Analysis
- max time kernel
115s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_4475091b66449ac144103029738fcea5_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_4475091b66449ac144103029738fcea5_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_4475091b66449ac144103029738fcea5_elex_mafia.exe
- Size 518KB
- Sample260809-vfpblsan2t
- SHA256 af741365235a7d66d44db24d33cdff6e7e265a64fb6452500d2a6a535ff13ad7
- MD5 4475091b66449ac144103029738fcea5
- SHA1 8f2e6b9ecec8e5fdc10dfc55780232aea9a9a802
- SHA512 156985b296907c48c16d0501d2a4f9568fe9418eb12166ba58a61d258ed97608dd5506982d083c1ea7afb2a5cf4c2890183c39249945eff105b7047fd2392e4f
- SSDEEP 12288:Jf1yBOtIZdpH+IKe5qV4c+KkZvqEWTy5dkb01UeYlWvDeeH+NZ:JfcBzZdcIK4qV4LtS45IWLeeeN
- TLSH T160B4F116B984C036E59302708A52EB961D3A7D759B3A64CBBBD4367E6FB03D1C634307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2500 E71A.tmp 2776 E7C6.tmp 4052 E8FF.tmp 2952 E9F9.tmp 3980 EAF3.tmp 4444 EBED.tmp 4728 ED54.tmp 4772 EE5E.tmp 2732 EF77.tmp 4892 F042.tmp 5036 F15B.tmp 2616 F255.tmp 2976 F320.tmp 2000 F3EB.tmp 3780 F4E5.tmp 5880 F60E.tmp 1508 F728.tmp 1776 F822.tmp 3080 F91C.tmp 3880 F9E7.tmp 3556 FAE1.tmp 2132 FBDB.tmp 5768 FCD5.tmp 3252 FDFE.tmp 2172 FF17.tmp 3000 20.tmp 1104 EC.tmp 2904 1C6.tmp 2900 2A1.tmp 8 38B.tmp 1012 476.tmp 5172 5AE.tmp 1932 6B8.tmp 2088 735.tmp 4776 7D1.tmp 3152 85E.tmp 5040 8FA.tmp 5016 987.tmp 1188 A23.tmp 2916 AB0.tmp 1500 B2D.tmp 5728 C17.tmp 4640 CB3.tmp 848 D30.tmp 6068 DDC.tmp 5852 E78.tmp 1008 F34.tmp 4812 FFF.tmp 4740 10BA.tmp 2752 1128.tmp 6116 11A5.tmp 4616 1212.tmp 4972 129F.tmp 5088 131C.tmp 1960 13A8.tmp 1768 1464.tmp 3340 14E1.tmp 5292 155E.tmp 3376 1629.tmp 3996 16C5.tmp 3988 1752.tmp 1160 17FE.tmp 6096 187B.tmp 5028 1907.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4070.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 545B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 416A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 638E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 594D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 610D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20C3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4352 wrote to memory of 2500 4352 2026-08-09_4475091b66449ac144103029738fcea5_elex_mafia.exe 88 PID 2500 wrote to memory of 2776 2500 E71A.tmp 89 PID 2776 wrote to memory of 4052 2776 E7C6.tmp 90 PID 4052 wrote to memory of 2952 4052 E8FF.tmp 91 PID 2952 wrote to memory of 3980 2952 E9F9.tmp 92 PID 3980 wrote to memory of 4444 3980 EAF3.tmp 93 PID 4444 wrote to memory of 4728 4444 EBED.tmp 94 PID 4728 wrote to memory of 4772 4728 ED54.tmp 95 PID 4772 wrote to memory of 2732 4772 EE5E.tmp 96 PID 2732 wrote to memory of 4892 2732 EF77.tmp 97 PID 4892 wrote to memory of 5036 4892 F042.tmp 98 PID 5036 wrote to memory of 2616 5036 F15B.tmp 99 PID 2616 wrote to memory of 2976 2616 F255.tmp 100 PID 2976 wrote to memory of 2000 2976 F320.tmp 101 PID 2000 wrote to memory of 3780 2000 F3EB.tmp 102 PID 3780 wrote to memory of 5880 3780 F4E5.tmp 103 PID 5880 wrote to memory of 1508 5880 F60E.tmp 104 PID 1508 wrote to memory of 1776 1508 F728.tmp 105 PID 1776 wrote to memory of 3080 1776 F822.tmp 106 PID 3080 wrote to memory of 3880 3080 F91C.tmp 107 PID 3880 wrote to memory of 3556 3880 F9E7.tmp 108 PID 3556 wrote to memory of 2132 3556 FAE1.tmp 109 PID 2132 wrote to memory of 5768 2132 FBDB.tmp 110 PID 5768 wrote to memory of 3252 5768 FCD5.tmp 111 PID 3252 wrote to memory of 2172 3252 FDFE.tmp 112 PID 2172 wrote to memory of 3000 2172 FF17.tmp 113 PID 3000 wrote to memory of 1104 3000 20.tmp 114 PID 1104 wrote to memory of 2904 1104 EC.tmp 115 PID 2904 wrote to memory of 2900 2904 1C6.tmp 116 PID 2900 wrote to memory of 8 2900 2A1.tmp 117 PID 8 wrote to memory of 1012 8 38B.tmp 118 PID 1012 wrote to memory of 5172 1012 476.tmp 119 PID 5172 wrote to memory of 1932 5172 5AE.tmp 120 PID 1932 wrote to memory of 2088 1932 6B8.tmp 121 PID 2088 wrote to memory of 4776 2088 735.tmp 122 PID 4776 wrote to memory of 3152 4776 7D1.tmp 123 PID 3152 wrote to memory of 5040 3152 85E.tmp 124 PID 5040 wrote to memory of 5016 5040 8FA.tmp 125 PID 5016 wrote to memory of 1188 5016 987.tmp 126 PID 1188 wrote to memory of 2916 1188 A23.tmp 127 PID 2916 wrote to memory of 1500 2916 AB0.tmp 128 PID 1500 wrote to memory of 5728 1500 B2D.tmp 129 PID 5728 wrote to memory of 4640 5728 C17.tmp 130 PID 4640 wrote to memory of 848 4640 CB3.tmp 131 PID 848 wrote to memory of 6068 848 D30.tmp 132 PID 6068 wrote to memory of 5852 6068 DDC.tmp 133 PID 5852 wrote to memory of 1008 5852 E78.tmp 134 PID 1008 wrote to memory of 4812 1008 F34.tmp 135 PID 4812 wrote to memory of 4740 4812 FFF.tmp 136 PID 4740 wrote to memory of 2752 4740 10BA.tmp 137 PID 2752 wrote to memory of 6116 2752 1128.tmp 138 PID 6116 wrote to memory of 4616 6116 11A5.tmp 139 PID 4616 wrote to memory of 4972 4616 1212.tmp 140 PID 4972 wrote to memory of 5088 4972 129F.tmp 141 PID 5088 wrote to memory of 1960 5088 131C.tmp 142 PID 1960 wrote to memory of 1768 1960 13A8.tmp 143 PID 1768 wrote to memory of 3340 1768 1464.tmp 144 PID 3340 wrote to memory of 5292 3340 14E1.tmp 145 PID 5292 wrote to memory of 3376 5292 155E.tmp 146 PID 3376 wrote to memory of 3996 3376 1629.tmp 147 PID 3996 wrote to memory of 3988 3996 16C5.tmp 148 PID 3988 wrote to memory of 1160 3988 1752.tmp 149 PID 1160 wrote to memory of 6096 1160 17FE.tmp 150 PID 6096 wrote to memory of 5028 6096 187B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_4475091b66449ac144103029738fcea5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4475091b66449ac144103029738fcea5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"C:\Users\Admin\AppData\Local\Temp\EAF3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"C:\Users\Admin\AppData\Local\Temp\EE5E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\EF77.tmp"C:\Users\Admin\AppData\Local\Temp\EF77.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\F042.tmp"C:\Users\Admin\AppData\Local\Temp\F042.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\F15B.tmp"C:\Users\Admin\AppData\Local\Temp\F15B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\F255.tmp"C:\Users\Admin\AppData\Local\Temp\F255.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\F60E.tmp"C:\Users\Admin\AppData\Local\Temp\F60E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\F728.tmp"C:\Users\Admin\AppData\Local\Temp\F728.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\F822.tmp"C:\Users\Admin\AppData\Local\Temp\F822.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\F91C.tmp"C:\Users\Admin\AppData\Local\Temp\F91C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"C:\Users\Admin\AppData\Local\Temp\FAE1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\1C6.tmp"C:\Users\Admin\AppData\Local\Temp\1C6.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2A1.tmp"C:\Users\Admin\AppData\Local\Temp\2A1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\38B.tmp"C:\Users\Admin\AppData\Local\Temp\38B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\476.tmp"C:\Users\Admin\AppData\Local\Temp\476.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\6B8.tmp"C:\Users\Admin\AppData\Local\Temp\6B8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\735.tmp"C:\Users\Admin\AppData\Local\Temp\735.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\7D1.tmp"C:\Users\Admin\AppData\Local\Temp\7D1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\B2D.tmp"C:\Users\Admin\AppData\Local\Temp\B2D.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\CB3.tmp"C:\Users\Admin\AppData\Local\Temp\CB3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\D30.tmp"C:\Users\Admin\AppData\Local\Temp\D30.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\DDC.tmp"C:\Users\Admin\AppData\Local\Temp\DDC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\10BA.tmp"C:\Users\Admin\AppData\Local\Temp\10BA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\1212.tmp"C:\Users\Admin\AppData\Local\Temp\1212.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\129F.tmp"C:\Users\Admin\AppData\Local\Temp\129F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\13A8.tmp"C:\Users\Admin\AppData\Local\Temp\13A8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\14E1.tmp"C:\Users\Admin\AppData\Local\Temp\14E1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\1629.tmp"C:\Users\Admin\AppData\Local\Temp\1629.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\16C5.tmp"C:\Users\Admin\AppData\Local\Temp\16C5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\17FE.tmp"C:\Users\Admin\AppData\Local\Temp\17FE.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\187B.tmp"C:\Users\Admin\AppData\Local\Temp\187B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\1907.tmp"C:\Users\Admin\AppData\Local\Temp\1907.tmp"65⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"66⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"67⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"68⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"69⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\1B98.tmp"C:\Users\Admin\AppData\Local\Temp\1B98.tmp"70⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\1C15.tmp"C:\Users\Admin\AppData\Local\Temp\1C15.tmp"71⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"C:\Users\Admin\AppData\Local\Temp\1CA1.tmp"72⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"73⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"74⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\1E18.tmp"C:\Users\Admin\AppData\Local\Temp\1E18.tmp"75⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\1F32.tmp"C:\Users\Admin\AppData\Local\Temp\1F32.tmp"77⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"78⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"79⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"80⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"81⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\21A3.tmp"C:\Users\Admin\AppData\Local\Temp\21A3.tmp"82⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\2210.tmp"C:\Users\Admin\AppData\Local\Temp\2210.tmp"83⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\22AC.tmp"C:\Users\Admin\AppData\Local\Temp\22AC.tmp"84⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"86⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2423.tmp"C:\Users\Admin\AppData\Local\Temp\2423.tmp"87⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"88⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"89⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"90⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\2656.tmp"C:\Users\Admin\AppData\Local\Temp\2656.tmp"91⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\26D3.tmp"C:\Users\Admin\AppData\Local\Temp\26D3.tmp"92⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"93⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\27CD.tmp"C:\Users\Admin\AppData\Local\Temp\27CD.tmp"94⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"95⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\28F6.tmp"C:\Users\Admin\AppData\Local\Temp\28F6.tmp"96⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"97⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\29F0.tmp"C:\Users\Admin\AppData\Local\Temp\29F0.tmp"98⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"99⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\2B09.tmp"C:\Users\Admin\AppData\Local\Temp\2B09.tmp"100⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\2B95.tmp"C:\Users\Admin\AppData\Local\Temp\2B95.tmp"101⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\2C12.tmp"C:\Users\Admin\AppData\Local\Temp\2C12.tmp"102⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\2C80.tmp"C:\Users\Admin\AppData\Local\Temp\2C80.tmp"103⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\2D3B.tmp"C:\Users\Admin\AppData\Local\Temp\2D3B.tmp"104⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2E06.tmp"C:\Users\Admin\AppData\Local\Temp\2E06.tmp"105⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"106⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"108⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\300A.tmp"C:\Users\Admin\AppData\Local\Temp\300A.tmp"109⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\3087.tmp"C:\Users\Admin\AppData\Local\Temp\3087.tmp"110⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\30E5.tmp"C:\Users\Admin\AppData\Local\Temp\30E5.tmp"111⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\3181.tmp"C:\Users\Admin\AppData\Local\Temp\3181.tmp"112⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\31DF.tmp"C:\Users\Admin\AppData\Local\Temp\31DF.tmp"113⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\327B.tmp"C:\Users\Admin\AppData\Local\Temp\327B.tmp"114⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\3308.tmp"C:\Users\Admin\AppData\Local\Temp\3308.tmp"115⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\3375.tmp"C:\Users\Admin\AppData\Local\Temp\3375.tmp"116⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\33F2.tmp"C:\Users\Admin\AppData\Local\Temp\33F2.tmp"117⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\347F.tmp"C:\Users\Admin\AppData\Local\Temp\347F.tmp"118⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\34EC.tmp"C:\Users\Admin\AppData\Local\Temp\34EC.tmp"119⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\3569.tmp"C:\Users\Admin\AppData\Local\Temp\3569.tmp"120⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\35E6.tmp"C:\Users\Admin\AppData\Local\Temp\35E6.tmp"121⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3663.tmp"C:\Users\Admin\AppData\Local\Temp\3663.tmp"122⤵PID:3192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-