Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-15_f6876d93b08ac08cc32a2b70839a0ad2_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-15_f6876d93b08ac08cc32a2b70839a0ad2_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-15_f6876d93b08ac08cc32a2b70839a0ad2_elex_mafia.exe
- Size 518KB
- Sample261015-2nw5raee97
- SHA256 ec5c3149c925e6dc68117b63bcbaecd7d0f4d0baf327207e64c87abeb3284fdf
- MD5 f6876d93b08ac08cc32a2b70839a0ad2
- SHA1 9543f104940e614990d2375ac09ac87ddc6fcff9
- SHA512 5c38ca1a886530d0ac989e226a1a151e280d3484417f9e6814220b10abb67af3e328638809afadc1de3f2416104387332487696ce6af66207326f70adb969910
- SSDEEP 12288:anTpha1Jvu4KyqzjCr4UPEsZ+EQ+eL5b8gMNZ:any1E4KnzjC4KF5G8xN
- TLSH T18AB4F020B885C032F5D201384A66EBA6593E7D705B65A5CB3BC4367DAFB12C1E77930B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4108 D481.tmp 4984 D53D.tmp 3268 D5BA.tmp 5272 D656.tmp 4996 D712.tmp 2976 D7DD.tmp 5812 D85A.tmp 3188 D8F6.tmp 2260 D973.tmp 5044 DA3E.tmp 5936 DB28.tmp 4088 DC13.tmp 4488 DCEE.tmp 2392 DDA9.tmp 5428 DE36.tmp 5244 DEF1.tmp 4204 DFBC.tmp 236 E059.tmp 4300 E124.tmp 4256 E1B0.tmp 916 E28B.tmp 828 E356.tmp 5624 E412.tmp 5236 E4CD.tmp 5232 E55A.tmp 1532 E5E6.tmp 1484 E6C1.tmp 2724 E76D.tmp 4288 E838.tmp 788 E8B5.tmp 3536 E980.tmp 3504 E9EE.tmp 5408 EAA9.tmp 5848 EB17.tmp 5224 EB84.tmp 5956 EBF1.tmp 5356 EC6E.tmp 2500 ECFB.tmp 3048 ED68.tmp 1420 EDF5.tmp 4232 EE82.tmp 5992 EEFF.tmp 6080 EF7C.tmp 6108 F008.tmp 5500 F076.tmp 984 F0D3.tmp 1596 F150.tmp 6036 F1CD.tmp 4272 F22B.tmp 1904 F2A8.tmp 2672 F325.tmp 1964 F3B2.tmp 2536 F43E.tmp 4404 F4AC.tmp 5620 F519.tmp 2960 F586.tmp 5944 F603.tmp 4252 F680.tmp 3512 F73C.tmp 3960 F7A9.tmp 2956 F836.tmp 5588 F8B3.tmp 3468 F920.tmp 5252 F99D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B58B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F38E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6529.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4476 wrote to memory of 4108 4476 2026-10-15_f6876d93b08ac08cc32a2b70839a0ad2_elex_mafia.exe 89 PID 4108 wrote to memory of 4984 4108 D481.tmp 90 PID 4984 wrote to memory of 3268 4984 D53D.tmp 91 PID 3268 wrote to memory of 5272 3268 D5BA.tmp 92 PID 5272 wrote to memory of 4996 5272 D656.tmp 93 PID 4996 wrote to memory of 2976 4996 D712.tmp 94 PID 2976 wrote to memory of 5812 2976 D7DD.tmp 95 PID 5812 wrote to memory of 3188 5812 D85A.tmp 96 PID 3188 wrote to memory of 2260 3188 D8F6.tmp 97 PID 2260 wrote to memory of 5044 2260 D973.tmp 98 PID 5044 wrote to memory of 5936 5044 DA3E.tmp 99 PID 5936 wrote to memory of 4088 5936 DB28.tmp 100 PID 4088 wrote to memory of 4488 4088 DC13.tmp 101 PID 4488 wrote to memory of 2392 4488 DCEE.tmp 102 PID 2392 wrote to memory of 5428 2392 DDA9.tmp 103 PID 5428 wrote to memory of 5244 5428 DE36.tmp 104 PID 5244 wrote to memory of 4204 5244 DEF1.tmp 105 PID 4204 wrote to memory of 236 4204 DFBC.tmp 106 PID 236 wrote to memory of 4300 236 E059.tmp 107 PID 4300 wrote to memory of 4256 4300 E124.tmp 108 PID 4256 wrote to memory of 916 4256 E1B0.tmp 109 PID 916 wrote to memory of 828 916 E28B.tmp 110 PID 828 wrote to memory of 5624 828 E356.tmp 111 PID 5624 wrote to memory of 5236 5624 E412.tmp 112 PID 5236 wrote to memory of 5232 5236 E4CD.tmp 113 PID 5232 wrote to memory of 1532 5232 E55A.tmp 114 PID 1532 wrote to memory of 1484 1532 E5E6.tmp 115 PID 1484 wrote to memory of 2724 1484 E6C1.tmp 116 PID 2724 wrote to memory of 4288 2724 E76D.tmp 117 PID 4288 wrote to memory of 788 4288 E838.tmp 118 PID 788 wrote to memory of 3536 788 E8B5.tmp 119 PID 3536 wrote to memory of 3504 3536 E980.tmp 120 PID 3504 wrote to memory of 5408 3504 E9EE.tmp 121 PID 5408 wrote to memory of 5848 5408 EAA9.tmp 122 PID 5848 wrote to memory of 5224 5848 EB17.tmp 123 PID 5224 wrote to memory of 5956 5224 EB84.tmp 124 PID 5956 wrote to memory of 5356 5956 EBF1.tmp 125 PID 5356 wrote to memory of 2500 5356 EC6E.tmp 126 PID 2500 wrote to memory of 3048 2500 ECFB.tmp 127 PID 3048 wrote to memory of 1420 3048 ED68.tmp 128 PID 1420 wrote to memory of 4232 1420 EDF5.tmp 129 PID 4232 wrote to memory of 5992 4232 EE82.tmp 130 PID 5992 wrote to memory of 6080 5992 EEFF.tmp 131 PID 6080 wrote to memory of 6108 6080 EF7C.tmp 132 PID 6108 wrote to memory of 5500 6108 F008.tmp 133 PID 5500 wrote to memory of 984 5500 F076.tmp 134 PID 984 wrote to memory of 1596 984 F0D3.tmp 135 PID 1596 wrote to memory of 6036 1596 F150.tmp 136 PID 6036 wrote to memory of 4272 6036 F1CD.tmp 137 PID 4272 wrote to memory of 1904 4272 F22B.tmp 138 PID 1904 wrote to memory of 2672 1904 F2A8.tmp 139 PID 2672 wrote to memory of 1964 2672 F325.tmp 140 PID 1964 wrote to memory of 2536 1964 F3B2.tmp 141 PID 2536 wrote to memory of 4404 2536 F43E.tmp 142 PID 4404 wrote to memory of 5620 4404 F4AC.tmp 143 PID 5620 wrote to memory of 2960 5620 F519.tmp 144 PID 2960 wrote to memory of 5944 2960 F586.tmp 145 PID 5944 wrote to memory of 4252 5944 F603.tmp 146 PID 4252 wrote to memory of 3512 4252 F680.tmp 147 PID 3512 wrote to memory of 3960 3512 F73C.tmp 148 PID 3960 wrote to memory of 2956 3960 F7A9.tmp 149 PID 2956 wrote to memory of 5588 2956 F836.tmp 150 PID 5588 wrote to memory of 3468 5588 F8B3.tmp 151 PID 3468 wrote to memory of 5252 3468 F920.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_f6876d93b08ac08cc32a2b70839a0ad2_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f6876d93b08ac08cc32a2b70839a0ad2_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\D481.tmp"C:\Users\Admin\AppData\Local\Temp\D481.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\D53D.tmp"C:\Users\Admin\AppData\Local\Temp\D53D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\D656.tmp"C:\Users\Admin\AppData\Local\Temp\D656.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\D85A.tmp"C:\Users\Admin\AppData\Local\Temp\D85A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\D973.tmp"C:\Users\Admin\AppData\Local\Temp\D973.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"C:\Users\Admin\AppData\Local\Temp\DA3E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\DB28.tmp"C:\Users\Admin\AppData\Local\Temp\DB28.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\DC13.tmp"C:\Users\Admin\AppData\Local\Temp\DC13.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\DE36.tmp"C:\Users\Admin\AppData\Local\Temp\DE36.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\E059.tmp"C:\Users\Admin\AppData\Local\Temp\E059.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\E124.tmp"C:\Users\Admin\AppData\Local\Temp\E124.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\E356.tmp"C:\Users\Admin\AppData\Local\Temp\E356.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\E412.tmp"C:\Users\Admin\AppData\Local\Temp\E412.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\E55A.tmp"C:\Users\Admin\AppData\Local\Temp\E55A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"C:\Users\Admin\AppData\Local\Temp\E6C1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\E76D.tmp"C:\Users\Admin\AppData\Local\Temp\E76D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\E838.tmp"C:\Users\Admin\AppData\Local\Temp\E838.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\E980.tmp"C:\Users\Admin\AppData\Local\Temp\E980.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"C:\Users\Admin\AppData\Local\Temp\EAA9.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\EB17.tmp"C:\Users\Admin\AppData\Local\Temp\EB17.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\EB84.tmp"C:\Users\Admin\AppData\Local\Temp\EB84.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"C:\Users\Admin\AppData\Local\Temp\ECFB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\F008.tmp"C:\Users\Admin\AppData\Local\Temp\F008.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\F076.tmp"C:\Users\Admin\AppData\Local\Temp\F076.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\F0D3.tmp"C:\Users\Admin\AppData\Local\Temp\F0D3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\F150.tmp"C:\Users\Admin\AppData\Local\Temp\F150.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"C:\Users\Admin\AppData\Local\Temp\F1CD.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\F22B.tmp"C:\Users\Admin\AppData\Local\Temp\F22B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"C:\Users\Admin\AppData\Local\Temp\F4AC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\F519.tmp"C:\Users\Admin\AppData\Local\Temp\F519.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\F603.tmp"C:\Users\Admin\AppData\Local\Temp\F603.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\F680.tmp"C:\Users\Admin\AppData\Local\Temp\F680.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\F73C.tmp"C:\Users\Admin\AppData\Local\Temp\F73C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\F836.tmp"C:\Users\Admin\AppData\Local\Temp\F836.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\F920.tmp"C:\Users\Admin\AppData\Local\Temp\F920.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\F99D.tmp"C:\Users\Admin\AppData\Local\Temp\F99D.tmp"65⤵
- Executes dropped EXE
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\FA2A.tmp"C:\Users\Admin\AppData\Local\Temp\FA2A.tmp"66⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\FA97.tmp"C:\Users\Admin\AppData\Local\Temp\FA97.tmp"67⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\FB24.tmp"C:\Users\Admin\AppData\Local\Temp\FB24.tmp"68⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"69⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\FC3D.tmp"C:\Users\Admin\AppData\Local\Temp\FC3D.tmp"70⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"71⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"72⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"73⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"74⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"75⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\FEED.tmp"C:\Users\Admin\AppData\Local\Temp\FEED.tmp"76⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\FF6A.tmp"C:\Users\Admin\AppData\Local\Temp\FF6A.tmp"77⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"C:\Users\Admin\AppData\Local\Temp\FFD7.tmp"78⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\44.tmp"C:\Users\Admin\AppData\Local\Temp\44.tmp"79⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"80⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\14E.tmp"C:\Users\Admin\AppData\Local\Temp\14E.tmp"81⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\1DB.tmp"C:\Users\Admin\AppData\Local\Temp\1DB.tmp"82⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"83⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\2A6.tmp"C:\Users\Admin\AppData\Local\Temp\2A6.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\313.tmp"C:\Users\Admin\AppData\Local\Temp\313.tmp"85⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\381.tmp"C:\Users\Admin\AppData\Local\Temp\381.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\3FE.tmp"C:\Users\Admin\AppData\Local\Temp\3FE.tmp"87⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\48A.tmp"C:\Users\Admin\AppData\Local\Temp\48A.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4F8.tmp"C:\Users\Admin\AppData\Local\Temp\4F8.tmp"89⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\565.tmp"C:\Users\Admin\AppData\Local\Temp\565.tmp"90⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\5D2.tmp"C:\Users\Admin\AppData\Local\Temp\5D2.tmp"91⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\64F.tmp"C:\Users\Admin\AppData\Local\Temp\64F.tmp"92⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\6BD.tmp"C:\Users\Admin\AppData\Local\Temp\6BD.tmp"93⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"94⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\7A7.tmp"C:\Users\Admin\AppData\Local\Temp\7A7.tmp"95⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"96⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\891.tmp"C:\Users\Admin\AppData\Local\Temp\891.tmp"97⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"98⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\98B.tmp"C:\Users\Admin\AppData\Local\Temp\98B.tmp"99⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\9F9.tmp"C:\Users\Admin\AppData\Local\Temp\9F9.tmp"100⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"101⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\B12.tmp"C:\Users\Admin\AppData\Local\Temp\B12.tmp"102⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\B8F.tmp"C:\Users\Admin\AppData\Local\Temp\B8F.tmp"103⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\C0C.tmp"C:\Users\Admin\AppData\Local\Temp\C0C.tmp"104⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\C99.tmp"C:\Users\Admin\AppData\Local\Temp\C99.tmp"105⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\D16.tmp"C:\Users\Admin\AppData\Local\Temp\D16.tmp"106⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\D83.tmp"C:\Users\Admin\AppData\Local\Temp\D83.tmp"107⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\E1F.tmp"C:\Users\Admin\AppData\Local\Temp\E1F.tmp"108⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\E9C.tmp"C:\Users\Admin\AppData\Local\Temp\E9C.tmp"109⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\FA6.tmp"C:\Users\Admin\AppData\Local\Temp\FA6.tmp"111⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\1013.tmp"C:\Users\Admin\AppData\Local\Temp\1013.tmp"112⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\Users\Admin\AppData\Local\Temp\10FE.tmp"C:\Users\Admin\AppData\Local\Temp\10FE.tmp"114⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\118A.tmp"C:\Users\Admin\AppData\Local\Temp\118A.tmp"115⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\1217.tmp"C:\Users\Admin\AppData\Local\Temp\1217.tmp"116⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\1275.tmp"C:\Users\Admin\AppData\Local\Temp\1275.tmp"117⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"118⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"119⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\13DC.tmp"C:\Users\Admin\AppData\Local\Temp\13DC.tmp"120⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\1469.tmp"C:\Users\Admin\AppData\Local\Temp\1469.tmp"121⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\14F5.tmp"C:\Users\Admin\AppData\Local\Temp\14F5.tmp"122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-