Analysis
- max time kernel
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-23_bf695cd713a7e0a08016af0092945ed5_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-23_bf695cd713a7e0a08016af0092945ed5_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-23_bf695cd713a7e0a08016af0092945ed5_elex_mafia.exe
- Size 518KB
- Sample261023-jprbsaav9s
- SHA256 087253ffe35601505f26c8a22528ac1c1e65825cba994ddc49b4199bd60b9748
- MD5 bf695cd713a7e0a08016af0092945ed5
- SHA1 31124e7868d28dfc0a30f9e6adb1e5fc4de4fa52
- SHA512 056342acc36a4ba6d620d22d84a976be9d49c93749200079db8eab9e273c7abb5360300a1ba789059a75332f1a4ff42a3cde7d14e37e8f1674e67221da210f8d
- SSDEEP 12288:anTpha1Jvu405vfA/7prhZJ8T+guqjS+NcvVEXDMNZ:any1E4yY/7Ipuq++NuVA4N
- TLSH T157B4F112B945C032F2D211394F66EB61583A7CB69B2AA4C37F94363E6EB17D1D27430B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1896 D121.tmp 4740 D20C.tmp 4904 D325.tmp 3968 D392.tmp 2160 D45D.tmp 3132 D4FA.tmp 4748 D5A5.tmp 4788 D632.tmp 1816 D6CE.tmp 1880 D7B9.tmp 384 D855.tmp 4116 D8E2.tmp 4148 D98D.tmp 3060 DA2A.tmp 924 DAD6.tmp 4892 DB81.tmp 5140 DC2D.tmp 5968 DCE9.tmp 3792 DD66.tmp 5688 DE41.tmp 5732 DECD.tmp 2992 DF5A.tmp 3816 DFE6.tmp 2196 E0B2.tmp 4256 E19C.tmp 884 E277.tmp 4692 E313.tmp 4324 E3A0.tmp 3292 E45B.tmp 4332 E507.tmp 6136 E601.tmp 1184 E6AD.tmp 4564 E739.tmp 4556 E7B6.tmp 2296 E833.tmp 5656 E891.tmp 4444 E91E.tmp 1808 E97C.tmp 1484 E9E9.tmp 4000 EA66.tmp 3600 EAE3.tmp 4516 EB7F.tmp 5224 EC0C.tmp 5956 EC79.tmp 4568 ECE7.tmp 1168 ED54.tmp 4772 EDD1.tmp 3124 EE3E.tmp 2056 EEAC.tmp 5996 EF58.tmp 3172 EFB5.tmp 5748 F023.tmp 3196 F0A0.tmp 4468 F13C.tmp 4868 F1A9.tmp 3492 F236.tmp 5372 F2A3.tmp 3440 F320.tmp 720 F3BD.tmp 5580 F449.tmp 5936 F4B7.tmp 4612 F514.tmp 5400 F591.tmp 2720 F60E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C209.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 155E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2046.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 926E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8960.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 466C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A941.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F30C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B42E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1896 4664 2026-10-23_bf695cd713a7e0a08016af0092945ed5_elex_mafia.exe 88 PID 1896 wrote to memory of 4740 1896 D121.tmp 89 PID 4740 wrote to memory of 4904 4740 D20C.tmp 90 PID 4904 wrote to memory of 3968 4904 D325.tmp 91 PID 3968 wrote to memory of 2160 3968 D392.tmp 92 PID 2160 wrote to memory of 3132 2160 D45D.tmp 93 PID 3132 wrote to memory of 4748 3132 D4FA.tmp 94 PID 4748 wrote to memory of 4788 4748 D5A5.tmp 95 PID 4788 wrote to memory of 1816 4788 D632.tmp 96 PID 1816 wrote to memory of 1880 1816 D6CE.tmp 97 PID 1880 wrote to memory of 384 1880 D7B9.tmp 98 PID 384 wrote to memory of 4116 384 D855.tmp 99 PID 4116 wrote to memory of 4148 4116 D8E2.tmp 100 PID 4148 wrote to memory of 3060 4148 D98D.tmp 101 PID 3060 wrote to memory of 924 3060 DA2A.tmp 102 PID 924 wrote to memory of 4892 924 DAD6.tmp 103 PID 4892 wrote to memory of 5140 4892 DB81.tmp 104 PID 5140 wrote to memory of 5968 5140 DC2D.tmp 105 PID 5968 wrote to memory of 3792 5968 DCE9.tmp 106 PID 3792 wrote to memory of 5688 3792 DD66.tmp 107 PID 5688 wrote to memory of 5732 5688 DE41.tmp 108 PID 5732 wrote to memory of 2992 5732 DECD.tmp 109 PID 2992 wrote to memory of 3816 2992 DF5A.tmp 110 PID 3816 wrote to memory of 2196 3816 DFE6.tmp 111 PID 2196 wrote to memory of 4256 2196 E0B2.tmp 112 PID 4256 wrote to memory of 884 4256 E19C.tmp 113 PID 884 wrote to memory of 4692 884 E277.tmp 114 PID 4692 wrote to memory of 4324 4692 E313.tmp 115 PID 4324 wrote to memory of 3292 4324 E3A0.tmp 116 PID 3292 wrote to memory of 4332 3292 E45B.tmp 117 PID 4332 wrote to memory of 6136 4332 E507.tmp 118 PID 6136 wrote to memory of 1184 6136 E601.tmp 119 PID 1184 wrote to memory of 4564 1184 E6AD.tmp 120 PID 4564 wrote to memory of 4556 4564 E739.tmp 121 PID 4556 wrote to memory of 2296 4556 E7B6.tmp 122 PID 2296 wrote to memory of 5656 2296 E833.tmp 123 PID 5656 wrote to memory of 4444 5656 E891.tmp 124 PID 4444 wrote to memory of 1808 4444 E91E.tmp 125 PID 1808 wrote to memory of 1484 1808 E97C.tmp 126 PID 1484 wrote to memory of 4000 1484 E9E9.tmp 127 PID 4000 wrote to memory of 3600 4000 EA66.tmp 128 PID 3600 wrote to memory of 4516 3600 EAE3.tmp 129 PID 4516 wrote to memory of 5224 4516 EB7F.tmp 130 PID 5224 wrote to memory of 5956 5224 EC0C.tmp 131 PID 5956 wrote to memory of 4568 5956 EC79.tmp 132 PID 4568 wrote to memory of 1168 4568 ECE7.tmp 133 PID 1168 wrote to memory of 4772 1168 ED54.tmp 134 PID 4772 wrote to memory of 3124 4772 EDD1.tmp 135 PID 3124 wrote to memory of 2056 3124 EE3E.tmp 136 PID 2056 wrote to memory of 5996 2056 EEAC.tmp 137 PID 5996 wrote to memory of 3172 5996 EF58.tmp 138 PID 3172 wrote to memory of 5748 3172 EFB5.tmp 139 PID 5748 wrote to memory of 3196 5748 F023.tmp 140 PID 3196 wrote to memory of 4468 3196 F0A0.tmp 141 PID 4468 wrote to memory of 4868 4468 F13C.tmp 142 PID 4868 wrote to memory of 3492 4868 F1A9.tmp 143 PID 3492 wrote to memory of 5372 3492 F236.tmp 144 PID 5372 wrote to memory of 3440 5372 F2A3.tmp 145 PID 3440 wrote to memory of 720 3440 F320.tmp 146 PID 720 wrote to memory of 5580 720 F3BD.tmp 147 PID 5580 wrote to memory of 5936 5580 F449.tmp 148 PID 5936 wrote to memory of 4612 5936 F4B7.tmp 149 PID 4612 wrote to memory of 5400 4612 F514.tmp 150 PID 5400 wrote to memory of 2720 5400 F591.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_bf695cd713a7e0a08016af0092945ed5_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_bf695cd713a7e0a08016af0092945ed5_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\D20C.tmp"C:\Users\Admin\AppData\Local\Temp\D20C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\D325.tmp"C:\Users\Admin\AppData\Local\Temp\D325.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\D392.tmp"C:\Users\Admin\AppData\Local\Temp\D392.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\D45D.tmp"C:\Users\Admin\AppData\Local\Temp\D45D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\D5A5.tmp"C:\Users\Admin\AppData\Local\Temp\D5A5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\D632.tmp"C:\Users\Admin\AppData\Local\Temp\D632.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"C:\Users\Admin\AppData\Local\Temp\DAD6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\DB81.tmp"C:\Users\Admin\AppData\Local\Temp\DB81.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"C:\Users\Admin\AppData\Local\Temp\DC2D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"C:\Users\Admin\AppData\Local\Temp\DCE9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\DD66.tmp"C:\Users\Admin\AppData\Local\Temp\DD66.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\DE41.tmp"C:\Users\Admin\AppData\Local\Temp\DE41.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\E277.tmp"C:\Users\Admin\AppData\Local\Temp\E277.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"C:\Users\Admin\AppData\Local\Temp\E3A0.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\E601.tmp"C:\Users\Admin\AppData\Local\Temp\E601.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"C:\Users\Admin\AppData\Local\Temp\E6AD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\E739.tmp"C:\Users\Admin\AppData\Local\Temp\E739.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\E833.tmp"C:\Users\Admin\AppData\Local\Temp\E833.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\E891.tmp"C:\Users\Admin\AppData\Local\Temp\E891.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\E97C.tmp"C:\Users\Admin\AppData\Local\Temp\E97C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\EA66.tmp"C:\Users\Admin\AppData\Local\Temp\EA66.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"C:\Users\Admin\AppData\Local\Temp\EB7F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"C:\Users\Admin\AppData\Local\Temp\EC0C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\EC79.tmp"C:\Users\Admin\AppData\Local\Temp\EC79.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"C:\Users\Admin\AppData\Local\Temp\EDD1.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"C:\Users\Admin\AppData\Local\Temp\EE3E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\EF58.tmp"C:\Users\Admin\AppData\Local\Temp\EF58.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\F023.tmp"C:\Users\Admin\AppData\Local\Temp\F023.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"C:\Users\Admin\AppData\Local\Temp\F1A9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\F236.tmp"C:\Users\Admin\AppData\Local\Temp\F236.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\F514.tmp"C:\Users\Admin\AppData\Local\Temp\F514.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\F591.tmp"C:\Users\Admin\AppData\Local\Temp\F591.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\F60E.tmp"C:\Users\Admin\AppData\Local\Temp\F60E.tmp"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\F68B.tmp"C:\Users\Admin\AppData\Local\Temp\F68B.tmp"66⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"67⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"68⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\F802.tmp"C:\Users\Admin\AppData\Local\Temp\F802.tmp"69⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"70⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\F8DD.tmp"C:\Users\Admin\AppData\Local\Temp\F8DD.tmp"71⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\F94A.tmp"C:\Users\Admin\AppData\Local\Temp\F94A.tmp"72⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"73⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"74⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"75⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"76⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"77⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"78⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"79⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"80⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\FD23.tmp"C:\Users\Admin\AppData\Local\Temp\FD23.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"82⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"83⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"84⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"85⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"86⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"87⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\8E.tmp"C:\Users\Admin\AppData\Local\Temp\8E.tmp"88⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"89⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"90⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\214.tmp"C:\Users\Admin\AppData\Local\Temp\214.tmp"91⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"92⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"93⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\38B.tmp"C:\Users\Admin\AppData\Local\Temp\38B.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"95⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"96⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\4F3.tmp"C:\Users\Admin\AppData\Local\Temp\4F3.tmp"97⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\560.tmp"C:\Users\Admin\AppData\Local\Temp\560.tmp"98⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"100⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6F6.tmp"C:\Users\Admin\AppData\Local\Temp\6F6.tmp"101⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\793.tmp"C:\Users\Admin\AppData\Local\Temp\793.tmp"102⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"103⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"104⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\90A.tmp"C:\Users\Admin\AppData\Local\Temp\90A.tmp"105⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"106⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\A04.tmp"C:\Users\Admin\AppData\Local\Temp\A04.tmp"107⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\A81.tmp"C:\Users\Admin\AppData\Local\Temp\A81.tmp"108⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"109⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"110⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"111⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\CA4.tmp"C:\Users\Admin\AppData\Local\Temp\CA4.tmp"112⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\D30.tmp"C:\Users\Admin\AppData\Local\Temp\D30.tmp"113⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"114⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\E49.tmp"C:\Users\Admin\AppData\Local\Temp\E49.tmp"115⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"116⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\F43.tmp"C:\Users\Admin\AppData\Local\Temp\F43.tmp"117⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\FE0.tmp"C:\Users\Admin\AppData\Local\Temp\FE0.tmp"118⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"119⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"120⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\1166.tmp"C:\Users\Admin\AppData\Local\Temp\1166.tmp"121⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\1203.tmp"C:\Users\Admin\AppData\Local\Temp\1203.tmp"122⤵PID:1700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-