Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/07/2026, 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_d641d5f24712ff24b1c79254371a598c_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_d641d5f24712ff24b1c79254371a598c_elex_mafia.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
General
- Target 2026-07-04_d641d5f24712ff24b1c79254371a598c_elex_mafia.exe
- Size 561KB
- Sample260704-vsctcaes9m
- SHA256 5b2920bd12219c254e4aeac6f79339c04e74226baf184d52d7265e6be3c7d41e
- MD5 d641d5f24712ff24b1c79254371a598c
- SHA1 1f6d8a0f00b5adffb0123d2e0f33daccd1945848
- SHA512 4f3962297d233f594c2ca456083fb7cf76f849446c7cd70d29751ce344d7e4af98ef3af4e071495ec609944d9956485d10514eb4d8e364ec38a2d5cb4915f9bc
- SSDEEP 6144:kPTkurf/m9KOzlMsPhYET0yhlwmYQ82t6WPS/4t1PldzeWWjZ8QW8+9ITHT6HPOQ:VuelPWET0yhpYUt6GA6ddEW59aOmDZuL
- TLSH T160C4DF11B2D8C835F1F31A340EF597A2093BBC629B74E9CB2784661D1EB12D1EA78713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3268 6DB9.tmp 1196 6E45.tmp 4152 6ED2.tmp 4124 6F5F.tmp 1904 6FBC.tmp 1576 701A.tmp 3160 7078.tmp 3824 70F5.tmp 1148 7172.tmp 2860 71EF.tmp 4680 725C.tmp 3436 72BA.tmp 5000 7318.tmp 4244 73B4.tmp 4488 7450.tmp 2488 74DD.tmp 1440 7589.tmp 208 7606.tmp 4576 7692.tmp 3948 771F.tmp 1180 776D.tmp 740 77DB.tmp 3588 7838.tmp 1788 78A6.tmp 1924 7913.tmp 1004 7961.tmp 2864 79BF.tmp 2172 7A1D.tmp 4956 7A6B.tmp 4692 7AF7.tmp 4548 7B55.tmp 4552 7BB3.tmp 852 7C11.tmp 3180 7C6E.tmp 4216 7CBD.tmp 752 7D1A.tmp 4172 7D68.tmp 1572 7DB7.tmp 4080 7E05.tmp 2524 7E53.tmp 5080 7EA1.tmp 1240 7EEF.tmp 4160 7F4D.tmp 2324 7F9B.tmp 1752 7FE9.tmp 4544 8037.tmp 432 8095.tmp 1016 80E3.tmp 4768 8131.tmp 2368 818F.tmp 2972 81DD.tmp 4300 823B.tmp 4272 8289.tmp 672 82D7.tmp 4512 8325.tmp 2416 8373.tmp 4320 83C1.tmp 2476 8410.tmp 4980 845E.tmp 1328 84BB.tmp 3080 850A.tmp 860 8567.tmp 4700 85C5.tmp 1212 8623.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 554A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D03C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4052 wrote to memory of 3268 4052 2026-07-04_d641d5f24712ff24b1c79254371a598c_elex_mafia.exe 85 PID 3268 wrote to memory of 1196 3268 6DB9.tmp 86 PID 1196 wrote to memory of 4152 1196 6E45.tmp 87 PID 4152 wrote to memory of 4124 4152 6ED2.tmp 88 PID 4124 wrote to memory of 1904 4124 6F5F.tmp 89 PID 1904 wrote to memory of 1576 1904 6FBC.tmp 90 PID 1576 wrote to memory of 3160 1576 701A.tmp 91 PID 3160 wrote to memory of 3824 3160 7078.tmp 93 PID 3824 wrote to memory of 1148 3824 70F5.tmp 94 PID 1148 wrote to memory of 2860 1148 7172.tmp 95 PID 2860 wrote to memory of 4680 2860 71EF.tmp 96 PID 4680 wrote to memory of 3436 4680 725C.tmp 98 PID 3436 wrote to memory of 5000 3436 72BA.tmp 100 PID 5000 wrote to memory of 4244 5000 7318.tmp 102 PID 4244 wrote to memory of 4488 4244 73B4.tmp 103 PID 4488 wrote to memory of 2488 4488 7450.tmp 104 PID 2488 wrote to memory of 1440 2488 74DD.tmp 105 PID 1440 wrote to memory of 208 1440 7589.tmp 106 PID 208 wrote to memory of 4576 208 7606.tmp 107 PID 4576 wrote to memory of 3948 4576 7692.tmp 108 PID 3948 wrote to memory of 1180 3948 771F.tmp 109 PID 1180 wrote to memory of 740 1180 776D.tmp 110 PID 740 wrote to memory of 3588 740 77DB.tmp 111 PID 3588 wrote to memory of 1788 3588 7838.tmp 112 PID 1788 wrote to memory of 1924 1788 78A6.tmp 113 PID 1924 wrote to memory of 1004 1924 7913.tmp 114 PID 1004 wrote to memory of 2864 1004 7961.tmp 115 PID 2864 wrote to memory of 2172 2864 79BF.tmp 116 PID 2172 wrote to memory of 4956 2172 7A1D.tmp 117 PID 4956 wrote to memory of 4692 4956 7A6B.tmp 118 PID 4692 wrote to memory of 4548 4692 7AF7.tmp 119 PID 4548 wrote to memory of 4552 4548 7B55.tmp 120 PID 4552 wrote to memory of 852 4552 7BB3.tmp 121 PID 852 wrote to memory of 3180 852 7C11.tmp 122 PID 3180 wrote to memory of 4216 3180 7C6E.tmp 123 PID 4216 wrote to memory of 752 4216 7CBD.tmp 124 PID 752 wrote to memory of 4172 752 7D1A.tmp 125 PID 4172 wrote to memory of 1572 4172 7D68.tmp 126 PID 1572 wrote to memory of 4080 1572 7DB7.tmp 127 PID 4080 wrote to memory of 2524 4080 7E05.tmp 128 PID 2524 wrote to memory of 5080 2524 7E53.tmp 129 PID 5080 wrote to memory of 1240 5080 7EA1.tmp 130 PID 1240 wrote to memory of 4160 1240 7EEF.tmp 131 PID 4160 wrote to memory of 2324 4160 7F4D.tmp 132 PID 2324 wrote to memory of 1752 2324 7F9B.tmp 133 PID 1752 wrote to memory of 4544 1752 7FE9.tmp 134 PID 4544 wrote to memory of 432 4544 8037.tmp 135 PID 432 wrote to memory of 1016 432 8095.tmp 136 PID 1016 wrote to memory of 4768 1016 80E3.tmp 137 PID 4768 wrote to memory of 2368 4768 8131.tmp 138 PID 2368 wrote to memory of 2972 2368 818F.tmp 139 PID 2972 wrote to memory of 4300 2972 81DD.tmp 140 PID 4300 wrote to memory of 4272 4300 823B.tmp 141 PID 4272 wrote to memory of 672 4272 8289.tmp 142 PID 672 wrote to memory of 4512 672 82D7.tmp 143 PID 4512 wrote to memory of 2416 4512 8325.tmp 144 PID 2416 wrote to memory of 4320 2416 8373.tmp 145 PID 4320 wrote to memory of 2476 4320 83C1.tmp 146 PID 2476 wrote to memory of 4980 2476 8410.tmp 147 PID 4980 wrote to memory of 1328 4980 845E.tmp 148 PID 1328 wrote to memory of 3080 1328 84BB.tmp 149 PID 3080 wrote to memory of 860 3080 850A.tmp 150 PID 860 wrote to memory of 4700 860 8567.tmp 151 PID 4700 wrote to memory of 1212 4700 85C5.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_d641d5f24712ff24b1c79254371a598c_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_d641d5f24712ff24b1c79254371a598c_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\701A.tmp"C:\Users\Admin\AppData\Local\Temp\701A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\7078.tmp"C:\Users\Admin\AppData\Local\Temp\7078.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\725C.tmp"C:\Users\Admin\AppData\Local\Temp\725C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\7318.tmp"C:\Users\Admin\AppData\Local\Temp\7318.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\771F.tmp"C:\Users\Admin\AppData\Local\Temp\771F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\77DB.tmp"C:\Users\Admin\AppData\Local\Temp\77DB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\78A6.tmp"C:\Users\Admin\AppData\Local\Temp\78A6.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\7913.tmp"C:\Users\Admin\AppData\Local\Temp\7913.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\7961.tmp"C:\Users\Admin\AppData\Local\Temp\7961.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\79BF.tmp"C:\Users\Admin\AppData\Local\Temp\79BF.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\7B55.tmp"C:\Users\Admin\AppData\Local\Temp\7B55.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\7C11.tmp"C:\Users\Admin\AppData\Local\Temp\7C11.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\7D68.tmp"C:\Users\Admin\AppData\Local\Temp\7D68.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7E53.tmp"C:\Users\Admin\AppData\Local\Temp\7E53.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\8289.tmp"C:\Users\Admin\AppData\Local\Temp\8289.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\82D7.tmp"C:\Users\Admin\AppData\Local\Temp\82D7.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\84BB.tmp"C:\Users\Admin\AppData\Local\Temp\84BB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\850A.tmp"C:\Users\Admin\AppData\Local\Temp\850A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\8567.tmp"C:\Users\Admin\AppData\Local\Temp\8567.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"65⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"66⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\86DE.tmp"C:\Users\Admin\AppData\Local\Temp\86DE.tmp"67⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"68⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"69⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"70⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"71⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"72⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\88D2.tmp"C:\Users\Admin\AppData\Local\Temp\88D2.tmp"73⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\8930.tmp"C:\Users\Admin\AppData\Local\Temp\8930.tmp"74⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\898E.tmp"C:\Users\Admin\AppData\Local\Temp\898E.tmp"75⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\8A49.tmp"C:\Users\Admin\AppData\Local\Temp\8A49.tmp"77⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"78⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\8B05.tmp"C:\Users\Admin\AppData\Local\Temp\8B05.tmp"79⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\8B53.tmp"C:\Users\Admin\AppData\Local\Temp\8B53.tmp"80⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"81⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"82⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"83⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"84⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"85⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"86⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"87⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\8E22.tmp"C:\Users\Admin\AppData\Local\Temp\8E22.tmp"88⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"89⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"C:\Users\Admin\AppData\Local\Temp\8EBE.tmp"90⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"91⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"92⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"93⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"94⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\9054.tmp"C:\Users\Admin\AppData\Local\Temp\9054.tmp"95⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"96⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"97⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\914E.tmp"C:\Users\Admin\AppData\Local\Temp\914E.tmp"98⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\919C.tmp"C:\Users\Admin\AppData\Local\Temp\919C.tmp"99⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"100⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"101⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\92A6.tmp"C:\Users\Admin\AppData\Local\Temp\92A6.tmp"102⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\92F4.tmp"C:\Users\Admin\AppData\Local\Temp\92F4.tmp"103⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"104⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\93B0.tmp"C:\Users\Admin\AppData\Local\Temp\93B0.tmp"105⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\940D.tmp"C:\Users\Admin\AppData\Local\Temp\940D.tmp"106⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\945B.tmp"C:\Users\Admin\AppData\Local\Temp\945B.tmp"107⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\94AA.tmp"C:\Users\Admin\AppData\Local\Temp\94AA.tmp"108⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"109⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"110⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\95A4.tmp"C:\Users\Admin\AppData\Local\Temp\95A4.tmp"111⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\9601.tmp"C:\Users\Admin\AppData\Local\Temp\9601.tmp"112⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\964F.tmp"C:\Users\Admin\AppData\Local\Temp\964F.tmp"113⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"114⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\96FB.tmp"C:\Users\Admin\AppData\Local\Temp\96FB.tmp"115⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"116⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\9798.tmp"C:\Users\Admin\AppData\Local\Temp\9798.tmp"117⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"118⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9843.tmp"C:\Users\Admin\AppData\Local\Temp\9843.tmp"119⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"120⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"121⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"122⤵PID:4280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-