Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 08:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_d75658a91d1da4d87b33a30b3555f28f_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_d75658a91d1da4d87b33a30b3555f28f_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_d75658a91d1da4d87b33a30b3555f28f_elex_mafia.exe
- Size 518KB
- Sample260809-j82lvsbr7x
- SHA256 dc82a2a689131e304f09c0bca8fa1e9526a66adbc533470c1b71e257023b8cfd
- MD5 d75658a91d1da4d87b33a30b3555f28f
- SHA1 f7c9dc7245933acced1d44a599ecefa50a9822c5
- SHA512 c95d686d04bb89471a39ecaf9c0af1b66971a917d3891dd89804c77d94df28d8c58c785cb8f923ff9b2aabb76184d4a3112c0269860e0b5f56b0c4a1d2ff5326
- SSDEEP 12288:Jf1yBOtIZdpH+IKeEaYYEtkyubtQEHv5R7r9zIAoLHjXgs4ABwJWonN+NZ:JfcBzZdcIKL9YE+yoQsa3LHjXzBwAo4N
- TLSH T1D0B4F112BA44C132E6D325308A26EFA2493A3D76972694C7BBD4357E6FB03D2C674347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4012 5908.tmp 3768 59C3.tmp 4856 5A8F.tmp 4848 5B79.tmp 4688 5C44.tmp 4860 5D1F.tmp 3652 5E09.tmp 2088 5EC5.tmp 4548 5F71.tmp 3508 5FFD.tmp 4108 60C8.tmp 2980 61A3.tmp 4160 627E.tmp 4172 631A.tmp 3100 63E5.tmp 2692 64A1.tmp 3468 654D.tmp 3048 65E9.tmp 1388 6695.tmp 1764 6731.tmp 2720 67CD.tmp 3996 6889.tmp 216 6915.tmp 4456 69C1.tmp 932 6A7D.tmp 5020 6B57.tmp 3964 6BF4.tmp 1676 6C90.tmp 4028 6D1D.tmp 2512 6E07.tmp 4844 6E94.tmp 4424 6F6E.tmp 1340 7059.tmp 3000 70B6.tmp 1184 7124.tmp 3748 7191.tmp 4264 71FF.tmp 5076 727C.tmp 4564 7308.tmp 4560 7376.tmp 1360 73E3.tmp 4556 7460.tmp 4356 74DD.tmp 1068 756A.tmp 3332 7606.tmp 1284 7683.tmp 3636 770F.tmp 1860 779C.tmp 976 7829.tmp 4620 78B5.tmp 684 7932.tmp 3528 79BF.tmp 2824 7A2C.tmp 3712 7A8A.tmp 4904 7B07.tmp 3248 7B84.tmp 4148 7BF1.tmp 2424 7C5F.tmp 204 7CCC.tmp 716 7D3A.tmp 740 7DB7.tmp 4500 7E34.tmp 2388 7EA1.tmp 3444 7F1E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 385C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 779C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9815.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 4012 2596 2026-08-09_d75658a91d1da4d87b33a30b3555f28f_elex_mafia.exe 84 PID 4012 wrote to memory of 3768 4012 5908.tmp 85 PID 3768 wrote to memory of 4856 3768 59C3.tmp 86 PID 4856 wrote to memory of 4848 4856 5A8F.tmp 87 PID 4848 wrote to memory of 4688 4848 5B79.tmp 88 PID 4688 wrote to memory of 4860 4688 5C44.tmp 89 PID 4860 wrote to memory of 3652 4860 5D1F.tmp 90 PID 3652 wrote to memory of 2088 3652 5E09.tmp 91 PID 2088 wrote to memory of 4548 2088 5EC5.tmp 92 PID 4548 wrote to memory of 3508 4548 5F71.tmp 93 PID 3508 wrote to memory of 4108 3508 5FFD.tmp 94 PID 4108 wrote to memory of 2980 4108 60C8.tmp 95 PID 2980 wrote to memory of 4160 2980 61A3.tmp 96 PID 4160 wrote to memory of 4172 4160 627E.tmp 98 PID 4172 wrote to memory of 3100 4172 631A.tmp 100 PID 3100 wrote to memory of 2692 3100 63E5.tmp 101 PID 2692 wrote to memory of 3468 2692 64A1.tmp 102 PID 3468 wrote to memory of 3048 3468 654D.tmp 103 PID 3048 wrote to memory of 1388 3048 65E9.tmp 104 PID 1388 wrote to memory of 1764 1388 6695.tmp 107 PID 1764 wrote to memory of 2720 1764 6731.tmp 108 PID 2720 wrote to memory of 3996 2720 67CD.tmp 109 PID 3996 wrote to memory of 216 3996 6889.tmp 110 PID 216 wrote to memory of 4456 216 6915.tmp 111 PID 4456 wrote to memory of 932 4456 69C1.tmp 112 PID 932 wrote to memory of 5020 932 6A7D.tmp 114 PID 5020 wrote to memory of 3964 5020 6B57.tmp 117 PID 3964 wrote to memory of 1676 3964 6BF4.tmp 119 PID 1676 wrote to memory of 4028 1676 6C90.tmp 120 PID 4028 wrote to memory of 2512 4028 6D1D.tmp 122 PID 2512 wrote to memory of 4844 2512 6E07.tmp 123 PID 4844 wrote to memory of 4424 4844 6E94.tmp 124 PID 4424 wrote to memory of 1340 4424 6F6E.tmp 125 PID 1340 wrote to memory of 3000 1340 7059.tmp 126 PID 3000 wrote to memory of 1184 3000 70B6.tmp 127 PID 1184 wrote to memory of 3748 1184 7124.tmp 128 PID 3748 wrote to memory of 4264 3748 7191.tmp 129 PID 4264 wrote to memory of 5076 4264 71FF.tmp 130 PID 5076 wrote to memory of 4564 5076 727C.tmp 131 PID 4564 wrote to memory of 4560 4564 7308.tmp 132 PID 4560 wrote to memory of 1360 4560 7376.tmp 133 PID 1360 wrote to memory of 4556 1360 73E3.tmp 134 PID 4556 wrote to memory of 4356 4556 7460.tmp 135 PID 4356 wrote to memory of 1068 4356 74DD.tmp 136 PID 1068 wrote to memory of 3332 1068 756A.tmp 137 PID 3332 wrote to memory of 1284 3332 7606.tmp 138 PID 1284 wrote to memory of 3636 1284 7683.tmp 139 PID 3636 wrote to memory of 1860 3636 770F.tmp 141 PID 1860 wrote to memory of 976 1860 779C.tmp 142 PID 976 wrote to memory of 4620 976 7829.tmp 143 PID 4620 wrote to memory of 684 4620 78B5.tmp 144 PID 684 wrote to memory of 3528 684 7932.tmp 145 PID 3528 wrote to memory of 2824 3528 79BF.tmp 146 PID 2824 wrote to memory of 3712 2824 7A2C.tmp 147 PID 3712 wrote to memory of 4904 3712 7A8A.tmp 148 PID 4904 wrote to memory of 3248 4904 7B07.tmp 149 PID 3248 wrote to memory of 4148 3248 7B84.tmp 150 PID 4148 wrote to memory of 2424 4148 7BF1.tmp 151 PID 2424 wrote to memory of 204 2424 7C5F.tmp 152 PID 204 wrote to memory of 716 204 7CCC.tmp 153 PID 716 wrote to memory of 740 716 7D3A.tmp 154 PID 740 wrote to memory of 4500 740 7DB7.tmp 155 PID 4500 wrote to memory of 2388 4500 7E34.tmp 156 PID 2388 wrote to memory of 3444 2388 7EA1.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_d75658a91d1da4d87b33a30b3555f28f_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d75658a91d1da4d87b33a30b3555f28f_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\61A3.tmp"C:\Users\Admin\AppData\Local\Temp\61A3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\67CD.tmp"C:\Users\Admin\AppData\Local\Temp\67CD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\70B6.tmp"C:\Users\Admin\AppData\Local\Temp\70B6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7124.tmp"C:\Users\Admin\AppData\Local\Temp\7124.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\71FF.tmp"C:\Users\Admin\AppData\Local\Temp\71FF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\7460.tmp"C:\Users\Admin\AppData\Local\Temp\7460.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\756A.tmp"C:\Users\Admin\AppData\Local\Temp\756A.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\7829.tmp"C:\Users\Admin\AppData\Local\Temp\7829.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\79BF.tmp"C:\Users\Admin\AppData\Local\Temp\79BF.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\7B07.tmp"C:\Users\Admin\AppData\Local\Temp\7B07.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"65⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"66⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"67⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"68⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"69⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"70⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"71⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\819F.tmp"C:\Users\Admin\AppData\Local\Temp\819F.tmp"72⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"73⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"74⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"75⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\82F6.tmp"C:\Users\Admin\AppData\Local\Temp\82F6.tmp"76⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\8344.tmp"C:\Users\Admin\AppData\Local\Temp\8344.tmp"77⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"78⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\83E1.tmp"C:\Users\Admin\AppData\Local\Temp\83E1.tmp"79⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"80⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\848D.tmp"C:\Users\Admin\AppData\Local\Temp\848D.tmp"81⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\84DB.tmp"C:\Users\Admin\AppData\Local\Temp\84DB.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8538.tmp"C:\Users\Admin\AppData\Local\Temp\8538.tmp"83⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"84⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"85⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\8642.tmp"C:\Users\Admin\AppData\Local\Temp\8642.tmp"86⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"87⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"88⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"89⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\87A9.tmp"C:\Users\Admin\AppData\Local\Temp\87A9.tmp"90⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\87F8.tmp"C:\Users\Admin\AppData\Local\Temp\87F8.tmp"91⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"92⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\88A3.tmp"C:\Users\Admin\AppData\Local\Temp\88A3.tmp"93⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"94⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"95⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"96⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"97⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"98⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"99⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\8B05.tmp"C:\Users\Admin\AppData\Local\Temp\8B05.tmp"100⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\8B53.tmp"C:\Users\Admin\AppData\Local\Temp\8B53.tmp"101⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"102⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"103⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"104⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"105⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"106⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\8D47.tmp"C:\Users\Admin\AppData\Local\Temp\8D47.tmp"107⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"108⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"C:\Users\Admin\AppData\Local\Temp\8DE3.tmp"109⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\8E51.tmp"C:\Users\Admin\AppData\Local\Temp\8E51.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"111⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"112⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"C:\Users\Admin\AppData\Local\Temp\8F6A.tmp"113⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"114⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\9025.tmp"C:\Users\Admin\AppData\Local\Temp\9025.tmp"115⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\9093.tmp"C:\Users\Admin\AppData\Local\Temp\9093.tmp"116⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\90E1.tmp"C:\Users\Admin\AppData\Local\Temp\90E1.tmp"117⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\912F.tmp"C:\Users\Admin\AppData\Local\Temp\912F.tmp"118⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"119⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"120⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\9219.tmp"C:\Users\Admin\AppData\Local\Temp\9219.tmp"121⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\9277.tmp"C:\Users\Admin\AppData\Local\Temp\9277.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-