Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_b19fce9b9b875edd985028c271fd9ad4_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_b19fce9b9b875edd985028c271fd9ad4_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-22_b19fce9b9b875edd985028c271fd9ad4_elex_mafia.exe
- Size 561KB
- Sample260823-csv1tadn51
- SHA256 5e3ecf3e6b959ecad9533ec9a7c6b3673d3f594aee7781eca81eaf523b278cf3
- MD5 b19fce9b9b875edd985028c271fd9ad4
- SHA1 3d200fd040fcc13038794559a7ec36aa6913888d
- SHA512 2e6ab26f96b7dc3c5031b62e0cacf833b0ffc4efaffe64c3765dae8bc7050b52fa6791448b00c1868ecc703994ed8f6b7458d6c07fda19e5c48fbcc9d6293b0e
- SSDEEP 12288:VuelPWET0yhPH5cu+4eR7hDx11toLDZuL:8eEEvhuoedhT1CDoL
- TLSH T1ABC4DF11B2D4C832F1F31A344AF497A2097BBD229B75E9CF2784561E5EB02D1EA39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1888 5C83.tmp 2904 5D4E.tmp 3868 5DCB.tmp 1104 5E77.tmp 5000 5F13.tmp 3004 5FCE.tmp 2844 604B.tmp 4072 6136.tmp 2284 61A3.tmp 5088 6220.tmp 4260 62CC.tmp 4100 6339.tmp 3848 63F5.tmp 3112 6491.tmp 4820 654D.tmp 1760 65CA.tmp 2084 6685.tmp 4428 6731.tmp 4828 67AE.tmp 3280 680C.tmp 4008 6889.tmp 5108 6906.tmp 4064 6992.tmp 2424 6A2F.tmp 2108 6ABB.tmp 2836 6B38.tmp 4716 6BE4.tmp 2952 6CAF.tmp 3472 6D6B.tmp 1480 6E17.tmp 4976 6EC2.tmp 4496 6F7E.tmp 4604 6FFB.tmp 4316 7059.tmp 4772 70A7.tmp 4632 7105.tmp 4368 7162.tmp 1412 71B0.tmp 1484 71FF.tmp 2788 726C.tmp 4024 72CA.tmp 5080 7337.tmp 312 7385.tmp 3772 73E3.tmp 2144 7431.tmp 3056 747F.tmp 3188 74CD.tmp 4636 752B.tmp 4216 7579.tmp 4116 75C7.tmp 4120 7615.tmp 2220 7664.tmp 2096 76B2.tmp 2432 7700.tmp 4624 774E.tmp 2056 779C.tmp 3672 7809.tmp 2708 7877.tmp 1476 78C5.tmp 1892 7932.tmp 2020 79A0.tmp 1912 79FD.tmp 2876 7A4C.tmp 2392 7A9A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 941D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6906.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F335.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D85A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E700.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 430A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 1888 4524 2026-08-22_b19fce9b9b875edd985028c271fd9ad4_elex_mafia.exe 84 PID 1888 wrote to memory of 2904 1888 5C83.tmp 85 PID 2904 wrote to memory of 3868 2904 5D4E.tmp 86 PID 3868 wrote to memory of 1104 3868 5DCB.tmp 87 PID 1104 wrote to memory of 5000 1104 5E77.tmp 88 PID 5000 wrote to memory of 3004 5000 5F13.tmp 89 PID 3004 wrote to memory of 2844 3004 5FCE.tmp 90 PID 2844 wrote to memory of 4072 2844 604B.tmp 91 PID 4072 wrote to memory of 2284 4072 6136.tmp 92 PID 2284 wrote to memory of 5088 2284 61A3.tmp 94 PID 5088 wrote to memory of 4260 5088 6220.tmp 95 PID 4260 wrote to memory of 4100 4260 62CC.tmp 96 PID 4100 wrote to memory of 3848 4100 6339.tmp 97 PID 3848 wrote to memory of 3112 3848 63F5.tmp 98 PID 3112 wrote to memory of 4820 3112 6491.tmp 101 PID 4820 wrote to memory of 1760 4820 654D.tmp 102 PID 1760 wrote to memory of 2084 1760 65CA.tmp 103 PID 2084 wrote to memory of 4428 2084 6685.tmp 104 PID 4428 wrote to memory of 4828 4428 6731.tmp 105 PID 4828 wrote to memory of 3280 4828 67AE.tmp 107 PID 3280 wrote to memory of 4008 3280 680C.tmp 108 PID 4008 wrote to memory of 5108 4008 6889.tmp 109 PID 5108 wrote to memory of 4064 5108 6906.tmp 113 PID 4064 wrote to memory of 2424 4064 6992.tmp 115 PID 2424 wrote to memory of 2108 2424 6A2F.tmp 117 PID 2108 wrote to memory of 2836 2108 6ABB.tmp 118 PID 2836 wrote to memory of 4716 2836 6B38.tmp 119 PID 4716 wrote to memory of 2952 4716 6BE4.tmp 120 PID 2952 wrote to memory of 3472 2952 6CAF.tmp 121 PID 3472 wrote to memory of 1480 3472 6D6B.tmp 122 PID 1480 wrote to memory of 4976 1480 6E17.tmp 123 PID 4976 wrote to memory of 4496 4976 6EC2.tmp 124 PID 4496 wrote to memory of 4604 4496 6F7E.tmp 125 PID 4604 wrote to memory of 4316 4604 6FFB.tmp 126 PID 4316 wrote to memory of 4772 4316 7059.tmp 127 PID 4772 wrote to memory of 4632 4772 70A7.tmp 128 PID 4632 wrote to memory of 4368 4632 7105.tmp 129 PID 4368 wrote to memory of 1412 4368 7162.tmp 130 PID 1412 wrote to memory of 1484 1412 71B0.tmp 131 PID 1484 wrote to memory of 2788 1484 71FF.tmp 132 PID 2788 wrote to memory of 4024 2788 726C.tmp 133 PID 4024 wrote to memory of 5080 4024 72CA.tmp 134 PID 5080 wrote to memory of 312 5080 7337.tmp 135 PID 312 wrote to memory of 3772 312 7385.tmp 136 PID 3772 wrote to memory of 2144 3772 73E3.tmp 137 PID 2144 wrote to memory of 3056 2144 7431.tmp 138 PID 3056 wrote to memory of 3188 3056 747F.tmp 139 PID 3188 wrote to memory of 4636 3188 74CD.tmp 140 PID 4636 wrote to memory of 4216 4636 752B.tmp 142 PID 4216 wrote to memory of 4116 4216 7579.tmp 143 PID 4116 wrote to memory of 4120 4116 75C7.tmp 144 PID 4120 wrote to memory of 2220 4120 7615.tmp 145 PID 2220 wrote to memory of 2096 2220 7664.tmp 146 PID 2096 wrote to memory of 2432 2096 76B2.tmp 147 PID 2432 wrote to memory of 4624 2432 7700.tmp 148 PID 4624 wrote to memory of 2056 4624 774E.tmp 149 PID 2056 wrote to memory of 3672 2056 779C.tmp 150 PID 3672 wrote to memory of 2708 3672 7809.tmp 151 PID 2708 wrote to memory of 1476 2708 7877.tmp 152 PID 1476 wrote to memory of 1892 1476 78C5.tmp 153 PID 1892 wrote to memory of 2020 1892 7932.tmp 154 PID 2020 wrote to memory of 1912 2020 79A0.tmp 155 PID 1912 wrote to memory of 2876 1912 79FD.tmp 156 PID 2876 wrote to memory of 2392 2876 7A4C.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_b19fce9b9b875edd985028c271fd9ad4_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_b19fce9b9b875edd985028c271fd9ad4_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\61A3.tmp"C:\Users\Admin\AppData\Local\Temp\61A3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\63F5.tmp"C:\Users\Admin\AppData\Local\Temp\63F5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\67AE.tmp"C:\Users\Admin\AppData\Local\Temp\67AE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\6992.tmp"C:\Users\Admin\AppData\Local\Temp\6992.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\6E17.tmp"C:\Users\Admin\AppData\Local\Temp\6E17.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\71FF.tmp"C:\Users\Admin\AppData\Local\Temp\71FF.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\7337.tmp"C:\Users\Admin\AppData\Local\Temp\7337.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7385.tmp"C:\Users\Admin\AppData\Local\Temp\7385.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\74CD.tmp"C:\Users\Admin\AppData\Local\Temp\74CD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\7877.tmp"C:\Users\Admin\AppData\Local\Temp\7877.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\78C5.tmp"C:\Users\Admin\AppData\Local\Temp\78C5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"65⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"66⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:900 -
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"69⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\7C40.tmp"C:\Users\Admin\AppData\Local\Temp\7C40.tmp"70⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"71⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"C:\Users\Admin\AppData\Local\Temp\7CEB.tmp"72⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"73⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7D88.tmp"C:\Users\Admin\AppData\Local\Temp\7D88.tmp"74⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"75⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\7E24.tmp"C:\Users\Admin\AppData\Local\Temp\7E24.tmp"76⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\7E72.tmp"C:\Users\Admin\AppData\Local\Temp\7E72.tmp"77⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"C:\Users\Admin\AppData\Local\Temp\7EC0.tmp"78⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"79⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"80⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"81⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"82⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"83⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"84⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\8122.tmp"C:\Users\Admin\AppData\Local\Temp\8122.tmp"85⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"86⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"87⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\821C.tmp"C:\Users\Admin\AppData\Local\Temp\821C.tmp"88⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"89⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\82B8.tmp"C:\Users\Admin\AppData\Local\Temp\82B8.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8306.tmp"C:\Users\Admin\AppData\Local\Temp\8306.tmp"91⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\8354.tmp"C:\Users\Admin\AppData\Local\Temp\8354.tmp"92⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"93⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"94⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"95⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\84BB.tmp"C:\Users\Admin\AppData\Local\Temp\84BB.tmp"96⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\850A.tmp"C:\Users\Admin\AppData\Local\Temp\850A.tmp"97⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"98⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\85A6.tmp"C:\Users\Admin\AppData\Local\Temp\85A6.tmp"99⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\85F4.tmp"C:\Users\Admin\AppData\Local\Temp\85F4.tmp"100⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"101⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"102⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\86EE.tmp"C:\Users\Admin\AppData\Local\Temp\86EE.tmp"103⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"104⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"105⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"106⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\8826.tmp"C:\Users\Admin\AppData\Local\Temp\8826.tmp"107⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"108⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"109⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"110⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"111⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\89FB.tmp"C:\Users\Admin\AppData\Local\Temp\89FB.tmp"112⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"113⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"114⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\8B24.tmp"C:\Users\Admin\AppData\Local\Temp\8B24.tmp"115⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\8B91.tmp"C:\Users\Admin\AppData\Local\Temp\8B91.tmp"116⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"117⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"118⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"119⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"120⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\8D28.tmp"C:\Users\Admin\AppData\Local\Temp\8D28.tmp"121⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\8D76.tmp"C:\Users\Admin\AppData\Local\Temp\8D76.tmp"122⤵PID:3896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-