Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_79caa7de4fe79652a4267e8f3622b055_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_79caa7de4fe79652a4267e8f3622b055_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-11_79caa7de4fe79652a4267e8f3622b055_elex_mafia.exe
- Size 520KB
- Sample260811-dfdrfathld
- SHA256 a243ee1d95ee4ad55f72fd0241e3b18caf0a6ad3b80e175b2f0100946b5a9e35
- MD5 79caa7de4fe79652a4267e8f3622b055
- SHA1 7ba19c719bbe7ea301681b53c980649e2afd647f
- SHA512 4e7736442ca8fd3086682f70cedf9387483ae56a4b703ee9fb31e26ad75d87c3daf50f6e353a6f1d77ee395a4f815f1fb0c155636b824dfd5e332b5178b02c30
- SSDEEP 6144:lLvd/XzCjUIF1UuXLyQjmOH+JjL0VpzKneLtDvX1x9SwVo7WFcSJ29v4LacuXsHT:roRXOQjmOykHUeZvXhVmWOSuKNZ
- TLSH T184B4E1227185C032E5D211318F26DF610A7E7C665B2A92CB3BD42A6E6FF42C1E775387
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3432 8671.tmp 5112 870D.tmp 3084 87D8.tmp 5008 88D2.tmp 2384 896F.tmp 1388 89FB.tmp 464 8A97.tmp 4368 8B43.tmp 2916 8BEF.tmp 4356 8C6C.tmp 1856 8D08.tmp 1768 8DA5.tmp 2348 8E60.tmp 1744 8F0C.tmp 4956 8FB8.tmp 3048 9064.tmp 3768 90F0.tmp 1740 916D.tmp 1760 920A.tmp 5036 92B6.tmp 452 9352.tmp 1480 93FE.tmp 4296 94B9.tmp 5016 9555.tmp 4496 95F2.tmp 4748 968E.tmp 220 971B.tmp 2688 9788.tmp 3560 9815.tmp 5064 9892.tmp 3948 992E.tmp 4304 99BA.tmp 4880 9A66.tmp 2168 9AB4.tmp 1716 9B03.tmp 3776 9B51.tmp 3252 9B9F.tmp 3648 9C0C.tmp 3500 9C7A.tmp 8 9CF7.tmp 436 9D45.tmp 1496 9DB2.tmp 1888 9E00.tmp 1784 9E5E.tmp 3552 9EAC.tmp 2148 9EFA.tmp 4688 9F68.tmp 2792 9FB6.tmp 1672 A004.tmp 4508 A062.tmp 4860 A0BF.tmp 1196 A11D.tmp 4136 A17B.tmp 4376 A1C9.tmp 540 A227.tmp 1544 A275.tmp 4768 A2D3.tmp 3140 A321.tmp 2088 A36F.tmp 1668 A3BD.tmp 4736 A40B.tmp 1676 A459.tmp 652 A4A7.tmp 3260 A505.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 160F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F817.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E296.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 966A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 992E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7BB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1132 wrote to memory of 3432 1132 2026-08-11_79caa7de4fe79652a4267e8f3622b055_elex_mafia.exe 85 PID 3432 wrote to memory of 5112 3432 8671.tmp 86 PID 5112 wrote to memory of 3084 5112 870D.tmp 87 PID 3084 wrote to memory of 5008 3084 87D8.tmp 88 PID 5008 wrote to memory of 2384 5008 88D2.tmp 89 PID 2384 wrote to memory of 1388 2384 896F.tmp 90 PID 1388 wrote to memory of 464 1388 89FB.tmp 91 PID 464 wrote to memory of 4368 464 8A97.tmp 92 PID 4368 wrote to memory of 2916 4368 8B43.tmp 93 PID 2916 wrote to memory of 4356 2916 8BEF.tmp 94 PID 4356 wrote to memory of 1856 4356 8C6C.tmp 95 PID 1856 wrote to memory of 1768 1856 8D08.tmp 96 PID 1768 wrote to memory of 2348 1768 8DA5.tmp 97 PID 2348 wrote to memory of 1744 2348 8E60.tmp 98 PID 1744 wrote to memory of 4956 1744 8F0C.tmp 99 PID 4956 wrote to memory of 3048 4956 8FB8.tmp 100 PID 3048 wrote to memory of 3768 3048 9064.tmp 101 PID 3768 wrote to memory of 1740 3768 90F0.tmp 102 PID 1740 wrote to memory of 1760 1740 916D.tmp 105 PID 1760 wrote to memory of 5036 1760 920A.tmp 106 PID 5036 wrote to memory of 452 5036 92B6.tmp 107 PID 452 wrote to memory of 1480 452 9352.tmp 108 PID 1480 wrote to memory of 4296 1480 93FE.tmp 109 PID 4296 wrote to memory of 5016 4296 94B9.tmp 110 PID 5016 wrote to memory of 4496 5016 9555.tmp 111 PID 4496 wrote to memory of 4748 4496 95F2.tmp 113 PID 4748 wrote to memory of 220 4748 968E.tmp 114 PID 220 wrote to memory of 2688 220 971B.tmp 116 PID 2688 wrote to memory of 3560 2688 9788.tmp 117 PID 3560 wrote to memory of 5064 3560 9815.tmp 118 PID 5064 wrote to memory of 3948 5064 9892.tmp 119 PID 3948 wrote to memory of 4304 3948 992E.tmp 120 PID 4304 wrote to memory of 4880 4304 99BA.tmp 121 PID 4880 wrote to memory of 2168 4880 9A66.tmp 122 PID 2168 wrote to memory of 1716 2168 9AB4.tmp 123 PID 1716 wrote to memory of 3776 1716 9B03.tmp 124 PID 3776 wrote to memory of 3252 3776 9B51.tmp 125 PID 3252 wrote to memory of 3648 3252 9B9F.tmp 126 PID 3648 wrote to memory of 3500 3648 9C0C.tmp 127 PID 3500 wrote to memory of 8 3500 9C7A.tmp 128 PID 8 wrote to memory of 436 8 9CF7.tmp 129 PID 436 wrote to memory of 1496 436 9D45.tmp 130 PID 1496 wrote to memory of 1888 1496 9DB2.tmp 131 PID 1888 wrote to memory of 1784 1888 9E00.tmp 132 PID 1784 wrote to memory of 3552 1784 9E5E.tmp 133 PID 3552 wrote to memory of 2148 3552 9EAC.tmp 134 PID 2148 wrote to memory of 4688 2148 9EFA.tmp 135 PID 4688 wrote to memory of 2792 4688 9F68.tmp 136 PID 2792 wrote to memory of 1672 2792 9FB6.tmp 137 PID 1672 wrote to memory of 4508 1672 A004.tmp 138 PID 4508 wrote to memory of 4860 4508 A062.tmp 139 PID 4860 wrote to memory of 1196 4860 A0BF.tmp 140 PID 1196 wrote to memory of 4136 1196 A11D.tmp 141 PID 4136 wrote to memory of 4376 4136 A17B.tmp 142 PID 4376 wrote to memory of 540 4376 A1C9.tmp 144 PID 540 wrote to memory of 1544 540 A227.tmp 146 PID 1544 wrote to memory of 4768 1544 A275.tmp 147 PID 4768 wrote to memory of 3140 4768 A2D3.tmp 148 PID 3140 wrote to memory of 2088 3140 A321.tmp 150 PID 2088 wrote to memory of 1668 2088 A36F.tmp 151 PID 1668 wrote to memory of 4736 1668 A3BD.tmp 153 PID 4736 wrote to memory of 1676 4736 A40B.tmp 154 PID 1676 wrote to memory of 652 1676 A459.tmp 156 PID 652 wrote to memory of 3260 652 A4A7.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_79caa7de4fe79652a4267e8f3622b055_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_79caa7de4fe79652a4267e8f3622b055_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\8671.tmp"C:\Users\Admin\AppData\Local\Temp\8671.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\870D.tmp"C:\Users\Admin\AppData\Local\Temp\870D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\88D2.tmp"C:\Users\Admin\AppData\Local\Temp\88D2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\89FB.tmp"C:\Users\Admin\AppData\Local\Temp\89FB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\8A97.tmp"C:\Users\Admin\AppData\Local\Temp\8A97.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"C:\Users\Admin\AppData\Local\Temp\8C6C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"C:\Users\Admin\AppData\Local\Temp\8FB8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\9064.tmp"C:\Users\Admin\AppData\Local\Temp\9064.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\92B6.tmp"C:\Users\Admin\AppData\Local\Temp\92B6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\93FE.tmp"C:\Users\Admin\AppData\Local\Temp\93FE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\94B9.tmp"C:\Users\Admin\AppData\Local\Temp\94B9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\95F2.tmp"C:\Users\Admin\AppData\Local\Temp\95F2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\968E.tmp"C:\Users\Admin\AppData\Local\Temp\968E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\971B.tmp"C:\Users\Admin\AppData\Local\Temp\971B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\9788.tmp"C:\Users\Admin\AppData\Local\Temp\9788.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9815.tmp"C:\Users\Admin\AppData\Local\Temp\9815.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\992E.tmp"C:\Users\Admin\AppData\Local\Temp\992E.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\99BA.tmp"C:\Users\Admin\AppData\Local\Temp\99BA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"C:\Users\Admin\AppData\Local\Temp\9CF7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\9D45.tmp"C:\Users\Admin\AppData\Local\Temp\9D45.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"C:\Users\Admin\AppData\Local\Temp\9FB6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\A062.tmp"C:\Users\Admin\AppData\Local\Temp\A062.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\A11D.tmp"C:\Users\Admin\AppData\Local\Temp\A11D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\A17B.tmp"C:\Users\Admin\AppData\Local\Temp\A17B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\A227.tmp"C:\Users\Admin\AppData\Local\Temp\A227.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\A275.tmp"C:\Users\Admin\AppData\Local\Temp\A275.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A321.tmp"C:\Users\Admin\AppData\Local\Temp\A321.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\A36F.tmp"C:\Users\Admin\AppData\Local\Temp\A36F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\A40B.tmp"C:\Users\Admin\AppData\Local\Temp\A40B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\A459.tmp"C:\Users\Admin\AppData\Local\Temp\A459.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"65⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"66⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"67⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"68⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"69⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"70⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"71⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\A747.tmp"C:\Users\Admin\AppData\Local\Temp\A747.tmp"72⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"73⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\A822.tmp"C:\Users\Admin\AppData\Local\Temp\A822.tmp"74⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"75⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"76⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\A92C.tmp"C:\Users\Admin\AppData\Local\Temp\A92C.tmp"77⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A989.tmp"C:\Users\Admin\AppData\Local\Temp\A989.tmp"78⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"79⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\AA35.tmp"C:\Users\Admin\AppData\Local\Temp\AA35.tmp"80⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"81⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"82⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"83⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"84⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"85⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\AC48.tmp"C:\Users\Admin\AppData\Local\Temp\AC48.tmp"86⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"87⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\AD04.tmp"C:\Users\Admin\AppData\Local\Temp\AD04.tmp"88⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\AD81.tmp"C:\Users\Admin\AppData\Local\Temp\AD81.tmp"89⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"90⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"91⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"92⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"93⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\AF08.tmp"C:\Users\Admin\AppData\Local\Temp\AF08.tmp"94⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\AF56.tmp"C:\Users\Admin\AppData\Local\Temp\AF56.tmp"95⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"C:\Users\Admin\AppData\Local\Temp\AFC3.tmp"96⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"97⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\B06F.tmp"C:\Users\Admin\AppData\Local\Temp\B06F.tmp"98⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"99⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B11B.tmp"C:\Users\Admin\AppData\Local\Temp\B11B.tmp"100⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\B169.tmp"C:\Users\Admin\AppData\Local\Temp\B169.tmp"101⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"102⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B205.tmp"C:\Users\Admin\AppData\Local\Temp\B205.tmp"103⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\B253.tmp"C:\Users\Admin\AppData\Local\Temp\B253.tmp"104⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"105⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"106⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\B33E.tmp"C:\Users\Admin\AppData\Local\Temp\B33E.tmp"107⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\B38C.tmp"C:\Users\Admin\AppData\Local\Temp\B38C.tmp"108⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"C:\Users\Admin\AppData\Local\Temp\B3DA.tmp"109⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\B428.tmp"C:\Users\Admin\AppData\Local\Temp\B428.tmp"110⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\B486.tmp"C:\Users\Admin\AppData\Local\Temp\B486.tmp"111⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"112⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\B532.tmp"C:\Users\Admin\AppData\Local\Temp\B532.tmp"113⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\B580.tmp"C:\Users\Admin\AppData\Local\Temp\B580.tmp"114⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"115⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\B62C.tmp"C:\Users\Admin\AppData\Local\Temp\B62C.tmp"116⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\B67A.tmp"C:\Users\Admin\AppData\Local\Temp\B67A.tmp"117⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\B706.tmp"C:\Users\Admin\AppData\Local\Temp\B706.tmp"118⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"119⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"120⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\B800.tmp"C:\Users\Admin\AppData\Local\Temp\B800.tmp"121⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\B84F.tmp"C:\Users\Admin\AppData\Local\Temp\B84F.tmp"122⤵PID:4980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-