Analysis
- max time kernel
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 15:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_413e9f4bdf11d272ad70e0747f646fe2_elex_mafia.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_413e9f4bdf11d272ad70e0747f646fe2_elex_mafia.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-06_413e9f4bdf11d272ad70e0747f646fe2_elex_mafia.exe
- Size 561KB
- Sample260806-s26rnsem9s
- SHA256 123e98b5687d6cdbf2ba57a4047fa84c20b9dc561d602dd1b5205a11430a2f0a
- MD5 413e9f4bdf11d272ad70e0747f646fe2
- SHA1 a1d83fac9739a6eca8667bfe3bfbb4d2e0704850
- SHA512 6cdfd4e9bd1a1b0b1ff611ef4eaecb46e5c1bc101bd587c184d298b82a7f409f0d5e2aefb83f1d6b69e26832cabf4ff76dd7adb49587d0d413953935bdd8d4d8
- SSDEEP 12288:VuelPWET0yhjTTXQ3UiVPF2j7YCqvqRQCkO8780DZuL:8eEEvhE3J3BjCkOoDoL
- TLSH T184C4CF11B2D48836F1F31A344DF09BA1497B7C629B35E9CF2788622D5EB16D0E639713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5680 5F6C.tmp 5320 6037.tmp 3956 6141.tmp 2808 620C.tmp 6056 62A8.tmp 2136 6354.tmp 2800 63F0.tmp 3248 64DA.tmp 1500 6586.tmp 4616 6671.tmp 4800 676B.tmp 6128 6865.tmp 1176 695F.tmp 252 6A1A.tmp 4172 6B14.tmp 1916 6BB0.tmp 2684 6C7C.tmp 5904 6D27.tmp 1368 6DB4.tmp 1136 6E9E.tmp 2744 6F5A.tmp 4396 7064.tmp 2220 712F.tmp 1204 7209.tmp 3328 72D5.tmp 2092 7390.tmp 620 744C.tmp 1380 7526.tmp 752 75F1.tmp 5268 76AD.tmp 596 7778.tmp 3068 7853.tmp 6024 791E.tmp 6088 79AB.tmp 1064 7A47.tmp 2012 7AD3.tmp 1436 7B50.tmp 4792 7BDD.tmp 3092 7C6A.tmp 6112 7D06.tmp 4532 7D93.tmp 1632 7E2F.tmp 2056 7ECB.tmp 3036 7F38.tmp 3136 7FD5.tmp 3580 8061.tmp 5060 80EE.tmp 3460 81A9.tmp 1840 8236.tmp 3264 82D2.tmp 4420 834F.tmp 5876 83EC.tmp 5944 8488.tmp 3436 8524.tmp 5916 85B1.tmp 5036 863D.tmp 356 86AB.tmp 5056 8757.tmp 5836 87D4.tmp 3744 8851.tmp 4208 88CE.tmp 5152 895A.tmp 2256 89F6.tmp 4776 8A93.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5610.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C68D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D37E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D67B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B52D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 907A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEB9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 5680 1760 2026-08-06_413e9f4bdf11d272ad70e0747f646fe2_elex_mafia.exe 89 PID 5680 wrote to memory of 5320 5680 5F6C.tmp 90 PID 5320 wrote to memory of 3956 5320 6037.tmp 91 PID 3956 wrote to memory of 2808 3956 6141.tmp 92 PID 2808 wrote to memory of 6056 2808 620C.tmp 93 PID 6056 wrote to memory of 2136 6056 62A8.tmp 94 PID 2136 wrote to memory of 2800 2136 6354.tmp 95 PID 2800 wrote to memory of 3248 2800 63F0.tmp 96 PID 3248 wrote to memory of 1500 3248 64DA.tmp 97 PID 1500 wrote to memory of 4616 1500 6586.tmp 98 PID 4616 wrote to memory of 4800 4616 6671.tmp 99 PID 4800 wrote to memory of 6128 4800 676B.tmp 100 PID 6128 wrote to memory of 1176 6128 6865.tmp 101 PID 1176 wrote to memory of 252 1176 695F.tmp 102 PID 252 wrote to memory of 4172 252 6A1A.tmp 103 PID 4172 wrote to memory of 1916 4172 6B14.tmp 104 PID 1916 wrote to memory of 2684 1916 6BB0.tmp 105 PID 2684 wrote to memory of 5904 2684 6C7C.tmp 106 PID 5904 wrote to memory of 1368 5904 6D27.tmp 107 PID 1368 wrote to memory of 1136 1368 6DB4.tmp 108 PID 1136 wrote to memory of 2744 1136 6E9E.tmp 109 PID 2744 wrote to memory of 4396 2744 6F5A.tmp 110 PID 4396 wrote to memory of 2220 4396 7064.tmp 111 PID 2220 wrote to memory of 1204 2220 712F.tmp 112 PID 1204 wrote to memory of 3328 1204 7209.tmp 113 PID 3328 wrote to memory of 2092 3328 72D5.tmp 114 PID 2092 wrote to memory of 620 2092 7390.tmp 115 PID 620 wrote to memory of 1380 620 744C.tmp 116 PID 1380 wrote to memory of 752 1380 7526.tmp 117 PID 752 wrote to memory of 5268 752 75F1.tmp 118 PID 5268 wrote to memory of 596 5268 76AD.tmp 119 PID 596 wrote to memory of 3068 596 7778.tmp 120 PID 3068 wrote to memory of 6024 3068 7853.tmp 121 PID 6024 wrote to memory of 6088 6024 791E.tmp 122 PID 6088 wrote to memory of 1064 6088 79AB.tmp 123 PID 1064 wrote to memory of 2012 1064 7A47.tmp 124 PID 2012 wrote to memory of 1436 2012 7AD3.tmp 125 PID 1436 wrote to memory of 4792 1436 7B50.tmp 126 PID 4792 wrote to memory of 3092 4792 7BDD.tmp 127 PID 3092 wrote to memory of 6112 3092 7C6A.tmp 128 PID 6112 wrote to memory of 4532 6112 7D06.tmp 129 PID 4532 wrote to memory of 1632 4532 7D93.tmp 130 PID 1632 wrote to memory of 2056 1632 7E2F.tmp 131 PID 2056 wrote to memory of 3036 2056 7ECB.tmp 132 PID 3036 wrote to memory of 3136 3036 7F38.tmp 133 PID 3136 wrote to memory of 3580 3136 7FD5.tmp 134 PID 3580 wrote to memory of 5060 3580 8061.tmp 135 PID 5060 wrote to memory of 3460 5060 80EE.tmp 136 PID 3460 wrote to memory of 1840 3460 81A9.tmp 137 PID 1840 wrote to memory of 3264 1840 8236.tmp 138 PID 3264 wrote to memory of 4420 3264 82D2.tmp 139 PID 4420 wrote to memory of 5876 4420 834F.tmp 140 PID 5876 wrote to memory of 5944 5876 83EC.tmp 141 PID 5944 wrote to memory of 3436 5944 8488.tmp 142 PID 3436 wrote to memory of 5916 3436 8524.tmp 143 PID 5916 wrote to memory of 5036 5916 85B1.tmp 144 PID 5036 wrote to memory of 356 5036 863D.tmp 145 PID 356 wrote to memory of 5056 356 86AB.tmp 146 PID 5056 wrote to memory of 5836 5056 8757.tmp 147 PID 5836 wrote to memory of 3744 5836 87D4.tmp 148 PID 3744 wrote to memory of 4208 3744 8851.tmp 149 PID 4208 wrote to memory of 5152 4208 88CE.tmp 150 PID 5152 wrote to memory of 2256 5152 895A.tmp 151 PID 2256 wrote to memory of 4776 2256 89F6.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_413e9f4bdf11d272ad70e0747f646fe2_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_413e9f4bdf11d272ad70e0747f646fe2_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\6037.tmp"C:\Users\Admin\AppData\Local\Temp\6037.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\620C.tmp"C:\Users\Admin\AppData\Local\Temp\620C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\62A8.tmp"C:\Users\Admin\AppData\Local\Temp\62A8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\6354.tmp"C:\Users\Admin\AppData\Local\Temp\6354.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\63F0.tmp"C:\Users\Admin\AppData\Local\Temp\63F0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\6586.tmp"C:\Users\Admin\AppData\Local\Temp\6586.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\676B.tmp"C:\Users\Admin\AppData\Local\Temp\676B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\6865.tmp"C:\Users\Admin\AppData\Local\Temp\6865.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\695F.tmp"C:\Users\Admin\AppData\Local\Temp\695F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\7064.tmp"C:\Users\Admin\AppData\Local\Temp\7064.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\7209.tmp"C:\Users\Admin\AppData\Local\Temp\7209.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\744C.tmp"C:\Users\Admin\AppData\Local\Temp\744C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\7526.tmp"C:\Users\Admin\AppData\Local\Temp\7526.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\7778.tmp"C:\Users\Admin\AppData\Local\Temp\7778.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\7853.tmp"C:\Users\Admin\AppData\Local\Temp\7853.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\791E.tmp"C:\Users\Admin\AppData\Local\Temp\791E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\7A47.tmp"C:\Users\Admin\AppData\Local\Temp\7A47.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\7B50.tmp"C:\Users\Admin\AppData\Local\Temp\7B50.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\7F38.tmp"C:\Users\Admin\AppData\Local\Temp\7F38.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"C:\Users\Admin\AppData\Local\Temp\7FD5.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\8061.tmp"C:\Users\Admin\AppData\Local\Temp\8061.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\80EE.tmp"C:\Users\Admin\AppData\Local\Temp\80EE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\82D2.tmp"C:\Users\Admin\AppData\Local\Temp\82D2.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\834F.tmp"C:\Users\Admin\AppData\Local\Temp\834F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\8488.tmp"C:\Users\Admin\AppData\Local\Temp\8488.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\86AB.tmp"C:\Users\Admin\AppData\Local\Temp\86AB.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\8757.tmp"C:\Users\Admin\AppData\Local\Temp\8757.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\89F6.tmp"C:\Users\Admin\AppData\Local\Temp\89F6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"66⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"67⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"68⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"69⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\8D04.tmp"C:\Users\Admin\AppData\Local\Temp\8D04.tmp"70⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"71⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"72⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"73⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"74⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"75⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"76⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"77⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"78⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"79⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\9282.tmp"C:\Users\Admin\AppData\Local\Temp\9282.tmp"80⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\92FF.tmp"C:\Users\Admin\AppData\Local\Temp\92FF.tmp"81⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"82⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"83⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\94C4.tmp"C:\Users\Admin\AppData\Local\Temp\94C4.tmp"84⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"85⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"86⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"87⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\96A8.tmp"C:\Users\Admin\AppData\Local\Temp\96A8.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:292 -
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"89⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"90⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\981F.tmp"C:\Users\Admin\AppData\Local\Temp\981F.tmp"91⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"92⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"93⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\9A33.tmp"C:\Users\Admin\AppData\Local\Temp\9A33.tmp"95⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\9ABF.tmp"C:\Users\Admin\AppData\Local\Temp\9ABF.tmp"96⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"97⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"98⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"99⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"C:\Users\Admin\AppData\Local\Temp\9CE2.tmp"100⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"C:\Users\Admin\AppData\Local\Temp\9D5F.tmp"101⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"C:\Users\Admin\AppData\Local\Temp\9E4A.tmp"103⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9F82.tmp"C:\Users\Admin\AppData\Local\Temp\9F82.tmp"105⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"106⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\A08C.tmp"C:\Users\Admin\AppData\Local\Temp\A08C.tmp"107⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A109.tmp"C:\Users\Admin\AppData\Local\Temp\A109.tmp"108⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\A195.tmp"C:\Users\Admin\AppData\Local\Temp\A195.tmp"109⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A222.tmp"C:\Users\Admin\AppData\Local\Temp\A222.tmp"110⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"111⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\A31C.tmp"C:\Users\Admin\AppData\Local\Temp\A31C.tmp"112⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\A3A9.tmp"C:\Users\Admin\AppData\Local\Temp\A3A9.tmp"113⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\A426.tmp"C:\Users\Admin\AppData\Local\Temp\A426.tmp"114⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"115⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\A54E.tmp"C:\Users\Admin\AppData\Local\Temp\A54E.tmp"116⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"117⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\A687.tmp"C:\Users\Admin\AppData\Local\Temp\A687.tmp"118⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"119⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\A791.tmp"C:\Users\Admin\AppData\Local\Temp\A791.tmp"120⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\A83C.tmp"C:\Users\Admin\AppData\Local\Temp\A83C.tmp"121⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"C:\Users\Admin\AppData\Local\Temp\A8C9.tmp"122⤵PID:3316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-