Analysis
- max time kernel
116s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_05e73e2f5d2abcbd23f2964d4e036868_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_05e73e2f5d2abcbd23f2964d4e036868_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-24_05e73e2f5d2abcbd23f2964d4e036868_elex_mafia.exe
- Size 524KB
- Sample260924-e6cgqs1x3j
- SHA256 20a341c63c615738748a3fb4417daa036abf2caa5ba51843cd6e37e19dd44a5a
- MD5 05e73e2f5d2abcbd23f2964d4e036868
- SHA1 564908cd7dc0e3860063612a18f02c2d0da5f12b
- SHA512 7c823051965ff9a008340fbe3384814d7866cae447993cf6e4c92741d469b21ee11c02ad073fc9ca60a63616c2aa181dc156bb0617afed19cdd5dbbb9e3fdbb4
- SSDEEP 12288:TRyZzqyL66TyqdfFLbF90cjloo6tcll87r5m6h0NZ:TRyQylTy2LbFPjlwclQrg6h0N
- TLSH T181B4E016758AC436F28211358A66DBA61A3B3DB5972764CB3BC5363E2FB03D1D2B4307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4344 6C96.tmp 1508 6D90.tmp 3620 6E4C.tmp 5496 6FD2.tmp 3504 70DC.tmp 5308 71F5.tmp 5696 730E.tmp 4172 7418.tmp 2340 7512.tmp 1740 75CD.tmp 3592 76A8.tmp 2628 7764.tmp 1228 782F.tmp 2492 78EA.tmp 1496 79B5.tmp 2776 7A90.tmp 4328 7B8A.tmp 2540 7C55.tmp 4776 7D20.tmp 4716 7DEC.tmp 3884 7EC6.tmp 2036 7F82.tmp 3232 806C.tmp 3308 8166.tmp 5920 8231.tmp 4740 835A.tmp 1064 8435.tmp 752 84F0.tmp 5216 85EA.tmp 3268 86A6.tmp 3500 87A0.tmp 3984 886B.tmp 364 8975.tmp 2820 8A11.tmp 4584 8ACC.tmp 2324 8B88.tmp 4980 8C15.tmp 4544 8CC0.tmp 5792 8D3D.tmp 3536 8E09.tmp 4396 8E76.tmp 548 8F22.tmp 1008 8FAE.tmp 3572 904B.tmp 4268 90F7.tmp 3328 9183.tmp 3428 9210.tmp 1116 92BC.tmp 5016 9329.tmp 3464 93A6.tmp 2904 9423.tmp 3856 94A0.tmp 4856 952D.tmp 2160 95AA.tmp 3720 9636.tmp 1096 9694.tmp 3316 9711.tmp 2732 978E.tmp 3280 980B.tmp 2656 9888.tmp 1640 9905.tmp 3848 9982.tmp 1432 99FF.tmp 1632 9A8C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B293.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 489E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 582F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6221.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1871.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 980B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 244D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A336.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8818.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E05F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C94C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25D4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 4344 2616 2026-09-24_05e73e2f5d2abcbd23f2964d4e036868_elex_mafia.exe 89 PID 4344 wrote to memory of 1508 4344 6C96.tmp 90 PID 1508 wrote to memory of 3620 1508 6D90.tmp 91 PID 3620 wrote to memory of 5496 3620 6E4C.tmp 92 PID 5496 wrote to memory of 3504 5496 6FD2.tmp 93 PID 3504 wrote to memory of 5308 3504 70DC.tmp 94 PID 5308 wrote to memory of 5696 5308 71F5.tmp 95 PID 5696 wrote to memory of 4172 5696 730E.tmp 96 PID 4172 wrote to memory of 2340 4172 7418.tmp 97 PID 2340 wrote to memory of 1740 2340 7512.tmp 98 PID 1740 wrote to memory of 3592 1740 75CD.tmp 99 PID 3592 wrote to memory of 2628 3592 76A8.tmp 100 PID 2628 wrote to memory of 1228 2628 7764.tmp 101 PID 1228 wrote to memory of 2492 1228 782F.tmp 102 PID 2492 wrote to memory of 1496 2492 78EA.tmp 103 PID 1496 wrote to memory of 2776 1496 79B5.tmp 104 PID 2776 wrote to memory of 4328 2776 7A90.tmp 105 PID 4328 wrote to memory of 2540 4328 7B8A.tmp 106 PID 2540 wrote to memory of 4776 2540 7C55.tmp 107 PID 4776 wrote to memory of 4716 4776 7D20.tmp 108 PID 4716 wrote to memory of 3884 4716 7DEC.tmp 109 PID 3884 wrote to memory of 2036 3884 7EC6.tmp 110 PID 2036 wrote to memory of 3232 2036 7F82.tmp 111 PID 3232 wrote to memory of 3308 3232 806C.tmp 112 PID 3308 wrote to memory of 5920 3308 8166.tmp 113 PID 5920 wrote to memory of 4740 5920 8231.tmp 114 PID 4740 wrote to memory of 1064 4740 835A.tmp 115 PID 1064 wrote to memory of 752 1064 8435.tmp 116 PID 752 wrote to memory of 5216 752 84F0.tmp 117 PID 5216 wrote to memory of 3268 5216 85EA.tmp 118 PID 3268 wrote to memory of 3500 3268 86A6.tmp 119 PID 3500 wrote to memory of 3984 3500 87A0.tmp 120 PID 3984 wrote to memory of 364 3984 886B.tmp 121 PID 364 wrote to memory of 2820 364 8975.tmp 122 PID 2820 wrote to memory of 4584 2820 8A11.tmp 123 PID 4584 wrote to memory of 2324 4584 8ACC.tmp 124 PID 2324 wrote to memory of 4980 2324 8B88.tmp 125 PID 4980 wrote to memory of 4544 4980 8C15.tmp 126 PID 4544 wrote to memory of 5792 4544 8CC0.tmp 127 PID 5792 wrote to memory of 3536 5792 8D3D.tmp 128 PID 3536 wrote to memory of 4396 3536 8E09.tmp 129 PID 4396 wrote to memory of 548 4396 8E76.tmp 130 PID 548 wrote to memory of 1008 548 8F22.tmp 131 PID 1008 wrote to memory of 3572 1008 8FAE.tmp 132 PID 3572 wrote to memory of 4268 3572 904B.tmp 133 PID 4268 wrote to memory of 3328 4268 90F7.tmp 134 PID 3328 wrote to memory of 3428 3328 9183.tmp 135 PID 3428 wrote to memory of 1116 3428 9210.tmp 136 PID 1116 wrote to memory of 5016 1116 92BC.tmp 137 PID 5016 wrote to memory of 3464 5016 9329.tmp 138 PID 3464 wrote to memory of 2904 3464 93A6.tmp 139 PID 2904 wrote to memory of 3856 2904 9423.tmp 140 PID 3856 wrote to memory of 4856 3856 94A0.tmp 141 PID 4856 wrote to memory of 2160 4856 952D.tmp 142 PID 2160 wrote to memory of 3720 2160 95AA.tmp 143 PID 3720 wrote to memory of 1096 3720 9636.tmp 144 PID 1096 wrote to memory of 3316 1096 9694.tmp 145 PID 3316 wrote to memory of 2732 3316 9711.tmp 146 PID 2732 wrote to memory of 3280 2732 978E.tmp 147 PID 3280 wrote to memory of 2656 3280 980B.tmp 148 PID 2656 wrote to memory of 1640 2656 9888.tmp 149 PID 1640 wrote to memory of 3848 1640 9905.tmp 150 PID 3848 wrote to memory of 1432 3848 9982.tmp 151 PID 1432 wrote to memory of 1632 1432 99FF.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_05e73e2f5d2abcbd23f2964d4e036868_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_05e73e2f5d2abcbd23f2964d4e036868_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\6C96.tmp"C:\Users\Admin\AppData\Local\Temp\6C96.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\6D90.tmp"C:\Users\Admin\AppData\Local\Temp\6D90.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\7418.tmp"C:\Users\Admin\AppData\Local\Temp\7418.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\7512.tmp"C:\Users\Admin\AppData\Local\Temp\7512.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\75CD.tmp"C:\Users\Admin\AppData\Local\Temp\75CD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\76A8.tmp"C:\Users\Admin\AppData\Local\Temp\76A8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\7764.tmp"C:\Users\Admin\AppData\Local\Temp\7764.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\782F.tmp"C:\Users\Admin\AppData\Local\Temp\782F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\78EA.tmp"C:\Users\Admin\AppData\Local\Temp\78EA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\79B5.tmp"C:\Users\Admin\AppData\Local\Temp\79B5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\7A90.tmp"C:\Users\Admin\AppData\Local\Temp\7A90.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\7C55.tmp"C:\Users\Admin\AppData\Local\Temp\7C55.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\7DEC.tmp"C:\Users\Admin\AppData\Local\Temp\7DEC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\7F82.tmp"C:\Users\Admin\AppData\Local\Temp\7F82.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\806C.tmp"C:\Users\Admin\AppData\Local\Temp\806C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\8231.tmp"C:\Users\Admin\AppData\Local\Temp\8231.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\835A.tmp"C:\Users\Admin\AppData\Local\Temp\835A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\84F0.tmp"C:\Users\Admin\AppData\Local\Temp\84F0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\85EA.tmp"C:\Users\Admin\AppData\Local\Temp\85EA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\86A6.tmp"C:\Users\Admin\AppData\Local\Temp\86A6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\87A0.tmp"C:\Users\Admin\AppData\Local\Temp\87A0.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\886B.tmp"C:\Users\Admin\AppData\Local\Temp\886B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\8975.tmp"C:\Users\Admin\AppData\Local\Temp\8975.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\8A11.tmp"C:\Users\Admin\AppData\Local\Temp\8A11.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\8C15.tmp"C:\Users\Admin\AppData\Local\Temp\8C15.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8CC0.tmp"C:\Users\Admin\AppData\Local\Temp\8CC0.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\8D3D.tmp"C:\Users\Admin\AppData\Local\Temp\8D3D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\8E09.tmp"C:\Users\Admin\AppData\Local\Temp\8E09.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\8E76.tmp"C:\Users\Admin\AppData\Local\Temp\8E76.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\8F22.tmp"C:\Users\Admin\AppData\Local\Temp\8F22.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\8FAE.tmp"C:\Users\Admin\AppData\Local\Temp\8FAE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\904B.tmp"C:\Users\Admin\AppData\Local\Temp\904B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\90F7.tmp"C:\Users\Admin\AppData\Local\Temp\90F7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\9183.tmp"C:\Users\Admin\AppData\Local\Temp\9183.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\9210.tmp"C:\Users\Admin\AppData\Local\Temp\9210.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\92BC.tmp"C:\Users\Admin\AppData\Local\Temp\92BC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\9329.tmp"C:\Users\Admin\AppData\Local\Temp\9329.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\93A6.tmp"C:\Users\Admin\AppData\Local\Temp\93A6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\9423.tmp"C:\Users\Admin\AppData\Local\Temp\9423.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\94A0.tmp"C:\Users\Admin\AppData\Local\Temp\94A0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\952D.tmp"C:\Users\Admin\AppData\Local\Temp\952D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\95AA.tmp"C:\Users\Admin\AppData\Local\Temp\95AA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\9636.tmp"C:\Users\Admin\AppData\Local\Temp\9636.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\9694.tmp"C:\Users\Admin\AppData\Local\Temp\9694.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9982.tmp"C:\Users\Admin\AppData\Local\Temp\9982.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\99FF.tmp"C:\Users\Admin\AppData\Local\Temp\99FF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\9A8C.tmp"C:\Users\Admin\AppData\Local\Temp\9A8C.tmp"65⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\9B09.tmp"C:\Users\Admin\AppData\Local\Temp\9B09.tmp"66⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\9B95.tmp"C:\Users\Admin\AppData\Local\Temp\9B95.tmp"67⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\9C12.tmp"C:\Users\Admin\AppData\Local\Temp\9C12.tmp"68⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\9CBE.tmp"C:\Users\Admin\AppData\Local\Temp\9CBE.tmp"69⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9D4B.tmp"C:\Users\Admin\AppData\Local\Temp\9D4B.tmp"70⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"C:\Users\Admin\AppData\Local\Temp\9DF7.tmp"71⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9E64.tmp"C:\Users\Admin\AppData\Local\Temp\9E64.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\9ED1.tmp"C:\Users\Admin\AppData\Local\Temp\9ED1.tmp"73⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\9F4E.tmp"C:\Users\Admin\AppData\Local\Temp\9F4E.tmp"74⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\9FCB.tmp"C:\Users\Admin\AppData\Local\Temp\9FCB.tmp"75⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\A048.tmp"C:\Users\Admin\AppData\Local\Temp\A048.tmp"76⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\A0D5.tmp"C:\Users\Admin\AppData\Local\Temp\A0D5.tmp"77⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A152.tmp"C:\Users\Admin\AppData\Local\Temp\A152.tmp"78⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\A1DF.tmp"C:\Users\Admin\AppData\Local\Temp\A1DF.tmp"79⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\A25C.tmp"C:\Users\Admin\AppData\Local\Temp\A25C.tmp"80⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\A2C9.tmp"C:\Users\Admin\AppData\Local\Temp\A2C9.tmp"81⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\A336.tmp"C:\Users\Admin\AppData\Local\Temp\A336.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\A3B3.tmp"C:\Users\Admin\AppData\Local\Temp\A3B3.tmp"83⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A421.tmp"C:\Users\Admin\AppData\Local\Temp\A421.tmp"84⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"C:\Users\Admin\AppData\Local\Temp\A4AD.tmp"85⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\A51B.tmp"C:\Users\Admin\AppData\Local\Temp\A51B.tmp"86⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\A5A7.tmp"C:\Users\Admin\AppData\Local\Temp\A5A7.tmp"87⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\A615.tmp"C:\Users\Admin\AppData\Local\Temp\A615.tmp"88⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\A682.tmp"C:\Users\Admin\AppData\Local\Temp\A682.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\A70F.tmp"C:\Users\Admin\AppData\Local\Temp\A70F.tmp"90⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\A79B.tmp"C:\Users\Admin\AppData\Local\Temp\A79B.tmp"91⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\A809.tmp"C:\Users\Admin\AppData\Local\Temp\A809.tmp"92⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\A886.tmp"C:\Users\Admin\AppData\Local\Temp\A886.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\A903.tmp"C:\Users\Admin\AppData\Local\Temp\A903.tmp"94⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\A980.tmp"C:\Users\Admin\AppData\Local\Temp\A980.tmp"95⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\AA1C.tmp"C:\Users\Admin\AppData\Local\Temp\AA1C.tmp"96⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\AA7A.tmp"C:\Users\Admin\AppData\Local\Temp\AA7A.tmp"97⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\AB06.tmp"C:\Users\Admin\AppData\Local\Temp\AB06.tmp"98⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\AB83.tmp"C:\Users\Admin\AppData\Local\Temp\AB83.tmp"99⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\AC00.tmp"C:\Users\Admin\AppData\Local\Temp\AC00.tmp"100⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\AC7D.tmp"C:\Users\Admin\AppData\Local\Temp\AC7D.tmp"101⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"C:\Users\Admin\AppData\Local\Temp\AD1A.tmp"102⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\AD97.tmp"C:\Users\Admin\AppData\Local\Temp\AD97.tmp"103⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\AE04.tmp"C:\Users\Admin\AppData\Local\Temp\AE04.tmp"104⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\AE91.tmp"C:\Users\Admin\AppData\Local\Temp\AE91.tmp"105⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"106⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\AF9A.tmp"C:\Users\Admin\AppData\Local\Temp\AF9A.tmp"107⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B017.tmp"C:\Users\Admin\AppData\Local\Temp\B017.tmp"108⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B094.tmp"C:\Users\Admin\AppData\Local\Temp\B094.tmp"109⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\B102.tmp"C:\Users\Admin\AppData\Local\Temp\B102.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\B16F.tmp"C:\Users\Admin\AppData\Local\Temp\B16F.tmp"111⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\B1EC.tmp"C:\Users\Admin\AppData\Local\Temp\B1EC.tmp"112⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\B259.tmp"C:\Users\Admin\AppData\Local\Temp\B259.tmp"113⤵PID:52
-
C:\Users\Admin\AppData\Local\Temp\B2C7.tmp"C:\Users\Admin\AppData\Local\Temp\B2C7.tmp"114⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\B344.tmp"C:\Users\Admin\AppData\Local\Temp\B344.tmp"115⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\B3B1.tmp"C:\Users\Admin\AppData\Local\Temp\B3B1.tmp"116⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\B42E.tmp"C:\Users\Admin\AppData\Local\Temp\B42E.tmp"117⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B49C.tmp"C:\Users\Admin\AppData\Local\Temp\B49C.tmp"118⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\B509.tmp"C:\Users\Admin\AppData\Local\Temp\B509.tmp"119⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\B576.tmp"C:\Users\Admin\AppData\Local\Temp\B576.tmp"120⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\B5F3.tmp"C:\Users\Admin\AppData\Local\Temp\B5F3.tmp"121⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\B670.tmp"C:\Users\Admin\AppData\Local\Temp\B670.tmp"122⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-