Analysis
- max time kernel
122s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-13_f0ed372a5de578d90032ca97cac74462_elex_mafia.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_f0ed372a5de578d90032ca97cac74462_elex_mafia.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-13_f0ed372a5de578d90032ca97cac74462_elex_mafia.exe
- Size 561KB
- Sample261014-b3c3baes4y
- SHA256 b75cf26fd3afab222d4c803a3861b02660aa78d77e31d18c2b547363eaeeb508
- MD5 f0ed372a5de578d90032ca97cac74462
- SHA1 276eca338024842b2eafb7af1ad0f5920541e305
- SHA512 200c24590b7da1b807b4475768d94e265b69f9e998a57d01c58f059b70daf217882e18cc6380a3cffd5a5a91f632438bddb0b63477f7357242b300faed2b134b
- SSDEEP 12288:mtZCN/mQz3o6p/iaK5z5JniIfmGc7aVSOoZ6SD7DZuL:mtZCcQDp/E15JnLPdVGZ6s7DoL
- TLSH T15CC4DF11F6D8C435F5B316345AF2DBA2493BBCA59B35D9CB2384226E2EB12C1C675323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1112 9968.tmp 5108 9A13.tmp 5008 9AB0.tmp 1716 9B4C.tmp 2488 9C27.tmp 4572 9DCD.tmp 3428 9E69.tmp 2288 9F05.tmp 6072 9F92.tmp 5584 A02E.tmp 3408 A0AB.tmp 3268 A157.tmp 4272 A1F3.tmp 1700 A2CE.tmp 4480 A389.tmp 1208 A445.tmp 5028 A510.tmp 3032 A5BC.tmp 5444 A677.tmp 5104 A733.tmp 5992 A7CF.tmp 3520 A88B.tmp 2096 A927.tmp 3776 A9B3.tmp 1500 AA8E.tmp 2356 AB69.tmp 5232 ABF6.tmp 4180 AC82.tmp 4792 ACFF.tmp 5072 ADAB.tmp 4996 AE57.tmp 5416 AED4.tmp 2844 AF70.tmp 2432 AFDE.tmp 3000 B07A.tmp 1380 B0D8.tmp 3952 B174.tmp 3104 B1F1.tmp 4764 B24F.tmp 5696 B2DB.tmp 4720 B349.tmp 5016 B3B6.tmp 4264 B433.tmp 5892 B4C0.tmp 3124 B55C.tmp 2908 B5C9.tmp 3044 B665.tmp 6028 B6D3.tmp 5112 B75F.tmp 1252 B7FC.tmp 4576 B8A8.tmp 2716 B934.tmp 1364 B9B1.tmp 4328 BA2E.tmp 5432 BABB.tmp 2792 BB47.tmp 1200 BBB5.tmp 4312 BC51.tmp 5084 BCCE.tmp 3188 BD3B.tmp 4912 BDC8.tmp 3412 BE35.tmp 3700 BEB2.tmp 1104 BF2F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B349.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D504.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 198F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1907.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E97C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5610.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E611.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 853F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E18C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56D7.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5564 wrote to memory of 1112 5564 2026-10-13_f0ed372a5de578d90032ca97cac74462_elex_mafia.exe 88 PID 1112 wrote to memory of 5108 1112 9968.tmp 89 PID 5108 wrote to memory of 5008 5108 9A13.tmp 90 PID 5008 wrote to memory of 1716 5008 9AB0.tmp 91 PID 1716 wrote to memory of 2488 1716 9B4C.tmp 92 PID 2488 wrote to memory of 4572 2488 9C27.tmp 93 PID 4572 wrote to memory of 3428 4572 9DCD.tmp 94 PID 3428 wrote to memory of 2288 3428 9E69.tmp 95 PID 2288 wrote to memory of 6072 2288 9F05.tmp 96 PID 6072 wrote to memory of 5584 6072 9F92.tmp 97 PID 5584 wrote to memory of 3408 5584 A02E.tmp 98 PID 3408 wrote to memory of 3268 3408 A0AB.tmp 99 PID 3268 wrote to memory of 4272 3268 A157.tmp 100 PID 4272 wrote to memory of 1700 4272 A1F3.tmp 101 PID 1700 wrote to memory of 4480 1700 A2CE.tmp 102 PID 4480 wrote to memory of 1208 4480 A389.tmp 103 PID 1208 wrote to memory of 5028 1208 A445.tmp 104 PID 5028 wrote to memory of 3032 5028 A510.tmp 105 PID 3032 wrote to memory of 5444 3032 A5BC.tmp 106 PID 5444 wrote to memory of 5104 5444 A677.tmp 107 PID 5104 wrote to memory of 5992 5104 A733.tmp 108 PID 5992 wrote to memory of 3520 5992 A7CF.tmp 109 PID 3520 wrote to memory of 2096 3520 A88B.tmp 110 PID 2096 wrote to memory of 3776 2096 A927.tmp 111 PID 3776 wrote to memory of 1500 3776 A9B3.tmp 112 PID 1500 wrote to memory of 2356 1500 AA8E.tmp 113 PID 2356 wrote to memory of 5232 2356 AB69.tmp 114 PID 5232 wrote to memory of 4180 5232 ABF6.tmp 115 PID 4180 wrote to memory of 4792 4180 AC82.tmp 116 PID 4792 wrote to memory of 5072 4792 ACFF.tmp 117 PID 5072 wrote to memory of 4996 5072 ADAB.tmp 118 PID 4996 wrote to memory of 5416 4996 AE57.tmp 119 PID 5416 wrote to memory of 2844 5416 AED4.tmp 120 PID 2844 wrote to memory of 2432 2844 AF70.tmp 121 PID 2432 wrote to memory of 3000 2432 AFDE.tmp 122 PID 3000 wrote to memory of 1380 3000 B07A.tmp 123 PID 1380 wrote to memory of 3952 1380 B0D8.tmp 124 PID 3952 wrote to memory of 3104 3952 B174.tmp 125 PID 3104 wrote to memory of 4764 3104 B1F1.tmp 126 PID 4764 wrote to memory of 5696 4764 B24F.tmp 127 PID 5696 wrote to memory of 4720 5696 B2DB.tmp 128 PID 4720 wrote to memory of 5016 4720 B349.tmp 129 PID 5016 wrote to memory of 4264 5016 B3B6.tmp 130 PID 4264 wrote to memory of 5892 4264 B433.tmp 131 PID 5892 wrote to memory of 3124 5892 B4C0.tmp 132 PID 3124 wrote to memory of 2908 3124 B55C.tmp 133 PID 2908 wrote to memory of 3044 2908 B5C9.tmp 134 PID 3044 wrote to memory of 6028 3044 B665.tmp 135 PID 6028 wrote to memory of 5112 6028 B6D3.tmp 136 PID 5112 wrote to memory of 1252 5112 B75F.tmp 137 PID 1252 wrote to memory of 4576 1252 B7FC.tmp 138 PID 4576 wrote to memory of 2716 4576 B8A8.tmp 139 PID 2716 wrote to memory of 1364 2716 B934.tmp 140 PID 1364 wrote to memory of 4328 1364 B9B1.tmp 141 PID 4328 wrote to memory of 5432 4328 BA2E.tmp 142 PID 5432 wrote to memory of 2792 5432 BABB.tmp 143 PID 2792 wrote to memory of 1200 2792 BB47.tmp 144 PID 1200 wrote to memory of 4312 1200 BBB5.tmp 145 PID 4312 wrote to memory of 5084 4312 BC51.tmp 146 PID 5084 wrote to memory of 3188 5084 BCCE.tmp 147 PID 3188 wrote to memory of 4912 3188 BD3B.tmp 148 PID 4912 wrote to memory of 3412 4912 BDC8.tmp 149 PID 3412 wrote to memory of 3700 3412 BE35.tmp 150 PID 3700 wrote to memory of 1104 3700 BEB2.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_f0ed372a5de578d90032ca97cac74462_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_f0ed372a5de578d90032ca97cac74462_elex_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\9968.tmp"C:\Users\Admin\AppData\Local\Temp\9968.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\9E69.tmp"C:\Users\Admin\AppData\Local\Temp\9E69.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\9F05.tmp"C:\Users\Admin\AppData\Local\Temp\9F05.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\A389.tmp"C:\Users\Admin\AppData\Local\Temp\A389.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A445.tmp"C:\Users\Admin\AppData\Local\Temp\A445.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\A510.tmp"C:\Users\Admin\AppData\Local\Temp\A510.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"C:\Users\Admin\AppData\Local\Temp\A5BC.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A677.tmp"C:\Users\Admin\AppData\Local\Temp\A677.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\A733.tmp"C:\Users\Admin\AppData\Local\Temp\A733.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\A927.tmp"C:\Users\Admin\AppData\Local\Temp\A927.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"C:\Users\Admin\AppData\Local\Temp\ABF6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"C:\Users\Admin\AppData\Local\Temp\ACFF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\AE57.tmp"C:\Users\Admin\AppData\Local\Temp\AE57.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\AED4.tmp"C:\Users\Admin\AppData\Local\Temp\AED4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\AF70.tmp"C:\Users\Admin\AppData\Local\Temp\AF70.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"C:\Users\Admin\AppData\Local\Temp\AFDE.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\B433.tmp"C:\Users\Admin\AppData\Local\Temp\B433.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"C:\Users\Admin\AppData\Local\Temp\B4C0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\B55C.tmp"C:\Users\Admin\AppData\Local\Temp\B55C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\B665.tmp"C:\Users\Admin\AppData\Local\Temp\B665.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\B75F.tmp"C:\Users\Admin\AppData\Local\Temp\B75F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"C:\Users\Admin\AppData\Local\Temp\B7FC.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\B934.tmp"C:\Users\Admin\AppData\Local\Temp\B934.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"C:\Users\Admin\AppData\Local\Temp\B9B1.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"C:\Users\Admin\AppData\Local\Temp\BA2E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\BABB.tmp"C:\Users\Admin\AppData\Local\Temp\BABB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\BC51.tmp"C:\Users\Admin\AppData\Local\Temp\BC51.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCCE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"C:\Users\Admin\AppData\Local\Temp\BD3B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"C:\Users\Admin\AppData\Local\Temp\BDC8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"C:\Users\Admin\AppData\Local\Temp\BEB2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"C:\Users\Admin\AppData\Local\Temp\BF2F.tmp"65⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\C00A.tmp"C:\Users\Admin\AppData\Local\Temp\C00A.tmp"67⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\C097.tmp"C:\Users\Admin\AppData\Local\Temp\C097.tmp"68⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C114.tmp"C:\Users\Admin\AppData\Local\Temp\C114.tmp"69⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\C191.tmp"C:\Users\Admin\AppData\Local\Temp\C191.tmp"70⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\C20E.tmp"C:\Users\Admin\AppData\Local\Temp\C20E.tmp"71⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\C27B.tmp"C:\Users\Admin\AppData\Local\Temp\C27B.tmp"72⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"C:\Users\Admin\AppData\Local\Temp\C2F8.tmp"73⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\C366.tmp"C:\Users\Admin\AppData\Local\Temp\C366.tmp"74⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"75⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\C460.tmp"C:\Users\Admin\AppData\Local\Temp\C460.tmp"76⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"C:\Users\Admin\AppData\Local\Temp\C4DD.tmp"77⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"78⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"79⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\C654.tmp"C:\Users\Admin\AppData\Local\Temp\C654.tmp"80⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"C:\Users\Admin\AppData\Local\Temp\C6F0.tmp"81⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\C76D.tmp"C:\Users\Admin\AppData\Local\Temp\C76D.tmp"82⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"83⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\C896.tmp"C:\Users\Admin\AppData\Local\Temp\C896.tmp"84⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"85⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"86⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"88⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"89⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\CB93.tmp"C:\Users\Admin\AppData\Local\Temp\CB93.tmp"90⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\CC01.tmp"C:\Users\Admin\AppData\Local\Temp\CC01.tmp"91⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"C:\Users\Admin\AppData\Local\Temp\CC7E.tmp"92⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"93⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\CD78.tmp"C:\Users\Admin\AppData\Local\Temp\CD78.tmp"94⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"95⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"96⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"97⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"98⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\D018.tmp"C:\Users\Admin\AppData\Local\Temp\D018.tmp"99⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"100⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\D150.tmp"C:\Users\Admin\AppData\Local\Temp\D150.tmp"101⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"C:\Users\Admin\AppData\Local\Temp\D1EC.tmp"102⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"103⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"C:\Users\Admin\AppData\Local\Temp\D2D7.tmp"104⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\D354.tmp"C:\Users\Admin\AppData\Local\Temp\D354.tmp"105⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"106⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"107⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"108⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"109⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\D603.tmp"C:\Users\Admin\AppData\Local\Temp\D603.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"112⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"113⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"114⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"115⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"116⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"117⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"118⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\DA78.tmp"C:\Users\Admin\AppData\Local\Temp\DA78.tmp"119⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\DB04.tmp"C:\Users\Admin\AppData\Local\Temp\DB04.tmp"120⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\DB72.tmp"C:\Users\Admin\AppData\Local\Temp\DB72.tmp"121⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"C:\Users\Admin\AppData\Local\Temp\DBEF.tmp"122⤵PID:5604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-