Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 14:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_183237de352b4a3abb19382e4a24e33f_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_183237de352b4a3abb19382e4a24e33f_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-06-04_183237de352b4a3abb19382e4a24e33f_elex_mafia_poet-rat_stealc_tofsee.exe
- Size 3.6MB
- Sample260604-scmbqsg16w
- SHA256 6bd8b8027ba1a80aad890d1088ea56d7b82a4728833cd524e86b009f79c01dce
- MD5 183237de352b4a3abb19382e4a24e33f
- SHA1 c6e69703d94d18f105b1126bb1ba53e44db055d1
- SHA512 915c0c9bed01a02433ca07c9c915f422c65434c5371b9ed7aeee6f4d97d9ebc9a2d967802907a5d2cab2abba9973b215a69c6e20a46100e83523febdd6946e93
- SSDEEP 49152:w/OJDGJZNfVvNGEADt7i+/yTukuFGNLrkBirx:EOMJPflchrSiGdkBirx
- TLSH T15506931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5048 178A.tmp 2524 17F8.tmp 4876 1A1B.tmp 1976 1B92.tmp 4512 1CF9.tmp 1864 1E70.tmp 2628 1FD7.tmp 888 214E.tmp 3432 2277.tmp 1368 23B0.tmp 5964 24F8.tmp 5660 2621.tmp 4540 2815.tmp 5240 294D.tmp 4444 2AC4.tmp 3888 2BED.tmp 3996 2D54.tmp 5188 2EBC.tmp 3816 2F58.tmp 3128 30DF.tmp 1880 3236.tmp 2544 335F.tmp 3796 3498.tmp 704 35A1.tmp 5980 36EA.tmp 3556 3832.tmp 2036 3999.tmp 2720 3AE1.tmp 4792 3B7D.tmp 3392 3BCC.tmp 3808 3E4C.tmp 3720 3FA4.tmp 2084 410B.tmp 660 4179.tmp 2208 41D6.tmp 4616 4253.tmp 3792 42D0.tmp 2076 432E.tmp 4312 43AB.tmp 4700 4409.tmp 5596 4467.tmp 3180 44F3.tmp 992 4541.tmp 5388 45BE.tmp 5608 460D.tmp 3412 4699.tmp 5552 46E7.tmp 1740 4784.tmp 5408 47D2.tmp 400 482F.tmp 5216 487E.tmp 1812 48CC.tmp 3396 491A.tmp 4688 4968.tmp 128 49B6.tmp 464 4A04.tmp 3192 4A52.tmp 3920 4AA0.tmp 1456 4AEF.tmp 4372 4B3D.tmp 2908 4B8B.tmp 4148 4BE9.tmp 2220 4C37.tmp 3312 4C85.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 401C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 729B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 289D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F652.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_183237de352b4a3abb19382e4a24e33f_elex_mafia_poet-rat_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8364.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 5048 3528 2026-06-04_183237de352b4a3abb19382e4a24e33f_elex_mafia_poet-rat_stealc_tofsee.exe 81 PID 5048 wrote to memory of 2524 5048 178A.tmp 82 PID 2524 wrote to memory of 4876 2524 17F8.tmp 83 PID 4876 wrote to memory of 1976 4876 1A1B.tmp 84 PID 1976 wrote to memory of 4512 1976 1B92.tmp 85 PID 4512 wrote to memory of 1864 4512 1CF9.tmp 86 PID 1864 wrote to memory of 2628 1864 1E70.tmp 87 PID 2628 wrote to memory of 888 2628 1FD7.tmp 88 PID 888 wrote to memory of 3432 888 214E.tmp 89 PID 3432 wrote to memory of 1368 3432 2277.tmp 90 PID 1368 wrote to memory of 5964 1368 23B0.tmp 91 PID 5964 wrote to memory of 5660 5964 24F8.tmp 92 PID 5660 wrote to memory of 4540 5660 2621.tmp 93 PID 4540 wrote to memory of 5240 4540 2815.tmp 94 PID 5240 wrote to memory of 4444 5240 294D.tmp 95 PID 4444 wrote to memory of 3888 4444 2AC4.tmp 96 PID 3888 wrote to memory of 3996 3888 2BED.tmp 97 PID 3996 wrote to memory of 5188 3996 2D54.tmp 98 PID 5188 wrote to memory of 3816 5188 2EBC.tmp 99 PID 3816 wrote to memory of 3128 3816 2F58.tmp 100 PID 3128 wrote to memory of 1880 3128 30DF.tmp 101 PID 1880 wrote to memory of 2544 1880 3236.tmp 102 PID 2544 wrote to memory of 3796 2544 335F.tmp 103 PID 3796 wrote to memory of 704 3796 3498.tmp 104 PID 704 wrote to memory of 5980 704 35A1.tmp 105 PID 5980 wrote to memory of 3556 5980 36EA.tmp 106 PID 3556 wrote to memory of 2036 3556 3832.tmp 107 PID 2036 wrote to memory of 2720 2036 3999.tmp 108 PID 2720 wrote to memory of 4792 2720 3AE1.tmp 109 PID 4792 wrote to memory of 3392 4792 3B7D.tmp 110 PID 3392 wrote to memory of 3808 3392 3BCC.tmp 111 PID 3808 wrote to memory of 3720 3808 3E4C.tmp 112 PID 3720 wrote to memory of 2084 3720 3FA4.tmp 113 PID 2084 wrote to memory of 660 2084 410B.tmp 114 PID 660 wrote to memory of 2208 660 4179.tmp 115 PID 2208 wrote to memory of 4616 2208 41D6.tmp 116 PID 4616 wrote to memory of 3792 4616 4253.tmp 117 PID 3792 wrote to memory of 2076 3792 42D0.tmp 118 PID 2076 wrote to memory of 4312 2076 432E.tmp 119 PID 4312 wrote to memory of 4700 4312 43AB.tmp 120 PID 4700 wrote to memory of 5596 4700 4409.tmp 121 PID 5596 wrote to memory of 3180 5596 4467.tmp 122 PID 3180 wrote to memory of 992 3180 44F3.tmp 123 PID 992 wrote to memory of 5388 992 4541.tmp 124 PID 5388 wrote to memory of 5608 5388 45BE.tmp 125 PID 5608 wrote to memory of 3412 5608 460D.tmp 126 PID 3412 wrote to memory of 5552 3412 4699.tmp 127 PID 5552 wrote to memory of 1740 5552 46E7.tmp 128 PID 1740 wrote to memory of 5408 1740 4784.tmp 129 PID 5408 wrote to memory of 400 5408 47D2.tmp 130 PID 400 wrote to memory of 5216 400 482F.tmp 131 PID 5216 wrote to memory of 1812 5216 487E.tmp 132 PID 1812 wrote to memory of 3396 1812 48CC.tmp 133 PID 3396 wrote to memory of 4688 3396 491A.tmp 134 PID 4688 wrote to memory of 128 4688 4968.tmp 135 PID 128 wrote to memory of 464 128 49B6.tmp 136 PID 464 wrote to memory of 3192 464 4A04.tmp 137 PID 3192 wrote to memory of 3920 3192 4A52.tmp 138 PID 3920 wrote to memory of 1456 3920 4AA0.tmp 139 PID 1456 wrote to memory of 4372 1456 4AEF.tmp 140 PID 4372 wrote to memory of 2908 4372 4B3D.tmp 141 PID 2908 wrote to memory of 4148 2908 4B8B.tmp 142 PID 4148 wrote to memory of 2220 4148 4BE9.tmp 143 PID 2220 wrote to memory of 3312 2220 4C37.tmp 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_183237de352b4a3abb19382e4a24e33f_elex_mafia_poet-rat_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_183237de352b4a3abb19382e4a24e33f_elex_mafia_poet-rat_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\2815.tmp"C:\Users\Admin\AppData\Local\Temp\2815.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\2D54.tmp"C:\Users\Admin\AppData\Local\Temp\2D54.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\3999.tmp"C:\Users\Admin\AppData\Local\Temp\3999.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:128 -
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"65⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"66⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"67⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"68⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"69⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"70⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"71⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"72⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"73⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"74⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"75⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"76⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\503E.tmp"C:\Users\Admin\AppData\Local\Temp\503E.tmp"77⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"78⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"79⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"80⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"81⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"82⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"83⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"84⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"85⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"86⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"87⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"88⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\5426.tmp"C:\Users\Admin\AppData\Local\Temp\5426.tmp"89⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"90⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"91⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"92⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"93⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"94⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\560A.tmp"C:\Users\Admin\AppData\Local\Temp\560A.tmp"95⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"96⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"97⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"98⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\5743.tmp"C:\Users\Admin\AppData\Local\Temp\5743.tmp"99⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"100⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\57DF.tmp"C:\Users\Admin\AppData\Local\Temp\57DF.tmp"101⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"102⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"103⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"104⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"105⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"106⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"107⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"108⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"109⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"110⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"111⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"112⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"113⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"114⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"115⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"116⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"117⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"118⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"119⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"120⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"121⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"122⤵PID:4948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-