Analysis
- max time kernel
46s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_568830cc6675666f3f389fedfd5e2658_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_568830cc6675666f3f389fedfd5e2658_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
General
- Target 2026-07-08_568830cc6675666f3f389fedfd5e2658_elex_mafia_poet-rat_stealc_tofsee.exe
- Size 3.6MB
- Sample260708-e889gsbw9j
- SHA256 7a0c1fd9c2d4c5915f9c7f06dd767c32c333ae7d146bd1042a96d67332560a90
- MD5 568830cc6675666f3f389fedfd5e2658
- SHA1 7c3fac734ddbd746474c28d0da4157912422bdf2
- SHA512 357e89b25825f37597ec28aa91e3b64d85847ae4ca91d3dfb4da6829f64d934aa1f88c265e0f8d2528d586dc91085c64f20ce5c00f1a622c99f4cdaf5c67e3d5
- SSDEEP 49152:w/OJD/sGe1zNGEADt7i+/yTukuFGNLrkBirxsP:EOXwzchrSiGdkBirx
- TLSH T10C0694113BFAC635F2BF8B316EB2E694197BF9629D51C25F2069424E1C35B408E63732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 3660 94D.tmp 5204 A66.tmp 800 F0A.tmp 5660 1227.tmp 3068 1515.tmp 5312 17F3.tmp 5472 1AB2.tmp 4292 1DBF.tmp 596 20BD.tmp 3172 2224.tmp 1264 2699.tmp 4992 291A.tmp 5292 2A62.tmp 5716 2DEC.tmp 2228 30AB.tmp 5956 33B8.tmp 3088 3500.tmp 6140 382D.tmp 2988 3B2B.tmp 2628 3E67.tmp 1116 3F90.tmp 5272 4329.tmp 4720 456C.tmp 256 48A8.tmp 2364 49F0.tmp 2856 4E55.tmp 2392 5124.tmp 1356 526C.tmp 5780 56F0.tmp 4472 59DE.tmp 3008 5DA7.tmp 4168 6085.tmp 1860 6354.tmp 4452 643E.tmp 2468 6538.tmp 1668 6603.tmp 3952 66FD.tmp 2052 67F7.tmp 2460 68E2.tmp 3436 69EB.tmp 3800 6AF5.tmp 2888 6BFF.tmp 4056 6D08.tmp 2448 6DF3.tmp 1904 6EDD.tmp 2420 6FB8.tmp 4716 70D1.tmp 1812 719C.tmp 3264 7277.tmp 3440 7323.tmp 4460 73DE.tmp 764 749A.tmp 3036 7565.tmp 3892 7620.tmp 3656 76CC.tmp 756 7778.tmp 5380 7824.tmp 3292 78D0.tmp 4504 798B.tmp 3512 7A37.tmp 4076 7AD3.tmp 3040 7B7F.tmp 3712 7C3B.tmp 3912 7CF6.tmp - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 938C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3500.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 798B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 841A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8004.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A56E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 815B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 836F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5124.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 913A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{E8B87BFB-EA88-449B-9FD2-7E47A513F4DF} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{2AC43F14-3AFC-44BE-B7D8-33582E230469} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\NotificationData explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5720 explorer.exe 5720 explorer.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 3368 sihost.exe 5720 explorer.exe 5720 explorer.exe 5720 explorer.exe 5720 explorer.exe 5720 explorer.exe 5720 explorer.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5720 explorer.exe 5720 explorer.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1792 StartMenuExperienceHost.exe 1600 SearchHost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 3660 4372 2026-07-08_568830cc6675666f3f389fedfd5e2658_elex_mafia_poet-rat_stealc_tofsee.exe 87 PID 3660 wrote to memory of 5204 3660 94D.tmp 88 PID 5204 wrote to memory of 800 5204 A66.tmp 89 PID 800 wrote to memory of 5660 800 F0A.tmp 90 PID 5660 wrote to memory of 3068 5660 1227.tmp 91 PID 3068 wrote to memory of 5312 3068 1515.tmp 92 PID 5312 wrote to memory of 5472 5312 17F3.tmp 93 PID 5472 wrote to memory of 4292 5472 1AB2.tmp 94 PID 4292 wrote to memory of 596 4292 1DBF.tmp 95 PID 596 wrote to memory of 3172 596 20BD.tmp 96 PID 3172 wrote to memory of 1264 3172 2224.tmp 97 PID 1264 wrote to memory of 4992 1264 2699.tmp 98 PID 4992 wrote to memory of 5292 4992 291A.tmp 99 PID 5292 wrote to memory of 5716 5292 2A62.tmp 100 PID 5716 wrote to memory of 2228 5716 2DEC.tmp 101 PID 2228 wrote to memory of 5956 2228 30AB.tmp 102 PID 5956 wrote to memory of 3088 5956 33B8.tmp 103 PID 3088 wrote to memory of 6140 3088 3500.tmp 104 PID 6140 wrote to memory of 2988 6140 382D.tmp 105 PID 2988 wrote to memory of 2628 2988 3B2B.tmp 106 PID 2628 wrote to memory of 1116 2628 3E67.tmp 107 PID 1116 wrote to memory of 5272 1116 3F90.tmp 108 PID 5272 wrote to memory of 4720 5272 4329.tmp 109 PID 4720 wrote to memory of 256 4720 456C.tmp 110 PID 256 wrote to memory of 2364 256 48A8.tmp 111 PID 2364 wrote to memory of 2856 2364 49F0.tmp 112 PID 2856 wrote to memory of 2392 2856 4E55.tmp 113 PID 2392 wrote to memory of 1356 2392 5124.tmp 114 PID 1356 wrote to memory of 5780 1356 526C.tmp 115 PID 5780 wrote to memory of 4472 5780 56F0.tmp 116 PID 4472 wrote to memory of 3008 4472 59DE.tmp 117 PID 3008 wrote to memory of 4168 3008 5DA7.tmp 118 PID 4168 wrote to memory of 1860 4168 6085.tmp 119 PID 1860 wrote to memory of 4452 1860 6354.tmp 120 PID 4452 wrote to memory of 2468 4452 643E.tmp 121 PID 2468 wrote to memory of 1668 2468 6538.tmp 122 PID 1668 wrote to memory of 3952 1668 6603.tmp 123 PID 3952 wrote to memory of 2052 3952 66FD.tmp 124 PID 2052 wrote to memory of 2460 2052 67F7.tmp 125 PID 2460 wrote to memory of 3436 2460 68E2.tmp 126 PID 3436 wrote to memory of 3800 3436 69EB.tmp 127 PID 3800 wrote to memory of 2888 3800 6AF5.tmp 128 PID 2888 wrote to memory of 4056 2888 6BFF.tmp 129 PID 4056 wrote to memory of 2448 4056 6D08.tmp 130 PID 2448 wrote to memory of 1904 2448 6DF3.tmp 131 PID 1904 wrote to memory of 2420 1904 6EDD.tmp 132 PID 2420 wrote to memory of 4716 2420 6FB8.tmp 133 PID 4716 wrote to memory of 1812 4716 70D1.tmp 134 PID 1812 wrote to memory of 3264 1812 719C.tmp 135 PID 3264 wrote to memory of 3440 3264 7277.tmp 136 PID 3440 wrote to memory of 4460 3440 7323.tmp 137 PID 4460 wrote to memory of 764 4460 73DE.tmp 138 PID 764 wrote to memory of 3036 764 749A.tmp 139 PID 3036 wrote to memory of 3892 3036 7565.tmp 140 PID 3892 wrote to memory of 3656 3892 7620.tmp 141 PID 3656 wrote to memory of 756 3656 76CC.tmp 142 PID 756 wrote to memory of 5380 756 7778.tmp 143 PID 5380 wrote to memory of 3292 5380 7824.tmp 144 PID 3292 wrote to memory of 4504 3292 78D0.tmp 145 PID 4504 wrote to memory of 3512 4504 798B.tmp 146 PID 3512 wrote to memory of 4076 3512 7A37.tmp 147 PID 4076 wrote to memory of 3040 4076 7AD3.tmp 149 PID 3040 wrote to memory of 3712 3040 7B7F.tmp 150 PID 3712 wrote to memory of 3912 3712 7C3B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_568830cc6675666f3f389fedfd5e2658_elex_mafia_poet-rat_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_568830cc6675666f3f389fedfd5e2658_elex_mafia_poet-rat_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\94D.tmp"C:\Users\Admin\AppData\Local\Temp\94D.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\A66.tmp"C:\Users\Admin\AppData\Local\Temp\A66.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\F0A.tmp"C:\Users\Admin\AppData\Local\Temp\F0A.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\1515.tmp"C:\Users\Admin\AppData\Local\Temp\1515.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\17F3.tmp"C:\Users\Admin\AppData\Local\Temp\17F3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"C:\Users\Admin\AppData\Local\Temp\1DBF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\2224.tmp"C:\Users\Admin\AppData\Local\Temp\2224.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\2699.tmp"C:\Users\Admin\AppData\Local\Temp\2699.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\291A.tmp"C:\Users\Admin\AppData\Local\Temp\291A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\2A62.tmp"C:\Users\Admin\AppData\Local\Temp\2A62.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\33B8.tmp"C:\Users\Admin\AppData\Local\Temp\33B8.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\3500.tmp"C:\Users\Admin\AppData\Local\Temp\3500.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\456C.tmp"C:\Users\Admin\AppData\Local\Temp\456C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\48A8.tmp"C:\Users\Admin\AppData\Local\Temp\48A8.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\56F0.tmp"C:\Users\Admin\AppData\Local\Temp\56F0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\59DE.tmp"C:\Users\Admin\AppData\Local\Temp\59DE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\6354.tmp"C:\Users\Admin\AppData\Local\Temp\6354.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\643E.tmp"C:\Users\Admin\AppData\Local\Temp\643E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\6538.tmp"C:\Users\Admin\AppData\Local\Temp\6538.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\6AF5.tmp"C:\Users\Admin\AppData\Local\Temp\6AF5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"C:\Users\Admin\AppData\Local\Temp\6BFF.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\6D08.tmp"C:\Users\Admin\AppData\Local\Temp\6D08.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\719C.tmp"C:\Users\Admin\AppData\Local\Temp\719C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\7277.tmp"C:\Users\Admin\AppData\Local\Temp\7277.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\7323.tmp"C:\Users\Admin\AppData\Local\Temp\7323.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7620.tmp"C:\Users\Admin\AppData\Local\Temp\7620.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\7778.tmp"C:\Users\Admin\AppData\Local\Temp\7778.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\7824.tmp"C:\Users\Admin\AppData\Local\Temp\7824.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\78D0.tmp"C:\Users\Admin\AppData\Local\Temp\78D0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"65⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"66⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\7F48.tmp"C:\Users\Admin\AppData\Local\Temp\7F48.tmp"68⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\815B.tmp"C:\Users\Admin\AppData\Local\Temp\815B.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\8207.tmp"C:\Users\Admin\AppData\Local\Temp\8207.tmp"72⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\841A.tmp"C:\Users\Admin\AppData\Local\Temp\841A.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\84D6.tmp"C:\Users\Admin\AppData\Local\Temp\84D6.tmp"76⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"77⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\86AB.tmp"C:\Users\Admin\AppData\Local\Temp\86AB.tmp"78⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\8776.tmp"C:\Users\Admin\AppData\Local\Temp\8776.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"81⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\89A8.tmp"C:\Users\Admin\AppData\Local\Temp\89A8.tmp"82⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"83⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:380 -
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"88⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"91⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"92⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\913A.tmp"C:\Users\Admin\AppData\Local\Temp\913A.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"94⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\92D0.tmp"C:\Users\Admin\AppData\Local\Temp\92D0.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\938C.tmp"C:\Users\Admin\AppData\Local\Temp\938C.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\9447.tmp"C:\Users\Admin\AppData\Local\Temp\9447.tmp"97⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\94F3.tmp"C:\Users\Admin\AppData\Local\Temp\94F3.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"99⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\9689.tmp"C:\Users\Admin\AppData\Local\Temp\9689.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\9754.tmp"C:\Users\Admin\AppData\Local\Temp\9754.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\98FA.tmp"C:\Users\Admin\AppData\Local\Temp\98FA.tmp"103⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\99A6.tmp"C:\Users\Admin\AppData\Local\Temp\99A6.tmp"104⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\9A52.tmp"C:\Users\Admin\AppData\Local\Temp\9A52.tmp"105⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"C:\Users\Admin\AppData\Local\Temp\9B0D.tmp"106⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"108⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\9D30.tmp"C:\Users\Admin\AppData\Local\Temp\9D30.tmp"109⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\9F34.tmp"C:\Users\Admin\AppData\Local\Temp\9F34.tmp"112⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"C:\Users\Admin\AppData\Local\Temp\9FEF.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A09B.tmp"C:\Users\Admin\AppData\Local\Temp\A09B.tmp"114⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\A166.tmp"C:\Users\Admin\AppData\Local\Temp\A166.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\A222.tmp"C:\Users\Admin\AppData\Local\Temp\A222.tmp"116⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\A37A.tmp"C:\Users\Admin\AppData\Local\Temp\A37A.tmp"118⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\A426.tmp"C:\Users\Admin\AppData\Local\Temp\A426.tmp"119⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"C:\Users\Admin\AppData\Local\Temp\A4C2.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\A56E.tmp"C:\Users\Admin\AppData\Local\Temp\A56E.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A61A.tmp"C:\Users\Admin\AppData\Local\Temp\A61A.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:1916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-