Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_838b3b85985a3c153a736965ef5bc91c_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_838b3b85985a3c153a736965ef5bc91c_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_838b3b85985a3c153a736965ef5bc91c_elex_mafia_poet-rat_stealc_tofsee.exe
- Size 3.6MB
- Sample260801-zawkyswdpg
- SHA256 6f42648bcb55c3229ecae980ecfa9963965f73ae523fb713d3b6cc5a106b2a94
- MD5 838b3b85985a3c153a736965ef5bc91c
- SHA1 99735124ee3e3af70e67d74e9758a2a0ca127a69
- SHA512 ee3b51a79339516a17ec0a08daa0b5000d824410ae6caddf70a222c1021565e9e2c025d76a07135eecf051fb37cc36840e235b7302019d4f33edeff7b3cdb29b
- SSDEEP 49152:w/OJD8Aqtddol3NGEADt7i+/yTukuFGNLrkBirxsP:EOKAqvE3chrSiGdkBirx
- TLSH T18706931137FAC635F2BF8B316EB2E694197BF9629D51C25F20A9424E1C35B408E63732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2840 6D9A.tmp 3412 6ED2.tmp 4408 71D0.tmp 1064 74AE.tmp 4240 77DB.tmp 2020 7990.tmp 2328 7BC3.tmp 4872 7DF5.tmp 2332 80D3.tmp 4684 81ED.tmp 3464 8548.tmp 4120 87E8.tmp 1160 89FB.tmp 4328 8C3D.tmp 2464 8E31.tmp 224 9083.tmp 3024 9248.tmp 972 949A.tmp 1740 96DC.tmp 1700 98EF.tmp 1784 9B03.tmp 836 9D16.tmp 4728 9E3F.tmp 680 A13C.tmp 3740 A3AD.tmp 4852 A5B1.tmp 4672 A7C4.tmp 3520 AA83.tmp 3424 ACB6.tmp 2108 AF65.tmp 3008 B1A7.tmp 4524 B3EA.tmp 404 B65B.tmp 824 B7E1.tmp 3976 B84F.tmp 4628 B90A.tmp 4744 B977.tmp 2416 BA14.tmp 3896 BAC0.tmp 4956 BB5C.tmp 1540 BC17.tmp 3808 BCC3.tmp 4264 BD31.tmp 3284 BDCD.tmp 2092 BE88.tmp 2428 BF34.tmp 4896 BFD0.tmp 4424 C04D.tmp 4520 C0AB.tmp 4692 C128.tmp 5008 C196.tmp 5024 C213.tmp 1356 C270.tmp 552 C2CE.tmp 4796 C32C.tmp 3796 C399.tmp 3564 C3F7.tmp 844 C455.tmp 3504 C4B2.tmp 5060 C510.tmp 5080 C59D.tmp 4160 C5FB.tmp 2704 C649.tmp 4912 C6A6.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B83A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 714E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D52D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D184.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C32C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 719C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C213.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E654.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 2840 4908 2026-08-01_838b3b85985a3c153a736965ef5bc91c_elex_mafia_poet-rat_stealc_tofsee.exe 86 PID 2840 wrote to memory of 3412 2840 6D9A.tmp 87 PID 3412 wrote to memory of 4408 3412 6ED2.tmp 88 PID 4408 wrote to memory of 1064 4408 71D0.tmp 89 PID 1064 wrote to memory of 4240 1064 74AE.tmp 90 PID 4240 wrote to memory of 2020 4240 77DB.tmp 91 PID 2020 wrote to memory of 2328 2020 7990.tmp 92 PID 2328 wrote to memory of 4872 2328 7BC3.tmp 95 PID 4872 wrote to memory of 2332 4872 7DF5.tmp 96 PID 2332 wrote to memory of 4684 2332 80D3.tmp 97 PID 4684 wrote to memory of 3464 4684 81ED.tmp 100 PID 3464 wrote to memory of 4120 3464 8548.tmp 101 PID 4120 wrote to memory of 1160 4120 87E8.tmp 102 PID 1160 wrote to memory of 4328 1160 89FB.tmp 103 PID 4328 wrote to memory of 2464 4328 8C3D.tmp 105 PID 2464 wrote to memory of 224 2464 8E31.tmp 106 PID 224 wrote to memory of 3024 224 9083.tmp 107 PID 3024 wrote to memory of 972 3024 9248.tmp 108 PID 972 wrote to memory of 1740 972 949A.tmp 109 PID 1740 wrote to memory of 1700 1740 96DC.tmp 110 PID 1700 wrote to memory of 1784 1700 98EF.tmp 112 PID 1784 wrote to memory of 836 1784 9B03.tmp 113 PID 836 wrote to memory of 4728 836 9D16.tmp 114 PID 4728 wrote to memory of 680 4728 9E3F.tmp 115 PID 680 wrote to memory of 3740 680 A13C.tmp 117 PID 3740 wrote to memory of 4852 3740 A3AD.tmp 118 PID 4852 wrote to memory of 4672 4852 A5B1.tmp 119 PID 4672 wrote to memory of 3520 4672 A7C4.tmp 120 PID 3520 wrote to memory of 3424 3520 AA83.tmp 121 PID 3424 wrote to memory of 2108 3424 ACB6.tmp 122 PID 4268 wrote to memory of 3008 4268 B0DC.tmp 124 PID 3008 wrote to memory of 4524 3008 B1A7.tmp 125 PID 4524 wrote to memory of 404 4524 B3EA.tmp 126 PID 404 wrote to memory of 824 404 B65B.tmp 127 PID 824 wrote to memory of 3976 824 B7E1.tmp 128 PID 3976 wrote to memory of 4628 3976 B84F.tmp 129 PID 4628 wrote to memory of 4744 4628 B90A.tmp 130 PID 4744 wrote to memory of 2416 4744 B977.tmp 131 PID 2416 wrote to memory of 3896 2416 BA14.tmp 132 PID 3896 wrote to memory of 4956 3896 BAC0.tmp 133 PID 4956 wrote to memory of 1540 4956 BB5C.tmp 134 PID 1540 wrote to memory of 3808 1540 BC17.tmp 135 PID 3808 wrote to memory of 4264 3808 BCC3.tmp 136 PID 4264 wrote to memory of 3284 4264 BD31.tmp 137 PID 3284 wrote to memory of 2092 3284 BDCD.tmp 138 PID 2092 wrote to memory of 2428 2092 BE88.tmp 139 PID 2428 wrote to memory of 4896 2428 BF34.tmp 140 PID 4896 wrote to memory of 4424 4896 BFD0.tmp 141 PID 4424 wrote to memory of 4520 4424 C04D.tmp 142 PID 4520 wrote to memory of 4692 4520 C0AB.tmp 143 PID 4692 wrote to memory of 5008 4692 C128.tmp 144 PID 5008 wrote to memory of 5024 5008 C196.tmp 145 PID 5024 wrote to memory of 1356 5024 C213.tmp 146 PID 1356 wrote to memory of 552 1356 C270.tmp 147 PID 552 wrote to memory of 4796 552 C2CE.tmp 148 PID 4796 wrote to memory of 3796 4796 C32C.tmp 149 PID 3796 wrote to memory of 3564 3796 C399.tmp 150 PID 3564 wrote to memory of 844 3564 C3F7.tmp 151 PID 844 wrote to memory of 3504 844 C455.tmp 152 PID 3504 wrote to memory of 5060 3504 C4B2.tmp 153 PID 5060 wrote to memory of 5080 5060 C510.tmp 154 PID 5080 wrote to memory of 4160 5080 C59D.tmp 155 PID 4160 wrote to memory of 2704 4160 C5FB.tmp 156 PID 2704 wrote to memory of 4912 2704 C649.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_838b3b85985a3c153a736965ef5bc91c_elex_mafia_poet-rat_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_838b3b85985a3c153a736965ef5bc91c_elex_mafia_poet-rat_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\71D0.tmp"C:\Users\Admin\AppData\Local\Temp\71D0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\74AE.tmp"C:\Users\Admin\AppData\Local\Temp\74AE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\77DB.tmp"C:\Users\Admin\AppData\Local\Temp\77DB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\81ED.tmp"C:\Users\Admin\AppData\Local\Temp\81ED.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\8548.tmp"C:\Users\Admin\AppData\Local\Temp\8548.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\89FB.tmp"C:\Users\Admin\AppData\Local\Temp\89FB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\9083.tmp"C:\Users\Admin\AppData\Local\Temp\9083.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\949A.tmp"C:\Users\Admin\AppData\Local\Temp\949A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\96DC.tmp"C:\Users\Admin\AppData\Local\Temp\96DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\9D16.tmp"C:\Users\Admin\AppData\Local\Temp\9D16.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"C:\Users\Admin\AppData\Local\Temp\9E3F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\A13C.tmp"C:\Users\Admin\AppData\Local\Temp\A13C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"C:\Users\Admin\AppData\Local\Temp\A3AD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\AA83.tmp"C:\Users\Admin\AppData\Local\Temp\AA83.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\AF65.tmp"C:\Users\Admin\AppData\Local\Temp\AF65.tmp"31⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"32⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"C:\Users\Admin\AppData\Local\Temp\B1A7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\B65B.tmp"C:\Users\Admin\AppData\Local\Temp\B65B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\B84F.tmp"C:\Users\Admin\AppData\Local\Temp\B84F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\B90A.tmp"C:\Users\Admin\AppData\Local\Temp\B90A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\B977.tmp"C:\Users\Admin\AppData\Local\Temp\B977.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\BA14.tmp"C:\Users\Admin\AppData\Local\Temp\BA14.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"C:\Users\Admin\AppData\Local\Temp\BB5C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\BC17.tmp"C:\Users\Admin\AppData\Local\Temp\BC17.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\BD31.tmp"C:\Users\Admin\AppData\Local\Temp\BD31.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\BE88.tmp"C:\Users\Admin\AppData\Local\Temp\BE88.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\BF34.tmp"C:\Users\Admin\AppData\Local\Temp\BF34.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"C:\Users\Admin\AppData\Local\Temp\C0AB.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\C128.tmp"C:\Users\Admin\AppData\Local\Temp\C128.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\C196.tmp"C:\Users\Admin\AppData\Local\Temp\C196.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\C32C.tmp"C:\Users\Admin\AppData\Local\Temp\C32C.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\C399.tmp"C:\Users\Admin\AppData\Local\Temp\C399.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\C455.tmp"C:\Users\Admin\AppData\Local\Temp\C455.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\C510.tmp"C:\Users\Admin\AppData\Local\Temp\C510.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\C59D.tmp"C:\Users\Admin\AppData\Local\Temp\C59D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"C:\Users\Admin\AppData\Local\Temp\C6A6.tmp"66⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"67⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"68⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"69⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\C89A.tmp"C:\Users\Admin\AppData\Local\Temp\C89A.tmp"71⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"72⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"73⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"74⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"75⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"76⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"77⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"78⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"79⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"80⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"81⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"83⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"84⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"85⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\CE38.tmp"C:\Users\Admin\AppData\Local\Temp\CE38.tmp"86⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\CE96.tmp"C:\Users\Admin\AppData\Local\Temp\CE96.tmp"87⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"88⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"89⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"90⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"91⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"92⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"93⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"94⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"96⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"97⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"98⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"99⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"100⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"101⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"102⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\D481.tmp"C:\Users\Admin\AppData\Local\Temp\D481.tmp"103⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:964 -
C:\Users\Admin\AppData\Local\Temp\D58B.tmp"C:\Users\Admin\AppData\Local\Temp\D58B.tmp"106⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"108⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"109⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\D702.tmp"C:\Users\Admin\AppData\Local\Temp\D702.tmp"110⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\D760.tmp"C:\Users\Admin\AppData\Local\Temp\D760.tmp"111⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"112⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\D81B.tmp"C:\Users\Admin\AppData\Local\Temp\D81B.tmp"113⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"114⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"115⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"116⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"117⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"118⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"C:\Users\Admin\AppData\Local\Temp\DA8C.tmp"119⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"120⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"121⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-