Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_545540131505e0ca693b8be3f8d3d577_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_545540131505e0ca693b8be3f8d3d577_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-16_545540131505e0ca693b8be3f8d3d577_elex_mafia_poet-rat_stealc_tofsee.exe
- Size 3.6MB
- Sample260816-e7q2hsdj7z
- SHA256 538ed0bc34f70dc262ee80a88997a83f5903248cfd11021cde0eda1604375633
- MD5 545540131505e0ca693b8be3f8d3d577
- SHA1 cb090d8e01a366b3625b0506c328a52ab22eaab0
- SHA512 144006c08bfa1d6c96c9ede9a4f6557a761c07a8830efc7292778c35af91e20c78840d408d79058ac03fa9e136eb1f12fbf55a4683476a1203a15b884944b086
- SSDEEP 49152:w/OJD+uVANuuNGEADt7i+/yTukuFGNLrkBirx:EOfVechrSiGdkBirx
- TLSH T10E06931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3492 24D9.tmp 1096 2805.tmp 4840 2A66.tmp 1724 2E10.tmp 4908 3081.tmp 4980 32C3.tmp 5036 3488.tmp 4548 3747.tmp 1676 3989.tmp 3400 3BEB.tmp 1536 3E1D.tmp 4152 4031.tmp 4324 430F.tmp 3620 4541.tmp 872 4745.tmp 2008 4958.tmp 964 4A52.tmp 4308 4B8B.tmp 2204 4D40.tmp 3336 4E79.tmp 4948 4EE6.tmp 3960 50BB.tmp 4984 5280.tmp 3120 534B.tmp 2068 54F1.tmp 3456 55CC.tmp 2564 57C0.tmp 1348 59A4.tmp 3416 5A6F.tmp 4924 5B0C.tmp 3612 5D5D.tmp 4176 5E19.tmp 560 5EB5.tmp 988 5F71.tmp 3820 5FDE.tmp 2020 60B9.tmp 3372 6116.tmp 3904 623F.tmp 5020 62CC.tmp 2360 6359.tmp 2688 63E5.tmp 2416 6433.tmp 5044 64B0.tmp 3560 650E.tmp 784 65E9.tmp 4444 66C4.tmp 4976 6721.tmp 2880 677F.tmp 4756 67DD.tmp 4936 685A.tmp 4372 68B8.tmp 1884 6906.tmp 3940 6963.tmp 4092 69C1.tmp 1968 6A0F.tmp 1796 6A6D.tmp 4352 6ACB.tmp 364 6B19.tmp 3220 6B86.tmp 4280 6BE4.tmp 3168 6C32.tmp 4536 6C80.tmp 1768 6CCE.tmp 4076 6D1D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E25C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 992E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 768E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 850A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 333B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69BC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 3492 2892 2026-08-16_545540131505e0ca693b8be3f8d3d577_elex_mafia_poet-rat_stealc_tofsee.exe 84 PID 3492 wrote to memory of 1096 3492 24D9.tmp 85 PID 1096 wrote to memory of 4840 1096 2805.tmp 86 PID 4840 wrote to memory of 1724 4840 2A66.tmp 87 PID 1724 wrote to memory of 4908 1724 2E10.tmp 88 PID 4908 wrote to memory of 4980 4908 3081.tmp 89 PID 4980 wrote to memory of 5036 4980 32C3.tmp 90 PID 5036 wrote to memory of 4548 5036 3488.tmp 91 PID 4548 wrote to memory of 1676 4548 3747.tmp 92 PID 1676 wrote to memory of 3400 1676 3989.tmp 93 PID 3400 wrote to memory of 1536 3400 3BEB.tmp 94 PID 1536 wrote to memory of 4152 1536 3E1D.tmp 95 PID 4152 wrote to memory of 4324 4152 4031.tmp 96 PID 4324 wrote to memory of 3620 4324 430F.tmp 97 PID 3620 wrote to memory of 872 3620 4541.tmp 98 PID 872 wrote to memory of 2008 872 4745.tmp 99 PID 2008 wrote to memory of 964 2008 4958.tmp 100 PID 964 wrote to memory of 4308 964 4A52.tmp 101 PID 4308 wrote to memory of 2204 4308 4B8B.tmp 103 PID 2204 wrote to memory of 3336 2204 4D40.tmp 104 PID 3336 wrote to memory of 4948 3336 4E79.tmp 105 PID 4948 wrote to memory of 3960 4948 4EE6.tmp 106 PID 3960 wrote to memory of 4984 3960 50BB.tmp 107 PID 4984 wrote to memory of 3120 4984 5280.tmp 108 PID 3120 wrote to memory of 2068 3120 534B.tmp 109 PID 2068 wrote to memory of 3456 2068 54F1.tmp 110 PID 3456 wrote to memory of 2564 3456 55CC.tmp 111 PID 2564 wrote to memory of 1348 2564 57C0.tmp 112 PID 1348 wrote to memory of 3416 1348 59A4.tmp 113 PID 3416 wrote to memory of 4924 3416 5A6F.tmp 114 PID 4924 wrote to memory of 3612 4924 5B0C.tmp 115 PID 3612 wrote to memory of 4176 3612 5D5D.tmp 116 PID 4176 wrote to memory of 560 4176 5E19.tmp 117 PID 560 wrote to memory of 988 560 5EB5.tmp 118 PID 988 wrote to memory of 3820 988 5F71.tmp 119 PID 3820 wrote to memory of 2020 3820 5FDE.tmp 120 PID 2020 wrote to memory of 3372 2020 60B9.tmp 121 PID 3372 wrote to memory of 3904 3372 6116.tmp 122 PID 3904 wrote to memory of 5020 3904 623F.tmp 123 PID 5020 wrote to memory of 2360 5020 62CC.tmp 124 PID 2360 wrote to memory of 2688 2360 6359.tmp 125 PID 2688 wrote to memory of 2416 2688 63E5.tmp 128 PID 2416 wrote to memory of 5044 2416 6433.tmp 129 PID 5044 wrote to memory of 3560 5044 64B0.tmp 130 PID 4008 wrote to memory of 784 4008 657B.tmp 132 PID 784 wrote to memory of 4444 784 65E9.tmp 133 PID 4444 wrote to memory of 4976 4444 66C4.tmp 134 PID 4976 wrote to memory of 2880 4976 6721.tmp 135 PID 2880 wrote to memory of 4756 2880 677F.tmp 136 PID 4756 wrote to memory of 4936 4756 67DD.tmp 137 PID 4936 wrote to memory of 4372 4936 685A.tmp 139 PID 4372 wrote to memory of 1884 4372 68B8.tmp 140 PID 1884 wrote to memory of 3940 1884 6906.tmp 142 PID 3940 wrote to memory of 4092 3940 6963.tmp 143 PID 4092 wrote to memory of 1968 4092 69C1.tmp 144 PID 1968 wrote to memory of 1796 1968 6A0F.tmp 145 PID 1796 wrote to memory of 4352 1796 6A6D.tmp 146 PID 4352 wrote to memory of 364 4352 6ACB.tmp 147 PID 364 wrote to memory of 3220 364 6B19.tmp 148 PID 3220 wrote to memory of 4280 3220 6B86.tmp 149 PID 4280 wrote to memory of 3168 4280 6BE4.tmp 150 PID 3168 wrote to memory of 4536 3168 6C32.tmp 151 PID 4536 wrote to memory of 1768 4536 6C80.tmp 152 PID 1768 wrote to memory of 4076 1768 6CCE.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_545540131505e0ca693b8be3f8d3d577_elex_mafia_poet-rat_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_545540131505e0ca693b8be3f8d3d577_elex_mafia_poet-rat_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\430F.tmp"C:\Users\Admin\AppData\Local\Temp\430F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\50BB.tmp"C:\Users\Admin\AppData\Local\Temp\50BB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"45⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"46⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\6C32.tmp"C:\Users\Admin\AppData\Local\Temp\6C32.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\6C80.tmp"C:\Users\Admin\AppData\Local\Temp\6C80.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"66⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"67⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"68⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\6E26.tmp"C:\Users\Admin\AppData\Local\Temp\6E26.tmp"69⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6E74.tmp"C:\Users\Admin\AppData\Local\Temp\6E74.tmp"70⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"71⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\6F11.tmp"C:\Users\Admin\AppData\Local\Temp\6F11.tmp"72⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"73⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"74⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"C:\Users\Admin\AppData\Local\Temp\6FFB.tmp"75⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"76⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"77⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"78⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"79⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"80⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"81⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"82⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"83⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"84⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\7337.tmp"C:\Users\Admin\AppData\Local\Temp\7337.tmp"85⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\7385.tmp"C:\Users\Admin\AppData\Local\Temp\7385.tmp"86⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"87⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\7421.tmp"C:\Users\Admin\AppData\Local\Temp\7421.tmp"88⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"89⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"90⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"91⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"92⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"93⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"95⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"96⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"97⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"98⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"99⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"100⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"101⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\78C5.tmp"C:\Users\Admin\AppData\Local\Temp\78C5.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"103⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"104⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"105⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"106⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"107⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"108⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"109⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\7C30.tmp"C:\Users\Admin\AppData\Local\Temp\7C30.tmp"110⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"111⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"112⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"113⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"114⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"115⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"116⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"117⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"118⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"119⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"120⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"121⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"122⤵PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-