Analysis
- max time kernel
131s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 15:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_6cbad5a36f52a74a8094a767e64023a5_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_6cbad5a36f52a74a8094a767e64023a5_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-06-26_6cbad5a36f52a74a8094a767e64023a5_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
- Size 521KB
- Sample260629-slps8agv2s
- SHA256 ab1ea587ab41852eb2a74a6bbdf01c45d3683a1ba8df8b315bb1b5fd9861f6a2
- MD5 6cbad5a36f52a74a8094a767e64023a5
- SHA1 50fe6ecf0a413dc30260280dee60dd142f84f866
- SHA512 b5614b36a0166806b89ded2f75fb2a21a6ac0fc4dce4ed8832b42e4026916bf27c17c1e57fc133582917b8c63b3b79ba0b4d3231e0ecf225786205409fb6f2b7
- SSDEEP 12288:c/1Ba9pn+Dgoi86UtTrBrQ91JgzVTzUbqIWf60NZi:c/C98Dgo8yBOjgJfoqtS0Ng
- TLSH T1F7B4F122B588C032F59212344E56EBA1893EBC754B2698C73BD43B6E6FB53C1D676307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2732 D358.tmp 5240 D3E5.tmp 4532 D472.tmp 4176 D51E.tmp 5988 D5BA.tmp 6120 D685.tmp 1224 D712.tmp 5968 D7FC.tmp 2772 D8A8.tmp 1600 D954.tmp 1332 DA00.tmp 5484 DAAB.tmp 5336 DB67.tmp 4284 DC03.tmp 5548 DCCE.tmp 4376 DD99.tmp 5304 DE55.tmp 3708 DF30.tmp 4496 DFEB.tmp 6052 E068.tmp 5280 E124.tmp 3536 E1FE.tmp 3404 E27B.tmp 1376 E327.tmp 3804 E3C4.tmp 2724 E460.tmp 1860 E4FC.tmp 3800 E598.tmp 2880 E625.tmp 1956 E6A2.tmp 6116 E74E.tmp 616 E7DA.tmp 4212 E896.tmp 3284 E913.tmp 1032 E9A0.tmp 892 EA0D.tmp 4744 EA7A.tmp 992 EAF7.tmp 3000 EB65.tmp 612 EBD2.tmp 2124 EC3F.tmp 1300 ECAD.tmp 5844 ED1A.tmp 2988 ED88.tmp 4300 EDF5.tmp 1248 EE72.tmp 6008 EEEF.tmp 5976 EF5C.tmp 4056 EFCA.tmp 5532 F047.tmp 2972 F0C4.tmp 1108 F131.tmp 792 F1AE.tmp 428 F21B.tmp 5140 F289.tmp 4668 F2F6.tmp 5500 F373.tmp 2268 F3F0.tmp 5428 F45E.tmp 4172 F4CB.tmp 2848 F538.tmp 2116 F5C5.tmp 2728 F652.tmp 5380 F6BF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 129F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F21B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ED0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7044.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A946.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A70F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8776.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2732 2860 2026-06-26_6cbad5a36f52a74a8094a767e64023a5_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe 87 PID 2732 wrote to memory of 5240 2732 D358.tmp 88 PID 5240 wrote to memory of 4532 5240 D3E5.tmp 89 PID 4532 wrote to memory of 4176 4532 D472.tmp 90 PID 4176 wrote to memory of 5988 4176 D51E.tmp 91 PID 5988 wrote to memory of 6120 5988 D5BA.tmp 92 PID 6120 wrote to memory of 1224 6120 D685.tmp 93 PID 1224 wrote to memory of 5968 1224 D712.tmp 94 PID 5968 wrote to memory of 2772 5968 D7FC.tmp 95 PID 2772 wrote to memory of 1600 2772 D8A8.tmp 96 PID 1600 wrote to memory of 1332 1600 D954.tmp 97 PID 1332 wrote to memory of 5484 1332 DA00.tmp 98 PID 5484 wrote to memory of 5336 5484 DAAB.tmp 99 PID 5336 wrote to memory of 4284 5336 DB67.tmp 100 PID 4284 wrote to memory of 5548 4284 DC03.tmp 101 PID 5548 wrote to memory of 4376 5548 DCCE.tmp 102 PID 4376 wrote to memory of 5304 4376 DD99.tmp 103 PID 5304 wrote to memory of 3708 5304 DE55.tmp 104 PID 3708 wrote to memory of 4496 3708 DF30.tmp 105 PID 4496 wrote to memory of 6052 4496 DFEB.tmp 106 PID 6052 wrote to memory of 5280 6052 E068.tmp 107 PID 5280 wrote to memory of 3536 5280 E124.tmp 108 PID 3536 wrote to memory of 3404 3536 E1FE.tmp 109 PID 3404 wrote to memory of 1376 3404 E27B.tmp 110 PID 1376 wrote to memory of 3804 1376 E327.tmp 111 PID 3804 wrote to memory of 2724 3804 E3C4.tmp 112 PID 2724 wrote to memory of 1860 2724 E460.tmp 113 PID 1860 wrote to memory of 3800 1860 E4FC.tmp 114 PID 3800 wrote to memory of 2880 3800 E598.tmp 115 PID 2880 wrote to memory of 1956 2880 E625.tmp 116 PID 1956 wrote to memory of 6116 1956 E6A2.tmp 117 PID 6116 wrote to memory of 616 6116 E74E.tmp 118 PID 616 wrote to memory of 4212 616 E7DA.tmp 119 PID 4212 wrote to memory of 3284 4212 E896.tmp 120 PID 3284 wrote to memory of 1032 3284 E913.tmp 121 PID 1032 wrote to memory of 892 1032 E9A0.tmp 122 PID 892 wrote to memory of 4744 892 EA0D.tmp 123 PID 4744 wrote to memory of 992 4744 EA7A.tmp 124 PID 992 wrote to memory of 3000 992 EAF7.tmp 125 PID 3000 wrote to memory of 612 3000 EB65.tmp 126 PID 612 wrote to memory of 2124 612 EBD2.tmp 127 PID 2124 wrote to memory of 1300 2124 EC3F.tmp 128 PID 1300 wrote to memory of 5844 1300 ECAD.tmp 129 PID 5844 wrote to memory of 2988 5844 ED1A.tmp 130 PID 2988 wrote to memory of 4300 2988 ED88.tmp 131 PID 4300 wrote to memory of 1248 4300 EDF5.tmp 132 PID 1248 wrote to memory of 6008 1248 EE72.tmp 133 PID 6008 wrote to memory of 5976 6008 EEEF.tmp 134 PID 5976 wrote to memory of 4056 5976 EF5C.tmp 135 PID 4056 wrote to memory of 5532 4056 EFCA.tmp 136 PID 5532 wrote to memory of 2972 5532 F047.tmp 137 PID 2972 wrote to memory of 1108 2972 F0C4.tmp 138 PID 1108 wrote to memory of 792 1108 F131.tmp 139 PID 792 wrote to memory of 428 792 F1AE.tmp 140 PID 428 wrote to memory of 5140 428 F21B.tmp 141 PID 5140 wrote to memory of 4668 5140 F289.tmp 142 PID 4668 wrote to memory of 5500 4668 F2F6.tmp 143 PID 5500 wrote to memory of 2268 5500 F373.tmp 144 PID 2268 wrote to memory of 5428 2268 F3F0.tmp 145 PID 5428 wrote to memory of 4172 5428 F45E.tmp 146 PID 4172 wrote to memory of 2848 4172 F4CB.tmp 147 PID 2848 wrote to memory of 2116 2848 F538.tmp 148 PID 2116 wrote to memory of 2728 2116 F5C5.tmp 149 PID 2728 wrote to memory of 5380 2728 F652.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_6cbad5a36f52a74a8094a767e64023a5_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_6cbad5a36f52a74a8094a767e64023a5_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\DC03.tmp"C:\Users\Admin\AppData\Local\Temp\DC03.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\DD99.tmp"C:\Users\Admin\AppData\Local\Temp\DD99.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\E124.tmp"C:\Users\Admin\AppData\Local\Temp\E124.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\E27B.tmp"C:\Users\Admin\AppData\Local\Temp\E27B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\E460.tmp"C:\Users\Admin\AppData\Local\Temp\E460.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"C:\Users\Admin\AppData\Local\Temp\E4FC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\E598.tmp"C:\Users\Admin\AppData\Local\Temp\E598.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E74E.tmp"C:\Users\Admin\AppData\Local\Temp\E74E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\E896.tmp"C:\Users\Admin\AppData\Local\Temp\E896.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\E913.tmp"C:\Users\Admin\AppData\Local\Temp\E913.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"C:\Users\Admin\AppData\Local\Temp\EBD2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"C:\Users\Admin\AppData\Local\Temp\ECAD.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\EF5C.tmp"C:\Users\Admin\AppData\Local\Temp\EF5C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"C:\Users\Admin\AppData\Local\Temp\EFCA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\F047.tmp"C:\Users\Admin\AppData\Local\Temp\F047.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\F131.tmp"C:\Users\Admin\AppData\Local\Temp\F131.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"C:\Users\Admin\AppData\Local\Temp\F1AE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\F21B.tmp"C:\Users\Admin\AppData\Local\Temp\F21B.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\F45E.tmp"C:\Users\Admin\AppData\Local\Temp\F45E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"C:\Users\Admin\AppData\Local\Temp\F5C5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\F72C.tmp"C:\Users\Admin\AppData\Local\Temp\F72C.tmp"66⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"67⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\F807.tmp"C:\Users\Admin\AppData\Local\Temp\F807.tmp"68⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"69⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\F901.tmp"C:\Users\Admin\AppData\Local\Temp\F901.tmp"70⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\F97E.tmp"C:\Users\Admin\AppData\Local\Temp\F97E.tmp"71⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"72⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"73⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\FB05.tmp"C:\Users\Admin\AppData\Local\Temp\FB05.tmp"74⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"75⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"76⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"77⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"C:\Users\Admin\AppData\Local\Temp\FCD9.tmp"78⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\FD47.tmp"C:\Users\Admin\AppData\Local\Temp\FD47.tmp"79⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"80⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\FE31.tmp"C:\Users\Admin\AppData\Local\Temp\FE31.tmp"81⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"82⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\FF4A.tmp"C:\Users\Admin\AppData\Local\Temp\FF4A.tmp"83⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"84⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\25.tmp"C:\Users\Admin\AppData\Local\Temp\25.tmp"85⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\B2.tmp"C:\Users\Admin\AppData\Local\Temp\B2.tmp"86⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\13E.tmp"C:\Users\Admin\AppData\Local\Temp\13E.tmp"87⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\1DB.tmp"C:\Users\Admin\AppData\Local\Temp\1DB.tmp"88⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\277.tmp"C:\Users\Admin\AppData\Local\Temp\277.tmp"89⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\313.tmp"C:\Users\Admin\AppData\Local\Temp\313.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\381.tmp"C:\Users\Admin\AppData\Local\Temp\381.tmp"91⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3FE.tmp"C:\Users\Admin\AppData\Local\Temp\3FE.tmp"92⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\47B.tmp"C:\Users\Admin\AppData\Local\Temp\47B.tmp"93⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\507.tmp"C:\Users\Admin\AppData\Local\Temp\507.tmp"94⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"95⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\601.tmp"C:\Users\Admin\AppData\Local\Temp\601.tmp"96⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\67E.tmp"C:\Users\Admin\AppData\Local\Temp\67E.tmp"97⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\70B.tmp"C:\Users\Admin\AppData\Local\Temp\70B.tmp"98⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"100⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\8C0.tmp"C:\Users\Admin\AppData\Local\Temp\8C0.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"102⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\99B.tmp"C:\Users\Admin\AppData\Local\Temp\99B.tmp"103⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\A28.tmp"C:\Users\Admin\AppData\Local\Temp\A28.tmp"104⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"105⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B31.tmp"C:\Users\Admin\AppData\Local\Temp\B31.tmp"106⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"107⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\C1C.tmp"C:\Users\Admin\AppData\Local\Temp\C1C.tmp"108⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\C99.tmp"C:\Users\Admin\AppData\Local\Temp\C99.tmp"109⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\D16.tmp"C:\Users\Admin\AppData\Local\Temp\D16.tmp"110⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"111⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\DF0.tmp"C:\Users\Admin\AppData\Local\Temp\DF0.tmp"112⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\E6D.tmp"C:\Users\Admin\AppData\Local\Temp\E6D.tmp"113⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"114⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\F67.tmp"C:\Users\Admin\AppData\Local\Temp\F67.tmp"115⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"116⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\1061.tmp"C:\Users\Admin\AppData\Local\Temp\1061.tmp"117⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\10EE.tmp"C:\Users\Admin\AppData\Local\Temp\10EE.tmp"118⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\115B.tmp"C:\Users\Admin\AppData\Local\Temp\115B.tmp"119⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\11E8.tmp"C:\Users\Admin\AppData\Local\Temp\11E8.tmp"120⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"121⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"122⤵PID:3216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-