Analysis
- max time kernel
122s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 01:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-13_f434e37d8c90f6d17f8134f33c3c66b0_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_f434e37d8c90f6d17f8134f33c3c66b0_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-13_f434e37d8c90f6d17f8134f33c3c66b0_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
- Size 521KB
- Sample261014-bldbrawycw
- SHA256 e437c240d098fec0256bb8628f63a5e12ae9c37c3280bca4e603c7978498f861
- MD5 f434e37d8c90f6d17f8134f33c3c66b0
- SHA1 c1b699b1d308b5de51bfdc2d52614cd267f7fe94
- SHA512 d9236d0479e65361bb002bedbe763f7a3577c7fe1370dd0febebbfd161a65f17e1e9ed842ed3f92bea1be7161d69ffd6248bb4ece227ffeabb66f4678109a49b
- SSDEEP 12288:c/1Ba9pn+DASCewo+9isGJSdoT04YUEU9rLRNZi:c/C98DbjZ+pGstUhNg
- TLSH T16BB4F122B5C8C032F1D206348E62EBA2493BBD755B2695D73BD43A6E5EB43C1E635307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 440 3AB.tmp 5984 4A5.tmp 4620 57F.tmp 4344 60C.tmp 4552 689.tmp 3464 725.tmp 6008 7C2.tmp 6084 84E.tmp 4508 8DB.tmp 5856 996.tmp 4252 A42.tmp 3656 B5B.tmp 4872 C36.tmp 6064 CD2.tmp 1164 D7E.tmp 5144 E0B.tmp 5388 E98.tmp 4036 F34.tmp 464 FE0.tmp 1764 106C.tmp 5568 1109.tmp 2000 11B4.tmp 2016 1270.tmp 3876 131C.tmp 2452 1389.tmp 1580 1416.tmp 2676 1483.tmp 4724 152F.tmp 2368 15DB.tmp 5096 1668.tmp 5176 1713.tmp 1976 17A0.tmp 2656 187B.tmp 1792 1907.tmp 4192 1984.tmp 5632 1A21.tmp 5764 1A9E.tmp 1248 1B2A.tmp 1160 1B88.tmp 4676 1C05.tmp 5612 1C92.tmp 1620 1D0F.tmp 2868 1D7C.tmp 4644 1DE9.tmp 1468 1E76.tmp 2948 1F03.tmp 2648 1F80.tmp 4868 201C.tmp 3388 20B8.tmp 5872 2145.tmp 3416 21C2.tmp 1916 223F.tmp 3708 22CB.tmp 3644 2348.tmp 3504 23D5.tmp 5384 2452.tmp 2888 24CF.tmp 2652 254C.tmp 4632 25D9.tmp 2612 2675.tmp 1304 2702.tmp 2776 276F.tmp 5368 27EC.tmp 5440 2869.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C59E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 917E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D36E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 254C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 583E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 369D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 106C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E03F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C60C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23D5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3232 wrote to memory of 440 3232 2026-10-13_f434e37d8c90f6d17f8134f33c3c66b0_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe 90 PID 440 wrote to memory of 5984 440 3AB.tmp 91 PID 5984 wrote to memory of 4620 5984 4A5.tmp 92 PID 4620 wrote to memory of 4344 4620 57F.tmp 93 PID 4344 wrote to memory of 4552 4344 60C.tmp 94 PID 4552 wrote to memory of 3464 4552 689.tmp 95 PID 3464 wrote to memory of 6008 3464 725.tmp 96 PID 6008 wrote to memory of 6084 6008 7C2.tmp 97 PID 6084 wrote to memory of 4508 6084 84E.tmp 98 PID 4508 wrote to memory of 5856 4508 8DB.tmp 99 PID 5856 wrote to memory of 4252 5856 996.tmp 100 PID 4252 wrote to memory of 3656 4252 A42.tmp 101 PID 3656 wrote to memory of 4872 3656 B5B.tmp 102 PID 4872 wrote to memory of 6064 4872 C36.tmp 103 PID 6064 wrote to memory of 1164 6064 CD2.tmp 104 PID 1164 wrote to memory of 5144 1164 D7E.tmp 105 PID 5144 wrote to memory of 5388 5144 E0B.tmp 106 PID 5388 wrote to memory of 4036 5388 E98.tmp 107 PID 4036 wrote to memory of 464 4036 F34.tmp 108 PID 464 wrote to memory of 1764 464 FE0.tmp 109 PID 1764 wrote to memory of 5568 1764 106C.tmp 110 PID 5568 wrote to memory of 2000 5568 1109.tmp 111 PID 2000 wrote to memory of 2016 2000 11B4.tmp 112 PID 2016 wrote to memory of 3876 2016 1270.tmp 113 PID 3876 wrote to memory of 2452 3876 131C.tmp 114 PID 2452 wrote to memory of 1580 2452 1389.tmp 115 PID 1580 wrote to memory of 2676 1580 1416.tmp 116 PID 2676 wrote to memory of 4724 2676 1483.tmp 117 PID 4724 wrote to memory of 2368 4724 152F.tmp 118 PID 2368 wrote to memory of 5096 2368 15DB.tmp 119 PID 5096 wrote to memory of 5176 5096 1668.tmp 120 PID 5176 wrote to memory of 1976 5176 1713.tmp 121 PID 1976 wrote to memory of 2656 1976 17A0.tmp 122 PID 2656 wrote to memory of 1792 2656 187B.tmp 123 PID 1792 wrote to memory of 4192 1792 1907.tmp 124 PID 4192 wrote to memory of 5632 4192 1984.tmp 125 PID 5632 wrote to memory of 5764 5632 1A21.tmp 126 PID 5764 wrote to memory of 1248 5764 1A9E.tmp 127 PID 1248 wrote to memory of 1160 1248 1B2A.tmp 128 PID 1160 wrote to memory of 4676 1160 1B88.tmp 129 PID 4676 wrote to memory of 5612 4676 1C05.tmp 130 PID 5612 wrote to memory of 1620 5612 1C92.tmp 131 PID 1620 wrote to memory of 2868 1620 1D0F.tmp 132 PID 2868 wrote to memory of 4644 2868 1D7C.tmp 133 PID 4644 wrote to memory of 1468 4644 1DE9.tmp 134 PID 1468 wrote to memory of 2948 1468 1E76.tmp 135 PID 2948 wrote to memory of 2648 2948 1F03.tmp 136 PID 2648 wrote to memory of 4868 2648 1F80.tmp 137 PID 4868 wrote to memory of 3388 4868 201C.tmp 138 PID 3388 wrote to memory of 5872 3388 20B8.tmp 139 PID 5872 wrote to memory of 3416 5872 2145.tmp 140 PID 3416 wrote to memory of 1916 3416 21C2.tmp 141 PID 1916 wrote to memory of 3708 1916 223F.tmp 142 PID 3708 wrote to memory of 3644 3708 22CB.tmp 143 PID 3644 wrote to memory of 3504 3644 2348.tmp 144 PID 3504 wrote to memory of 5384 3504 23D5.tmp 145 PID 5384 wrote to memory of 2888 5384 2452.tmp 146 PID 2888 wrote to memory of 2652 2888 24CF.tmp 147 PID 2652 wrote to memory of 4632 2652 254C.tmp 148 PID 4632 wrote to memory of 2612 4632 25D9.tmp 149 PID 2612 wrote to memory of 1304 2612 2675.tmp 150 PID 1304 wrote to memory of 2776 1304 2702.tmp 151 PID 2776 wrote to memory of 5368 2776 276F.tmp 152 PID 5368 wrote to memory of 5440 5368 27EC.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_f434e37d8c90f6d17f8134f33c3c66b0_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_f434e37d8c90f6d17f8134f33c3c66b0_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\3AB.tmp"C:\Users\Admin\AppData\Local\Temp\3AB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4A5.tmp"C:\Users\Admin\AppData\Local\Temp\4A5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\689.tmp"C:\Users\Admin\AppData\Local\Temp\689.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\7C2.tmp"C:\Users\Admin\AppData\Local\Temp\7C2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\84E.tmp"C:\Users\Admin\AppData\Local\Temp\84E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\8DB.tmp"C:\Users\Admin\AppData\Local\Temp\8DB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\996.tmp"C:\Users\Admin\AppData\Local\Temp\996.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\B5B.tmp"C:\Users\Admin\AppData\Local\Temp\B5B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\C36.tmp"C:\Users\Admin\AppData\Local\Temp\C36.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\FE0.tmp"C:\Users\Admin\AppData\Local\Temp\FE0.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\106C.tmp"C:\Users\Admin\AppData\Local\Temp\106C.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1109.tmp"C:\Users\Admin\AppData\Local\Temp\1109.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\11B4.tmp"C:\Users\Admin\AppData\Local\Temp\11B4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1270.tmp"C:\Users\Admin\AppData\Local\Temp\1270.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1483.tmp"C:\Users\Admin\AppData\Local\Temp\1483.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\152F.tmp"C:\Users\Admin\AppData\Local\Temp\152F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\17A0.tmp"C:\Users\Admin\AppData\Local\Temp\17A0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\187B.tmp"C:\Users\Admin\AppData\Local\Temp\187B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1907.tmp"C:\Users\Admin\AppData\Local\Temp\1907.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\1984.tmp"C:\Users\Admin\AppData\Local\Temp\1984.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"C:\Users\Admin\AppData\Local\Temp\1B2A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\1C05.tmp"C:\Users\Admin\AppData\Local\Temp\1C05.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\1C92.tmp"C:\Users\Admin\AppData\Local\Temp\1C92.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"C:\Users\Admin\AppData\Local\Temp\1D0F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"C:\Users\Admin\AppData\Local\Temp\1D7C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\1E76.tmp"C:\Users\Admin\AppData\Local\Temp\1E76.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\1F03.tmp"C:\Users\Admin\AppData\Local\Temp\1F03.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\201C.tmp"C:\Users\Admin\AppData\Local\Temp\201C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\20B8.tmp"C:\Users\Admin\AppData\Local\Temp\20B8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\2145.tmp"C:\Users\Admin\AppData\Local\Temp\2145.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\21C2.tmp"C:\Users\Admin\AppData\Local\Temp\21C2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\23D5.tmp"C:\Users\Admin\AppData\Local\Temp\23D5.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\25D9.tmp"C:\Users\Admin\AppData\Local\Temp\25D9.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2675.tmp"C:\Users\Admin\AppData\Local\Temp\2675.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2702.tmp"C:\Users\Admin\AppData\Local\Temp\2702.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\27EC.tmp"C:\Users\Admin\AppData\Local\Temp\27EC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"65⤵
- Executes dropped EXE
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\28F6.tmp"C:\Users\Admin\AppData\Local\Temp\28F6.tmp"66⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2973.tmp"C:\Users\Admin\AppData\Local\Temp\2973.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\29E0.tmp"C:\Users\Admin\AppData\Local\Temp\29E0.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"C:\Users\Admin\AppData\Local\Temp\2A4D.tmp"69⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"70⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2B57.tmp"C:\Users\Admin\AppData\Local\Temp\2B57.tmp"71⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"C:\Users\Admin\AppData\Local\Temp\2BC4.tmp"72⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\2C51.tmp"C:\Users\Admin\AppData\Local\Temp\2C51.tmp"73⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"C:\Users\Admin\AppData\Local\Temp\2CCE.tmp"74⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"75⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"76⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\2E64.tmp"C:\Users\Admin\AppData\Local\Temp\2E64.tmp"77⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"C:\Users\Admin\AppData\Local\Temp\2EF1.tmp"78⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"C:\Users\Admin\AppData\Local\Temp\2F8D.tmp"79⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"C:\Users\Admin\AppData\Local\Temp\2FEB.tmp"80⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"81⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\30D5.tmp"C:\Users\Admin\AppData\Local\Temp\30D5.tmp"82⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\3171.tmp"C:\Users\Admin\AppData\Local\Temp\3171.tmp"83⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\320E.tmp"C:\Users\Admin\AppData\Local\Temp\320E.tmp"84⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\327B.tmp"C:\Users\Admin\AppData\Local\Temp\327B.tmp"85⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\32F8.tmp"C:\Users\Admin\AppData\Local\Temp\32F8.tmp"86⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3375.tmp"C:\Users\Admin\AppData\Local\Temp\3375.tmp"87⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\33E2.tmp"C:\Users\Admin\AppData\Local\Temp\33E2.tmp"88⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\3450.tmp"C:\Users\Admin\AppData\Local\Temp\3450.tmp"89⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\34CD.tmp"C:\Users\Admin\AppData\Local\Temp\34CD.tmp"90⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\354A.tmp"C:\Users\Admin\AppData\Local\Temp\354A.tmp"91⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\35D6.tmp"C:\Users\Admin\AppData\Local\Temp\35D6.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\3663.tmp"C:\Users\Admin\AppData\Local\Temp\3663.tmp"93⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\36D0.tmp"C:\Users\Admin\AppData\Local\Temp\36D0.tmp"94⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\373E.tmp"C:\Users\Admin\AppData\Local\Temp\373E.tmp"95⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\37CA.tmp"C:\Users\Admin\AppData\Local\Temp\37CA.tmp"96⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\3857.tmp"C:\Users\Admin\AppData\Local\Temp\3857.tmp"97⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\38F3.tmp"C:\Users\Admin\AppData\Local\Temp\38F3.tmp"98⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\3970.tmp"C:\Users\Admin\AppData\Local\Temp\3970.tmp"99⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\39FD.tmp"C:\Users\Admin\AppData\Local\Temp\39FD.tmp"100⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"C:\Users\Admin\AppData\Local\Temp\3A6A.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"C:\Users\Admin\AppData\Local\Temp\3AE7.tmp"102⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\3B55.tmp"C:\Users\Admin\AppData\Local\Temp\3B55.tmp"103⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"C:\Users\Admin\AppData\Local\Temp\3BF1.tmp"104⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"C:\Users\Admin\AppData\Local\Temp\3C6E.tmp"105⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\3CFB.tmp"C:\Users\Admin\AppData\Local\Temp\3CFB.tmp"106⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\3D97.tmp"C:\Users\Admin\AppData\Local\Temp\3D97.tmp"107⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3E04.tmp"C:\Users\Admin\AppData\Local\Temp\3E04.tmp"108⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\3E81.tmp"C:\Users\Admin\AppData\Local\Temp\3E81.tmp"109⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"C:\Users\Admin\AppData\Local\Temp\3EEF.tmp"110⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\3F6C.tmp"C:\Users\Admin\AppData\Local\Temp\3F6C.tmp"111⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"112⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\4094.tmp"C:\Users\Admin\AppData\Local\Temp\4094.tmp"113⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\4111.tmp"C:\Users\Admin\AppData\Local\Temp\4111.tmp"114⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\419E.tmp"C:\Users\Admin\AppData\Local\Temp\419E.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\421B.tmp"C:\Users\Admin\AppData\Local\Temp\421B.tmp"116⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\4298.tmp"C:\Users\Admin\AppData\Local\Temp\4298.tmp"117⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\4315.tmp"C:\Users\Admin\AppData\Local\Temp\4315.tmp"118⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\43C1.tmp"C:\Users\Admin\AppData\Local\Temp\43C1.tmp"119⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\444E.tmp"C:\Users\Admin\AppData\Local\Temp\444E.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\44CB.tmp"C:\Users\Admin\AppData\Local\Temp\44CB.tmp"121⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\4567.tmp"C:\Users\Admin\AppData\Local\Temp\4567.tmp"122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-