Analysis
- max time kernel
122s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 03:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-13_e221f1362ba08e64df6f726fb24b577d_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_e221f1362ba08e64df6f726fb24b577d_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-13_e221f1362ba08e64df6f726fb24b577d_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
- Size 521KB
- Sample261014-d2d94avw2k
- SHA256 0ab14d621640b8394134e596cf204e29ce989a46716048f347da63c7cd13f92f
- MD5 e221f1362ba08e64df6f726fb24b577d
- SHA1 c791063e315f02acde373f85f3b4b4f2a13b3a29
- SHA512 7777cde2cfe4080926bc6fff8573476687f421e41b8e61ced84bd4734dea2ede7bbb53e5e945bf99a74b0e4735b8c876d2b678f172d7c8086394366bc3fb0456
- SSDEEP 6144:NDvuOnBRuzNG+F3BGL9l3n+koG0/8c+FfBrUklousYNDofNaj9O3ROWhQc5cOU7J:c/1Ba9pn+DQjrUklIOofz3IOQczNNZi
- TLSH T124B4F111B5C4C432E1A212304E56EFA2983ABC759B35A8C77BD03A6E6FB53C1D775207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3216 38B.tmp 240 418.tmp 4620 4C4.tmp 4344 57F.tmp 108 61C.tmp 2956 699.tmp 3428 706.tmp 4316 783.tmp 4596 800.tmp 2768 88D.tmp 1168 929.tmp 3448 9C5.tmp 3736 ABF.tmp 4780 BB9.tmp 4260 C46.tmp 2716 CD2.tmp 2520 D4F.tmp 4036 E0B.tmp 464 E98.tmp 3220 F15.tmp 2724 FA1.tmp 2000 104D.tmp 2016 10CA.tmp 3900 1186.tmp 4820 1241.tmp 1548 12CE.tmp 1596 13A8.tmp 4724 1445.tmp 3528 14D1.tmp 5096 159C.tmp 252 1668.tmp 2064 16F4.tmp 2860 17BF.tmp 5952 182D.tmp 3692 18AA.tmp 1264 1936.tmp 4372 19A4.tmp 5224 1A21.tmp 3104 1A9E.tmp 3564 1B0B.tmp 3408 1B98.tmp 756 1C05.tmp 1956 1C72.tmp 2644 1CEF.tmp 4648 1D6C.tmp 1832 1DDA.tmp 2720 1E66.tmp 4336 1EE3.tmp 864 1F51.tmp 1272 1FBE.tmp 908 204B.tmp 5832 20D7.tmp 2600 2154.tmp 4652 21B2.tmp 2488 224E.tmp 5384 22CB.tmp 2888 2348.tmp 2652 23D5.tmp 4632 2452.tmp 836 24DF.tmp 3828 255C.tmp 2776 25C9.tmp 3316 2656.tmp 5016 26C3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EADE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8931.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1578.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F85B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F57D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 509D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7626.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6473.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 3216 2640 2026-10-13_e221f1362ba08e64df6f726fb24b577d_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe 90 PID 3216 wrote to memory of 240 3216 38B.tmp 91 PID 240 wrote to memory of 4620 240 418.tmp 92 PID 4620 wrote to memory of 4344 4620 4C4.tmp 93 PID 4344 wrote to memory of 108 4344 57F.tmp 94 PID 108 wrote to memory of 2956 108 61C.tmp 95 PID 2956 wrote to memory of 3428 2956 699.tmp 96 PID 3428 wrote to memory of 4316 3428 706.tmp 97 PID 4316 wrote to memory of 4596 4316 783.tmp 98 PID 4596 wrote to memory of 2768 4596 800.tmp 99 PID 2768 wrote to memory of 1168 2768 88D.tmp 100 PID 1168 wrote to memory of 3448 1168 929.tmp 101 PID 3448 wrote to memory of 3736 3448 9C5.tmp 102 PID 3736 wrote to memory of 4780 3736 ABF.tmp 103 PID 4780 wrote to memory of 4260 4780 BB9.tmp 104 PID 4260 wrote to memory of 2716 4260 C46.tmp 105 PID 2716 wrote to memory of 2520 2716 CD2.tmp 106 PID 2520 wrote to memory of 4036 2520 D4F.tmp 107 PID 4036 wrote to memory of 464 4036 E0B.tmp 108 PID 464 wrote to memory of 3220 464 E98.tmp 109 PID 3220 wrote to memory of 2724 3220 F15.tmp 110 PID 2724 wrote to memory of 2000 2724 FA1.tmp 111 PID 2000 wrote to memory of 2016 2000 104D.tmp 112 PID 2016 wrote to memory of 3900 2016 10CA.tmp 113 PID 3900 wrote to memory of 4820 3900 1186.tmp 114 PID 4820 wrote to memory of 1548 4820 1241.tmp 115 PID 1548 wrote to memory of 1596 1548 12CE.tmp 116 PID 1596 wrote to memory of 4724 1596 13A8.tmp 117 PID 4724 wrote to memory of 3528 4724 1445.tmp 118 PID 3528 wrote to memory of 5096 3528 14D1.tmp 119 PID 5096 wrote to memory of 252 5096 159C.tmp 120 PID 252 wrote to memory of 2064 252 1668.tmp 121 PID 2064 wrote to memory of 2860 2064 16F4.tmp 122 PID 2860 wrote to memory of 5952 2860 17BF.tmp 123 PID 5952 wrote to memory of 3692 5952 182D.tmp 124 PID 3692 wrote to memory of 1264 3692 18AA.tmp 125 PID 1264 wrote to memory of 4372 1264 1936.tmp 126 PID 4372 wrote to memory of 5224 4372 19A4.tmp 127 PID 5224 wrote to memory of 3104 5224 1A21.tmp 128 PID 3104 wrote to memory of 3564 3104 1A9E.tmp 129 PID 3564 wrote to memory of 3408 3564 1B0B.tmp 130 PID 3408 wrote to memory of 756 3408 1B98.tmp 131 PID 756 wrote to memory of 1956 756 1C05.tmp 132 PID 1956 wrote to memory of 2644 1956 1C72.tmp 133 PID 2644 wrote to memory of 4648 2644 1CEF.tmp 134 PID 4648 wrote to memory of 1832 4648 1D6C.tmp 135 PID 1832 wrote to memory of 2720 1832 1DDA.tmp 136 PID 2720 wrote to memory of 4336 2720 1E66.tmp 137 PID 4336 wrote to memory of 864 4336 1EE3.tmp 138 PID 864 wrote to memory of 1272 864 1F51.tmp 139 PID 1272 wrote to memory of 908 1272 1FBE.tmp 140 PID 908 wrote to memory of 5832 908 204B.tmp 141 PID 5832 wrote to memory of 2600 5832 20D7.tmp 142 PID 2600 wrote to memory of 4652 2600 2154.tmp 143 PID 4652 wrote to memory of 2488 4652 21B2.tmp 144 PID 2488 wrote to memory of 5384 2488 224E.tmp 145 PID 5384 wrote to memory of 2888 5384 22CB.tmp 146 PID 2888 wrote to memory of 2652 2888 2348.tmp 147 PID 2652 wrote to memory of 4632 2652 23D5.tmp 148 PID 4632 wrote to memory of 836 4632 2452.tmp 149 PID 836 wrote to memory of 3828 836 24DF.tmp 150 PID 3828 wrote to memory of 2776 3828 255C.tmp 151 PID 2776 wrote to memory of 3316 2776 25C9.tmp 152 PID 3316 wrote to memory of 5016 3316 2656.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_e221f1362ba08e64df6f726fb24b577d_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_e221f1362ba08e64df6f726fb24b577d_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\38B.tmp"C:\Users\Admin\AppData\Local\Temp\38B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\9C5.tmp"C:\Users\Admin\AppData\Local\Temp\9C5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\ABF.tmp"C:\Users\Admin\AppData\Local\Temp\ABF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\BB9.tmp"C:\Users\Admin\AppData\Local\Temp\BB9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\C46.tmp"C:\Users\Admin\AppData\Local\Temp\C46.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\CD2.tmp"C:\Users\Admin\AppData\Local\Temp\CD2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\D4F.tmp"C:\Users\Admin\AppData\Local\Temp\D4F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\104D.tmp"C:\Users\Admin\AppData\Local\Temp\104D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\10CA.tmp"C:\Users\Admin\AppData\Local\Temp\10CA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\12CE.tmp"C:\Users\Admin\AppData\Local\Temp\12CE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\13A8.tmp"C:\Users\Admin\AppData\Local\Temp\13A8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\1445.tmp"C:\Users\Admin\AppData\Local\Temp\1445.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\159C.tmp"C:\Users\Admin\AppData\Local\Temp\159C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\16F4.tmp"C:\Users\Admin\AppData\Local\Temp\16F4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\17BF.tmp"C:\Users\Admin\AppData\Local\Temp\17BF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\18AA.tmp"C:\Users\Admin\AppData\Local\Temp\18AA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\1936.tmp"C:\Users\Admin\AppData\Local\Temp\1936.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"C:\Users\Admin\AppData\Local\Temp\1B0B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\1B98.tmp"C:\Users\Admin\AppData\Local\Temp\1B98.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\1C05.tmp"C:\Users\Admin\AppData\Local\Temp\1C05.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"C:\Users\Admin\AppData\Local\Temp\1DDA.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1E66.tmp"C:\Users\Admin\AppData\Local\Temp\1E66.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\204B.tmp"C:\Users\Admin\AppData\Local\Temp\204B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\2154.tmp"C:\Users\Admin\AppData\Local\Temp\2154.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\23D5.tmp"C:\Users\Admin\AppData\Local\Temp\23D5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2656.tmp"C:\Users\Admin\AppData\Local\Temp\2656.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"65⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\2740.tmp"C:\Users\Admin\AppData\Local\Temp\2740.tmp"66⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\27BD.tmp"C:\Users\Admin\AppData\Local\Temp\27BD.tmp"67⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\283A.tmp"C:\Users\Admin\AppData\Local\Temp\283A.tmp"68⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\28A7.tmp"C:\Users\Admin\AppData\Local\Temp\28A7.tmp"69⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\2924.tmp"C:\Users\Admin\AppData\Local\Temp\2924.tmp"70⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\29C1.tmp"C:\Users\Admin\AppData\Local\Temp\29C1.tmp"71⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"72⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"C:\Users\Admin\AppData\Local\Temp\2AEA.tmp"73⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\2B76.tmp"C:\Users\Admin\AppData\Local\Temp\2B76.tmp"74⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\2C61.tmp"C:\Users\Admin\AppData\Local\Temp\2C61.tmp"76⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"C:\Users\Admin\AppData\Local\Temp\2CDE.tmp"77⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"C:\Users\Admin\AppData\Local\Temp\2D5B.tmp"78⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"C:\Users\Admin\AppData\Local\Temp\2DD8.tmp"79⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\2E64.tmp"C:\Users\Admin\AppData\Local\Temp\2E64.tmp"80⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\2ED2.tmp"C:\Users\Admin\AppData\Local\Temp\2ED2.tmp"81⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\2F4F.tmp"C:\Users\Admin\AppData\Local\Temp\2F4F.tmp"82⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"C:\Users\Admin\AppData\Local\Temp\2FCC.tmp"83⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\3039.tmp"C:\Users\Admin\AppData\Local\Temp\3039.tmp"84⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\30B6.tmp"C:\Users\Admin\AppData\Local\Temp\30B6.tmp"85⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3123.tmp"C:\Users\Admin\AppData\Local\Temp\3123.tmp"86⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"87⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\321D.tmp"C:\Users\Admin\AppData\Local\Temp\321D.tmp"88⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\32AA.tmp"C:\Users\Admin\AppData\Local\Temp\32AA.tmp"89⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\3337.tmp"C:\Users\Admin\AppData\Local\Temp\3337.tmp"90⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\33C3.tmp"C:\Users\Admin\AppData\Local\Temp\33C3.tmp"91⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\3440.tmp"C:\Users\Admin\AppData\Local\Temp\3440.tmp"92⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\34BD.tmp"C:\Users\Admin\AppData\Local\Temp\34BD.tmp"93⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\352B.tmp"C:\Users\Admin\AppData\Local\Temp\352B.tmp"94⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\35D6.tmp"C:\Users\Admin\AppData\Local\Temp\35D6.tmp"95⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\3644.tmp"C:\Users\Admin\AppData\Local\Temp\3644.tmp"96⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\36D0.tmp"C:\Users\Admin\AppData\Local\Temp\36D0.tmp"97⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\374D.tmp"C:\Users\Admin\AppData\Local\Temp\374D.tmp"98⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\37BB.tmp"C:\Users\Admin\AppData\Local\Temp\37BB.tmp"99⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\3838.tmp"C:\Users\Admin\AppData\Local\Temp\3838.tmp"100⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\38A5.tmp"C:\Users\Admin\AppData\Local\Temp\38A5.tmp"101⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\3922.tmp"C:\Users\Admin\AppData\Local\Temp\3922.tmp"102⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\39AF.tmp"C:\Users\Admin\AppData\Local\Temp\39AF.tmp"103⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"C:\Users\Admin\AppData\Local\Temp\3A4B.tmp"104⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3AC8.tmp"C:\Users\Admin\AppData\Local\Temp\3AC8.tmp"105⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\3B55.tmp"C:\Users\Admin\AppData\Local\Temp\3B55.tmp"106⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"C:\Users\Admin\AppData\Local\Temp\3BE1.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\3C4F.tmp"C:\Users\Admin\AppData\Local\Temp\3C4F.tmp"108⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"C:\Users\Admin\AppData\Local\Temp\3CCC.tmp"109⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3D49.tmp"C:\Users\Admin\AppData\Local\Temp\3D49.tmp"110⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\3DB6.tmp"C:\Users\Admin\AppData\Local\Temp\3DB6.tmp"111⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\3E33.tmp"C:\Users\Admin\AppData\Local\Temp\3E33.tmp"112⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\3EB0.tmp"C:\Users\Admin\AppData\Local\Temp\3EB0.tmp"113⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"C:\Users\Admin\AppData\Local\Temp\3F1D.tmp"114⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3F9A.tmp"C:\Users\Admin\AppData\Local\Temp\3F9A.tmp"115⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\4027.tmp"C:\Users\Admin\AppData\Local\Temp\4027.tmp"116⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\4085.tmp"C:\Users\Admin\AppData\Local\Temp\4085.tmp"117⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\4111.tmp"C:\Users\Admin\AppData\Local\Temp\4111.tmp"118⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\418E.tmp"C:\Users\Admin\AppData\Local\Temp\418E.tmp"119⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\422B.tmp"C:\Users\Admin\AppData\Local\Temp\422B.tmp"120⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\42C7.tmp"C:\Users\Admin\AppData\Local\Temp\42C7.tmp"121⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\4334.tmp"C:\Users\Admin\AppData\Local\Temp\4334.tmp"122⤵PID:5796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-