Analysis
- max time kernel
123s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-14_afc0df6a6cce983dc2df15bb7d7c5412_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_afc0df6a6cce983dc2df15bb7d7c5412_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-14_afc0df6a6cce983dc2df15bb7d7c5412_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
- Size 521KB
- Sample261014-rmgcsss16r
- SHA256 05bf31f68df932605b867ff912999ae2ec1613fda84e7e4703fb218bd4075b71
- MD5 afc0df6a6cce983dc2df15bb7d7c5412
- SHA1 270a24b9578bd475ef66ee0ee0800c88fccf3c14
- SHA512 50477017bf9701428527e39cc647af114dca891ecf73a73ea4270da00fbb8a9238e5fa7460cb375892d37a55cf2a9ee30c4df22fd9f2f8d0e8d7fe90881bb025
- SSDEEP 12288:c/1Ba9pn+DyLKRI2keZ1gIzKLlZKR4tdf87NZi:c/C98DNIVeUI2lkR4/E7Ng
- TLSH T1A3B4F122B588C432F1D222354A56EBA28D3ABC754B2664C33BD4277E6FB53C1E675307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 812 C8D4.tmp 4848 C970.tmp 5704 CA2C.tmp 5736 CAE7.tmp 4480 CBF1.tmp 6112 CC9D.tmp 3476 CD68.tmp 1400 CDD5.tmp 5200 CE72.tmp 4308 CF1E.tmp 2024 CFAA.tmp 1268 D046.tmp 4248 D0C3.tmp 2452 D140.tmp 5648 D1BD.tmp 4260 D289.tmp 5436 D344.tmp 1056 D3C1.tmp 1916 D44E.tmp 4452 D4FA.tmp 4712 D586.tmp 4964 D622.tmp 1500 D6CE.tmp 5492 D78A.tmp 4556 D845.tmp 4836 D8D2.tmp 3724 D9BC.tmp 4576 DA59.tmp 2248 DB24.tmp 6084 DB91.tmp 4684 DC1E.tmp 2924 DCD9.tmp 4268 DD56.tmp 2020 DDE3.tmp 6068 DE7F.tmp 3028 DF3B.tmp 5976 DFC7.tmp 5100 E044.tmp 4856 E0E0.tmp 4708 E17D.tmp 4756 E219.tmp 1376 E2B5.tmp 2488 E342.tmp 1340 E3DE.tmp 2640 E46B.tmp 2804 E4E8.tmp 2652 E5C2.tmp 5036 E67E.tmp 4492 E739.tmp 2580 E797.tmp 2476 E805.tmp 2604 E882.tmp 5640 E8FF.tmp 2868 E97C.tmp 6048 EA27.tmp 2324 EAA4.tmp 1576 EB41.tmp 5712 EBDD.tmp 2132 EC6A.tmp 3464 ECD7.tmp 2496 ED54.tmp 5544 EDF0.tmp 908 EE6D.tmp 2104 EEEA.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 721F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 505F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3411.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9684.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A005.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CD5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4292 wrote to memory of 812 4292 2026-10-14_afc0df6a6cce983dc2df15bb7d7c5412_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe 88 PID 812 wrote to memory of 4848 812 C8D4.tmp 89 PID 4848 wrote to memory of 5704 4848 C970.tmp 90 PID 5704 wrote to memory of 5736 5704 CA2C.tmp 91 PID 5736 wrote to memory of 4480 5736 CAE7.tmp 92 PID 4480 wrote to memory of 6112 4480 CBF1.tmp 93 PID 6112 wrote to memory of 3476 6112 CC9D.tmp 94 PID 3476 wrote to memory of 1400 3476 CD68.tmp 95 PID 1400 wrote to memory of 5200 1400 CDD5.tmp 96 PID 5200 wrote to memory of 4308 5200 CE72.tmp 97 PID 4308 wrote to memory of 2024 4308 CF1E.tmp 98 PID 2024 wrote to memory of 1268 2024 CFAA.tmp 99 PID 1268 wrote to memory of 4248 1268 D046.tmp 100 PID 4248 wrote to memory of 2452 4248 D0C3.tmp 101 PID 2452 wrote to memory of 5648 2452 D140.tmp 102 PID 5648 wrote to memory of 4260 5648 D1BD.tmp 103 PID 4260 wrote to memory of 5436 4260 D289.tmp 104 PID 5436 wrote to memory of 1056 5436 D344.tmp 105 PID 1056 wrote to memory of 1916 1056 D3C1.tmp 106 PID 1916 wrote to memory of 4452 1916 D44E.tmp 107 PID 4452 wrote to memory of 4712 4452 D4FA.tmp 108 PID 4712 wrote to memory of 4964 4712 D586.tmp 109 PID 4964 wrote to memory of 1500 4964 D622.tmp 110 PID 1500 wrote to memory of 5492 1500 D6CE.tmp 111 PID 5492 wrote to memory of 4556 5492 D78A.tmp 112 PID 4556 wrote to memory of 4836 4556 D845.tmp 113 PID 4836 wrote to memory of 3724 4836 D8D2.tmp 114 PID 3724 wrote to memory of 4576 3724 D9BC.tmp 115 PID 4576 wrote to memory of 2248 4576 DA59.tmp 116 PID 2248 wrote to memory of 6084 2248 DB24.tmp 117 PID 6084 wrote to memory of 4684 6084 DB91.tmp 118 PID 4684 wrote to memory of 2924 4684 DC1E.tmp 119 PID 2924 wrote to memory of 4268 2924 DCD9.tmp 120 PID 4268 wrote to memory of 2020 4268 DD56.tmp 121 PID 2020 wrote to memory of 6068 2020 DDE3.tmp 122 PID 6068 wrote to memory of 3028 6068 DE7F.tmp 123 PID 3028 wrote to memory of 5976 3028 DF3B.tmp 124 PID 5976 wrote to memory of 5100 5976 DFC7.tmp 125 PID 5100 wrote to memory of 4856 5100 E044.tmp 126 PID 4856 wrote to memory of 4708 4856 E0E0.tmp 127 PID 4708 wrote to memory of 4756 4708 E17D.tmp 128 PID 4756 wrote to memory of 1376 4756 E219.tmp 129 PID 1376 wrote to memory of 2488 1376 E2B5.tmp 130 PID 2488 wrote to memory of 1340 2488 E342.tmp 131 PID 1340 wrote to memory of 2640 1340 E3DE.tmp 132 PID 2640 wrote to memory of 2804 2640 E46B.tmp 133 PID 2804 wrote to memory of 2652 2804 E4E8.tmp 134 PID 2652 wrote to memory of 5036 2652 E5C2.tmp 135 PID 5036 wrote to memory of 4492 5036 E67E.tmp 136 PID 4492 wrote to memory of 2580 4492 E739.tmp 137 PID 2580 wrote to memory of 2476 2580 E797.tmp 138 PID 2476 wrote to memory of 2604 2476 E805.tmp 139 PID 2604 wrote to memory of 5640 2604 E882.tmp 140 PID 5640 wrote to memory of 2868 5640 E8FF.tmp 141 PID 2868 wrote to memory of 6048 2868 E97C.tmp 142 PID 6048 wrote to memory of 2324 6048 EA27.tmp 143 PID 2324 wrote to memory of 1576 2324 EAA4.tmp 144 PID 1576 wrote to memory of 5712 1576 EB41.tmp 145 PID 5712 wrote to memory of 2132 5712 EBDD.tmp 146 PID 2132 wrote to memory of 3464 2132 EC6A.tmp 147 PID 3464 wrote to memory of 2496 3464 ECD7.tmp 148 PID 2496 wrote to memory of 5544 2496 ED54.tmp 149 PID 5544 wrote to memory of 908 5544 EDF0.tmp 150 PID 908 wrote to memory of 2104 908 EE6D.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_afc0df6a6cce983dc2df15bb7d7c5412_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_afc0df6a6cce983dc2df15bb7d7c5412_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"C:\Users\Admin\AppData\Local\Temp\C8D4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\C970.tmp"C:\Users\Admin\AppData\Local\Temp\C970.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"C:\Users\Admin\AppData\Local\Temp\CA2C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"C:\Users\Admin\AppData\Local\Temp\CAE7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"C:\Users\Admin\AppData\Local\Temp\CBF1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"C:\Users\Admin\AppData\Local\Temp\CC9D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\CD68.tmp"C:\Users\Admin\AppData\Local\Temp\CD68.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"C:\Users\Admin\AppData\Local\Temp\CDD5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\CE72.tmp"C:\Users\Admin\AppData\Local\Temp\CE72.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"C:\Users\Admin\AppData\Local\Temp\CF1E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"C:\Users\Admin\AppData\Local\Temp\CFAA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\D046.tmp"C:\Users\Admin\AppData\Local\Temp\D046.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"C:\Users\Admin\AppData\Local\Temp\D0C3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\D140.tmp"C:\Users\Admin\AppData\Local\Temp\D140.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"C:\Users\Admin\AppData\Local\Temp\D1BD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\D289.tmp"C:\Users\Admin\AppData\Local\Temp\D289.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\D344.tmp"C:\Users\Admin\AppData\Local\Temp\D344.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"C:\Users\Admin\AppData\Local\Temp\D4FA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\D586.tmp"C:\Users\Admin\AppData\Local\Temp\D586.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\D622.tmp"C:\Users\Admin\AppData\Local\Temp\D622.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\DA59.tmp"C:\Users\Admin\AppData\Local\Temp\DA59.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\DB24.tmp"C:\Users\Admin\AppData\Local\Temp\DB24.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\DB91.tmp"C:\Users\Admin\AppData\Local\Temp\DB91.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"C:\Users\Admin\AppData\Local\Temp\DCD9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\DD56.tmp"C:\Users\Admin\AppData\Local\Temp\DD56.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\E044.tmp"C:\Users\Admin\AppData\Local\Temp\E044.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\E17D.tmp"C:\Users\Admin\AppData\Local\Temp\E17D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\E219.tmp"C:\Users\Admin\AppData\Local\Temp\E219.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\E46B.tmp"C:\Users\Admin\AppData\Local\Temp\E46B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"C:\Users\Admin\AppData\Local\Temp\E4E8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"C:\Users\Admin\AppData\Local\Temp\E5C2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\E739.tmp"C:\Users\Admin\AppData\Local\Temp\E739.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\E797.tmp"C:\Users\Admin\AppData\Local\Temp\E797.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\E805.tmp"C:\Users\Admin\AppData\Local\Temp\E805.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\E882.tmp"C:\Users\Admin\AppData\Local\Temp\E882.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\E97C.tmp"C:\Users\Admin\AppData\Local\Temp\E97C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"C:\Users\Admin\AppData\Local\Temp\EAA4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\EB41.tmp"C:\Users\Admin\AppData\Local\Temp\EB41.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"C:\Users\Admin\AppData\Local\Temp\ECD7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"65⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\EF77.tmp"C:\Users\Admin\AppData\Local\Temp\EF77.tmp"66⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"67⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"68⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\F11D.tmp"C:\Users\Admin\AppData\Local\Temp\F11D.tmp"69⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\F18A.tmp"C:\Users\Admin\AppData\Local\Temp\F18A.tmp"70⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\F207.tmp"C:\Users\Admin\AppData\Local\Temp\F207.tmp"71⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"73⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"74⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"75⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"76⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"77⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"78⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"79⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"80⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\F737.tmp"C:\Users\Admin\AppData\Local\Temp\F737.tmp"81⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"82⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"83⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"84⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"85⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"86⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"87⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"88⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"90⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\FC29.tmp"C:\Users\Admin\AppData\Local\Temp\FC29.tmp"91⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"92⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"93⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"94⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"95⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"96⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"97⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\1.tmp"C:\Users\Admin\AppData\Local\Temp\1.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:468 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"99⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\FB.tmp"C:\Users\Admin\AppData\Local\Temp\FB.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"102⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\272.tmp"C:\Users\Admin\AppData\Local\Temp\272.tmp"103⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2EF.tmp"C:\Users\Admin\AppData\Local\Temp\2EF.tmp"104⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"105⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\3F9.tmp"C:\Users\Admin\AppData\Local\Temp\3F9.tmp"106⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"107⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"108⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"109⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"110⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"111⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"112⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\7E1.tmp"C:\Users\Admin\AppData\Local\Temp\7E1.tmp"113⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\86D.tmp"C:\Users\Admin\AppData\Local\Temp\86D.tmp"114⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"115⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"116⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\A04.tmp"C:\Users\Admin\AppData\Local\Temp\A04.tmp"117⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\A90.tmp"C:\Users\Admin\AppData\Local\Temp\A90.tmp"118⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\B2D.tmp"C:\Users\Admin\AppData\Local\Temp\B2D.tmp"119⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\BB9.tmp"C:\Users\Admin\AppData\Local\Temp\BB9.tmp"120⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\C65.tmp"C:\Users\Admin\AppData\Local\Temp\C65.tmp"121⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\CF2.tmp"C:\Users\Admin\AppData\Local\Temp\CF2.tmp"122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-