Analysis
- max time kernel
121s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 10:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_692de088c6e8c1513f3d0c55821e1e3e_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_692de088c6e8c1513f3d0c55821e1e3e_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-22_692de088c6e8c1513f3d0c55821e1e3e_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
- Size 521KB
- Sample261024-l5ph8stvht
- SHA256 c2880e94d3035e8de1fd08f847bb4999435306ca23a119d413d71e5eeed8d6b0
- MD5 692de088c6e8c1513f3d0c55821e1e3e
- SHA1 4ba1ce9332de67128478bd11dfe4f12bf7817040
- SHA512 f8db50e046644069c3bb83bbb641306e657367d6fab95da6a4e2a84a53619ea7f0142b45c52d6199aa43dc7e7ae5e6944245e29d1d8746a651be74400ee26073
- SSDEEP 12288:c/1Ba9pn+DvpVGNM5u4Oxeu/D+xRlTe+opBNZi:c/C98DhV5u4Y7+xRdeLNg
- TLSH T137B4F111B588C532E5E212318E56EBA2883AFDB58B2695C33BD4376E6FB53C1D231343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2412 7D20.tmp 2100 7DBD.tmp 4876 7E69.tmp 1436 7ED6.tmp 4624 7F82.tmp 4416 801E.tmp 5964 809B.tmp 2636 8166.tmp 2204 8629.tmp 4916 86D5.tmp 3532 8761.tmp 4192 87DE.tmp 4716 88AA.tmp 3688 8946.tmp 1188 8A01.tmp 5848 8ACC.tmp 4176 8B88.tmp 1424 8C53.tmp 3200 8CE0.tmp 1124 8D6C.tmp 5856 8E57.tmp 3100 8F22.tmp 1728 8FCE.tmp 2120 905A.tmp 3016 9106.tmp 2656 9193.tmp 5764 921F.tmp 2796 92DB.tmp 300 9377.tmp 204 9433.tmp 3808 94CF.tmp 920 954C.tmp 5356 9607.tmp 5532 9684.tmp 5976 9701.tmp 3716 977E.tmp 3372 97EC.tmp 2500 9869.tmp 4836 98E6.tmp 6048 9953.tmp 2252 99C1.tmp 5192 9A3E.tmp 3560 9ABB.tmp 5864 9B38.tmp 2836 9BA5.tmp 5800 9C12.tmp 5696 9C9F.tmp 5684 9D2C.tmp 1596 9DA9.tmp 4980 9E16.tmp 3216 9EA3.tmp 1772 9F20.tmp 6040 9F8D.tmp 4952 A00A.tmp 3552 A097.tmp 3416 A104.tmp 4492 A181.tmp 3196 A1FE.tmp 1340 A28B.tmp 2384 A2F8.tmp 3316 A375.tmp 2328 A3F2.tmp 6112 A45F.tmp 2616 A4DC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 292B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5010.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B811.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F71E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 310A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 527D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 607.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 726D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 975A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1729.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D92B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6780.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B6F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6120 wrote to memory of 2412 6120 2026-10-22_692de088c6e8c1513f3d0c55821e1e3e_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe 89 PID 2412 wrote to memory of 2100 2412 7D20.tmp 90 PID 2100 wrote to memory of 4876 2100 7DBD.tmp 91 PID 4876 wrote to memory of 1436 4876 7E69.tmp 92 PID 1436 wrote to memory of 4624 1436 7ED6.tmp 93 PID 4624 wrote to memory of 4416 4624 7F82.tmp 94 PID 4416 wrote to memory of 5964 4416 801E.tmp 95 PID 5964 wrote to memory of 2636 5964 809B.tmp 96 PID 2636 wrote to memory of 2204 2636 8166.tmp 97 PID 2204 wrote to memory of 4916 2204 8629.tmp 98 PID 4916 wrote to memory of 3532 4916 86D5.tmp 99 PID 3532 wrote to memory of 4192 3532 8761.tmp 100 PID 4192 wrote to memory of 4716 4192 87DE.tmp 101 PID 4716 wrote to memory of 3688 4716 88AA.tmp 102 PID 3688 wrote to memory of 1188 3688 8946.tmp 103 PID 1188 wrote to memory of 5848 1188 8A01.tmp 104 PID 5848 wrote to memory of 4176 5848 8ACC.tmp 105 PID 4176 wrote to memory of 1424 4176 8B88.tmp 106 PID 1424 wrote to memory of 3200 1424 8C53.tmp 107 PID 3200 wrote to memory of 1124 3200 8CE0.tmp 108 PID 1124 wrote to memory of 5856 1124 8D6C.tmp 109 PID 5856 wrote to memory of 3100 5856 8E57.tmp 110 PID 3100 wrote to memory of 1728 3100 8F22.tmp 111 PID 1728 wrote to memory of 2120 1728 8FCE.tmp 112 PID 2120 wrote to memory of 3016 2120 905A.tmp 113 PID 3016 wrote to memory of 2656 3016 9106.tmp 114 PID 2656 wrote to memory of 5764 2656 9193.tmp 115 PID 5764 wrote to memory of 2796 5764 921F.tmp 116 PID 2796 wrote to memory of 300 2796 92DB.tmp 117 PID 300 wrote to memory of 204 300 9377.tmp 118 PID 204 wrote to memory of 3808 204 9433.tmp 119 PID 3808 wrote to memory of 920 3808 94CF.tmp 120 PID 920 wrote to memory of 5356 920 954C.tmp 121 PID 5356 wrote to memory of 5532 5356 9607.tmp 122 PID 5532 wrote to memory of 5976 5532 9684.tmp 123 PID 5976 wrote to memory of 3716 5976 9701.tmp 124 PID 3716 wrote to memory of 3372 3716 977E.tmp 125 PID 3372 wrote to memory of 2500 3372 97EC.tmp 126 PID 2500 wrote to memory of 4836 2500 9869.tmp 127 PID 4836 wrote to memory of 6048 4836 98E6.tmp 128 PID 6048 wrote to memory of 2252 6048 9953.tmp 129 PID 2252 wrote to memory of 5192 2252 99C1.tmp 130 PID 5192 wrote to memory of 3560 5192 9A3E.tmp 131 PID 3560 wrote to memory of 5864 3560 9ABB.tmp 132 PID 5864 wrote to memory of 2836 5864 9B38.tmp 133 PID 2836 wrote to memory of 5800 2836 9BA5.tmp 134 PID 5800 wrote to memory of 5696 5800 9C12.tmp 135 PID 5696 wrote to memory of 5684 5696 9C9F.tmp 136 PID 5684 wrote to memory of 1596 5684 9D2C.tmp 137 PID 1596 wrote to memory of 4980 1596 9DA9.tmp 138 PID 4980 wrote to memory of 3216 4980 9E16.tmp 139 PID 3216 wrote to memory of 1772 3216 9EA3.tmp 140 PID 1772 wrote to memory of 6040 1772 9F20.tmp 141 PID 6040 wrote to memory of 4952 6040 9F8D.tmp 142 PID 4952 wrote to memory of 3552 4952 A00A.tmp 143 PID 3552 wrote to memory of 3416 3552 A097.tmp 144 PID 3416 wrote to memory of 4492 3416 A104.tmp 145 PID 4492 wrote to memory of 3196 4492 A181.tmp 146 PID 3196 wrote to memory of 1340 3196 A1FE.tmp 147 PID 1340 wrote to memory of 2384 1340 A28B.tmp 148 PID 2384 wrote to memory of 3316 2384 A2F8.tmp 149 PID 3316 wrote to memory of 2328 3316 A375.tmp 150 PID 2328 wrote to memory of 6112 2328 A3F2.tmp 151 PID 6112 wrote to memory of 2616 6112 A45F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_692de088c6e8c1513f3d0c55821e1e3e_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_692de088c6e8c1513f3d0c55821e1e3e_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"C:\Users\Admin\AppData\Local\Temp\7DBD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\7E69.tmp"C:\Users\Admin\AppData\Local\Temp\7E69.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"C:\Users\Admin\AppData\Local\Temp\7ED6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\7F82.tmp"C:\Users\Admin\AppData\Local\Temp\7F82.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\801E.tmp"C:\Users\Admin\AppData\Local\Temp\801E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\809B.tmp"C:\Users\Admin\AppData\Local\Temp\809B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8629.tmp"C:\Users\Admin\AppData\Local\Temp\8629.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\86D5.tmp"C:\Users\Admin\AppData\Local\Temp\86D5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8761.tmp"C:\Users\Admin\AppData\Local\Temp\8761.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\87DE.tmp"C:\Users\Admin\AppData\Local\Temp\87DE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\88AA.tmp"C:\Users\Admin\AppData\Local\Temp\88AA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\8946.tmp"C:\Users\Admin\AppData\Local\Temp\8946.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\8A01.tmp"C:\Users\Admin\AppData\Local\Temp\8A01.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"C:\Users\Admin\AppData\Local\Temp\8ACC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8C53.tmp"C:\Users\Admin\AppData\Local\Temp\8C53.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\8D6C.tmp"C:\Users\Admin\AppData\Local\Temp\8D6C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\8E57.tmp"C:\Users\Admin\AppData\Local\Temp\8E57.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\8F22.tmp"C:\Users\Admin\AppData\Local\Temp\8F22.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\8FCE.tmp"C:\Users\Admin\AppData\Local\Temp\8FCE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\905A.tmp"C:\Users\Admin\AppData\Local\Temp\905A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9106.tmp"C:\Users\Admin\AppData\Local\Temp\9106.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\9193.tmp"C:\Users\Admin\AppData\Local\Temp\9193.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\921F.tmp"C:\Users\Admin\AppData\Local\Temp\921F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\92DB.tmp"C:\Users\Admin\AppData\Local\Temp\92DB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9377.tmp"C:\Users\Admin\AppData\Local\Temp\9377.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\9433.tmp"C:\Users\Admin\AppData\Local\Temp\9433.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\94CF.tmp"C:\Users\Admin\AppData\Local\Temp\94CF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\954C.tmp"C:\Users\Admin\AppData\Local\Temp\954C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9607.tmp"C:\Users\Admin\AppData\Local\Temp\9607.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\9684.tmp"C:\Users\Admin\AppData\Local\Temp\9684.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\9701.tmp"C:\Users\Admin\AppData\Local\Temp\9701.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\977E.tmp"C:\Users\Admin\AppData\Local\Temp\977E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\98E6.tmp"C:\Users\Admin\AppData\Local\Temp\98E6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\99C1.tmp"C:\Users\Admin\AppData\Local\Temp\99C1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"C:\Users\Admin\AppData\Local\Temp\9A3E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\9ABB.tmp"C:\Users\Admin\AppData\Local\Temp\9ABB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\9B38.tmp"C:\Users\Admin\AppData\Local\Temp\9B38.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"C:\Users\Admin\AppData\Local\Temp\9BA5.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\9C12.tmp"C:\Users\Admin\AppData\Local\Temp\9C12.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\9C9F.tmp"C:\Users\Admin\AppData\Local\Temp\9C9F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\9D2C.tmp"C:\Users\Admin\AppData\Local\Temp\9D2C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\9DA9.tmp"C:\Users\Admin\AppData\Local\Temp\9DA9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\9E16.tmp"C:\Users\Admin\AppData\Local\Temp\9E16.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\9EA3.tmp"C:\Users\Admin\AppData\Local\Temp\9EA3.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\9F20.tmp"C:\Users\Admin\AppData\Local\Temp\9F20.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\9F8D.tmp"C:\Users\Admin\AppData\Local\Temp\9F8D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\A00A.tmp"C:\Users\Admin\AppData\Local\Temp\A00A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\A097.tmp"C:\Users\Admin\AppData\Local\Temp\A097.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\A104.tmp"C:\Users\Admin\AppData\Local\Temp\A104.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A181.tmp"C:\Users\Admin\AppData\Local\Temp\A181.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"C:\Users\Admin\AppData\Local\Temp\A1FE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\A28B.tmp"C:\Users\Admin\AppData\Local\Temp\A28B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\A2F8.tmp"C:\Users\Admin\AppData\Local\Temp\A2F8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\A375.tmp"C:\Users\Admin\AppData\Local\Temp\A375.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\A3F2.tmp"C:\Users\Admin\AppData\Local\Temp\A3F2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\A45F.tmp"C:\Users\Admin\AppData\Local\Temp\A45F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\A4DC.tmp"C:\Users\Admin\AppData\Local\Temp\A4DC.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\A569.tmp"C:\Users\Admin\AppData\Local\Temp\A569.tmp"66⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\A5D6.tmp"C:\Users\Admin\AppData\Local\Temp\A5D6.tmp"67⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\A653.tmp"C:\Users\Admin\AppData\Local\Temp\A653.tmp"68⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\A6D0.tmp"C:\Users\Admin\AppData\Local\Temp\A6D0.tmp"69⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A74D.tmp"C:\Users\Admin\AppData\Local\Temp\A74D.tmp"70⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A7DA.tmp"C:\Users\Admin\AppData\Local\Temp\A7DA.tmp"71⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\A857.tmp"C:\Users\Admin\AppData\Local\Temp\A857.tmp"72⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\A8D4.tmp"C:\Users\Admin\AppData\Local\Temp\A8D4.tmp"73⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A941.tmp"C:\Users\Admin\AppData\Local\Temp\A941.tmp"74⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"C:\Users\Admin\AppData\Local\Temp\A9BE.tmp"75⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\AA2C.tmp"C:\Users\Admin\AppData\Local\Temp\AA2C.tmp"76⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\AAA9.tmp"C:\Users\Admin\AppData\Local\Temp\AAA9.tmp"77⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\AB16.tmp"C:\Users\Admin\AppData\Local\Temp\AB16.tmp"78⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\AB83.tmp"C:\Users\Admin\AppData\Local\Temp\AB83.tmp"79⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\ABF1.tmp"C:\Users\Admin\AppData\Local\Temp\ABF1.tmp"80⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\AC5E.tmp"C:\Users\Admin\AppData\Local\Temp\AC5E.tmp"81⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\ACCC.tmp"C:\Users\Admin\AppData\Local\Temp\ACCC.tmp"82⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\AD39.tmp"C:\Users\Admin\AppData\Local\Temp\AD39.tmp"83⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\ADB6.tmp"C:\Users\Admin\AppData\Local\Temp\ADB6.tmp"84⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\AE23.tmp"C:\Users\Admin\AppData\Local\Temp\AE23.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\AEA0.tmp"C:\Users\Admin\AppData\Local\Temp\AEA0.tmp"86⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"C:\Users\Admin\AppData\Local\Temp\AF0E.tmp"87⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\AF7B.tmp"C:\Users\Admin\AppData\Local\Temp\AF7B.tmp"88⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\AFD9.tmp"C:\Users\Admin\AppData\Local\Temp\AFD9.tmp"89⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\B046.tmp"C:\Users\Admin\AppData\Local\Temp\B046.tmp"90⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\B0B4.tmp"C:\Users\Admin\AppData\Local\Temp\B0B4.tmp"91⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\B131.tmp"C:\Users\Admin\AppData\Local\Temp\B131.tmp"92⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\B1CD.tmp"C:\Users\Admin\AppData\Local\Temp\B1CD.tmp"93⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\B23A.tmp"C:\Users\Admin\AppData\Local\Temp\B23A.tmp"94⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\B2C7.tmp"C:\Users\Admin\AppData\Local\Temp\B2C7.tmp"95⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\B344.tmp"C:\Users\Admin\AppData\Local\Temp\B344.tmp"96⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\B3C1.tmp"C:\Users\Admin\AppData\Local\Temp\B3C1.tmp"97⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\B43E.tmp"C:\Users\Admin\AppData\Local\Temp\B43E.tmp"98⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\B49C.tmp"C:\Users\Admin\AppData\Local\Temp\B49C.tmp"99⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\B519.tmp"C:\Users\Admin\AppData\Local\Temp\B519.tmp"100⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\B596.tmp"C:\Users\Admin\AppData\Local\Temp\B596.tmp"101⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\B603.tmp"C:\Users\Admin\AppData\Local\Temp\B603.tmp"102⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\B670.tmp"C:\Users\Admin\AppData\Local\Temp\B670.tmp"103⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\B6DE.tmp"C:\Users\Admin\AppData\Local\Temp\B6DE.tmp"104⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\B75B.tmp"C:\Users\Admin\AppData\Local\Temp\B75B.tmp"105⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\B7C8.tmp"C:\Users\Admin\AppData\Local\Temp\B7C8.tmp"106⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\B855.tmp"C:\Users\Admin\AppData\Local\Temp\B855.tmp"107⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\B8C2.tmp"C:\Users\Admin\AppData\Local\Temp\B8C2.tmp"108⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B92F.tmp"C:\Users\Admin\AppData\Local\Temp\B92F.tmp"109⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\B9AC.tmp"C:\Users\Admin\AppData\Local\Temp\B9AC.tmp"110⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\BA39.tmp"C:\Users\Admin\AppData\Local\Temp\BA39.tmp"111⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\BAB6.tmp"C:\Users\Admin\AppData\Local\Temp\BAB6.tmp"112⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\BB23.tmp"C:\Users\Admin\AppData\Local\Temp\BB23.tmp"113⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\BB91.tmp"C:\Users\Admin\AppData\Local\Temp\BB91.tmp"114⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\BBFE.tmp"C:\Users\Admin\AppData\Local\Temp\BBFE.tmp"115⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"117⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"118⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"119⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"120⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"121⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"122⤵PID:5544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-