Analysis
- max time kernel
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_6159903e48179f14fb15c3bdd2107e32_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_6159903e48179f14fb15c3bdd2107e32_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-03_6159903e48179f14fb15c3bdd2107e32_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe
- Size 521KB
- Sample261104-xpcqaazs3q
- SHA256 52dd586b96282ff07f5fd0d9eceb70f33a69b0fbbc429592dea85dab6f9b93e4
- MD5 6159903e48179f14fb15c3bdd2107e32
- SHA1 a790d44fc2ae9ddbb701ae1c3e3893b344aa0b3b
- SHA512 72ec07bbc67ac1fced67b6ad4f02f85ff03f77dc14ed7a21a50eb3ff22eae37ee1913cf18545b4e520b635e81d013bd957d3483008c8b9bf11f57d62736cdc5d
- SSDEEP 12288:c/1Ba9pn+Dt8rTAttYOYW8GYAaPMywjgigCuSNZi:c/C98DyriY1W8GYAwigCuSNg
- TLSH T140B4F115B5C4C432F1D216304E56EFA2883ABC758B2694C73BD43AAE2FB52D1EA35307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 712 4963.tmp 5072 4A3E.tmp 4700 4B19.tmp 1996 4BE4.tmp 4052 4CBF.tmp 5116 4DA9.tmp 3300 4E74.tmp 5620 4F20.tmp 4500 500A.tmp 2552 50D5.tmp 1660 5172.tmp 5424 51FE.tmp 4192 52AA.tmp 5736 5327.tmp 1040 53D3.tmp 5676 547F.tmp 4616 551B.tmp 252 55A8.tmp 3852 5654.tmp 2976 570F.tmp 4512 57BB.tmp 1612 5877.tmp 4488 5913.tmp 2692 5990.tmp 1664 5A6B.tmp 5144 5B36.tmp 5628 5BF1.tmp 480 5CBC.tmp 5940 5D39.tmp 1568 5DC6.tmp 4576 5E53.tmp 1784 5F0E.tmp 2840 5FBA.tmp 2124 6027.tmp 3672 6095.tmp 1464 6112.tmp 1984 617F.tmp 5496 61FC.tmp 5936 6279.tmp 3404 62F6.tmp 4492 6373.tmp 5800 63F0.tmp 1164 646D.tmp 4236 64DA.tmp 2672 6557.tmp 3928 65C5.tmp 3172 6632.tmp 936 66BF.tmp 2772 672C.tmp 724 67B9.tmp 5716 6836.tmp 4816 68C2.tmp 552 693F.tmp 2060 699D.tmp 3676 6A1A.tmp 2196 6A88.tmp 6140 6B05.tmp 3828 6BA1.tmp 4372 6C1E.tmp 3012 6C8B.tmp 1352 6CF9.tmp 616 6D76.tmp 4484 6DF3.tmp 4044 6E60.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F57D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B55C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F40B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 471C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D60E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D40F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 419E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B84A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C69.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 712 3564 2026-11-03_6159903e48179f14fb15c3bdd2107e32_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe 89 PID 712 wrote to memory of 5072 712 4963.tmp 90 PID 5072 wrote to memory of 4700 5072 4A3E.tmp 91 PID 4700 wrote to memory of 1996 4700 4B19.tmp 92 PID 1996 wrote to memory of 4052 1996 4BE4.tmp 93 PID 4052 wrote to memory of 5116 4052 4CBF.tmp 94 PID 5116 wrote to memory of 3300 5116 4DA9.tmp 95 PID 3300 wrote to memory of 5620 3300 4E74.tmp 96 PID 5620 wrote to memory of 4500 5620 4F20.tmp 97 PID 4500 wrote to memory of 2552 4500 500A.tmp 98 PID 2552 wrote to memory of 1660 2552 50D5.tmp 99 PID 1660 wrote to memory of 5424 1660 5172.tmp 100 PID 5424 wrote to memory of 4192 5424 51FE.tmp 101 PID 4192 wrote to memory of 5736 4192 52AA.tmp 102 PID 5736 wrote to memory of 1040 5736 5327.tmp 103 PID 1040 wrote to memory of 5676 1040 53D3.tmp 104 PID 5676 wrote to memory of 4616 5676 547F.tmp 105 PID 4616 wrote to memory of 252 4616 551B.tmp 106 PID 252 wrote to memory of 3852 252 55A8.tmp 107 PID 3852 wrote to memory of 2976 3852 5654.tmp 108 PID 2976 wrote to memory of 4512 2976 570F.tmp 109 PID 4512 wrote to memory of 1612 4512 57BB.tmp 110 PID 1612 wrote to memory of 4488 1612 5877.tmp 111 PID 4488 wrote to memory of 2692 4488 5913.tmp 112 PID 2692 wrote to memory of 1664 2692 5990.tmp 113 PID 1664 wrote to memory of 5144 1664 5A6B.tmp 114 PID 5144 wrote to memory of 5628 5144 5B36.tmp 115 PID 5628 wrote to memory of 480 5628 5BF1.tmp 116 PID 480 wrote to memory of 5940 480 5CBC.tmp 117 PID 5940 wrote to memory of 1568 5940 5D39.tmp 118 PID 1568 wrote to memory of 4576 1568 5DC6.tmp 119 PID 4576 wrote to memory of 1784 4576 5E53.tmp 120 PID 1784 wrote to memory of 2840 1784 5F0E.tmp 121 PID 2840 wrote to memory of 2124 2840 5FBA.tmp 122 PID 2124 wrote to memory of 3672 2124 6027.tmp 123 PID 3672 wrote to memory of 1464 3672 6095.tmp 124 PID 1464 wrote to memory of 1984 1464 6112.tmp 125 PID 1984 wrote to memory of 5496 1984 617F.tmp 126 PID 5496 wrote to memory of 5936 5496 61FC.tmp 127 PID 5936 wrote to memory of 3404 5936 6279.tmp 128 PID 3404 wrote to memory of 4492 3404 62F6.tmp 129 PID 4492 wrote to memory of 5800 4492 6373.tmp 130 PID 5800 wrote to memory of 1164 5800 63F0.tmp 131 PID 1164 wrote to memory of 4236 1164 646D.tmp 132 PID 4236 wrote to memory of 2672 4236 64DA.tmp 133 PID 2672 wrote to memory of 3928 2672 6557.tmp 134 PID 3928 wrote to memory of 3172 3928 65C5.tmp 135 PID 3172 wrote to memory of 936 3172 6632.tmp 136 PID 936 wrote to memory of 2772 936 66BF.tmp 137 PID 2772 wrote to memory of 724 2772 672C.tmp 138 PID 724 wrote to memory of 5716 724 67B9.tmp 139 PID 5716 wrote to memory of 4816 5716 6836.tmp 140 PID 4816 wrote to memory of 552 4816 68C2.tmp 141 PID 552 wrote to memory of 2060 552 693F.tmp 142 PID 2060 wrote to memory of 3676 2060 699D.tmp 143 PID 3676 wrote to memory of 2196 3676 6A1A.tmp 144 PID 2196 wrote to memory of 6140 2196 6A88.tmp 145 PID 6140 wrote to memory of 3828 6140 6B05.tmp 146 PID 3828 wrote to memory of 4372 3828 6BA1.tmp 147 PID 4372 wrote to memory of 3012 4372 6C1E.tmp 148 PID 3012 wrote to memory of 1352 3012 6C8B.tmp 149 PID 1352 wrote to memory of 616 1352 6CF9.tmp 150 PID 616 wrote to memory of 4484 616 6D76.tmp 151 PID 4484 wrote to memory of 4044 4484 6DF3.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_6159903e48179f14fb15c3bdd2107e32_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6159903e48179f14fb15c3bdd2107e32_elex_karagany_mafia_manuscrypt_rhadamanthys_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\4963.tmp"C:\Users\Admin\AppData\Local\Temp\4963.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\4E74.tmp"C:\Users\Admin\AppData\Local\Temp\4E74.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\500A.tmp"C:\Users\Admin\AppData\Local\Temp\500A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\50D5.tmp"C:\Users\Admin\AppData\Local\Temp\50D5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5172.tmp"C:\Users\Admin\AppData\Local\Temp\5172.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\51FE.tmp"C:\Users\Admin\AppData\Local\Temp\51FE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\52AA.tmp"C:\Users\Admin\AppData\Local\Temp\52AA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\5327.tmp"C:\Users\Admin\AppData\Local\Temp\5327.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\53D3.tmp"C:\Users\Admin\AppData\Local\Temp\53D3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\551B.tmp"C:\Users\Admin\AppData\Local\Temp\551B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5913.tmp"C:\Users\Admin\AppData\Local\Temp\5913.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\5990.tmp"C:\Users\Admin\AppData\Local\Temp\5990.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5B36.tmp"C:\Users\Admin\AppData\Local\Temp\5B36.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\5D39.tmp"C:\Users\Admin\AppData\Local\Temp\5D39.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5E53.tmp"C:\Users\Admin\AppData\Local\Temp\5E53.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\6112.tmp"C:\Users\Admin\AppData\Local\Temp\6112.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\61FC.tmp"C:\Users\Admin\AppData\Local\Temp\61FC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\6279.tmp"C:\Users\Admin\AppData\Local\Temp\6279.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\62F6.tmp"C:\Users\Admin\AppData\Local\Temp\62F6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\6373.tmp"C:\Users\Admin\AppData\Local\Temp\6373.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\63F0.tmp"C:\Users\Admin\AppData\Local\Temp\63F0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\646D.tmp"C:\Users\Admin\AppData\Local\Temp\646D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\67B9.tmp"C:\Users\Admin\AppData\Local\Temp\67B9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\6836.tmp"C:\Users\Admin\AppData\Local\Temp\6836.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\68C2.tmp"C:\Users\Admin\AppData\Local\Temp\68C2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\693F.tmp"C:\Users\Admin\AppData\Local\Temp\693F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\699D.tmp"C:\Users\Admin\AppData\Local\Temp\699D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\6E60.tmp"C:\Users\Admin\AppData\Local\Temp\6E60.tmp"65⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"66⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"67⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"C:\Users\Admin\AppData\Local\Temp\6FB8.tmp"68⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"69⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\70B2.tmp"C:\Users\Admin\AppData\Local\Temp\70B2.tmp"70⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"71⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\719C.tmp"C:\Users\Admin\AppData\Local\Temp\719C.tmp"72⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7229.tmp"C:\Users\Admin\AppData\Local\Temp\7229.tmp"73⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\7296.tmp"C:\Users\Admin\AppData\Local\Temp\7296.tmp"74⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"75⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"76⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\73FD.tmp"C:\Users\Admin\AppData\Local\Temp\73FD.tmp"77⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\745B.tmp"C:\Users\Admin\AppData\Local\Temp\745B.tmp"78⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\74D8.tmp"C:\Users\Admin\AppData\Local\Temp\74D8.tmp"79⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7555.tmp"C:\Users\Admin\AppData\Local\Temp\7555.tmp"80⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"81⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\765F.tmp"C:\Users\Admin\AppData\Local\Temp\765F.tmp"82⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\76FB.tmp"C:\Users\Admin\AppData\Local\Temp\76FB.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\7768.tmp"C:\Users\Admin\AppData\Local\Temp\7768.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"85⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"86⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\78DF.tmp"C:\Users\Admin\AppData\Local\Temp\78DF.tmp"87⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"88⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\79E9.tmp"C:\Users\Admin\AppData\Local\Temp\79E9.tmp"89⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"90⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"91⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\7B41.tmp"C:\Users\Admin\AppData\Local\Temp\7B41.tmp"92⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"93⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"94⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"95⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\7D35.tmp"C:\Users\Admin\AppData\Local\Temp\7D35.tmp"96⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"97⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"98⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"99⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7F19.tmp"C:\Users\Admin\AppData\Local\Temp\7F19.tmp"100⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"101⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\8013.tmp"C:\Users\Admin\AppData\Local\Temp\8013.tmp"102⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\80A0.tmp"C:\Users\Admin\AppData\Local\Temp\80A0.tmp"103⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\810D.tmp"C:\Users\Admin\AppData\Local\Temp\810D.tmp"104⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"105⤵PID:5608
-
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"106⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\82A3.tmp"C:\Users\Admin\AppData\Local\Temp\82A3.tmp"107⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"108⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\838E.tmp"C:\Users\Admin\AppData\Local\Temp\838E.tmp"109⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\83FB.tmp"C:\Users\Admin\AppData\Local\Temp\83FB.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"111⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"112⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\8572.tmp"C:\Users\Admin\AppData\Local\Temp\8572.tmp"113⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\860E.tmp"C:\Users\Admin\AppData\Local\Temp\860E.tmp"114⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"115⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\8776.tmp"C:\Users\Admin\AppData\Local\Temp\8776.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"118⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"119⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"120⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\893B.tmp"C:\Users\Admin\AppData\Local\Temp\893B.tmp"121⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\89B8.tmp"C:\Users\Admin\AppData\Local\Temp\89B8.tmp"122⤵PID:4600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-