🎯 Mutex-based execution marker

The items that name it 2

• NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  writeup2026-09-28

  Main component creates a mutex named <username>-<process name>, e.g., Contoso-Poedit.exe

• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeup2026-06-08

  CPFATE_2704_v4.0.30319 mutex found in v1 and v2, encoding a hardcoded ID and the .NET runtime version, acting as a developer/codebase fingerprint.