Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d90d84cc97e6d8a8a859de2d6f41c10c0a1b7f53573451cc7961f999ba63d77.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
General
- Target 0d90d84cc97e6d8a8a859de2d6f41c10c0a1b7f53573451cc7961f999ba63d77.exe
- Size 9.4MB
- Sample260916-xtqspseq3v
- SHA256 0d90d84cc97e6d8a8a859de2d6f41c10c0a1b7f53573451cc7961f999ba63d77
- MD5 340cb431659753d746422ffcf64ffc06
- SHA1 d8cac264b56eb2be750ad20919dd9b694e07904d
- SHA512 b290fedbc047dda525691f6547dbe0dde816dd9d5e94447d2b3a0793fc85ea2dc7e0853d56e198856ee5c249d54e1079181e183107f3e9b75cf757e4baf4d773
- SSDEEP 98304:F7GpL4IFkDS1foMqv4Yop7IyoB+QBPDE7uo:F7GpZ31foMqtB+QBPDEJ
- TLSH T1A7A649525B970EB0DCE72FB5B59F233D8B25ED368EA90DB8E54CC104A1431986D2FB90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5596 mutated_19250.exe 5532 mutated_19250.exe 5416 mutated_19250.exe 1608 mutated_19250.exe 1188 mutated_19250.exe 3592 mutated_19250.exe 3672 mutated_19250.exe 2428 mutated_19250.exe 3816 mutated_19250.exe 5768 mutated_19250.exe 4656 mutated_19250.exe 748 mutated_19250.exe 1788 mutated_19250.exe 4904 mutated_19250.exe 3748 mutated_19250.exe 6128 mutated_19250.exe 972 mutated_10545.exe 2600 mutated_10545.exe 1364 mutated_10545.exe 1072 mutated_10545.exe 2640 mutated_10545.exe 5336 mutated_10545.exe 2484 mutated_10545.exe 456 mutated_10545.exe 3340 mutated_10545.exe 1876 mutated_10545.exe 5896 mutated_10545.exe 5240 mutated_10545.exe 1376 mutated_10545.exe 1196 mutated_10545.exe 1872 mutated_10545.exe 1956 mutated_10545.exe 1848 mutated_10545.exe 2868 mutated_10545.exe 3784 mutated_10545.exe 624 mutated_3921.exe 5680 mutated_3921.exe 5124 mutated_3921.exe 4872 mutated_3921.exe 3724 mutated_3921.exe 3012 mutated_3921.exe 1696 mutated_3921.exe 4752 mutated_3921.exe 620 mutated_3921.exe 616 mutated_3921.exe 5980 mutated_3921.exe 1652 mutated_3921.exe 4536 mutated_3921.exe 2892 mutated_3921.exe 5152 mutated_3921.exe 4140 mutated_25904.exe 5924 mutated_25904.exe 5252 mutated_25904.exe 1936 mutated_25904.exe 3596 mutated_25904.exe 5692 mutated_25904.exe 1960 mutated_25904.exe 1700 mutated_25904.exe 5832 mutated_25904.exe 2268 mutated_25904.exe 940 mutated_25904.exe 5524 mutated_25904.exe 1744 mutated_25904.exe 1280 mutated_25904.exe - Program crash 1 IoCs
pid pid_target Process 11136 10412 Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_25904.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_24746.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_21803.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_13098.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_27604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_3513.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_15660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_31009.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_21803.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6677.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6677.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_3513.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6473.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_15660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_793.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_21803.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6779.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_17701.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_16152.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_7447.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_3615.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_793.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_29460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_3921.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_3921.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_17701.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_24355.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_26907.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_6444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_18621.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_793.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_7447.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_24644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_3717.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_7447.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mutated_22806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 5596 4756 0d90d84cc97e6d8a8a859de2d6f41c10c0a1b7f53573451cc7961f999ba63d77.exe 84 PID 5596 wrote to memory of 5532 5596 mutated_19250.exe 85 PID 5532 wrote to memory of 5416 5532 mutated_19250.exe 86 PID 5416 wrote to memory of 1608 5416 mutated_19250.exe 87 PID 1608 wrote to memory of 1188 1608 mutated_19250.exe 88 PID 1188 wrote to memory of 3592 1188 mutated_19250.exe 89 PID 3592 wrote to memory of 3672 3592 mutated_19250.exe 90 PID 3672 wrote to memory of 2428 3672 mutated_19250.exe 91 PID 2428 wrote to memory of 3816 2428 mutated_19250.exe 92 PID 3816 wrote to memory of 5768 3816 mutated_19250.exe 93 PID 5768 wrote to memory of 4656 5768 mutated_19250.exe 94 PID 4656 wrote to memory of 748 4656 mutated_19250.exe 95 PID 748 wrote to memory of 1788 748 mutated_19250.exe 96 PID 1788 wrote to memory of 4904 1788 mutated_19250.exe 97 PID 4904 wrote to memory of 3748 4904 mutated_19250.exe 98 PID 3748 wrote to memory of 6128 3748 mutated_19250.exe 99 PID 6128 wrote to memory of 972 6128 mutated_19250.exe 100 PID 972 wrote to memory of 2600 972 mutated_10545.exe 101 PID 2600 wrote to memory of 1364 2600 mutated_10545.exe 102 PID 1364 wrote to memory of 1072 1364 mutated_10545.exe 103 PID 1072 wrote to memory of 2640 1072 mutated_10545.exe 104 PID 2640 wrote to memory of 5336 2640 mutated_10545.exe 105 PID 5336 wrote to memory of 2484 5336 mutated_10545.exe 106 PID 2484 wrote to memory of 456 2484 mutated_10545.exe 107 PID 456 wrote to memory of 3340 456 mutated_10545.exe 108 PID 3340 wrote to memory of 1876 3340 mutated_10545.exe 109 PID 1876 wrote to memory of 5896 1876 mutated_10545.exe 110 PID 5896 wrote to memory of 5240 5896 mutated_10545.exe 111 PID 5240 wrote to memory of 1376 5240 mutated_10545.exe 112 PID 1376 wrote to memory of 1196 1376 mutated_10545.exe 113 PID 1196 wrote to memory of 1872 1196 mutated_10545.exe 114 PID 1872 wrote to memory of 1956 1872 mutated_10545.exe 115 PID 1956 wrote to memory of 1848 1956 mutated_10545.exe 116 PID 1848 wrote to memory of 2868 1848 mutated_10545.exe 117 PID 2868 wrote to memory of 3784 2868 mutated_10545.exe 118 PID 3784 wrote to memory of 624 3784 mutated_10545.exe 119 PID 624 wrote to memory of 5680 624 mutated_3921.exe 120 PID 5680 wrote to memory of 5124 5680 mutated_3921.exe 121 PID 5124 wrote to memory of 4872 5124 mutated_3921.exe 122 PID 4872 wrote to memory of 3724 4872 mutated_3921.exe 123 PID 3724 wrote to memory of 3012 3724 mutated_3921.exe 124 PID 3012 wrote to memory of 1696 3012 mutated_3921.exe 125 PID 1696 wrote to memory of 4752 1696 mutated_3921.exe 126 PID 4752 wrote to memory of 620 4752 mutated_3921.exe 127 PID 620 wrote to memory of 616 620 mutated_3921.exe 128 PID 616 wrote to memory of 5980 616 mutated_3921.exe 129 PID 5980 wrote to memory of 1652 5980 mutated_3921.exe 130 PID 1652 wrote to memory of 4536 1652 mutated_3921.exe 131 PID 4536 wrote to memory of 2892 4536 mutated_3921.exe 132 PID 2892 wrote to memory of 5152 2892 mutated_3921.exe 133 PID 5152 wrote to memory of 4140 5152 mutated_3921.exe 134 PID 4140 wrote to memory of 5924 4140 mutated_25904.exe 135 PID 5924 wrote to memory of 5252 5924 mutated_25904.exe 136 PID 5252 wrote to memory of 1936 5252 mutated_25904.exe 137 PID 1936 wrote to memory of 3596 1936 mutated_25904.exe 138 PID 3596 wrote to memory of 5692 3596 mutated_25904.exe 139 PID 5692 wrote to memory of 1960 5692 mutated_25904.exe 140 PID 1960 wrote to memory of 1700 1960 mutated_25904.exe 141 PID 1700 wrote to memory of 5832 1700 mutated_25904.exe 142 PID 5832 wrote to memory of 2268 5832 mutated_25904.exe 143 PID 2268 wrote to memory of 940 2268 mutated_25904.exe 144 PID 940 wrote to memory of 5524 940 mutated_25904.exe 145 PID 5524 wrote to memory of 1744 5524 mutated_25904.exe 146 PID 1744 wrote to memory of 1280 1744 mutated_25904.exe 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d90d84cc97e6d8a8a859de2d6f41c10c0a1b7f53573451cc7961f999ba63d77.exe"C:\Users\Admin\AppData\Local\Temp\0d90d84cc97e6d8a8a859de2d6f41c10c0a1b7f53573451cc7961f999ba63d77.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\mutated_19250.exe"mutated_19250.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\mutated_10545.exe"mutated_10545.exe"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\mutated_3921.exe"mutated_3921.exe"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"65⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"66⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\mutated_25904.exe"mutated_25904.exe"67⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"68⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"69⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"70⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"71⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"72⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"73⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"74⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"75⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"76⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"77⤵
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"78⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"79⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"80⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"81⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"82⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"83⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"84⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\mutated_6882.exe"mutated_6882.exe"85⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"86⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"87⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"88⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"89⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"90⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"91⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"92⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"93⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"94⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"95⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"96⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"97⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"98⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"99⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"100⤵
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\mutated_24746.exe"mutated_24746.exe"101⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"102⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"103⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"104⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"105⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"106⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"107⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"108⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"109⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"110⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"111⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"112⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"113⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"114⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"115⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"116⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"117⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\mutated_32558.exe"mutated_32558.exe"118⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\mutated_27706.exe"mutated_27706.exe"119⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\mutated_27706.exe"mutated_27706.exe"120⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\mutated_27706.exe"mutated_27706.exe"121⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\mutated_27706.exe"mutated_27706.exe"122⤵PID:5428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-