Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
30/10/2022, 20:38 UTC
General
-
Target
c85e67d1581dc4e1e60f0f39dc7068338b348ec7c3a9ff90c5f768440fef7912.exe
-
Size
1.3MB
-
MD5
a106560a61ac40d575bf8dfba62229a7
-
SHA1
5e2dbc801e06b86ced4499115567634131f5adb6
-
SHA256
c85e67d1581dc4e1e60f0f39dc7068338b348ec7c3a9ff90c5f768440fef7912
-
SHA512
5ad8fe689297f888b12676078960d40bfcb457f59b30cdc7527870a79ff6bec0389ca621069dc88dbcf40b44662c8c304d0d50af6f2a80c5b8b91fc49447cd08
-
SSDEEP
24576:OR1RgRJRmRWRJRbR9RCRwR8RvRhR3R8RARTR9RTRIRkReRJRPRkR:OR1RgRJRmRWRJRbR9RCRwR8RvRhR3R8w
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c85e67d1581dc4e1e60f0f39dc7068338b348ec7c3a9ff90c5f768440fef7912.exe"C:\Users\Admin\AppData\Local\Temp\c85e67d1581dc4e1e60f0f39dc7068338b348ec7c3a9ff90c5f768440fef7912.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7087156.exeC:\Users\Admin\AppData\Local\Temp\tmp7087156.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7087187.exeC:\Users\Admin\AppData\Local\Temp\tmp7087187.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7087265.exeC:\Users\Admin\AppData\Local\Temp\tmp7087265.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7088373.exeC:\Users\Admin\AppData\Local\Temp\tmp7088373.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7087375.exeC:\Users\Admin\AppData\Local\Temp\tmp7087375.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7087546.exeC:\Users\Admin\AppData\Local\Temp\tmp7087546.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7087843.exeC:\Users\Admin\AppData\Local\Temp\tmp7087843.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7088326.exeC:\Users\Admin\AppData\Local\Temp\tmp7088326.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7088576.exeC:\Users\Admin\AppData\Local\Temp\tmp7088576.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7089449.exeC:\Users\Admin\AppData\Local\Temp\tmp7089449.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7089949.exeC:\Users\Admin\AppData\Local\Temp\tmp7089949.exe11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7090027.exeC:\Users\Admin\AppData\Local\Temp\tmp7090027.exe11⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7089559.exeC:\Users\Admin\AppData\Local\Temp\tmp7089559.exe9⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7088903.exeC:\Users\Admin\AppData\Local\Temp\tmp7088903.exe7⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7088389.exeC:\Users\Admin\AppData\Local\Temp\tmp7088389.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp7088685.exeC:\Users\Admin\AppData\Local\Temp\tmp7088685.exe6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7089309.exeC:\Users\Admin\AppData\Local\Temp\tmp7089309.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7089886.exeC:\Users\Admin\AppData\Local\Temp\tmp7089886.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7090385.exeC:\Users\Admin\AppData\Local\Temp\tmp7090385.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7094395.exeC:\Users\Admin\AppData\Local\Temp\tmp7094395.exe11⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7094488.exeC:\Users\Admin\AppData\Local\Temp\tmp7094488.exe11⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7093334.exeC:\Users\Admin\AppData\Local\Temp\tmp7093334.exe9⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7090058.exeC:\Users\Admin\AppData\Local\Temp\tmp7090058.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7093989.exeC:\Users\Admin\AppData\Local\Temp\tmp7093989.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7095065.exeC:\Users\Admin\AppData\Local\Temp\tmp7095065.exe10⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7096547.exeC:\Users\Admin\AppData\Local\Temp\tmp7096547.exe12⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7096719.exeC:\Users\Admin\AppData\Local\Temp\tmp7096719.exe12⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7095533.exeC:\Users\Admin\AppData\Local\Temp\tmp7095533.exe10⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7094348.exeC:\Users\Admin\AppData\Local\Temp\tmp7094348.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\tmp7094691.exeC:\Users\Admin\AppData\Local\Temp\tmp7094691.exe9⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7094909.exeC:\Users\Admin\AppData\Local\Temp\tmp7094909.exe9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7095268.exeC:\Users\Admin\AppData\Local\Temp\tmp7095268.exe10⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7095627.exeC:\Users\Admin\AppData\Local\Temp\tmp7095627.exe10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7096376.exeC:\Users\Admin\AppData\Local\Temp\tmp7096376.exe11⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7097249.exeC:\Users\Admin\AppData\Local\Temp\tmp7097249.exe13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7097624.exeC:\Users\Admin\AppData\Local\Temp\tmp7097624.exe13⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7096594.exeC:\Users\Admin\AppData\Local\Temp\tmp7096594.exe11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7097156.exeC:\Users\Admin\AppData\Local\Temp\tmp7097156.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7098248.exeC:\Users\Admin\AppData\Local\Temp\tmp7098248.exe14⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7098997.exeC:\Users\Admin\AppData\Local\Temp\tmp7098997.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7100245.exeC:\Users\Admin\AppData\Local\Temp\tmp7100245.exe18⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7103567.exeC:\Users\Admin\AppData\Local\Temp\tmp7103567.exe18⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7099433.exeC:\Users\Admin\AppData\Local\Temp\tmp7099433.exe16⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7098466.exeC:\Users\Admin\AppData\Local\Temp\tmp7098466.exe14⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7097468.exeC:\Users\Admin\AppData\Local\Temp\tmp7097468.exe12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7098263.exeC:\Users\Admin\AppData\Local\Temp\tmp7098263.exe13⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7098716.exeC:\Users\Admin\AppData\Local\Temp\tmp7098716.exe13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7099808.exeC:\Users\Admin\AppData\Local\Temp\tmp7099808.exe14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7100057.exeC:\Users\Admin\AppData\Local\Temp\tmp7100057.exe15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7104254.exeC:\Users\Admin\AppData\Local\Temp\tmp7104254.exe17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7104613.exeC:\Users\Admin\AppData\Local\Temp\tmp7104613.exe17⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7102928.exeC:\Users\Admin\AppData\Local\Temp\tmp7102928.exe15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp7104020.exeC:\Users\Admin\AppData\Local\Temp\tmp7104020.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7104909.exeC:\Users\Admin\AppData\Local\Temp\tmp7104909.exe18⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7105845.exeC:\Users\Admin\AppData\Local\Temp\tmp7105845.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7106173.exeC:\Users\Admin\AppData\Local\Temp\tmp7106173.exe20⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7105003.exeC:\Users\Admin\AppData\Local\Temp\tmp7105003.exe18⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7104597.exeC:\Users\Admin\AppData\Local\Temp\tmp7104597.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7105018.exeC:\Users\Admin\AppData\Local\Temp\tmp7105018.exe17⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7106282.exeC:\Users\Admin\AppData\Local\Temp\tmp7106282.exe19⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7108840.exeC:\Users\Admin\AppData\Local\Temp\tmp7108840.exe21⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7112225.exeC:\Users\Admin\AppData\Local\Temp\tmp7112225.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7112678.exeC:\Users\Admin\AppData\Local\Temp\tmp7112678.exe23⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7109121.exeC:\Users\Admin\AppData\Local\Temp\tmp7109121.exe21⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7107015.exeC:\Users\Admin\AppData\Local\Temp\tmp7107015.exe19⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7105689.exeC:\Users\Admin\AppData\Local\Temp\tmp7105689.exe17⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7106032.exeC:\Users\Admin\AppData\Local\Temp\tmp7106032.exe18⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7107358.exeC:\Users\Admin\AppData\Local\Temp\tmp7107358.exe20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7107795.exeC:\Users\Admin\AppData\Local\Temp\tmp7107795.exe20⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7106157.exeC:\Users\Admin\AppData\Local\Temp\tmp7106157.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7106687.exeC:\Users\Admin\AppData\Local\Temp\tmp7106687.exe19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7106984.exeC:\Users\Admin\AppData\Local\Temp\tmp7106984.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7107967.exeC:\Users\Admin\AppData\Local\Temp\tmp7107967.exe20⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7109402.exeC:\Users\Admin\AppData\Local\Temp\tmp7109402.exe22⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7114768.exeC:\Users\Admin\AppData\Local\Temp\tmp7114768.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7114909.exeC:\Users\Admin\AppData\Local\Temp\tmp7114909.exe24⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7112647.exeC:\Users\Admin\AppData\Local\Temp\tmp7112647.exe22⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7108793.exeC:\Users\Admin\AppData\Local\Temp\tmp7108793.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7109074.exeC:\Users\Admin\AppData\Local\Temp\tmp7109074.exe21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7109277.exeC:\Users\Admin\AppData\Local\Temp\tmp7109277.exe21⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7112662.exeC:\Users\Admin\AppData\Local\Temp\tmp7112662.exe22⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7116110.exeC:\Users\Admin\AppData\Local\Temp\tmp7116110.exe24⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7116703.exeC:\Users\Admin\AppData\Local\Temp\tmp7116703.exe26⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7117654.exeC:\Users\Admin\AppData\Local\Temp\tmp7117654.exe28⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7118668.exeC:\Users\Admin\AppData\Local\Temp\tmp7118668.exe30⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7119760.exeC:\Users\Admin\AppData\Local\Temp\tmp7119760.exe32⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7119885.exeC:\Users\Admin\AppData\Local\Temp\tmp7119885.exe32⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7118856.exeC:\Users\Admin\AppData\Local\Temp\tmp7118856.exe30⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7117748.exeC:\Users\Admin\AppData\Local\Temp\tmp7117748.exe28⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7116828.exeC:\Users\Admin\AppData\Local\Temp\tmp7116828.exe26⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7116204.exeC:\Users\Admin\AppData\Local\Temp\tmp7116204.exe24⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7114675.exeC:\Users\Admin\AppData\Local\Temp\tmp7114675.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7115486.exeC:\Users\Admin\AppData\Local\Temp\tmp7115486.exe23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7116250.exeC:\Users\Admin\AppData\Local\Temp\tmp7116250.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7116843.exeC:\Users\Admin\AppData\Local\Temp\tmp7116843.exe24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7117186.exeC:\Users\Admin\AppData\Local\Temp\tmp7117186.exe24⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7117951.exeC:\Users\Admin\AppData\Local\Temp\tmp7117951.exe25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7118216.exeC:\Users\Admin\AppData\Local\Temp\tmp7118216.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7118700.exeC:\Users\Admin\AppData\Local\Temp\tmp7118700.exe26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7119043.exeC:\Users\Admin\AppData\Local\Temp\tmp7119043.exe26⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7119370.exeC:\Users\Admin\AppData\Local\Temp\tmp7119370.exe27⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7120166.exeC:\Users\Admin\AppData\Local\Temp\tmp7120166.exe29⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7121820.exeC:\Users\Admin\AppData\Local\Temp\tmp7121820.exe31⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7122272.exeC:\Users\Admin\AppData\Local\Temp\tmp7122272.exe33⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7122709.exeC:\Users\Admin\AppData\Local\Temp\tmp7122709.exe35⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7123364.exeC:\Users\Admin\AppData\Local\Temp\tmp7123364.exe37⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7123988.exeC:\Users\Admin\AppData\Local\Temp\tmp7123988.exe39⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7124565.exeC:\Users\Admin\AppData\Local\Temp\tmp7124565.exe41⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7125096.exeC:\Users\Admin\AppData\Local\Temp\tmp7125096.exe43⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7125657.exeC:\Users\Admin\AppData\Local\Temp\tmp7125657.exe45⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7126297.exeC:\Users\Admin\AppData\Local\Temp\tmp7126297.exe47⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7126905.exeC:\Users\Admin\AppData\Local\Temp\tmp7126905.exe49⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7127467.exeC:\Users\Admin\AppData\Local\Temp\tmp7127467.exe51⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7132864.exeC:\Users\Admin\AppData\Local\Temp\tmp7132864.exe53⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7134471.exeC:\Users\Admin\AppData\Local\Temp\tmp7134471.exe55⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7135189.exeC:\Users\Admin\AppData\Local\Temp\tmp7135189.exe57⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7135844.exeC:\Users\Admin\AppData\Local\Temp\tmp7135844.exe59⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7136390.exeC:\Users\Admin\AppData\Local\Temp\tmp7136390.exe61⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7136920.exeC:\Users\Admin\AppData\Local\Temp\tmp7136920.exe63⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7137466.exeC:\Users\Admin\AppData\Local\Temp\tmp7137466.exe65⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7138075.exeC:\Users\Admin\AppData\Local\Temp\tmp7138075.exe67⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7138621.exeC:\Users\Admin\AppData\Local\Temp\tmp7138621.exe69⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7139136.exeC:\Users\Admin\AppData\Local\Temp\tmp7139136.exe71⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7139853.exeC:\Users\Admin\AppData\Local\Temp\tmp7139853.exe73⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7142131.exeC:\Users\Admin\AppData\Local\Temp\tmp7142131.exe75⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7143160.exeC:\Users\Admin\AppData\Local\Temp\tmp7143160.exe77⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7143940.exeC:\Users\Admin\AppData\Local\Temp\tmp7143940.exe79⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7144502.exeC:\Users\Admin\AppData\Local\Temp\tmp7144502.exe81⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7145048.exeC:\Users\Admin\AppData\Local\Temp\tmp7145048.exe83⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7145594.exeC:\Users\Admin\AppData\Local\Temp\tmp7145594.exe85⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7146187.exeC:\Users\Admin\AppData\Local\Temp\tmp7146187.exe87⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7146889.exeC:\Users\Admin\AppData\Local\Temp\tmp7146889.exe89⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7147341.exeC:\Users\Admin\AppData\Local\Temp\tmp7147341.exe91⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7147903.exeC:\Users\Admin\AppData\Local\Temp\tmp7147903.exe93⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7148496.exeC:\Users\Admin\AppData\Local\Temp\tmp7148496.exe95⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7149167.exeC:\Users\Admin\AppData\Local\Temp\tmp7149167.exe97⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7150586.exeC:\Users\Admin\AppData\Local\Temp\tmp7150586.exe99⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7150181.exeC:\Users\Admin\AppData\Local\Temp\tmp7150181.exe99⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7151538.exeC:\Users\Admin\AppData\Local\Temp\tmp7151538.exe101⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7152099.exeC:\Users\Admin\AppData\Local\Temp\tmp7152099.exe103⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7152723.exeC:\Users\Admin\AppData\Local\Temp\tmp7152723.exe105⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7153223.exeC:\Users\Admin\AppData\Local\Temp\tmp7153223.exe107⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7153847.exeC:\Users\Admin\AppData\Local\Temp\tmp7153847.exe109⤵
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7154439.exeC:\Users\Admin\AppData\Local\Temp\tmp7154439.exe111⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"112⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\tmp7155079.exeC:\Users\Admin\AppData\Local\Temp\tmp7155079.exe113⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7155656.exeC:\Users\Admin\AppData\Local\Temp\tmp7155656.exe115⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7156077.exeC:\Users\Admin\AppData\Local\Temp\tmp7156077.exe117⤵
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7156592.exeC:\Users\Admin\AppData\Local\Temp\tmp7156592.exe119⤵
- Modifies registry class
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7157185.exeC:\Users\Admin\AppData\Local\Temp\tmp7157185.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-