41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30

Analysis

max time kernel
153s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe
Size

7.4MB
MD5

e7de06b3a0713329e1112ed2132d596b
SHA1

ae60a9d03847b64c5f37e0d4bbc9d58c5f17efc8
SHA256

41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30
SHA512

8b88ea782113e6acafdf5038f00ae055570170713ce45b2519a81833585a4756b837b30acba2d00a7498b593510e12df9587f4d5115d7bcbf013bca0777de5bb
SSDEEP

98304:dtytNt8tytNt3tytNt8tytNt4tytNt8tytNt:fkvCkvdkvCkv2kvCkv

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 29 IoCs

pid	Process
916	tmp7097281.exe
1980	tmp7097608.exe
1212	notpad.exe
1036	tmp7098326.exe
536	tmp7098716.exe
1200	notpad.exe
1804	tmp7106391.exe
1696	tmp7110962.exe
456	notpad.exe
1984	tmp7125486.exe
1752	tmp7112335.exe
2040	notpad.exe
304	tmp7112818.exe
1548	tmp7113941.exe
2044	tmp7113692.exe
568	tmp7155765.exe
344	notpad.exe
668	tmp7115455.exe
1592	notpad.exe
1212	tmp7116313.exe
556	tmp7116375.exe
1300	tmp7124191.exe
588	tmp7154299.exe
1828	tmp7155282.exe
1492	tmp7154018.exe
912	notpad.exe
1844	tmp7220256.exe
1700	tmp7194532.exe
1696	tmp7193549.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/840-62-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x0009000000012301-72.dat	upx
behavioral1/files/0x0009000000012301-70.dat	upx
behavioral1/files/0x0009000000012301-73.dat	upx
behavioral1/files/0x0009000000012301-69.dat	upx
behavioral1/memory/1212-85-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x00080000000122f9-79.dat	upx
behavioral1/files/0x0009000000012301-87.dat	upx
behavioral1/files/0x0009000000012301-90.dat	upx
behavioral1/files/0x0009000000012301-88.dat	upx
behavioral1/memory/1200-91-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1200-101-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x00080000000122f9-103.dat	upx
behavioral1/files/0x000a000000012301-106.dat	upx
behavioral1/files/0x000a000000012301-107.dat	upx
behavioral1/files/0x000a000000012301-110.dat	upx
behavioral1/files/0x000a000000012301-109.dat	upx
behavioral1/memory/456-111-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x00080000000122f9-117.dat	upx
behavioral1/files/0x000a000000012301-128.dat	upx
behavioral1/files/0x000a000000012301-123.dat	upx
behavioral1/files/0x000a000000012301-124.dat	upx
behavioral1/files/0x0009000000012324-127.dat	upx
behavioral1/files/0x0009000000012324-126.dat	upx
behavioral1/files/0x0009000000012324-121.dat	upx
behavioral1/files/0x0009000000012324-120.dat	upx
behavioral1/memory/456-135-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1752-139-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x00080000000122f9-142.dat	upx
behavioral1/memory/2040-136-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1752-151-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x000a000000012301-153.dat	upx
behavioral1/files/0x000a000000012301-156.dat	upx
behavioral1/files/0x000a000000012301-154.dat	upx
behavioral1/memory/568-157-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2040-160-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/668-162-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1592-164-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/568-167-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/668-170-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1212-180-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1592-185-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1656-206-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1756-207-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2024-209-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1096-208-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2024-215-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1756-226-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2008-230-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/344-250-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1036-249-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1816-246-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1036-254-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/344-258-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1816-259-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2020-269-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1644-267-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1716-274-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1932-275-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1692-273-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1168-264-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/456-261-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/912-244-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/536-243-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Loads dropped DLL 58 IoCs

pid	Process
840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe
840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe
840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe
840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe
812	WerFault.exe
812	WerFault.exe
916	tmp7097281.exe
916	tmp7097281.exe
1212	notpad.exe
1212	notpad.exe
1212	notpad.exe
1036	tmp7098326.exe
1036	tmp7098326.exe
812	WerFault.exe
1200	notpad.exe
1200	notpad.exe
1200	notpad.exe
1804	tmp7124924.exe
1804	tmp7124924.exe
456	notpad.exe
456	notpad.exe
456	notpad.exe
456	notpad.exe
1984	tmp7125486.exe
1984	tmp7125486.exe
1752	tmp7112335.exe
1752	tmp7112335.exe
1752	tmp7112335.exe
2040	notpad.exe
2040	notpad.exe
304	tmp7154549.exe
304	tmp7154549.exe
2040	notpad.exe
2040	notpad.exe
568	tmp7155765.exe
568	tmp7155765.exe
344	notpad.exe
344	notpad.exe
568	tmp7155765.exe
568	tmp7155765.exe
668	tmp7115455.exe
668	tmp7115455.exe
668	tmp7115455.exe
1592	notpad.exe
1592	notpad.exe
556	tmp7191334.exe
1212	tmp7191256.exe
556	tmp7191334.exe
1212	tmp7191256.exe
1212	tmp7191256.exe
1828	tmp7213127.exe
1828	tmp7213127.exe
1492	tmp7154018.exe
1492	tmp7154018.exe
1592	notpad.exe
1592	notpad.exe
1700	tmp7194532.exe
1700	tmp7194532.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\notpad.exe	tmp7106391.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7097281.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7112818.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp7155282.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7194532.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp7194532.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7125486.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp7112818.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp7116375.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7098326.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7112818.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	notpad.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7194532.exe
File created	C:\Windows\SysWOW64\fsb.tmp	tmp7097281.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp7097281.exe
File created	C:\Windows\SysWOW64\notpad.exe	notpad.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7116375.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7155282.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7098326.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7155282.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7097281.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7125486.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp7125486.exe
File created	C:\Windows\SysWOW64\notpad.exe-	notpad.exe
File created	C:\Windows\SysWOW64\notpad.exe	tmp7098326.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7106391.exe
File created	C:\Windows\SysWOW64\notpad.exe-	tmp7106391.exe
File opened for modification	C:\Windows\SysWOW64\fsb.tmp	tmp7116375.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	1980	WerFault.exe	28

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7125486.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	notpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7194532.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7097281.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7106391.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7116375.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7155282.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7098326.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1"	tmp7112818.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 916	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	27
PID 840 wrote to memory of 916	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	27
PID 840 wrote to memory of 916	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	27
PID 840 wrote to memory of 916	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	27
PID 840 wrote to memory of 1980	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	28
PID 840 wrote to memory of 1980	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	28
PID 840 wrote to memory of 1980	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	28
PID 840 wrote to memory of 1980	840	41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe	28
PID 1980 wrote to memory of 812	1980	tmp7097608.exe	29
PID 1980 wrote to memory of 812	1980	tmp7097608.exe	29
PID 1980 wrote to memory of 812	1980	tmp7097608.exe	29
PID 1980 wrote to memory of 812	1980	tmp7097608.exe	29
PID 916 wrote to memory of 1212	916	tmp7097281.exe	30
PID 916 wrote to memory of 1212	916	tmp7097281.exe	30
PID 916 wrote to memory of 1212	916	tmp7097281.exe	30
PID 916 wrote to memory of 1212	916	tmp7097281.exe	30
PID 1212 wrote to memory of 1036	1212	notpad.exe	31
PID 1212 wrote to memory of 1036	1212	notpad.exe	31
PID 1212 wrote to memory of 1036	1212	notpad.exe	31
PID 1212 wrote to memory of 1036	1212	notpad.exe	31
PID 1212 wrote to memory of 536	1212	notpad.exe	32
PID 1212 wrote to memory of 536	1212	notpad.exe	32
PID 1212 wrote to memory of 536	1212	notpad.exe	32
PID 1212 wrote to memory of 536	1212	notpad.exe	32
PID 1036 wrote to memory of 1200	1036	tmp7098326.exe	33
PID 1036 wrote to memory of 1200	1036	tmp7098326.exe	33
PID 1036 wrote to memory of 1200	1036	tmp7098326.exe	33
PID 1036 wrote to memory of 1200	1036	tmp7098326.exe	33
PID 1200 wrote to memory of 1804	1200	notpad.exe	34
PID 1200 wrote to memory of 1804	1200	notpad.exe	34
PID 1200 wrote to memory of 1804	1200	notpad.exe	34
PID 1200 wrote to memory of 1804	1200	notpad.exe	34
PID 1200 wrote to memory of 1696	1200	notpad.exe	35
PID 1200 wrote to memory of 1696	1200	notpad.exe	35
PID 1200 wrote to memory of 1696	1200	notpad.exe	35
PID 1200 wrote to memory of 1696	1200	notpad.exe	35
PID 1804 wrote to memory of 456	1804	tmp7124924.exe	88
PID 1804 wrote to memory of 456	1804	tmp7124924.exe	88
PID 1804 wrote to memory of 456	1804	tmp7124924.exe	88
PID 1804 wrote to memory of 456	1804	tmp7124924.exe	88
PID 456 wrote to memory of 1984	456	notpad.exe	98
PID 456 wrote to memory of 1984	456	notpad.exe	98
PID 456 wrote to memory of 1984	456	notpad.exe	98
PID 456 wrote to memory of 1984	456	notpad.exe	98
PID 456 wrote to memory of 1752	456	notpad.exe	41
PID 456 wrote to memory of 1752	456	notpad.exe	41
PID 456 wrote to memory of 1752	456	notpad.exe	41
PID 456 wrote to memory of 1752	456	notpad.exe	41
PID 1984 wrote to memory of 2040	1984	tmp7125486.exe	39
PID 1984 wrote to memory of 2040	1984	tmp7125486.exe	39
PID 1984 wrote to memory of 2040	1984	tmp7125486.exe	39
PID 1984 wrote to memory of 2040	1984	tmp7125486.exe	39
PID 1752 wrote to memory of 304	1752	tmp7112335.exe	38
PID 1752 wrote to memory of 304	1752	tmp7112335.exe	38
PID 1752 wrote to memory of 304	1752	tmp7112335.exe	38
PID 1752 wrote to memory of 304	1752	tmp7112335.exe	38
PID 1752 wrote to memory of 1548	1752	tmp7112335.exe	40
PID 1752 wrote to memory of 1548	1752	tmp7112335.exe	40
PID 1752 wrote to memory of 1548	1752	tmp7112335.exe	40
PID 1752 wrote to memory of 1548	1752	tmp7112335.exe	40
PID 2040 wrote to memory of 2044	2040	notpad.exe	45
PID 2040 wrote to memory of 2044	2040	notpad.exe	45
PID 2040 wrote to memory of 2044	2040	notpad.exe	45
PID 2040 wrote to memory of 2044	2040	notpad.exe	45

C:\Users\Admin\AppData\Local\Temp\41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe
"C:\Users\Admin\AppData\Local\Temp\41d4a74801522fc2d10a9eae0b147389c6e51dc929b9c29fabda46db99089a30.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\tmp7097281.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7097281.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\tmp7098326.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7098326.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\tmp7106391.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7106391.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        7⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\tmp7111773.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7111773.exe
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\tmp7115455.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7115455.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\tmp7116375.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7116375.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:556
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        12⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192020.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192020.exe
        12⤵
        
        PID:920
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        13⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192894.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192894.exe
        14⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216107.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216107.exe
        15⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        16⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217011.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217011.exe
        17⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217245.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217245.exe
        18⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217479.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217479.exe
        18⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194376.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194376.exe
        14⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195156.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195156.exe
        15⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195530.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195530.exe
        15⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192472.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192472.exe
        12⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\tmp7124191.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7124191.exe
        11⤵
        Executes dropped EXE
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\tmp7113692.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7113692.exe
        10⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\tmp7112335.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7112335.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\tmp7128153.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7128153.exe
        8⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\tmp7128450.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7128450.exe
        8⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        7⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\tmp7125844.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7125844.exe
        8⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        9⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\tmp7126624.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7126624.exe
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\tmp7127295.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7127295.exe
        9⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\tmp7127872.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7127872.exe
        9⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\tmp7124940.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7124940.exe
        10⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\tmp7110962.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7110962.exe
        6⤵
        Executes dropped EXE
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\tmp7127592.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7127592.exe
        5⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\tmp7155812.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155812.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\tmp7156124.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7156124.exe
        6⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\tmp7127046.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7127046.exe
        5⤵
        
        PID:1160
  - - C:\Users\Admin\AppData\Local\Temp\tmp7098716.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7098716.exe
      4⤵
      Executes dropped EXE
      PID:536
- C:\Users\Admin\AppData\Local\Temp\tmp7097608.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7097608.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 36
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:812

C:\Users\Admin\AppData\Local\Temp\tmp7112818.exe
C:\Users\Admin\AppData\Local\Temp\tmp7112818.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:304
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:568
- - C:\Users\Admin\AppData\Local\Temp\tmp7115642.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7115642.exe
    3⤵
    PID:344
  - - C:\Windows\SysWOW64\notpad.exe
      "C:\Windows\system32\notpad.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\tmp7118263.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7118263.exe
        5⤵
        
        PID:588
      - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:456
    - - C:\Users\Admin\AppData\Local\Temp\tmp7124503.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7124503.exe
        5⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\tmp7125064.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7125064.exe
        6⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        7⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157903.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157903.exe
        8⤵
        
        PID:108
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        9⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158012.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158012.exe
        8⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158714.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158714.exe
        9⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158230.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158230.exe
        9⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194812.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194812.exe
        10⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        11⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196232.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196232.exe
        12⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196575.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196575.exe
        13⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        14⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\tmp7213158.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7213158.exe
        15⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214827.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214827.exe
        15⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215249.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215249.exe
        16⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215592.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215592.exe
        16⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\tmp7211988.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7211988.exe
        13⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195546.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195546.exe
        10⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195811.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195811.exe
        11⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195858.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195858.exe
        11⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194953.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194953.exe
        9⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194890.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194890.exe
        9⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215997.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215997.exe
        10⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        11⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217604.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217604.exe
        12⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217979.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217979.exe
        13⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217698.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217698.exe
        13⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216497.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216497.exe
        12⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216216.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216216.exe
        10⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\tmp7125486.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7125486.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1984
- - C:\Users\Admin\AppData\Local\Temp\tmp7116313.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7116313.exe
    3⤵
    - Executes dropped EXE
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\tmp7124643.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7124643.exe
      4⤵
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\tmp7124175.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7124175.exe
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\notpad.exe
      "C:\Windows\system32\notpad.exe"
      4⤵
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\tmp7192238.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192238.exe
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\tmp7192675.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192675.exe
        5⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\tmp7192940.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192940.exe
        6⤵
        
        PID:108
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        7⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194906.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194906.exe
        8⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195343.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195343.exe
        9⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194984.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194984.exe
        9⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194547.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194547.exe
        8⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        9⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195592.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195592.exe
        10⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195670.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7195670.exe
        10⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196201.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196201.exe
        11⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196372.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7196372.exe
        11⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\tmp7194048.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194048.exe
        6⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215467.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215467.exe
        7⤵
        
        PID:580
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        8⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216684.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7216684.exe
        9⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217916.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217916.exe
        10⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217776.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217776.exe
        10⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        11⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235950.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235950.exe
        12⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\tmp7237057.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7237057.exe
        13⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\tmp7238071.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7238071.exe
        13⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235341.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235341.exe
        12⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235170.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235170.exe
        10⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234827.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234827.exe
        10⤵
        
        PID:1516
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:1012

C:\Users\Admin\AppData\Local\Temp\tmp7113941.exe
C:\Users\Admin\AppData\Local\Temp\tmp7113941.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Users\Admin\AppData\Local\Temp\tmp7124674.exe
C:\Users\Admin\AppData\Local\Temp\tmp7124674.exe
1⤵
PID:1700
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\tmp7125189.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7125189.exe
    3⤵
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\tmp7129042.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7129042.exe
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\tmp7128684.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7128684.exe
      4⤵
      PID:1796
- - C:\Users\Admin\AppData\Local\Temp\tmp7125735.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7125735.exe
    3⤵
    PID:1756

C:\Windows\SysWOW64\notpad.exe
"C:\Windows\system32\notpad.exe"
1⤵
PID:1844
- C:\Users\Admin\AppData\Local\Temp\tmp7125376.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7125376.exe
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\tmp7124924.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7124924.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1804

C:\Users\Admin\AppData\Local\Temp\tmp7125517.exe
C:\Users\Admin\AppData\Local\Temp\tmp7125517.exe
1⤵
PID:320
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:2008

C:\Users\Admin\AppData\Local\Temp\tmp7125860.exe
C:\Users\Admin\AppData\Local\Temp\tmp7125860.exe
1⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\tmp7126406.exe
C:\Users\Admin\AppData\Local\Temp\tmp7126406.exe
1⤵
PID:1564

C:\Windows\SysWOW64\notpad.exe
"C:\Windows\system32\notpad.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:344
- C:\Users\Admin\AppData\Local\Temp\tmp7126749.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7126749.exe
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\tmp7215545.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7215545.exe
      4⤵
      PID:1544
- C:\Users\Admin\AppData\Local\Temp\tmp7127420.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7127420.exe
  2⤵
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\tmp7128808.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7128808.exe
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\tmp7128559.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7128559.exe
    3⤵
    PID:1328

C:\Users\Admin\AppData\Local\Temp\tmp7126375.exe
C:\Users\Admin\AppData\Local\Temp\tmp7126375.exe
1⤵
PID:1824

C:\Users\Admin\AppData\Local\Temp\tmp7126234.exe
C:\Users\Admin\AppData\Local\Temp\tmp7126234.exe
1⤵
PID:276

C:\Users\Admin\AppData\Local\Temp\tmp7126921.exe
C:\Users\Admin\AppData\Local\Temp\tmp7126921.exe
1⤵
PID:912
- C:\Users\Admin\AppData\Local\Temp\tmp7127670.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7127670.exe
  2⤵
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\tmp7127342.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7127342.exe
  2⤵
  PID:588

C:\Users\Admin\AppData\Local\Temp\tmp7128434.exe
C:\Users\Admin\AppData\Local\Temp\tmp7128434.exe
1⤵
PID:1180

C:\Windows\SysWOW64\notpad.exe
"C:\Windows\system32\notpad.exe"
1⤵
PID:1692
- C:\Users\Admin\AppData\Local\Temp\tmp7129386.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7129386.exe
  2⤵
  PID:848
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\tmp7154018.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7154018.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1492
    - - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        5⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\tmp7155360.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155360.exe
        6⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155547.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155547.exe
        7⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155656.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155656.exe
        7⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\tmp7155282.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155282.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214890.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214890.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214765.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214765.exe
        7⤵
        
        PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\tmp7154751.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7154751.exe
      4⤵
      PID:1168
- C:\Users\Admin\AppData\Local\Temp\tmp7153691.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7153691.exe
  2⤵
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\tmp7155344.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7155344.exe
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\tmp7154549.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7154549.exe
    3⤵
    - Loads dropped DLL
    PID:304

C:\Users\Admin\AppData\Local\Temp\tmp7128871.exe
C:\Users\Admin\AppData\Local\Temp\tmp7128871.exe
1⤵
PID:684
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\tmp7150399.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7150399.exe
    3⤵
    PID:544
  - - C:\Windows\SysWOW64\notpad.exe
      "C:\Windows\system32\notpad.exe"
      4⤵
      Executes dropped EXE
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\tmp7154642.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7154642.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\tmp7155110.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7155110.exe
        5⤵
        
        PID:672
- - C:\Users\Admin\AppData\Local\Temp\tmp7154299.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7154299.exe
    3⤵
    - Executes dropped EXE
    PID:588
  - - C:\Users\Admin\AppData\Local\Temp\tmp7155625.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7155625.exe
      4⤵
      PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\tmp7154954.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7154954.exe
      4⤵
      PID:456

C:\Users\Admin\AppData\Local\Temp\tmp7129573.exe
C:\Users\Admin\AppData\Local\Temp\tmp7129573.exe
1⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\tmp7128964.exe
C:\Users\Admin\AppData\Local\Temp\tmp7128964.exe
1⤵
PID:1756
- C:\Users\Admin\AppData\Local\Temp\tmp7126936.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7126936.exe
  2⤵
  PID:1632

C:\Windows\SysWOW64\notpad.exe
"C:\Windows\system32\notpad.exe"
1⤵
PID:1716
- C:\Users\Admin\AppData\Local\Temp\tmp7129744.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7129744.exe
  2⤵
  PID:1664
- - C:\Users\Admin\AppData\Local\Temp\tmp7154096.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7154096.exe
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\tmp7154783.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7154783.exe
    3⤵
    PID:1488

C:\Users\Admin\AppData\Local\Temp\tmp7128699.exe
C:\Users\Admin\AppData\Local\Temp\tmp7128699.exe
1⤵
PID:1584

C:\Users\Admin\AppData\Local\Temp\tmp7128481.exe
C:\Users\Admin\AppData\Local\Temp\tmp7128481.exe
1⤵
PID:2020

C:\Users\Admin\AppData\Local\Temp\tmp7127732.exe
C:\Users\Admin\AppData\Local\Temp\tmp7127732.exe
1⤵
PID:1012
- C:\Users\Admin\AppData\Local\Temp\tmp7155765.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7155765.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:568
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\tmp7191739.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7191739.exe
      4⤵
      PID:1952
- C:\Users\Admin\AppData\Local\Temp\tmp7156109.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7156109.exe
  2⤵
  PID:808

C:\Users\Admin\AppData\Local\Temp\tmp7126156.exe
C:\Users\Admin\AppData\Local\Temp\tmp7126156.exe
1⤵
PID:1380
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\tmp7218259.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7218259.exe
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\tmp7218525.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7218525.exe
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\tmp7236948.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7236948.exe
      4⤵
      PID:804
    - - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\tmp7240037.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7240037.exe
        6⤵
        
        PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\tmp7237775.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7237775.exe
      4⤵
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\tmp7246059.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7246059.exe
        5⤵
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\tmp7247120.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7247120.exe
        5⤵
        
        PID:1700

C:\Users\Admin\AppData\Local\Temp\tmp7155937.exe
C:\Users\Admin\AppData\Local\Temp\tmp7155937.exe
1⤵
PID:564

C:\Users\Admin\AppData\Local\Temp\tmp7156015.exe
C:\Users\Admin\AppData\Local\Temp\tmp7156015.exe
1⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\tmp7156280.exe
C:\Users\Admin\AppData\Local\Temp\tmp7156280.exe
1⤵
PID:1516
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\tmp7156670.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7156670.exe
    3⤵
    PID:1564
  - - C:\Windows\SysWOW64\notpad.exe
      "C:\Windows\system32\notpad.exe"
      4⤵
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\tmp7157076.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157076.exe
        5⤵
        
        PID:1200
      - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        6⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157700.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157700.exe
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158090.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158090.exe
        7⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158449.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158449.exe
        8⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158355.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7158355.exe
        8⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\tmp7157341.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157341.exe
        5⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\tmp7157622.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157622.exe
        6⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\tmp7157559.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7157559.exe
        6⤵
        
        PID:1488
- - C:\Users\Admin\AppData\Local\Temp\tmp7156795.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7156795.exe
    3⤵
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\tmp7157123.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7157123.exe
      4⤵
      PID:920
  - - C:\Users\Admin\AppData\Local\Temp\tmp7157403.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7157403.exe
      4⤵
      PID:1744

C:\Users\Admin\AppData\Local\Temp\tmp7156405.exe
C:\Users\Admin\AppData\Local\Temp\tmp7156405.exe
1⤵
PID:436

C:\Users\Admin\AppData\Local\Temp\tmp7156514.exe
C:\Users\Admin\AppData\Local\Temp\tmp7156514.exe
1⤵
PID:1020
- C:\Users\Admin\AppData\Local\Temp\tmp7156701.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7156701.exe
  2⤵
  PID:1920
- C:\Users\Admin\AppData\Local\Temp\tmp7156998.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7156998.exe
  2⤵
  PID:848

C:\Users\Admin\AppData\Local\Temp\tmp7156421.exe
C:\Users\Admin\AppData\Local\Temp\tmp7156421.exe
1⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\tmp7158355.exe
C:\Users\Admin\AppData\Local\Temp\tmp7158355.exe
1⤵
PID:2024
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:984
- - C:\Users\Admin\AppData\Local\Temp\tmp7158839.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7158839.exe
    3⤵
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\tmp7216949.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7216949.exe
      4⤵
      PID:1236
    - - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        5⤵
        
        PID:1516
- - C:\Users\Admin\AppData\Local\Temp\tmp7159244.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7159244.exe
    3⤵
    PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\tmp7191973.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7191973.exe
      4⤵
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\tmp7191318.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7191318.exe
      4⤵
      PID:2000

C:\Users\Admin\AppData\Local\Temp\tmp7158464.exe
C:\Users\Admin\AppData\Local\Temp\tmp7158464.exe
1⤵
PID:1588
- C:\Users\Admin\AppData\Local\Temp\tmp7159104.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7159104.exe
  2⤵
  PID:1480
- - C:\Windows\SysWOW64\notpad.exe
    "C:\Windows\system32\notpad.exe"
    3⤵
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\tmp7186856.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7186856.exe
      4⤵
      PID:1728
    - - C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\tmp7191146.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7191146.exe
        6⤵
        
        PID:276
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        7⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\tmp7191817.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7191817.exe
        8⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192519.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7192519.exe
        9⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        10⤵
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\tmp7193549.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7193549.exe
        11⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        12⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194532.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7194532.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\tmp7193315.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7193315.exe
        9⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219149.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219149.exe
        9⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219102.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219102.exe
        9⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        10⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219461.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219461.exe
        11⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        12⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220194.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220194.exe
        13⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        14⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220553.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220553.exe
        15⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\tmp7232611.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7232611.exe
        15⤵
        
        PID:592
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233937.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233937.exe
        16⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233579.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233579.exe
        16⤵
        
        PID:524
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        17⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235107.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235107.exe
        18⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\tmp7236371.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7236371.exe
        19⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\tmp7238149.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7238149.exe
        19⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234359.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234359.exe
        18⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220256.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220256.exe
        13⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220459.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220459.exe
        14⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        15⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\tmp7232783.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7232783.exe
        16⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        17⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233891.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233891.exe
        18⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        19⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234624.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234624.exe
        20⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234811.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234811.exe
        20⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234873.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234873.exe
        21⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235981.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7235981.exe
        21⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234343.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234343.exe
        18⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233610.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7233610.exe
        16⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234733.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234733.exe
        17⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234078.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7234078.exe
        17⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\tmp7230630.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7230630.exe
        14⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219663.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219663.exe
        11⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219788.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219788.exe
        12⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219975.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219975.exe
        12⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\tmp7191334.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7191334.exe
        6⤵
        Loads dropped DLL
        
        PID:556
  - - C:\Users\Admin\AppData\Local\Temp\tmp7190866.exe
      C:\Users\Admin\AppData\Local\Temp\tmp7190866.exe
      4⤵
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\tmp7191614.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7191614.exe
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\tmp7217963.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217963.exe
        6⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\tmp7218431.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7218431.exe
        7⤵
        
        PID:556
        
        C:\Windows\SysWOW64\notpad.exe
        
        "C:\Windows\system32\notpad.exe"
        8⤵
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\tmp7218837.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7218837.exe
        9⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219133.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219133.exe
        9⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220085.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7220085.exe
        10⤵
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219632.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7219632.exe
        10⤵
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\tmp7218478.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7218478.exe
        7⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\tmp7217760.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7217760.exe
        6⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\tmp7191256.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7191256.exe
        5⤵
        Loads dropped DLL
        
        PID:1212
- C:\Users\Admin\AppData\Local\Temp\tmp7159275.exe
  C:\Users\Admin\AppData\Local\Temp\tmp7159275.exe
  2⤵
  PID:672

C:\Users\Admin\AppData\Local\Temp\tmp7196060.exe
C:\Users\Admin\AppData\Local\Temp\tmp7196060.exe
1⤵
PID:568
- C:\Windows\SysWOW64\notpad.exe
  "C:\Windows\system32\notpad.exe"
  2⤵
  PID:536
- - C:\Users\Admin\AppData\Local\Temp\tmp7196622.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7196622.exe
    3⤵
    PID:1916
  - - C:\Windows\SysWOW64\notpad.exe
      "C:\Windows\system32\notpad.exe"
      4⤵
      PID:960
    - - C:\Users\Admin\AppData\Local\Temp\tmp7214437.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214437.exe
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\tmp7214968.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7214968.exe
        5⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\tmp7215514.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215514.exe
        6⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\tmp7215763.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmp7215763.exe
        6⤵
        
        PID:1844
- - C:\Users\Admin\AppData\Local\Temp\tmp7213127.exe
    C:\Users\Admin\AppData\Local\Temp\tmp7213127.exe
    3⤵
    - Loads dropped DLL
    PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7097281.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7097281.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7097608.exe

Filesize
136KB

MD5
450d747d35aabf49398845ace2fe644a

SHA1
34a1391547db151b4dcd75a71ad53194e39ab2f6

SHA256
94e8eaf4ef52206126542129d22858b350bc76e7a4c35c0f240339e2faf29027

SHA512
f21739a83964986ef128726693b848475dc4d5a8b6b064034435832363c0e7f1540a15a7e5e28e389ac4fe433071b869b1ad4217a5ab34862dd09ca9e2b7c477

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7098326.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7098326.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7098716.exe

Filesize
175KB

MD5
d378bffb70923139d6a4f546864aa61c

SHA1
f00aa51c2ed8b2f656318fdc01ee1cf5441011a4

SHA256
c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102

SHA512
7c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7106391.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7106391.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7110962.exe

Filesize
175KB

MD5
d378bffb70923139d6a4f546864aa61c

SHA1
f00aa51c2ed8b2f656318fdc01ee1cf5441011a4

SHA256
c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102

SHA512
7c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7111773.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7111773.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7112335.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7112335.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7112818.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7112818.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7113692.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7113941.exe

Filesize
175KB

MD5
d378bffb70923139d6a4f546864aa61c

SHA1
f00aa51c2ed8b2f656318fdc01ee1cf5441011a4

SHA256
c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102

SHA512
7c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663

Download Submit
C:\Windows\SysWOW64\fsb.tmp

Filesize
5.7MB

MD5
0d3e158dbcf2a307b360ed162a9b5e73

SHA1
f91698f94263af578d5869c5e632075b70136270

SHA256
4b63a7d690ace7176b16c10476611d9716162efec4f12942b82732c2ef6d8e6a

SHA512
210fe8ec1157af01462888455616624f631e55ce6b5708b1e152323f7bbce7ef30b9d97bed6f3ce0833ace2ac5b98c2270ab871271a81c6bcd364da742f8a1f9

Download Submit
C:\Windows\SysWOW64\fsb.tmp

Filesize
3.3MB

MD5
724577af09b66a664fce489eaef251a6

SHA1
58627b848ae7216359799c21d636857d6a68eeed

SHA256
45728f16c11f4f510ff9fe7c835fce2f6a164b266fa3139aacc2f0994f594047

SHA512
eb991506f00a945fdad37f057e2781ca283a06428d1582a05b21f36d5dfdf23b4c8816d7e441b61df8d1d59b06d58f8de4e47d1245a56a3dcd1f2bd4fd3932d3

Download Submit
C:\Windows\SysWOW64\fsb.tmp

Filesize
1.9MB

MD5
673713c32028b7eec7b1d222a7fd2999

SHA1
1f554631625c437a1c13f3e3d41fe1947e601318

SHA256
da9707cf8efdcfdabb364e4b6762cf24a8c8970dbfc95f1a1652b8c42e5e1f74

SHA512
8cc031b1943b91c66e64f88bcc3d8dd7fa8283ab5cae1a6deebedaa1dc8ade84846583d4af08cac20dee5eb61b2b4e219b662d0d7b097db78f25c4a23a464fe6

Download Submit
C:\Windows\SysWOW64\fsb.tmp

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
C:\Windows\SysWOW64\notpad.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
C:\Windows\SysWOW64\notpad.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
C:\Windows\SysWOW64\notpad.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
C:\Windows\SysWOW64\notpad.exe

Filesize
10.4MB

MD5
cf9ec44d3bee285478493ee46b665cc7

SHA1
eb8af3bbe3ea70c87494818c23c494685bc696b0

SHA256
24e7e3604fb85a9dc77d275258830b8618f2e0f565bff757e09c7bdb546fb22b

SHA512
296abac4e0fc0020785990976e9e9f3c18eff094efb7a52d6b1f66753efe47b19ac230c888f594ed8243855e58537d4016d25acdd6eecebf98d8adde49c5e7d1

Download Submit
C:\Windows\SysWOW64\notpad.exe

Filesize
10.1MB

MD5
1e154ff3247264ff2e6ca2aa83ac2d6a

SHA1
b110e507f0033ccf0be166fdc2f55c561f0b6604

SHA256
d615ff58e67a0b5677ebcea48569dc430f8e1fda2547308f0bb591f7615ada37

SHA512
6ee23c0199a72c5bf4968c06546d62bdaeaf06cffc81bdfbd51093add239fb76375dca1d823229c0c239040dca29298c48ca971b3ba8910480073b9cc12113a5

Download Submit
C:\Windows\SysWOW64\notpad.exe

Filesize
10.2MB

MD5
874e4b36bb81ecfe61ca57e92aca161c

SHA1
39bb2756c1a0706938496503040cc3a519486d0e

SHA256
820f3545313ec1a824a31d3d6fe6be92fec63be5dd40e1838d0ed6336d663751

SHA512
af59da22e810f2ebb7aebbc834140725670023f51604de36cf079455a3dca39bd29b1e00448556720ea6dbd355572c73ab7fa062863ba9edc1da0c77e06f2e13

Download Submit
C:\Windows\SysWOW64\notpad.exe

Filesize
9.1MB

MD5
d99665673145cf7d9de7e2824ebcd403

SHA1
e1d83bc7035b4e44742be4da26fd2bbeb93b5926

SHA256
7d406b56fd39c3bcae10dba33f2bb86b08bf4534d78ff94bf91c6d93bfd40d6b

SHA512
7eb495f694e23bcd3072f6d905234b0a785f8b79dc027e758c353ea6f19970061eb5d7a4e3868433dc1a2249a9f625349522a443b78b55c5c52e89e732613f03

Download Submit
C:\fsb.stb

Filesize
10KB

MD5
280b12e4717c3a7cf2c39561b30bc9e6

SHA1
8bf777a28c25793357ce8305bf8b01987bc4d9f2

SHA256
f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc

SHA512
861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7

Download Submit
C:\fsb.stb

Filesize
10KB

MD5
280b12e4717c3a7cf2c39561b30bc9e6

SHA1
8bf777a28c25793357ce8305bf8b01987bc4d9f2

SHA256
f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc

SHA512
861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7

Download Submit
C:\fsb.stb

Filesize
10KB

MD5
280b12e4717c3a7cf2c39561b30bc9e6

SHA1
8bf777a28c25793357ce8305bf8b01987bc4d9f2

SHA256
f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc

SHA512
861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7

Download Submit
C:\fsb.stb

Filesize
10KB

MD5
280b12e4717c3a7cf2c39561b30bc9e6

SHA1
8bf777a28c25793357ce8305bf8b01987bc4d9f2

SHA256
f6ab4ba25b6075aa5a76d006c434e64cad37fdb2ff242c848c98fad5167a1bfc

SHA512
861560b01b9b02fcb80c4e233617d72684c7669e1bce3a234b0fafce733735619e6532fb065ed2d1a4c1249635dca7c75561daaaf92460fad3b8771bb20883b7

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7097281.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7097281.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7097608.exe

Filesize
136KB

MD5
450d747d35aabf49398845ace2fe644a

SHA1
34a1391547db151b4dcd75a71ad53194e39ab2f6

SHA256
94e8eaf4ef52206126542129d22858b350bc76e7a4c35c0f240339e2faf29027

SHA512
f21739a83964986ef128726693b848475dc4d5a8b6b064034435832363c0e7f1540a15a7e5e28e389ac4fe433071b869b1ad4217a5ab34862dd09ca9e2b7c477

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7097608.exe

Filesize
136KB

MD5
450d747d35aabf49398845ace2fe644a

SHA1
34a1391547db151b4dcd75a71ad53194e39ab2f6

SHA256
94e8eaf4ef52206126542129d22858b350bc76e7a4c35c0f240339e2faf29027

SHA512
f21739a83964986ef128726693b848475dc4d5a8b6b064034435832363c0e7f1540a15a7e5e28e389ac4fe433071b869b1ad4217a5ab34862dd09ca9e2b7c477

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7097608.exe

Filesize
136KB

MD5
450d747d35aabf49398845ace2fe644a

SHA1
34a1391547db151b4dcd75a71ad53194e39ab2f6

SHA256
94e8eaf4ef52206126542129d22858b350bc76e7a4c35c0f240339e2faf29027

SHA512
f21739a83964986ef128726693b848475dc4d5a8b6b064034435832363c0e7f1540a15a7e5e28e389ac4fe433071b869b1ad4217a5ab34862dd09ca9e2b7c477

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7097608.exe

Filesize
136KB

MD5
450d747d35aabf49398845ace2fe644a

SHA1
34a1391547db151b4dcd75a71ad53194e39ab2f6

SHA256
94e8eaf4ef52206126542129d22858b350bc76e7a4c35c0f240339e2faf29027

SHA512
f21739a83964986ef128726693b848475dc4d5a8b6b064034435832363c0e7f1540a15a7e5e28e389ac4fe433071b869b1ad4217a5ab34862dd09ca9e2b7c477

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7097608.exe

Filesize
136KB

MD5
450d747d35aabf49398845ace2fe644a

SHA1
34a1391547db151b4dcd75a71ad53194e39ab2f6

SHA256
94e8eaf4ef52206126542129d22858b350bc76e7a4c35c0f240339e2faf29027

SHA512
f21739a83964986ef128726693b848475dc4d5a8b6b064034435832363c0e7f1540a15a7e5e28e389ac4fe433071b869b1ad4217a5ab34862dd09ca9e2b7c477

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7098326.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7098326.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7098716.exe

Filesize
175KB

MD5
d378bffb70923139d6a4f546864aa61c

SHA1
f00aa51c2ed8b2f656318fdc01ee1cf5441011a4

SHA256
c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102

SHA512
7c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7106391.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7106391.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7110962.exe

Filesize
175KB

MD5
d378bffb70923139d6a4f546864aa61c

SHA1
f00aa51c2ed8b2f656318fdc01ee1cf5441011a4

SHA256
c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102

SHA512
7c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7111773.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7111773.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7112335.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7112335.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7112818.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7112818.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7113692.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7113692.exe

Filesize
7.3MB

MD5
1cf54a1b82d683488bad63fa8fe60e66

SHA1
8bb77a061166c7f0a8e3845ccfb76e7e38fd0bd1

SHA256
773d6e922521655f90ea7b9c6e942c63291a2c38d8d5b05da441d996c78742ce

SHA512
83053181114dc6d9689fd575ff7e421fe34cafc843e79d10c7abbd369af62912c5fccdaaadafd1cb6cc6c26f094366572a720e95e6e3b4a416fe35b4ff4b86ba

Download Submit
\Users\Admin\AppData\Local\Temp\tmp7113941.exe

Filesize
175KB

MD5
d378bffb70923139d6a4f546864aa61c

SHA1
f00aa51c2ed8b2f656318fdc01ee1cf5441011a4

SHA256
c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102

SHA512
7c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
7.4MB

MD5
c5585093343a25cb59cedbe4310d7d04

SHA1
fe7c6c783f957be51c26dab69762197c69dd52ab

SHA256
61ec6f9b29ca0ba4ecc0805f3a25fceaf9e4f1f1bf962632fd0495f1ea396324

SHA512
b0e883455293f07ee5de058d623dab227ebb14184315a5f88dab3f4c5de0f817e082863c3ab3e45b11903a865c9fcaf1ae82ffe68d704ece42726fe897854fb7

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
9.7MB

MD5
98d2531c74e405ae5e6c96525b1e03e7

SHA1
1e934b948c16a93e7e5184c74809495b6191d091

SHA256
798d1e0ceb79b99d26b9bf9474644d3e1aedab40dba9b12c29429266c388918b

SHA512
a5050bc0887eb9f82b3f8e09dd07d73130732488e8a1f56da808d69fd6ddcb58f42077df85f0c1d1bcfc84fe48676467d2979912af182fd6dcc393ef562f75fd

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
11.0MB

MD5
358a5780a5177079c90f669983214db9

SHA1
fff53c9ed3aa59d3396dd3e903386354f7243e35

SHA256
857b057510dda1a9ee8b42e2512ee9fcd6650d43a039346f488a2d16934366fe

SHA512
0a7a82176759ef141ff35026743eee21c2e842ad65149a131d521c2bda4fd691663d3418fa40827f6609f3fd4ce91d0aa5fd8ab801f9f0c0395455466b10180f

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
10.4MB

MD5
483857206f230d2a66ab2b24532dd3d9

SHA1
572241840377744e6a5b07217ce2e391b811cc3a

SHA256
a221b50229f01e4d486239a32b8c354f9f5881e4e1881c8641649f322a9fa431

SHA512
34092f7a34ae62ab05cac9d55e7d84bc1e68c7fb24b5b1bc3195de9b9051f30194130b53842afb710284f55bc044eca6cbc9b9a2450cc3112e3feefd91de1082

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
9.6MB

MD5
6dc30e63559e9830b562f4de38affb87

SHA1
0392aa097b65ac3a19e602cf30b1783cdc70b348

SHA256
1d1d6505a447aa7989380ed597f89155bcf61a76059e687456d00f26f55d2bde

SHA512
1a449ef64fbe939c013af467fc00baf2b711afa95925e6d7fb486cc53452815b504bbc4c53fe98f4aa267e88328d1656997af7978b21772b6c6fbcbad7cfaaeb

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
9.1MB

MD5
d99665673145cf7d9de7e2824ebcd403

SHA1
e1d83bc7035b4e44742be4da26fd2bbeb93b5926

SHA256
7d406b56fd39c3bcae10dba33f2bb86b08bf4534d78ff94bf91c6d93bfd40d6b

SHA512
7eb495f694e23bcd3072f6d905234b0a785f8b79dc027e758c353ea6f19970061eb5d7a4e3868433dc1a2249a9f625349522a443b78b55c5c52e89e732613f03

Download Submit
\Windows\SysWOW64\notpad.exe

Filesize
9.3MB

MD5
cbe21c32fb7426ffb64e91cdc89ed588

SHA1
0188ecab92671f3ba4e3cdf108f3067bf2f62c19

SHA256
9d166a75f96fc4c80f012db10d6f8abd2413fd56e6b7bcaca669b971608c3479

SHA512
72c9dbbed0c636b0ade11c0bb1577d35a1498435112e854325971055c5000c408523ab85b1270ee17427fa61a00b2917403abc586be3684e14ebeedaacbb2d02

Download Submit
memory/344-258-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/344-250-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/456-134-0x0000000000220000-0x000000000023F000-memory.dmp

Filesize
124KB

Download
memory/456-135-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/456-111-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/456-261-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/456-131-0x0000000000220000-0x000000000023F000-memory.dmp

Filesize
124KB

Download
memory/536-243-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/568-167-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/568-157-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/580-295-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/588-300-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/588-248-0x0000000000620000-0x000000000063F000-memory.dmp

Filesize
124KB

Download
memory/588-276-0x0000000000620000-0x000000000063F000-memory.dmp

Filesize
124KB

Download
memory/668-170-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/668-162-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/840-62-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/912-244-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/916-63-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1036-254-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1036-249-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1096-228-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1096-208-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1168-264-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1200-91-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1200-101-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1212-85-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1212-174-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1212-180-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1492-192-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1572-202-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1592-164-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1592-185-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1644-267-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1656-206-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1664-281-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1664-288-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1692-273-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1692-284-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1696-194-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1716-274-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1716-280-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1752-151-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1752-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1756-207-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1756-226-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1816-259-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1816-246-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1824-287-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1824-278-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1844-205-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1904-294-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1932-277-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1932-275-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1948-282-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1948-298-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1980-68-0x0000000000010000-0x0000000000032000-memory.dmp

Filesize
136KB

Download
memory/1984-129-0x00000000021A0000-0x00000000021AD000-memory.dmp

Filesize
52KB

Download
memory/1996-302-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2008-230-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2020-269-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2024-209-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2024-215-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2040-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2040-160-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download