Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 21:22
Behavioral task
behavioral1
Sample
31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe
Resource
win10v2004-20220901-en
General
-
Target
31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe
-
Size
3.2MB
-
MD5
ffa55e199fd9037e07d6d3eb3181db6c
-
SHA1
6c9b3cc94cd2a9bc6a7778845b1c71bec7d002e3
-
SHA256
31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24
-
SHA512
6213532c8da6abc861b05c32c6e9f613985076cd8df3b2763a2599ec5f514431f0559b69fb585b0b2f10e402b391358ce08557d4be6d4322b256d32928708003
-
SSDEEP
24576:cDyTFtjEDyTFtjTDyTFtjBDyTFtjJDyTFtjcDyTFtjEDyTFtjTDyTFtjBDyTFtj:1txtItqtCt5txtItqt
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1620 tmp7108232.exe 1868 tmp7109152.exe 1448 notpad.exe 1092 tmp7113817.exe 832 tmp7114363.exe 904 notpad.exe 2040 tmp7115080.exe 1052 notpad.exe 1696 tmp7115658.exe 1524 tmp7134222.exe 1976 tmp7116438.exe 2000 notpad.exe 1608 tmp7118060.exe 972 tmp7119230.exe 1600 notpad.exe 736 tmp7119667.exe 920 tmp7120119.exe 364 notpad.exe 908 tmp7120494.exe 1952 notpad.exe 1588 tmp7121180.exe 944 tmp7132287.exe 1960 tmp7122350.exe 1364 notpad.exe 1776 tmp7123442.exe 832 tmp7124830.exe 1780 notpad.exe 1204 tmp7125236.exe 2036 tmp7134658.exe 1232 tmp7133691.exe 1380 tmp7125985.exe 1968 notpad.exe 1972 tmp7126718.exe 1920 tmp7126983.exe 1064 tmp7134799.exe 1400 tmp7127498.exe 1572 tmp7127701.exe 1980 tmp7128403.exe 580 notpad.exe 1504 tmp7128637.exe 1924 tmp7129417.exe 1068 notpad.exe 1860 tmp7129666.exe 2020 tmp7129900.exe 820 notpad.exe 1752 tmp7130431.exe 1612 notpad.exe 1288 tmp7131117.exe 1688 notpad.exe 1460 tmp7130758.exe 944 tmp7132287.exe 1176 tmp7132038.exe 1720 notpad.exe 1932 tmp7133442.exe 1772 tmp7132428.exe 1116 tmp7133894.exe 836 tmp7133566.exe 1928 notpad.exe 1668 tmp7134112.exe 1232 tmp7133691.exe 1604 tmp7133847.exe 1640 notpad.exe 2036 tmp7134658.exe 2008 tmp7134284.exe -
resource yara_rule behavioral1/memory/1612-54-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1612-64-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0007000000014112-74.dat upx behavioral1/files/0x0007000000014112-73.dat upx behavioral1/files/0x0007000000014112-71.dat upx behavioral1/files/0x0007000000014112-70.dat upx behavioral1/memory/1448-75-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0009000000013922-81.dat upx behavioral1/memory/1448-87-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0007000000014112-92.dat upx behavioral1/files/0x0007000000014112-90.dat upx behavioral1/files/0x0007000000014112-89.dat upx behavioral1/files/0x0009000000013922-99.dat upx behavioral1/memory/904-98-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/904-110-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0007000000014112-107.dat upx behavioral1/memory/1052-120-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0007000000014112-105.dat upx behavioral1/files/0x0007000000014112-104.dat upx behavioral1/files/0x0009000000013922-122.dat upx behavioral1/files/0x0007000000014112-125.dat upx behavioral1/files/0x0007000000014112-126.dat upx behavioral1/files/0x0007000000014112-128.dat upx behavioral1/memory/2000-141-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0007000000014112-144.dat upx behavioral1/files/0x0007000000014112-143.dat upx behavioral1/files/0x0007000000014112-146.dat upx behavioral1/files/0x0009000000013922-138.dat upx behavioral1/files/0x0009000000013922-152.dat upx behavioral1/memory/1600-156-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/364-161-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/364-164-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1952-168-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1364-173-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1364-176-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1780-183-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2036-185-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2036-190-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1968-196-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1064-199-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1064-202-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/580-209-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1068-214-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1612-221-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/820-220-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/820-226-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1612-230-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1688-237-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1932-240-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1460-239-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1176-238-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1720-235-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1460-243-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1176-252-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1720-259-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1932-258-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1120-262-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1640-264-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2008-263-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1928-266-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1928-268-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2008-270-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1640-271-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1120-272-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Loads dropped DLL 64 IoCs
pid Process 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 1944 WerFault.exe 1944 WerFault.exe 1620 tmp7108232.exe 1620 tmp7108232.exe 1448 notpad.exe 1448 notpad.exe 1448 notpad.exe 1092 tmp7113817.exe 1092 tmp7113817.exe 904 notpad.exe 904 notpad.exe 904 notpad.exe 2040 tmp7115080.exe 2040 tmp7115080.exe 1052 notpad.exe 1052 notpad.exe 1052 notpad.exe 1524 tmp7134222.exe 1524 tmp7134222.exe 1944 WerFault.exe 2000 notpad.exe 2000 notpad.exe 2000 notpad.exe 1608 tmp7118060.exe 1608 tmp7118060.exe 1600 notpad.exe 1600 notpad.exe 1600 notpad.exe 736 tmp7119667.exe 736 tmp7119667.exe 364 notpad.exe 364 notpad.exe 364 notpad.exe 908 tmp7120494.exe 908 tmp7120494.exe 1952 notpad.exe 1952 notpad.exe 1952 notpad.exe 944 tmp7132287.exe 944 tmp7132287.exe 1364 notpad.exe 1364 notpad.exe 1364 notpad.exe 1776 tmp7123442.exe 1776 tmp7123442.exe 1780 notpad.exe 1780 notpad.exe 1204 tmp7125236.exe 1204 tmp7125236.exe 1780 notpad.exe 2036 tmp7134658.exe 2036 tmp7134658.exe 1380 tmp7125985.exe 1380 tmp7125985.exe 2036 tmp7134658.exe 1968 notpad.exe 1968 notpad.exe 1920 tmp7126983.exe 1920 tmp7126983.exe 1968 notpad.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7125236.exe File created C:\Windows\SysWOW64\notpad.exe tmp7127701.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7133566.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7144564.exe File created C:\Windows\SysWOW64\notpad.exe tmp7173425.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7113817.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7166982.exe File created C:\Windows\SysWOW64\notpad.exe tmp7140633.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7154798.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7166982.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7168635.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7135891.exe File created C:\Windows\SysWOW64\notpad.exe tmp7151241.exe File created C:\Windows\SysWOW64\notpad.exe tmp7166467.exe File created C:\Windows\SysWOW64\notpad.exe tmp7130431.exe File created C:\Windows\SysWOW64\notpad.exe tmp7147981.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7173425.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7175016.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7127701.exe File created C:\Windows\SysWOW64\notpad.exe tmp7129666.exe File created C:\Windows\SysWOW64\notpad.exe tmp7145376.exe File created C:\Windows\SysWOW64\notpad.exe tmp7152583.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7153316.exe File created C:\Windows\SysWOW64\notpad.exe tmp7145750.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7153098.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7173035.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7179337.exe File created C:\Windows\SysWOW64\notpad.exe tmp7134924.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7159151.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7175203.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7140633.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7145376.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7157091.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7160211.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7134924.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7133691.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7152630.exe File created C:\Windows\SysWOW64\notpad.exe tmp7172099.exe File created C:\Windows\SysWOW64\notpad.exe tmp7183034.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7166280.exe File created C:\Windows\SysWOW64\notpad.exe tmp7175562.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7179134.exe File created C:\Windows\SysWOW64\notpad.exe tmp7115080.exe File created C:\Windows\SysWOW64\notpad.exe tmp7118060.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7120494.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7162115.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7165781.exe File created C:\Windows\SysWOW64\notpad.exe tmp7162645.exe File created C:\Windows\SysWOW64\notpad.exe tmp7166280.exe File created C:\Windows\SysWOW64\notpad.exe tmp7184782.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7159853.exe File created C:\Windows\SysWOW64\notpad.exe tmp7162926.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7168573.exe File created C:\Windows\SysWOW64\notpad.exe tmp7132287.exe File created C:\Windows\SysWOW64\notpad.exe tmp7123442.exe File created C:\Windows\SysWOW64\notpad.exe tmp7128637.exe File created C:\Windows\SysWOW64\notpad.exe tmp7132428.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7147981.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7187168.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7140633.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7143675.exe File created C:\Windows\SysWOW64\notpad.exe tmp7160383.exe File created C:\Windows\SysWOW64\notpad.exe- tmp7170975.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp7187168.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1944 1868 WerFault.exe 27 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7123442.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7134924.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7138824.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7153519.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7169291.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7179914.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7108232.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7125236.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7131117.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7132428.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7133691.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7161647.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7118060.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7158261.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7179337.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7135891.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7142458.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7150664.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7168635.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7120494.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7125985.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7126983.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7143675.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7144564.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7165593.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7172598.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7187168.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7128637.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7147981.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7151023.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7158948.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7166280.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7179727.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7132287.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7133566.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7174501.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7175203.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7157091.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7158511.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7165999.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7166467.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7170975.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7173269.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7115080.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7134222.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7145750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7151241.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7152458.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7161896.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7166982.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7168573.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7173035.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7175016.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7181194.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7213221.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7226449.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7130431.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7162926.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7177512.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7145376.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7153316.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7159837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7162645.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp7113817.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1620 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 26 PID 1612 wrote to memory of 1620 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 26 PID 1612 wrote to memory of 1620 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 26 PID 1612 wrote to memory of 1620 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 26 PID 1612 wrote to memory of 1868 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 27 PID 1612 wrote to memory of 1868 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 27 PID 1612 wrote to memory of 1868 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 27 PID 1612 wrote to memory of 1868 1612 31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe 27 PID 1868 wrote to memory of 1944 1868 tmp7109152.exe 28 PID 1868 wrote to memory of 1944 1868 tmp7109152.exe 28 PID 1868 wrote to memory of 1944 1868 tmp7109152.exe 28 PID 1868 wrote to memory of 1944 1868 tmp7109152.exe 28 PID 1620 wrote to memory of 1448 1620 tmp7108232.exe 29 PID 1620 wrote to memory of 1448 1620 tmp7108232.exe 29 PID 1620 wrote to memory of 1448 1620 tmp7108232.exe 29 PID 1620 wrote to memory of 1448 1620 tmp7108232.exe 29 PID 1448 wrote to memory of 1092 1448 notpad.exe 30 PID 1448 wrote to memory of 1092 1448 notpad.exe 30 PID 1448 wrote to memory of 1092 1448 notpad.exe 30 PID 1448 wrote to memory of 1092 1448 notpad.exe 30 PID 1448 wrote to memory of 832 1448 notpad.exe 31 PID 1448 wrote to memory of 832 1448 notpad.exe 31 PID 1448 wrote to memory of 832 1448 notpad.exe 31 PID 1448 wrote to memory of 832 1448 notpad.exe 31 PID 1092 wrote to memory of 904 1092 tmp7113817.exe 32 PID 1092 wrote to memory of 904 1092 tmp7113817.exe 32 PID 1092 wrote to memory of 904 1092 tmp7113817.exe 32 PID 1092 wrote to memory of 904 1092 tmp7113817.exe 32 PID 904 wrote to memory of 2040 904 notpad.exe 37 PID 904 wrote to memory of 2040 904 notpad.exe 37 PID 904 wrote to memory of 2040 904 notpad.exe 37 PID 904 wrote to memory of 2040 904 notpad.exe 37 PID 904 wrote to memory of 1696 904 notpad.exe 33 PID 904 wrote to memory of 1696 904 notpad.exe 33 PID 904 wrote to memory of 1696 904 notpad.exe 33 PID 904 wrote to memory of 1696 904 notpad.exe 33 PID 2040 wrote to memory of 1052 2040 tmp7115080.exe 36 PID 2040 wrote to memory of 1052 2040 tmp7115080.exe 36 PID 2040 wrote to memory of 1052 2040 tmp7115080.exe 36 PID 2040 wrote to memory of 1052 2040 tmp7115080.exe 36 PID 1052 wrote to memory of 1524 1052 notpad.exe 90 PID 1052 wrote to memory of 1524 1052 notpad.exe 90 PID 1052 wrote to memory of 1524 1052 notpad.exe 90 PID 1052 wrote to memory of 1524 1052 notpad.exe 90 PID 1052 wrote to memory of 1976 1052 notpad.exe 35 PID 1052 wrote to memory of 1976 1052 notpad.exe 35 PID 1052 wrote to memory of 1976 1052 notpad.exe 35 PID 1052 wrote to memory of 1976 1052 notpad.exe 35 PID 1524 wrote to memory of 2000 1524 tmp7134222.exe 38 PID 1524 wrote to memory of 2000 1524 tmp7134222.exe 38 PID 1524 wrote to memory of 2000 1524 tmp7134222.exe 38 PID 1524 wrote to memory of 2000 1524 tmp7134222.exe 38 PID 2000 wrote to memory of 1608 2000 notpad.exe 41 PID 2000 wrote to memory of 1608 2000 notpad.exe 41 PID 2000 wrote to memory of 1608 2000 notpad.exe 41 PID 2000 wrote to memory of 1608 2000 notpad.exe 41 PID 2000 wrote to memory of 972 2000 notpad.exe 39 PID 2000 wrote to memory of 972 2000 notpad.exe 39 PID 2000 wrote to memory of 972 2000 notpad.exe 39 PID 2000 wrote to memory of 972 2000 notpad.exe 39 PID 1608 wrote to memory of 1600 1608 tmp7118060.exe 40 PID 1608 wrote to memory of 1600 1608 tmp7118060.exe 40 PID 1608 wrote to memory of 1600 1608 tmp7118060.exe 40 PID 1608 wrote to memory of 1600 1608 tmp7118060.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe"C:\Users\Admin\AppData\Local\Temp\31016fa552296c59009b533bd6ed74eb66a718367780c6aafa4abd5a151a4a24.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\tmp7108232.exeC:\Users\Admin\AppData\Local\Temp\tmp7108232.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\tmp7113817.exeC:\Users\Admin\AppData\Local\Temp\tmp7113817.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\tmp7115658.exeC:\Users\Admin\AppData\Local\Temp\tmp7115658.exe6⤵
- Executes dropped EXE
PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7115080.exeC:\Users\Admin\AppData\Local\Temp\tmp7115080.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2040
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7114363.exeC:\Users\Admin\AppData\Local\Temp\tmp7114363.exe4⤵
- Executes dropped EXE
PID:832
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7109152.exeC:\Users\Admin\AppData\Local\Temp\tmp7109152.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 363⤵
- Loads dropped DLL
- Program crash
PID:1944
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7115876.exeC:\Users\Admin\AppData\Local\Temp\tmp7115876.exe1⤵PID:1524
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\tmp7119230.exeC:\Users\Admin\AppData\Local\Temp\tmp7119230.exe3⤵
- Executes dropped EXE
PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7118060.exeC:\Users\Admin\AppData\Local\Temp\tmp7118060.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1608
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7116438.exeC:\Users\Admin\AppData\Local\Temp\tmp7116438.exe1⤵
- Executes dropped EXE
PID:1976
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\tmp7119667.exeC:\Users\Admin\AppData\Local\Temp\tmp7119667.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:364 -
C:\Users\Admin\AppData\Local\Temp\tmp7120494.exeC:\Users\Admin\AppData\Local\Temp\tmp7120494.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:908 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\tmp7121508.exeC:\Users\Admin\AppData\Local\Temp\tmp7121508.exe6⤵PID:944
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\tmp7123442.exeC:\Users\Admin\AppData\Local\Temp\tmp7123442.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1776 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\tmp7125236.exeC:\Users\Admin\AppData\Local\Temp\tmp7125236.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:1204 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"11⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\tmp7125985.exeC:\Users\Admin\AppData\Local\Temp\tmp7125985.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1380 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\tmp7126983.exeC:\Users\Admin\AppData\Local\Temp\tmp7126983.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1920 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"15⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\tmp7127701.exeC:\Users\Admin\AppData\Local\Temp\tmp7127701.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1572 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"17⤵
- Executes dropped EXE
PID:580 -
C:\Users\Admin\AppData\Local\Temp\tmp7128637.exeC:\Users\Admin\AppData\Local\Temp\tmp7128637.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1504 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"19⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\tmp7129666.exeC:\Users\Admin\AppData\Local\Temp\tmp7129666.exe20⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1860 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"21⤵
- Executes dropped EXE
PID:820 -
C:\Users\Admin\AppData\Local\Temp\tmp7130431.exeC:\Users\Admin\AppData\Local\Temp\tmp7130431.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1752 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"23⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\tmp7131117.exeC:\Users\Admin\AppData\Local\Temp\tmp7131117.exe24⤵
- Executes dropped EXE
- Modifies registry class
PID:1288 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"25⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\tmp7132287.exeC:\Users\Admin\AppData\Local\Temp\tmp7132287.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:944 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"27⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\tmp7133691.exeC:\Users\Admin\AppData\Local\Temp\tmp7133691.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1232 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"29⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\tmp7134799.exeC:\Users\Admin\AppData\Local\Temp\tmp7134799.exe30⤵
- Executes dropped EXE
PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7135860.exeC:\Users\Admin\AppData\Local\Temp\tmp7135860.exe30⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\tmp7136250.exeC:\Users\Admin\AppData\Local\Temp\tmp7136250.exe31⤵PID:952
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7138543.exeC:\Users\Admin\AppData\Local\Temp\tmp7138543.exe31⤵PID:1556
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7134284.exeC:\Users\Admin\AppData\Local\Temp\tmp7134284.exe28⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\tmp7134924.exeC:\Users\Admin\AppData\Local\Temp\tmp7134924.exe29⤵
- Drops file in System32 directory
- Modifies registry class
PID:2016 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"30⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\tmp7136078.exeC:\Users\Admin\AppData\Local\Temp\tmp7136078.exe31⤵PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7137420.exeC:\Users\Admin\AppData\Local\Temp\tmp7137420.exe31⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\tmp7140633.exeC:\Users\Admin\AppData\Local\Temp\tmp7140633.exe32⤵
- Drops file in System32 directory
PID:1112 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"33⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\tmp7141335.exeC:\Users\Admin\AppData\Local\Temp\tmp7141335.exe34⤵PID:1756
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7141819.exeC:\Users\Admin\AppData\Local\Temp\tmp7141819.exe34⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\tmp7142458.exeC:\Users\Admin\AppData\Local\Temp\tmp7142458.exe35⤵
- Modifies registry class
PID:1332 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"36⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\tmp7144221.exeC:\Users\Admin\AppData\Local\Temp\tmp7144221.exe37⤵PID:1976
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7144518.exeC:\Users\Admin\AppData\Local\Temp\tmp7144518.exe37⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\tmp7145376.exeC:\Users\Admin\AppData\Local\Temp\tmp7145376.exe38⤵
- Drops file in System32 directory
- Modifies registry class
PID:568 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"39⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\tmp7146421.exeC:\Users\Admin\AppData\Local\Temp\tmp7146421.exe40⤵PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7147700.exeC:\Users\Admin\AppData\Local\Temp\tmp7147700.exe40⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\tmp7148153.exeC:\Users\Admin\AppData\Local\Temp\tmp7148153.exe41⤵PID:520
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7150415.exeC:\Users\Admin\AppData\Local\Temp\tmp7150415.exe41⤵PID:548
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7146234.exeC:\Users\Admin\AppData\Local\Temp\tmp7146234.exe38⤵PID:1692
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7143332.exeC:\Users\Admin\AppData\Local\Temp\tmp7143332.exe35⤵PID:1048
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7141132.exeC:\Users\Admin\AppData\Local\Temp\tmp7141132.exe32⤵PID:364
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7135579.exeC:\Users\Admin\AppData\Local\Temp\tmp7135579.exe29⤵PID:524
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7133442.exeC:\Users\Admin\AppData\Local\Temp\tmp7133442.exe26⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\tmp7133847.exeC:\Users\Admin\AppData\Local\Temp\tmp7133847.exe27⤵
- Executes dropped EXE
PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7134658.exeC:\Users\Admin\AppData\Local\Temp\tmp7134658.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7132038.exeC:\Users\Admin\AppData\Local\Temp\tmp7132038.exe24⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\tmp7134112.exeC:\Users\Admin\AppData\Local\Temp\tmp7134112.exe25⤵
- Executes dropped EXE
PID:1668
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7133566.exeC:\Users\Admin\AppData\Local\Temp\tmp7133566.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:836 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"26⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\tmp7135080.exeC:\Users\Admin\AppData\Local\Temp\tmp7135080.exe27⤵PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7135657.exeC:\Users\Admin\AppData\Local\Temp\tmp7135657.exe27⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\tmp7136374.exeC:\Users\Admin\AppData\Local\Temp\tmp7136374.exe28⤵PID:920
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7138558.exeC:\Users\Admin\AppData\Local\Temp\tmp7138558.exe28⤵PID:1588
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7130758.exeC:\Users\Admin\AppData\Local\Temp\tmp7130758.exe22⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\tmp7132428.exeC:\Users\Admin\AppData\Local\Temp\tmp7132428.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1772 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"24⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\tmp7134222.exeC:\Users\Admin\AppData\Local\Temp\tmp7134222.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7134970.exeC:\Users\Admin\AppData\Local\Temp\tmp7134970.exe25⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\tmp7135891.exeC:\Users\Admin\AppData\Local\Temp\tmp7135891.exe26⤵
- Drops file in System32 directory
- Modifies registry class
PID:1680 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"27⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\tmp7138824.exeC:\Users\Admin\AppData\Local\Temp\tmp7138824.exe28⤵
- Modifies registry class
PID:1292 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"29⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\tmp7141850.exeC:\Users\Admin\AppData\Local\Temp\tmp7141850.exe30⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7142708.exeC:\Users\Admin\AppData\Local\Temp\tmp7142708.exe30⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\tmp7143675.exeC:\Users\Admin\AppData\Local\Temp\tmp7143675.exe31⤵
- Drops file in System32 directory
- Modifies registry class
PID:2036 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"32⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\tmp7144564.exeC:\Users\Admin\AppData\Local\Temp\tmp7144564.exe33⤵
- Drops file in System32 directory
- Modifies registry class
PID:1520 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"34⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\tmp7145220.exeC:\Users\Admin\AppData\Local\Temp\tmp7145220.exe35⤵PID:1120
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7146327.exeC:\Users\Admin\AppData\Local\Temp\tmp7146327.exe35⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\tmp7147685.exeC:\Users\Admin\AppData\Local\Temp\tmp7147685.exe36⤵PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7150352.exeC:\Users\Admin\AppData\Local\Temp\tmp7150352.exe36⤵PID:1796
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7144908.exeC:\Users\Admin\AppData\Local\Temp\tmp7144908.exe33⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\tmp7145750.exeC:\Users\Admin\AppData\Local\Temp\tmp7145750.exe34⤵
- Drops file in System32 directory
- Modifies registry class
PID:1576 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"35⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\tmp7147981.exeC:\Users\Admin\AppData\Local\Temp\tmp7147981.exe36⤵
- Drops file in System32 directory
- Modifies registry class
PID:1752 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"37⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\tmp7150664.exeC:\Users\Admin\AppData\Local\Temp\tmp7150664.exe38⤵
- Modifies registry class
PID:612 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"39⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\tmp7151241.exeC:\Users\Admin\AppData\Local\Temp\tmp7151241.exe40⤵
- Drops file in System32 directory
- Modifies registry class
PID:1652 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"41⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\tmp7152583.exeC:\Users\Admin\AppData\Local\Temp\tmp7152583.exe42⤵
- Drops file in System32 directory
PID:1212 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"43⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\tmp7153098.exeC:\Users\Admin\AppData\Local\Temp\tmp7153098.exe44⤵
- Drops file in System32 directory
PID:1784 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"45⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\tmp7153581.exeC:\Users\Admin\AppData\Local\Temp\tmp7153581.exe46⤵PID:268
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7154237.exeC:\Users\Admin\AppData\Local\Temp\tmp7154237.exe46⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\tmp7155188.exeC:\Users\Admin\AppData\Local\Temp\tmp7155188.exe47⤵PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7157013.exeC:\Users\Admin\AppData\Local\Temp\tmp7157013.exe47⤵PID:944
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7153410.exeC:\Users\Admin\AppData\Local\Temp\tmp7153410.exe44⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\tmp7154018.exeC:\Users\Admin\AppData\Local\Temp\tmp7154018.exe45⤵PID:1796
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"46⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\tmp7154642.exeC:\Users\Admin\AppData\Local\Temp\tmp7154642.exe47⤵PID:612
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7155048.exeC:\Users\Admin\AppData\Local\Temp\tmp7155048.exe47⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\tmp7156920.exeC:\Users\Admin\AppData\Local\Temp\tmp7156920.exe48⤵PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7157996.exeC:\Users\Admin\AppData\Local\Temp\tmp7157996.exe48⤵PID:1400
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7154517.exeC:\Users\Admin\AppData\Local\Temp\tmp7154517.exe45⤵PID:548
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7152895.exeC:\Users\Admin\AppData\Local\Temp\tmp7152895.exe42⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\tmp7153301.exeC:\Users\Admin\AppData\Local\Temp\tmp7153301.exe43⤵PID:240
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7153800.exeC:\Users\Admin\AppData\Local\Temp\tmp7153800.exe43⤵PID:1588
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7152021.exeC:\Users\Admin\AppData\Local\Temp\tmp7152021.exe40⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\tmp7152458.exeC:\Users\Admin\AppData\Local\Temp\tmp7152458.exe41⤵
- Modifies registry class
PID:1668 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"42⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\tmp7152801.exeC:\Users\Admin\AppData\Local\Temp\tmp7152801.exe43⤵PID:1056
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7153238.exeC:\Users\Admin\AppData\Local\Temp\tmp7153238.exe43⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\tmp7153519.exeC:\Users\Admin\AppData\Local\Temp\tmp7153519.exe44⤵
- Modifies registry class
PID:1068 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"45⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\tmp7154315.exeC:\Users\Admin\AppData\Local\Temp\tmp7154315.exe46⤵PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7154533.exeC:\Users\Admin\AppData\Local\Temp\tmp7154533.exe46⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\tmp7155360.exeC:\Users\Admin\AppData\Local\Temp\tmp7155360.exe47⤵PID:1652
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"48⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\tmp7157091.exeC:\Users\Admin\AppData\Local\Temp\tmp7157091.exe49⤵
- Drops file in System32 directory
- Modifies registry class
PID:1968 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"50⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\tmp7158261.exeC:\Users\Admin\AppData\Local\Temp\tmp7158261.exe51⤵
- Modifies registry class
PID:1708 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"52⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\tmp7158511.exeC:\Users\Admin\AppData\Local\Temp\tmp7158511.exe53⤵
- Modifies registry class
PID:940 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"54⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\tmp7158948.exeC:\Users\Admin\AppData\Local\Temp\tmp7158948.exe55⤵
- Modifies registry class
PID:788 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"56⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\tmp7159151.exeC:\Users\Admin\AppData\Local\Temp\tmp7159151.exe57⤵
- Drops file in System32 directory
PID:1744 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"58⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\tmp7159837.exeC:\Users\Admin\AppData\Local\Temp\tmp7159837.exe59⤵
- Modifies registry class
PID:1752 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"60⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\tmp7160383.exeC:\Users\Admin\AppData\Local\Temp\tmp7160383.exe61⤵
- Drops file in System32 directory
PID:1604 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"62⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\tmp7161756.exeC:\Users\Admin\AppData\Local\Temp\tmp7161756.exe63⤵PID:1620
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7162395.exeC:\Users\Admin\AppData\Local\Temp\tmp7162395.exe63⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\tmp7162926.exeC:\Users\Admin\AppData\Local\Temp\tmp7162926.exe64⤵
- Drops file in System32 directory
- Modifies registry class
PID:1796 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"65⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\tmp7165781.exeC:\Users\Admin\AppData\Local\Temp\tmp7165781.exe66⤵
- Drops file in System32 directory
PID:1936 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"67⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\tmp7165999.exeC:\Users\Admin\AppData\Local\Temp\tmp7165999.exe68⤵
- Modifies registry class
PID:1396 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"69⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\tmp7166483.exeC:\Users\Admin\AppData\Local\Temp\tmp7166483.exe70⤵PID:992
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7166888.exeC:\Users\Admin\AppData\Local\Temp\tmp7166888.exe70⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\tmp7167356.exeC:\Users\Admin\AppData\Local\Temp\tmp7167356.exe71⤵PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7167450.exeC:\Users\Admin\AppData\Local\Temp\tmp7167450.exe71⤵PID:1064
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7166233.exeC:\Users\Admin\AppData\Local\Temp\tmp7166233.exe68⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\tmp7166467.exeC:\Users\Admin\AppData\Local\Temp\tmp7166467.exe69⤵
- Drops file in System32 directory
- Modifies registry class
PID:2040 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"70⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\tmp7166982.exeC:\Users\Admin\AppData\Local\Temp\tmp7166982.exe71⤵
- Drops file in System32 directory
- Modifies registry class
PID:836 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"72⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\tmp7168682.exeC:\Users\Admin\AppData\Local\Temp\tmp7168682.exe73⤵PID:1996
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7168854.exeC:\Users\Admin\AppData\Local\Temp\tmp7168854.exe73⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\tmp7169275.exeC:\Users\Admin\AppData\Local\Temp\tmp7169275.exe74⤵PID:1476
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7169603.exeC:\Users\Admin\AppData\Local\Temp\tmp7169603.exe74⤵PID:1928
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7168386.exeC:\Users\Admin\AppData\Local\Temp\tmp7168386.exe71⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\tmp7168635.exeC:\Users\Admin\AppData\Local\Temp\tmp7168635.exe72⤵
- Drops file in System32 directory
- Modifies registry class
PID:1436 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"73⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\tmp7169291.exeC:\Users\Admin\AppData\Local\Temp\tmp7169291.exe74⤵
- Modifies registry class
PID:1232 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"75⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\tmp7169930.exeC:\Users\Admin\AppData\Local\Temp\tmp7169930.exe76⤵PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7170617.exeC:\Users\Admin\AppData\Local\Temp\tmp7170617.exe76⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\tmp7170991.exeC:\Users\Admin\AppData\Local\Temp\tmp7170991.exe77⤵PID:1468
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7171943.exeC:\Users\Admin\AppData\Local\Temp\tmp7171943.exe77⤵PID:1708
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7169587.exeC:\Users\Admin\AppData\Local\Temp\tmp7169587.exe74⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\tmp7169712.exeC:\Users\Admin\AppData\Local\Temp\tmp7169712.exe75⤵PID:1256
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7169743.exeC:\Users\Admin\AppData\Local\Temp\tmp7169743.exe75⤵PID:2008
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7169041.exeC:\Users\Admin\AppData\Local\Temp\tmp7169041.exe72⤵PID:2028
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7166763.exeC:\Users\Admin\AppData\Local\Temp\tmp7166763.exe69⤵PID:1504
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7165843.exeC:\Users\Admin\AppData\Local\Temp\tmp7165843.exe66⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\tmp7166280.exeC:\Users\Admin\AppData\Local\Temp\tmp7166280.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:1720 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"68⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\tmp7166748.exeC:\Users\Admin\AppData\Local\Temp\tmp7166748.exe69⤵PID:580
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"70⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\tmp7167278.exeC:\Users\Admin\AppData\Local\Temp\tmp7167278.exe71⤵PID:1708
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"72⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\tmp7167715.exeC:\Users\Admin\AppData\Local\Temp\tmp7167715.exe73⤵PID:568
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7168292.exeC:\Users\Admin\AppData\Local\Temp\tmp7168292.exe73⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\tmp7168573.exeC:\Users\Admin\AppData\Local\Temp\tmp7168573.exe74⤵
- Drops file in System32 directory
- Modifies registry class
PID:1948 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"75⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\tmp7169057.exeC:\Users\Admin\AppData\Local\Temp\tmp7169057.exe76⤵PID:1640
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"77⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\tmp7169540.exeC:\Users\Admin\AppData\Local\Temp\tmp7169540.exe78⤵PID:2040
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"79⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\tmp7170975.exeC:\Users\Admin\AppData\Local\Temp\tmp7170975.exe80⤵
- Drops file in System32 directory
- Modifies registry class
PID:2036 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"81⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\tmp7172161.exeC:\Users\Admin\AppData\Local\Temp\tmp7172161.exe82⤵PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7172286.exeC:\Users\Admin\AppData\Local\Temp\tmp7172286.exe82⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\tmp7172426.exeC:\Users\Admin\AppData\Local\Temp\tmp7172426.exe83⤵PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7172457.exeC:\Users\Admin\AppData\Local\Temp\tmp7172457.exe83⤵PID:1796
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7171896.exeC:\Users\Admin\AppData\Local\Temp\tmp7171896.exe80⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\tmp7172099.exeC:\Users\Admin\AppData\Local\Temp\tmp7172099.exe81⤵
- Drops file in System32 directory
PID:568 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"82⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\tmp7172598.exeC:\Users\Admin\AppData\Local\Temp\tmp7172598.exe83⤵
- Modifies registry class
PID:1192 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"84⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\tmp7173035.exeC:\Users\Admin\AppData\Local\Temp\tmp7173035.exe85⤵
- Drops file in System32 directory
- Modifies registry class
PID:1712 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"86⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\tmp7173269.exeC:\Users\Admin\AppData\Local\Temp\tmp7173269.exe87⤵
- Modifies registry class
PID:548 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"88⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\tmp7173503.exeC:\Users\Admin\AppData\Local\Temp\tmp7173503.exe89⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7174080.exeC:\Users\Admin\AppData\Local\Temp\tmp7174080.exe89⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\tmp7174657.exeC:\Users\Admin\AppData\Local\Temp\tmp7174657.exe90⤵PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7174922.exeC:\Users\Admin\AppData\Local\Temp\tmp7174922.exe90⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\tmp7175765.exeC:\Users\Admin\AppData\Local\Temp\tmp7175765.exe91⤵PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7177122.exeC:\Users\Admin\AppData\Local\Temp\tmp7177122.exe91⤵PID:1948
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7173315.exeC:\Users\Admin\AppData\Local\Temp\tmp7173315.exe87⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\tmp7174064.exeC:\Users\Admin\AppData\Local\Temp\tmp7174064.exe88⤵PID:1408
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7174251.exeC:\Users\Admin\AppData\Local\Temp\tmp7174251.exe88⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\tmp7174501.exeC:\Users\Admin\AppData\Local\Temp\tmp7174501.exe89⤵
- Modifies registry class
PID:1936 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"90⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\tmp7175016.exeC:\Users\Admin\AppData\Local\Temp\tmp7175016.exe91⤵
- Drops file in System32 directory
- Modifies registry class
PID:1692 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"92⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\tmp7175406.exeC:\Users\Admin\AppData\Local\Temp\tmp7175406.exe93⤵PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7175468.exeC:\Users\Admin\AppData\Local\Temp\tmp7175468.exe93⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\tmp7175655.exeC:\Users\Admin\AppData\Local\Temp\tmp7175655.exe94⤵PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7175811.exeC:\Users\Admin\AppData\Local\Temp\tmp7175811.exe94⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\tmp7176201.exeC:\Users\Admin\AppData\Local\Temp\tmp7176201.exe95⤵PID:864
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7176279.exeC:\Users\Admin\AppData\Local\Temp\tmp7176279.exe95⤵PID:836
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7175063.exeC:\Users\Admin\AppData\Local\Temp\tmp7175063.exe91⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\tmp7175203.exeC:\Users\Admin\AppData\Local\Temp\tmp7175203.exe92⤵
- Drops file in System32 directory
- Modifies registry class
PID:1920 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"93⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\tmp7175749.exeC:\Users\Admin\AppData\Local\Temp\tmp7175749.exe94⤵PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7176077.exeC:\Users\Admin\AppData\Local\Temp\tmp7176077.exe94⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\tmp7176373.exeC:\Users\Admin\AppData\Local\Temp\tmp7176373.exe95⤵PID:1688
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"96⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\tmp7177684.exeC:\Users\Admin\AppData\Local\Temp\tmp7177684.exe97⤵PID:572
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7177886.exeC:\Users\Admin\AppData\Local\Temp\tmp7177886.exe97⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\tmp7179337.exeC:\Users\Admin\AppData\Local\Temp\tmp7179337.exe98⤵
- Drops file in System32 directory
- Modifies registry class
PID:1080 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"99⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\tmp7180039.exeC:\Users\Admin\AppData\Local\Temp\tmp7180039.exe100⤵PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7180164.exeC:\Users\Admin\AppData\Local\Temp\tmp7180164.exe100⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\tmp7180414.exeC:\Users\Admin\AppData\Local\Temp\tmp7180414.exe101⤵PID:396
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7181022.exeC:\Users\Admin\AppData\Local\Temp\tmp7181022.exe101⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\tmp7181194.exeC:\Users\Admin\AppData\Local\Temp\tmp7181194.exe102⤵
- Modifies registry class
PID:1068 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"103⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\tmp7185624.exeC:\Users\Admin\AppData\Local\Temp\tmp7185624.exe104⤵PID:1460
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7186264.exeC:\Users\Admin\AppData\Local\Temp\tmp7186264.exe104⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\tmp7186638.exeC:\Users\Admin\AppData\Local\Temp\tmp7186638.exe105⤵PID:2008
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"106⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\tmp7188058.exeC:\Users\Admin\AppData\Local\Temp\tmp7188058.exe107⤵PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7188260.exeC:\Users\Admin\AppData\Local\Temp\tmp7188260.exe107⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\tmp7188853.exeC:\Users\Admin\AppData\Local\Temp\tmp7188853.exe108⤵PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7190975.exeC:\Users\Admin\AppData\Local\Temp\tmp7190975.exe108⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\tmp7192675.exeC:\Users\Admin\AppData\Local\Temp\tmp7192675.exe109⤵PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7193346.exeC:\Users\Admin\AppData\Local\Temp\tmp7193346.exe109⤵PID:1604
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7186747.exeC:\Users\Admin\AppData\Local\Temp\tmp7186747.exe105⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\tmp7187168.exeC:\Users\Admin\AppData\Local\Temp\tmp7187168.exe106⤵
- Drops file in System32 directory
- Modifies registry class
PID:1076 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"107⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\tmp7190444.exeC:\Users\Admin\AppData\Local\Temp\tmp7190444.exe108⤵PID:1556
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"109⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\tmp7192644.exeC:\Users\Admin\AppData\Local\Temp\tmp7192644.exe110⤵PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7193783.exeC:\Users\Admin\AppData\Local\Temp\tmp7193783.exe110⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\tmp7197121.exeC:\Users\Admin\AppData\Local\Temp\tmp7197121.exe111⤵PID:316
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7199118.exeC:\Users\Admin\AppData\Local\Temp\tmp7199118.exe111⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\tmp7206762.exeC:\Users\Admin\AppData\Local\Temp\tmp7206762.exe112⤵PID:304
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7191131.exeC:\Users\Admin\AppData\Local\Temp\tmp7191131.exe108⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\tmp7193736.exeC:\Users\Admin\AppData\Local\Temp\tmp7193736.exe109⤵PID:1652
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"110⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\tmp7197948.exeC:\Users\Admin\AppData\Local\Temp\tmp7197948.exe111⤵PID:1092
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"112⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\tmp7203829.exeC:\Users\Admin\AppData\Local\Temp\tmp7203829.exe113⤵PID:1208
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"114⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\tmp7207480.exeC:\Users\Admin\AppData\Local\Temp\tmp7207480.exe115⤵PID:1176
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7210319.exeC:\Users\Admin\AppData\Local\Temp\tmp7210319.exe115⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\tmp7213221.exeC:\Users\Admin\AppData\Local\Temp\tmp7213221.exe116⤵
- Modifies registry class
PID:2008 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"117⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\tmp7217994.exeC:\Users\Admin\AppData\Local\Temp\tmp7217994.exe118⤵PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7217355.exeC:\Users\Admin\AppData\Local\Temp\tmp7217355.exe118⤵PID:560
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7214609.exeC:\Users\Admin\AppData\Local\Temp\tmp7214609.exe116⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\tmp7218010.exeC:\Users\Admin\AppData\Local\Temp\tmp7218010.exe117⤵PID:572
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7222019.exeC:\Users\Admin\AppData\Local\Temp\tmp7222019.exe117⤵PID:1812
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7233688.exeC:\Users\Admin\AppData\Local\Temp\tmp7233688.exe116⤵PID:1184
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7205857.exeC:\Users\Admin\AppData\Local\Temp\tmp7205857.exe113⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\tmp7209726.exeC:\Users\Admin\AppData\Local\Temp\tmp7209726.exe114⤵PID:1068
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"115⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\tmp7210990.exeC:\Users\Admin\AppData\Local\Temp\tmp7210990.exe116⤵PID:836
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7211785.exeC:\Users\Admin\AppData\Local\Temp\tmp7211785.exe116⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\tmp7215124.exeC:\Users\Admin\AppData\Local\Temp\tmp7215124.exe117⤵PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7218119.exeC:\Users\Admin\AppData\Local\Temp\tmp7218119.exe117⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\tmp7222081.exeC:\Users\Admin\AppData\Local\Temp\tmp7222081.exe118⤵PID:1764
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"119⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\tmp7227697.exeC:\Users\Admin\AppData\Local\Temp\tmp7227697.exe120⤵PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7232908.exeC:\Users\Admin\AppData\Local\Temp\tmp7232908.exe120⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\tmp7233173.exeC:\Users\Admin\AppData\Local\Temp\tmp7233173.exe121⤵PID:832
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-