Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 01:01
Behavioral task
behavioral1
Sample
6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe
Resource
win10v2004-20220812-en
General
-
Target
6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe
-
Size
677KB
-
MD5
723c9b95d66c5f763327baa4fe889310
-
SHA1
37999e045e0f3713fea1c6063aa84e37d05cdf80
-
SHA256
6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102
-
SHA512
793526f6f7a9414d4576b3b047743e6e6b3862e4b3d759f848c6b3a64c7411748fbafc44d0978330fe5d0fde8a1330ce8ba2c8a96f4aa8a5521a99249433f005
-
SSDEEP
12288:HPhR9PUPhR9PgPhR9P9PhR9PGPhR9PePhR9PuPhR9PnSDyTFtj:JRYRgRJRWRSRmRkDyTFtj
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5064 tmp240552468.exe 1276 tmp240552484.exe 5084 tmp240552546.exe 4216 tmp240552562.exe 844 tmp240552609.exe 4928 tmp240552703.exe 4824 tmp240552765.exe 4888 tmp240552812.exe 2536 tmp240552859.exe 2028 tmp240552921.exe 2672 tmp240552968.exe 932 tmp240553000.exe 2720 tmp240553078.exe 4828 notpad.exe 1800 tmp240553156.exe 5000 tmp240553187.exe 4732 tmp240553265.exe 4020 notpad.exe 3064 tmp240553406.exe 1400 tmp240553500.exe 3612 notpad.exe 3632 tmp240553640.exe 1264 tmp240553812.exe 4796 notpad.exe 1452 tmp240554015.exe 1444 tmp240554046.exe 3988 notpad.exe 2968 tmp240554203.exe 5088 tmp240554218.exe 4456 notpad.exe 1576 tmp240554375.exe 408 tmp240554390.exe 1156 notpad.exe 5100 tmp240554515.exe 3084 tmp240554531.exe 4048 notpad.exe 1116 tmp240554765.exe 4140 tmp240555171.exe 3528 notpad.exe 1844 tmp240555421.exe 2300 tmp240555500.exe 2960 notpad.exe 4296 tmp240555656.exe 4868 tmp240555703.exe 2656 notpad.exe 1644 tmp240555875.exe 4192 tmp240555921.exe 4976 notpad.exe 2548 tmp240556125.exe 5104 tmp240556203.exe 3980 notpad.exe 1804 tmp240556437.exe 3208 tmp240556484.exe 3016 notpad.exe 564 tmp240556687.exe 5084 tmp240556750.exe 1292 notpad.exe 5072 tmp240556875.exe 4928 tmp240556906.exe 2576 notpad.exe 4076 tmp240557078.exe 5116 tmp240557109.exe 1716 notpad.exe 2216 tmp240557328.exe -
resource yara_rule behavioral2/files/0x0006000000022e1c-146.dat upx behavioral2/memory/4216-153-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0007000000022e22-152.dat upx behavioral2/memory/4928-160-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e24-159.dat upx behavioral2/memory/4888-161-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e24-158.dat upx behavioral2/memory/4888-168-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/932-186-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e1f-189.dat upx behavioral2/memory/4828-193-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4020-203-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0007000000022e21-205.dat upx behavioral2/files/0x0007000000022e21-217.dat upx behavioral2/files/0x0006000000022e1f-241.dat upx behavioral2/memory/4456-244-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1156-248-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4048-250-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0007000000022e21-237.dat upx behavioral2/memory/3988-235-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e1f-231.dat upx behavioral2/memory/4048-254-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0007000000022e21-227.dat upx behavioral2/memory/4796-225-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e1f-222.dat upx behavioral2/memory/3528-257-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3612-215-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3612-212-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e1f-209.dat upx behavioral2/files/0x0006000000022e1f-199.dat upx behavioral2/files/0x0007000000022e21-195.dat upx behavioral2/files/0x0007000000022e21-182.dat upx behavioral2/files/0x0007000000022e21-180.dat upx behavioral2/memory/2028-175-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e2a-174.dat upx behavioral2/files/0x0006000000022e2a-173.dat upx behavioral2/files/0x0006000000022e27-167.dat upx behavioral2/files/0x0006000000022e27-166.dat upx behavioral2/files/0x0007000000022e22-151.dat upx behavioral2/memory/1276-145-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e1c-144.dat upx behavioral2/memory/4876-142-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0006000000022e19-138.dat upx behavioral2/files/0x0006000000022e19-137.dat upx behavioral2/memory/2960-261-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2656-265-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4976-269-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3980-273-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3016-277-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1292-281-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2576-285-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1716-287-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2720-289-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1716-290-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4344-291-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2720-292-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4344-293-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4732-294-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4732-295-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3564-296-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2204-297-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3868-298-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3868-299-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4756-300-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240629937.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240656265.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240657484.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240552468.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240589828.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240598640.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240601093.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240621468.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240682828.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240686125.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240691468.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240679109.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240679921.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240587171.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240587343.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240588937.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240637656.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240650312.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240689015.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240692312.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240553640.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240629140.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240652109.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240658703.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240680171.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240654187.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240683218.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240586984.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240597859.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240626609.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240627125.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240650765.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240685812.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240598078.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240622078.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240623281.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240658906.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240680421.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240554375.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240640187.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240652406.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240650906.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240676468.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240691937.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240598968.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240638171.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240687406.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240687984.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240678875.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240682625.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240555875.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240598796.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240623812.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240630640.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240653765.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240624500.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240657093.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240659421.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240691609.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240658078.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240677328.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240679593.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240594046.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp240625000.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240623031.exe File created C:\Windows\SysWOW64\notpad.exe tmp240626609.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240627125.exe File created C:\Windows\SysWOW64\notpad.exe tmp240648968.exe File created C:\Windows\SysWOW64\notpad.exe tmp240650906.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240659625.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240686609.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240596765.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240596234.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240597375.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240597859.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240624234.exe File created C:\Windows\SysWOW64\notpad.exe tmp240638343.exe File created C:\Windows\SysWOW64\notpad.exe tmp240651093.exe File created C:\Windows\SysWOW64\notpad.exe tmp240653765.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240589093.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240678093.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240658703.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240596031.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240625000.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240627562.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240630109.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240683593.exe File created C:\Windows\SysWOW64\notpad.exe tmp240685812.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240555875.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240688812.exe File created C:\Windows\SysWOW64\notpad.exe tmp240595234.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240625250.exe File created C:\Windows\SysWOW64\notpad.exe tmp240628562.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240678093.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240561875.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240594546.exe File created C:\Windows\SysWOW64\notpad.exe tmp240658906.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240680171.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240686125.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240688609.exe File created C:\Windows\SysWOW64\notpad.exe tmp240691609.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240570578.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240622078.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240622078.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240679921.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240680968.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240683390.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240686609.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240687406.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240556875.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240557078.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240624500.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240658703.exe File created C:\Windows\SysWOW64\notpad.exe tmp240686609.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240554375.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240629750.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240649406.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240651093.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240659093.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240677593.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240689656.exe File opened for modification C:\Windows\SysWOW64\fsb.stb tmp240596968.exe File created C:\Windows\SysWOW64\notpad.exe tmp240683593.exe File created C:\Windows\SysWOW64\notpad.exe tmp240685609.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240689656.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240596578.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240640187.exe File created C:\Windows\SysWOW64\notpad.exe- tmp240682828.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process 4420 1800 WerFault.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240624500.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240650312.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240684171.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240687406.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240691609.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240555421.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240566750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240585781.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240586187.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240597375.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240600781.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240638515.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240650765.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240659421.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240686937.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240692312.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240598968.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240620484.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240629359.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240637828.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240651906.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240556125.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240587171.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240656687.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240658078.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240659625.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240595078.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240619296.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240626906.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240629750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240677328.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240677593.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240682828.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240687625.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240555875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240589093.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240589296.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240589828.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240597578.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240624234.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240552468.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240588937.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240653937.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240658515.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240680781.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240683968.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240686359.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240554375.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240554765.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240561875.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240596578.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240597859.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240622781.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240678328.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240587343.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240588750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240593593.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240598640.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240598796.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240600937.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240623031.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240648968.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240649718.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "%SystemRoot%\\system32\\NOTPAD.EXE %1" tmp240652406.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 5064 4876 6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe 127 PID 4876 wrote to memory of 5064 4876 6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe 127 PID 4876 wrote to memory of 5064 4876 6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe 127 PID 4876 wrote to memory of 1276 4876 6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe 126 PID 4876 wrote to memory of 1276 4876 6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe 126 PID 4876 wrote to memory of 1276 4876 6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe 126 PID 1276 wrote to memory of 5084 1276 tmp240552484.exe 82 PID 1276 wrote to memory of 5084 1276 tmp240552484.exe 82 PID 1276 wrote to memory of 5084 1276 tmp240552484.exe 82 PID 1276 wrote to memory of 4216 1276 tmp240552484.exe 83 PID 1276 wrote to memory of 4216 1276 tmp240552484.exe 83 PID 1276 wrote to memory of 4216 1276 tmp240552484.exe 83 PID 4216 wrote to memory of 844 4216 tmp240552562.exe 84 PID 4216 wrote to memory of 844 4216 tmp240552562.exe 84 PID 4216 wrote to memory of 844 4216 tmp240552562.exe 84 PID 4216 wrote to memory of 4928 4216 tmp240552562.exe 125 PID 4216 wrote to memory of 4928 4216 tmp240552562.exe 125 PID 4216 wrote to memory of 4928 4216 tmp240552562.exe 125 PID 4928 wrote to memory of 4824 4928 tmp240552703.exe 124 PID 4928 wrote to memory of 4824 4928 tmp240552703.exe 124 PID 4928 wrote to memory of 4824 4928 tmp240552703.exe 124 PID 4928 wrote to memory of 4888 4928 tmp240552703.exe 123 PID 4928 wrote to memory of 4888 4928 tmp240552703.exe 123 PID 4928 wrote to memory of 4888 4928 tmp240552703.exe 123 PID 4888 wrote to memory of 2536 4888 tmp240552812.exe 85 PID 4888 wrote to memory of 2536 4888 tmp240552812.exe 85 PID 4888 wrote to memory of 2536 4888 tmp240552812.exe 85 PID 4888 wrote to memory of 2028 4888 tmp240552812.exe 122 PID 4888 wrote to memory of 2028 4888 tmp240552812.exe 122 PID 4888 wrote to memory of 2028 4888 tmp240552812.exe 122 PID 2028 wrote to memory of 2672 2028 tmp240552921.exe 121 PID 2028 wrote to memory of 2672 2028 tmp240552921.exe 121 PID 2028 wrote to memory of 2672 2028 tmp240552921.exe 121 PID 2028 wrote to memory of 932 2028 tmp240552921.exe 119 PID 2028 wrote to memory of 932 2028 tmp240552921.exe 119 PID 2028 wrote to memory of 932 2028 tmp240552921.exe 119 PID 5064 wrote to memory of 4828 5064 tmp240552468.exe 118 PID 5064 wrote to memory of 4828 5064 tmp240552468.exe 118 PID 5064 wrote to memory of 4828 5064 tmp240552468.exe 118 PID 932 wrote to memory of 2720 932 tmp240553000.exe 86 PID 932 wrote to memory of 2720 932 tmp240553000.exe 86 PID 932 wrote to memory of 2720 932 tmp240553000.exe 86 PID 932 wrote to memory of 1800 932 tmp240553000.exe 117 PID 932 wrote to memory of 1800 932 tmp240553000.exe 117 PID 932 wrote to memory of 1800 932 tmp240553000.exe 117 PID 4828 wrote to memory of 5000 4828 notpad.exe 116 PID 4828 wrote to memory of 5000 4828 notpad.exe 116 PID 4828 wrote to memory of 5000 4828 notpad.exe 116 PID 4828 wrote to memory of 4732 4828 notpad.exe 114 PID 4828 wrote to memory of 4732 4828 notpad.exe 114 PID 4828 wrote to memory of 4732 4828 notpad.exe 114 PID 5000 wrote to memory of 4020 5000 tmp240553187.exe 87 PID 5000 wrote to memory of 4020 5000 tmp240553187.exe 87 PID 5000 wrote to memory of 4020 5000 tmp240553187.exe 87 PID 4020 wrote to memory of 3064 4020 notpad.exe 112 PID 4020 wrote to memory of 3064 4020 notpad.exe 112 PID 4020 wrote to memory of 3064 4020 notpad.exe 112 PID 4020 wrote to memory of 1400 4020 notpad.exe 111 PID 4020 wrote to memory of 1400 4020 notpad.exe 111 PID 4020 wrote to memory of 1400 4020 notpad.exe 111 PID 3064 wrote to memory of 3612 3064 tmp240553406.exe 88 PID 3064 wrote to memory of 3612 3064 tmp240553406.exe 88 PID 3064 wrote to memory of 3612 3064 tmp240553406.exe 88 PID 3612 wrote to memory of 3632 3612 notpad.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe"C:\Users\Admin\AppData\Local\Temp\6d24a1079d31d71bef4f35a24ecbde6540bb180d5509cea78e07f3a409954102.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\tmp240552484.exeC:\Users\Admin\AppData\Local\Temp\tmp240552484.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240552468.exeC:\Users\Admin\AppData\Local\Temp\tmp240552468.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5064
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240552546.exeC:\Users\Admin\AppData\Local\Temp\tmp240552546.exe1⤵
- Executes dropped EXE
PID:5084
-
C:\Users\Admin\AppData\Local\Temp\tmp240552562.exeC:\Users\Admin\AppData\Local\Temp\tmp240552562.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\tmp240552609.exeC:\Users\Admin\AppData\Local\Temp\tmp240552609.exe2⤵
- Executes dropped EXE
PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240552703.exeC:\Users\Admin\AppData\Local\Temp\tmp240552703.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240552859.exeC:\Users\Admin\AppData\Local\Temp\tmp240552859.exe1⤵
- Executes dropped EXE
PID:2536
-
C:\Users\Admin\AppData\Local\Temp\tmp240553078.exeC:\Users\Admin\AppData\Local\Temp\tmp240553078.exe1⤵
- Executes dropped EXE
PID:2720
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\tmp240553500.exeC:\Users\Admin\AppData\Local\Temp\tmp240553500.exe2⤵
- Executes dropped EXE
PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240553406.exeC:\Users\Admin\AppData\Local\Temp\tmp240553406.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064
-
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\tmp240553812.exeC:\Users\Admin\AppData\Local\Temp\tmp240553812.exe2⤵
- Executes dropped EXE
PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240553640.exeC:\Users\Admin\AppData\Local\Temp\tmp240553640.exe2⤵
- Executes dropped EXE
- Checks computer location settings
PID:3632
-
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"1⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\tmp240554046.exeC:\Users\Admin\AppData\Local\Temp\tmp240554046.exe2⤵
- Executes dropped EXE
PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240554015.exeC:\Users\Admin\AppData\Local\Temp\tmp240554015.exe2⤵
- Executes dropped EXE
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240554218.exeC:\Users\Admin\AppData\Local\Temp\tmp240554218.exe1⤵
- Executes dropped EXE
PID:5088
-
C:\Users\Admin\AppData\Local\Temp\tmp240554390.exeC:\Users\Admin\AppData\Local\Temp\tmp240554390.exe1⤵
- Executes dropped EXE
PID:408
-
C:\Users\Admin\AppData\Local\Temp\tmp240554515.exeC:\Users\Admin\AppData\Local\Temp\tmp240554515.exe1⤵
- Executes dropped EXE
PID:5100 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"2⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\tmp240554765.exeC:\Users\Admin\AppData\Local\Temp\tmp240554765.exe3⤵
- Executes dropped EXE
- Modifies registry class
PID:1116 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"4⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\tmp240555421.exeC:\Users\Admin\AppData\Local\Temp\tmp240555421.exe5⤵
- Executes dropped EXE
- Modifies registry class
PID:1844 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"6⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\tmp240555656.exeC:\Users\Admin\AppData\Local\Temp\tmp240555656.exe7⤵
- Executes dropped EXE
PID:4296 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"8⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\tmp240555875.exeC:\Users\Admin\AppData\Local\Temp\tmp240555875.exe9⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:1644 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"10⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\tmp240556125.exeC:\Users\Admin\AppData\Local\Temp\tmp240556125.exe11⤵
- Executes dropped EXE
- Modifies registry class
PID:2548 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"12⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\tmp240556437.exeC:\Users\Admin\AppData\Local\Temp\tmp240556437.exe13⤵
- Executes dropped EXE
PID:1804 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"14⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\tmp240556687.exeC:\Users\Admin\AppData\Local\Temp\tmp240556687.exe15⤵
- Executes dropped EXE
PID:564 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"16⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\tmp240556875.exeC:\Users\Admin\AppData\Local\Temp\tmp240556875.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5072 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"18⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\tmp240557078.exeC:\Users\Admin\AppData\Local\Temp\tmp240557078.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4076 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"20⤵
- Executes dropped EXE
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\tmp240557328.exeC:\Users\Admin\AppData\Local\Temp\tmp240557328.exe21⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"22⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\tmp240561875.exeC:\Users\Admin\AppData\Local\Temp\tmp240561875.exe23⤵
- Drops file in System32 directory
- Modifies registry class
PID:1344 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"24⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\tmp240566750.exeC:\Users\Admin\AppData\Local\Temp\tmp240566750.exe25⤵
- Modifies registry class
PID:116 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"26⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\tmp240570578.exeC:\Users\Admin\AppData\Local\Temp\tmp240570578.exe27⤵
- Drops file in System32 directory
PID:2932 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"28⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\tmp240585781.exeC:\Users\Admin\AppData\Local\Temp\tmp240585781.exe29⤵
- Modifies registry class
PID:3996 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"30⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\tmp240586000.exeC:\Users\Admin\AppData\Local\Temp\tmp240586000.exe31⤵PID:3828
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"32⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\tmp240586187.exeC:\Users\Admin\AppData\Local\Temp\tmp240586187.exe33⤵
- Modifies registry class
PID:1396 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"34⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\tmp240586984.exeC:\Users\Admin\AppData\Local\Temp\tmp240586984.exe35⤵
- Checks computer location settings
PID:4556 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"36⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\tmp240587171.exeC:\Users\Admin\AppData\Local\Temp\tmp240587171.exe37⤵
- Checks computer location settings
- Modifies registry class
PID:1412 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"38⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\tmp240587343.exeC:\Users\Admin\AppData\Local\Temp\tmp240587343.exe39⤵
- Checks computer location settings
- Modifies registry class
PID:3872 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"40⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\tmp240588468.exeC:\Users\Admin\AppData\Local\Temp\tmp240588468.exe41⤵PID:1760
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"42⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\tmp240588750.exeC:\Users\Admin\AppData\Local\Temp\tmp240588750.exe43⤵
- Modifies registry class
PID:1476 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"44⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\tmp240588937.exeC:\Users\Admin\AppData\Local\Temp\tmp240588937.exe45⤵
- Checks computer location settings
- Modifies registry class
PID:1856 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"46⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\tmp240589093.exeC:\Users\Admin\AppData\Local\Temp\tmp240589093.exe47⤵
- Drops file in System32 directory
- Modifies registry class
PID:64 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"48⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\tmp240589296.exeC:\Users\Admin\AppData\Local\Temp\tmp240589296.exe49⤵
- Modifies registry class
PID:968 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"50⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\tmp240589828.exeC:\Users\Admin\AppData\Local\Temp\tmp240589828.exe51⤵
- Checks computer location settings
- Modifies registry class
PID:3236 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"52⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\tmp240590031.exeC:\Users\Admin\AppData\Local\Temp\tmp240590031.exe53⤵PID:564
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"54⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\tmp240593593.exeC:\Users\Admin\AppData\Local\Temp\tmp240593593.exe55⤵
- Modifies registry class
PID:4972 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"56⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\tmp240593828.exeC:\Users\Admin\AppData\Local\Temp\tmp240593828.exe57⤵PID:4076
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"58⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\tmp240594046.exeC:\Users\Admin\AppData\Local\Temp\tmp240594046.exe59⤵
- Checks computer location settings
PID:2144 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"60⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\tmp240594218.exeC:\Users\Admin\AppData\Local\Temp\tmp240594218.exe61⤵PID:4752
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"62⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\tmp240594546.exeC:\Users\Admin\AppData\Local\Temp\tmp240594546.exe63⤵
- Drops file in System32 directory
PID:204 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"64⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\tmp240594843.exeC:\Users\Admin\AppData\Local\Temp\tmp240594843.exe65⤵PID:4992
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"66⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\tmp240595078.exeC:\Users\Admin\AppData\Local\Temp\tmp240595078.exe67⤵
- Modifies registry class
PID:1456 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"68⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\tmp240595234.exeC:\Users\Admin\AppData\Local\Temp\tmp240595234.exe69⤵
- Drops file in System32 directory
PID:780 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"70⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\tmp240595484.exeC:\Users\Admin\AppData\Local\Temp\tmp240595484.exe71⤵PID:1004
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"72⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\tmp240595796.exeC:\Users\Admin\AppData\Local\Temp\tmp240595796.exe73⤵PID:5088
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"74⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\tmp240596031.exeC:\Users\Admin\AppData\Local\Temp\tmp240596031.exe75⤵
- Drops file in System32 directory
PID:5040 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"76⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\tmp240596234.exeC:\Users\Admin\AppData\Local\Temp\tmp240596234.exe77⤵
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"78⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\tmp240596375.exeC:\Users\Admin\AppData\Local\Temp\tmp240596375.exe79⤵PID:3932
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"80⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\tmp240596578.exeC:\Users\Admin\AppData\Local\Temp\tmp240596578.exe81⤵
- Drops file in System32 directory
- Modifies registry class
PID:1340 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"82⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\tmp240596765.exeC:\Users\Admin\AppData\Local\Temp\tmp240596765.exe83⤵
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"84⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\tmp240596968.exeC:\Users\Admin\AppData\Local\Temp\tmp240596968.exe85⤵
- Drops file in System32 directory
PID:2328 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"86⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\tmp240597375.exeC:\Users\Admin\AppData\Local\Temp\tmp240597375.exe87⤵
- Drops file in System32 directory
- Modifies registry class
PID:3968 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"88⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\tmp240597578.exeC:\Users\Admin\AppData\Local\Temp\tmp240597578.exe89⤵
- Modifies registry class
PID:1104 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"90⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\tmp240597859.exeC:\Users\Admin\AppData\Local\Temp\tmp240597859.exe91⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
PID:3056 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"92⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\tmp240598078.exeC:\Users\Admin\AppData\Local\Temp\tmp240598078.exe93⤵
- Checks computer location settings
PID:1276 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"94⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\tmp240598312.exeC:\Users\Admin\AppData\Local\Temp\tmp240598312.exe95⤵PID:5116
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"96⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\tmp240598640.exeC:\Users\Admin\AppData\Local\Temp\tmp240598640.exe97⤵
- Checks computer location settings
- Modifies registry class
PID:3244 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"98⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\tmp240598796.exeC:\Users\Admin\AppData\Local\Temp\tmp240598796.exe99⤵
- Checks computer location settings
- Modifies registry class
PID:4560 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"100⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\tmp240598968.exeC:\Users\Admin\AppData\Local\Temp\tmp240598968.exe101⤵
- Checks computer location settings
- Modifies registry class
PID:932 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"102⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\tmp240600406.exeC:\Users\Admin\AppData\Local\Temp\tmp240600406.exe103⤵PID:224
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"104⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\tmp240600500.exeC:\Users\Admin\AppData\Local\Temp\tmp240600500.exe105⤵PID:1868
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"106⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\tmp240600671.exeC:\Users\Admin\AppData\Local\Temp\tmp240600671.exe107⤵PID:1748
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"108⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\tmp240600843.exeC:\Users\Admin\AppData\Local\Temp\tmp240600843.exe109⤵PID:1072
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240600781.exeC:\Users\Admin\AppData\Local\Temp\tmp240600781.exe109⤵
- Modifies registry class
PID:4008 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"110⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\tmp240600937.exeC:\Users\Admin\AppData\Local\Temp\tmp240600937.exe111⤵
- Modifies registry class
PID:4700 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"112⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\tmp240601093.exeC:\Users\Admin\AppData\Local\Temp\tmp240601093.exe113⤵
- Checks computer location settings
PID:4600 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"114⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\tmp240619296.exeC:\Users\Admin\AppData\Local\Temp\tmp240619296.exe115⤵
- Modifies registry class
PID:4840 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"116⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\tmp240620015.exeC:\Users\Admin\AppData\Local\Temp\tmp240620015.exe117⤵PID:2136
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"118⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\tmp240620484.exeC:\Users\Admin\AppData\Local\Temp\tmp240620484.exe119⤵
- Modifies registry class
PID:2300 -
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"120⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\tmp240620984.exeC:\Users\Admin\AppData\Local\Temp\tmp240620984.exe121⤵PID:2936
-
C:\Windows\SysWOW64\notpad.exe"C:\Windows\system32\notpad.exe"122⤵PID:4280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-