Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
02/12/2022, 20:56
General
-
Target
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe
-
Size
16KB
-
MD5
7d2c9dcea4b12ddb26d943aef5956fc7
-
SHA1
6811f78b05d0b1d050bc211f48c06ba349b74ed5
-
SHA256
a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d
-
SHA512
f792fc2b58a825f6518e3434a91c93afc3ba9c1a3fd81e97a75b60c7b4df2fe8bfdfad322fd9827e43f67a962587fd122742958f123caa5a9ec9342ed360280c
-
SSDEEP
384:IZ76Fph0u+c1POTB7wqc1E3egvonG5LChm04LGrLmZ:VP+cgB2EvsG8mJ2Lu
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 31 IoCs
-
Installs/modifies Browser Helper Object 2 TTPs 62 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 64 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe"C:\Users\Admin\AppData\Local\Temp\a64c731e014d98f50b1ac26aac87dd729869c7d1c79e956b0c9e32075439990d.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240551609.bat2⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240552062.bat3⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe3⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240552750.bat4⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe4⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240552953.bat5⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe5⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240553187.bat6⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe6⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240553343.bat7⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe7⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240553484.bat8⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe8⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240553640.bat9⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe9⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240553812.bat10⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe10⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240554062.bat11⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe11⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240554218.bat12⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe12⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240554500.bat13⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe13⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240556781.bat14⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe14⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240556906.bat15⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe15⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240557140.bat16⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe16⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240557359.bat17⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe17⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240557656.bat18⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe18⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240557875.bat19⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240558031.bat20⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe20⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240558218.bat21⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe21⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240558375.bat22⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe22⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240558546.bat23⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe23⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240558703.bat24⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe24⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240558937.bat25⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe25⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240559109.bat26⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe26⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240559265.bat27⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe27⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240559515.bat28⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe28⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240559687.bat29⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240559968.bat30⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe30⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240560156.bat31⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe31⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240560406.bat32⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240560578.bat33⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240561703.bat34⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe34⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240561859.bat35⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe35⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240562031.bat36⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe36⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240562171.bat37⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240579312.bat38⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe38⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240579468.bat39⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240579640.bat40⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe40⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240579812.bat41⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240579984.bat42⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe42⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240580218.bat43⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe43⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240580390.bat44⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe44⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240580625.bat45⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe45⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240580859.bat46⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe46⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240581031.bat47⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240581218.bat48⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe48⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240581359.bat49⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240581546.bat50⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe50⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240581703.bat51⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe51⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240581890.bat52⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe52⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240582015.bat53⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240582171.bat54⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe54⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240582343.bat55⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240582515.bat56⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe56⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240582671.bat57⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240582875.bat58⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe58⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240583046.bat59⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240583203.bat60⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe60⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240583359.bat61⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240583703.bat62⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe62⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240583875.bat63⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe63⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240584031.bat64⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe64⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240585015.bat65⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240586234.bat66⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe66⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240586437.bat67⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240586625.bat68⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe68⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240586796.bat69⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240587031.bat70⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe70⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240587156.bat71⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe71⤵
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe72⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240587812.bat73⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240593734.bat74⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe74⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240593968.bat75⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240594156.bat76⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe76⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240594359.bat77⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV178⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240594562.bat78⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe78⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240594859.bat79⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240595000.bat80⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe80⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599421.bat81⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599609.bat82⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe82⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599765.bat83⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240599906.bat84⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe84⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240600046.bat85⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240600187.bat86⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe86⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240600375.bat87⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240600500.bat88⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe88⤵
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604000.bat90⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe90⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604109.bat91⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604250.bat92⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe92⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604546.bat93⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604718.bat94⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe94⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240604859.bat95⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605078.bat96⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe96⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605281.bat97⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605453.bat98⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe98⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605703.bat99⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240605843.bat100⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe100⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606171.bat101⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240606328.bat102⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe102⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240612500.bat103⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613031.bat104⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe104⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613312.bat105⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613593.bat106⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe106⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240613859.bat107⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614218.bat108⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe108⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240614562.bat109⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615171.bat110⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe110⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615390.bat111⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615671.bat112⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe112⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240615968.bat113⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616218.bat114⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe114⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616453.bat115⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240616687.bat116⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe116⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617015.bat117⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617296.bat118⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe118⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617468.bat119⤵
-
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe119⤵
-
C:\Windows\SysWOW64\siwdaapi.exeC:\Windows\system32\siwdaapi.exe120⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240617906.bat121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-