Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 03:05

General

  • Target

    01c99fbbb5d50f074822c1708c8413e5.exe

  • Size

    249KB

  • MD5

    01c99fbbb5d50f074822c1708c8413e5

  • SHA1

    3a54e650b79129d3c760db9d54216e331ee5590d

  • SHA256

    cff5eb284178d398145ca611e668f2b360e400a3fe4d88de0a69f4ffe8357502

  • SHA512

    80a58fe2755d68887b74011bc6327724023a5a4fd2f98a1325b7c3957d23f254ba7269c5803f617ba919c7008aed701f5eceae959fee7ed1c1b70c04ec2444c7

  • SSDEEP

    6144:uwcT8JFSLJZ9LZY4jZ5YBTohsD/TXyMnY/FQ+GCO:uVT8JFSFZ9L64jiohsD/7yh/FT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01c99fbbb5d50f074822c1708c8413e5.exe
    "C:\Users\Admin\AppData\Local\Temp\01c99fbbb5d50f074822c1708c8413e5.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Windows\SysWOW64\sysconf.exe
      C:\Windows\system32\sysconf.exe -meltserver "C:\Users\Admin\AppData\Local\Temp\01c99fbbb5d50f074822c1708c8413e5.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:804
      • C:\Windows\SysWOW64\sysconf.exe
        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\SysWOW64\sysconf.exe
          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:208
          • C:\Windows\SysWOW64\sysconf.exe
            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2372
            • C:\Windows\SysWOW64\sysconf.exe
              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:4860
              • C:\Windows\SysWOW64\sysconf.exe
                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:3992
                • C:\Windows\SysWOW64\sysconf.exe
                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                  8⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:1852
                  • C:\Windows\SysWOW64\sysconf.exe
                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:464
                    • C:\Windows\SysWOW64\sysconf.exe
                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                      10⤵
                        PID:5116
                        • C:\Windows\SysWOW64\sysconf.exe
                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                          11⤵
                            PID:4596
                            • C:\Windows\SysWOW64\sysconf.exe
                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                              12⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Suspicious use of WriteProcessMemory
                              PID:1872
                              • C:\Windows\SysWOW64\sysconf.exe
                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                13⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious use of WriteProcessMemory
                                PID:3624
                                • C:\Windows\SysWOW64\sysconf.exe
                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                  14⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious use of WriteProcessMemory
                                  PID:4656
                                  • C:\Windows\SysWOW64\sysconf.exe
                                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                    15⤵
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4436
                                    • C:\Windows\SysWOW64\sysconf.exe
                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                      16⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Suspicious use of WriteProcessMemory
                                      PID:4304
                                      • C:\Windows\SysWOW64\sysconf.exe
                                        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                        17⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1652
                                        • C:\Windows\SysWOW64\sysconf.exe
                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                          18⤵
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Suspicious use of WriteProcessMemory
                                          PID:460
                                          • C:\Windows\SysWOW64\sysconf.exe
                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                            19⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1180
                                            • C:\Windows\SysWOW64\sysconf.exe
                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                              20⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Suspicious use of WriteProcessMemory
                                              PID:1580
                                              • C:\Windows\SysWOW64\sysconf.exe
                                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                21⤵
                                                  PID:3476
                                                  • C:\Windows\SysWOW64\sysconf.exe
                                                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                    22⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2740
                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                      23⤵
                                                        PID:5116
                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                          24⤵
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          PID:4508
                                                          • C:\Windows\SysWOW64\sysconf.exe
                                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                            25⤵
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            PID:4824
                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                              26⤵
                                                                PID:3420
                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                  27⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  PID:3760
                                                                  • C:\Windows\SysWOW64\sysconf.exe
                                                                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                    28⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    PID:900
                                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                      29⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:4920
                                                                      • C:\Windows\SysWOW64\sysconf.exe
                                                                        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                        30⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        PID:1016
                                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                          31⤵
                                                                            PID:3476
                                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                              32⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              PID:732
                                                                              • C:\Windows\SysWOW64\sysconf.exe
                                                                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                33⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                PID:4468
                                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                  34⤵
                                                                                    PID:4384
                                                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                      35⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      PID:4960
                                                                                      • C:\Windows\SysWOW64\sysconf.exe
                                                                                        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                        36⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4596
                                                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                          37⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          PID:2544
                                                                                          • C:\Windows\SysWOW64\sysconf.exe
                                                                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                            38⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            PID:376
                                                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                              39⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in System32 directory
                                                                                              PID:1496
                                                                                              • C:\Windows\SysWOW64\sysconf.exe
                                                                                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                40⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in System32 directory
                                                                                                PID:3356
                                                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                  41⤵
                                                                                                    PID:4040
                                                                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                      42⤵
                                                                                                        PID:4976
                                                                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                          43⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in System32 directory
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3476
                                                                                                          • C:\Windows\SysWOW64\sysconf.exe
                                                                                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                            44⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:4056
                                                                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                              45⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4368
                                                                                                              • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                46⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5116
                                                                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                  47⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  PID:4384
                                                                                                                  • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                    48⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:4388
                                                                                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                      49⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      PID:5068
                                                                                                                      • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                        50⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in System32 directory
                                                                                                                        PID:4720
                                                                                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                          51⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:336
                                                                                                                          • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                            52⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in System32 directory
                                                                                                                            PID:876
                                                                                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                              53⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in System32 directory
                                                                                                                              PID:3740
                                                                                                                              • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                54⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in System32 directory
                                                                                                                                PID:5108
                                                                                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                  55⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  PID:2348
                                                                                                                                  • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                    56⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:4976
                                                                                                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                      57⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:5032
                                                                                                                                      • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                        58⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:3404
                                                                                                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                          59⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:4088
                                                                                                                                          • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                            60⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            PID:3420
                                                                                                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                              61⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:4472
                                                                                                                                              • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                62⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:728
                                                                                                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                  63⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  PID:4728
                                                                                                                                                  • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                    64⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:3416
                                                                                                                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                      65⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4040
                                                                                                                                                      • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                        66⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:3120
                                                                                                                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                          67⤵
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          PID:3036
                                                                                                                                                          • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                            68⤵
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            PID:2740
                                                                                                                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                              69⤵
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              PID:3612
                                                                                                                                                              • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                70⤵
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                PID:2612
                                                                                                                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                  71⤵
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  PID:4336
                                                                                                                                                                  • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                    C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                    72⤵
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    PID:5068
                                                                                                                                                                    • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                      C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                      73⤵
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      PID:4720
                                                                                                                                                                      • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                        C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                        74⤵
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        PID:3244
                                                                                                                                                                        • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                          C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                          75⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:336
                                                                                                                                                                          • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                            C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                            76⤵
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            PID:3740
                                                                                                                                                                            • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                              C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                              77⤵
                                                                                                                                                                                PID:3228
                                                                                                                                                                                • C:\Windows\SysWOW64\sysconf.exe
                                                                                                                                                                                  C:\Windows\system32\sysconf.exe -meltserver "C:\Windows\SysWOW64\sysconf.exe"
                                                                                                                                                                                  78⤵
                                                                                                                                                                                    PID:3332

                        Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          95KB

                          MD5

                          8eb870f771666a60433930ed7fe7c43a

                          SHA1

                          1949d62e0fb50dae24820873a7237ab5ff2686bb

                          SHA256

                          246c39cc35014aae0fe7e4d3976eff7f506572afddaf5140350408b5a8ab9526

                          SHA512

                          400755c107c61636dd41b13d620bb645295b72f2d269c072278d64df00c021a2dec146cbb55f0ba48c423640263453233f1654d0fd8120574c3dc4f9c02afbf2

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          101KB

                          MD5

                          31b9f5001494dd6480dc461fb16763d6

                          SHA1

                          a6ad253d94e2f204224f110870f1ca79a86a40f4

                          SHA256

                          c339be4c22673c0fced89e88a6f1151a9290026f551e5ad332d461b11d4d7808

                          SHA512

                          585ee17b6a16f036918e4f037e2f7fd7cbdf9761b61487408c9210bb592a010d9c72f3017c65879ef2950f9e6f0b0f239022fe1fa8a8aa3bd3d439b407f2dbbf

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          17KB

                          MD5

                          29fcb3d695ae720a188975db055fc1c6

                          SHA1

                          18873efadaa2ea4351072c029b374cd5f7c6ffd2

                          SHA256

                          5111eabc5e64488d6d6878d0457d6d0746933484dcdea22065640a6b57df0f0b

                          SHA512

                          e5a17897d90f65f925d8acf036987d15da1c33abf97a8d496d9073bba28abb78010976447c4e12cd2442b244bb1d201ec946cd2120179f4d0dcae97d8a1955bf

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          120KB

                          MD5

                          453a88c494e979889f566b2918c0fef1

                          SHA1

                          f87a64c6b2099d4d77264de397893878b4c954f4

                          SHA256

                          43efcb7ef02f05f637c8dc4c40bfe69097fc552659558fae77370463ed10fc4c

                          SHA512

                          9414f18e9e8ffe322de999c608dcf70bc82917b3bf1833258d83cc165288af964a3f341a4c44b6c5445823900e477dbd3845e91fe109b13e534b422dc07369ca

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          150KB

                          MD5

                          955d6812a8d480adf8c26388968329c7

                          SHA1

                          cf04546566bf2a591de83b5a85e80ffbc5c47643

                          SHA256

                          0239d9f55ed5c057a5a91e43f1dd6928690b8c415501d85d81c9f0fefc5cb244

                          SHA512

                          f2f116b3afe00ba5160019bcace1991f7de998a28e393841105575a83ec42b6115024adbf6689cd317522ff54fe1b79e0b575cd93a508b0bab4551436a94c9ec

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          124KB

                          MD5

                          b33e45c2f85339a6c6c9c3bf1168ba9d

                          SHA1

                          4d8c8bd2a12b58245e9adb9a8c3aab6ae7a59244

                          SHA256

                          3cee7d87c3e5631ca24493e26fe8f04402ce87b965dd0ccd8ba5e0bcfb7a50db

                          SHA512

                          2433d57dead11b8da76da2fdd5116db7d3e64a6adff9ce671cff84964fbb27379935e8473718a1b1e9c04af3f82e89b623fa78ba817afc38a7041344e154cf5c

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          85KB

                          MD5

                          8a8c454f8c73d606a90f22d849a89b3e

                          SHA1

                          1e26f89f9b198d735d5fd62714515d8f562d2684

                          SHA256

                          8f24b475e87caa3de7474127c6c575cd1f01d00c1818692f511012d835097723

                          SHA512

                          32a7203b50f20caae76cb397bbd314fb4598c41a152995c5c87ba08fc331b94a77a5efc70afb2bef345d56a0de4faa73e970344bc5aaa1f4a9ce4377b0acda0c

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          47KB

                          MD5

                          36e047118c1e83b8191a094470924ffb

                          SHA1

                          4627939b8f24e91c870c1097e5daca7ba1cb6ee7

                          SHA256

                          3b3f0410337b77a96e4d7a6a38d77b53f84f0352686588896f4f02e8e45dce31

                          SHA512

                          06ee859199152b073ce7a2cb3f8df0534bba745058495781409f270cabe646fd2e374a56186db16776f299b1d5666b23900eedf416afdcab390fe9b7205e374d

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          33KB

                          MD5

                          509037ec8493f1cec7e2a74bc6096491

                          SHA1

                          89fca34db4e7636274a4c814cf2cb7d6184ee33d

                          SHA256

                          4c26369aeb6055cc37caed38cf73615b49f808056a0b153e88b9a4a4a152d4b8

                          SHA512

                          a16a966da42e1f63c752f511d140579bc69f2926bf51327792f17dd497a62508a822f604f7dbfb8039b2e2ba4ff8b1703d48651f5f391e837613b071e64133e9

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          64KB

                          MD5

                          8dcb9d64f230d39f21e6bec14abb5268

                          SHA1

                          685d66b65996de44e473d0b960e0f6f8a4daf031

                          SHA256

                          1d6fad2ff63f8fdbab198f088d920cb15c579af9f02b7b1084a8098eeb348581

                          SHA512

                          a636e20a8d48329d6ea4684d3133e71c819f5dd80af5623f438cb35039faea33b65b8b4deb51acb653b9d3eb7e333b3e4167d990007bec890863f16a619c019c

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          65KB

                          MD5

                          dad2e3ad17943a6ab072dd0512f59a97

                          SHA1

                          582819bef28256e56917325e0e77100897b8fcb9

                          SHA256

                          f6deb3d808098aa29777b6b968a09ada06a35a883d1277cd9cbe276793f5ac62

                          SHA512

                          bcdb063e161203c4bba08a6f4d269a94381e626fae3694787e5efdfa4f44c7f4ef507b86c19e56ea2f3f26435dd6cd866befd0ac12a183d2084cac79ec874871

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          46KB

                          MD5

                          1f226e6404a5e5e52502ad59127b8ea5

                          SHA1

                          2ffd54a6976444d706e9198056c3a08db1214fe8

                          SHA256

                          82ea5e69c29f13114bd45c0e05253e33a19acf4443122a135226f777f726f86b

                          SHA512

                          306a2ddd87e9db70d027a4c20375e815090f1df3d4ccbebf05b1536e2d29112e988623d85e615046f290bdd9bf77e71a26ce35ba1bb7d46aa64cc690f8ae82c4

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          28KB

                          MD5

                          41a64ff69468b984191a42e2250fee85

                          SHA1

                          97ada5f426bb207b5df41475da7e6b16631eaadc

                          SHA256

                          2ce0afea5ae989ad893320a1c2788ef16af6f59375b11557e7c450ec163a5bff

                          SHA512

                          83283e41c3a6e072148cce8d869c0ba0f837b62684291d3b6d73172612e7b16f67cc0772e6a621bdb0a135e7add24d07cf9a165bc3dce8ecf16a65af07ebeb02

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          23KB

                          MD5

                          0fea6f2b1026aed8af765a85f726b042

                          SHA1

                          8f0bd353e14924d3272ad03000f0ef0ebeec79bc

                          SHA256

                          a41169f09c054cb1f067ff8fda7d65cf94565dfc09f791853d90468d929c8a5d

                          SHA512

                          af17700727946e622cee26ad52b900b4082f9a0a1893bbe28c62ba3cc6f0707fc16c89e4b50a1b8e3d20720e9b2db49419e0b06b568e524e8f1f3fb560d3d5fc

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          59KB

                          MD5

                          e3d991bd73bc0e0b328bcdd6ba0fb485

                          SHA1

                          40c6ab48b37dbdfe9745df02bd59ee9dab046d0b

                          SHA256

                          21ad404b567ea1f50a6d35dec350dbc9b3b6f05ded619be217d8501937b4f4da

                          SHA512

                          3625f28168bd3dd43e3ece4f60e1280543f8fc225f050e1cccdf0f89ddabe1f2a2ef6286d734d9202b6a1b629faca0abe82898606f2083295110ab900b3e60d6

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          31KB

                          MD5

                          0aa69079f6bf4e3fbe69d9544b72d107

                          SHA1

                          6053ef58f1852a2ead46b9152c4e9e6df8594af8

                          SHA256

                          d028b125ea8dee9762a1a9cf744f71255e6d1c776f1de725326599a6119396f8

                          SHA512

                          1cb82a2f0db3abb0ff98e71473b923f53e087cb02800471757d1f258ac7ab791ad1010ca32f54b306e77fc609a88dfeb886ce36f8aa1f53f6add167bd5d4ca58

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          92KB

                          MD5

                          11d20b26db378a718b42daa2d771b0aa

                          SHA1

                          d1ea7b26ad69c90d7e00ad200d1f4b9e9ea9cfd4

                          SHA256

                          984753b93dc3c48b207a5cbeeb4d1097cea4fd7f68e2fd983152aef7cb99d095

                          SHA512

                          da4ea3df3968a0f84fde1e18827ecff84964c167263352fd80bf4918cea21034e3465c66b048887c4275e92a23d90122bf4f695236584c0ab73518a8768ace2c

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          191KB

                          MD5

                          2ee927d88d4da6a48844b6c4107323b7

                          SHA1

                          cddc150518efb5e338efb725a856c2f15ddb2ae3

                          SHA256

                          967c2449bb9173ff5ccd1e16ce2bcc634c6867384dfbfd34ded3e723cb46ef27

                          SHA512

                          82d45a7c81b5611fb4b67c50541b052d0406dfbc806a12cb6652bf584a0a956421010c5e1e60505ef833a2cc1058ec262e0bb7fe894f3f32c22535da9b019075

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          125KB

                          MD5

                          712945c9ab62b7150ed3befc318af0d0

                          SHA1

                          ab727e22bdc7ad7935f6c4edead90498f2563045

                          SHA256

                          a52267a4a4b2e43c88f5e160d9fa6ff082f08260e2fed2d829a4aac5a615f2c9

                          SHA512

                          f6c54d84976f632d63a0adad816cef973647423c661b5fa4fa3803767e590e8baa7e276b81a6608d766c6044d133534de9b6d4f9ec9f4dd88251e8cf49f54540

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          249KB

                          MD5

                          c0dc9d5f0799f688c1d0d888814e454e

                          SHA1

                          bab6fc21f9d7537ff807054726e237d5aaa8d341

                          SHA256

                          0ec771edfb3822e0929c614e6ca1c4ecb158a13b8181f260fbb3d3149e663182

                          SHA512

                          a7510dce0c5c403ba6580df8d3562a2b55c0d1c9b1c1276a8ecf70d3a34cb7d0e2515bc88fd37b99afc93c04641869b685e8520fc4ba8741a3fc9e4162a996e2

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          17KB

                          MD5

                          e4455ffd41384ea2736b5ff35150695e

                          SHA1

                          7341600eb8f2a48658e826b72fab8ac9f25630e1

                          SHA256

                          fdc947c691a50cec74b64f99af9cd74c489e71b2501ec888f1bc03f92c19ec05

                          SHA512

                          6023fba688e8d25fc7d7eb2e1fb01f25bfda1c0c9de8b6c17d0d78c6e348471265c67a2341a3bcf1e135cdfdf2310b92d1bb6e6c7b44fe0675bb5ec83ac7d71d

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          108KB

                          MD5

                          9f27aaef34e2e9fbbf3d7a918346e2a9

                          SHA1

                          0ac8c2bf389d4e50a402f01c070cfd2ae496f96c

                          SHA256

                          2c5967081fd3e65140c05626249a79accef444fc10ef3b4001d886bf5d2bdf6c

                          SHA512

                          177fd3d3e73d12ceeca12b726f7ccd96ac6448ccf74ae12788a7cc45c5ea5343cf0f969fbe0ff07e5c19403c30422779c0654334cb5c8fd5d416b2c77b69414d

                        • C:\Windows\SysWOW64\sysconf.exe

                          Filesize

                          134KB

                          MD5

                          07282ef56759149b9b3c962f8a6739ab

                          SHA1

                          96d5ff4b1c4d506a3cda89ec4ad6efaf5911b81b

                          SHA256

                          a01f41fb6af8e586a5a2269e1b3a8a2516aa8470e3a28aed9b44559f9b8844a3

                          SHA512

                          abcc67357601b40d0e11ddac7400e8573c0e485cd672ecb69cfd6846e087014714be2cc0678e09747ffb0bc6d4386dc3f523f176e467e4d5852ad5383d22e444

                        • memory/208-12-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/208-14-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/376-104-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/460-53-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/464-29-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/464-27-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/732-89-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/732-87-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/804-8-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/804-6-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/900-79-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1016-83-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1180-55-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1580-58-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1580-56-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1652-49-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1652-51-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1852-24-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1852-26-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1872-35-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/1872-37-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/2372-15-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/2372-17-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/2536-9-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/2536-11-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/2544-102-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/2740-63-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3420-73-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3420-75-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3476-59-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3476-86-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3476-84-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3476-61-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3624-40-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3624-38-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3760-77-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3992-23-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/3992-21-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4304-46-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4304-48-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4384-94-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4384-92-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4436-45-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4468-91-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4508-67-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4508-69-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4596-34-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4596-32-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4596-98-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4596-100-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4656-41-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4656-43-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4784-4-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4784-0-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4824-72-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4824-70-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4860-20-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4860-18-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4920-81-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4960-95-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/4960-97-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/5116-66-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/5116-64-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB

                        • memory/5116-31-0x0000000000400000-0x0000000000446000-memory.dmp

                          Filesize

                          280KB