Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
16d21f6bd48d0425a8d1e4fd0059b45c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
16d21f6bd48d0425a8d1e4fd0059b45c.exe
Resource
win10v2004-20231215-en
General
-
Target
16d21f6bd48d0425a8d1e4fd0059b45c.exe
-
Size
38KB
-
MD5
16d21f6bd48d0425a8d1e4fd0059b45c
-
SHA1
7cd44841eddb746946ba301613025dc092b2159d
-
SHA256
545c25bdd6d1a9cb3974974104bde506601c1e5738983869411897b91e6c0a24
-
SHA512
e48e126cde844e017d4e461b916207ba0fcb29c8d38b2cc2ae14349e741ee328f6c3c957abfac0369ff675a44a8f80e6778f627711079f79610535ce9b7a5ab9
-
SSDEEP
768:IkFZ0VdXeMaWDoOEN58MVkSJS0S0JEzuXCZWM+N1:IkUDXeM3pMTdS0GzuXAWM+N1
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 30 IoCs
resource yara_rule behavioral2/memory/4988-13-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/2032-17-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4664-19-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/440-21-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4852-24-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/1524-27-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/2584-29-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4928-32-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/972-35-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4632-37-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/1360-41-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/3588-43-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/5048-45-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/3096-48-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/2464-51-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4088-52-0x0000000002030000-0x0000000002130000-memory.dmp modiloader_stage2 behavioral2/memory/2740-56-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4504-54-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/2044-60-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/1632-63-0x0000000002030000-0x0000000002130000-memory.dmp modiloader_stage2 behavioral2/memory/3700-61-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4088-67-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/4388-71-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/2280-75-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/1632-79-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/3228-81-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/2964-85-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/1172-89-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/5084-93-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 behavioral2/memory/368-96-0x0000000000400000-0x0000000000425000-memory.dmp modiloader_stage2 -
Executes dropped EXE 64 IoCs
pid Process 2032 svvosts.exe 4664 svvosts.exe 440 svvosts.exe 4852 svvosts.exe 1524 svvosts.exe 2584 svvosts.exe 4928 svvosts.exe 972 svvosts.exe 4632 svvosts.exe 1360 svvosts.exe 3588 svvosts.exe 5048 svvosts.exe 3096 svvosts.exe 2464 svvosts.exe 4504 svvosts.exe 2740 svvosts.exe 2044 svvosts.exe 3700 svvosts.exe 4088 svvosts.exe 4388 svvosts.exe 2280 svvosts.exe 1632 svvosts.exe 3228 svvosts.exe 2964 svvosts.exe 1172 svvosts.exe 5084 svvosts.exe 368 svvosts.exe 4280 svvosts.exe 5032 svvosts.exe 1864 svvosts.exe 844 svvosts.exe 4764 svvosts.exe 4924 svvosts.exe 208 svvosts.exe 4292 svvosts.exe 2024 svvosts.exe 2120 svvosts.exe 3748 svvosts.exe 4980 svvosts.exe 1496 svvosts.exe 4740 svvosts.exe 1792 svvosts.exe 1536 svvosts.exe 4312 svvosts.exe 1736 svvosts.exe 4788 svvosts.exe 1532 svvosts.exe 3088 svvosts.exe 944 svvosts.exe 2020 svvosts.exe 4288 svvosts.exe 4344 svvosts.exe 4264 svvosts.exe 5076 svvosts.exe 5116 svvosts.exe 1348 svvosts.exe 4540 svvosts.exe 1156 svvosts.exe 3944 svvosts.exe 3300 svvosts.exe 4784 svvosts.exe 3172 svvosts.exe 3528 svvosts.exe 3468 svvosts.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File created C:\Windows\SysWOW64\svvosts.exe svvosts.exe File opened for modification C:\Windows\SysWOW64\$$a.bat svvosts.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 2032 4988 16d21f6bd48d0425a8d1e4fd0059b45c.exe 91 PID 4988 wrote to memory of 2032 4988 16d21f6bd48d0425a8d1e4fd0059b45c.exe 91 PID 4988 wrote to memory of 2032 4988 16d21f6bd48d0425a8d1e4fd0059b45c.exe 91 PID 2032 wrote to memory of 4664 2032 svvosts.exe 93 PID 2032 wrote to memory of 4664 2032 svvosts.exe 93 PID 2032 wrote to memory of 4664 2032 svvosts.exe 93 PID 4664 wrote to memory of 440 4664 svvosts.exe 94 PID 4664 wrote to memory of 440 4664 svvosts.exe 94 PID 4664 wrote to memory of 440 4664 svvosts.exe 94 PID 440 wrote to memory of 4852 440 svvosts.exe 96 PID 440 wrote to memory of 4852 440 svvosts.exe 96 PID 440 wrote to memory of 4852 440 svvosts.exe 96 PID 4852 wrote to memory of 1524 4852 svvosts.exe 97 PID 4852 wrote to memory of 1524 4852 svvosts.exe 97 PID 4852 wrote to memory of 1524 4852 svvosts.exe 97 PID 1524 wrote to memory of 2584 1524 svvosts.exe 98 PID 1524 wrote to memory of 2584 1524 svvosts.exe 98 PID 1524 wrote to memory of 2584 1524 svvosts.exe 98 PID 2584 wrote to memory of 4928 2584 svvosts.exe 99 PID 2584 wrote to memory of 4928 2584 svvosts.exe 99 PID 2584 wrote to memory of 4928 2584 svvosts.exe 99 PID 4928 wrote to memory of 972 4928 svvosts.exe 100 PID 4928 wrote to memory of 972 4928 svvosts.exe 100 PID 4928 wrote to memory of 972 4928 svvosts.exe 100 PID 972 wrote to memory of 4632 972 svvosts.exe 101 PID 972 wrote to memory of 4632 972 svvosts.exe 101 PID 972 wrote to memory of 4632 972 svvosts.exe 101 PID 4632 wrote to memory of 1360 4632 svvosts.exe 102 PID 4632 wrote to memory of 1360 4632 svvosts.exe 102 PID 4632 wrote to memory of 1360 4632 svvosts.exe 102 PID 1360 wrote to memory of 3588 1360 svvosts.exe 103 PID 1360 wrote to memory of 3588 1360 svvosts.exe 103 PID 1360 wrote to memory of 3588 1360 svvosts.exe 103 PID 3588 wrote to memory of 5048 3588 svvosts.exe 104 PID 3588 wrote to memory of 5048 3588 svvosts.exe 104 PID 3588 wrote to memory of 5048 3588 svvosts.exe 104 PID 5048 wrote to memory of 3096 5048 svvosts.exe 105 PID 5048 wrote to memory of 3096 5048 svvosts.exe 105 PID 5048 wrote to memory of 3096 5048 svvosts.exe 105 PID 3096 wrote to memory of 2464 3096 svvosts.exe 106 PID 3096 wrote to memory of 2464 3096 svvosts.exe 106 PID 3096 wrote to memory of 2464 3096 svvosts.exe 106 PID 2464 wrote to memory of 4504 2464 svvosts.exe 107 PID 2464 wrote to memory of 4504 2464 svvosts.exe 107 PID 2464 wrote to memory of 4504 2464 svvosts.exe 107 PID 4504 wrote to memory of 2740 4504 svvosts.exe 108 PID 4504 wrote to memory of 2740 4504 svvosts.exe 108 PID 4504 wrote to memory of 2740 4504 svvosts.exe 108 PID 2740 wrote to memory of 2044 2740 svvosts.exe 109 PID 2740 wrote to memory of 2044 2740 svvosts.exe 109 PID 2740 wrote to memory of 2044 2740 svvosts.exe 109 PID 2044 wrote to memory of 3700 2044 svvosts.exe 110 PID 2044 wrote to memory of 3700 2044 svvosts.exe 110 PID 2044 wrote to memory of 3700 2044 svvosts.exe 110 PID 3700 wrote to memory of 4088 3700 svvosts.exe 111 PID 3700 wrote to memory of 4088 3700 svvosts.exe 111 PID 3700 wrote to memory of 4088 3700 svvosts.exe 111 PID 4088 wrote to memory of 4388 4088 svvosts.exe 112 PID 4088 wrote to memory of 4388 4088 svvosts.exe 112 PID 4088 wrote to memory of 4388 4088 svvosts.exe 112 PID 4388 wrote to memory of 2280 4388 svvosts.exe 113 PID 4388 wrote to memory of 2280 4388 svvosts.exe 113 PID 4388 wrote to memory of 2280 4388 svvosts.exe 113 PID 2280 wrote to memory of 1632 2280 svvosts.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\16d21f6bd48d0425a8d1e4fd0059b45c.exe"C:\Users\Admin\AppData\Local\Temp\16d21f6bd48d0425a8d1e4fd0059b45c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1632 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe24⤵
- Executes dropped EXE
PID:3228 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe25⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe26⤵
- Executes dropped EXE
PID:1172 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5084 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:368 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe29⤵
- Executes dropped EXE
PID:4280 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe30⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1864 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:844 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe33⤵
- Executes dropped EXE
PID:4764 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4924 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe35⤵
- Executes dropped EXE
PID:208 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe36⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe37⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe38⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3748 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe40⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4740 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe43⤵
- Executes dropped EXE
PID:1792 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe44⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe45⤵
- Executes dropped EXE
PID:4312 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1736 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe47⤵
- Executes dropped EXE
PID:4788 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe48⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3088 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe50⤵
- Executes dropped EXE
PID:944 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe51⤵
- Executes dropped EXE
PID:2020 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe52⤵
- Executes dropped EXE
PID:4288 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe53⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe54⤵
- Executes dropped EXE
PID:4264 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5076 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe56⤵
- Executes dropped EXE
PID:5116 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe57⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4540 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe59⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe60⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe61⤵
- Executes dropped EXE
PID:3300 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4784 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe63⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe64⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe65⤵
- Executes dropped EXE
PID:3468 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe66⤵PID:1380
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe67⤵
- Drops file in System32 directory
PID:3580 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe68⤵PID:1952
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe69⤵PID:516
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe70⤵
- Drops file in System32 directory
PID:4728 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe71⤵PID:2744
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe72⤵PID:3980
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe73⤵
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe74⤵PID:4984
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe75⤵PID:3616
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe76⤵
- Drops file in System32 directory
PID:216 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe77⤵
- Drops file in System32 directory
PID:1576 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe78⤵PID:5180
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe79⤵
- Drops file in System32 directory
PID:5268 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe80⤵
- Drops file in System32 directory
PID:5320 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe81⤵PID:5360
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe82⤵PID:5392
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe83⤵PID:5420
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe84⤵
- Drops file in System32 directory
PID:5448 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe85⤵PID:5472
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe86⤵PID:5500
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe87⤵
- Drops file in System32 directory
PID:5532 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe88⤵
- Drops file in System32 directory
PID:5568 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe89⤵PID:5832
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe90⤵PID:5992
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe91⤵PID:6120
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe92⤵PID:540
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe93⤵PID:2524
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe94⤵PID:2464
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe95⤵PID:3592
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe96⤵PID:3124
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe97⤵
- Drops file in System32 directory
PID:2228 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe98⤵PID:5720
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe99⤵PID:4188
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe100⤵
- Drops file in System32 directory
PID:5896 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe101⤵PID:3724
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe102⤵PID:6184
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe103⤵PID:6276
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe104⤵PID:6340
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe105⤵PID:6424
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe106⤵PID:6556
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe107⤵PID:6648
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe108⤵
- Drops file in System32 directory
PID:6732 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe109⤵PID:6788
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe110⤵
- Drops file in System32 directory
PID:6840 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe111⤵PID:6872
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe112⤵
- Drops file in System32 directory
PID:6896 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe113⤵PID:6976
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe114⤵PID:6996
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe115⤵PID:7020
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe116⤵PID:7040
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe117⤵
- Drops file in System32 directory
PID:7124 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe118⤵PID:4056
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe119⤵
- Drops file in System32 directory
PID:3100 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe120⤵
- Drops file in System32 directory
PID:6540 -
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe121⤵PID:6700
-
C:\Windows\SysWOW64\svvosts.exeC:\Windows\system32\svvosts.exe122⤵
- Drops file in System32 directory
PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-