Analysis
-
max time kernel
107s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
Seven.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
Seven.exe
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
Seven.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
Seven.exe
Resource
win11-20240419-en
General
-
Target
Seven.exe
-
Size
139KB
-
MD5
350273e0d2e8a9ba5e37b791016112a0
-
SHA1
5bfb616dd46f67d1dcbbff55ca5917ffc1ec8b71
-
SHA256
27297bf8139bea755e9297e7e1489d827d1ee09a8e1d94a3ef96a2edb2de61ba
-
SHA512
b1e768524b4e840bd5f4163205122dd1725583245d8bfd5cbd89eb21a5fb9d33aff1b7b0ca42132b7dae469e025068ae663b3b02ad59927a558dc340141ec91b
-
SSDEEP
3072:miS4omp03WQthI/9S3BZi08iRQ1G78IVn27bSfcJd8ltw:miS4ompB9S3BZi0a1G78IVhcTct
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" Seven.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Renames multiple (261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocks application from running via registry modification 1 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Seven.exe -
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" Seven.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Winhost.exe -
Deletes itself 1 IoCs
pid Process 1380 Winhost.exe -
Executes dropped EXE 64 IoCs
pid Process 1380 Winhost.exe 2816 Winhost.exe 4188 Winhost.exe 3392 Winhost.exe 4300 Winhost.exe 3216 Winhost.exe 2820 Winhost.exe 3132 Winhost.exe 2832 Winhost.exe 1464 Winhost.exe 2096 Winhost.exe 4812 Winhost.exe 4384 Winhost.exe 3808 Winhost.exe 4120 Winhost.exe 1784 Winhost.exe 3976 Winhost.exe 5056 Winhost.exe 4440 Winhost.exe 1704 Winhost.exe 1468 Winhost.exe 4952 Winhost.exe 1504 Winhost.exe 3172 Winhost.exe 1980 Winhost.exe 4224 Winhost.exe 1700 Winhost.exe 1908 Winhost.exe 5072 Winhost.exe 2072 Winhost.exe 3716 Winhost.exe 1468 Winhost.exe 4816 Winhost.exe 2940 Winhost.exe 1980 Winhost.exe 2820 Winhost.exe 2360 Winhost.exe 1604 Winhost.exe 4024 Winhost.exe 5012 Winhost.exe 4364 Winhost.exe 3792 Winhost.exe 2212 Winhost.exe 4232 Winhost.exe 1644 Winhost.exe 464 Winhost.exe 5060 Winhost.exe 4356 Winhost.exe 936 Winhost.exe 3160 Winhost.exe 2848 Winhost.exe 1204 Winhost.exe 2040 Winhost.exe 4512 Winhost.exe 3704 Winhost.exe 3596 Winhost.exe 3928 Winhost.exe 4308 Winhost.exe 2956 Winhost.exe 2376 Winhost.exe 4564 Winhost.exe 4364 Winhost.exe 876 Winhost.exe 2108 Winhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Seven.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua Seven.exe -
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini Winhost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Winhost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Winhost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Winhost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini Winhost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Winhost.exe File opened for modification C:\Users\Admin\Music\desktop.ini Winhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com 4 raw.githubusercontent.com 5 raw.githubusercontent.com -
Drops file in System32 directory 57 IoCs
description ioc Process File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File opened for modification C:\Windows\System32\Winhost.exe cmd.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File opened for modification C:\Windows\System32\Winhost.exe attrib.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File opened for modification C:\Windows\System32\Seven.dll cmd.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\System32\Seven.runtimeconfig.json cmd.exe File opened for modification C:\Windows\System32\Seven.runtimeconfig.json cmd.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File opened for modification C:\Windows\System32\Seven.dll attrib.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\System32\Winhost.exe cmd.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\System32\Seven.dll cmd.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File opened for modification C:\Windows\System32\Seven.runtimeconfig.json attrib.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe File created C:\Windows\system32\EncryptedLog.txt Winhost.exe File created C:\Windows\system32\KeyAndIV.txt Winhost.exe -
Sets desktop wallpaper using registry 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmprvzlsr.tmp" Winhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmppnxohl.tmp" Winhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp0gelnm.tmp" Winhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp5ke1pm.tmp" Seven.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3fxlvh.tmp" Winhost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3196 powershell.exe 3196 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3196 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3196 4864 Seven.exe 87 PID 4864 wrote to memory of 3196 4864 Seven.exe 87 PID 4864 wrote to memory of 3080 4864 Seven.exe 89 PID 4864 wrote to memory of 3080 4864 Seven.exe 89 PID 4864 wrote to memory of 1912 4864 Seven.exe 90 PID 4864 wrote to memory of 1912 4864 Seven.exe 90 PID 4864 wrote to memory of 3104 4864 Seven.exe 91 PID 4864 wrote to memory of 3104 4864 Seven.exe 91 PID 4864 wrote to memory of 2536 4864 Seven.exe 92 PID 4864 wrote to memory of 2536 4864 Seven.exe 92 PID 4864 wrote to memory of 640 4864 Seven.exe 93 PID 4864 wrote to memory of 640 4864 Seven.exe 93 PID 4864 wrote to memory of 3132 4864 Seven.exe 94 PID 4864 wrote to memory of 3132 4864 Seven.exe 94 PID 4864 wrote to memory of 5004 4864 Seven.exe 95 PID 4864 wrote to memory of 5004 4864 Seven.exe 95 PID 4864 wrote to memory of 3976 4864 Seven.exe 96 PID 4864 wrote to memory of 3976 4864 Seven.exe 96 PID 4864 wrote to memory of 3868 4864 Seven.exe 97 PID 4864 wrote to memory of 3868 4864 Seven.exe 97 PID 4864 wrote to memory of 2796 4864 Seven.exe 98 PID 4864 wrote to memory of 2796 4864 Seven.exe 98 PID 4864 wrote to memory of 4240 4864 Seven.exe 99 PID 4864 wrote to memory of 4240 4864 Seven.exe 99 PID 4864 wrote to memory of 1552 4864 Seven.exe 100 PID 4864 wrote to memory of 1552 4864 Seven.exe 100 PID 4864 wrote to memory of 4880 4864 Seven.exe 101 PID 4864 wrote to memory of 4880 4864 Seven.exe 101 PID 4864 wrote to memory of 5036 4864 Seven.exe 102 PID 4864 wrote to memory of 5036 4864 Seven.exe 102 PID 1552 wrote to memory of 4260 1552 cmd.exe 103 PID 1552 wrote to memory of 4260 1552 cmd.exe 103 PID 2536 wrote to memory of 2260 2536 cmd.exe 104 PID 2536 wrote to memory of 2260 2536 cmd.exe 104 PID 4880 wrote to memory of 4924 4880 cmd.exe 105 PID 4880 wrote to memory of 4924 4880 cmd.exe 105 PID 4240 wrote to memory of 2164 4240 cmd.exe 106 PID 4240 wrote to memory of 2164 4240 cmd.exe 106 PID 5036 wrote to memory of 1380 5036 cmd.exe 107 PID 5036 wrote to memory of 1380 5036 cmd.exe 107 PID 640 wrote to memory of 3612 640 cmd.exe 109 PID 640 wrote to memory of 3612 640 cmd.exe 109 PID 2796 wrote to memory of 636 2796 cmd.exe 108 PID 2796 wrote to memory of 636 2796 cmd.exe 108 PID 1380 wrote to memory of 2816 1380 Winhost.exe 111 PID 1380 wrote to memory of 2816 1380 Winhost.exe 111 PID 2816 wrote to memory of 4188 2816 Winhost.exe 114 PID 2816 wrote to memory of 4188 2816 Winhost.exe 114 PID 4188 wrote to memory of 3392 4188 Winhost.exe 116 PID 4188 wrote to memory of 3392 4188 Winhost.exe 116 PID 3392 wrote to memory of 4300 3392 Winhost.exe 118 PID 3392 wrote to memory of 4300 3392 Winhost.exe 118 PID 4300 wrote to memory of 3216 4300 Winhost.exe 120 PID 4300 wrote to memory of 3216 4300 Winhost.exe 120 PID 3216 wrote to memory of 2820 3216 Winhost.exe 122 PID 3216 wrote to memory of 2820 3216 Winhost.exe 122 PID 2820 wrote to memory of 3132 2820 Winhost.exe 124 PID 2820 wrote to memory of 3132 2820 Winhost.exe 124 PID 3132 wrote to memory of 2832 3132 Winhost.exe 126 PID 3132 wrote to memory of 2832 3132 Winhost.exe 126 PID 2832 wrote to memory of 1464 2832 Winhost.exe 128 PID 2832 wrote to memory of 1464 2832 Winhost.exe 128 PID 1464 wrote to memory of 2096 1464 Winhost.exe 130 PID 1464 wrote to memory of 2096 1464 Winhost.exe 130 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLua = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" Seven.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "1" Seven.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 6 IoCs
pid Process 4924 attrib.exe 2260 attrib.exe 4260 attrib.exe 3612 attrib.exe 636 attrib.exe 2164 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Seven.exe"C:\Users\Admin\AppData\Local\Temp\Seven.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Admin\AppData\Local\Temp\Winhost.exe2⤵PID:3080
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Windows\System32\Winhost.exe2⤵
- Drops file in System32 directory
PID:1912
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.exe C:\Users\Public\Documents\Winhost.exe2⤵PID:3104
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Winhost.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Winhost.exe3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:2260
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Users\Public\Documents\Winhost.exe2⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\system32\attrib.exeattrib +h C:\Users\Public\Documents\Winhost.exe3⤵
- Views/modifies file attributes
PID:3612
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Windows\System32\Seven.dll2⤵
- Drops file in System32 directory
PID:3132
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.dll C:\Users\Public\Documents\Seven.dll2⤵PID:5004
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Drops file in System32 directory
PID:3976
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C copy C:\Users\Admin\AppData\Local\Temp\Seven.runtimeconfig.json C:\Users\Public\Documents\Seven.runtimeconfig.json2⤵PID:3868
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.dll3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:636
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Windows\System32\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\system32\attrib.exeattrib +h C:\Windows\System32\Seven.runtimeconfig.json3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:2164
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Users\Public\Documents\Seven.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\system32\attrib.exeattrib +h C:\Users\Public\Documents\Seven.dll3⤵
- Views/modifies file attributes
PID:4260
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C attrib +h C:\Users\Public\Documents\Seven.runtimeconfig.json2⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\system32\attrib.exeattrib +h C:\Users\Public\Documents\Seven.runtimeconfig.json3⤵
- Views/modifies file attributes
PID:4924
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C start C:\Users\Admin\AppData\Local\Temp\Winhost.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exeC:\Users\Admin\AppData\Local\Temp\Winhost.exe3⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"14⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"15⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"16⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"18⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"19⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"22⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"24⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"25⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"29⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"30⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"31⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"32⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"33⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"36⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"37⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"39⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"41⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"42⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"44⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"49⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"50⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"51⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"52⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"54⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"55⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"57⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"59⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"60⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"61⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
PID:2376 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:936
-
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"63⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"64⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"66⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"67⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"68⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"69⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"70⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"71⤵
- Checks computer location settings
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"72⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"73⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"74⤵
- Checks computer location settings
PID:808 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"75⤵
- Checks computer location settings
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"76⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"77⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"78⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"79⤵
- Checks computer location settings
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"80⤵
- Checks computer location settings
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"81⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"82⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"83⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"84⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"85⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"86⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"87⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"88⤵
- Checks computer location settings
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"89⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"90⤵
- Checks computer location settings
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"91⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"92⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"93⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"94⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"95⤵
- Checks computer location settings
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"96⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"97⤵
- Checks computer location settings
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"98⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"99⤵
- Checks computer location settings
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"100⤵
- Checks computer location settings
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"101⤵
- Checks computer location settings
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"102⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"103⤵
- Checks computer location settings
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"104⤵
- Checks computer location settings
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"105⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"106⤵
- Checks computer location settings
PID:368 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"107⤵
- Checks computer location settings
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"108⤵
- Checks computer location settings
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"109⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"110⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"111⤵
- Checks computer location settings
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"112⤵
- Checks computer location settings
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"113⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"114⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"115⤵
- Checks computer location settings
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"116⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"117⤵
- Checks computer location settings
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"118⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"119⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"120⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"121⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\Winhost.exe"C:\Users\Admin\AppData\Local\Temp\Winhost.exe"122⤵
- Checks computer location settings
PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-