Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
cc4ba8817473517498cb3f02d70fdd60N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cc4ba8817473517498cb3f02d70fdd60N.exe
Resource
win10v2004-20240802-en
General
-
Target
cc4ba8817473517498cb3f02d70fdd60N.exe
-
Size
363KB
-
MD5
cc4ba8817473517498cb3f02d70fdd60
-
SHA1
29e4e7b61ee98f72efa5d649d964b30fc9986a6a
-
SHA256
d7dc538919b2d69267a7800324ee7144ddd7c00bf68c73b3edf201928a49bb6e
-
SHA512
330ba8332423e5b6e334c69d2442ea3634df766fc62afb33c35ac5b45890454622fcdcaae016408dde6b77079d308cfe8b7535d13c3e8824494a1043552eb38e
-
SSDEEP
6144:SFbqRq90Bgo8PCRKfeEeO4oZjec4HWsBpC+MgsxVl:4b8q90BgjhP6sjerChgu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3764 svchosts.exe 2056 svchosts.exe 1716 svchosts.exe 3152 svchosts.exe 3940 svchosts.exe 3120 svchosts.exe 624 svchosts.exe 956 svchosts.exe 2844 svchosts.exe 1932 svchosts.exe 552 svchosts.exe 1276 svchosts.exe 1624 svchosts.exe 4184 svchosts.exe 2920 svchosts.exe 632 svchosts.exe 1876 svchosts.exe 3552 svchosts.exe 4456 svchosts.exe 1880 svchosts.exe 3984 svchosts.exe 4896 svchosts.exe 3368 svchosts.exe 4548 svchosts.exe 3956 svchosts.exe 4556 svchosts.exe 4428 svchosts.exe 2332 svchosts.exe 216 svchosts.exe 1660 svchosts.exe 4376 svchosts.exe 1212 svchosts.exe 1668 svchosts.exe 2764 svchosts.exe 4688 svchosts.exe 3688 svchosts.exe 4532 svchosts.exe 4864 svchosts.exe 3236 svchosts.exe 4080 svchosts.exe 4788 svchosts.exe 2288 svchosts.exe 1276 svchosts.exe 724 svchosts.exe 4056 svchosts.exe 1732 svchosts.exe 2144 svchosts.exe 2416 svchosts.exe 2892 svchosts.exe 4844 svchosts.exe 1268 svchosts.exe 2656 svchosts.exe 4896 svchosts.exe 624 svchosts.exe 800 svchosts.exe 3148 svchosts.exe 2188 svchosts.exe 4972 svchosts.exe 3860 svchosts.exe 2164 svchosts.exe 4724 svchosts.exe 1916 svchosts.exe 3552 svchosts.exe 908 svchosts.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe Process not Found File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe File created C:\Windows\SysWOW64\svchosts.exe svchosts.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1292 2924 cc4ba8817473517498cb3f02d70fdd60N.exe 83 PID 2924 wrote to memory of 1292 2924 cc4ba8817473517498cb3f02d70fdd60N.exe 83 PID 2924 wrote to memory of 1292 2924 cc4ba8817473517498cb3f02d70fdd60N.exe 83 PID 1292 wrote to memory of 3764 1292 cmd.exe 85 PID 1292 wrote to memory of 3764 1292 cmd.exe 85 PID 1292 wrote to memory of 3764 1292 cmd.exe 85 PID 3764 wrote to memory of 2368 3764 svchosts.exe 86 PID 3764 wrote to memory of 2368 3764 svchosts.exe 86 PID 3764 wrote to memory of 2368 3764 svchosts.exe 86 PID 2368 wrote to memory of 2056 2368 cmd.exe 89 PID 2368 wrote to memory of 2056 2368 cmd.exe 89 PID 2368 wrote to memory of 2056 2368 cmd.exe 89 PID 2056 wrote to memory of 2416 2056 svchosts.exe 90 PID 2056 wrote to memory of 2416 2056 svchosts.exe 90 PID 2056 wrote to memory of 2416 2056 svchosts.exe 90 PID 2416 wrote to memory of 1716 2416 cmd.exe 92 PID 2416 wrote to memory of 1716 2416 cmd.exe 92 PID 2416 wrote to memory of 1716 2416 cmd.exe 92 PID 1716 wrote to memory of 4904 1716 svchosts.exe 94 PID 1716 wrote to memory of 4904 1716 svchosts.exe 94 PID 1716 wrote to memory of 4904 1716 svchosts.exe 94 PID 4904 wrote to memory of 3152 4904 cmd.exe 96 PID 4904 wrote to memory of 3152 4904 cmd.exe 96 PID 4904 wrote to memory of 3152 4904 cmd.exe 96 PID 3152 wrote to memory of 2020 3152 svchosts.exe 97 PID 3152 wrote to memory of 2020 3152 svchosts.exe 97 PID 3152 wrote to memory of 2020 3152 svchosts.exe 97 PID 2020 wrote to memory of 3940 2020 cmd.exe 99 PID 2020 wrote to memory of 3940 2020 cmd.exe 99 PID 2020 wrote to memory of 3940 2020 cmd.exe 99 PID 3940 wrote to memory of 2724 3940 svchosts.exe 101 PID 3940 wrote to memory of 2724 3940 svchosts.exe 101 PID 3940 wrote to memory of 2724 3940 svchosts.exe 101 PID 2724 wrote to memory of 3120 2724 cmd.exe 103 PID 2724 wrote to memory of 3120 2724 cmd.exe 103 PID 2724 wrote to memory of 3120 2724 cmd.exe 103 PID 3120 wrote to memory of 1940 3120 svchosts.exe 104 PID 3120 wrote to memory of 1940 3120 svchosts.exe 104 PID 3120 wrote to memory of 1940 3120 svchosts.exe 104 PID 1940 wrote to memory of 624 1940 cmd.exe 106 PID 1940 wrote to memory of 624 1940 cmd.exe 106 PID 1940 wrote to memory of 624 1940 cmd.exe 106 PID 624 wrote to memory of 4080 624 svchosts.exe 107 PID 624 wrote to memory of 4080 624 svchosts.exe 107 PID 624 wrote to memory of 4080 624 svchosts.exe 107 PID 4080 wrote to memory of 956 4080 cmd.exe 109 PID 4080 wrote to memory of 956 4080 cmd.exe 109 PID 4080 wrote to memory of 956 4080 cmd.exe 109 PID 956 wrote to memory of 4560 956 svchosts.exe 110 PID 956 wrote to memory of 4560 956 svchosts.exe 110 PID 956 wrote to memory of 4560 956 svchosts.exe 110 PID 4560 wrote to memory of 2844 4560 cmd.exe 112 PID 4560 wrote to memory of 2844 4560 cmd.exe 112 PID 4560 wrote to memory of 2844 4560 cmd.exe 112 PID 2844 wrote to memory of 4488 2844 svchosts.exe 113 PID 2844 wrote to memory of 4488 2844 svchosts.exe 113 PID 2844 wrote to memory of 4488 2844 svchosts.exe 113 PID 4488 wrote to memory of 1932 4488 cmd.exe 115 PID 4488 wrote to memory of 1932 4488 cmd.exe 115 PID 4488 wrote to memory of 1932 4488 cmd.exe 115 PID 1932 wrote to memory of 1828 1932 svchosts.exe 116 PID 1932 wrote to memory of 1828 1932 svchosts.exe 116 PID 1932 wrote to memory of 1828 1932 svchosts.exe 116 PID 1828 wrote to memory of 552 1828 cmd.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc4ba8817473517498cb3f02d70fdd60N.exe"C:\Users\Admin\AppData\Local\Temp\cc4ba8817473517498cb3f02d70fdd60N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe6⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe8⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe10⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe12⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe14⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:624 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe16⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe18⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe20⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe22⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe23⤵
- Executes dropped EXE
PID:552 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe24⤵PID:1920
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe25⤵
- Executes dropped EXE
PID:1276 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe26⤵PID:2444
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1624 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe28⤵PID:1548
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe29⤵
- Executes dropped EXE
PID:4184 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe30⤵PID:392
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe31⤵
- Executes dropped EXE
PID:2920 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe32⤵PID:4348
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe33⤵
- Executes dropped EXE
PID:632 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe34⤵
- System Location Discovery: System Language Discovery
PID:4568 -
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe35⤵
- Executes dropped EXE
PID:1876 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe36⤵PID:2144
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe37⤵
- Executes dropped EXE
PID:3552 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe38⤵PID:1908
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe39⤵
- Executes dropped EXE
PID:4456 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe40⤵PID:1832
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe41⤵
- Executes dropped EXE
PID:1880 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe42⤵PID:4692
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe43⤵
- Executes dropped EXE
PID:3984 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe44⤵PID:3580
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe45⤵
- Executes dropped EXE
PID:4896 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe46⤵PID:2780
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe47⤵
- Executes dropped EXE
PID:3368 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe48⤵PID:4248
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe49⤵
- Executes dropped EXE
PID:4548 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe50⤵PID:4996
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3956 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe52⤵PID:2844
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe53⤵
- Executes dropped EXE
PID:4556 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe54⤵PID:4228
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe55⤵
- Executes dropped EXE
PID:4428 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe56⤵PID:1700
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe57⤵
- Executes dropped EXE
PID:2332 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe58⤵PID:1980
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe59⤵
- Executes dropped EXE
PID:216 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe60⤵PID:2236
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1660 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe62⤵PID:836
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe63⤵
- Executes dropped EXE
PID:4376 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe64⤵PID:2208
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1212 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe66⤵PID:2064
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe67⤵
- Executes dropped EXE
PID:1668 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe68⤵PID:3336
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe69⤵
- Executes dropped EXE
PID:2764 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe70⤵PID:5008
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe71⤵
- Executes dropped EXE
PID:4688 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe72⤵PID:3696
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3688 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe74⤵PID:1784
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4532 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe76⤵
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:3368
-
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe77⤵
- Executes dropped EXE
PID:4864 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe78⤵PID:3772
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe79⤵
- Executes dropped EXE
PID:3236 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe80⤵PID:1616
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe81⤵
- Executes dropped EXE
PID:4080 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe82⤵PID:3116
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe83⤵
- Executes dropped EXE
PID:4788 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe84⤵PID:3860
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe85⤵
- Executes dropped EXE
PID:2288 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe86⤵PID:2704
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1276 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe88⤵PID:5048
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe89⤵
- Executes dropped EXE
PID:724 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe90⤵PID:4724
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe91⤵
- Executes dropped EXE
PID:4056 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe92⤵PID:1916
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1732 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe94⤵PID:4360
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2144 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe96⤵PID:796
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe97⤵
- Executes dropped EXE
PID:2416 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe98⤵PID:1716
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe99⤵
- Executes dropped EXE
PID:2892 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe100⤵PID:4480
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe101⤵
- Executes dropped EXE
PID:4844 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe102⤵PID:3940
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe103⤵
- Executes dropped EXE
PID:1268 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe104⤵PID:1100
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2656 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe106⤵PID:2768
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe107⤵
- Executes dropped EXE
PID:4896 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe108⤵PID:3980
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe109⤵
- Executes dropped EXE
PID:624 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe110⤵PID:4492
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe111⤵
- Executes dropped EXE
PID:800 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe112⤵PID:3772
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe113⤵
- Executes dropped EXE
PID:3148 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe114⤵PID:1616
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe115⤵
- Executes dropped EXE
PID:2188 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe116⤵PID:3032
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe117⤵
- Executes dropped EXE
PID:4972 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe118⤵PID:1748
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe119⤵
- Executes dropped EXE
PID:3860 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe120⤵PID:1204
-
C:\WINDOWS\SysWOW64\svchosts.exeC:\WINDOWS\system32\svchosts.exe121⤵
- Executes dropped EXE
PID:2164 -
C:\WINDOWS\SysWOW64\cmd.execmd.exe /c C:\WINDOWS\system32\svchosts.exe122⤵PID:552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-