So let's look at one last thing.
I'm going to jump to the image,
and what this is basically going to do is just take us to the directory
where that is because I want to show you one last thing.
So this is the directory where TrickBot is.
We see our executable, which we saw before.
We see an INI file,
and this is a file that TrickBot uses to generate the
host-based key for each system.
Fortunately,
we're going to use a tool later on that will just generate the key for us.
And more importantly, there's this data directory,
and if we go in here, you see that it's being populated with files,
and each of these files, these are the modules that TrickBot downloads.
Again,
we're doing this on Windows 7 because it will actually
download them to disk on Windows 7.
On Windows 10, it will not.
It will just keep them in memory.
(Aaron) Right, they go in the memory.
So here's the physical manifestation of the files that were --- Oh,
it just downloaded another one.
(Tyler) Yeah, so if we jump over to Process Explorer,
we can probably, yeah, you can see a bunch of different svchosts now being run.
These are all of the different modules that TrickBot is running.
So it's doing a bunch of stuff to the system right now.
(Aaron) So each module's going to start up underneath svchost, as well.
(Tyler) Yeah, yeah, absolutely.