Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 11:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40ca3bdb93a3335c18f3b5d316aa101a.exe
Resource
win7-20231215-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
40ca3bdb93a3335c18f3b5d316aa101a.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
40ca3bdb93a3335c18f3b5d316aa101a.exe
-
Size
192KB
-
MD5
40ca3bdb93a3335c18f3b5d316aa101a
-
SHA1
3524b4d97028b0941fea1c4f4569c5214e814f52
-
SHA256
d3ec5734dbfb2f7233f9b152599eccbb8a7badc565bcb4a23bc242be709f74e9
-
SHA512
5a1cc8973132aa81527531a029a85d9b13cf05bcc5657aa8c391058ce756780a7954b0a1811f086a3c2388c54d9a0b14b623587755b24b2555878c7ba7db2bfe
-
SSDEEP
3072:mKb5zN9u8StaSRnYkOlzbG9/ZZADT7ONPGzXwTFKEGC2FovgiLfsuEnUooTpgO:md4ShcGhZ+T74PZFLMFUgiLPEUtFgO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4256 commserv.exe 1508 commserv.exe 1912 commserv.exe 2320 commserv.exe 3772 commserv.exe 5020 commserv.exe 5060 commserv.exe 2652 commserv.exe 4772 commserv.exe 4612 commserv.exe 2228 commserv.exe 5036 commserv.exe 2480 commserv.exe 1564 commserv.exe 3116 commserv.exe 4224 commserv.exe 4928 commserv.exe 2692 commserv.exe 4844 commserv.exe 3008 commserv.exe 4616 commserv.exe 4480 commserv.exe 4504 commserv.exe 4184 commserv.exe 4812 commserv.exe 1448 commserv.exe 3292 commserv.exe 3316 commserv.exe 3624 commserv.exe 1888 commserv.exe 2116 commserv.exe 4264 commserv.exe 2428 commserv.exe 4776 commserv.exe 4788 commserv.exe 4744 commserv.exe 396 commserv.exe 3316 commserv.exe 412 commserv.exe 2688 commserv.exe 1504 commserv.exe 1196 commserv.exe 2724 commserv.exe 952 commserv.exe 4788 commserv.exe 4848 commserv.exe 2936 commserv.exe 2632 commserv.exe 4584 commserv.exe 3412 commserv.exe 2232 commserv.exe 5044 commserv.exe 4496 commserv.exe 3672 commserv.exe 1848 commserv.exe 4368 commserv.exe 1904 commserv.exe 2524 commserv.exe 400 commserv.exe 3076 commserv.exe 1564 commserv.exe 3160 commserv.exe 2020 commserv.exe 1536 commserv.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File created C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\accwiz.bin commserv.exe File opened for modification C:\Windows\SysWOW64\commserv.exe 40ca3bdb93a3335c18f3b5d316aa101a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3324 wrote to memory of 400 3324 40ca3bdb93a3335c18f3b5d316aa101a.exe 90 PID 3324 wrote to memory of 400 3324 40ca3bdb93a3335c18f3b5d316aa101a.exe 90 PID 3324 wrote to memory of 400 3324 40ca3bdb93a3335c18f3b5d316aa101a.exe 90 PID 400 wrote to memory of 3024 400 40ca3bdb93a3335c18f3b5d316aa101a.exe 95 PID 400 wrote to memory of 3024 400 40ca3bdb93a3335c18f3b5d316aa101a.exe 95 PID 400 wrote to memory of 3024 400 40ca3bdb93a3335c18f3b5d316aa101a.exe 95 PID 3024 wrote to memory of 4160 3024 40ca3bdb93a3335c18f3b5d316aa101a.exe 98 PID 3024 wrote to memory of 4160 3024 40ca3bdb93a3335c18f3b5d316aa101a.exe 98 PID 3024 wrote to memory of 4160 3024 40ca3bdb93a3335c18f3b5d316aa101a.exe 98 PID 4160 wrote to memory of 2232 4160 40ca3bdb93a3335c18f3b5d316aa101a.exe 100 PID 4160 wrote to memory of 2232 4160 40ca3bdb93a3335c18f3b5d316aa101a.exe 100 PID 4160 wrote to memory of 2232 4160 40ca3bdb93a3335c18f3b5d316aa101a.exe 100 PID 2232 wrote to memory of 868 2232 40ca3bdb93a3335c18f3b5d316aa101a.exe 104 PID 2232 wrote to memory of 868 2232 40ca3bdb93a3335c18f3b5d316aa101a.exe 104 PID 2232 wrote to memory of 868 2232 40ca3bdb93a3335c18f3b5d316aa101a.exe 104 PID 868 wrote to memory of 1020 868 40ca3bdb93a3335c18f3b5d316aa101a.exe 108 PID 868 wrote to memory of 1020 868 40ca3bdb93a3335c18f3b5d316aa101a.exe 108 PID 868 wrote to memory of 1020 868 40ca3bdb93a3335c18f3b5d316aa101a.exe 108 PID 1020 wrote to memory of 4360 1020 40ca3bdb93a3335c18f3b5d316aa101a.exe 110 PID 1020 wrote to memory of 4360 1020 40ca3bdb93a3335c18f3b5d316aa101a.exe 110 PID 1020 wrote to memory of 4360 1020 40ca3bdb93a3335c18f3b5d316aa101a.exe 110 PID 4360 wrote to memory of 1672 4360 40ca3bdb93a3335c18f3b5d316aa101a.exe 112 PID 4360 wrote to memory of 1672 4360 40ca3bdb93a3335c18f3b5d316aa101a.exe 112 PID 4360 wrote to memory of 1672 4360 40ca3bdb93a3335c18f3b5d316aa101a.exe 112 PID 1672 wrote to memory of 4552 1672 40ca3bdb93a3335c18f3b5d316aa101a.exe 115 PID 1672 wrote to memory of 4552 1672 40ca3bdb93a3335c18f3b5d316aa101a.exe 115 PID 1672 wrote to memory of 4552 1672 40ca3bdb93a3335c18f3b5d316aa101a.exe 115 PID 4552 wrote to memory of 4364 4552 40ca3bdb93a3335c18f3b5d316aa101a.exe 117 PID 4552 wrote to memory of 4364 4552 40ca3bdb93a3335c18f3b5d316aa101a.exe 117 PID 4552 wrote to memory of 4364 4552 40ca3bdb93a3335c18f3b5d316aa101a.exe 117 PID 4364 wrote to memory of 3012 4364 40ca3bdb93a3335c18f3b5d316aa101a.exe 121 PID 4364 wrote to memory of 3012 4364 40ca3bdb93a3335c18f3b5d316aa101a.exe 121 PID 4364 wrote to memory of 3012 4364 40ca3bdb93a3335c18f3b5d316aa101a.exe 121 PID 3012 wrote to memory of 3292 3012 40ca3bdb93a3335c18f3b5d316aa101a.exe 123 PID 3012 wrote to memory of 3292 3012 40ca3bdb93a3335c18f3b5d316aa101a.exe 123 PID 3012 wrote to memory of 3292 3012 40ca3bdb93a3335c18f3b5d316aa101a.exe 123 PID 3292 wrote to memory of 640 3292 40ca3bdb93a3335c18f3b5d316aa101a.exe 125 PID 3292 wrote to memory of 640 3292 40ca3bdb93a3335c18f3b5d316aa101a.exe 125 PID 3292 wrote to memory of 640 3292 40ca3bdb93a3335c18f3b5d316aa101a.exe 125 PID 640 wrote to memory of 4860 640 40ca3bdb93a3335c18f3b5d316aa101a.exe 127 PID 640 wrote to memory of 4860 640 40ca3bdb93a3335c18f3b5d316aa101a.exe 127 PID 640 wrote to memory of 4860 640 40ca3bdb93a3335c18f3b5d316aa101a.exe 127 PID 4860 wrote to memory of 3684 4860 40ca3bdb93a3335c18f3b5d316aa101a.exe 129 PID 4860 wrote to memory of 3684 4860 40ca3bdb93a3335c18f3b5d316aa101a.exe 129 PID 4860 wrote to memory of 3684 4860 40ca3bdb93a3335c18f3b5d316aa101a.exe 129 PID 3684 wrote to memory of 1048 3684 40ca3bdb93a3335c18f3b5d316aa101a.exe 131 PID 3684 wrote to memory of 1048 3684 40ca3bdb93a3335c18f3b5d316aa101a.exe 131 PID 3684 wrote to memory of 1048 3684 40ca3bdb93a3335c18f3b5d316aa101a.exe 131 PID 1048 wrote to memory of 1504 1048 40ca3bdb93a3335c18f3b5d316aa101a.exe 133 PID 1048 wrote to memory of 1504 1048 40ca3bdb93a3335c18f3b5d316aa101a.exe 133 PID 1048 wrote to memory of 1504 1048 40ca3bdb93a3335c18f3b5d316aa101a.exe 133 PID 1504 wrote to memory of 2564 1504 40ca3bdb93a3335c18f3b5d316aa101a.exe 135 PID 1504 wrote to memory of 2564 1504 40ca3bdb93a3335c18f3b5d316aa101a.exe 135 PID 1504 wrote to memory of 2564 1504 40ca3bdb93a3335c18f3b5d316aa101a.exe 135 PID 2564 wrote to memory of 8 2564 40ca3bdb93a3335c18f3b5d316aa101a.exe 137 PID 2564 wrote to memory of 8 2564 40ca3bdb93a3335c18f3b5d316aa101a.exe 137 PID 2564 wrote to memory of 8 2564 40ca3bdb93a3335c18f3b5d316aa101a.exe 137 PID 8 wrote to memory of 1104 8 40ca3bdb93a3335c18f3b5d316aa101a.exe 139 PID 8 wrote to memory of 1104 8 40ca3bdb93a3335c18f3b5d316aa101a.exe 139 PID 8 wrote to memory of 1104 8 40ca3bdb93a3335c18f3b5d316aa101a.exe 139 PID 1104 wrote to memory of 4232 1104 40ca3bdb93a3335c18f3b5d316aa101a.exe 141 PID 1104 wrote to memory of 4232 1104 40ca3bdb93a3335c18f3b5d316aa101a.exe 141 PID 1104 wrote to memory of 4232 1104 40ca3bdb93a3335c18f3b5d316aa101a.exe 141 PID 4232 wrote to memory of 1672 4232 40ca3bdb93a3335c18f3b5d316aa101a.exe 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exe"C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea2⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea3⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea4⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea5⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea6⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea7⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea8⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea9⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea10⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea11⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea13⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea14⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea15⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea16⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea17⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea18⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea19⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea20⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea21⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea22⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea23⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea24⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea25⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea26⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea27⤵
- Drops file in System32 directory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea28⤵
- Drops file in System32 directory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea29⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea30⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea31⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea32⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea33⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea34⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea35⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea36⤵
- Drops file in System32 directory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea37⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea38⤵
- Drops file in System32 directory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea39⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea40⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea41⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea42⤵
- Drops file in System32 directory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea43⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea44⤵
- Drops file in System32 directory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea45⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea46⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea47⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea48⤵
- Drops file in System32 directory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea49⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea50⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea51⤵
- Drops file in System32 directory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea52⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea53⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea54⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea55⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea56⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea57⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea58⤵
- Drops file in System32 directory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea59⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea60⤵
- Drops file in System32 directory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea61⤵
- Drops file in System32 directory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea62⤵
- Drops file in System32 directory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea63⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea64⤵
- Drops file in System32 directory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea65⤵
- Drops file in System32 directory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea66⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea67⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea68⤵
- Drops file in System32 directory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea69⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea70⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea71⤵
- Drops file in System32 directory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea72⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea73⤵
- Drops file in System32 directory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea74⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea75⤵
- Drops file in System32 directory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea76⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea77⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea78⤵
- Drops file in System32 directory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea79⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea80⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea81⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea82⤵
- Drops file in System32 directory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea83⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea84⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea85⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea86⤵
- Drops file in System32 directory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea87⤵
- Drops file in System32 directory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea88⤵
- Drops file in System32 directory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea89⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea90⤵
- Drops file in System32 directory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea91⤵
- Drops file in System32 directory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea92⤵
- Drops file in System32 directory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea93⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea94⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea95⤵
- Drops file in System32 directory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea96⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea97⤵
- Drops file in System32 directory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea98⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea99⤵
- Drops file in System32 directory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea100⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea101⤵
- Drops file in System32 directory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea102⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea103⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea104⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea105⤵
- Drops file in System32 directory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea106⤵
- Drops file in System32 directory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea107⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea108⤵
- Drops file in System32 directory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea109⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea110⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea111⤵
- Drops file in System32 directory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea112⤵
- Drops file in System32 directory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea113⤵
- Drops file in System32 directory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea114⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea115⤵
- Drops file in System32 directory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea116⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea117⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea118⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea119⤵
- Drops file in System32 directory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea120⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea121⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\40ca3bdb93a3335c18f3b5d316aa101a.exea122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-