Analysis
-
max time kernel
1703s -
max time network
1708s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 21:19
Static task
static1
Behavioral task
behavioral1
Sample
Preview_Document.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
Preview_Document.exe
-
Size
740KB
-
MD5
a67036f99e9ccc705bdb940bbf4422d0
-
SHA1
bed29d74cceafbd5effe43d9f828d46e96551511
-
SHA256
fd240893aeb0ac202fd3d9ffba6ff0d585e49a9238ae287a42e854a3b1fb2815
-
SHA512
1a384917fb1f2adef2346015e24c093ef6540dcba1f556d60cbbebed6dd05334a5bac04dbc46e7b2c3f8e6e7f7479138880e48e3a82f1e3032c5e3bfa518df9b
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 847 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 PID 1612 wrote to memory of 1980 1612 Preview_Document.exe 28 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1612 set thread context of 1980 1612 Preview_Document.exe 28 -
Blacklisted process makes network request 15 IoCs
flow pid Process 11 1980 cmd.exe 12 1980 cmd.exe 13 1980 cmd.exe 14 1980 cmd.exe 17 1980 cmd.exe 18 1980 cmd.exe 20 1980 cmd.exe 21 1980 cmd.exe 23 1980 cmd.exe 25 1980 cmd.exe 27 1980 cmd.exe 28 1980 cmd.exe 30 1980 cmd.exe 31 1980 cmd.exe 33 1980 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Preview_Document.exe"C:\Users\Admin\AppData\Local\Temp\Preview_Document.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1612 -
C:\Windows\system32\cmd.execmd.exe2⤵
- Blacklisted process makes network request
PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Preview_Document.exeC:\Users\Admin\AppData\Local\Temp\Preview_Document.exe {791EA01C-0BDE-4DDA-9212-F2963D3E081A}1⤵PID:1628