Analysis
-
max time kernel
485s -
max time network
557s -
platform
windows7_x64 -
resource
win7 -
submitted
08/07/2020, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
20038d40000.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
20038d40000.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
20038d40000.exe
-
Size
218KB
-
MD5
577299552becc2546d9e4901350291b4
-
SHA1
7cb0ce048505fa60f48380d40275503eaf3df2a9
-
SHA256
482e5f869960f2be2d99c4cf26662b0a5567894e45f73ae43d442ec44dfbf01e
-
SHA512
3ec37181affeb5e5a7e5ac95a417e0278d297eaf67ece6e863b84e3f58f105842e4bda0b04e7f72da994953554eec441edcd9e4c16212e3f486830cd54546ec1
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 839 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 PID 1612 wrote to memory of 2020 1612 20038d40000.exe 29 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1612 set thread context of 2020 1612 20038d40000.exe 29 -
Blacklisted process makes network request 9 IoCs
flow pid Process 22 2020 cmd.exe 23 2020 cmd.exe 26 2020 cmd.exe 28 2020 cmd.exe 29 2020 cmd.exe 30 2020 cmd.exe 31 2020 cmd.exe 32 2020 cmd.exe 34 2020 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20038d40000.exe"C:\Users\Admin\AppData\Local\Temp\20038d40000.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1612 -
C:\Windows\system32\cmd.execmd.exe2⤵
- Blacklisted process makes network request
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\20038d40000.exeC:\Users\Admin\AppData\Local\Temp\20038d40000.exe {8479DA42-F421-4225-9891-6AB83D3E081A}1⤵PID:1960