Analysis
-
max time kernel
132s -
max time network
156s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 09:24
Static task
static1
Behavioral task
behavioral1
Sample
SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe
-
Size
1.5MB
-
MD5
0789465bc17bc4852eb45209aab31f7c
-
SHA1
bab2316f721d23b3607ee888be673ef76311b184
-
SHA256
f37f40245387cf924b4692267251875273ef75ad03fa9f92d73ab021f5c9e307
-
SHA512
b78884bad9029d83ea16a6cd1041cbc4e1b8fd1cf371682bc43a54ed6b5ca542cfd19d13b3cb5ba869d0fdd76f1864c4354158231e68d45d9eb8f2ec074fbf2b
Score
10/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of WriteProcessMemory 527 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 1328 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 26 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1460 wrote to memory of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 PID 1328 wrote to memory of 2324 1328 TapiUnattend.exe 30 PID 1328 wrote to memory of 2324 1328 TapiUnattend.exe 30 PID 1328 wrote to memory of 2324 1328 TapiUnattend.exe 30 PID 1328 wrote to memory of 2324 1328 TapiUnattend.exe 30 PID 2324 wrote to memory of 2424 2324 cmd.exe 32 PID 2324 wrote to memory of 2424 2324 cmd.exe 32 PID 2324 wrote to memory of 2424 2324 cmd.exe 32 PID 2324 wrote to memory of 2424 2324 cmd.exe 32 PID 2324 wrote to memory of 2440 2324 cmd.exe 33 PID 2324 wrote to memory of 2440 2324 cmd.exe 33 PID 2324 wrote to memory of 2440 2324 cmd.exe 33 PID 2324 wrote to memory of 2440 2324 cmd.exe 33 PID 2324 wrote to memory of 2452 2324 cmd.exe 34 PID 2324 wrote to memory of 2452 2324 cmd.exe 34 PID 2324 wrote to memory of 2452 2324 cmd.exe 34 PID 2324 wrote to memory of 2452 2324 cmd.exe 34 PID 2324 wrote to memory of 2468 2324 cmd.exe 35 PID 2324 wrote to memory of 2468 2324 cmd.exe 35 PID 2324 wrote to memory of 2468 2324 cmd.exe 35 PID 2324 wrote to memory of 2468 2324 cmd.exe 35 PID 1328 wrote to memory of 2488 1328 TapiUnattend.exe 36 PID 1328 wrote to memory of 2488 1328 TapiUnattend.exe 36 PID 1328 wrote to memory of 2488 1328 TapiUnattend.exe 36 PID 1328 wrote to memory of 2488 1328 TapiUnattend.exe 36 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1460 set thread context of 2312 1460 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 29 -
Executes dropped EXE 2 IoCs
pid Process 2528 fodhelper.exe 2548 fodhelper.exe -
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral1/memory/2312-126-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Amdw = "C:\\Users\\Admin\\AppData\\Local\\Amdw\\Amdw.hta" SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 2424 reg.exe 2440 reg.exe 2468 reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe"C:\Users\Admin\AppData\Local\Temp\SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run entry to start application
PID:1460 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵PID:1328
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:2324
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2424
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:2452
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2468
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Runex.bat3⤵PID:2488
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2528
-
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2548
-
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵PID:2312
-