Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
10-07-2020 09:24
Static task
static1
Behavioral task
behavioral1
Sample
SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe
-
Size
1.5MB
-
MD5
0789465bc17bc4852eb45209aab31f7c
-
SHA1
bab2316f721d23b3607ee888be673ef76311b184
-
SHA256
f37f40245387cf924b4692267251875273ef75ad03fa9f92d73ab021f5c9e307
-
SHA512
b78884bad9029d83ea16a6cd1041cbc4e1b8fd1cf371682bc43a54ed6b5ca542cfd19d13b3cb5ba869d0fdd76f1864c4354158231e68d45d9eb8f2ec074fbf2b
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1356 set thread context of 2800 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 76 -
ParallaxRat payload 1 IoCs
Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
resource yara_rule behavioral2/memory/2800-127-0x0000000000400000-0x0000000000424000-memory.dmp parallax_rat -
Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Amdw = "C:\\Users\\Admin\\AppData\\Local\\Amdw\\Amdw.hta" SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 2192 reg.exe 3488 reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of WriteProcessMemory 507 IoCs
description pid Process procid_target PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 1356 wrote to memory of 3500 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 72 PID 3500 wrote to memory of 1104 3500 TapiUnattend.exe 75 PID 3500 wrote to memory of 1104 3500 TapiUnattend.exe 75 PID 3500 wrote to memory of 1104 3500 TapiUnattend.exe 75 PID 1356 wrote to memory of 2800 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 76 PID 1356 wrote to memory of 2800 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 76 PID 1356 wrote to memory of 2800 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 76 PID 1356 wrote to memory of 2800 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 76 PID 1356 wrote to memory of 2800 1356 SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe 76 PID 1104 wrote to memory of 2192 1104 cmd.exe 78 PID 1104 wrote to memory of 2192 1104 cmd.exe 78 PID 1104 wrote to memory of 2192 1104 cmd.exe 78 PID 1104 wrote to memory of 3488 1104 cmd.exe 79 PID 1104 wrote to memory of 3488 1104 cmd.exe 79 PID 1104 wrote to memory of 3488 1104 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe"C:\Users\Admin\AppData\Local\Temp\SOYKAL MID YEAR REQUEST 202090404885554540000009004954.exe"1⤵
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵PID:3500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat3⤵PID:1104
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2192
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:3488
-
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵PID:2800
-