Analysis
-
max time kernel
60s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
15-07-2020 15:52
Static task
static1
Behavioral task
behavioral1
Sample
Doc-Preview.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Doc-Preview.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Doc-Preview.exe
-
Size
425KB
-
MD5
f5b7ebf0221bd55dbda661eefde1d958
-
SHA1
ebbd293fb26da47cdfbc47b55371de2772faa5ac
-
SHA256
66fe4f89b6a5408851c16d7af393e97969e8712d5e7300a75e54c86ad33d1060
-
SHA512
3c94d1f492fde84a3ae142349916c874db5b2b53b7755b9de74122ca5aba2801ca0e7185a2df433090c86039354ab2cf31a394337d086705b1a280a97ccda2c7
Score
8/10
Malware Config
Signatures
-
Blacklisted process makes network request 5 IoCs
flow pid Process 17 1548 cmd.exe 18 1548 cmd.exe 19 1548 cmd.exe 20 1548 cmd.exe 21 1548 cmd.exe -
Loads dropped DLL 4 IoCs
pid Process 1296 Doc-Preview.exe 1296 Doc-Preview.exe 868 Process not Found 868 Process not Found -
Suspicious use of WriteProcessMemory 842 IoCs
description pid Process procid_target PID 1296 wrote to memory of 1848 1296 Doc-Preview.exe 28 PID 1296 wrote to memory of 1848 1296 Doc-Preview.exe 28 PID 1296 wrote to memory of 1848 1296 Doc-Preview.exe 28 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 PID 1848 wrote to memory of 1548 1848 1A60.exe 30 -
Executes dropped EXE 2 IoCs
pid Process 1848 1A60.exe 1256 1A60.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1848 1A60.exe 1848 1A60.exe 1256 1A60.exe 1256 1A60.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1848 set thread context of 1548 1848 1A60.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc-Preview.exe"C:\Users\Admin\AppData\Local\Temp\Doc-Preview.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\1A60.exeC:\Users\Admin\AppData\Local\Temp\1A60.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:1848 -
C:\Windows\system32\cmd.execmd.exe3⤵
- Blacklisted process makes network request
PID:1548
-
-
-
C:\Users\Admin\AppData\Local\Temp\Doc-Preview.exeC:\Users\Admin\AppData\Local\Temp\Doc-Preview.exe {A886167F-8244-4EB2-BDE2-D25926E5F215}1⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1A60.exeC:\Users\Admin\AppData\Local\Temp\1A60.exe {B2BE488C-A957-4230-A4A2-E5A518D3C5BA}1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1256