Analysis
-
max time kernel
126s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
15/07/2020, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
Doc-Preview.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Doc-Preview.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Doc-Preview.exe
-
Size
425KB
-
MD5
f5b7ebf0221bd55dbda661eefde1d958
-
SHA1
ebbd293fb26da47cdfbc47b55371de2772faa5ac
-
SHA256
66fe4f89b6a5408851c16d7af393e97969e8712d5e7300a75e54c86ad33d1060
-
SHA512
3c94d1f492fde84a3ae142349916c874db5b2b53b7755b9de74122ca5aba2801ca0e7185a2df433090c86039354ab2cf31a394337d086705b1a280a97ccda2c7
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 840 IoCs
description pid Process procid_target PID 1628 wrote to memory of 4092 1628 Doc-Preview.exe 72 PID 1628 wrote to memory of 4092 1628 Doc-Preview.exe 72 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 PID 4092 wrote to memory of 4056 4092 8C1.exe 77 -
Executes dropped EXE 2 IoCs
pid Process 4092 8C1.exe 4004 8C1.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4092 8C1.exe 4092 8C1.exe 4004 8C1.exe 4004 8C1.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4092 set thread context of 4056 4092 8C1.exe 77 -
Blacklisted process makes network request 4 IoCs
flow pid Process 12 4056 cmd.exe 13 4056 cmd.exe 14 4056 cmd.exe 15 4056 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc-Preview.exe"C:\Users\Admin\AppData\Local\Temp\Doc-Preview.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8C1.exeC:\Users\Admin\AppData\Local\Temp\8C1.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:4092 -
C:\Windows\SYSTEM32\cmd.execmd.exe3⤵
- Blacklisted process makes network request
PID:4056
-
-
-
C:\Users\Admin\AppData\Local\Temp\Doc-Preview.exeC:\Users\Admin\AppData\Local\Temp\Doc-Preview.exe {BF22B958-85DA-4F99-9630-03735B583D0F}1⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\8C1.exeC:\Users\Admin\AppData\Local\Temp\8C1.exe {C415328B-1F8E-4D0E-9E21-1344BA24DD66}1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4004