Analysis
- max time kernel
148s - max time network
151s - platform
windows7_x64 - resource
win7 - submitted
21/07/2020, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
SBIN32000636990,pdf.scr
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SBIN32000636990,pdf.scr
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target SBIN32000636990,pdf.scr
- Size 1.1MB
- Sample200721-jfhrmgjsma
- SHA256 ece26faace5bcf7afeba359279d17aeb7f99f739fce454e964c88ebad9745bdb
- MD5 629e124eff07f0d656e30939bec28af9
- SHA1 7cd829a3453c6bd2904a4a354a69cd436c126449
- SHA512 a6a9ec9e1162a0e24716e144b871744eb1bb595316a2faba4c3fd779ee45239d978952bfd98b519bf7d34a57d9106022422c3855a3edff12b176e3164c8ffaaf
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2300 fodhelper.exe 2320 fodhelper.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\internet explorer\ieinstal.exe ieinstal.exe - Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 4 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of WriteProcessMemory 527 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1108 wrote to memory of 1820 1108 SBIN32000636990,pdf.scr 26 PID 1820 wrote to memory of 2124 1820 TapiUnattend.exe 27 PID 1820 wrote to memory of 2124 1820 TapiUnattend.exe 27 PID 1820 wrote to memory of 2124 1820 TapiUnattend.exe 27 PID 1820 wrote to memory of 2124 1820 TapiUnattend.exe 27 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 1108 wrote to memory of 2148 1108 SBIN32000636990,pdf.scr 29 PID 2124 wrote to memory of 2172 2124 cmd.exe 30 PID 2124 wrote to memory of 2172 2124 cmd.exe 30 PID 2124 wrote to memory of 2172 2124 cmd.exe 30 PID 2124 wrote to memory of 2172 2124 cmd.exe 30 PID 2124 wrote to memory of 2196 2124 cmd.exe 31 PID 2124 wrote to memory of 2196 2124 cmd.exe 31 PID 2124 wrote to memory of 2196 2124 cmd.exe 31 PID 2124 wrote to memory of 2196 2124 cmd.exe 31 PID 2124 wrote to memory of 2216 2124 cmd.exe 32 PID 2124 wrote to memory of 2216 2124 cmd.exe 32 PID 2124 wrote to memory of 2216 2124 cmd.exe 32 PID 2124 wrote to memory of 2216 2124 cmd.exe 32 PID 2124 wrote to memory of 2236 2124 cmd.exe 33 PID 2124 wrote to memory of 2236 2124 cmd.exe 33 PID 2124 wrote to memory of 2236 2124 cmd.exe 33 PID 2124 wrote to memory of 2236 2124 cmd.exe 33 PID 1820 wrote to memory of 2260 1820 TapiUnattend.exe 34 PID 1820 wrote to memory of 2260 1820 TapiUnattend.exe 34 PID 1820 wrote to memory of 2260 1820 TapiUnattend.exe 34 PID 1820 wrote to memory of 2260 1820 TapiUnattend.exe 34 - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1108 set thread context of 2148 1108 SBIN32000636990,pdf.scr 29 - NetWire RAT payload 2 IoCs
resource yara_rule behavioral1/memory/2148-127-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2148-131-0x0000000000400000-0x0000000000433000-memory.dmp netwire - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Nzcq = "C:\\Users\\Admin\\AppData\\Local\\Nzcq\\Nzcq.hta" SBIN32000636990,pdf.scr - Modifies registry key 1 TTPs 3 IoCs
pid Process 2172 reg.exe 2196 reg.exe 2236 reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SBIN32000636990,pdf.scr"C:\Users\Admin\AppData\Local\Temp\SBIN32000636990,pdf.scr" /S1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Adds Run key to start application
PID:1108 -
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:2124
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2172
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2196
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:2216
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2236
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Runex.bat3⤵PID:2260
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2300
-
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
PID:2320
-
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Drops file in Program Files directory
PID:2148
-