Analysis
- max time kernel
151s - max time network
123s - platform
windows10_x64 - resource
win10v200722 - submitted
29/07/2020, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe
- Size 316KB
- Sample200729-8avp5sdc5s
- SHA256 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2
- MD5 e769681f1b8ba93593fb4290d5290da0
- SHA1 a55a83e12b0aadb70c06e0a1898eb979b5b8429d
- SHA512 37e0bd7679ce056ef1763fdff3b804eb9cde3533fb1adc9eb522053c0dfeb462e94cf07543feeddfd0691326b02be0b10d66c9f891328749f17bedcad91fb680
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 3808 server.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 512 set thread context of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 3808 set thread context of 3636 3808 server.exe 73 - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe -
resource yara_rule behavioral2/memory/648-2-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/648-4-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/648-5-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/648-6-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/1004-47-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3636-58-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/3636-59-0x0000000000400000-0x0000000000457000-memory.dmp upx - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1004 explorer.exe - Modifies Installed Components in the registry 2 TTPs
- Suspicious use of WriteProcessMemory 284 IoCs
description pid Process procid_target PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 512 wrote to memory of 648 512 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 67 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 3052 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 56 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 648 wrote to memory of 1004 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 68 PID 1004 wrote to memory of 3808 1004 explorer.exe 72 PID 1004 wrote to memory of 3808 1004 explorer.exe 72 PID 1004 wrote to memory of 3808 1004 explorer.exe 72 PID 3808 wrote to memory of 3636 3808 server.exe 73 PID 3808 wrote to memory of 3636 3808 server.exe 73 PID 3808 wrote to memory of 3636 3808 server.exe 73 PID 3808 wrote to memory of 3636 3808 server.exe 73 PID 3808 wrote to memory of 3636 3808 server.exe 73 PID 3808 wrote to memory of 3636 3808 server.exe 73 PID 3808 wrote to memory of 3636 3808 server.exe 73 PID 3808 wrote to memory of 3636 3808 server.exe 73 - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 648 1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1004 explorer.exe Token: SeDebugPrivilege 1004 explorer.exe Token: SeRestorePrivilege 3820 WerFault.exe Token: SeBackupPrivilege 3820 WerFault.exe Token: SeDebugPrivilege 3820 WerFault.exe - Executes dropped EXE 2 IoCs
pid Process 3808 server.exe 3636 server.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3820 3636 WerFault.exe 73
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe"C:\Users\Admin\AppData\Local\Temp\1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe"C:\Users\Admin\AppData\Local\Temp\1d2ef8cd1682b74a09a6a4f5f3caa932eadbcf798ecb183b3cafaade1a38c3b2.exe"3⤵
- Suspicious use of FindShellTrayWindow
- Adds policy Run key to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:648 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1004 -
C:\dir\install\install\server.exe"C:\dir\install\install\server.exe"5⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:3808 -
C:\dir\install\install\server.exe"C:\dir\install\install\server.exe"6⤵
- Executes dropped EXE
PID:3636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 5807⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Program crash
PID:3820
-
-
-
-
-
-