Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
28-09-2020 06:18
Static task
static1
Behavioral task
behavioral1
Sample
ezmvVCJt.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ezmvVCJt.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
ezmvVCJt.exe
-
Size
276KB
-
MD5
0ee2f7d6a851faf44bf235186be91a19
-
SHA1
83ebbf632e25dbe69b060d190a42a5125ffe3902
-
SHA256
b64c40843b011d715c431b761680e8565383ac702f5ed80492fb30bd6aa33929
-
SHA512
4450f9169419cd502df259bd32c9e37a793db17d731d206e71ff61065cb0277917874bb7196672e6e5cab0d7ee1ee1103b018ae5e2e0ac917ecfd807db18368a
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ezmvVCJt.exe Set value (str) \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" ezmvVCJt.exe Set value (str) \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe" server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" ezmvVCJt.exe Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ezmvVCJt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe" server.exe Key created \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 672 server.exe 592 server.exe 2148 server.exe 2444 server.exe -
Modifies Installed Components in the registry 2 TTPs
-
resource yara_rule behavioral1/memory/1292-0-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1884-78-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x000500000001318b-80.dat upx behavioral1/files/0x000500000001318b-112.dat upx behavioral1/files/0x000500000001318b-118.dat upx behavioral1/files/0x000500000001318b-122.dat upx behavioral1/files/0x000500000001318b-137.dat upx behavioral1/files/0x000500000001318b-164.dat upx behavioral1/files/0x000500000001318b-165.dat upx behavioral1/files/0x000500000001318b-167.dat upx behavioral1/memory/1880-198-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/files/0x000300000001318e-205.dat upx behavioral1/files/0x000300000001318e-207.dat upx behavioral1/files/0x000300000001318e-208.dat upx behavioral1/files/0x000300000001318e-211.dat upx behavioral1/memory/592-253-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x000500000001318b-256.dat upx behavioral1/files/0x000500000001318b-257.dat upx behavioral1/files/0x000500000001318b-281.dat upx -
Loads dropped DLL 9 IoCs
pid Process 1884 explorer.exe 1884 explorer.exe 1884 explorer.exe 1884 explorer.exe 1880 ezmvVCJt.exe 1880 ezmvVCJt.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\install\server.exe ezmvVCJt.exe File created C:\Windows\SysWOW64\install\server.exe ezmvVCJt.exe File opened for modification C:\Windows\SysWOW64\install\server.exe ezmvVCJt.exe File opened for modification C:\Windows\SysWOW64\install\server.exe server.exe File created C:\Windows\SysWOW64\install\server.exe server.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2756 592 WerFault.exe 33 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1292 ezmvVCJt.exe 672 server.exe 2148 server.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1880 ezmvVCJt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1880 ezmvVCJt.exe Token: SeDebugPrivilege 1880 ezmvVCJt.exe Token: SeDebugPrivilege 2756 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1292 ezmvVCJt.exe -
Suspicious use of WriteProcessMemory 822 IoCs
description pid Process procid_target PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1328 1292 ezmvVCJt.exe 20 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1884 1292 ezmvVCJt.exe 28 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1608 1292 ezmvVCJt.exe 29 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1884 wrote to memory of 672 1884 explorer.exe 31 PID 1884 wrote to memory of 672 1884 explorer.exe 31 PID 1884 wrote to memory of 672 1884 explorer.exe 31 PID 1884 wrote to memory of 672 1884 explorer.exe 31 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 280 672 server.exe 32 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1884 wrote to memory of 2148 1884 explorer.exe 34 PID 1884 wrote to memory of 2148 1884 explorer.exe 34 PID 1884 wrote to memory of 2148 1884 explorer.exe 34 PID 1884 wrote to memory of 2148 1884 explorer.exe 34 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 1292 wrote to memory of 1880 1292 ezmvVCJt.exe 30 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 1880 wrote to memory of 2444 1880 ezmvVCJt.exe 35 PID 1880 wrote to memory of 2444 1880 ezmvVCJt.exe 35 PID 1880 wrote to memory of 2444 1880 ezmvVCJt.exe 35 PID 1880 wrote to memory of 2444 1880 ezmvVCJt.exe 35 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 672 wrote to memory of 592 672 server.exe 33 PID 592 wrote to memory of 2756 592 server.exe 36 PID 592 wrote to memory of 2756 592 server.exe 36 PID 592 wrote to memory of 2756 592 server.exe 36 PID 592 wrote to memory of 2756 592 server.exe 36
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"2⤵
- Adds policy Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds policy Run key to start application
- Loads dropped DLL
PID:1884 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:672 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:280
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\SysWOW64\install\server.exe"5⤵
- Executes dropped EXE
PID:592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 4686⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2148
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1880 -
C:\Users\Admin\AppData\Roaming\install\server.exe"C:\Users\Admin\AppData\Roaming\install\server.exe"4⤵
- Executes dropped EXE
PID:2444
-
-
-