Analysis
-
max time kernel
71s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
28-09-2020 06:18
Static task
static1
Behavioral task
behavioral1
Sample
ezmvVCJt.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ezmvVCJt.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
ezmvVCJt.exe
-
Size
276KB
-
MD5
0ee2f7d6a851faf44bf235186be91a19
-
SHA1
83ebbf632e25dbe69b060d190a42a5125ffe3902
-
SHA256
b64c40843b011d715c431b761680e8565383ac702f5ed80492fb30bd6aa33929
-
SHA512
4450f9169419cd502df259bd32c9e37a793db17d731d206e71ff61065cb0277917874bb7196672e6e5cab0d7ee1ee1103b018ae5e2e0ac917ecfd807db18368a
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\install\\server.exe" server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ezmvVCJt.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" ezmvVCJt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\install\\server.exe" server.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ezmvVCJt.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe" server.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\install\\server.exe" server.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\install\\server.exe" server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" ezmvVCJt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run server.exe -
Executes dropped EXE 5 IoCs
pid Process 2952 server.exe 1072 server.exe 3824 server.exe 3776 server.exe 1588 server.exe -
Modifies Installed Components in the registry 2 TTPs
-
resource yara_rule behavioral2/memory/732-0-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/3920-78-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/files/0x000200000001ad39-90.dat upx behavioral2/files/0x000200000001ad39-100.dat upx behavioral2/files/0x000200000001ad39-110.dat upx behavioral2/files/0x000100000001ad40-122.dat upx behavioral2/files/0x000200000001ad39-131.dat upx behavioral2/files/0x000200000001ad39-170.dat upx behavioral2/files/0x000200000001ad39-200.dat upx behavioral2/memory/2080-238-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\install\server.exe server.exe File created C:\Windows\SysWOW64\install\server.exe server.exe File created C:\Windows\SysWOW64\install\server.exe ezmvVCJt.exe File opened for modification C:\Windows\SysWOW64\install\server.exe ezmvVCJt.exe File opened for modification C:\Windows\SysWOW64\install\server.exe server.exe File created C:\Windows\SysWOW64\install\server.exe server.exe File opened for modification C:\Windows\SysWOW64\install\server.exe server.exe File created C:\Windows\SysWOW64\install\server.exe server.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 732 ezmvVCJt.exe 732 ezmvVCJt.exe 2952 server.exe 2952 server.exe 1072 server.exe 1072 server.exe 1588 server.exe 1588 server.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 732 ezmvVCJt.exe -
Suspicious use of WriteProcessMemory 946 IoCs
description pid Process procid_target PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 2968 732 ezmvVCJt.exe 56 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 3920 732 ezmvVCJt.exe 73 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2252 732 ezmvVCJt.exe 76 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 3920 wrote to memory of 2952 3920 explorer.exe 78 PID 3920 wrote to memory of 2952 3920 explorer.exe 78 PID 3920 wrote to memory of 2952 3920 explorer.exe 78 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 3920 wrote to memory of 1072 3920 explorer.exe 79 PID 3920 wrote to memory of 1072 3920 explorer.exe 79 PID 3920 wrote to memory of 1072 3920 explorer.exe 79 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3332 2952 server.exe 80 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 1576 1072 server.exe 82 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 3920 wrote to memory of 1588 3920 explorer.exe 84 PID 3920 wrote to memory of 1588 3920 explorer.exe 84 PID 3920 wrote to memory of 1588 3920 explorer.exe 84 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 732 wrote to memory of 2080 732 ezmvVCJt.exe 77 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 2952 wrote to memory of 3824 2952 server.exe 81 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83 PID 1072 wrote to memory of 3776 1072 server.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"2⤵
- Adds policy Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds policy Run key to start application
PID:3920 -
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2952 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:3332
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\SysWOW64\install\server.exe"5⤵
- Executes dropped EXE
PID:3824
-
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1072 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1576
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\SysWOW64\install\server.exe"5⤵
- Executes dropped EXE
PID:3776
-
-
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1588
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2252
-
-
C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"C:\Users\Admin\AppData\Local\Temp\ezmvVCJt.exe"3⤵PID:2080
-
-