Analysis
-
max time kernel
14s -
max time network
114s -
platform
windows10_x64 -
resource
win10 -
submitted
14/10/2020, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
1 (2).exe
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1 (2).exe
Resource
win10
0 signatures
0 seconds
General
-
Target
1 (2).exe
-
Size
5.4MB
-
MD5
bb936ca806d32ba86d4c4c5069c24745
-
SHA1
bd61de6217556c3923e645043254b782e400b978
-
SHA256
8fbb33ae75d79566d8a3682d500be2668376e1a79b193ca0d1d6a280822cb0f6
-
SHA512
8bb865e0b12e999b61947a691fb6959f966518d9e2c46c2d2abd69375e5ac1fc38906c550952c4b5dd9ee1e21c5bbe164e5028a4247902801a0edfcd8e31dd3a
Score
10/10
Malware Config
Signatures
-
BazarBackdoor 4 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
description flow ioc HTTP URL 15 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/4 HTTP URL 16 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/4 HTTP URL 17 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/4 HTTP URL 18 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/2 -
Blacklisted process makes network request 4 IoCs
flow pid Process 15 3664 cmd.exe 16 3664 cmd.exe 17 3664 cmd.exe 18 3664 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3148 set thread context of 3664 3148 1 (2).exe 77 -
Suspicious use of WriteProcessMemory 851 IoCs
description pid Process procid_target PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\1 (2).exe"C:\Users\Admin\AppData\Local\Temp\1 (2).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blacklisted process makes network request
PID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\1 (2).exeC:\Users\Admin\AppData\Local\Temp\1 (2).exe 30644382521⤵PID:2152