Analysis
- max time kernel
14s - max time network
114s - platform
windows10_x64 - resource
win10 - submitted
14/10/2020, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
1 (2).exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1 (2).exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 1 (2).exe
- Size 5.4MB
- Sample201014-wljskqzpm2
- SHA256 8fbb33ae75d79566d8a3682d500be2668376e1a79b193ca0d1d6a280822cb0f6
- MD5 bb936ca806d32ba86d4c4c5069c24745
- SHA1 bd61de6217556c3923e645043254b782e400b978
- SHA512 8bb865e0b12e999b61947a691fb6959f966518d9e2c46c2d2abd69375e5ac1fc38906c550952c4b5dd9ee1e21c5bbe164e5028a4247902801a0edfcd8e31dd3a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- BazarBackdoor 4 IoCs
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
description flow ioc HTTP URL 15 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/4 HTTP URL 16 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/4 HTTP URL 17 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/4 HTTP URL 18 https://cuprinc.com/e23162ea80ec21eefb8502e6aee22143/2 - Blacklisted process makes network request 4 IoCs
flow pid Process 15 3664 cmd.exe 16 3664 cmd.exe 17 3664 cmd.exe 18 3664 cmd.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3148 set thread context of 3664 3148 1 (2).exe 77 - Suspicious use of WriteProcessMemory 851 IoCs
description pid Process procid_target PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77 PID 3148 wrote to memory of 3664 3148 1 (2).exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\1 (2).exe"C:\Users\Admin\AppData\Local\Temp\1 (2).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe2⤵
- Blacklisted process makes network request
PID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\1 (2).exeC:\Users\Admin\AppData\Local\Temp\1 (2).exe 30644382521⤵PID:2152