remcos | 8cffc3d5b5b830c82c8c9f958a699fb4668d39df6ae0b2f50ec68571c9eac6d9

Analysis

max time kernel
151s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
05/11/2020, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW_PURCHASING_ORDER-2020.exe
Size 10.0MB
Sample201105-e9mhmkz6fx
SHA256 8cffc3d5b5b830c82c8c9f958a699fb4668d39df6ae0b2f50ec68571c9eac6d9
MD5 b56c44f3ca36db28258a428e7a586039
SHA1 4439124e8842faa54da71608a6af4f657dbc1e19
SHA512 dc618a8eafb2d8619bbff74594d2e6d3d6fc44914e39423d0ffdc23f8b66459e58bf6493ee1a1f16fc9b91551f88ba32a86b237a01dbc3d09cea7fdca30fa108
MD5 SHA1 SHA512

Score

10^/10

remcos rat

Malware Config

Extracted

Family

remcos

www.ecxco.com:2404

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\alg.url	NEW_PURCHASING_ORDER-2020.exe

Suspicious use of SetThreadContext 65 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 2012	1668	NEW_PURCHASING_ORDER-2020.exe	29
PID 2012 set thread context of 1284	2012	dllhost.exe	30
PID 2012 set thread context of 1416	2012	dllhost.exe	31
PID 2012 set thread context of 1632	2012	dllhost.exe	32
PID 2012 set thread context of 1756	2012	dllhost.exe	33
PID 2012 set thread context of 1440	2012	dllhost.exe	34
PID 2012 set thread context of 1992	2012	dllhost.exe	35
PID 2012 set thread context of 852	2012	dllhost.exe	36
PID 2012 set thread context of 868	2012	dllhost.exe	37
PID 2012 set thread context of 808	2012	dllhost.exe	38
PID 2012 set thread context of 660	2012	dllhost.exe	39
PID 2012 set thread context of 764	2012	dllhost.exe	40
PID 2012 set thread context of 1456	2012	dllhost.exe	41
PID 2012 set thread context of 600	2012	dllhost.exe	42
PID 2012 set thread context of 1088	2012	dllhost.exe	43
PID 2012 set thread context of 1624	2012	dllhost.exe	44
PID 2012 set thread context of 1596	2012	dllhost.exe	45
PID 2012 set thread context of 1260	2012	dllhost.exe	46
PID 2012 set thread context of 1092	2012	dllhost.exe	47
PID 2012 set thread context of 1844	2012	dllhost.exe	48
PID 2012 set thread context of 1072	2012	dllhost.exe	49
PID 2012 set thread context of 1628	2012	dllhost.exe	50
PID 2012 set thread context of 1124	2012	dllhost.exe	51
PID 2012 set thread context of 1984	2012	dllhost.exe	52
PID 2012 set thread context of 1032	2012	dllhost.exe	53
PID 2012 set thread context of 924	2012	dllhost.exe	54
PID 2012 set thread context of 440	2012	dllhost.exe	55
PID 2012 set thread context of 884	2012	dllhost.exe	56
PID 2012 set thread context of 948	2012	dllhost.exe	57
PID 2012 set thread context of 1208	2012	dllhost.exe	58
PID 2012 set thread context of 1560	2012	dllhost.exe	59
PID 2012 set thread context of 1592	2012	dllhost.exe	60
PID 2012 set thread context of 1948	2012	dllhost.exe	61
PID 2012 set thread context of 1336	2012	dllhost.exe	62
PID 2012 set thread context of 1016	2012	dllhost.exe	63
PID 2012 set thread context of 344	2012	dllhost.exe	64
PID 2012 set thread context of 292	2012	dllhost.exe	65
PID 2012 set thread context of 828	2012	dllhost.exe	66
PID 2012 set thread context of 300	2012	dllhost.exe	67
PID 2012 set thread context of 336	2012	dllhost.exe	68
PID 2012 set thread context of 1740	2012	dllhost.exe	69
PID 2012 set thread context of 812	2012	dllhost.exe	70
PID 2012 set thread context of 972	2012	dllhost.exe	71
PID 2012 set thread context of 2020	2012	dllhost.exe	72
PID 2012 set thread context of 1700	2012	dllhost.exe	73
PID 2012 set thread context of 824	2012	dllhost.exe	74
PID 2012 set thread context of 1940	2012	dllhost.exe	75
PID 2012 set thread context of 1340	2012	dllhost.exe	76
PID 2012 set thread context of 400	2012	dllhost.exe	77
PID 2012 set thread context of 620	2012	dllhost.exe	78
PID 2012 set thread context of 1672	2012	dllhost.exe	79
PID 2012 set thread context of 1084	2012	dllhost.exe	80
PID 2012 set thread context of 1528	2012	dllhost.exe	81
PID 2012 set thread context of 1772	2012	dllhost.exe	82
PID 2012 set thread context of 296	2012	dllhost.exe	83
PID 2012 set thread context of 1520	2012	dllhost.exe	84
PID 2012 set thread context of 1968	2012	dllhost.exe	85
PID 2012 set thread context of 1100	2012	dllhost.exe	86
PID 2012 set thread context of 1892	2012	dllhost.exe	87
PID 2012 set thread context of 1256	2012	dllhost.exe	88
PID 2012 set thread context of 240	2012	dllhost.exe	89
PID 2012 set thread context of 796	2012	dllhost.exe	90
PID 2012 set thread context of 2036	2012	dllhost.exe	91
PID 2012 set thread context of 1108	2012	dllhost.exe	92
PID 2012 set thread context of 1648	2012	dllhost.exe	93

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1668	NEW_PURCHASING_ORDER-2020.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1668	NEW_PURCHASING_ORDER-2020.exe
1668	NEW_PURCHASING_ORDER-2020.exe
1668	NEW_PURCHASING_ORDER-2020.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1668	NEW_PURCHASING_ORDER-2020.exe
1668	NEW_PURCHASING_ORDER-2020.exe
1668	NEW_PURCHASING_ORDER-2020.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2012	dllhost.exe

Suspicious use of WriteProcessMemory 645 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2012	1668	NEW_PURCHASING_ORDER-2020.exe	29
PID 1668 wrote to memory of 2012	1668	NEW_PURCHASING_ORDER-2020.exe	29
PID 1668 wrote to memory of 2012	1668	NEW_PURCHASING_ORDER-2020.exe	29
PID 1668 wrote to memory of 2012	1668	NEW_PURCHASING_ORDER-2020.exe	29
PID 1668 wrote to memory of 2012	1668	NEW_PURCHASING_ORDER-2020.exe	29
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1284	2012	dllhost.exe	30
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1416	2012	dllhost.exe	31
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1632	2012	dllhost.exe	32
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1756	2012	dllhost.exe	33
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1440	2012	dllhost.exe	34
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 1992	2012	dllhost.exe	35
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 852	2012	dllhost.exe	36
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 868	2012	dllhost.exe	37
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 808	2012	dllhost.exe	38
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 660	2012	dllhost.exe	39
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 764	2012	dllhost.exe	40
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 1456	2012	dllhost.exe	41
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 600	2012	dllhost.exe	42
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1088	2012	dllhost.exe	43
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1624	2012	dllhost.exe	44
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1596	2012	dllhost.exe	45
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1260	2012	dllhost.exe	46
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1092	2012	dllhost.exe	47
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1844	2012	dllhost.exe	48
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1072	2012	dllhost.exe	49
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1628	2012	dllhost.exe	50
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1124	2012	dllhost.exe	51
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1984	2012	dllhost.exe	52
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 1032	2012	dllhost.exe	53
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 924	2012	dllhost.exe	54
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 440	2012	dllhost.exe	55
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 884	2012	dllhost.exe	56
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 948	2012	dllhost.exe	57
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1208	2012	dllhost.exe	58
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1560	2012	dllhost.exe	59
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1592	2012	dllhost.exe	60
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1948	2012	dllhost.exe	61
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1336	2012	dllhost.exe	62
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 1016	2012	dllhost.exe	63
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 344	2012	dllhost.exe	64
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 292	2012	dllhost.exe	65
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 828	2012	dllhost.exe	66
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 300	2012	dllhost.exe	67
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 336	2012	dllhost.exe	68
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 1740	2012	dllhost.exe	69
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 812	2012	dllhost.exe	70
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 972	2012	dllhost.exe	71
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 2020	2012	dllhost.exe	72
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 1700	2012	dllhost.exe	73
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 824	2012	dllhost.exe	74
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1940	2012	dllhost.exe	75
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 1340	2012	dllhost.exe	76
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 400	2012	dllhost.exe	77
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 620	2012	dllhost.exe	78
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1672	2012	dllhost.exe	79
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1084	2012	dllhost.exe	80
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1528	2012	dllhost.exe	81
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 1772	2012	dllhost.exe	82
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 296	2012	dllhost.exe	83
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1520	2012	dllhost.exe	84
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1968	2012	dllhost.exe	85
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1100	2012	dllhost.exe	86
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1892	2012	dllhost.exe	87
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 1256	2012	dllhost.exe	88
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 240	2012	dllhost.exe	89
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 796	2012	dllhost.exe	90
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 2036	2012	dllhost.exe	91
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1108	2012	dllhost.exe	92
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93
PID 2012 wrote to memory of 1648	2012	dllhost.exe	93

C:\Users\Admin\AppData\Local\Temp\NEW_PURCHASING_ORDER-2020.exe
"C:\Users\Admin\AppData\Local\Temp\NEW_PURCHASING_ORDER-2020.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1440
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:852
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:868
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:808
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:660
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:764
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:600
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1088
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1092
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1072
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:924
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:440
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:884
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:948
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:344
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:292
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:828
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:300
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:336
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:812
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:972
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:824
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:400
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:620
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:296
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:240
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:796
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe
    3⤵
    PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1284-3-0x0000000001000000-0x0000000001005000-memory.dmp

Download

memory/1284-5-0x0000000001000000-0x0000000001005000-memory.dmp

Download

memory/2012-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2012-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads