Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
ISF form == 20030316 M#EGLV003090032432.scr
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ISF form == 20030316 M#EGLV003090032432.scr
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target ISF form == 20030316 M#EGLV003090032432.scr
- Size 584KB
- Sample201109-wpss4ne9a6
- SHA256 5cd183da8ceb32dfce5219ece25684d9eb1624ca8e0ec30e374219732944c8e5
- MD5 7de6d9395aafb8bd1720692f8c3e8397
- SHA1 b46eb569d352fe5dc0cc5c3f67fe6474a09a514f
- SHA512 46433ffdb7c7d31518e5030e40cfb5045878e0e11f57458c3316eb1ccafaec31297c0bb5836fa1f1ab151fa690bb8d8a72fcfb5c063425a594c1b2914ce32b08
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
188.72.124.143:2858
Signatures
- ServiceHost packer 12 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/1120-24-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/1120-23-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/1120-25-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/1812-35-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/1812-34-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/1812-36-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/2392-44-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/2392-45-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/2392-46-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/4712-54-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/4712-55-0x0000000000413A84-mapping.dmp servicehost behavioral2/memory/4712-56-0x0000000000413A84-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 3176 xls.exe 552 xls.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\xls = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\xls.exe\"" ISF form == 20030316 M#EGLV003090032432.scr Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ xls.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\xls = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\xls.exe\"" xls.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ISF form == 20030316 M#EGLV003090032432.scr - Suspicious use of SetThreadContext 148 IoCs
description pid Process procid_target PID 4768 set thread context of 2820 4768 ISF form == 20030316 M#EGLV003090032432.scr 73 PID 3176 set thread context of 552 3176 xls.exe 83 PID 552 set thread context of 352 552 xls.exe 86 PID 352 set thread context of 1120 352 svchost.exe 87 PID 552 set thread context of 4048 552 xls.exe 92 PID 4048 set thread context of 1812 4048 svchost.exe 93 PID 552 set thread context of 4584 552 xls.exe 97 PID 4584 set thread context of 2392 4584 svchost.exe 98 PID 552 set thread context of 4728 552 xls.exe 104 PID 4728 set thread context of 4712 4728 svchost.exe 105 PID 552 set thread context of 2436 552 xls.exe 107 PID 2436 set thread context of 1540 2436 svchost.exe 108 PID 552 set thread context of 2108 552 xls.exe 110 PID 2108 set thread context of 4944 2108 svchost.exe 111 PID 552 set thread context of 3968 552 xls.exe 113 PID 3968 set thread context of 4912 3968 svchost.exe 114 PID 552 set thread context of 4128 552 xls.exe 116 PID 4128 set thread context of 3488 4128 svchost.exe 117 PID 552 set thread context of 5044 552 xls.exe 118 PID 5044 set thread context of 3104 5044 svchost.exe 120 PID 552 set thread context of 372 552 xls.exe 121 PID 372 set thread context of 4264 372 svchost.exe 122 PID 552 set thread context of 508 552 xls.exe 125 PID 508 set thread context of 3084 508 svchost.exe 126 PID 552 set thread context of 808 552 xls.exe 127 PID 808 set thread context of 1052 808 svchost.exe 128 PID 552 set thread context of 2052 552 xls.exe 132 PID 2052 set thread context of 3144 2052 svchost.exe 133 PID 552 set thread context of 1900 552 xls.exe 134 PID 1900 set thread context of 2396 1900 svchost.exe 135 PID 552 set thread context of 4612 552 xls.exe 136 PID 4612 set thread context of 720 4612 svchost.exe 138 PID 552 set thread context of 3876 552 xls.exe 139 PID 3876 set thread context of 2320 3876 svchost.exe 140 PID 552 set thread context of 4588 552 xls.exe 141 PID 4588 set thread context of 4468 4588 svchost.exe 142 PID 552 set thread context of 1972 552 xls.exe 143 PID 1972 set thread context of 1468 1972 svchost.exe 144 PID 552 set thread context of 4476 552 xls.exe 145 PID 4476 set thread context of 1528 4476 svchost.exe 146 PID 552 set thread context of 4848 552 xls.exe 147 PID 4848 set thread context of 4628 4848 svchost.exe 148 PID 552 set thread context of 5076 552 xls.exe 150 PID 5076 set thread context of 4816 5076 svchost.exe 151 PID 552 set thread context of 3408 552 xls.exe 152 PID 3408 set thread context of 2304 3408 svchost.exe 153 PID 552 set thread context of 2148 552 xls.exe 155 PID 2148 set thread context of 4248 2148 svchost.exe 157 PID 552 set thread context of 2788 552 xls.exe 158 PID 2788 set thread context of 4176 2788 svchost.exe 161 PID 552 set thread context of 4192 552 xls.exe 162 PID 4192 set thread context of 4864 4192 svchost.exe 163 PID 552 set thread context of 4336 552 xls.exe 164 PID 4336 set thread context of 3096 4336 svchost.exe 165 PID 552 set thread context of 1156 552 xls.exe 166 PID 1156 set thread context of 4460 1156 svchost.exe 167 PID 552 set thread context of 4536 552 xls.exe 168 PID 4536 set thread context of 3700 4536 svchost.exe 169 PID 552 set thread context of 2456 552 xls.exe 170 PID 2456 set thread context of 5020 2456 svchost.exe 171 PID 552 set thread context of 4340 552 xls.exe 172 PID 4340 set thread context of 744 4340 svchost.exe 173 PID 552 set thread context of 1116 552 xls.exe 174 PID 1116 set thread context of 4556 1116 svchost.exe 175 PID 552 set thread context of 2248 552 xls.exe 176 PID 2248 set thread context of 4516 2248 svchost.exe 177 PID 552 set thread context of 2852 552 xls.exe 179 PID 2852 set thread context of 4776 2852 svchost.exe 180 PID 552 set thread context of 4400 552 xls.exe 182 PID 4400 set thread context of 4800 4400 svchost.exe 183 PID 552 set thread context of 5004 552 xls.exe 184 PID 5004 set thread context of 3900 5004 svchost.exe 185 PID 552 set thread context of 3480 552 xls.exe 186 PID 3480 set thread context of 1764 3480 svchost.exe 187 PID 552 set thread context of 3712 552 xls.exe 188 PID 3712 set thread context of 3208 3712 svchost.exe 189 PID 552 set thread context of 3948 552 xls.exe 190 PID 3948 set thread context of 4500 3948 svchost.exe 191 PID 552 set thread context of 2092 552 xls.exe 192 PID 2092 set thread context of 648 2092 svchost.exe 193 PID 552 set thread context of 1188 552 xls.exe 194 PID 1188 set thread context of 3896 1188 svchost.exe 196 PID 552 set thread context of 2152 552 xls.exe 198 PID 2152 set thread context of 2996 2152 svchost.exe 199 PID 552 set thread context of 4808 552 xls.exe 200 PID 4808 set thread context of 4920 4808 svchost.exe 201 PID 552 set thread context of 3364 552 xls.exe 202 PID 3364 set thread context of 4984 3364 svchost.exe 203 PID 552 set thread context of 4196 552 xls.exe 204 PID 4196 set thread context of 4200 4196 svchost.exe 205 PID 552 set thread context of 1584 552 xls.exe 207 PID 1584 set thread context of 2912 1584 svchost.exe 208 PID 552 set thread context of 1424 552 xls.exe 209 PID 1424 set thread context of 4640 1424 svchost.exe 210 PID 552 set thread context of 4632 552 xls.exe 211 PID 4632 set thread context of 3660 4632 svchost.exe 212 PID 552 set thread context of 2716 552 xls.exe 213 PID 2716 set thread context of 4804 2716 svchost.exe 214 PID 552 set thread context of 4968 552 xls.exe 215 PID 4968 set thread context of 2348 4968 svchost.exe 217 PID 552 set thread context of 2472 552 xls.exe 220 PID 2472 set thread context of 3212 2472 svchost.exe 221 PID 552 set thread context of 4416 552 xls.exe 223 PID 4416 set thread context of 500 4416 svchost.exe 226 PID 552 set thread context of 608 552 xls.exe 228 PID 608 set thread context of 1112 608 svchost.exe 229 PID 552 set thread context of 3348 552 xls.exe 230 PID 3348 set thread context of 4952 3348 svchost.exe 231 PID 552 set thread context of 4784 552 xls.exe 233 PID 4784 set thread context of 4368 4784 svchost.exe 234 PID 552 set thread context of 4996 552 xls.exe 235 PID 4996 set thread context of 4304 4996 svchost.exe 237 PID 552 set thread context of 2588 552 xls.exe 239 PID 2588 set thread context of 4272 2588 svchost.exe 240 PID 552 set thread context of 2960 552 xls.exe 241 PID 2960 set thread context of 2232 2960 svchost.exe 242 PID 552 set thread context of 4708 552 xls.exe 243 PID 4708 set thread context of 1632 4708 svchost.exe 245 PID 552 set thread context of 4852 552 xls.exe 246 PID 4852 set thread context of 5104 4852 svchost.exe 248 PID 552 set thread context of 4508 552 xls.exe 249 PID 4508 set thread context of 4788 4508 svchost.exe 250 PID 552 set thread context of 652 552 xls.exe 251 PID 652 set thread context of 1056 652 svchost.exe 252 PID 552 set thread context of 4456 552 xls.exe 253 PID 4456 set thread context of 3840 4456 svchost.exe 254 PID 552 set thread context of 4388 552 xls.exe 255 PID 4388 set thread context of 3868 4388 svchost.exe 257 PID 552 set thread context of 644 552 xls.exe 258 PID 644 set thread context of 4752 644 svchost.exe 260 PID 552 set thread context of 2332 552 xls.exe 261 PID 2332 set thread context of 3024 2332 svchost.exe 262 PID 552 set thread context of 4872 552 xls.exe 263 PID 4872 set thread context of 4484 4872 svchost.exe 264 PID 552 set thread context of 4772 552 xls.exe 267 PID 4772 set thread context of 4932 4772 svchost.exe 268 PID 552 set thread context of 4884 552 xls.exe 269 PID 4884 set thread context of 4432 4884 svchost.exe 270 PID 552 set thread context of 2372 552 xls.exe 271 PID 2372 set thread context of 1212 2372 svchost.exe 273 PID 552 set thread context of 4540 552 xls.exe 274 PID 4540 set thread context of 724 4540 svchost.exe 275 PID 552 set thread context of 2316 552 xls.exe 277 PID 2316 set thread context of 1020 2316 svchost.exe 278 PID 552 set thread context of 4764 552 xls.exe 279 PID 4764 set thread context of 4352 4764 svchost.exe 280 PID 552 set thread context of 192 552 xls.exe 281 PID 192 set thread context of 3508 192 svchost.exe 282 - Program crash 4 IoCs
pid pid_target Process procid_target 1560 1120 WerFault.exe 87 1996 1812 WerFault.exe 93 2412 2392 WerFault.exe 98 212 4712 WerFault.exe 105 - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings ISF form == 20030316 M#EGLV003090032432.scr - Modifies registry key 1 TTPs 2 IoCs
pid Process 1288 reg.exe 3460 reg.exe - Suspicious behavior: EnumeratesProcesses 212 IoCs
pid Process 4768 ISF form == 20030316 M#EGLV003090032432.scr 4768 ISF form == 20030316 M#EGLV003090032432.scr 3176 xls.exe 3176 xls.exe 352 svchost.exe 352 svchost.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 4048 svchost.exe 4048 svchost.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 1996 WerFault.exe 4584 svchost.exe 4584 svchost.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 4728 svchost.exe 4728 svchost.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 212 WerFault.exe 2436 svchost.exe 2436 svchost.exe 2108 svchost.exe 2108 svchost.exe 3968 svchost.exe 3968 svchost.exe 4128 svchost.exe 4128 svchost.exe 5044 svchost.exe 5044 svchost.exe 372 svchost.exe 372 svchost.exe 508 svchost.exe 508 svchost.exe 808 svchost.exe 808 svchost.exe 2052 svchost.exe 2052 svchost.exe 1900 svchost.exe 1900 svchost.exe 4612 svchost.exe 4612 svchost.exe 3876 svchost.exe 3876 svchost.exe 4588 svchost.exe 4588 svchost.exe 1972 svchost.exe 1972 svchost.exe 4476 svchost.exe 4476 svchost.exe 4848 svchost.exe 4848 svchost.exe 5076 svchost.exe 5076 svchost.exe 3408 svchost.exe 3408 svchost.exe 2148 svchost.exe 2148 svchost.exe 2788 svchost.exe 2788 svchost.exe 4192 svchost.exe 4192 svchost.exe 4336 svchost.exe 4336 svchost.exe 1156 svchost.exe 1156 svchost.exe 4536 svchost.exe 4536 svchost.exe 2456 svchost.exe 2456 svchost.exe 4340 svchost.exe 4340 svchost.exe 1116 svchost.exe 1116 svchost.exe 2248 svchost.exe 2248 svchost.exe 2852 svchost.exe 2852 svchost.exe 4400 svchost.exe 4400 svchost.exe 5004 svchost.exe 5004 svchost.exe 3480 svchost.exe 3480 svchost.exe 3712 svchost.exe 3712 svchost.exe 3948 svchost.exe 3948 svchost.exe 2092 svchost.exe 2092 svchost.exe 1188 svchost.exe 1188 svchost.exe 2152 svchost.exe 2152 svchost.exe 4808 svchost.exe 4808 svchost.exe 3364 svchost.exe 3364 svchost.exe 4196 svchost.exe 4196 svchost.exe 1584 svchost.exe 1584 svchost.exe 1424 svchost.exe 1424 svchost.exe 4632 svchost.exe 4632 svchost.exe 2716 svchost.exe 2716 svchost.exe 4968 svchost.exe 4968 svchost.exe 2472 svchost.exe 2472 svchost.exe 4416 svchost.exe 4416 svchost.exe 608 svchost.exe 608 svchost.exe 3348 svchost.exe 3348 svchost.exe 4784 svchost.exe 4784 svchost.exe 4996 svchost.exe 4996 svchost.exe 2588 svchost.exe 2588 svchost.exe 2960 svchost.exe 2960 svchost.exe 4708 svchost.exe 4708 svchost.exe 4852 svchost.exe 4852 svchost.exe 4508 svchost.exe 4508 svchost.exe 652 svchost.exe 652 svchost.exe 4456 svchost.exe 4456 svchost.exe 4388 svchost.exe 4388 svchost.exe 644 svchost.exe 644 svchost.exe 2332 svchost.exe 2332 svchost.exe 4872 svchost.exe 4872 svchost.exe 4772 svchost.exe 4772 svchost.exe 4884 svchost.exe 4884 svchost.exe 2372 svchost.exe 2372 svchost.exe 4540 svchost.exe 4540 svchost.exe 2316 svchost.exe 2316 svchost.exe 4764 svchost.exe 4764 svchost.exe 192 svchost.exe 192 svchost.exe - Suspicious behavior: MapViewOfSection 90 IoCs
pid Process 4768 ISF form == 20030316 M#EGLV003090032432.scr 3176 xls.exe 352 svchost.exe 4048 svchost.exe 4584 svchost.exe 4728 svchost.exe 2436 svchost.exe 2108 svchost.exe 3968 svchost.exe 4128 svchost.exe 5044 svchost.exe 5044 svchost.exe 372 svchost.exe 508 svchost.exe 808 svchost.exe 2052 svchost.exe 1900 svchost.exe 4612 svchost.exe 4612 svchost.exe 3876 svchost.exe 4588 svchost.exe 1972 svchost.exe 4476 svchost.exe 4848 svchost.exe 5076 svchost.exe 3408 svchost.exe 2148 svchost.exe 2148 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 4192 svchost.exe 4336 svchost.exe 1156 svchost.exe 4536 svchost.exe 2456 svchost.exe 4340 svchost.exe 1116 svchost.exe 2248 svchost.exe 2852 svchost.exe 4400 svchost.exe 5004 svchost.exe 3480 svchost.exe 3712 svchost.exe 3948 svchost.exe 2092 svchost.exe 1188 svchost.exe 1188 svchost.exe 2152 svchost.exe 4808 svchost.exe 3364 svchost.exe 4196 svchost.exe 1584 svchost.exe 1424 svchost.exe 4632 svchost.exe 2716 svchost.exe 4968 svchost.exe 4968 svchost.exe 2472 svchost.exe 4416 svchost.exe 4416 svchost.exe 4416 svchost.exe 608 svchost.exe 3348 svchost.exe 4784 svchost.exe 4996 svchost.exe 4996 svchost.exe 2588 svchost.exe 2960 svchost.exe 4708 svchost.exe 4708 svchost.exe 4852 svchost.exe 4852 svchost.exe 4508 svchost.exe 652 svchost.exe 4456 svchost.exe 4388 svchost.exe 4388 svchost.exe 644 svchost.exe 644 svchost.exe 2332 svchost.exe 4872 svchost.exe 4772 svchost.exe 4884 svchost.exe 2372 svchost.exe 2372 svchost.exe 4540 svchost.exe 2316 svchost.exe 4764 svchost.exe 192 svchost.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 1560 WerFault.exe Token: SeBackupPrivilege 1560 WerFault.exe Token: SeDebugPrivilege 1560 WerFault.exe Token: SeDebugPrivilege 1996 WerFault.exe Token: SeDebugPrivilege 2412 WerFault.exe Token: SeDebugPrivilege 212 WerFault.exe - Suspicious use of WriteProcessMemory 1321 IoCs
description pid Process procid_target PID 4768 wrote to memory of 2820 4768 ISF form == 20030316 M#EGLV003090032432.scr 73 PID 4768 wrote to memory of 2820 4768 ISF form == 20030316 M#EGLV003090032432.scr 73 PID 4768 wrote to memory of 2820 4768 ISF form == 20030316 M#EGLV003090032432.scr 73 PID 2820 wrote to memory of 1160 2820 ISF form == 20030316 M#EGLV003090032432.scr 74 PID 2820 wrote to memory of 1160 2820 ISF form == 20030316 M#EGLV003090032432.scr 74 PID 2820 wrote to memory of 1160 2820 ISF form == 20030316 M#EGLV003090032432.scr 74 PID 1160 wrote to memory of 3460 1160 cmd.exe 76 PID 1160 wrote to memory of 3460 1160 cmd.exe 76 PID 1160 wrote to memory of 3460 1160 cmd.exe 76 PID 2820 wrote to memory of 2496 2820 ISF form == 20030316 M#EGLV003090032432.scr 77 PID 2820 wrote to memory of 2496 2820 ISF form == 20030316 M#EGLV003090032432.scr 77 PID 2820 wrote to memory of 2496 2820 ISF form == 20030316 M#EGLV003090032432.scr 77 PID 2496 wrote to memory of 4204 2496 WScript.exe 80 PID 2496 wrote to memory of 4204 2496 WScript.exe 80 PID 2496 wrote to memory of 4204 2496 WScript.exe 80 PID 4204 wrote to memory of 3176 4204 cmd.exe 82 PID 4204 wrote to memory of 3176 4204 cmd.exe 82 PID 4204 wrote to memory of 3176 4204 cmd.exe 82 PID 3176 wrote to memory of 552 3176 xls.exe 83 PID 3176 wrote to memory of 552 3176 xls.exe 83 PID 3176 wrote to memory of 552 3176 xls.exe 83 PID 552 wrote to memory of 804 552 xls.exe 84 PID 552 wrote to memory of 804 552 xls.exe 84 PID 552 wrote to memory of 804 552 xls.exe 84 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 552 wrote to memory of 352 552 xls.exe 86 PID 352 wrote to memory of 1120 352 svchost.exe 87 PID 352 wrote to memory of 1120 352 svchost.exe 87 PID 352 wrote to memory of 1120 352 svchost.exe 87 PID 804 wrote to memory of 1288 804 cmd.exe 88 PID 804 wrote to memory of 1288 804 cmd.exe 88 PID 804 wrote to memory of 1288 804 cmd.exe 88 PID 552 wrote to memory of 4052 552 xls.exe 91 PID 552 wrote to memory of 4052 552 xls.exe 91 PID 552 wrote to memory of 4052 552 xls.exe 91 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 552 wrote to memory of 4048 552 xls.exe 92 PID 4048 wrote to memory of 1812 4048 svchost.exe 93 PID 4048 wrote to memory of 1812 4048 svchost.exe 93 PID 4048 wrote to memory of 1812 4048 svchost.exe 93 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 552 wrote to memory of 4584 552 xls.exe 97 PID 4584 wrote to memory of 2392 4584 svchost.exe 98 PID 4584 wrote to memory of 2392 4584 svchost.exe 98 PID 4584 wrote to memory of 2392 4584 svchost.exe 98 PID 552 wrote to memory of 2864 552 xls.exe 101 PID 552 wrote to memory of 2864 552 xls.exe 101 PID 552 wrote to memory of 2864 552 xls.exe 101 PID 552 wrote to memory of 4736 552 xls.exe 102 PID 552 wrote to memory of 4736 552 xls.exe 102 PID 552 wrote to memory of 4736 552 xls.exe 102 PID 552 wrote to memory of 4744 552 xls.exe 103 PID 552 wrote to memory of 4744 552 xls.exe 103 PID 552 wrote to memory of 4744 552 xls.exe 103 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 552 wrote to memory of 4728 552 xls.exe 104 PID 4728 wrote to memory of 4712 4728 svchost.exe 105 PID 4728 wrote to memory of 4712 4728 svchost.exe 105 PID 4728 wrote to memory of 4712 4728 svchost.exe 105 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 552 wrote to memory of 2436 552 xls.exe 107 PID 2436 wrote to memory of 1540 2436 svchost.exe 108 PID 2436 wrote to memory of 1540 2436 svchost.exe 108 PID 2436 wrote to memory of 1540 2436 svchost.exe 108 PID 552 wrote to memory of 2076 552 xls.exe 109 PID 552 wrote to memory of 2076 552 xls.exe 109 PID 552 wrote to memory of 2076 552 xls.exe 109 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 552 wrote to memory of 2108 552 xls.exe 110 PID 2108 wrote to memory of 4944 2108 svchost.exe 111 PID 2108 wrote to memory of 4944 2108 svchost.exe 111 PID 2108 wrote to memory of 4944 2108 svchost.exe 111 PID 552 wrote to memory of 4120 552 xls.exe 112 PID 552 wrote to memory of 4120 552 xls.exe 112 PID 552 wrote to memory of 4120 552 xls.exe 112 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 552 wrote to memory of 3968 552 xls.exe 113 PID 3968 wrote to memory of 4912 3968 svchost.exe 114 PID 3968 wrote to memory of 4912 3968 svchost.exe 114 PID 3968 wrote to memory of 4912 3968 svchost.exe 114 PID 552 wrote to memory of 3788 552 xls.exe 115 PID 552 wrote to memory of 3788 552 xls.exe 115 PID 552 wrote to memory of 3788 552 xls.exe 115 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 552 wrote to memory of 4128 552 xls.exe 116 PID 4128 wrote to memory of 3488 4128 svchost.exe 117 PID 4128 wrote to memory of 3488 4128 svchost.exe 117 PID 4128 wrote to memory of 3488 4128 svchost.exe 117 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 552 wrote to memory of 5044 552 xls.exe 118 PID 5044 wrote to memory of 3792 5044 svchost.exe 119 PID 5044 wrote to memory of 3792 5044 svchost.exe 119 PID 5044 wrote to memory of 3792 5044 svchost.exe 119 PID 5044 wrote to memory of 3104 5044 svchost.exe 120 PID 5044 wrote to memory of 3104 5044 svchost.exe 120 PID 5044 wrote to memory of 3104 5044 svchost.exe 120 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 552 wrote to memory of 372 552 xls.exe 121 PID 372 wrote to memory of 4264 372 svchost.exe 122 PID 372 wrote to memory of 4264 372 svchost.exe 122 PID 372 wrote to memory of 4264 372 svchost.exe 122 PID 552 wrote to memory of 4156 552 xls.exe 123 PID 552 wrote to memory of 4156 552 xls.exe 123 PID 552 wrote to memory of 4156 552 xls.exe 123 PID 552 wrote to memory of 4188 552 xls.exe 124 PID 552 wrote to memory of 4188 552 xls.exe 124 PID 552 wrote to memory of 4188 552 xls.exe 124 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 552 wrote to memory of 508 552 xls.exe 125 PID 508 wrote to memory of 3084 508 svchost.exe 126 PID 508 wrote to memory of 3084 508 svchost.exe 126 PID 508 wrote to memory of 3084 508 svchost.exe 126 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 552 wrote to memory of 808 552 xls.exe 127 PID 808 wrote to memory of 1052 808 svchost.exe 128 PID 808 wrote to memory of 1052 808 svchost.exe 128 PID 808 wrote to memory of 1052 808 svchost.exe 128 PID 552 wrote to memory of 1392 552 xls.exe 129 PID 552 wrote to memory of 1392 552 xls.exe 129 PID 552 wrote to memory of 1392 552 xls.exe 129 PID 552 wrote to memory of 1712 552 xls.exe 130 PID 552 wrote to memory of 1712 552 xls.exe 130 PID 552 wrote to memory of 1712 552 xls.exe 130 PID 552 wrote to memory of 1768 552 xls.exe 131 PID 552 wrote to memory of 1768 552 xls.exe 131 PID 552 wrote to memory of 1768 552 xls.exe 131 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 552 wrote to memory of 2052 552 xls.exe 132 PID 2052 wrote to memory of 3144 2052 svchost.exe 133 PID 2052 wrote to memory of 3144 2052 svchost.exe 133 PID 2052 wrote to memory of 3144 2052 svchost.exe 133 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 552 wrote to memory of 1900 552 xls.exe 134 PID 1900 wrote to memory of 2396 1900 svchost.exe 135 PID 1900 wrote to memory of 2396 1900 svchost.exe 135 PID 1900 wrote to memory of 2396 1900 svchost.exe 135 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 552 wrote to memory of 4612 552 xls.exe 136 PID 4612 wrote to memory of 4408 4612 svchost.exe 137 PID 4612 wrote to memory of 4408 4612 svchost.exe 137 PID 4612 wrote to memory of 4408 4612 svchost.exe 137 PID 4612 wrote to memory of 720 4612 svchost.exe 138 PID 4612 wrote to memory of 720 4612 svchost.exe 138 PID 4612 wrote to memory of 720 4612 svchost.exe 138 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 552 wrote to memory of 3876 552 xls.exe 139 PID 3876 wrote to memory of 2320 3876 svchost.exe 140 PID 3876 wrote to memory of 2320 3876 svchost.exe 140 PID 3876 wrote to memory of 2320 3876 svchost.exe 140 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 552 wrote to memory of 4588 552 xls.exe 141 PID 4588 wrote to memory of 4468 4588 svchost.exe 142 PID 4588 wrote to memory of 4468 4588 svchost.exe 142 PID 4588 wrote to memory of 4468 4588 svchost.exe 142 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 552 wrote to memory of 1972 552 xls.exe 143 PID 1972 wrote to memory of 1468 1972 svchost.exe 144 PID 1972 wrote to memory of 1468 1972 svchost.exe 144 PID 1972 wrote to memory of 1468 1972 svchost.exe 144 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 552 wrote to memory of 4476 552 xls.exe 145 PID 4476 wrote to memory of 1528 4476 svchost.exe 146 PID 4476 wrote to memory of 1528 4476 svchost.exe 146 PID 4476 wrote to memory of 1528 4476 svchost.exe 146 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 552 wrote to memory of 4848 552 xls.exe 147 PID 4848 wrote to memory of 4628 4848 svchost.exe 148 PID 4848 wrote to memory of 4628 4848 svchost.exe 148 PID 4848 wrote to memory of 4628 4848 svchost.exe 148 PID 552 wrote to memory of 5012 552 xls.exe 149 PID 552 wrote to memory of 5012 552 xls.exe 149 PID 552 wrote to memory of 5012 552 xls.exe 149 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 552 wrote to memory of 5076 552 xls.exe 150 PID 5076 wrote to memory of 4816 5076 svchost.exe 151 PID 5076 wrote to memory of 4816 5076 svchost.exe 151 PID 5076 wrote to memory of 4816 5076 svchost.exe 151 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 552 wrote to memory of 3408 552 xls.exe 152 PID 3408 wrote to memory of 2304 3408 svchost.exe 153 PID 3408 wrote to memory of 2304 3408 svchost.exe 153 PID 3408 wrote to memory of 2304 3408 svchost.exe 153 PID 552 wrote to memory of 2184 552 xls.exe 154 PID 552 wrote to memory of 2184 552 xls.exe 154 PID 552 wrote to memory of 2184 552 xls.exe 154 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 552 wrote to memory of 2148 552 xls.exe 155 PID 2148 wrote to memory of 3680 2148 svchost.exe 156 PID 2148 wrote to memory of 3680 2148 svchost.exe 156 PID 2148 wrote to memory of 3680 2148 svchost.exe 156 PID 2148 wrote to memory of 4248 2148 svchost.exe 157 PID 2148 wrote to memory of 4248 2148 svchost.exe 157 PID 2148 wrote to memory of 4248 2148 svchost.exe 157 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 552 wrote to memory of 2788 552 xls.exe 158 PID 2788 wrote to memory of 4040 2788 svchost.exe 159 PID 2788 wrote to memory of 4040 2788 svchost.exe 159 PID 2788 wrote to memory of 4040 2788 svchost.exe 159 PID 2788 wrote to memory of 4000 2788 svchost.exe 160 PID 2788 wrote to memory of 4000 2788 svchost.exe 160 PID 2788 wrote to memory of 4000 2788 svchost.exe 160 PID 2788 wrote to memory of 4176 2788 svchost.exe 161 PID 2788 wrote to memory of 4176 2788 svchost.exe 161 PID 2788 wrote to memory of 4176 2788 svchost.exe 161 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 552 wrote to memory of 4192 552 xls.exe 162 PID 4192 wrote to memory of 4864 4192 svchost.exe 163 PID 4192 wrote to memory of 4864 4192 svchost.exe 163 PID 4192 wrote to memory of 4864 4192 svchost.exe 163 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 552 wrote to memory of 4336 552 xls.exe 164 PID 4336 wrote to memory of 3096 4336 svchost.exe 165 PID 4336 wrote to memory of 3096 4336 svchost.exe 165 PID 4336 wrote to memory of 3096 4336 svchost.exe 165 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 552 wrote to memory of 1156 552 xls.exe 166 PID 1156 wrote to memory of 4460 1156 svchost.exe 167 PID 1156 wrote to memory of 4460 1156 svchost.exe 167 PID 1156 wrote to memory of 4460 1156 svchost.exe 167 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 552 wrote to memory of 4536 552 xls.exe 168 PID 4536 wrote to memory of 3700 4536 svchost.exe 169 PID 4536 wrote to memory of 3700 4536 svchost.exe 169 PID 4536 wrote to memory of 3700 4536 svchost.exe 169 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 552 wrote to memory of 2456 552 xls.exe 170 PID 2456 wrote to memory of 5020 2456 svchost.exe 171 PID 2456 wrote to memory of 5020 2456 svchost.exe 171 PID 2456 wrote to memory of 5020 2456 svchost.exe 171 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 552 wrote to memory of 4340 552 xls.exe 172 PID 4340 wrote to memory of 744 4340 svchost.exe 173 PID 4340 wrote to memory of 744 4340 svchost.exe 173 PID 4340 wrote to memory of 744 4340 svchost.exe 173 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 552 wrote to memory of 1116 552 xls.exe 174 PID 1116 wrote to memory of 4556 1116 svchost.exe 175 PID 1116 wrote to memory of 4556 1116 svchost.exe 175 PID 1116 wrote to memory of 4556 1116 svchost.exe 175 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 552 wrote to memory of 2248 552 xls.exe 176 PID 2248 wrote to memory of 4516 2248 svchost.exe 177 PID 2248 wrote to memory of 4516 2248 svchost.exe 177 PID 2248 wrote to memory of 4516 2248 svchost.exe 177 PID 552 wrote to memory of 3908 552 xls.exe 178 PID 552 wrote to memory of 3908 552 xls.exe 178 PID 552 wrote to memory of 3908 552 xls.exe 178 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 552 wrote to memory of 2852 552 xls.exe 179 PID 2852 wrote to memory of 4776 2852 svchost.exe 180 PID 2852 wrote to memory of 4776 2852 svchost.exe 180 PID 2852 wrote to memory of 4776 2852 svchost.exe 180 PID 552 wrote to memory of 1092 552 xls.exe 181 PID 552 wrote to memory of 1092 552 xls.exe 181 PID 552 wrote to memory of 1092 552 xls.exe 181 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 552 wrote to memory of 4400 552 xls.exe 182 PID 4400 wrote to memory of 4800 4400 svchost.exe 183 PID 4400 wrote to memory of 4800 4400 svchost.exe 183 PID 4400 wrote to memory of 4800 4400 svchost.exe 183 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 552 wrote to memory of 5004 552 xls.exe 184 PID 5004 wrote to memory of 3900 5004 svchost.exe 185 PID 5004 wrote to memory of 3900 5004 svchost.exe 185 PID 5004 wrote to memory of 3900 5004 svchost.exe 185 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 552 wrote to memory of 3480 552 xls.exe 186 PID 3480 wrote to memory of 1764 3480 svchost.exe 187 PID 3480 wrote to memory of 1764 3480 svchost.exe 187 PID 3480 wrote to memory of 1764 3480 svchost.exe 187 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 552 wrote to memory of 3712 552 xls.exe 188 PID 3712 wrote to memory of 3208 3712 svchost.exe 189 PID 3712 wrote to memory of 3208 3712 svchost.exe 189 PID 3712 wrote to memory of 3208 3712 svchost.exe 189 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 552 wrote to memory of 3948 552 xls.exe 190 PID 3948 wrote to memory of 4500 3948 svchost.exe 191 PID 3948 wrote to memory of 4500 3948 svchost.exe 191 PID 3948 wrote to memory of 4500 3948 svchost.exe 191 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 552 wrote to memory of 2092 552 xls.exe 192 PID 2092 wrote to memory of 648 2092 svchost.exe 193 PID 2092 wrote to memory of 648 2092 svchost.exe 193 PID 2092 wrote to memory of 648 2092 svchost.exe 193 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 552 wrote to memory of 1188 552 xls.exe 194 PID 1188 wrote to memory of 1312 1188 svchost.exe 195 PID 1188 wrote to memory of 1312 1188 svchost.exe 195 PID 1188 wrote to memory of 1312 1188 svchost.exe 195 PID 1188 wrote to memory of 3896 1188 svchost.exe 196 PID 1188 wrote to memory of 3896 1188 svchost.exe 196 PID 1188 wrote to memory of 3896 1188 svchost.exe 196 PID 552 wrote to memory of 2400 552 xls.exe 197 PID 552 wrote to memory of 2400 552 xls.exe 197 PID 552 wrote to memory of 2400 552 xls.exe 197 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 552 wrote to memory of 2152 552 xls.exe 198 PID 2152 wrote to memory of 2996 2152 svchost.exe 199 PID 2152 wrote to memory of 2996 2152 svchost.exe 199 PID 2152 wrote to memory of 2996 2152 svchost.exe 199 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 552 wrote to memory of 4808 552 xls.exe 200 PID 4808 wrote to memory of 4920 4808 svchost.exe 201 PID 4808 wrote to memory of 4920 4808 svchost.exe 201 PID 4808 wrote to memory of 4920 4808 svchost.exe 201 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 552 wrote to memory of 3364 552 xls.exe 202 PID 3364 wrote to memory of 4984 3364 svchost.exe 203 PID 3364 wrote to memory of 4984 3364 svchost.exe 203 PID 3364 wrote to memory of 4984 3364 svchost.exe 203 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 552 wrote to memory of 4196 552 xls.exe 204 PID 4196 wrote to memory of 4200 4196 svchost.exe 205 PID 4196 wrote to memory of 4200 4196 svchost.exe 205 PID 4196 wrote to memory of 4200 4196 svchost.exe 205 PID 552 wrote to memory of 1396 552 xls.exe 206 PID 552 wrote to memory of 1396 552 xls.exe 206 PID 552 wrote to memory of 1396 552 xls.exe 206 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 552 wrote to memory of 1584 552 xls.exe 207 PID 1584 wrote to memory of 2912 1584 svchost.exe 208 PID 1584 wrote to memory of 2912 1584 svchost.exe 208 PID 1584 wrote to memory of 2912 1584 svchost.exe 208 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 552 wrote to memory of 1424 552 xls.exe 209 PID 1424 wrote to memory of 4640 1424 svchost.exe 210 PID 1424 wrote to memory of 4640 1424 svchost.exe 210 PID 1424 wrote to memory of 4640 1424 svchost.exe 210 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 552 wrote to memory of 4632 552 xls.exe 211 PID 4632 wrote to memory of 3660 4632 svchost.exe 212 PID 4632 wrote to memory of 3660 4632 svchost.exe 212 PID 4632 wrote to memory of 3660 4632 svchost.exe 212 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 552 wrote to memory of 2716 552 xls.exe 213 PID 2716 wrote to memory of 4804 2716 svchost.exe 214 PID 2716 wrote to memory of 4804 2716 svchost.exe 214 PID 2716 wrote to memory of 4804 2716 svchost.exe 214 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 552 wrote to memory of 4968 552 xls.exe 215 PID 4968 wrote to memory of 5112 4968 svchost.exe 216 PID 4968 wrote to memory of 5112 4968 svchost.exe 216 PID 4968 wrote to memory of 5112 4968 svchost.exe 216 PID 4968 wrote to memory of 2348 4968 svchost.exe 217 PID 4968 wrote to memory of 2348 4968 svchost.exe 217 PID 4968 wrote to memory of 2348 4968 svchost.exe 217 PID 552 wrote to memory of 2132 552 xls.exe 218 PID 552 wrote to memory of 2132 552 xls.exe 218 PID 552 wrote to memory of 2132 552 xls.exe 218 PID 552 wrote to memory of 3624 552 xls.exe 219 PID 552 wrote to memory of 3624 552 xls.exe 219 PID 552 wrote to memory of 3624 552 xls.exe 219 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 552 wrote to memory of 2472 552 xls.exe 220 PID 2472 wrote to memory of 3212 2472 svchost.exe 221 PID 2472 wrote to memory of 3212 2472 svchost.exe 221 PID 2472 wrote to memory of 3212 2472 svchost.exe 221 PID 552 wrote to memory of 3824 552 xls.exe 222 PID 552 wrote to memory of 3824 552 xls.exe 222 PID 552 wrote to memory of 3824 552 xls.exe 222 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 552 wrote to memory of 4416 552 xls.exe 223 PID 4416 wrote to memory of 4880 4416 svchost.exe 224 PID 4416 wrote to memory of 4880 4416 svchost.exe 224 PID 4416 wrote to memory of 4880 4416 svchost.exe 224 PID 4416 wrote to memory of 4160 4416 svchost.exe 225 PID 4416 wrote to memory of 4160 4416 svchost.exe 225 PID 4416 wrote to memory of 4160 4416 svchost.exe 225 PID 4416 wrote to memory of 500 4416 svchost.exe 226 PID 4416 wrote to memory of 500 4416 svchost.exe 226 PID 4416 wrote to memory of 500 4416 svchost.exe 226 PID 552 wrote to memory of 4820 552 xls.exe 227 PID 552 wrote to memory of 4820 552 xls.exe 227 PID 552 wrote to memory of 4820 552 xls.exe 227 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 552 wrote to memory of 608 552 xls.exe 228 PID 608 wrote to memory of 1112 608 svchost.exe 229 PID 608 wrote to memory of 1112 608 svchost.exe 229 PID 608 wrote to memory of 1112 608 svchost.exe 229 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 552 wrote to memory of 3348 552 xls.exe 230 PID 3348 wrote to memory of 4952 3348 svchost.exe 231 PID 3348 wrote to memory of 4952 3348 svchost.exe 231 PID 3348 wrote to memory of 4952 3348 svchost.exe 231 PID 552 wrote to memory of 4896 552 xls.exe 232 PID 552 wrote to memory of 4896 552 xls.exe 232 PID 552 wrote to memory of 4896 552 xls.exe 232 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 552 wrote to memory of 4784 552 xls.exe 233 PID 4784 wrote to memory of 4368 4784 svchost.exe 234 PID 4784 wrote to memory of 4368 4784 svchost.exe 234 PID 4784 wrote to memory of 4368 4784 svchost.exe 234 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 552 wrote to memory of 4996 552 xls.exe 235 PID 4996 wrote to memory of 2592 4996 svchost.exe 236 PID 4996 wrote to memory of 2592 4996 svchost.exe 236 PID 4996 wrote to memory of 2592 4996 svchost.exe 236 PID 4996 wrote to memory of 4304 4996 svchost.exe 237 PID 4996 wrote to memory of 4304 4996 svchost.exe 237 PID 4996 wrote to memory of 4304 4996 svchost.exe 237 PID 552 wrote to memory of 4716 552 xls.exe 238 PID 552 wrote to memory of 4716 552 xls.exe 238 PID 552 wrote to memory of 4716 552 xls.exe 238 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 552 wrote to memory of 2588 552 xls.exe 239 PID 2588 wrote to memory of 4272 2588 svchost.exe 240 PID 2588 wrote to memory of 4272 2588 svchost.exe 240 PID 2588 wrote to memory of 4272 2588 svchost.exe 240 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 552 wrote to memory of 2960 552 xls.exe 241 PID 2960 wrote to memory of 2232 2960 svchost.exe 242 PID 2960 wrote to memory of 2232 2960 svchost.exe 242 PID 2960 wrote to memory of 2232 2960 svchost.exe 242 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 552 wrote to memory of 4708 552 xls.exe 243 PID 4708 wrote to memory of 4868 4708 svchost.exe 244 PID 4708 wrote to memory of 4868 4708 svchost.exe 244 PID 4708 wrote to memory of 4868 4708 svchost.exe 244 PID 4708 wrote to memory of 1632 4708 svchost.exe 245 PID 4708 wrote to memory of 1632 4708 svchost.exe 245 PID 4708 wrote to memory of 1632 4708 svchost.exe 245 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 552 wrote to memory of 4852 552 xls.exe 246 PID 4852 wrote to memory of 3708 4852 svchost.exe 247 PID 4852 wrote to memory of 3708 4852 svchost.exe 247 PID 4852 wrote to memory of 3708 4852 svchost.exe 247 PID 4852 wrote to memory of 5104 4852 svchost.exe 248 PID 4852 wrote to memory of 5104 4852 svchost.exe 248 PID 4852 wrote to memory of 5104 4852 svchost.exe 248 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 552 wrote to memory of 4508 552 xls.exe 249 PID 4508 wrote to memory of 4788 4508 svchost.exe 250 PID 4508 wrote to memory of 4788 4508 svchost.exe 250 PID 4508 wrote to memory of 4788 4508 svchost.exe 250 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 552 wrote to memory of 652 552 xls.exe 251 PID 652 wrote to memory of 1056 652 svchost.exe 252 PID 652 wrote to memory of 1056 652 svchost.exe 252 PID 652 wrote to memory of 1056 652 svchost.exe 252 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 552 wrote to memory of 4456 552 xls.exe 253 PID 4456 wrote to memory of 3840 4456 svchost.exe 254 PID 4456 wrote to memory of 3840 4456 svchost.exe 254 PID 4456 wrote to memory of 3840 4456 svchost.exe 254 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 552 wrote to memory of 4388 552 xls.exe 255 PID 4388 wrote to memory of 4364 4388 svchost.exe 256 PID 4388 wrote to memory of 4364 4388 svchost.exe 256 PID 4388 wrote to memory of 4364 4388 svchost.exe 256 PID 4388 wrote to memory of 3868 4388 svchost.exe 257 PID 4388 wrote to memory of 3868 4388 svchost.exe 257 PID 4388 wrote to memory of 3868 4388 svchost.exe 257 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 552 wrote to memory of 644 552 xls.exe 258 PID 644 wrote to memory of 2596 644 svchost.exe 259 PID 644 wrote to memory of 2596 644 svchost.exe 259 PID 644 wrote to memory of 2596 644 svchost.exe 259 PID 644 wrote to memory of 4752 644 svchost.exe 260 PID 644 wrote to memory of 4752 644 svchost.exe 260 PID 644 wrote to memory of 4752 644 svchost.exe 260 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 552 wrote to memory of 2332 552 xls.exe 261 PID 2332 wrote to memory of 3024 2332 svchost.exe 262 PID 2332 wrote to memory of 3024 2332 svchost.exe 262 PID 2332 wrote to memory of 3024 2332 svchost.exe 262 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 552 wrote to memory of 4872 552 xls.exe 263 PID 4872 wrote to memory of 4484 4872 svchost.exe 264 PID 4872 wrote to memory of 4484 4872 svchost.exe 264 PID 4872 wrote to memory of 4484 4872 svchost.exe 264 PID 552 wrote to memory of 3328 552 xls.exe 265 PID 552 wrote to memory of 3328 552 xls.exe 265 PID 552 wrote to memory of 3328 552 xls.exe 265 PID 552 wrote to memory of 2300 552 xls.exe 266 PID 552 wrote to memory of 2300 552 xls.exe 266 PID 552 wrote to memory of 2300 552 xls.exe 266 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 552 wrote to memory of 4772 552 xls.exe 267 PID 4772 wrote to memory of 4932 4772 svchost.exe 268 PID 4772 wrote to memory of 4932 4772 svchost.exe 268 PID 4772 wrote to memory of 4932 4772 svchost.exe 268 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 552 wrote to memory of 4884 552 xls.exe 269 PID 4884 wrote to memory of 4432 4884 svchost.exe 270 PID 4884 wrote to memory of 4432 4884 svchost.exe 270 PID 4884 wrote to memory of 4432 4884 svchost.exe 270 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 552 wrote to memory of 2372 552 xls.exe 271 PID 2372 wrote to memory of 2980 2372 svchost.exe 272 PID 2372 wrote to memory of 2980 2372 svchost.exe 272 PID 2372 wrote to memory of 2980 2372 svchost.exe 272 PID 2372 wrote to memory of 1212 2372 svchost.exe 273 PID 2372 wrote to memory of 1212 2372 svchost.exe 273 PID 2372 wrote to memory of 1212 2372 svchost.exe 273 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 552 wrote to memory of 4540 552 xls.exe 274 PID 4540 wrote to memory of 724 4540 svchost.exe 275 PID 4540 wrote to memory of 724 4540 svchost.exe 275 PID 4540 wrote to memory of 724 4540 svchost.exe 275 PID 552 wrote to memory of 428 552 xls.exe 276 PID 552 wrote to memory of 428 552 xls.exe 276 PID 552 wrote to memory of 428 552 xls.exe 276 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 552 wrote to memory of 2316 552 xls.exe 277 PID 2316 wrote to memory of 1020 2316 svchost.exe 278 PID 2316 wrote to memory of 1020 2316 svchost.exe 278 PID 2316 wrote to memory of 1020 2316 svchost.exe 278 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 552 wrote to memory of 4764 552 xls.exe 279 PID 4764 wrote to memory of 4352 4764 svchost.exe 280 PID 4764 wrote to memory of 4352 4764 svchost.exe 280 PID 4764 wrote to memory of 4352 4764 svchost.exe 280 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 552 wrote to memory of 192 552 xls.exe 281 PID 192 wrote to memory of 3508 192 svchost.exe 282 PID 192 wrote to memory of 3508 192 svchost.exe 282 PID 192 wrote to memory of 3508 192 svchost.exe 282
Processes
-
C:\Users\Admin\AppData\Local\Temp\ISF form == 20030316 M#EGLV003090032432.scr"C:\Users\Admin\AppData\Local\Temp\ISF form == 20030316 M#EGLV003090032432.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\ISF form == 20030316 M#EGLV003090032432.scr"C:\Users\Admin\AppData\Local\Temp\ISF form == 20030316 M#EGLV003090032432.scr" /S2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
PID:3460
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\xls.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Roaming\remcos\xls.exeC:\Users\Admin\AppData\Roaming\remcos\xls.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Roaming\remcos\xls.exeC:\Users\Admin\AppData\Roaming\remcos\xls.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f8⤵
- Modifies registry key
PID:1288
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 2209⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4052
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 2249⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4584 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 2209⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2864
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4736
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4744
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4728 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 2289⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2436 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1540
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2076
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2108 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4944
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4120
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3968 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4912
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:3788
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4128 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3488
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5044 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3792
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3104
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:372 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4264
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4156
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4188
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:508 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3084
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:808 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1052
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:1392
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:1712
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:1768
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2052 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3144
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1900 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2396
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4612 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4408
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:720
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3876 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2320
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4588 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4468
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1972 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1468
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4476 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1528
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4848 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4628
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:5012
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5076 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4816
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3408 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2304
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2184
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2148 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3680
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4248
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2788 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4040
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4000
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4176
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4192 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4864
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4336 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3096
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1156 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4460
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4536 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3700
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2456 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:5020
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4340 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:744
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1116 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4556
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:2248 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4516
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:3908
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:2852 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4776
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:1092
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:4400 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4800
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:5004 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3900
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:3480 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1764
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:3712 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3208
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:3948 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4500
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:2092 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:648
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:1188 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1312
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3896
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2400
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:2152 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2996
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:4808 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4920
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:3364 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4984
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:4196 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4200
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:1396
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:1584 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2912
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:1424 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4640
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:4632 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3660
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:2716 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4804
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:4968 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:5112
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2348
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2132
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:3624
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:2472 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3212
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:3824
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:4416 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4880
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4160
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:500
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4820
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:608 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1112
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
- Suspicious behavior: MapViewOfSection
PID:3348 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4952
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4896
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4784
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4368
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4996
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2592
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4304
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4716
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2588
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4272
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2960
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2232
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4708
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4868
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1632
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4852
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3708
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:5104
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4508
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4788
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:652
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1056
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4456
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3840
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4388
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4364
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3868
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:644
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2596
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4752
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2332
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3024
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4872
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4484
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:3328
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2300
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4772
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4932
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4884
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4432
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2372
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:2980
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1212
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4540
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:724
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:428
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:2316
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:1020
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:4764
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:4352
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:192
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe8⤵PID:3508
-
-
-
-
-
-
-