".exe" wrote 32 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 52 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 4 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 8 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 1024 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 182272 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 11776 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 0 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 4608 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 512 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 124) ".exe" wrote 32 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 532) ".exe" wrote 52 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 532) ".exe" wrote 4 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 532) ".exe" wrote 8 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 532) ".exe" wrote 32 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 52 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 4 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 8 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 1024 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 182272 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 11776 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 0 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 4608 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 512 bytes to a remote process "C:\7a60e9f0c00bcf5791d898c84c26f484b4c671223f6121dc3608970d8bf8fe4f.exe" (Handle: 120) ".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 664) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 664) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 664) ".exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 664) ".exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\mshta.exe" (Handle: 616) ".exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\mshta.exe" (Handle: 616) ".exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\mshta.exe" (Handle: 616) ".exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\mshta.exe" (Handle: 616) "sevnz.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 182272 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 11776 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128) "sevnz.exe" wrote 4608 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 128)