Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
43s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07/07/2020, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe
-
Size
686KB
-
MD5
6a3708ad9f954e3abd920ce364540923
-
SHA1
3511a35920249c7def2bed50691d011310b76829
-
SHA256
6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3
-
SHA512
fa523d6d7acfa01de26ec28944e3fc9da9eda2575fc220207418f396c6583f12e466496290f43ff5cd3d0142f98bfdb6a350890d715b7a3f4c77524913ce205f
Score
10/10
Malware Config
Signatures
-
Program crash 6 IoCs
pid pid_target Process procid_target 1184 1620 WerFault.exe 67 1780 1620 WerFault.exe 67 3912 1620 WerFault.exe 67 2120 1620 WerFault.exe 67 3728 1620 WerFault.exe 67 740 1620 WerFault.exe 67 -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1231583446-2617009595-2137880041-1000\desktop.ini 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2104 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 69 PID 1620 wrote to memory of 2104 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 69 PID 1620 wrote to memory of 2104 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 69 PID 1620 wrote to memory of 3356 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 72 PID 1620 wrote to memory of 3356 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 72 PID 1620 wrote to memory of 3356 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 72 PID 1620 wrote to memory of 3836 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 75 PID 1620 wrote to memory of 3836 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 75 PID 1620 wrote to memory of 3836 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 75 PID 1620 wrote to memory of 3040 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 77 PID 1620 wrote to memory of 3040 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 77 PID 1620 wrote to memory of 3040 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 77 PID 1620 wrote to memory of 3120 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 79 PID 1620 wrote to memory of 3120 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 79 PID 1620 wrote to memory of 3120 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 79 PID 1620 wrote to memory of 2792 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 81 PID 1620 wrote to memory of 2792 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 81 PID 1620 wrote to memory of 2792 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 81 -
Suspicious use of AdjustPrivilegeToken 74 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2104 wmic.exe Token: SeSecurityPrivilege 2104 wmic.exe Token: SeTakeOwnershipPrivilege 2104 wmic.exe Token: SeLoadDriverPrivilege 2104 wmic.exe Token: SeSystemProfilePrivilege 2104 wmic.exe Token: SeSystemtimePrivilege 2104 wmic.exe Token: SeProfSingleProcessPrivilege 2104 wmic.exe Token: SeIncBasePriorityPrivilege 2104 wmic.exe Token: SeCreatePagefilePrivilege 2104 wmic.exe Token: SeBackupPrivilege 2104 wmic.exe Token: SeRestorePrivilege 2104 wmic.exe Token: SeShutdownPrivilege 2104 wmic.exe Token: SeDebugPrivilege 2104 wmic.exe Token: SeSystemEnvironmentPrivilege 2104 wmic.exe Token: SeRemoteShutdownPrivilege 2104 wmic.exe Token: SeUndockPrivilege 2104 wmic.exe Token: SeManageVolumePrivilege 2104 wmic.exe Token: 33 2104 wmic.exe Token: 34 2104 wmic.exe Token: 35 2104 wmic.exe Token: 36 2104 wmic.exe Token: SeBackupPrivilege 3864 vssvc.exe Token: SeRestorePrivilege 3864 vssvc.exe Token: SeAuditPrivilege 3864 vssvc.exe Token: SeIncreaseQuotaPrivilege 3836 wmic.exe Token: SeSecurityPrivilege 3836 wmic.exe Token: SeTakeOwnershipPrivilege 3836 wmic.exe Token: SeLoadDriverPrivilege 3836 wmic.exe Token: SeSystemProfilePrivilege 3836 wmic.exe Token: SeSystemtimePrivilege 3836 wmic.exe Token: SeProfSingleProcessPrivilege 3836 wmic.exe Token: SeIncBasePriorityPrivilege 3836 wmic.exe Token: SeCreatePagefilePrivilege 3836 wmic.exe Token: SeBackupPrivilege 3836 wmic.exe Token: SeRestorePrivilege 3836 wmic.exe Token: SeShutdownPrivilege 3836 wmic.exe Token: SeDebugPrivilege 3836 wmic.exe Token: SeSystemEnvironmentPrivilege 3836 wmic.exe Token: SeRemoteShutdownPrivilege 3836 wmic.exe Token: SeUndockPrivilege 3836 wmic.exe Token: SeManageVolumePrivilege 3836 wmic.exe Token: 33 3836 wmic.exe Token: 34 3836 wmic.exe Token: 35 3836 wmic.exe Token: 36 3836 wmic.exe Token: SeIncreaseQuotaPrivilege 3120 wmic.exe Token: SeSecurityPrivilege 3120 wmic.exe Token: SeTakeOwnershipPrivilege 3120 wmic.exe Token: SeLoadDriverPrivilege 3120 wmic.exe Token: SeSystemProfilePrivilege 3120 wmic.exe Token: SeSystemtimePrivilege 3120 wmic.exe Token: SeProfSingleProcessPrivilege 3120 wmic.exe Token: SeIncBasePriorityPrivilege 3120 wmic.exe Token: SeCreatePagefilePrivilege 3120 wmic.exe Token: SeBackupPrivilege 3120 wmic.exe Token: SeRestorePrivilege 3120 wmic.exe Token: SeShutdownPrivilege 3120 wmic.exe Token: SeDebugPrivilege 3120 wmic.exe Token: SeSystemEnvironmentPrivilege 3120 wmic.exe Token: SeRemoteShutdownPrivilege 3120 wmic.exe Token: SeUndockPrivilege 3120 wmic.exe Token: SeManageVolumePrivilege 3120 wmic.exe Token: 33 3120 wmic.exe Token: 34 3120 wmic.exe Token: 35 3120 wmic.exe Token: 36 3120 wmic.exe Token: SeRestorePrivilege 1184 WerFault.exe Token: SeBackupPrivilege 1184 WerFault.exe Token: SeDebugPrivilege 1184 WerFault.exe Token: SeDebugPrivilege 1780 WerFault.exe Token: SeDebugPrivilege 3912 WerFault.exe Token: SeDebugPrivilege 2120 WerFault.exe Token: SeDebugPrivilege 3728 WerFault.exe Token: SeDebugPrivilege 740 WerFault.exe -
Enumerates connected drives 3 TTPs
-
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe -
Suspicious behavior: EnumeratesProcesses 706 IoCs
pid Process 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1184 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 1780 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 3912 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 2120 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 3728 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 740 WerFault.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe 1620 6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3356 vssadmin.exe 3040 vssadmin.exe 2792 vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe"C:\Users\Admin\AppData\Local\Temp\6bacd97c278f9383891df6e9f72de7e106c0007b88d0999f051403ee19244ee3.exe"1⤵
- Drops desktop.ini file(s)
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
PID:1620 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:3356
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:3040
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 8402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 8922⤵
- Program crash
PID:1780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 8962⤵
- Program crash
PID:3912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 8922⤵
- Program crash
PID:2120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 9282⤵
- Program crash
PID:3728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 11402⤵
- Program crash
PID:740
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3864