Resubmissions
09-09-2020 09:18
200909-ev13telmdn 1008-09-2020 17:08
200908-br2a8ynnpn 1008-09-2020 17:07
200908-2bbw72ekmn 1008-09-2020 16:54
200908-qgbye23mhs 1008-09-2020 16:46
200908-p5f4c5cdzj 10Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
08-09-2020 16:54
Static task
static1
Behavioral task
behavioral1
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe
-
Size
154KB
-
MD5
91879bdd73625ac38c31fe5225310e92
-
SHA1
a007b979483ee6b57b93a11340932a60f5781570
-
SHA256
23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b
-
SHA512
22678f18385ed177ed34cac52fc8667c6d6cdc2953b1818a6e530411894aa6947b04408320137af8ebd5b1d6d733f374a1d962608e0e6c234e5a43b89fe9de3c
Malware Config
Extracted
Path
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
Family
raccoon
Ransom Note
[Raccoon Stealer] - v1.5.13-af-hotfix Release
Build compiled on Mon Jul 6 14:33:03 2020
Launched at: 2020.09.08 - 18:52:18 GMT
Bot_ID: 18823CA4-5761-4226-8787-CF36135F1C68_Admin
Running on a desktop
=R=A=C=C=O=O=N=
- Cookies: 0
- Passwords: 5
- Files: 0
System Information:
- System Language: English
- System TimeZone: -0 hrs
- IP: 154.61.71.13
- Location: 37.750999, -97.821999 | ?, ?, United States (?)
- ComputerName: LZUKLIOU
- Username: Admin
- Windows version: NT 10.0
- Product name: Windows 10 Pro
- System arch: x64
- CPU: Persocon Processor 2.5+ (2 cores)
- RAM: 4095 MB (717 MB used)
- Screen resolution: 1280x720
- Display devices:
0) Microsoft Basic Display Adapter
============
Extracted
Family
smokeloader
Version
2020
C2
http://dkajsdjiqwdwnfj.info/
http://2831ujedkdajsdj.info/
http://928eijdksasnfss.info/
https://dkajsdjiqwdwnfj.info/
https://2831ujedkdajsdj.info/
https://928eijdksasnfss.info/
rc4.i32
rc4.i32
Extracted
Family
zloader
Botnet
DLLobnova
Campaign
02.09.2020
C2
https://fsakfkdsajdajskjajs.online/gate.php
https://fdsadjsadsdsa.online/gate.php
https://dlsafoslfskfsafad.online/gate.php
https://dsofkasfsakdsdsa.online/gate.php
https://dkjsjdsjdjasduiasida.online/gate.php
https://fqnvtmqsywublocpheas.ru/gate.php
https://fqnvtmqsywublocpheas.su/gate.php
https://fqnvtmqsywublocpheas.eu/gate.php
https://fqnvtmqsywublocpheas.net/gate.php
https://fqnvtmqsywublodscpheas.com/gate.php
rc4.plain
rsa_pubkey.plain
Signatures
-
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
yara_rule raccoon_log_file -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
pid Process 740 203C.exe -
Deletes itself 1 IoCs
pid Process 2936 Process not Found -
Loads dropped DLL 8 IoCs
pid Process 408 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 784 regsvr32.exe 740 203C.exe 740 203C.exe 740 203C.exe 740 203C.exe 740 203C.exe 740 203C.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ubef = "regsvr32.exe /s C:\\Users\\Admin\\AppData\\Roaming\\Ewugfi\\ebdeoss.dll" msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ad6e-20.dat js -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 784 set thread context of 2920 784 regsvr32.exe 81 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1708 timeout.exe -
Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = c4542f101186d601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 751e06541186d601 svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 0b880b661186d601 svchost.exe -
Suspicious behavior: EnumeratesProcesses 2604 IoCs
pid Process 408 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 408 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found 2936 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 408 23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2064 svchost.exe Token: SeCreatePagefilePrivilege 2064 svchost.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3140 2936 Process not Found 75 PID 2936 wrote to memory of 3140 2936 Process not Found 75 PID 3140 wrote to memory of 784 3140 regsvr32.exe 76 PID 3140 wrote to memory of 784 3140 regsvr32.exe 76 PID 3140 wrote to memory of 784 3140 regsvr32.exe 76 PID 2936 wrote to memory of 740 2936 Process not Found 77 PID 2936 wrote to memory of 740 2936 Process not Found 77 PID 2936 wrote to memory of 740 2936 Process not Found 77 PID 740 wrote to memory of 2320 740 203C.exe 78 PID 740 wrote to memory of 2320 740 203C.exe 78 PID 740 wrote to memory of 2320 740 203C.exe 78 PID 2320 wrote to memory of 1708 2320 cmd.exe 80 PID 2320 wrote to memory of 1708 2320 cmd.exe 80 PID 2320 wrote to memory of 1708 2320 cmd.exe 80 PID 784 wrote to memory of 2920 784 regsvr32.exe 81 PID 784 wrote to memory of 2920 784 regsvr32.exe 81 PID 784 wrote to memory of 2920 784 regsvr32.exe 81 PID 784 wrote to memory of 2920 784 regsvr32.exe 81 PID 784 wrote to memory of 2920 784 regsvr32.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"C:\Users\Admin\AppData\Local\Temp\23bef893e3af7cb49dc5ae0a14452ed781f841db7397dc3ebb689291fd701b6b.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1F02.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1F02.dll2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Users\Admin\AppData\Local\Temp\203C.exeC:\Users\Admin\AppData\Local\Temp\203C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\203C.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1708
-
-