Analysis
- max time kernel
151s - max time network
113s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 09:22
Static task
static1
Behavioral task
behavioral1
Sample
d02a5551e929cd14fdb8db635659f433.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d02a5551e929cd14fdb8db635659f433.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target d02a5551e929cd14fdb8db635659f433.exe
- Size 326KB
- Sample201112-7apkeweb16
- SHA256 8f32a2bc4817137939fbd615fbcbab4c93dd0305e9d407ec6de706483c50556e
- MD5 d02a5551e929cd14fdb8db635659f433
- SHA1 033720580caa403721e86ba47467bbc7451296a3
- SHA512 a5aebdb6ac1cfb115832ce1c1d2ba7291f14e68956d829d7482f58a8ad6b1c85802205605f39b8b5cbbee77a6be2c2b87c8e874072e82cc9efb9c42be2af0c07
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1716 created 2328 1716 WerFault.exe 99 - Executes dropped EXE 6 IoCs
pid Process 68 9FDF.exe 940 9FDF.exe 2260 comeylol.exe 2940 comeylol.exe 2328 bctbdvj 1760 9FDF.exe - Deletes itself 1 IoCs
pid Process 2828 Process not Found - Loads dropped DLL 1 IoCs
pid Process 508 d02a5551e929cd14fdb8db635659f433.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Program crash 1 IoCs
pid pid_target Process procid_target 1716 2328 WerFault.exe 99 - Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 9FDF.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc comeylol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 comeylol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d02a5551e929cd14fdb8db635659f433.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d02a5551e929cd14fdb8db635659f433.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d02a5551e929cd14fdb8db635659f433.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 9FDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 9FDF.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 9FDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 comeylol.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 9FDF.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 9FDF.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service comeylol.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc comeylol.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service comeylol.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 744 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2333 IoCs
pid Process 508 d02a5551e929cd14fdb8db635659f433.exe 508 d02a5551e929cd14fdb8db635659f433.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 68 9FDF.exe 68 9FDF.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 516 explorer.exe 516 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 584 explorer.exe 584 explorer.exe 1128 explorer.exe 1128 explorer.exe 516 explorer.exe 516 explorer.exe 3584 explorer.exe 3584 explorer.exe 940 9FDF.exe 940 9FDF.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 4036 explorer.exe 4036 explorer.exe 940 9FDF.exe 940 9FDF.exe 1524 explorer.exe 1524 explorer.exe 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2260 comeylol.exe 2260 comeylol.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 516 explorer.exe 516 explorer.exe 516 explorer.exe 516 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2940 comeylol.exe 2940 comeylol.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2940 comeylol.exe 2940 comeylol.exe 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2776 explorer.exe 2828 Process not Found 2776 explorer.exe 1524 explorer.exe 1524 explorer.exe 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2776 explorer.exe 2776 explorer.exe 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 1448 explorer.exe 2828 Process not Found 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 2828 Process not Found 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1448 explorer.exe 1716 WerFault.exe 1448 explorer.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1716 WerFault.exe 1128 explorer.exe 2828 Process not Found 1128 explorer.exe 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 1716 WerFault.exe 1716 WerFault.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 3584 explorer.exe 584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 1448 explorer.exe 2828 Process not Found 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 1276 explorer.exe 2828 Process not Found 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 2828 Process not Found 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 2828 Process not Found 1276 explorer.exe 2828 Process not Found 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 1276 explorer.exe 2828 Process not Found 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 2828 Process not Found 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 4036 explorer.exe 2828 Process not Found 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 1276 explorer.exe 2828 Process not Found 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 2828 Process not Found 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 1448 explorer.exe 2828 Process not Found 1448 explorer.exe 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 2828 Process not Found 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 2828 Process not Found 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 3584 explorer.exe 2828 Process not Found 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 3584 explorer.exe 584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 1448 explorer.exe 2828 Process not Found 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 2828 Process not Found 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2408 explorer.exe 2408 explorer.exe 3584 explorer.exe 3584 explorer.exe 584 explorer.exe 584 explorer.exe 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1760 9FDF.exe 1760 9FDF.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 1128 explorer.exe 2828 Process not Found 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 2828 Process not Found 584 explorer.exe 2828 Process not Found 3584 explorer.exe 3584 explorer.exe 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 1276 explorer.exe 2828 Process not Found 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 584 explorer.exe 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 2828 Process not Found 2828 Process not Found 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 584 explorer.exe 3584 explorer.exe 2828 Process not Found 1448 explorer.exe 2828 Process not Found 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 1276 explorer.exe 1276 explorer.exe 2828 Process not Found 4036 explorer.exe 2828 Process not Found 4036 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 1524 explorer.exe 1524 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2408 explorer.exe 2408 explorer.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 3584 explorer.exe 584 explorer.exe 3584 explorer.exe 584 explorer.exe 2828 Process not Found 2828 Process not Found 1448 explorer.exe 1448 explorer.exe 1128 explorer.exe 1128 explorer.exe 2828 Process not Found 2828 Process not Found 1276 explorer.exe 1276 explorer.exe 4036 explorer.exe 4036 explorer.exe - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 508 d02a5551e929cd14fdb8db635659f433.exe 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2828 Process not Found 2260 comeylol.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeRestorePrivilege 1716 WerFault.exe Token: SeBackupPrivilege 1716 WerFault.exe Token: SeDebugPrivilege 1716 WerFault.exe Token: SeShutdownPrivilege 2828 Process not Found Token: SeCreatePagefilePrivilege 2828 Process not Found Token: SeShutdownPrivilege 2828 Process not Found Token: SeCreatePagefilePrivilege 2828 Process not Found Token: SeShutdownPrivilege 2828 Process not Found Token: SeCreatePagefilePrivilege 2828 Process not Found - Suspicious use of WriteProcessMemory 74 IoCs
description pid Process procid_target PID 2828 wrote to memory of 68 2828 Process not Found 78 PID 2828 wrote to memory of 68 2828 Process not Found 78 PID 2828 wrote to memory of 68 2828 Process not Found 78 PID 2828 wrote to memory of 3676 2828 Process not Found 79 PID 2828 wrote to memory of 3676 2828 Process not Found 79 PID 2828 wrote to memory of 3676 2828 Process not Found 79 PID 2828 wrote to memory of 3676 2828 Process not Found 79 PID 2828 wrote to memory of 1128 2828 Process not Found 80 PID 2828 wrote to memory of 1128 2828 Process not Found 80 PID 2828 wrote to memory of 1128 2828 Process not Found 80 PID 2828 wrote to memory of 2080 2828 Process not Found 81 PID 2828 wrote to memory of 2080 2828 Process not Found 81 PID 2828 wrote to memory of 2080 2828 Process not Found 81 PID 2828 wrote to memory of 2080 2828 Process not Found 81 PID 2828 wrote to memory of 516 2828 Process not Found 82 PID 2828 wrote to memory of 516 2828 Process not Found 82 PID 2828 wrote to memory of 516 2828 Process not Found 82 PID 2828 wrote to memory of 516 2828 Process not Found 82 PID 2828 wrote to memory of 1276 2828 Process not Found 83 PID 2828 wrote to memory of 1276 2828 Process not Found 83 PID 2828 wrote to memory of 1276 2828 Process not Found 83 PID 2828 wrote to memory of 1276 2828 Process not Found 83 PID 68 wrote to memory of 940 68 9FDF.exe 84 PID 68 wrote to memory of 940 68 9FDF.exe 84 PID 68 wrote to memory of 940 68 9FDF.exe 84 PID 2828 wrote to memory of 584 2828 Process not Found 85 PID 2828 wrote to memory of 584 2828 Process not Found 85 PID 2828 wrote to memory of 584 2828 Process not Found 85 PID 2828 wrote to memory of 1128 2828 Process not Found 86 PID 2828 wrote to memory of 1128 2828 Process not Found 86 PID 2828 wrote to memory of 1128 2828 Process not Found 86 PID 2828 wrote to memory of 1128 2828 Process not Found 86 PID 2828 wrote to memory of 3584 2828 Process not Found 87 PID 2828 wrote to memory of 3584 2828 Process not Found 87 PID 2828 wrote to memory of 3584 2828 Process not Found 87 PID 2828 wrote to memory of 1448 2828 Process not Found 88 PID 2828 wrote to memory of 1448 2828 Process not Found 88 PID 2828 wrote to memory of 1448 2828 Process not Found 88 PID 2828 wrote to memory of 1448 2828 Process not Found 88 PID 2828 wrote to memory of 4036 2828 Process not Found 89 PID 2828 wrote to memory of 4036 2828 Process not Found 89 PID 2828 wrote to memory of 4036 2828 Process not Found 89 PID 2828 wrote to memory of 3268 2828 Process not Found 90 PID 2828 wrote to memory of 3268 2828 Process not Found 90 PID 2828 wrote to memory of 3268 2828 Process not Found 90 PID 2828 wrote to memory of 3268 2828 Process not Found 90 PID 2828 wrote to memory of 756 2828 Process not Found 91 PID 2828 wrote to memory of 756 2828 Process not Found 91 PID 2828 wrote to memory of 756 2828 Process not Found 91 PID 2828 wrote to memory of 756 2828 Process not Found 91 PID 2828 wrote to memory of 1524 2828 Process not Found 92 PID 2828 wrote to memory of 1524 2828 Process not Found 92 PID 2828 wrote to memory of 1524 2828 Process not Found 92 PID 2828 wrote to memory of 1524 2828 Process not Found 92 PID 68 wrote to memory of 2260 68 9FDF.exe 93 PID 68 wrote to memory of 2260 68 9FDF.exe 93 PID 68 wrote to memory of 2260 68 9FDF.exe 93 PID 68 wrote to memory of 744 68 9FDF.exe 94 PID 68 wrote to memory of 744 68 9FDF.exe 94 PID 68 wrote to memory of 744 68 9FDF.exe 94 PID 2828 wrote to memory of 2408 2828 Process not Found 95 PID 2828 wrote to memory of 2408 2828 Process not Found 95 PID 2828 wrote to memory of 2408 2828 Process not Found 95 PID 2828 wrote to memory of 3880 2828 Process not Found 97 PID 2828 wrote to memory of 3880 2828 Process not Found 97 PID 2828 wrote to memory of 3880 2828 Process not Found 97 PID 2828 wrote to memory of 3880 2828 Process not Found 97 PID 2260 wrote to memory of 2940 2260 comeylol.exe 98 PID 2260 wrote to memory of 2940 2260 comeylol.exe 98 PID 2260 wrote to memory of 2940 2260 comeylol.exe 98 PID 2260 wrote to memory of 2776 2260 comeylol.exe 100 PID 2260 wrote to memory of 2776 2260 comeylol.exe 100 PID 2260 wrote to memory of 2776 2260 comeylol.exe 100 PID 2260 wrote to memory of 2776 2260 comeylol.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02a5551e929cd14fdb8db635659f433.exe"C:\Users\Admin\AppData\Local\Temp\d02a5551e929cd14fdb8db635659f433.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:508
-
C:\Users\Admin\AppData\Local\Temp\9FDF.exeC:\Users\Admin\AppData\Local\Temp\9FDF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:68 -
C:\Users\Admin\AppData\Local\Temp\9FDF.exeC:\Users\Admin\AppData\Local\Temp\9FDF.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:940
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:2260 -
C:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ivrodje\comeylol.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2940
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:2776
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ebbjcpkfk /tr "\"C:\Users\Admin\AppData\Local\Temp\9FDF.exe\" /I ebbjcpkfk" /SC ONCE /Z /ST 10:21 /ET 10:332⤵
- Creates scheduled task(s)
PID:744
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1128
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2080
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:516
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1276
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:584
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1128
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3584
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1448
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4036
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3268
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:756
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1524
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2408
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3880
-
C:\Users\Admin\AppData\Roaming\bctbdvjC:\Users\Admin\AppData\Roaming\bctbdvj1⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 4882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\9FDF.exeC:\Users\Admin\AppData\Local\Temp\9FDF.exe /I ebbjcpkfk1⤵
- Executes dropped EXE
PID:1760