Analysis
- max time kernel
150s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
bfcc028b11046ba83e472990c9c9f5a0.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bfcc028b11046ba83e472990c9c9f5a0.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target bfcc028b11046ba83e472990c9c9f5a0.exe
- Size 327KB
- Sample201112-811kf6ggss
- SHA256 2eafd204076978f8a4a3e39ab0b8dd4cbed9bec5a4ac39146e40d921c8af59ff
- MD5 bfcc028b11046ba83e472990c9c9f5a0
- SHA1 ae5ed433c08b4823652158678076f12b8588c1b6
- SHA512 43e5f4715dc2059264f3be0edbfd4ae8b1fb54a4e327a5e53764d235bf9973dd997acf09c82e4f85127e5c55719979385f783c10fae2baa1e9af1da54f7b85bd
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 4236 CA5A.exe 212 CA5A.exe 1172 cfpah.exe 3244 cfpah.exe 204 CA5A.exe - Deletes itself 1 IoCs
pid Process 3012 Process not Found - Loads dropped DLL 1 IoCs
pid Process 4752 bfcc028b11046ba83e472990c9c9f5a0.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfcc028b11046ba83e472990c9c9f5a0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service CA5A.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc cfpah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfcc028b11046ba83e472990c9c9f5a0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 CA5A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 cfpah.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfcc028b11046ba83e472990c9c9f5a0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service CA5A.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc cfpah.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service cfpah.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc CA5A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 CA5A.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc CA5A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 cfpah.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service cfpah.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2296 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2246 IoCs
pid Process 4752 bfcc028b11046ba83e472990c9c9f5a0.exe 4752 bfcc028b11046ba83e472990c9c9f5a0.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4236 CA5A.exe 4236 CA5A.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2952 explorer.exe 2952 explorer.exe 212 CA5A.exe 212 CA5A.exe 2952 explorer.exe 2952 explorer.exe 3012 Process not Found 3012 Process not Found 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 2952 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 212 CA5A.exe 212 CA5A.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 2108 explorer.exe 2108 explorer.exe 676 explorer.exe 676 explorer.exe 2588 explorer.exe 2588 explorer.exe 1172 cfpah.exe 1172 cfpah.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 2108 explorer.exe 2108 explorer.exe 676 explorer.exe 676 explorer.exe 2588 explorer.exe 2588 explorer.exe 3244 cfpah.exe 3244 cfpah.exe 2588 explorer.exe 2588 explorer.exe 3244 cfpah.exe 3244 cfpah.exe 2588 explorer.exe 2588 explorer.exe 2588 explorer.exe 2588 explorer.exe 2588 explorer.exe 2588 explorer.exe 4732 explorer.exe 4732 explorer.exe 4568 explorer.exe 4568 explorer.exe 2588 explorer.exe 2588 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 2588 explorer.exe 2588 explorer.exe 4732 explorer.exe 4732 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 2588 explorer.exe 2588 explorer.exe 4560 explorer.exe 4560 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 2588 explorer.exe 2588 explorer.exe 4560 explorer.exe 4560 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 2588 explorer.exe 2588 explorer.exe 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 4560 explorer.exe 4560 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 3012 Process not Found 3012 Process not Found 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 2860 explorer.exe 3012 Process not Found 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 3012 Process not Found 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 3012 Process not Found 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 1508 explorer.exe 3012 Process not Found 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 3012 Process not Found 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 3012 Process not Found 1912 explorer.exe 3012 Process not Found 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 3012 Process not Found 1912 explorer.exe 3012 Process not Found 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 3012 Process not Found 1912 explorer.exe 3012 Process not Found 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 3012 Process not Found 3012 Process not Found 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 3012 Process not Found 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 1508 explorer.exe 3012 Process not Found 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 3012 Process not Found 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 3012 Process not Found 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 3012 Process not Found 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 3012 Process not Found 1912 explorer.exe 3012 Process not Found 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 3012 Process not Found 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 3012 Process not Found 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 3012 Process not Found 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 3012 Process not Found 4560 explorer.exe 3012 Process not Found 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 3012 Process not Found 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 3012 Process not Found 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 3012 Process not Found 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 3012 Process not Found 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 3012 Process not Found 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 3012 Process not Found 1912 explorer.exe 3012 Process not Found 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 204 CA5A.exe 204 CA5A.exe 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 3012 Process not Found 676 explorer.exe 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 3012 Process not Found 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 3012 Process not Found 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 3012 Process not Found 1912 explorer.exe 3012 Process not Found 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 2860 explorer.exe 3012 Process not Found 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 3012 Process not Found 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 3012 Process not Found 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 2108 explorer.exe 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 3012 Process not Found 2108 explorer.exe 3012 Process not Found 2108 explorer.exe 1912 explorer.exe 1912 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 4568 explorer.exe 4568 explorer.exe 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 4560 explorer.exe 4560 explorer.exe 1912 explorer.exe 2108 explorer.exe 1912 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 676 explorer.exe 676 explorer.exe 3012 Process not Found 2860 explorer.exe 2860 explorer.exe 3012 Process not Found 4568 explorer.exe 4568 explorer.exe 3012 Process not Found 1508 explorer.exe 1508 explorer.exe 3012 Process not Found 3012 Process not Found 2588 explorer.exe 2588 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 4560 explorer.exe 3012 Process not Found 4560 explorer.exe 1912 explorer.exe 1912 explorer.exe 2108 explorer.exe 2108 explorer.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 4752 bfcc028b11046ba83e472990c9c9f5a0.exe 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 3012 Process not Found 1172 cfpah.exe - Suspicious use of WriteProcessMemory 74 IoCs
description pid Process procid_target PID 3012 wrote to memory of 4236 3012 Process not Found 78 PID 3012 wrote to memory of 4236 3012 Process not Found 78 PID 3012 wrote to memory of 4236 3012 Process not Found 78 PID 3012 wrote to memory of 2816 3012 Process not Found 79 PID 3012 wrote to memory of 2816 3012 Process not Found 79 PID 3012 wrote to memory of 2816 3012 Process not Found 79 PID 3012 wrote to memory of 2816 3012 Process not Found 79 PID 3012 wrote to memory of 528 3012 Process not Found 80 PID 3012 wrote to memory of 528 3012 Process not Found 80 PID 3012 wrote to memory of 528 3012 Process not Found 80 PID 3012 wrote to memory of 4552 3012 Process not Found 81 PID 3012 wrote to memory of 4552 3012 Process not Found 81 PID 3012 wrote to memory of 4552 3012 Process not Found 81 PID 3012 wrote to memory of 4552 3012 Process not Found 81 PID 4236 wrote to memory of 212 4236 CA5A.exe 82 PID 4236 wrote to memory of 212 4236 CA5A.exe 82 PID 4236 wrote to memory of 212 4236 CA5A.exe 82 PID 3012 wrote to memory of 2952 3012 Process not Found 83 PID 3012 wrote to memory of 2952 3012 Process not Found 83 PID 3012 wrote to memory of 2952 3012 Process not Found 83 PID 3012 wrote to memory of 2952 3012 Process not Found 83 PID 3012 wrote to memory of 2588 3012 Process not Found 84 PID 3012 wrote to memory of 2588 3012 Process not Found 84 PID 3012 wrote to memory of 2588 3012 Process not Found 84 PID 3012 wrote to memory of 2588 3012 Process not Found 84 PID 3012 wrote to memory of 4560 3012 Process not Found 85 PID 3012 wrote to memory of 4560 3012 Process not Found 85 PID 3012 wrote to memory of 4560 3012 Process not Found 85 PID 3012 wrote to memory of 1912 3012 Process not Found 86 PID 3012 wrote to memory of 1912 3012 Process not Found 86 PID 3012 wrote to memory of 1912 3012 Process not Found 86 PID 3012 wrote to memory of 1912 3012 Process not Found 86 PID 3012 wrote to memory of 2860 3012 Process not Found 87 PID 3012 wrote to memory of 2860 3012 Process not Found 87 PID 3012 wrote to memory of 2860 3012 Process not Found 87 PID 3012 wrote to memory of 2108 3012 Process not Found 88 PID 3012 wrote to memory of 2108 3012 Process not Found 88 PID 3012 wrote to memory of 2108 3012 Process not Found 88 PID 3012 wrote to memory of 2108 3012 Process not Found 88 PID 3012 wrote to memory of 676 3012 Process not Found 89 PID 3012 wrote to memory of 676 3012 Process not Found 89 PID 3012 wrote to memory of 676 3012 Process not Found 89 PID 4236 wrote to memory of 1172 4236 CA5A.exe 90 PID 4236 wrote to memory of 1172 4236 CA5A.exe 90 PID 4236 wrote to memory of 1172 4236 CA5A.exe 90 PID 3012 wrote to memory of 1544 3012 Process not Found 91 PID 3012 wrote to memory of 1544 3012 Process not Found 91 PID 3012 wrote to memory of 1544 3012 Process not Found 91 PID 3012 wrote to memory of 1544 3012 Process not Found 91 PID 4236 wrote to memory of 2296 4236 CA5A.exe 92 PID 4236 wrote to memory of 2296 4236 CA5A.exe 92 PID 4236 wrote to memory of 2296 4236 CA5A.exe 92 PID 3012 wrote to memory of 2924 3012 Process not Found 94 PID 3012 wrote to memory of 2924 3012 Process not Found 94 PID 3012 wrote to memory of 2924 3012 Process not Found 94 PID 3012 wrote to memory of 2924 3012 Process not Found 94 PID 3012 wrote to memory of 4568 3012 Process not Found 95 PID 3012 wrote to memory of 4568 3012 Process not Found 95 PID 3012 wrote to memory of 4568 3012 Process not Found 95 PID 3012 wrote to memory of 4568 3012 Process not Found 95 PID 3012 wrote to memory of 1508 3012 Process not Found 96 PID 3012 wrote to memory of 1508 3012 Process not Found 96 PID 3012 wrote to memory of 1508 3012 Process not Found 96 PID 3012 wrote to memory of 3536 3012 Process not Found 97 PID 3012 wrote to memory of 3536 3012 Process not Found 97 PID 3012 wrote to memory of 3536 3012 Process not Found 97 PID 3012 wrote to memory of 3536 3012 Process not Found 97 PID 1172 wrote to memory of 3244 1172 cfpah.exe 98 PID 1172 wrote to memory of 3244 1172 cfpah.exe 98 PID 1172 wrote to memory of 3244 1172 cfpah.exe 98 PID 1172 wrote to memory of 4732 1172 cfpah.exe 99 PID 1172 wrote to memory of 4732 1172 cfpah.exe 99 PID 1172 wrote to memory of 4732 1172 cfpah.exe 99 PID 1172 wrote to memory of 4732 1172 cfpah.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfcc028b11046ba83e472990c9c9f5a0.exe"C:\Users\Admin\AppData\Local\Temp\bfcc028b11046ba83e472990c9c9f5a0.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4752
-
C:\Users\Admin\AppData\Local\Temp\CA5A.exeC:\Users\Admin\AppData\Local\Temp\CA5A.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\CA5A.exeC:\Users\Admin\AppData\Local\Temp\CA5A.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:212
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Peakolve\cfpah.exeC:\Users\Admin\AppData\Roaming\Microsoft\Peakolve\cfpah.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:1172 -
C:\Users\Admin\AppData\Roaming\Microsoft\Peakolve\cfpah.exeC:\Users\Admin\AppData\Roaming\Microsoft\Peakolve\cfpah.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3244
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:4732
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ssqlynpxst /tr "\"C:\Users\Admin\AppData\Local\Temp\CA5A.exe\" /I ssqlynpxst" /SC ONCE /Z /ST 09:29 /ET 09:412⤵
- Creates scheduled task(s)
PID:2296
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2816
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:528
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4552
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2952
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2588
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4560
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2860
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2108
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:676
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1544
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2924
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4568
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1508
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\CA5A.exeC:\Users\Admin\AppData\Local\Temp\CA5A.exe /I ssqlynpxst1⤵
- Executes dropped EXE
PID:204