Analysis
- max time kernel
150s - max time network
136s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
document-1672143680.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1672143680.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1672143680.xlsb
- Size 291KB
- Sample201113-118lcdpdrs
- SHA256 b942663b15ee0a420408dddeefc059a9f09e443a756bcefd3ae9e55643529159
- MD5 1aaf38bd2e971d6a07492c5a5146de85
- SHA1 2b05aba731f5d593fd3ee73c2f55a64948611535
- SHA512 719043942a4378841a231a3a0ae2125d457e67db87e5cba443c4f72e2662e6da7e0e2f31275df59cc803194d1eb984566d5996234a8114f38b506067511f9a35
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 2160 fwpxeohi.exe 1748 E69D.exe 2492 E69D.exe 3464 xziwig.exe 2216 xziwig.exe - Loads dropped DLL 1 IoCs
pid Process 2160 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 E69D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc xziwig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service xziwig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc xziwig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 xziwig.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc E69D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 xziwig.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service xziwig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 E69D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service E69D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc E69D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service E69D.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2196 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4756 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2688 IoCs
pid Process 2160 fwpxeohi.exe 2160 fwpxeohi.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 1748 E69D.exe 1748 E69D.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 1260 explorer.exe 1260 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 1780 explorer.exe 2492 E69D.exe 2492 E69D.exe 4708 explorer.exe 4708 explorer.exe 3960 explorer.exe 3960 explorer.exe 1260 explorer.exe 1260 explorer.exe 3084 explorer.exe 3084 explorer.exe 2384 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2492 E69D.exe 2492 E69D.exe 2440 explorer.exe 2440 explorer.exe 4836 explorer.exe 4836 explorer.exe 1780 explorer.exe 1780 explorer.exe 2960 explorer.exe 2960 explorer.exe 4708 explorer.exe 4708 explorer.exe 3960 explorer.exe 3960 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 3084 explorer.exe 3084 explorer.exe 3464 xziwig.exe 3464 xziwig.exe 2384 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 1780 explorer.exe 1780 explorer.exe 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 1780 explorer.exe 1780 explorer.exe 4836 explorer.exe 4836 explorer.exe 2960 explorer.exe 2960 explorer.exe 1780 explorer.exe 1780 explorer.exe 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 1780 explorer.exe 1780 explorer.exe 4836 explorer.exe 4836 explorer.exe 2960 explorer.exe 2960 explorer.exe 4708 explorer.exe 4708 explorer.exe 3960 explorer.exe 3960 explorer.exe 1780 explorer.exe 1780 explorer.exe 4836 explorer.exe 2960 explorer.exe 4836 explorer.exe 2960 explorer.exe 4708 explorer.exe 4708 explorer.exe 3960 explorer.exe 3960 explorer.exe 3084 explorer.exe 3084 explorer.exe 1780 explorer.exe 1780 explorer.exe 4836 explorer.exe 4836 explorer.exe 2960 explorer.exe 2960 explorer.exe 4708 explorer.exe 4708 explorer.exe 2216 xziwig.exe 2216 xziwig.exe 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 3084 explorer.exe 3084 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 3960 explorer.exe 3960 explorer.exe 3084 explorer.exe 3084 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 4836 explorer.exe 4836 explorer.exe 2960 explorer.exe 2960 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 3084 explorer.exe 3084 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2216 xziwig.exe 2216 xziwig.exe 4708 explorer.exe 4708 explorer.exe 968 explorer.exe 968 explorer.exe 3960 explorer.exe 3960 explorer.exe 3084 explorer.exe 3084 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 4836 explorer.exe 4836 explorer.exe 2960 explorer.exe 2960 explorer.exe 4708 explorer.exe 4708 explorer.exe 3960 explorer.exe 3960 explorer.exe 3084 explorer.exe 3084 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 4836 explorer.exe 4836 explorer.exe 2960 explorer.exe 2960 explorer.exe 4708 explorer.exe 4708 explorer.exe 968 explorer.exe 968 explorer.exe 3960 explorer.exe 3960 explorer.exe 3084 explorer.exe 3084 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 2552 Process not Found 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 1780 explorer.exe 2552 Process not Found 2384 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2384 explorer.exe 2552 Process not Found 2384 explorer.exe 2552 Process not Found 1780 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2552 Process not Found 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 2552 Process not Found 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 2552 Process not Found 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 2552 Process not Found 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2384 explorer.exe 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 2552 Process not Found 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 2552 Process not Found 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 1780 explorer.exe 2552 Process not Found 2384 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2552 Process not Found 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 2552 Process not Found 4708 explorer.exe 2552 Process not Found 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 2552 Process not Found 3084 explorer.exe 1780 explorer.exe 2384 explorer.exe 1780 explorer.exe 2384 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 2552 Process not Found 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 2384 explorer.exe 1780 explorer.exe 1780 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 1780 explorer.exe 2552 Process not Found 2552 Process not Found 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2960 explorer.exe 2552 Process not Found 4836 explorer.exe 2552 Process not Found 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3960 explorer.exe 3960 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3084 explorer.exe 3084 explorer.exe 2552 Process not Found 1780 explorer.exe 2552 Process not Found 1780 explorer.exe 2384 explorer.exe 2384 explorer.exe 2440 explorer.exe 2440 explorer.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2960 explorer.exe 2552 Process not Found 2960 explorer.exe 4836 explorer.exe 4836 explorer.exe 4708 explorer.exe 4708 explorer.exe - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 2160 fwpxeohi.exe 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 2552 Process not Found 3464 xziwig.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2552 Process not Found Token: SeCreatePagefilePrivilege 2552 Process not Found Token: SeShutdownPrivilege 2552 Process not Found Token: SeCreatePagefilePrivilege 2552 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE 4756 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2552 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2160 4756 EXCEL.EXE 77 PID 4756 wrote to memory of 2160 4756 EXCEL.EXE 77 PID 4756 wrote to memory of 2160 4756 EXCEL.EXE 77 PID 2552 wrote to memory of 1748 2552 Process not Found 80 PID 2552 wrote to memory of 1748 2552 Process not Found 80 PID 2552 wrote to memory of 1748 2552 Process not Found 80 PID 2552 wrote to memory of 1900 2552 Process not Found 81 PID 2552 wrote to memory of 1900 2552 Process not Found 81 PID 2552 wrote to memory of 1900 2552 Process not Found 81 PID 2552 wrote to memory of 1900 2552 Process not Found 81 PID 2552 wrote to memory of 2260 2552 Process not Found 82 PID 2552 wrote to memory of 2260 2552 Process not Found 82 PID 2552 wrote to memory of 2260 2552 Process not Found 82 PID 2552 wrote to memory of 4640 2552 Process not Found 83 PID 2552 wrote to memory of 4640 2552 Process not Found 83 PID 2552 wrote to memory of 4640 2552 Process not Found 83 PID 2552 wrote to memory of 4640 2552 Process not Found 83 PID 1748 wrote to memory of 2492 1748 E69D.exe 84 PID 1748 wrote to memory of 2492 1748 E69D.exe 84 PID 1748 wrote to memory of 2492 1748 E69D.exe 84 PID 2552 wrote to memory of 1260 2552 Process not Found 85 PID 2552 wrote to memory of 1260 2552 Process not Found 85 PID 2552 wrote to memory of 1260 2552 Process not Found 85 PID 2552 wrote to memory of 1260 2552 Process not Found 85 PID 2552 wrote to memory of 2440 2552 Process not Found 86 PID 2552 wrote to memory of 2440 2552 Process not Found 86 PID 2552 wrote to memory of 2440 2552 Process not Found 86 PID 2552 wrote to memory of 2440 2552 Process not Found 86 PID 2552 wrote to memory of 1780 2552 Process not Found 87 PID 2552 wrote to memory of 1780 2552 Process not Found 87 PID 2552 wrote to memory of 1780 2552 Process not Found 87 PID 2552 wrote to memory of 4708 2552 Process not Found 88 PID 2552 wrote to memory of 4708 2552 Process not Found 88 PID 2552 wrote to memory of 4708 2552 Process not Found 88 PID 2552 wrote to memory of 4708 2552 Process not Found 88 PID 2552 wrote to memory of 3960 2552 Process not Found 89 PID 2552 wrote to memory of 3960 2552 Process not Found 89 PID 2552 wrote to memory of 3960 2552 Process not Found 89 PID 2552 wrote to memory of 3084 2552 Process not Found 90 PID 2552 wrote to memory of 3084 2552 Process not Found 90 PID 2552 wrote to memory of 3084 2552 Process not Found 90 PID 2552 wrote to memory of 3084 2552 Process not Found 90 PID 2552 wrote to memory of 2384 2552 Process not Found 91 PID 2552 wrote to memory of 2384 2552 Process not Found 91 PID 2552 wrote to memory of 2384 2552 Process not Found 91 PID 2552 wrote to memory of 3976 2552 Process not Found 92 PID 2552 wrote to memory of 3976 2552 Process not Found 92 PID 2552 wrote to memory of 3976 2552 Process not Found 92 PID 2552 wrote to memory of 3976 2552 Process not Found 92 PID 2552 wrote to memory of 2044 2552 Process not Found 93 PID 2552 wrote to memory of 2044 2552 Process not Found 93 PID 2552 wrote to memory of 2044 2552 Process not Found 93 PID 2552 wrote to memory of 2044 2552 Process not Found 93 PID 2552 wrote to memory of 4836 2552 Process not Found 94 PID 2552 wrote to memory of 4836 2552 Process not Found 94 PID 2552 wrote to memory of 4836 2552 Process not Found 94 PID 2552 wrote to memory of 4836 2552 Process not Found 94 PID 2552 wrote to memory of 2960 2552 Process not Found 95 PID 2552 wrote to memory of 2960 2552 Process not Found 95 PID 2552 wrote to memory of 2960 2552 Process not Found 95 PID 2552 wrote to memory of 4288 2552 Process not Found 96 PID 2552 wrote to memory of 4288 2552 Process not Found 96 PID 2552 wrote to memory of 4288 2552 Process not Found 96 PID 2552 wrote to memory of 4288 2552 Process not Found 96 PID 1748 wrote to memory of 3464 1748 E69D.exe 97 PID 1748 wrote to memory of 3464 1748 E69D.exe 97 PID 1748 wrote to memory of 3464 1748 E69D.exe 97 PID 1748 wrote to memory of 2196 1748 E69D.exe 98 PID 1748 wrote to memory of 2196 1748 E69D.exe 98 PID 1748 wrote to memory of 2196 1748 E69D.exe 98 PID 3464 wrote to memory of 2216 3464 xziwig.exe 100 PID 3464 wrote to memory of 2216 3464 xziwig.exe 100 PID 3464 wrote to memory of 2216 3464 xziwig.exe 100 PID 3464 wrote to memory of 968 3464 xziwig.exe 101 PID 3464 wrote to memory of 968 3464 xziwig.exe 101 PID 3464 wrote to memory of 968 3464 xziwig.exe 101 PID 3464 wrote to memory of 968 3464 xziwig.exe 101
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1672143680.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\E69D.exeC:\Users\Admin\AppData\Local\Temp\E69D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E69D.exeC:\Users\Admin\AppData\Local\Temp\E69D.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2492
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Pjdgjuvg\xziwig.exeC:\Users\Admin\AppData\Roaming\Microsoft\Pjdgjuvg\xziwig.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:3464 -
C:\Users\Admin\AppData\Roaming\Microsoft\Pjdgjuvg\xziwig.exeC:\Users\Admin\AppData\Roaming\Microsoft\Pjdgjuvg\xziwig.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2216
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:968
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn wxjrkdev /tr "\"C:\Users\Admin\AppData\Local\Temp\E69D.exe\" /I wxjrkdev" /SC ONCE /Z /ST 17:28 /ET 17:402⤵
- Creates scheduled task(s)
PID:2196
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1900
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2260
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4640
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1260
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2440
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1780
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4708
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3960
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3084
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2384
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3976
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2044
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4836
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2960
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4288