Analysis
- max time kernel
150s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
document-1692061373.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1692061373.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1692061373.xlsb
- Size 291KB
- Sample201113-1h4twctj86
- SHA256 8ff8e49a83357957b1d1dfee67d0d06bccf0aedacb40b2bfacc356ebd43d98d4
- MD5 19eaa3a06457a0b2bed1af234dcd94b0
- SHA1 c0ed032243aa11686ed7cb04687b6f3186680f40
- SHA512 43a03d32083f75948fe29eac8402ef156c5732f8cd97f345bf40d5c7fcb5d30bf7423201e88244af5b11117d4f134ed49a56472543a272f1f6e69a451927d9d6
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 6 IoCs
pid Process 892 fwpxeohi.exe 2304 ECC7.exe 1112 ECC7.exe 4568 kopji.exe 4080 kopji.exe 2160 ECC7.exe - Loads dropped DLL 1 IoCs
pid Process 892 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc ECC7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 kopji.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service kopji.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service ECC7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc kopji.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service kopji.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc kopji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 ECC7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc ECC7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service ECC7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 kopji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 ECC7.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2888 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4796 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2842 IoCs
pid Process 892 fwpxeohi.exe 892 fwpxeohi.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 2304 ECC7.exe 2304 ECC7.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4716 explorer.exe 4716 explorer.exe 644 explorer.exe 644 explorer.exe 4912 explorer.exe 4912 explorer.exe 1112 ECC7.exe 1112 ECC7.exe 3240 explorer.exe 3240 explorer.exe 1112 ECC7.exe 1112 ECC7.exe 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 4716 explorer.exe 4716 explorer.exe 4040 explorer.exe 4040 explorer.exe 644 explorer.exe 644 explorer.exe 2684 explorer.exe 2684 explorer.exe 3536 explorer.exe 3536 explorer.exe 4912 explorer.exe 4912 explorer.exe 4568 kopji.exe 4568 kopji.exe 3240 explorer.exe 3240 explorer.exe 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 4716 explorer.exe 4716 explorer.exe 4716 explorer.exe 4716 explorer.exe 4080 kopji.exe 4080 kopji.exe 1284 explorer.exe 1284 explorer.exe 4080 kopji.exe 4080 kopji.exe 4040 explorer.exe 4040 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 1680 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 644 explorer.exe 2684 explorer.exe 2684 explorer.exe 644 explorer.exe 644 explorer.exe 2684 explorer.exe 2684 explorer.exe 3536 explorer.exe 3536 explorer.exe 644 explorer.exe 644 explorer.exe 2684 explorer.exe 2684 explorer.exe 4912 explorer.exe 4912 explorer.exe 3536 explorer.exe 3536 explorer.exe 644 explorer.exe 644 explorer.exe 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3536 explorer.exe 3536 explorer.exe 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 2684 explorer.exe 2684 explorer.exe 4912 explorer.exe 4912 explorer.exe 3536 explorer.exe 3536 explorer.exe 4620 explorer.exe 4620 explorer.exe 3240 explorer.exe 3240 explorer.exe 644 explorer.exe 644 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 4912 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 4912 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 2684 explorer.exe 4912 explorer.exe 2684 explorer.exe 4912 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 4912 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 4912 explorer.exe 1284 explorer.exe 3152 Process not Found 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3152 Process not Found 4040 explorer.exe 3152 Process not Found 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 4912 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 4912 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 4040 explorer.exe 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 3152 Process not Found 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 3152 Process not Found 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 1284 explorer.exe 3152 Process not Found 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 4040 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 3152 Process not Found 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 1284 explorer.exe 3152 Process not Found 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 4040 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 3152 Process not Found 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 4040 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 3152 Process not Found 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 1284 explorer.exe 3152 Process not Found 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 4040 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 3152 Process not Found 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 3152 Process not Found 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 4040 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 3152 Process not Found 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 3152 Process not Found 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 3152 Process not Found 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 4040 explorer.exe 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 4620 explorer.exe 4620 explorer.exe 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 2684 explorer.exe 3152 Process not Found 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 3152 Process not Found 3152 Process not Found 2684 explorer.exe 2684 explorer.exe 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3152 Process not Found 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 2160 ECC7.exe 2160 ECC7.exe 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3536 explorer.exe 3536 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 4620 explorer.exe 3152 Process not Found 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 644 explorer.exe 644 explorer.exe 3152 Process not Found 3152 Process not Found 4912 explorer.exe 4912 explorer.exe 2684 explorer.exe 2684 explorer.exe 3152 Process not Found 3152 Process not Found 1284 explorer.exe 1284 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3536 explorer.exe 3152 Process not Found 3152 Process not Found 4620 explorer.exe 4620 explorer.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4040 explorer.exe 3240 explorer.exe 4040 explorer.exe 3240 explorer.exe 3152 Process not Found 3152 Process not Found - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 892 fwpxeohi.exe 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 3152 Process not Found 4568 kopji.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3152 Process not Found Token: SeCreatePagefilePrivilege 3152 Process not Found Token: SeShutdownPrivilege 3152 Process not Found Token: SeCreatePagefilePrivilege 3152 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4796 EXCEL.EXE 4796 EXCEL.EXE - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE 4796 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3152 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 4796 wrote to memory of 892 4796 EXCEL.EXE 78 PID 4796 wrote to memory of 892 4796 EXCEL.EXE 78 PID 4796 wrote to memory of 892 4796 EXCEL.EXE 78 PID 3152 wrote to memory of 2304 3152 Process not Found 81 PID 3152 wrote to memory of 2304 3152 Process not Found 81 PID 3152 wrote to memory of 2304 3152 Process not Found 81 PID 3152 wrote to memory of 2828 3152 Process not Found 82 PID 3152 wrote to memory of 2828 3152 Process not Found 82 PID 3152 wrote to memory of 2828 3152 Process not Found 82 PID 3152 wrote to memory of 2828 3152 Process not Found 82 PID 3152 wrote to memory of 1000 3152 Process not Found 83 PID 3152 wrote to memory of 1000 3152 Process not Found 83 PID 3152 wrote to memory of 1000 3152 Process not Found 83 PID 3152 wrote to memory of 4764 3152 Process not Found 84 PID 3152 wrote to memory of 4764 3152 Process not Found 84 PID 3152 wrote to memory of 4764 3152 Process not Found 84 PID 3152 wrote to memory of 4764 3152 Process not Found 84 PID 2304 wrote to memory of 1112 2304 ECC7.exe 85 PID 2304 wrote to memory of 1112 2304 ECC7.exe 85 PID 2304 wrote to memory of 1112 2304 ECC7.exe 85 PID 3152 wrote to memory of 4716 3152 Process not Found 86 PID 3152 wrote to memory of 4716 3152 Process not Found 86 PID 3152 wrote to memory of 4716 3152 Process not Found 86 PID 3152 wrote to memory of 4716 3152 Process not Found 86 PID 3152 wrote to memory of 644 3152 Process not Found 87 PID 3152 wrote to memory of 644 3152 Process not Found 87 PID 3152 wrote to memory of 644 3152 Process not Found 87 PID 3152 wrote to memory of 644 3152 Process not Found 87 PID 3152 wrote to memory of 4912 3152 Process not Found 88 PID 3152 wrote to memory of 4912 3152 Process not Found 88 PID 3152 wrote to memory of 4912 3152 Process not Found 88 PID 3152 wrote to memory of 3240 3152 Process not Found 89 PID 3152 wrote to memory of 3240 3152 Process not Found 89 PID 3152 wrote to memory of 3240 3152 Process not Found 89 PID 3152 wrote to memory of 3240 3152 Process not Found 89 PID 3152 wrote to memory of 4620 3152 Process not Found 90 PID 3152 wrote to memory of 4620 3152 Process not Found 90 PID 3152 wrote to memory of 4620 3152 Process not Found 90 PID 3152 wrote to memory of 1284 3152 Process not Found 91 PID 3152 wrote to memory of 1284 3152 Process not Found 91 PID 3152 wrote to memory of 1284 3152 Process not Found 91 PID 3152 wrote to memory of 1284 3152 Process not Found 91 PID 3152 wrote to memory of 4040 3152 Process not Found 92 PID 3152 wrote to memory of 4040 3152 Process not Found 92 PID 3152 wrote to memory of 4040 3152 Process not Found 92 PID 3152 wrote to memory of 4836 3152 Process not Found 93 PID 3152 wrote to memory of 4836 3152 Process not Found 93 PID 3152 wrote to memory of 4836 3152 Process not Found 93 PID 3152 wrote to memory of 4836 3152 Process not Found 93 PID 2304 wrote to memory of 4568 2304 ECC7.exe 94 PID 2304 wrote to memory of 4568 2304 ECC7.exe 94 PID 2304 wrote to memory of 4568 2304 ECC7.exe 94 PID 3152 wrote to memory of 4640 3152 Process not Found 95 PID 3152 wrote to memory of 4640 3152 Process not Found 95 PID 3152 wrote to memory of 4640 3152 Process not Found 95 PID 3152 wrote to memory of 4640 3152 Process not Found 95 PID 2304 wrote to memory of 2888 2304 ECC7.exe 96 PID 2304 wrote to memory of 2888 2304 ECC7.exe 96 PID 2304 wrote to memory of 2888 2304 ECC7.exe 96 PID 3152 wrote to memory of 2684 3152 Process not Found 98 PID 3152 wrote to memory of 2684 3152 Process not Found 98 PID 3152 wrote to memory of 2684 3152 Process not Found 98 PID 3152 wrote to memory of 2684 3152 Process not Found 98 PID 3152 wrote to memory of 3536 3152 Process not Found 99 PID 3152 wrote to memory of 3536 3152 Process not Found 99 PID 3152 wrote to memory of 3536 3152 Process not Found 99 PID 3152 wrote to memory of 2592 3152 Process not Found 100 PID 3152 wrote to memory of 2592 3152 Process not Found 100 PID 3152 wrote to memory of 2592 3152 Process not Found 100 PID 3152 wrote to memory of 2592 3152 Process not Found 100 PID 4568 wrote to memory of 4080 4568 kopji.exe 101 PID 4568 wrote to memory of 4080 4568 kopji.exe 101 PID 4568 wrote to memory of 4080 4568 kopji.exe 101 PID 4568 wrote to memory of 1680 4568 kopji.exe 102 PID 4568 wrote to memory of 1680 4568 kopji.exe 102 PID 4568 wrote to memory of 1680 4568 kopji.exe 102 PID 4568 wrote to memory of 1680 4568 kopji.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1692061373.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\ECC7.exeC:\Users\Admin\AppData\Local\Temp\ECC7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\ECC7.exeC:\Users\Admin\AppData\Local\Temp\ECC7.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1112
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Awuaese\kopji.exeC:\Users\Admin\AppData\Roaming\Microsoft\Awuaese\kopji.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:4568 -
C:\Users\Admin\AppData\Roaming\Microsoft\Awuaese\kopji.exeC:\Users\Admin\AppData\Roaming\Microsoft\Awuaese\kopji.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4080
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:1680
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn afauyvezrn /tr "\"C:\Users\Admin\AppData\Local\Temp\ECC7.exe\" /I afauyvezrn" /SC ONCE /Z /ST 17:19 /ET 17:312⤵
- Creates scheduled task(s)
PID:2888
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2828
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1000
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4764
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4716
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:644
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4912
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3240
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4620
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1284
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4040
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4836
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4640
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2684
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3536
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\ECC7.exeC:\Users\Admin\AppData\Local\Temp\ECC7.exe /I afauyvezrn1⤵
- Executes dropped EXE
PID:2160