Analysis
- max time kernel
150s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
document-1678585384.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1678585384.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1678585384.xlsb
- Size 291KB
- Sample201113-5379bkhgzj
- SHA256 8eca793a3f17ed76923c1b9c9717cd0efc8396bf0c12c84eea977bde485c5307
- MD5 f51c1d3dbe320d099218b5005938e98f
- SHA1 37e367860a460d380221c37c0d799cc6c45a1cc8
- SHA512 a361afc9c4aeb3d72faa17d8d7ad61895a6b939be787b391ffb2b923e577f701450835505c70356e290db9629fc23e49529da5738891d323d95c556753a6fd2f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4752 created 1768 4752 WerFault.exe 103 - Executes dropped EXE 7 IoCs
pid Process 496 fwpxeohi.exe 1700 E1AB.exe 2180 E1AB.exe 4404 gsimemia.exe 3164 gsimemia.exe 1768 wjdwajr 4452 E1AB.exe - Loads dropped DLL 1 IoCs
pid Process 496 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Program crash 1 IoCs
pid pid_target Process procid_target 4752 1768 WerFault.exe 103 - Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc E1AB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service E1AB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc E1AB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 gsimemia.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc gsimemia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 E1AB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service E1AB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service gsimemia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 E1AB.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc gsimemia.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service gsimemia.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 gsimemia.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3024 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4700 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2829 IoCs
pid Process 496 fwpxeohi.exe 496 fwpxeohi.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 1700 E1AB.exe 1700 E1AB.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2376 explorer.exe 2376 explorer.exe 4676 explorer.exe 4676 explorer.exe 4492 explorer.exe 4492 explorer.exe 2180 E1AB.exe 2180 E1AB.exe 2816 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2376 explorer.exe 2376 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 4664 explorer.exe 4664 explorer.exe 4676 explorer.exe 4676 explorer.exe 2180 E1AB.exe 2180 E1AB.exe 4420 explorer.exe 4420 explorer.exe 4540 explorer.exe 4540 explorer.exe 4492 explorer.exe 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2376 explorer.exe 2376 explorer.exe 2376 explorer.exe 2376 explorer.exe 4408 explorer.exe 4408 explorer.exe 4404 gsimemia.exe 4404 gsimemia.exe 4664 explorer.exe 4664 explorer.exe 4676 explorer.exe 4676 explorer.exe 3164 gsimemia.exe 3164 gsimemia.exe 4420 explorer.exe 4420 explorer.exe 4676 explorer.exe 4676 explorer.exe 4420 explorer.exe 4420 explorer.exe 3164 gsimemia.exe 3164 gsimemia.exe 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4540 explorer.exe 4492 explorer.exe 4492 explorer.exe 4420 explorer.exe 4420 explorer.exe 744 explorer.exe 744 explorer.exe 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4540 explorer.exe 4492 explorer.exe 4492 explorer.exe 4420 explorer.exe 4420 explorer.exe 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4540 explorer.exe 4492 explorer.exe 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 744 explorer.exe 744 explorer.exe 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4540 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4664 explorer.exe 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 2896 Process not Found 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2896 Process not Found 4492 explorer.exe 2896 Process not Found 2816 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4752 WerFault.exe 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4752 WerFault.exe 4752 WerFault.exe 4540 explorer.exe 4540 explorer.exe 4664 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 2896 Process not Found 4676 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 2896 Process not Found 4676 explorer.exe 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4664 explorer.exe 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 2896 Process not Found 2816 explorer.exe 2896 Process not Found 4492 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 2896 Process not Found 4676 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 4492 explorer.exe 2816 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 4676 explorer.exe 2896 Process not Found 4676 explorer.exe 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 2896 Process not Found 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4664 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 2896 Process not Found 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 2896 Process not Found 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4664 explorer.exe 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 2816 explorer.exe 2896 Process not Found 4492 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 2896 Process not Found 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4664 explorer.exe 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 4492 explorer.exe 2896 Process not Found 2816 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 2896 Process not Found 2816 explorer.exe 2896 Process not Found 4492 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2896 Process not Found 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4452 E1AB.exe 4452 E1AB.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 2896 Process not Found 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 4664 explorer.exe 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2212 explorer.exe 2212 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4420 explorer.exe 4420 explorer.exe 2896 Process not Found 2896 Process not Found 4408 explorer.exe 4408 explorer.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4676 explorer.exe 4676 explorer.exe 2896 Process not Found 4664 explorer.exe 2896 Process not Found 4664 explorer.exe 4540 explorer.exe 4540 explorer.exe 2896 Process not Found 2896 Process not Found 2816 explorer.exe 4492 explorer.exe 2816 explorer.exe 4492 explorer.exe 2896 Process not Found 2896 Process not Found 2212 explorer.exe 2212 explorer.exe - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 496 fwpxeohi.exe 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 2896 Process not Found 4404 gsimemia.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeRestorePrivilege 4752 WerFault.exe Token: SeBackupPrivilege 4752 WerFault.exe Token: SeDebugPrivilege 4752 WerFault.exe Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found Token: SeShutdownPrivilege 2896 Process not Found Token: SeCreatePagefilePrivilege 2896 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2896 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 4700 wrote to memory of 496 4700 EXCEL.EXE 78 PID 4700 wrote to memory of 496 4700 EXCEL.EXE 78 PID 4700 wrote to memory of 496 4700 EXCEL.EXE 78 PID 2896 wrote to memory of 1700 2896 Process not Found 81 PID 2896 wrote to memory of 1700 2896 Process not Found 81 PID 2896 wrote to memory of 1700 2896 Process not Found 81 PID 2896 wrote to memory of 4348 2896 Process not Found 82 PID 2896 wrote to memory of 4348 2896 Process not Found 82 PID 2896 wrote to memory of 4348 2896 Process not Found 82 PID 2896 wrote to memory of 4348 2896 Process not Found 82 PID 2896 wrote to memory of 4432 2896 Process not Found 83 PID 2896 wrote to memory of 4432 2896 Process not Found 83 PID 2896 wrote to memory of 4432 2896 Process not Found 83 PID 2896 wrote to memory of 3760 2896 Process not Found 84 PID 2896 wrote to memory of 3760 2896 Process not Found 84 PID 2896 wrote to memory of 3760 2896 Process not Found 84 PID 2896 wrote to memory of 3760 2896 Process not Found 84 PID 1700 wrote to memory of 2180 1700 E1AB.exe 85 PID 1700 wrote to memory of 2180 1700 E1AB.exe 85 PID 1700 wrote to memory of 2180 1700 E1AB.exe 85 PID 2896 wrote to memory of 2376 2896 Process not Found 86 PID 2896 wrote to memory of 2376 2896 Process not Found 86 PID 2896 wrote to memory of 2376 2896 Process not Found 86 PID 2896 wrote to memory of 2376 2896 Process not Found 86 PID 2896 wrote to memory of 4676 2896 Process not Found 87 PID 2896 wrote to memory of 4676 2896 Process not Found 87 PID 2896 wrote to memory of 4676 2896 Process not Found 87 PID 2896 wrote to memory of 4676 2896 Process not Found 87 PID 2896 wrote to memory of 4492 2896 Process not Found 88 PID 2896 wrote to memory of 4492 2896 Process not Found 88 PID 2896 wrote to memory of 4492 2896 Process not Found 88 PID 2896 wrote to memory of 2816 2896 Process not Found 89 PID 2896 wrote to memory of 2816 2896 Process not Found 89 PID 2896 wrote to memory of 2816 2896 Process not Found 89 PID 2896 wrote to memory of 2816 2896 Process not Found 89 PID 2896 wrote to memory of 2212 2896 Process not Found 90 PID 2896 wrote to memory of 2212 2896 Process not Found 90 PID 2896 wrote to memory of 2212 2896 Process not Found 90 PID 2896 wrote to memory of 4408 2896 Process not Found 91 PID 2896 wrote to memory of 4408 2896 Process not Found 91 PID 2896 wrote to memory of 4408 2896 Process not Found 91 PID 2896 wrote to memory of 4408 2896 Process not Found 91 PID 2896 wrote to memory of 4664 2896 Process not Found 92 PID 2896 wrote to memory of 4664 2896 Process not Found 92 PID 2896 wrote to memory of 4664 2896 Process not Found 92 PID 2896 wrote to memory of 3124 2896 Process not Found 93 PID 2896 wrote to memory of 3124 2896 Process not Found 93 PID 2896 wrote to memory of 3124 2896 Process not Found 93 PID 2896 wrote to memory of 3124 2896 Process not Found 93 PID 2896 wrote to memory of 4812 2896 Process not Found 94 PID 2896 wrote to memory of 4812 2896 Process not Found 94 PID 2896 wrote to memory of 4812 2896 Process not Found 94 PID 2896 wrote to memory of 4812 2896 Process not Found 94 PID 2896 wrote to memory of 4420 2896 Process not Found 95 PID 2896 wrote to memory of 4420 2896 Process not Found 95 PID 2896 wrote to memory of 4420 2896 Process not Found 95 PID 2896 wrote to memory of 4420 2896 Process not Found 95 PID 2896 wrote to memory of 4540 2896 Process not Found 96 PID 2896 wrote to memory of 4540 2896 Process not Found 96 PID 2896 wrote to memory of 4540 2896 Process not Found 96 PID 2896 wrote to memory of 5104 2896 Process not Found 97 PID 2896 wrote to memory of 5104 2896 Process not Found 97 PID 2896 wrote to memory of 5104 2896 Process not Found 97 PID 2896 wrote to memory of 5104 2896 Process not Found 97 PID 1700 wrote to memory of 4404 1700 E1AB.exe 98 PID 1700 wrote to memory of 4404 1700 E1AB.exe 98 PID 1700 wrote to memory of 4404 1700 E1AB.exe 98 PID 1700 wrote to memory of 3024 1700 E1AB.exe 99 PID 1700 wrote to memory of 3024 1700 E1AB.exe 99 PID 1700 wrote to memory of 3024 1700 E1AB.exe 99 PID 4404 wrote to memory of 3164 4404 gsimemia.exe 101 PID 4404 wrote to memory of 3164 4404 gsimemia.exe 101 PID 4404 wrote to memory of 3164 4404 gsimemia.exe 101 PID 4404 wrote to memory of 744 4404 gsimemia.exe 102 PID 4404 wrote to memory of 744 4404 gsimemia.exe 102 PID 4404 wrote to memory of 744 4404 gsimemia.exe 102 PID 4404 wrote to memory of 744 4404 gsimemia.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1678585384.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:496
-
-
C:\Users\Admin\AppData\Local\Temp\E1AB.exeC:\Users\Admin\AppData\Local\Temp\E1AB.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\E1AB.exeC:\Users\Admin\AppData\Local\Temp\E1AB.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2180
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Plgulatfuzgs\gsimemia.exeC:\Users\Admin\AppData\Roaming\Microsoft\Plgulatfuzgs\gsimemia.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:4404 -
C:\Users\Admin\AppData\Roaming\Microsoft\Plgulatfuzgs\gsimemia.exeC:\Users\Admin\AppData\Roaming\Microsoft\Plgulatfuzgs\gsimemia.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3164
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:744
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn amjfzrq /tr "\"C:\Users\Admin\AppData\Local\Temp\E1AB.exe\" /I amjfzrq" /SC ONCE /Z /ST 17:41 /ET 17:532⤵
- Creates scheduled task(s)
PID:3024
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4348
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4432
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3760
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2376
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4492
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2816
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2212
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4408
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4664
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3124
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4812
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4420
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4540
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5104
-
C:\Users\Admin\AppData\Roaming\wjdwajrC:\Users\Admin\AppData\Roaming\wjdwajr1⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 4802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\Users\Admin\AppData\Local\Temp\E1AB.exeC:\Users\Admin\AppData\Local\Temp\E1AB.exe /I amjfzrq1⤵
- Executes dropped EXE
PID:4452