Analysis
- max time kernel
150s - max time network
137s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
document-1673694735.xlsb
Resource
win7v20201028
Behavioral task
behavioral2
Sample
document-1673694735.xlsb
Resource
win10v20201028
General
- Target document-1673694735.xlsb
- Size 291KB
- Sample201113-5hwevvc8s2
- SHA256 746c44bc9f41ad758408cc835ff690c326c5a5778d90af319cb73a4d7f2b5732
- MD5 ab498db36344f59c199947e3f339bea0
- SHA1 20bc376d66911bd380e597d9dd393ca590fab1bb
- SHA512 3bc0d21250f20e0ed501112b4b8940ea73a79fc4e86a008dbc6de52e5243bd013f51476301be78bf7569cca03c9c6c7c9699ad3d0aa823d38cb05fe174c233de
- MD5 SHA1 SHA512
Malware Config
Extracted
-
smokeloader
-
2020
-
http://we11wdsgd.com/
Extracted
-
qakbot
-
tr01
-
1604997522
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 2844 fwpxeohi.exe 2400 BA9B.exe 2176 BA9B.exe 2960 ziewdw.exe 2640 ziewdw.exe - Loads dropped DLL 1 IoCs
pid Process 2844 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc ziewdw.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service ziewdw.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service ziewdw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 BA9B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service BA9B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 ziewdw.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc ziewdw.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc BA9B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service BA9B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc BA9B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 BA9B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 ziewdw.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3760 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3636 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2230 IoCs
pid Process 2844 fwpxeohi.exe 2844 fwpxeohi.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 2400 BA9B.exe 2400 BA9B.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 2244 explorer.exe 2244 explorer.exe 1288 explorer.exe 1288 explorer.exe 1436 explorer.exe 1436 explorer.exe 2176 BA9B.exe 2176 BA9B.exe 756 explorer.exe 756 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 2244 explorer.exe 2244 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 488 explorer.exe 488 explorer.exe 2176 BA9B.exe 2176 BA9B.exe 1436 explorer.exe 1436 explorer.exe 3732 explorer.exe 3732 explorer.exe 756 explorer.exe 756 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 2244 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 2960 ziewdw.exe 2960 ziewdw.exe 488 explorer.exe 488 explorer.exe 488 explorer.exe 488 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 2640 ziewdw.exe 2640 ziewdw.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 2640 ziewdw.exe 2640 ziewdw.exe 1436 explorer.exe 3732 explorer.exe 1436 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3068 explorer.exe 3068 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3732 explorer.exe 3732 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3068 explorer.exe 3068 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3732 explorer.exe 3732 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3732 explorer.exe 3732 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3732 explorer.exe 3732 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3732 explorer.exe 3732 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3112 explorer.exe 3112 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 3040 explorer.exe 1384 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 1436 explorer.exe 3112 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3112 explorer.exe 3112 explorer.exe 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 488 explorer.exe 3128 Process not Found 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 3128 Process not Found 3128 Process not Found 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 3128 Process not Found 3128 Process not Found 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3128 Process not Found 3128 Process not Found 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 3128 Process not Found 3128 Process not Found 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3732 explorer.exe 3732 explorer.exe 1436 explorer.exe 1436 explorer.exe 3112 explorer.exe 3112 explorer.exe 488 explorer.exe 488 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 756 explorer.exe 756 explorer.exe 3128 Process not Found 3128 Process not Found 3040 explorer.exe 3040 explorer.exe 1384 explorer.exe 1384 explorer.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 2844 fwpxeohi.exe 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 3128 Process not Found 2960 ziewdw.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found Token: SeShutdownPrivilege 3128 Process not Found Token: SeCreatePagefilePrivilege 3128 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE 3636 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3128 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 3636 wrote to memory of 2844 3636 EXCEL.EXE 78 PID 3636 wrote to memory of 2844 3636 EXCEL.EXE 78 PID 3636 wrote to memory of 2844 3636 EXCEL.EXE 78 PID 3128 wrote to memory of 2400 3128 Process not Found 81 PID 3128 wrote to memory of 2400 3128 Process not Found 81 PID 3128 wrote to memory of 2400 3128 Process not Found 81 PID 3128 wrote to memory of 3272 3128 Process not Found 82 PID 3128 wrote to memory of 3272 3128 Process not Found 82 PID 3128 wrote to memory of 3272 3128 Process not Found 82 PID 3128 wrote to memory of 3272 3128 Process not Found 82 PID 3128 wrote to memory of 500 3128 Process not Found 83 PID 3128 wrote to memory of 500 3128 Process not Found 83 PID 3128 wrote to memory of 500 3128 Process not Found 83 PID 3128 wrote to memory of 3484 3128 Process not Found 84 PID 3128 wrote to memory of 3484 3128 Process not Found 84 PID 3128 wrote to memory of 3484 3128 Process not Found 84 PID 3128 wrote to memory of 3484 3128 Process not Found 84 PID 2400 wrote to memory of 2176 2400 BA9B.exe 85 PID 2400 wrote to memory of 2176 2400 BA9B.exe 85 PID 2400 wrote to memory of 2176 2400 BA9B.exe 85 PID 3128 wrote to memory of 2244 3128 Process not Found 86 PID 3128 wrote to memory of 2244 3128 Process not Found 86 PID 3128 wrote to memory of 2244 3128 Process not Found 86 PID 3128 wrote to memory of 2244 3128 Process not Found 86 PID 3128 wrote to memory of 1288 3128 Process not Found 87 PID 3128 wrote to memory of 1288 3128 Process not Found 87 PID 3128 wrote to memory of 1288 3128 Process not Found 87 PID 3128 wrote to memory of 1288 3128 Process not Found 87 PID 3128 wrote to memory of 1436 3128 Process not Found 88 PID 3128 wrote to memory of 1436 3128 Process not Found 88 PID 3128 wrote to memory of 1436 3128 Process not Found 88 PID 3128 wrote to memory of 756 3128 Process not Found 89 PID 3128 wrote to memory of 756 3128 Process not Found 89 PID 3128 wrote to memory of 756 3128 Process not Found 89 PID 3128 wrote to memory of 756 3128 Process not Found 89 PID 3128 wrote to memory of 3112 3128 Process not Found 90 PID 3128 wrote to memory of 3112 3128 Process not Found 90 PID 3128 wrote to memory of 3112 3128 Process not Found 90 PID 3128 wrote to memory of 3040 3128 Process not Found 91 PID 3128 wrote to memory of 3040 3128 Process not Found 91 PID 3128 wrote to memory of 3040 3128 Process not Found 91 PID 3128 wrote to memory of 3040 3128 Process not Found 91 PID 3128 wrote to memory of 1384 3128 Process not Found 92 PID 3128 wrote to memory of 1384 3128 Process not Found 92 PID 3128 wrote to memory of 1384 3128 Process not Found 92 PID 3128 wrote to memory of 3524 3128 Process not Found 93 PID 3128 wrote to memory of 3524 3128 Process not Found 93 PID 3128 wrote to memory of 3524 3128 Process not Found 93 PID 3128 wrote to memory of 3524 3128 Process not Found 93 PID 3128 wrote to memory of 948 3128 Process not Found 94 PID 3128 wrote to memory of 948 3128 Process not Found 94 PID 3128 wrote to memory of 948 3128 Process not Found 94 PID 3128 wrote to memory of 948 3128 Process not Found 94 PID 3128 wrote to memory of 488 3128 Process not Found 95 PID 3128 wrote to memory of 488 3128 Process not Found 95 PID 3128 wrote to memory of 488 3128 Process not Found 95 PID 3128 wrote to memory of 488 3128 Process not Found 95 PID 3128 wrote to memory of 3732 3128 Process not Found 96 PID 3128 wrote to memory of 3732 3128 Process not Found 96 PID 3128 wrote to memory of 3732 3128 Process not Found 96 PID 3128 wrote to memory of 3976 3128 Process not Found 97 PID 3128 wrote to memory of 3976 3128 Process not Found 97 PID 3128 wrote to memory of 3976 3128 Process not Found 97 PID 3128 wrote to memory of 3976 3128 Process not Found 97 PID 2400 wrote to memory of 2960 2400 BA9B.exe 98 PID 2400 wrote to memory of 2960 2400 BA9B.exe 98 PID 2400 wrote to memory of 2960 2400 BA9B.exe 98 PID 2400 wrote to memory of 3760 2400 BA9B.exe 99 PID 2400 wrote to memory of 3760 2400 BA9B.exe 99 PID 2400 wrote to memory of 3760 2400 BA9B.exe 99 PID 2960 wrote to memory of 2640 2960 ziewdw.exe 101 PID 2960 wrote to memory of 2640 2960 ziewdw.exe 101 PID 2960 wrote to memory of 2640 2960 ziewdw.exe 101 PID 2960 wrote to memory of 3068 2960 ziewdw.exe 102 PID 2960 wrote to memory of 3068 2960 ziewdw.exe 102 PID 2960 wrote to memory of 3068 2960 ziewdw.exe 102 PID 2960 wrote to memory of 3068 2960 ziewdw.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1673694735.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\BA9B.exeC:\Users\Admin\AppData\Local\Temp\BA9B.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\BA9B.exeC:\Users\Admin\AppData\Local\Temp\BA9B.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2176
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Eemezhs\ziewdw.exeC:\Users\Admin\AppData\Roaming\Microsoft\Eemezhs\ziewdw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:2960 -
C:\Users\Admin\AppData\Roaming\Microsoft\Eemezhs\ziewdw.exeC:\Users\Admin\AppData\Roaming\Microsoft\Eemezhs\ziewdw.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2640
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:3068
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn rsifydxljp /tr "\"C:\Users\Admin\AppData\Local\Temp\BA9B.exe\" /I rsifydxljp" /SC ONCE /Z /ST 17:13 /ET 17:252⤵
- Creates scheduled task(s)
PID:3760
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3272
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:500
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3484
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2244
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1288
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1436
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:756
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3112
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3040
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1384
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3524
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:948
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:488
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3732
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3976