Analysis
- max time kernel
150s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
document-1429343675.xlsb
Resource
win7v20201028
Behavioral task
behavioral2
Sample
document-1429343675.xlsb
Resource
win10v20201028
General
- Target document-1429343675.xlsb
- Size 291KB
- Sample201113-exv3v752es
- SHA256 13bdb09ef1ec1958cc5b22198d08218bbe050bb2981e8d5d47896bd7fbf2068a
- MD5 ebcdbc37f04514d305b4c8baaca26edc
- SHA1 ba264f21f0d2991233184c84a81c4514fdac91bf
- SHA512 b8adae75bdbf795bbebcc9dba7b5475fa1d67af4770a7d68caf013fe228e248225631ca983f16cb3fad010af0eb0ef96e6825245ac7f9181cea560f3539342c6
- MD5 SHA1 SHA512
Malware Config
Extracted
-
smokeloader
-
2020
-
http://we11wdsgd.com/
Extracted
-
qakbot
-
tr01
-
1604997522
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1268 created 3816 1268 WerFault.exe 103 - Executes dropped EXE 6 IoCs
pid Process 3964 fwpxeohi.exe 2264 1D4D.exe 384 1D4D.exe 2128 jyjzhr.exe 3916 jyjzhr.exe 3816 aiascee - Loads dropped DLL 1 IoCs
pid Process 3964 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Program crash 1 IoCs
pid pid_target Process procid_target 1268 3816 WerFault.exe 103 - Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 1D4D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 1D4D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service jyjzhr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc jyjzhr.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 1D4D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 1D4D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 1D4D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 1D4D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 jyjzhr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc jyjzhr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service jyjzhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 jyjzhr.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3972 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 648 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2007 IoCs
pid Process 3964 fwpxeohi.exe 3964 fwpxeohi.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2264 1D4D.exe 2264 1D4D.exe 3024 Process not Found 3024 Process not Found 1752 explorer.exe 1752 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 1752 explorer.exe 1752 explorer.exe 3052 explorer.exe 3052 explorer.exe 2276 explorer.exe 2276 explorer.exe 896 explorer.exe 896 explorer.exe 384 1D4D.exe 384 1D4D.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 3876 explorer.exe 3876 explorer.exe 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 3052 explorer.exe 3052 explorer.exe 2276 explorer.exe 2276 explorer.exe 896 explorer.exe 896 explorer.exe 384 1D4D.exe 384 1D4D.exe 3876 explorer.exe 3876 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 3876 explorer.exe 3876 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3876 explorer.exe 3876 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3876 explorer.exe 3876 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3876 explorer.exe 3876 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3876 explorer.exe 3876 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3876 explorer.exe 3876 explorer.exe 888 explorer.exe 888 explorer.exe 2128 jyjzhr.exe 2128 jyjzhr.exe 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 2276 explorer.exe 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3916 jyjzhr.exe 3916 jyjzhr.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3916 jyjzhr.exe 3916 jyjzhr.exe 888 explorer.exe 888 explorer.exe 768 explorer.exe 768 explorer.exe 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 2276 explorer.exe 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3912 explorer.exe 3024 Process not Found 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 768 explorer.exe 768 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 3024 Process not Found 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 3024 Process not Found 3052 explorer.exe 3024 Process not Found 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 3876 explorer.exe 3024 Process not Found 2276 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 2276 explorer.exe 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3024 Process not Found 3700 explorer.exe 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3052 explorer.exe 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 3876 explorer.exe 3024 Process not Found 2276 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 2276 explorer.exe 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3024 Process not Found 3700 explorer.exe 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 3024 Process not Found 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 3876 explorer.exe 3024 Process not Found 2276 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 896 explorer.exe 896 explorer.exe 888 explorer.exe 888 explorer.exe 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3024 Process not Found 3700 explorer.exe 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 3876 explorer.exe 3024 Process not Found 2276 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 1020 explorer.exe 3052 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3912 explorer.exe 3024 Process not Found 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3024 Process not Found 1020 explorer.exe 3024 Process not Found 3052 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3876 explorer.exe 3876 explorer.exe 3024 Process not Found 2276 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 1020 explorer.exe 3052 explorer.exe 1020 explorer.exe 3052 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 1268 WerFault.exe 1268 WerFault.exe 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 2276 explorer.exe 3876 explorer.exe 3024 Process not Found 3024 Process not Found 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 896 explorer.exe 896 explorer.exe 3024 Process not Found 3024 Process not Found 888 explorer.exe 888 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3700 explorer.exe 3700 explorer.exe 3024 Process not Found 3024 Process not Found 3052 explorer.exe 3052 explorer.exe 1020 explorer.exe 1020 explorer.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2276 explorer.exe 3876 explorer.exe 3876 explorer.exe 2276 explorer.exe 3912 explorer.exe 3912 explorer.exe 3024 Process not Found 3024 Process not Found - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 3964 fwpxeohi.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 2128 jyjzhr.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeRestorePrivilege 1268 WerFault.exe Token: SeBackupPrivilege 1268 WerFault.exe Token: SeDebugPrivilege 1268 WerFault.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3024 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 648 wrote to memory of 3964 648 EXCEL.EXE 79 PID 648 wrote to memory of 3964 648 EXCEL.EXE 79 PID 648 wrote to memory of 3964 648 EXCEL.EXE 79 PID 3024 wrote to memory of 2264 3024 Process not Found 81 PID 3024 wrote to memory of 2264 3024 Process not Found 81 PID 3024 wrote to memory of 2264 3024 Process not Found 81 PID 3024 wrote to memory of 740 3024 Process not Found 82 PID 3024 wrote to memory of 740 3024 Process not Found 82 PID 3024 wrote to memory of 740 3024 Process not Found 82 PID 3024 wrote to memory of 740 3024 Process not Found 82 PID 3024 wrote to memory of 3884 3024 Process not Found 83 PID 3024 wrote to memory of 3884 3024 Process not Found 83 PID 3024 wrote to memory of 3884 3024 Process not Found 83 PID 3024 wrote to memory of 748 3024 Process not Found 84 PID 3024 wrote to memory of 748 3024 Process not Found 84 PID 3024 wrote to memory of 748 3024 Process not Found 84 PID 3024 wrote to memory of 748 3024 Process not Found 84 PID 3024 wrote to memory of 1752 3024 Process not Found 85 PID 3024 wrote to memory of 1752 3024 Process not Found 85 PID 3024 wrote to memory of 1752 3024 Process not Found 85 PID 3024 wrote to memory of 1752 3024 Process not Found 85 PID 3024 wrote to memory of 3700 3024 Process not Found 86 PID 3024 wrote to memory of 3700 3024 Process not Found 86 PID 3024 wrote to memory of 3700 3024 Process not Found 86 PID 3024 wrote to memory of 3700 3024 Process not Found 86 PID 3024 wrote to memory of 1020 3024 Process not Found 87 PID 3024 wrote to memory of 1020 3024 Process not Found 87 PID 3024 wrote to memory of 1020 3024 Process not Found 87 PID 2264 wrote to memory of 384 2264 1D4D.exe 88 PID 2264 wrote to memory of 384 2264 1D4D.exe 88 PID 2264 wrote to memory of 384 2264 1D4D.exe 88 PID 3024 wrote to memory of 3912 3024 Process not Found 89 PID 3024 wrote to memory of 3912 3024 Process not Found 89 PID 3024 wrote to memory of 3912 3024 Process not Found 89 PID 3024 wrote to memory of 3912 3024 Process not Found 89 PID 3024 wrote to memory of 3052 3024 Process not Found 90 PID 3024 wrote to memory of 3052 3024 Process not Found 90 PID 3024 wrote to memory of 3052 3024 Process not Found 90 PID 3024 wrote to memory of 2276 3024 Process not Found 91 PID 3024 wrote to memory of 2276 3024 Process not Found 91 PID 3024 wrote to memory of 2276 3024 Process not Found 91 PID 3024 wrote to memory of 2276 3024 Process not Found 91 PID 3024 wrote to memory of 896 3024 Process not Found 92 PID 3024 wrote to memory of 896 3024 Process not Found 92 PID 3024 wrote to memory of 896 3024 Process not Found 92 PID 3024 wrote to memory of 1860 3024 Process not Found 93 PID 3024 wrote to memory of 1860 3024 Process not Found 93 PID 3024 wrote to memory of 1860 3024 Process not Found 93 PID 3024 wrote to memory of 1860 3024 Process not Found 93 PID 3024 wrote to memory of 1748 3024 Process not Found 94 PID 3024 wrote to memory of 1748 3024 Process not Found 94 PID 3024 wrote to memory of 1748 3024 Process not Found 94 PID 3024 wrote to memory of 1748 3024 Process not Found 94 PID 3024 wrote to memory of 888 3024 Process not Found 95 PID 3024 wrote to memory of 888 3024 Process not Found 95 PID 3024 wrote to memory of 888 3024 Process not Found 95 PID 3024 wrote to memory of 888 3024 Process not Found 95 PID 3024 wrote to memory of 3876 3024 Process not Found 96 PID 3024 wrote to memory of 3876 3024 Process not Found 96 PID 3024 wrote to memory of 3876 3024 Process not Found 96 PID 3024 wrote to memory of 1120 3024 Process not Found 97 PID 3024 wrote to memory of 1120 3024 Process not Found 97 PID 3024 wrote to memory of 1120 3024 Process not Found 97 PID 3024 wrote to memory of 1120 3024 Process not Found 97 PID 2264 wrote to memory of 2128 2264 1D4D.exe 98 PID 2264 wrote to memory of 2128 2264 1D4D.exe 98 PID 2264 wrote to memory of 2128 2264 1D4D.exe 98 PID 2264 wrote to memory of 3972 2264 1D4D.exe 99 PID 2264 wrote to memory of 3972 2264 1D4D.exe 99 PID 2264 wrote to memory of 3972 2264 1D4D.exe 99 PID 2128 wrote to memory of 3916 2128 jyjzhr.exe 101 PID 2128 wrote to memory of 3916 2128 jyjzhr.exe 101 PID 2128 wrote to memory of 3916 2128 jyjzhr.exe 101 PID 2128 wrote to memory of 768 2128 jyjzhr.exe 102 PID 2128 wrote to memory of 768 2128 jyjzhr.exe 102 PID 2128 wrote to memory of 768 2128 jyjzhr.exe 102 PID 2128 wrote to memory of 768 2128 jyjzhr.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1429343675.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3964
-
-
C:\Users\Admin\AppData\Local\Temp\1D4D.exeC:\Users\Admin\AppData\Local\Temp\1D4D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\1D4D.exeC:\Users\Admin\AppData\Local\Temp\1D4D.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:384
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Twpghlks\jyjzhr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Twpghlks\jyjzhr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:2128 -
C:\Users\Admin\AppData\Roaming\Microsoft\Twpghlks\jyjzhr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Twpghlks\jyjzhr.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3916
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:768
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn pypcrmxih /tr "\"C:\Users\Admin\AppData\Local\Temp\1D4D.exe\" /I pypcrmxih" /SC ONCE /Z /ST 20:51 /ET 21:032⤵
- Creates scheduled task(s)
PID:3972
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:740
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3884
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:748
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1752
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1020
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3052
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2276
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:896
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1860
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1748
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:888
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3876
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1120
-
C:\Users\Admin\AppData\Roaming\aiasceeC:\Users\Admin\AppData\Roaming\aiascee1⤵
- Executes dropped EXE
PID:3816 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 4802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1268
-