Analysis
- max time kernel
150s - max time network
143s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
document-1679883349.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1679883349.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1679883349.xlsb
- Size 291KB
- Sample201113-kalnv7w7ea
- SHA256 18ca7ac174cce132507f3f21809f0ed5605c87600ced82b9b5c74125f628a22e
- MD5 dff9ea0f562c6671d489ab9fa4dd2ba9
- SHA1 d479a9eafb43dc1188605719e644492385cb3a64
- SHA512 8b9302ea6a25dd4a453de4692b43dc944ef6b277f0d7463d759daaa4f0b2f422011ba84dca1571ead441ce4c5c827ef8a260c62c2cf7f8de61d8bc61f3428061
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 6 IoCs
pid Process 2028 fwpxeohi.exe 3484 D7B8.exe 3560 D7B8.exe 3976 uzenrn.exe 1208 uzenrn.exe 3180 D7B8.exe - Loads dropped DLL 1 IoCs
pid Process 2028 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc D7B8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 uzenrn.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc uzenrn.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service uzenrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 D7B8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 D7B8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service D7B8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc uzenrn.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service D7B8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc D7B8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 uzenrn.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service uzenrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1428 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 796 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2770 IoCs
pid Process 2028 fwpxeohi.exe 2028 fwpxeohi.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 3484 D7B8.exe 3484 D7B8.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2348 explorer.exe 2348 explorer.exe 2700 explorer.exe 2700 explorer.exe 3560 D7B8.exe 3560 D7B8.exe 3292 explorer.exe 3292 explorer.exe 3560 D7B8.exe 3560 D7B8.exe 2420 explorer.exe 2420 explorer.exe 1464 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2348 explorer.exe 2348 explorer.exe 1752 explorer.exe 1752 explorer.exe 2700 explorer.exe 2700 explorer.exe 3800 explorer.exe 3800 explorer.exe 2792 explorer.exe 2792 explorer.exe 3976 uzenrn.exe 3976 uzenrn.exe 3292 explorer.exe 3292 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1464 explorer.exe 2348 explorer.exe 2348 explorer.exe 2348 explorer.exe 2348 explorer.exe 1872 explorer.exe 1872 explorer.exe 1208 uzenrn.exe 1208 uzenrn.exe 1208 uzenrn.exe 1208 uzenrn.exe 1752 explorer.exe 1752 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 2700 explorer.exe 2700 explorer.exe 2700 explorer.exe 2700 explorer.exe 3800 explorer.exe 3800 explorer.exe 2700 explorer.exe 2700 explorer.exe 2792 explorer.exe 2792 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2700 explorer.exe 2700 explorer.exe 2792 explorer.exe 2792 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2700 explorer.exe 2700 explorer.exe 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2700 explorer.exe 2700 explorer.exe 2792 explorer.exe 2792 explorer.exe 1464 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2792 explorer.exe 2792 explorer.exe 1752 explorer.exe 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 2756 Process not Found 1752 explorer.exe 2756 Process not Found 1464 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 2756 Process not Found 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 2756 Process not Found 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 2756 Process not Found 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 2756 Process not Found 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 3292 explorer.exe 2756 Process not Found 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 2756 Process not Found 1464 explorer.exe 2756 Process not Found 1752 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 3292 explorer.exe 2756 Process not Found 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 2756 Process not Found 1464 explorer.exe 2756 Process not Found 1752 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 2756 Process not Found 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 2756 Process not Found 1752 explorer.exe 2756 Process not Found 1464 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 2756 Process not Found 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 3180 D7B8.exe 3180 D7B8.exe 2756 Process not Found 1752 explorer.exe 1752 explorer.exe 2756 Process not Found 1464 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1464 explorer.exe 2756 Process not Found 1752 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 2756 Process not Found 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 2756 Process not Found 1464 explorer.exe 2756 Process not Found 1752 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 2756 Process not Found 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 2756 Process not Found 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2756 Process not Found 2756 Process not Found 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1464 explorer.exe 1752 explorer.exe 3292 explorer.exe 3292 explorer.exe 2756 Process not Found 3800 explorer.exe 2756 Process not Found 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2792 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1464 explorer.exe 1752 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2420 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2700 explorer.exe 2700 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 1872 explorer.exe 1872 explorer.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2792 explorer.exe 2756 Process not Found 2756 Process not Found 1752 explorer.exe 1464 explorer.exe 1752 explorer.exe 1464 explorer.exe 2756 Process not Found 2756 Process not Found 3292 explorer.exe 3292 explorer.exe 3800 explorer.exe 3800 explorer.exe 2420 explorer.exe 2756 Process not Found 2420 explorer.exe 2756 Process not Found - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 2028 fwpxeohi.exe 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 2756 Process not Found 3976 uzenrn.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found Token: SeShutdownPrivilege 2756 Process not Found Token: SeCreatePagefilePrivilege 2756 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE 796 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2756 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 796 wrote to memory of 2028 796 EXCEL.EXE 75 PID 796 wrote to memory of 2028 796 EXCEL.EXE 75 PID 796 wrote to memory of 2028 796 EXCEL.EXE 75 PID 2756 wrote to memory of 3484 2756 Process not Found 80 PID 2756 wrote to memory of 3484 2756 Process not Found 80 PID 2756 wrote to memory of 3484 2756 Process not Found 80 PID 2756 wrote to memory of 1008 2756 Process not Found 81 PID 2756 wrote to memory of 1008 2756 Process not Found 81 PID 2756 wrote to memory of 1008 2756 Process not Found 81 PID 2756 wrote to memory of 1008 2756 Process not Found 81 PID 2756 wrote to memory of 3956 2756 Process not Found 82 PID 2756 wrote to memory of 3956 2756 Process not Found 82 PID 2756 wrote to memory of 3956 2756 Process not Found 82 PID 2756 wrote to memory of 2096 2756 Process not Found 83 PID 2756 wrote to memory of 2096 2756 Process not Found 83 PID 2756 wrote to memory of 2096 2756 Process not Found 83 PID 2756 wrote to memory of 2096 2756 Process not Found 83 PID 3484 wrote to memory of 3560 3484 D7B8.exe 84 PID 3484 wrote to memory of 3560 3484 D7B8.exe 84 PID 3484 wrote to memory of 3560 3484 D7B8.exe 84 PID 2756 wrote to memory of 2348 2756 Process not Found 85 PID 2756 wrote to memory of 2348 2756 Process not Found 85 PID 2756 wrote to memory of 2348 2756 Process not Found 85 PID 2756 wrote to memory of 2348 2756 Process not Found 85 PID 2756 wrote to memory of 2700 2756 Process not Found 86 PID 2756 wrote to memory of 2700 2756 Process not Found 86 PID 2756 wrote to memory of 2700 2756 Process not Found 86 PID 2756 wrote to memory of 2700 2756 Process not Found 86 PID 2756 wrote to memory of 3292 2756 Process not Found 87 PID 2756 wrote to memory of 3292 2756 Process not Found 87 PID 2756 wrote to memory of 3292 2756 Process not Found 87 PID 2756 wrote to memory of 2420 2756 Process not Found 88 PID 2756 wrote to memory of 2420 2756 Process not Found 88 PID 2756 wrote to memory of 2420 2756 Process not Found 88 PID 2756 wrote to memory of 2420 2756 Process not Found 88 PID 2756 wrote to memory of 1464 2756 Process not Found 89 PID 2756 wrote to memory of 1464 2756 Process not Found 89 PID 2756 wrote to memory of 1464 2756 Process not Found 89 PID 2756 wrote to memory of 1872 2756 Process not Found 90 PID 2756 wrote to memory of 1872 2756 Process not Found 90 PID 2756 wrote to memory of 1872 2756 Process not Found 90 PID 2756 wrote to memory of 1872 2756 Process not Found 90 PID 2756 wrote to memory of 1752 2756 Process not Found 91 PID 2756 wrote to memory of 1752 2756 Process not Found 91 PID 2756 wrote to memory of 1752 2756 Process not Found 91 PID 3484 wrote to memory of 3976 3484 D7B8.exe 92 PID 3484 wrote to memory of 3976 3484 D7B8.exe 92 PID 3484 wrote to memory of 3976 3484 D7B8.exe 92 PID 3484 wrote to memory of 1428 3484 D7B8.exe 93 PID 3484 wrote to memory of 1428 3484 D7B8.exe 93 PID 3484 wrote to memory of 1428 3484 D7B8.exe 93 PID 2756 wrote to memory of 3104 2756 Process not Found 94 PID 2756 wrote to memory of 3104 2756 Process not Found 94 PID 2756 wrote to memory of 3104 2756 Process not Found 94 PID 2756 wrote to memory of 3104 2756 Process not Found 94 PID 2756 wrote to memory of 1844 2756 Process not Found 96 PID 2756 wrote to memory of 1844 2756 Process not Found 96 PID 2756 wrote to memory of 1844 2756 Process not Found 96 PID 2756 wrote to memory of 1844 2756 Process not Found 96 PID 2756 wrote to memory of 3800 2756 Process not Found 97 PID 2756 wrote to memory of 3800 2756 Process not Found 97 PID 2756 wrote to memory of 3800 2756 Process not Found 97 PID 2756 wrote to memory of 3800 2756 Process not Found 97 PID 2756 wrote to memory of 2792 2756 Process not Found 98 PID 2756 wrote to memory of 2792 2756 Process not Found 98 PID 2756 wrote to memory of 2792 2756 Process not Found 98 PID 2756 wrote to memory of 3652 2756 Process not Found 99 PID 2756 wrote to memory of 3652 2756 Process not Found 99 PID 2756 wrote to memory of 3652 2756 Process not Found 99 PID 2756 wrote to memory of 3652 2756 Process not Found 99 PID 3976 wrote to memory of 1208 3976 uzenrn.exe 100 PID 3976 wrote to memory of 1208 3976 uzenrn.exe 100 PID 3976 wrote to memory of 1208 3976 uzenrn.exe 100 PID 3976 wrote to memory of 1932 3976 uzenrn.exe 101 PID 3976 wrote to memory of 1932 3976 uzenrn.exe 101 PID 3976 wrote to memory of 1932 3976 uzenrn.exe 101 PID 3976 wrote to memory of 1932 3976 uzenrn.exe 101
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1679883349.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\D7B8.exeC:\Users\Admin\AppData\Local\Temp\D7B8.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\D7B8.exeC:\Users\Admin\AppData\Local\Temp\D7B8.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3560
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Uayoic\uzenrn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Uayoic\uzenrn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:3976 -
C:\Users\Admin\AppData\Roaming\Microsoft\Uayoic\uzenrn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Uayoic\uzenrn.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1208
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:1932
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn btgdxchfav /tr "\"C:\Users\Admin\AppData\Local\Temp\D7B8.exe\" /I btgdxchfav" /SC ONCE /Z /ST 17:09 /ET 17:212⤵
- Creates scheduled task(s)
PID:1428
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1008
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3956
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2096
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2348
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3292
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2420
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1464
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1872
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1752
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3104
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1844
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3800
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2792
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\D7B8.exeC:\Users\Admin\AppData\Local\Temp\D7B8.exe /I btgdxchfav1⤵
- Executes dropped EXE
PID:3180