Analysis
- max time kernel
150s - max time network
141s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
document-1650670159.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1650670159.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1650670159.xlsb
- Size 291KB
- Sample201113-wjybcc2lqa
- SHA256 fecb1cda1fce888eb51b0e062f223e9469736e21456a310719156228726e6719
- MD5 ed4af2e942ad1c11fd8aecc0a036ef68
- SHA1 d88c11bb11b0d77d375b6823d8023e64cbecd3ec
- SHA512 1b39956bf9aa456d7f67fa76399e97f3dba11c1effa51db03ebcf1526f4fe9ca883bcc5d9fbd349cdd0c3215cd86d26b6a0dcc3138aa14da3190626148d9b86c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 2504 fwpxeohi.exe 2612 C980.exe 2616 C980.exe 1468 dahojtc.exe 60 dahojtc.exe - Loads dropped DLL 1 IoCs
pid Process 2504 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C980.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc dahojtc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service C980.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C980.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 dahojtc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc dahojtc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 dahojtc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C980.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C980.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service C980.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service dahojtc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service dahojtc.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 644 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3408 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2508 IoCs
pid Process 2504 fwpxeohi.exe 2504 fwpxeohi.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2612 C980.exe 2612 C980.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 3116 Process not Found 3116 Process not Found 1816 explorer.exe 1816 explorer.exe 2664 explorer.exe 2664 explorer.exe 3696 explorer.exe 3696 explorer.exe 2616 C980.exe 2616 C980.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 2800 explorer.exe 1676 explorer.exe 1676 explorer.exe 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 2648 explorer.exe 2648 explorer.exe 2616 C980.exe 2616 C980.exe 2540 explorer.exe 2540 explorer.exe 2664 explorer.exe 2664 explorer.exe 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 2164 explorer.exe 2164 explorer.exe 1468 dahojtc.exe 1468 dahojtc.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 60 dahojtc.exe 60 dahojtc.exe 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 60 dahojtc.exe 60 dahojtc.exe 2648 explorer.exe 2648 explorer.exe 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 3696 explorer.exe 3696 explorer.exe 2372 explorer.exe 2372 explorer.exe 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 1676 explorer.exe 1676 explorer.exe 3696 explorer.exe 3696 explorer.exe 2648 explorer.exe 2648 explorer.exe 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2372 explorer.exe 2372 explorer.exe 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 2164 explorer.exe 2164 explorer.exe 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 2648 explorer.exe 2648 explorer.exe 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2164 explorer.exe 2164 explorer.exe 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 2164 explorer.exe 2164 explorer.exe 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 2648 explorer.exe 2664 explorer.exe 2648 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2164 explorer.exe 2164 explorer.exe 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 3116 Process not Found 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 3116 Process not Found 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2648 explorer.exe 2664 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2648 explorer.exe 2664 explorer.exe 2648 explorer.exe 3116 Process not Found 2540 explorer.exe 3116 Process not Found 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3116 Process not Found 3696 explorer.exe 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 2540 explorer.exe 3116 Process not Found 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 1676 explorer.exe 3116 Process not Found 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 3116 Process not Found 2188 explorer.exe 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 3116 Process not Found 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 3116 Process not Found 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3696 explorer.exe 3696 explorer.exe 3116 Process not Found 3116 Process not Found 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 2540 explorer.exe 2540 explorer.exe 3116 Process not Found 3116 Process not Found 2648 explorer.exe 2648 explorer.exe 3116 Process not Found 3116 Process not Found 2164 explorer.exe 2164 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2188 explorer.exe 2188 explorer.exe 3116 Process not Found 3116 Process not Found 3696 explorer.exe 3696 explorer.exe 1676 explorer.exe 1676 explorer.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 2664 explorer.exe 2664 explorer.exe 3116 Process not Found 3116 Process not Found 2540 explorer.exe 2540 explorer.exe 2648 explorer.exe 2648 explorer.exe - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 2504 fwpxeohi.exe 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 3116 Process not Found 1468 dahojtc.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3116 Process not Found Token: SeCreatePagefilePrivilege 3116 Process not Found Token: SeShutdownPrivilege 3116 Process not Found Token: SeCreatePagefilePrivilege 3116 Process not Found - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE 3408 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3116 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 3408 wrote to memory of 2504 3408 EXCEL.EXE 77 PID 3408 wrote to memory of 2504 3408 EXCEL.EXE 77 PID 3408 wrote to memory of 2504 3408 EXCEL.EXE 77 PID 3116 wrote to memory of 2612 3116 Process not Found 82 PID 3116 wrote to memory of 2612 3116 Process not Found 82 PID 3116 wrote to memory of 2612 3116 Process not Found 82 PID 3116 wrote to memory of 3124 3116 Process not Found 83 PID 3116 wrote to memory of 3124 3116 Process not Found 83 PID 3116 wrote to memory of 3124 3116 Process not Found 83 PID 3116 wrote to memory of 3124 3116 Process not Found 83 PID 3116 wrote to memory of 2576 3116 Process not Found 84 PID 3116 wrote to memory of 2576 3116 Process not Found 84 PID 3116 wrote to memory of 2576 3116 Process not Found 84 PID 3116 wrote to memory of 580 3116 Process not Found 85 PID 3116 wrote to memory of 580 3116 Process not Found 85 PID 3116 wrote to memory of 580 3116 Process not Found 85 PID 3116 wrote to memory of 580 3116 Process not Found 85 PID 3116 wrote to memory of 2800 3116 Process not Found 86 PID 3116 wrote to memory of 2800 3116 Process not Found 86 PID 3116 wrote to memory of 2800 3116 Process not Found 86 PID 3116 wrote to memory of 2800 3116 Process not Found 86 PID 2612 wrote to memory of 2616 2612 C980.exe 87 PID 2612 wrote to memory of 2616 2612 C980.exe 87 PID 2612 wrote to memory of 2616 2612 C980.exe 87 PID 3116 wrote to memory of 1816 3116 Process not Found 88 PID 3116 wrote to memory of 1816 3116 Process not Found 88 PID 3116 wrote to memory of 1816 3116 Process not Found 88 PID 3116 wrote to memory of 1816 3116 Process not Found 88 PID 3116 wrote to memory of 2664 3116 Process not Found 89 PID 3116 wrote to memory of 2664 3116 Process not Found 89 PID 3116 wrote to memory of 2664 3116 Process not Found 89 PID 3116 wrote to memory of 3696 3116 Process not Found 90 PID 3116 wrote to memory of 3696 3116 Process not Found 90 PID 3116 wrote to memory of 3696 3116 Process not Found 90 PID 3116 wrote to memory of 3696 3116 Process not Found 90 PID 3116 wrote to memory of 1676 3116 Process not Found 91 PID 3116 wrote to memory of 1676 3116 Process not Found 91 PID 3116 wrote to memory of 1676 3116 Process not Found 91 PID 3116 wrote to memory of 2188 3116 Process not Found 92 PID 3116 wrote to memory of 2188 3116 Process not Found 92 PID 3116 wrote to memory of 2188 3116 Process not Found 92 PID 3116 wrote to memory of 2188 3116 Process not Found 92 PID 3116 wrote to memory of 2164 3116 Process not Found 93 PID 3116 wrote to memory of 2164 3116 Process not Found 93 PID 3116 wrote to memory of 2164 3116 Process not Found 93 PID 3116 wrote to memory of 1476 3116 Process not Found 94 PID 3116 wrote to memory of 1476 3116 Process not Found 94 PID 3116 wrote to memory of 1476 3116 Process not Found 94 PID 3116 wrote to memory of 1476 3116 Process not Found 94 PID 3116 wrote to memory of 3572 3116 Process not Found 95 PID 3116 wrote to memory of 3572 3116 Process not Found 95 PID 3116 wrote to memory of 3572 3116 Process not Found 95 PID 3116 wrote to memory of 3572 3116 Process not Found 95 PID 3116 wrote to memory of 2648 3116 Process not Found 96 PID 3116 wrote to memory of 2648 3116 Process not Found 96 PID 3116 wrote to memory of 2648 3116 Process not Found 96 PID 3116 wrote to memory of 2648 3116 Process not Found 96 PID 3116 wrote to memory of 2540 3116 Process not Found 97 PID 3116 wrote to memory of 2540 3116 Process not Found 97 PID 3116 wrote to memory of 2540 3116 Process not Found 97 PID 3116 wrote to memory of 2184 3116 Process not Found 98 PID 3116 wrote to memory of 2184 3116 Process not Found 98 PID 3116 wrote to memory of 2184 3116 Process not Found 98 PID 3116 wrote to memory of 2184 3116 Process not Found 98 PID 2612 wrote to memory of 1468 2612 C980.exe 99 PID 2612 wrote to memory of 1468 2612 C980.exe 99 PID 2612 wrote to memory of 1468 2612 C980.exe 99 PID 2612 wrote to memory of 644 2612 C980.exe 100 PID 2612 wrote to memory of 644 2612 C980.exe 100 PID 2612 wrote to memory of 644 2612 C980.exe 100 PID 1468 wrote to memory of 60 1468 dahojtc.exe 102 PID 1468 wrote to memory of 60 1468 dahojtc.exe 102 PID 1468 wrote to memory of 60 1468 dahojtc.exe 102 PID 1468 wrote to memory of 2372 1468 dahojtc.exe 103 PID 1468 wrote to memory of 2372 1468 dahojtc.exe 103 PID 1468 wrote to memory of 2372 1468 dahojtc.exe 103 PID 1468 wrote to memory of 2372 1468 dahojtc.exe 103
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1650670159.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\C980.exeC:\Users\Admin\AppData\Local\Temp\C980.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\C980.exeC:\Users\Admin\AppData\Local\Temp\C980.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2616
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Xmsrzopnszrh\dahojtc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Xmsrzopnszrh\dahojtc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:1468 -
C:\Users\Admin\AppData\Roaming\Microsoft\Xmsrzopnszrh\dahojtc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Xmsrzopnszrh\dahojtc.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:60
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:2372
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn cuqyxbmpy /tr "\"C:\Users\Admin\AppData\Local\Temp\C980.exe\" /I cuqyxbmpy" /SC ONCE /Z /ST 17:15 /ET 17:272⤵
- Creates scheduled task(s)
PID:644
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3124
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2576
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:580
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2800
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1816
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2664
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3696
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1676
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2188
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2164
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1476
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3572
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2648
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2540
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2184