Analysis
- max time kernel
150s - max time network
139s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
document-1621968129.xlsb
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
document-1621968129.xlsb
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target document-1621968129.xlsb
- Size 291KB
- Sample201113-wwth7eqe1e
- SHA256 199621620a254b3e374ad9030ea79c27396589191b2a06f08fa35218ee00ff1f
- MD5 8d590299287234b66373864585d0a2c6
- SHA1 b24ff480d9c246b7e7fb1f8b2c05f3274fa87c42
- SHA512 f03dff2f1f012ec198e82c6a4932e8ac488f09fce5bd101e06b39e37989ff25e965cae020c2bcf46ee638f7e473ad7647aaefcf7c2979930edfbde5ac118cc67
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://we11wdsgd.com/
rc4.i32
rc4.i32
Extracted
Family
-
qakbot
Botnet
-
tr01
Campaign
-
1604997522
C2
-
122.61.213.85:443
-
2.50.89.119:995
-
189.183.201.0:443
-
86.98.145.152:2222
-
96.241.66.126:443
-
90.101.117.122:2222
-
94.69.112.148:2222
-
81.150.181.168:2222
-
82.127.125.209:2222
-
81.214.126.173:2222
-
86.140.82.116:20
-
172.87.157.235:443
-
176.181.247.197:443
-
78.97.110.47:443
-
5.15.90.117:2222
-
41.206.131.156:443
-
151.73.112.67:443
-
82.127.125.209:990
-
197.45.110.165:995
-
81.133.234.36:2222
-
37.6.222.192:995
-
118.100.108.25:443
-
86.97.162.141:2222
-
74.129.26.119:443
-
37.116.152.122:2222
-
92.154.83.96:1194
-
45.32.154.10:443
-
45.63.107.192:443
-
207.246.75.201:443
-
59.99.38.231:443
-
45.63.107.192:2222
-
195.97.101.40:443
-
45.63.107.192:995
-
199.247.16.80:443
-
199.247.22.145:443
-
80.240.26.178:443
-
108.52.39.68:443
-
203.106.195.67:443
-
2.50.143.154:2222
-
73.166.10.38:443
-
84.232.252.202:2222
-
47.146.39.147:443
-
69.40.22.180:443
-
73.239.229.107:995
-
71.187.177.20:443
-
50.244.112.90:443
-
67.61.157.208:443
-
45.118.65.34:443
-
217.128.117.218:2222
-
47.22.148.6:443
-
50.82.55.69:443
-
75.136.40.155:443
-
82.76.47.211:443
-
68.186.192.69:443
-
71.187.170.235:443
-
2.50.244.155:443
-
80.14.209.42:2222
-
196.204.207.111:443
-
78.132.115.83:6881
-
180.233.150.134:443
-
185.163.221.77:2222
-
41.206.131.166:443
-
149.28.99.97:2222
-
149.28.99.97:443
-
149.28.99.97:995
-
117.199.12.148:443
-
83.110.12.0:2222
-
2.50.110.49:2078
-
93.86.252.177:995
-
79.113.242.120:443
-
68.174.15.223:443
-
94.52.160.116:443
-
41.205.16.176:443
-
84.117.176.32:443
-
217.133.54.140:32100
-
185.105.131.233:443
-
87.27.110.90:2222
-
77.159.149.74:443
-
105.101.88.222:443
-
185.246.9.69:995
-
188.25.24.21:2222
-
2.90.127.64:443
-
86.97.191.98:2222
-
31.5.168.31:443
-
41.225.13.128:8443
-
24.205.42.241:443
-
41.97.173.199:443
-
105.198.236.101:443
-
190.220.8.10:995
-
197.161.154.132:443
-
24.90.129.73:443
-
120.150.34.178:443
-
122.60.99.107:443
-
27.223.92.142:995
-
96.41.93.96:443
-
109.209.94.165:2222
-
189.231.189.64:443
-
58.179.21.147:995
-
2.51.153.24:443
-
149.135.101.20:443
-
74.135.122.35:443
-
82.127.125.209:22
-
96.21.251.127:2222
-
98.116.20.194:443
-
39.32.61.193:995
-
173.173.1.164:443
-
109.205.204.229:2222
-
78.96.199.79:443
-
73.136.242.114:443
-
198.2.35.226:2222
-
156.205.170.226:995
-
117.197.231.67:443
-
41.227.93.43:443
-
89.136.39.108:443
-
207.246.70.216:443
-
45.32.165.134:443
-
45.32.162.253:443
-
140.82.27.132:443
-
37.106.36.31:995
-
45.63.104.123:443
-
63.155.67.114:995
-
96.30.198.161:443
-
95.179.247.224:443
-
188.27.32.167:443
-
108.31.15.10:995
-
81.88.254.62:443
-
184.66.18.83:443
-
73.55.254.225:443
-
184.98.97.227:995
-
216.215.77.18:2222
-
5.32.41.46:443
-
144.139.230.139:443
-
69.47.26.41:443
-
197.86.204.198:443
-
72.241.205.69:443
-
89.137.211.239:443
-
86.122.246.127:2222
-
197.47.160.202:995
-
24.137.76.62:995
-
86.248.30.56:2222
-
31.5.21.66:443
-
212.70.107.59:995
-
2.7.202.106:2222
-
72.36.59.46:2222
-
71.238.211.125:443
-
2.181.78.140:2222
-
81.97.154.100:443
-
47.44.217.98:443
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 5 IoCs
pid Process 4080 fwpxeohi.exe 416 CF1D.exe 4768 CF1D.exe 196 gkuqja.exe 5072 gkuqja.exe - Loads dropped DLL 1 IoCs
pid Process 4080 fwpxeohi.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 CF1D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc CF1D.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service gkuqja.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service CF1D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 gkuqja.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service gkuqja.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc gkuqja.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc CF1D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 gkuqja.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc gkuqja.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fwpxeohi.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service CF1D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 CF1D.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1768 schtasks.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4648 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 2752 IoCs
pid Process 4080 fwpxeohi.exe 4080 fwpxeohi.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 416 CF1D.exe 416 CF1D.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 2468 explorer.exe 2468 explorer.exe 3108 Process not Found 3108 Process not Found 1400 explorer.exe 1400 explorer.exe 2336 explorer.exe 2336 explorer.exe 4768 CF1D.exe 4768 CF1D.exe 4628 explorer.exe 4628 explorer.exe 4768 CF1D.exe 4768 CF1D.exe 4560 explorer.exe 4560 explorer.exe 4348 explorer.exe 4348 explorer.exe 2468 explorer.exe 2468 explorer.exe 904 explorer.exe 904 explorer.exe 3108 Process not Found 3108 Process not Found 1400 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 580 explorer.exe 580 explorer.exe 2336 explorer.exe 2336 explorer.exe 196 gkuqja.exe 196 gkuqja.exe 4628 explorer.exe 4628 explorer.exe 4560 explorer.exe 4560 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 2468 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 1400 explorer.exe 1400 explorer.exe 1400 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 580 explorer.exe 580 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 580 explorer.exe 580 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 5072 gkuqja.exe 5072 gkuqja.exe 4628 explorer.exe 580 explorer.exe 4628 explorer.exe 580 explorer.exe 2336 explorer.exe 4560 explorer.exe 2336 explorer.exe 4560 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 580 explorer.exe 580 explorer.exe 4628 explorer.exe 4628 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 5072 gkuqja.exe 5072 gkuqja.exe 4348 explorer.exe 4348 explorer.exe 904 explorer.exe 904 explorer.exe 1436 explorer.exe 1436 explorer.exe 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 1436 explorer.exe 1436 explorer.exe 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 580 explorer.exe 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 3108 Process not Found 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 3108 Process not Found 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 3108 Process not Found 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 3108 Process not Found 2336 explorer.exe 3108 Process not Found 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 1012 explorer.exe 3108 Process not Found 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 3108 Process not Found 4628 explorer.exe 3108 Process not Found 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 3108 Process not Found 2336 explorer.exe 3108 Process not Found 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 3108 Process not Found 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 3108 Process not Found 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 3108 Process not Found 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 3108 Process not Found 2336 explorer.exe 3108 Process not Found 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 3108 Process not Found 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 3108 Process not Found 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 3108 Process not Found 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 3108 Process not Found 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 3108 Process not Found 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 3108 Process not Found 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 3108 Process not Found 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 580 explorer.exe 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 3108 Process not Found 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1400 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 4560 explorer.exe 3108 Process not Found 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1400 explorer.exe 1012 explorer.exe 1400 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 3108 Process not Found 3108 Process not Found 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 3108 Process not Found 3108 Process not Found 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 3108 Process not Found 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 3108 Process not Found 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 3108 Process not Found 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 3108 Process not Found 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 3108 Process not Found 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 3108 Process not Found 4628 explorer.exe 580 explorer.exe 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 3108 Process not Found 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 3108 Process not Found 1400 explorer.exe 3108 Process not Found 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 3108 Process not Found 580 explorer.exe 3108 Process not Found 580 explorer.exe 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 3108 Process not Found 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 4560 explorer.exe 3108 Process not Found 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 1012 explorer.exe 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 904 explorer.exe 3108 Process not Found 904 explorer.exe 4348 explorer.exe 4348 explorer.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 4628 explorer.exe 4628 explorer.exe 580 explorer.exe 580 explorer.exe 3108 Process not Found 3108 Process not Found 4560 explorer.exe 4560 explorer.exe 2336 explorer.exe 2336 explorer.exe 3108 Process not Found 1012 explorer.exe 3108 Process not Found 1012 explorer.exe 1400 explorer.exe 1400 explorer.exe 3108 Process not Found 3108 Process not Found - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 4080 fwpxeohi.exe 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 3108 Process not Found 196 gkuqja.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3108 Process not Found Token: SeCreatePagefilePrivilege 3108 Process not Found Token: SeShutdownPrivilege 3108 Process not Found Token: SeCreatePagefilePrivilege 3108 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4648 EXCEL.EXE 4648 EXCEL.EXE - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3108 Process not Found - Suspicious use of WriteProcessMemory 77 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4080 4648 EXCEL.EXE 76 PID 4648 wrote to memory of 4080 4648 EXCEL.EXE 76 PID 4648 wrote to memory of 4080 4648 EXCEL.EXE 76 PID 3108 wrote to memory of 416 3108 Process not Found 81 PID 3108 wrote to memory of 416 3108 Process not Found 81 PID 3108 wrote to memory of 416 3108 Process not Found 81 PID 3108 wrote to memory of 636 3108 Process not Found 82 PID 3108 wrote to memory of 636 3108 Process not Found 82 PID 3108 wrote to memory of 636 3108 Process not Found 82 PID 3108 wrote to memory of 636 3108 Process not Found 82 PID 3108 wrote to memory of 568 3108 Process not Found 83 PID 3108 wrote to memory of 568 3108 Process not Found 83 PID 3108 wrote to memory of 568 3108 Process not Found 83 PID 3108 wrote to memory of 2900 3108 Process not Found 84 PID 3108 wrote to memory of 2900 3108 Process not Found 84 PID 3108 wrote to memory of 2900 3108 Process not Found 84 PID 3108 wrote to memory of 2900 3108 Process not Found 84 PID 416 wrote to memory of 4768 416 CF1D.exe 85 PID 416 wrote to memory of 4768 416 CF1D.exe 85 PID 416 wrote to memory of 4768 416 CF1D.exe 85 PID 3108 wrote to memory of 2468 3108 Process not Found 86 PID 3108 wrote to memory of 2468 3108 Process not Found 86 PID 3108 wrote to memory of 2468 3108 Process not Found 86 PID 3108 wrote to memory of 2468 3108 Process not Found 86 PID 3108 wrote to memory of 1400 3108 Process not Found 87 PID 3108 wrote to memory of 1400 3108 Process not Found 87 PID 3108 wrote to memory of 1400 3108 Process not Found 87 PID 3108 wrote to memory of 1400 3108 Process not Found 87 PID 3108 wrote to memory of 2336 3108 Process not Found 88 PID 3108 wrote to memory of 2336 3108 Process not Found 88 PID 3108 wrote to memory of 2336 3108 Process not Found 88 PID 3108 wrote to memory of 4628 3108 Process not Found 89 PID 3108 wrote to memory of 4628 3108 Process not Found 89 PID 3108 wrote to memory of 4628 3108 Process not Found 89 PID 3108 wrote to memory of 4628 3108 Process not Found 89 PID 3108 wrote to memory of 4560 3108 Process not Found 90 PID 3108 wrote to memory of 4560 3108 Process not Found 90 PID 3108 wrote to memory of 4560 3108 Process not Found 90 PID 3108 wrote to memory of 4348 3108 Process not Found 91 PID 3108 wrote to memory of 4348 3108 Process not Found 91 PID 3108 wrote to memory of 4348 3108 Process not Found 91 PID 3108 wrote to memory of 4348 3108 Process not Found 91 PID 3108 wrote to memory of 904 3108 Process not Found 92 PID 3108 wrote to memory of 904 3108 Process not Found 92 PID 3108 wrote to memory of 904 3108 Process not Found 92 PID 3108 wrote to memory of 3164 3108 Process not Found 93 PID 3108 wrote to memory of 3164 3108 Process not Found 93 PID 3108 wrote to memory of 3164 3108 Process not Found 93 PID 3108 wrote to memory of 3164 3108 Process not Found 93 PID 416 wrote to memory of 196 416 CF1D.exe 94 PID 416 wrote to memory of 196 416 CF1D.exe 94 PID 416 wrote to memory of 196 416 CF1D.exe 94 PID 3108 wrote to memory of 188 3108 Process not Found 95 PID 3108 wrote to memory of 188 3108 Process not Found 95 PID 3108 wrote to memory of 188 3108 Process not Found 95 PID 3108 wrote to memory of 188 3108 Process not Found 95 PID 416 wrote to memory of 1768 416 CF1D.exe 96 PID 416 wrote to memory of 1768 416 CF1D.exe 96 PID 416 wrote to memory of 1768 416 CF1D.exe 96 PID 3108 wrote to memory of 1012 3108 Process not Found 98 PID 3108 wrote to memory of 1012 3108 Process not Found 98 PID 3108 wrote to memory of 1012 3108 Process not Found 98 PID 3108 wrote to memory of 1012 3108 Process not Found 98 PID 3108 wrote to memory of 580 3108 Process not Found 99 PID 3108 wrote to memory of 580 3108 Process not Found 99 PID 3108 wrote to memory of 580 3108 Process not Found 99 PID 3108 wrote to memory of 2512 3108 Process not Found 100 PID 3108 wrote to memory of 2512 3108 Process not Found 100 PID 3108 wrote to memory of 2512 3108 Process not Found 100 PID 3108 wrote to memory of 2512 3108 Process not Found 100 PID 196 wrote to memory of 5072 196 gkuqja.exe 101 PID 196 wrote to memory of 5072 196 gkuqja.exe 101 PID 196 wrote to memory of 5072 196 gkuqja.exe 101 PID 196 wrote to memory of 1436 196 gkuqja.exe 102 PID 196 wrote to memory of 1436 196 gkuqja.exe 102 PID 196 wrote to memory of 1436 196 gkuqja.exe 102 PID 196 wrote to memory of 1436 196 gkuqja.exe 102
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\document-1621968129.xlsb"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\giogti\mpopqr\fwpxeohi.exe"C:\giogti\mpopqr\fwpxeohi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4080
-
-
C:\Users\Admin\AppData\Local\Temp\CF1D.exeC:\Users\Admin\AppData\Local\Temp\CF1D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\CF1D.exeC:\Users\Admin\AppData\Local\Temp\CF1D.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4768
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exeC:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:196 -
C:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exeC:\Users\Admin\AppData\Roaming\Microsoft\Fkbpcx\gkuqja.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5072
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:1436
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn eurdvlf /tr "\"C:\Users\Admin\AppData\Local\Temp\CF1D.exe\" /I eurdvlf" /SC ONCE /Z /ST 17:06 /ET 17:182⤵
- Creates scheduled task(s)
PID:1768
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:636
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:568
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2900
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2468
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1400
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2336
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4628
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4560
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4348
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:904
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3164
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:188
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1012
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:580
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2512