Overview
overview
10Static
static
8 (1).exe
windows7_x64
108 (1).exe
windows10_x64
108 (10).exe
windows7_x64
108 (10).exe
windows10_x64
8 (11).exe
windows7_x64
108 (11).exe
windows10_x64
108 (12).exe
windows7_x64
8 (12).exe
windows10_x64
108 (13).exe
windows7_x64
108 (13).exe
windows10_x64
108 (14).exe
windows7_x64
108 (14).exe
windows10_x64
108 (15).exe
windows7_x64
108 (15).exe
windows10_x64
108 (16).exe
windows7_x64
108 (16).exe
windows10_x64
108 (17).exe
windows7_x64
108 (17).exe
windows10_x64
108 (18).exe
windows7_x64
108 (18).exe
windows10_x64
108 (19).exe
windows7_x64
108 (19).exe
windows10_x64
108 (2).exe
windows7_x64
108 (2).exe
windows10_x64
108 (20).exe
windows7_x64
108 (20).exe
windows10_x64
108 (21).exe
windows7_x64
108 (21).exe
windows10_x64
108 (22).exe
windows7_x64
108 (22).exe
windows10_x64
108 (23).exe
windows7_x64
108 (23).exe
windows10_x64
Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
34s -
max time network
1850s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-07-2021 12:41
Static task
static1
Behavioral task
behavioral1
Sample
8 (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
8 (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
8 (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
8 (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
8 (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
8 (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
8 (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
8 (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
8 (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
8 (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
8 (14).exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
8 (14).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
8 (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
8 (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
8 (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
8 (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
8 (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
8 (17).exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
8 (18).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
8 (18).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
8 (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
8 (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
8 (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
8 (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
8 (20).exe
Resource
win7v20210408
Behavioral task
behavioral26
Sample
8 (20).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
8 (21).exe
Resource
win7v20210408
Behavioral task
behavioral28
Sample
8 (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
8 (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
8 (22).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
8 (23).exe
Resource
win7v20210408
Behavioral task
behavioral32
Sample
8 (23).exe
Resource
win10v20210410
General
-
Target
8 (13).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
vidar
39.7
865
https://shpak125.tumblr.com/
-
profile_id
865
Extracted
vidar
39.6
903
https://sslamlssa1.tumblr.com/
-
profile_id
903
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral9/memory/2648-353-0x0000000002D50000-0x0000000003676000-memory.dmp family_glupteba behavioral9/memory/2648-354-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 2480 rUNdlL32.eXe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3676 2480 rUNdlL32.eXe 86 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral9/memory/2616-290-0x0000000000417DFA-mapping.dmp family_redline behavioral9/memory/2080-318-0x0000000000417E1A-mapping.dmp family_redline behavioral9/memory/2664-295-0x0000000000417DEE-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
resource yara_rule behavioral9/memory/2616-290-0x0000000000417DFA-mapping.dmp Redline_stealer2 behavioral9/memory/2080-318-0x0000000000417E1A-mapping.dmp Redline_stealer2 behavioral9/memory/2664-295-0x0000000000417DEE-mapping.dmp Redline_stealer2 -
Nirsoft 1 IoCs
resource yara_rule behavioral9/memory/2228-273-0x00000000007B0000-0x000000000080B000-memory.dmp Nirsoft -
Vidar Stealer 5 IoCs
resource yara_rule behavioral9/memory/1968-161-0x0000000002220000-0x00000000022BD000-memory.dmp family_vidar behavioral9/memory/1968-162-0x0000000000400000-0x00000000008F2000-memory.dmp family_vidar behavioral9/memory/2624-324-0x00000000009F0000-0x0000000000A8D000-memory.dmp family_vidar behavioral9/memory/2624-333-0x0000000000400000-0x00000000008EC000-memory.dmp family_vidar behavioral9/memory/2244-352-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar -
resource yara_rule behavioral9/files/0x000300000001311e-69.dat aspack_v212_v242 behavioral9/files/0x000300000001311e-70.dat aspack_v212_v242 behavioral9/files/0x000300000001311e-71.dat aspack_v212_v242 behavioral9/files/0x000300000001311e-73.dat aspack_v212_v242 behavioral9/files/0x000300000001310e-76.dat aspack_v212_v242 behavioral9/files/0x000300000001310e-77.dat aspack_v212_v242 behavioral9/files/0x000300000001310c-78.dat aspack_v212_v242 behavioral9/files/0x000300000001310c-79.dat aspack_v212_v242 behavioral9/files/0x0003000000013116-82.dat aspack_v212_v242 behavioral9/files/0x0003000000013116-83.dat aspack_v212_v242 behavioral9/files/0x000300000001311e-85.dat aspack_v212_v242 behavioral9/files/0x000300000001311e-88.dat aspack_v212_v242 behavioral9/files/0x000300000001311e-87.dat aspack_v212_v242 behavioral9/files/0x000300000001311e-86.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
pid Process 624 setup_installer.exe 752 setup_install.exe 1152 sonia_1.exe 1176 sonia_2.exe 1968 sonia_3.exe 792 sonia_5.exe 800 sonia_4.exe 1000 sonia_6.exe 1452 Acre.exe.com 336 XJYhxoOgAoFTaxjYVe31KDnr.exe -
resource yara_rule behavioral9/files/0x0006000000013116-164.dat upx behavioral9/files/0x0006000000013116-165.dat upx behavioral9/files/0x0006000000013116-167.dat upx behavioral9/files/0x0006000000013116-169.dat upx behavioral9/files/0x0006000000013116-171.dat upx behavioral9/files/0x0006000000013116-170.dat upx -
resource yara_rule behavioral9/memory/2632-259-0x0000000000400000-0x000000000064F000-memory.dmp vmprotect -
Loads dropped DLL 40 IoCs
pid Process 1744 8 (13).exe 624 setup_installer.exe 624 setup_installer.exe 624 setup_installer.exe 624 setup_installer.exe 624 setup_installer.exe 624 setup_installer.exe 752 setup_install.exe 752 setup_install.exe 752 setup_install.exe 752 setup_install.exe 752 setup_install.exe 752 setup_install.exe 752 setup_install.exe 752 setup_install.exe 1160 cmd.exe 1160 cmd.exe 972 cmd.exe 972 cmd.exe 1324 cmd.exe 1324 cmd.exe 1176 sonia_2.exe 1176 sonia_2.exe 1968 sonia_3.exe 1968 sonia_3.exe 1344 cmd.exe 1932 cmd.exe 2044 cmd.exe 792 sonia_5.exe 792 sonia_5.exe 1000 sonia_6.exe 1000 sonia_6.exe 1176 PING.EXE 1000 sonia_6.exe 1000 sonia_6.exe 1452 Acre.exe.com 1452 Acre.exe.com 792 Acre.exe.com 792 Acre.exe.com 792 Acre.exe.com -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2356 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 698 api.2ip.ua 6 ipinfo.io 7 ipinfo.io 16 ip-api.com 344 api.2ip.ua 345 api.2ip.ua 386 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
pid pid_target Process procid_target 2120 1968 WerFault.exe 38 2228 2632 WerFault.exe 65 2448 2624 WerFault.exe 66 2344 2244 WerFault.exe 118 3020 924 WerFault.exe 111 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI PING.EXE Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI PING.EXE -
Delays execution with timeout.exe 2 IoCs
pid Process 1496 timeout.exe 3400 timeout.exe -
Kills process with taskkill 2 IoCs
pid Process 3076 taskkill.exe 3156 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Acre.exe.com Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Acre.exe.com Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Acre.exe.com Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Acre.exe.com Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Acre.exe.com Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 sonia_3.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1176 PING.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 1176 PING.EXE 1176 PING.EXE 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1176 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 800 sonia_4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 624 1744 8 (13).exe 29 PID 1744 wrote to memory of 624 1744 8 (13).exe 29 PID 1744 wrote to memory of 624 1744 8 (13).exe 29 PID 1744 wrote to memory of 624 1744 8 (13).exe 29 PID 1744 wrote to memory of 624 1744 8 (13).exe 29 PID 1744 wrote to memory of 624 1744 8 (13).exe 29 PID 1744 wrote to memory of 624 1744 8 (13).exe 29 PID 624 wrote to memory of 752 624 setup_installer.exe 30 PID 624 wrote to memory of 752 624 setup_installer.exe 30 PID 624 wrote to memory of 752 624 setup_installer.exe 30 PID 624 wrote to memory of 752 624 setup_installer.exe 30 PID 624 wrote to memory of 752 624 setup_installer.exe 30 PID 624 wrote to memory of 752 624 setup_installer.exe 30 PID 624 wrote to memory of 752 624 setup_installer.exe 30 PID 752 wrote to memory of 1160 752 setup_install.exe 32 PID 752 wrote to memory of 1160 752 setup_install.exe 32 PID 752 wrote to memory of 1160 752 setup_install.exe 32 PID 752 wrote to memory of 1160 752 setup_install.exe 32 PID 752 wrote to memory of 1160 752 setup_install.exe 32 PID 752 wrote to memory of 1160 752 setup_install.exe 32 PID 752 wrote to memory of 1160 752 setup_install.exe 32 PID 752 wrote to memory of 1324 752 setup_install.exe 33 PID 752 wrote to memory of 1324 752 setup_install.exe 33 PID 752 wrote to memory of 1324 752 setup_install.exe 33 PID 752 wrote to memory of 1324 752 setup_install.exe 33 PID 752 wrote to memory of 1324 752 setup_install.exe 33 PID 752 wrote to memory of 1324 752 setup_install.exe 33 PID 752 wrote to memory of 1324 752 setup_install.exe 33 PID 752 wrote to memory of 972 752 setup_install.exe 34 PID 752 wrote to memory of 972 752 setup_install.exe 34 PID 752 wrote to memory of 972 752 setup_install.exe 34 PID 752 wrote to memory of 972 752 setup_install.exe 34 PID 752 wrote to memory of 972 752 setup_install.exe 34 PID 752 wrote to memory of 972 752 setup_install.exe 34 PID 752 wrote to memory of 972 752 setup_install.exe 34 PID 752 wrote to memory of 1932 752 setup_install.exe 35 PID 752 wrote to memory of 1932 752 setup_install.exe 35 PID 752 wrote to memory of 1932 752 setup_install.exe 35 PID 752 wrote to memory of 1932 752 setup_install.exe 35 PID 752 wrote to memory of 1932 752 setup_install.exe 35 PID 752 wrote to memory of 1932 752 setup_install.exe 35 PID 752 wrote to memory of 1932 752 setup_install.exe 35 PID 752 wrote to memory of 1344 752 setup_install.exe 36 PID 752 wrote to memory of 1344 752 setup_install.exe 36 PID 752 wrote to memory of 1344 752 setup_install.exe 36 PID 752 wrote to memory of 1344 752 setup_install.exe 36 PID 752 wrote to memory of 1344 752 setup_install.exe 36 PID 752 wrote to memory of 1344 752 setup_install.exe 36 PID 752 wrote to memory of 1344 752 setup_install.exe 36 PID 1160 wrote to memory of 1152 1160 cmd.exe 37 PID 1160 wrote to memory of 1152 1160 cmd.exe 37 PID 1160 wrote to memory of 1152 1160 cmd.exe 37 PID 1160 wrote to memory of 1152 1160 cmd.exe 37 PID 1160 wrote to memory of 1152 1160 cmd.exe 37 PID 1160 wrote to memory of 1152 1160 cmd.exe 37 PID 1160 wrote to memory of 1152 1160 cmd.exe 37 PID 972 wrote to memory of 1968 972 cmd.exe 38 PID 972 wrote to memory of 1968 972 cmd.exe 38 PID 972 wrote to memory of 1968 972 cmd.exe 38 PID 972 wrote to memory of 1968 972 cmd.exe 38 PID 972 wrote to memory of 1968 972 cmd.exe 38 PID 972 wrote to memory of 1968 972 cmd.exe 38 PID 972 wrote to memory of 1968 972 cmd.exe 38 PID 752 wrote to memory of 2044 752 setup_install.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\8 (13).exe"C:\Users\Admin\AppData\Local\Temp\8 (13).exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\7zS072E4D05\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS072E4D05\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\7zS072E4D05\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
PID:1152
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\7zS072E4D05\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\7zS072E4D05\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 9646⤵
- Program crash
PID:2120
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\7zS072E4D05\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:2416
-
-
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"7⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeC:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe8⤵PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeC:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe8⤵PID:2080
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"7⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a8⤵PID:1580
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup 326.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"7⤵PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"7⤵PID:924
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 924 -s 6728⤵
- Program crash
PID:3020
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\7zS072E4D05\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\Documents\XJYhxoOgAoFTaxjYVe31KDnr.exe"C:\Users\Admin\Documents\XJYhxoOgAoFTaxjYVe31KDnr.exe"6⤵
- Executes dropped EXE
PID:336 -
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"7⤵PID:2576
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "7⤵PID:2472
-
-
-
C:\Users\Admin\Documents\iOwpEafnQ4tiJq8gc6FFuUlK.exe"C:\Users\Admin\Documents\iOwpEafnQ4tiJq8gc6FFuUlK.exe"6⤵PID:1516
-
C:\Users\Admin\Documents\iOwpEafnQ4tiJq8gc6FFuUlK.exeC:\Users\Admin\Documents\iOwpEafnQ4tiJq8gc6FFuUlK.exe7⤵PID:3640
-
-
-
C:\Users\Admin\Documents\d5yuykvBUh0zCxrJRRNAkL0l.exe"C:\Users\Admin\Documents\d5yuykvBUh0zCxrJRRNAkL0l.exe"6⤵PID:904
-
-
C:\Users\Admin\Documents\IZql1OuL5zkPY3MQPfizpVRp.exe"C:\Users\Admin\Documents\IZql1OuL5zkPY3MQPfizpVRp.exe"6⤵PID:2072
-
-
C:\Users\Admin\Documents\BOv5XwPJP7XqKEYIPxXe4ydN.exe"C:\Users\Admin\Documents\BOv5XwPJP7XqKEYIPxXe4ydN.exe"6⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:2088
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:1548
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:968
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:2596
-
-
-
C:\Users\Admin\Documents\hmL5328TwEseZsJtFbH1ScrG.exe"C:\Users\Admin\Documents\hmL5328TwEseZsJtFbH1ScrG.exe"6⤵PID:1256
-
C:\Users\Admin\Documents\hmL5328TwEseZsJtFbH1ScrG.exeC:\Users\Admin\Documents\hmL5328TwEseZsJtFbH1ScrG.exe7⤵PID:2700
-
-
-
C:\Users\Admin\Documents\ECW8kNQ8K4dTsdy3HXhjTPnB.exe"C:\Users\Admin\Documents\ECW8kNQ8K4dTsdy3HXhjTPnB.exe"6⤵PID:1900
-
C:\Users\Admin\Documents\ECW8kNQ8K4dTsdy3HXhjTPnB.exeC:\Users\Admin\Documents\ECW8kNQ8K4dTsdy3HXhjTPnB.exe7⤵PID:280
-
-
C:\Users\Admin\Documents\ECW8kNQ8K4dTsdy3HXhjTPnB.exeC:\Users\Admin\Documents\ECW8kNQ8K4dTsdy3HXhjTPnB.exe7⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 9408⤵
- Program crash
PID:2344
-
-
-
-
C:\Users\Admin\Documents\rJiHlSzt9DqfeD8Y42CjEhX8.exe"C:\Users\Admin\Documents\rJiHlSzt9DqfeD8Y42CjEhX8.exe"6⤵PID:880
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp7⤵PID:2316
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:2512
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp9⤵PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comAcre.exe.com k9⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k10⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k12⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k13⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k14⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k15⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k16⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k17⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k18⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k19⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k20⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k21⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k22⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k23⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k24⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k25⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k26⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k27⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k28⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k29⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k30⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k31⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k32⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k33⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k34⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k35⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k36⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k37⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k38⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k39⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k40⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k41⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k42⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k43⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k44⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k45⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k46⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k47⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k48⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k49⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k50⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k51⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k52⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k53⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k54⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k55⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k56⤵
- Loads dropped DLL
- Modifies system certificate store
PID:792 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k57⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k58⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k59⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k60⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k61⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k62⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k63⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k64⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k65⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k66⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k67⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k68⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k69⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k70⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k71⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k72⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k73⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k74⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k75⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k76⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k77⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k78⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k79⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k80⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k81⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k82⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k83⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k84⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k85⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k86⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k87⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k88⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k89⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k90⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k91⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k92⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k93⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k94⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k95⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k96⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k97⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k98⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k99⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k100⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k101⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k102⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k103⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k104⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k105⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k106⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k107⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k108⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k109⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k110⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k111⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k112⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k113⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k114⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k115⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k116⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k117⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k118⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k119⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k120⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k121⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k122⤵PID:3296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-