Analysis
-
max time kernel
150s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 16:52
Behavioral task
behavioral1
Sample
NEAS.f14896eb9bb972cb46b23308faeb76f0.exe
Resource
win7-20231020-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.f14896eb9bb972cb46b23308faeb76f0.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
NEAS.f14896eb9bb972cb46b23308faeb76f0.exe
-
Size
240KB
-
MD5
f14896eb9bb972cb46b23308faeb76f0
-
SHA1
8358683514846e5babc446a8aa4152a0750328aa
-
SHA256
888709df36e7284e5200330a64e1440c28e616c584eafac64ecd6e7e6dd7be74
-
SHA512
68e678190aa7e1b131907489c84f42e85477cb980185af6d24c20461476e2482103add4782e1de5da3eb2c2e2f1a101a89531f9c7e70a272e87ed2b29bfd4425
-
SSDEEP
6144:8ueeY8jgoWEcAJN+SYSUZCb6M3W8DStQUkA1FiHwSD:8ueeY8jTWtycSly8DSUA1YHVD
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nbgljf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dllmoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jdembk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kmdqai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Phkaqqoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jbghpc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anjikoip.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gablgk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cadcfd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anpnmele.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hckjjh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qpibke32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlmhfj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Daolgl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nkboeobh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndjcne32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acbhhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qpibke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ongijo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pijiif32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cakjfcfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dcjfpfnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dapcab32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Efnennjc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oboakhmo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dllmoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Femndhgh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jnmbjnlm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amgekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dfphmp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Abngccbl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dafbhkhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hbpgle32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kmdqai32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmfkin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ibijbc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohdlpa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Odbgbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dafbhkhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jpfnqc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjapfjnb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcpcehko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Amgekh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nneiikqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nkqpcnig.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmnfglcd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlckik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bhdbaihi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cddemi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbqpbbfi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejkndijd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fcnlng32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhjknljl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Okcmingd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hcpcehko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ajjjjghg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doidql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oboakhmo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fhiinbdo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ajlpepbi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Glmqjj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oagbljcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fcbehbim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjlfkj32.exe -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4488-0-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cd2-6.dat family_berbew behavioral2/files/0x0006000000022cd2-8.dat family_berbew behavioral2/memory/1428-7-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0007000000022cd4-14.dat family_berbew behavioral2/files/0x0007000000022cd4-16.dat family_berbew behavioral2/memory/956-15-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0007000000022cd6-22.dat family_berbew behavioral2/files/0x0007000000022cd6-24.dat family_berbew behavioral2/memory/2056-23-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0008000000022cd8-30.dat family_berbew behavioral2/files/0x0008000000022cd8-32.dat family_berbew behavioral2/memory/2316-31-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0008000000022cdb-38.dat family_berbew behavioral2/files/0x0008000000022cdb-39.dat family_berbew behavioral2/memory/1848-40-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cdd-45.dat family_berbew behavioral2/memory/5040-48-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cdd-47.dat family_berbew behavioral2/files/0x0006000000022cdf-53.dat family_berbew behavioral2/files/0x0006000000022cdf-56.dat family_berbew behavioral2/memory/4200-55-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce1-62.dat family_berbew behavioral2/memory/3992-63-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce1-64.dat family_berbew behavioral2/files/0x0006000000022ce3-70.dat family_berbew behavioral2/files/0x0006000000022ce3-71.dat family_berbew behavioral2/memory/336-72-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce5-73.dat family_berbew behavioral2/files/0x0006000000022ce5-78.dat family_berbew behavioral2/memory/4652-79-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce5-80.dat family_berbew behavioral2/files/0x0006000000022ce7-86.dat family_berbew behavioral2/files/0x0006000000022ce7-88.dat family_berbew behavioral2/memory/3812-87-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce9-94.dat family_berbew behavioral2/memory/2468-95-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ce9-96.dat family_berbew behavioral2/files/0x0006000000022ceb-97.dat family_berbew behavioral2/memory/772-103-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ceb-104.dat family_berbew behavioral2/files/0x0006000000022ceb-102.dat family_berbew behavioral2/files/0x0006000000022ced-110.dat family_berbew behavioral2/memory/1260-112-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022ced-111.dat family_berbew behavioral2/files/0x0006000000022cef-118.dat family_berbew behavioral2/memory/1792-120-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cef-119.dat family_berbew behavioral2/files/0x0006000000022cf1-126.dat family_berbew behavioral2/files/0x0006000000022cf1-128.dat family_berbew behavioral2/memory/1752-127-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf4-129.dat family_berbew behavioral2/files/0x0006000000022cf4-134.dat family_berbew behavioral2/files/0x0006000000022cf4-136.dat family_berbew behavioral2/memory/4944-135-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf7-142.dat family_berbew behavioral2/memory/2444-144-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf7-143.dat family_berbew behavioral2/memory/4440-151-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew behavioral2/files/0x0006000000022cf9-150.dat family_berbew behavioral2/files/0x0006000000022cf9-152.dat family_berbew behavioral2/files/0x0006000000022cfb-157.dat family_berbew behavioral2/files/0x0006000000022cfb-159.dat family_berbew behavioral2/memory/116-164-0x0000000000400000-0x0000000000442000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1428 Kjcjmclj.exe 956 Nkboeobh.exe 2056 Ndjcne32.exe 2316 Ohdlpa32.exe 1848 Phkaqqoi.exe 5040 Ajjjjghg.exe 4200 Ahpdcn32.exe 3992 Bjmpfdhb.exe 336 Cnboma32.exe 4652 Ejglcq32.exe 3812 Fhiinbdo.exe 2468 Jbghpc32.exe 772 Lpgalc32.exe 1260 Mbcjimda.exe 1792 Njahki32.exe 1752 Opefdo32.exe 4944 Pmpmnb32.exe 2444 Acbhhf32.exe 4440 Ajlpepbi.exe 116 Anjikoip.exe 4808 Bpmobi32.exe 1020 Cqinng32.exe 2940 Cnahbk32.exe 656 Dmknog32.exe 1208 Ejkndijd.exe 3092 Faqflb32.exe 2568 Glmqjj32.exe 3632 Headon32.exe 1280 Jnmbjnlm.exe 32 Knhbflbp.exe 4780 Nbgljf32.exe 4572 Oioahn32.exe 3736 Oianmm32.exe 1272 Qipjokik.exe 4396 Qpibke32.exe 4760 Amgekh32.exe 4616 Bnphag32.exe 1756 Bgimjmfl.exe 2104 Cgmfel32.exe 4456 Cnndbecl.exe 3096 Dobnpm32.exe 2344 Dodjemee.exe 4640 Doidql32.exe 1844 Enomic32.exe 2160 Ejennd32.exe 2756 Efolidno.exe 2640 Epgpajdp.exe 3728 Fcnlng32.exe 5000 Gablgk32.exe 3000 Gmnfglcd.exe 1204 Hnfehm32.exe 4816 Hoibmmpi.exe 696 Iajkohmj.exe 1876 Ihkila32.exe 4104 Jpfnqc32.exe 3840 Jpmdabfb.exe 2764 Ongijo32.exe 4220 Oagbljcp.exe 4600 Olmficce.exe 324 Pijiif32.exe 456 Qhbcpb32.exe 3244 Qajhigcj.exe 548 Alplfpbp.exe 4804 Abjdbj32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Jiljgjpp.dll Njahki32.exe File created C:\Windows\SysWOW64\Ajcegi32.dll Epgpajdp.exe File created C:\Windows\SysWOW64\Dafbhkhl.exe Dacebkko.exe File created C:\Windows\SysWOW64\Bidpblhd.dll Hmfkin32.exe File created C:\Windows\SysWOW64\Ajlpepbi.exe Acbhhf32.exe File created C:\Windows\SysWOW64\Ejennd32.exe Enomic32.exe File opened for modification C:\Windows\SysWOW64\Fqfeag32.exe Fjlmdmqj.exe File created C:\Windows\SysWOW64\Enfdho32.dll Ddklnh32.exe File created C:\Windows\SysWOW64\Mcmdjgqg.dll Kmdqai32.exe File created C:\Windows\SysWOW64\Jdbnmj32.dll Caimachg.exe File opened for modification C:\Windows\SysWOW64\Dllmoj32.exe Dfphmp32.exe File created C:\Windows\SysWOW64\Ljnjmcie.dll Gjapfjnb.exe File created C:\Windows\SysWOW64\Gfbpfedp.exe Gdcdlb32.exe File created C:\Windows\SysWOW64\Acbhhf32.exe Pmpmnb32.exe File created C:\Windows\SysWOW64\Ebplen32.dll Qajhigcj.exe File opened for modification C:\Windows\SysWOW64\Ndfgfd32.exe Nkncno32.exe File created C:\Windows\SysWOW64\Fnghjd32.dll Lpgalc32.exe File created C:\Windows\SysWOW64\Jkglkc32.dll Gfbpfedp.exe File created C:\Windows\SysWOW64\Mnfhilaa.dll Hbpgle32.exe File created C:\Windows\SysWOW64\Bjmpfdhb.exe Ahpdcn32.exe File opened for modification C:\Windows\SysWOW64\Qipjokik.exe Oianmm32.exe File created C:\Windows\SysWOW64\Dmbbmbea.dll Doidql32.exe File opened for modification C:\Windows\SysWOW64\Fcnlng32.exe Epgpajdp.exe File created C:\Windows\SysWOW64\Biolkc32.exe Appaangd.exe File created C:\Windows\SysWOW64\Hmblee32.dll Ibijbc32.exe File opened for modification C:\Windows\SysWOW64\Denlgq32.exe Dhjknljl.exe File opened for modification C:\Windows\SysWOW64\Liimgh32.exe Lpqioclc.exe File opened for modification C:\Windows\SysWOW64\Knhbflbp.exe Jnmbjnlm.exe File opened for modification C:\Windows\SysWOW64\Dobnpm32.exe Cnndbecl.exe File created C:\Windows\SysWOW64\Ajbegg32.exe Qlmhfj32.exe File opened for modification C:\Windows\SysWOW64\Lpqioclc.exe Kdnincal.exe File created C:\Windows\SysWOW64\Peajhk32.dll Liimgh32.exe File opened for modification C:\Windows\SysWOW64\Dcjfpfnh.exe Cakjfcfe.exe File created C:\Windows\SysWOW64\Fdmkka32.dll Anjikoip.exe File created C:\Windows\SysWOW64\Odiekomi.dll Cqinng32.exe File created C:\Windows\SysWOW64\Enomic32.exe Doidql32.exe File opened for modification C:\Windows\SysWOW64\Dapcab32.exe Dlckik32.exe File created C:\Windows\SysWOW64\Iempingp.exe Ibijbc32.exe File created C:\Windows\SysWOW64\Oianmm32.exe Oioahn32.exe File created C:\Windows\SysWOW64\Jpfnqc32.exe Ihkila32.exe File opened for modification C:\Windows\SysWOW64\Hcidoo32.exe Gjapfjnb.exe File created C:\Windows\SysWOW64\Jdembk32.exe Jiphebml.exe File created C:\Windows\SysWOW64\Bpmobi32.exe Anjikoip.exe File created C:\Windows\SysWOW64\Fbbjeame.dll Chphhn32.exe File created C:\Windows\SysWOW64\Mhgkgdjo.dll Femndhgh.exe File created C:\Windows\SysWOW64\Pkfbalie.dll Gjlfkj32.exe File opened for modification C:\Windows\SysWOW64\Cddemi32.exe Balfko32.exe File created C:\Windows\SysWOW64\Hmfkin32.exe Hbpgle32.exe File opened for modification C:\Windows\SysWOW64\Clnanlhn.exe Caimachg.exe File created C:\Windows\SysWOW64\Fcbehbim.exe Efnennjc.exe File created C:\Windows\SysWOW64\Hbpgle32.exe Hckjjh32.exe File created C:\Windows\SysWOW64\Gggnif32.dll Hcpcehko.exe File created C:\Windows\SysWOW64\Edmleg32.dll Ohdlpa32.exe File opened for modification C:\Windows\SysWOW64\Cakjfcfe.exe Clnanlhn.exe File opened for modification C:\Windows\SysWOW64\Nneiikqe.exe Kmlmlo32.exe File created C:\Windows\SysWOW64\Ipbaobme.dll Oboakhmo.exe File created C:\Windows\SysWOW64\Eamhhjbd.exe Edgkif32.exe File created C:\Windows\SysWOW64\Ndjcne32.exe Nkboeobh.exe File opened for modification C:\Windows\SysWOW64\Ejkndijd.exe Dmknog32.exe File opened for modification C:\Windows\SysWOW64\Faqflb32.exe Ejkndijd.exe File created C:\Windows\SysWOW64\Oioahn32.exe Nbgljf32.exe File created C:\Windows\SysWOW64\Bigfndlc.dll Eamhhjbd.exe File created C:\Windows\SysWOW64\Pojhjc32.dll Okcmingd.exe File opened for modification C:\Windows\SysWOW64\Hnfehm32.exe Gmnfglcd.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 32 5820 WerFault.exe 244 4968 5820 WerFault.exe 244 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iajkohmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Abjdbj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kppphe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node NEAS.f14896eb9bb972cb46b23308faeb76f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kjcjmclj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Doidql32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjkfjhn.dll" Olmficce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfkdkddn.dll" Dlckik32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fqfeag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Odbgbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Anjikoip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfieepcf.dll" Fqfeag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gjapfjnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ddpeigle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gicogo32.dll" Gdcdlb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Albikp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ddklnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmnqdjj.dll" Qpibke32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bonkjk32.dll" Boldcj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Imklncch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oboakhmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blqnfcom.dll" Balfko32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ndfgfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acjnfh32.dll" Bhdbaihi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Amgekh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gcggjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hbanfk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnflceji.dll" Anpnmele.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Balfko32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngpekcgb.dll" Nkncno32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Boknic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkieoo32.dll" Jbqpbbfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kdnincal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hoibmmpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gcojoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alnjhe32.dll" Ahpdcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moccao32.dll" Albikp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkphin32.dll" Jiphebml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ongijo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Imklncch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Boknic32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lpqioclc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bjmpfdhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Anjikoip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Caimachg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmdcif32.dll" Blkdgheg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jbqpbbfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Faqflb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Denlgq32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jiphebml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npjpooea.dll" Jjoeoedo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nneiikqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pojhjc32.dll" Okcmingd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ajlpepbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ejennd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Efnennjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiakgkoe.dll" Fcbehbim.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gdcdlb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Phkaqqoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hcbgen32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nocebkkf.dll" Lgmnqmam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcjcok32.dll" Dmknog32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jbqpbbfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jmfdpkeo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4488 wrote to memory of 1428 4488 NEAS.f14896eb9bb972cb46b23308faeb76f0.exe 90 PID 4488 wrote to memory of 1428 4488 NEAS.f14896eb9bb972cb46b23308faeb76f0.exe 90 PID 4488 wrote to memory of 1428 4488 NEAS.f14896eb9bb972cb46b23308faeb76f0.exe 90 PID 1428 wrote to memory of 956 1428 Kjcjmclj.exe 91 PID 1428 wrote to memory of 956 1428 Kjcjmclj.exe 91 PID 1428 wrote to memory of 956 1428 Kjcjmclj.exe 91 PID 956 wrote to memory of 2056 956 Nkboeobh.exe 92 PID 956 wrote to memory of 2056 956 Nkboeobh.exe 92 PID 956 wrote to memory of 2056 956 Nkboeobh.exe 92 PID 2056 wrote to memory of 2316 2056 Ndjcne32.exe 93 PID 2056 wrote to memory of 2316 2056 Ndjcne32.exe 93 PID 2056 wrote to memory of 2316 2056 Ndjcne32.exe 93 PID 2316 wrote to memory of 1848 2316 Ohdlpa32.exe 94 PID 2316 wrote to memory of 1848 2316 Ohdlpa32.exe 94 PID 2316 wrote to memory of 1848 2316 Ohdlpa32.exe 94 PID 1848 wrote to memory of 5040 1848 Phkaqqoi.exe 95 PID 1848 wrote to memory of 5040 1848 Phkaqqoi.exe 95 PID 1848 wrote to memory of 5040 1848 Phkaqqoi.exe 95 PID 5040 wrote to memory of 4200 5040 Ajjjjghg.exe 96 PID 5040 wrote to memory of 4200 5040 Ajjjjghg.exe 96 PID 5040 wrote to memory of 4200 5040 Ajjjjghg.exe 96 PID 4200 wrote to memory of 3992 4200 Ahpdcn32.exe 97 PID 4200 wrote to memory of 3992 4200 Ahpdcn32.exe 97 PID 4200 wrote to memory of 3992 4200 Ahpdcn32.exe 97 PID 3992 wrote to memory of 336 3992 Bjmpfdhb.exe 98 PID 3992 wrote to memory of 336 3992 Bjmpfdhb.exe 98 PID 3992 wrote to memory of 336 3992 Bjmpfdhb.exe 98 PID 336 wrote to memory of 4652 336 Cnboma32.exe 99 PID 336 wrote to memory of 4652 336 Cnboma32.exe 99 PID 336 wrote to memory of 4652 336 Cnboma32.exe 99 PID 4652 wrote to memory of 3812 4652 Ejglcq32.exe 100 PID 4652 wrote to memory of 3812 4652 Ejglcq32.exe 100 PID 4652 wrote to memory of 3812 4652 Ejglcq32.exe 100 PID 3812 wrote to memory of 2468 3812 Fhiinbdo.exe 101 PID 3812 wrote to memory of 2468 3812 Fhiinbdo.exe 101 PID 3812 wrote to memory of 2468 3812 Fhiinbdo.exe 101 PID 2468 wrote to memory of 772 2468 Jbghpc32.exe 102 PID 2468 wrote to memory of 772 2468 Jbghpc32.exe 102 PID 2468 wrote to memory of 772 2468 Jbghpc32.exe 102 PID 772 wrote to memory of 1260 772 Lpgalc32.exe 103 PID 772 wrote to memory of 1260 772 Lpgalc32.exe 103 PID 772 wrote to memory of 1260 772 Lpgalc32.exe 103 PID 1260 wrote to memory of 1792 1260 Mbcjimda.exe 104 PID 1260 wrote to memory of 1792 1260 Mbcjimda.exe 104 PID 1260 wrote to memory of 1792 1260 Mbcjimda.exe 104 PID 1792 wrote to memory of 1752 1792 Njahki32.exe 106 PID 1792 wrote to memory of 1752 1792 Njahki32.exe 106 PID 1792 wrote to memory of 1752 1792 Njahki32.exe 106 PID 1752 wrote to memory of 4944 1752 Opefdo32.exe 108 PID 1752 wrote to memory of 4944 1752 Opefdo32.exe 108 PID 1752 wrote to memory of 4944 1752 Opefdo32.exe 108 PID 4944 wrote to memory of 2444 4944 Pmpmnb32.exe 109 PID 4944 wrote to memory of 2444 4944 Pmpmnb32.exe 109 PID 4944 wrote to memory of 2444 4944 Pmpmnb32.exe 109 PID 2444 wrote to memory of 4440 2444 Acbhhf32.exe 110 PID 2444 wrote to memory of 4440 2444 Acbhhf32.exe 110 PID 2444 wrote to memory of 4440 2444 Acbhhf32.exe 110 PID 4440 wrote to memory of 116 4440 Ajlpepbi.exe 111 PID 4440 wrote to memory of 116 4440 Ajlpepbi.exe 111 PID 4440 wrote to memory of 116 4440 Ajlpepbi.exe 111 PID 116 wrote to memory of 4808 116 Anjikoip.exe 112 PID 116 wrote to memory of 4808 116 Anjikoip.exe 112 PID 116 wrote to memory of 4808 116 Anjikoip.exe 112 PID 4808 wrote to memory of 1020 4808 Bpmobi32.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f14896eb9bb972cb46b23308faeb76f0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f14896eb9bb972cb46b23308faeb76f0.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\Kjcjmclj.exeC:\Windows\system32\Kjcjmclj.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\Nkboeobh.exeC:\Windows\system32\Nkboeobh.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\Ndjcne32.exeC:\Windows\system32\Ndjcne32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Ohdlpa32.exeC:\Windows\system32\Ohdlpa32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\Phkaqqoi.exeC:\Windows\system32\Phkaqqoi.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\Ajjjjghg.exeC:\Windows\system32\Ajjjjghg.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\Ahpdcn32.exeC:\Windows\system32\Ahpdcn32.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\Bjmpfdhb.exeC:\Windows\system32\Bjmpfdhb.exe9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\Cnboma32.exeC:\Windows\system32\Cnboma32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\Ejglcq32.exeC:\Windows\system32\Ejglcq32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\Fhiinbdo.exeC:\Windows\system32\Fhiinbdo.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\Jbghpc32.exeC:\Windows\system32\Jbghpc32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\Lpgalc32.exeC:\Windows\system32\Lpgalc32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\Mbcjimda.exeC:\Windows\system32\Mbcjimda.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\Njahki32.exeC:\Windows\system32\Njahki32.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\Opefdo32.exeC:\Windows\system32\Opefdo32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\Pmpmnb32.exeC:\Windows\system32\Pmpmnb32.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\Acbhhf32.exeC:\Windows\system32\Acbhhf32.exe19⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\Ajlpepbi.exeC:\Windows\system32\Ajlpepbi.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\Anjikoip.exeC:\Windows\system32\Anjikoip.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\Bpmobi32.exeC:\Windows\system32\Bpmobi32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\Cqinng32.exeC:\Windows\system32\Cqinng32.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1020 -
C:\Windows\SysWOW64\Cnahbk32.exeC:\Windows\system32\Cnahbk32.exe24⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\SysWOW64\Dmknog32.exeC:\Windows\system32\Dmknog32.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:656 -
C:\Windows\SysWOW64\Ejkndijd.exeC:\Windows\system32\Ejkndijd.exe26⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1208 -
C:\Windows\SysWOW64\Faqflb32.exeC:\Windows\system32\Faqflb32.exe27⤵
- Executes dropped EXE
- Modifies registry class
PID:3092 -
C:\Windows\SysWOW64\Glmqjj32.exeC:\Windows\system32\Glmqjj32.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Headon32.exeC:\Windows\system32\Headon32.exe29⤵
- Executes dropped EXE
PID:3632 -
C:\Windows\SysWOW64\Jnmbjnlm.exeC:\Windows\system32\Jnmbjnlm.exe30⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:1280 -
C:\Windows\SysWOW64\Knhbflbp.exeC:\Windows\system32\Knhbflbp.exe31⤵
- Executes dropped EXE
PID:32 -
C:\Windows\SysWOW64\Nbgljf32.exeC:\Windows\system32\Nbgljf32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\Oioahn32.exeC:\Windows\system32\Oioahn32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4572 -
C:\Windows\SysWOW64\Oianmm32.exeC:\Windows\system32\Oianmm32.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3736 -
C:\Windows\SysWOW64\Qipjokik.exeC:\Windows\system32\Qipjokik.exe35⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\Qpibke32.exeC:\Windows\system32\Qpibke32.exe36⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4396 -
C:\Windows\SysWOW64\Amgekh32.exeC:\Windows\system32\Amgekh32.exe37⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:4760 -
C:\Windows\SysWOW64\Bnphag32.exeC:\Windows\system32\Bnphag32.exe38⤵
- Executes dropped EXE
PID:4616 -
C:\Windows\SysWOW64\Bgimjmfl.exeC:\Windows\system32\Bgimjmfl.exe39⤵
- Executes dropped EXE
PID:1756 -
C:\Windows\SysWOW64\Cgmfel32.exeC:\Windows\system32\Cgmfel32.exe40⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\Cnndbecl.exeC:\Windows\system32\Cnndbecl.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4456 -
C:\Windows\SysWOW64\Dobnpm32.exeC:\Windows\system32\Dobnpm32.exe42⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\Dodjemee.exeC:\Windows\system32\Dodjemee.exe43⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Doidql32.exeC:\Windows\system32\Doidql32.exe44⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4640 -
C:\Windows\SysWOW64\Enomic32.exeC:\Windows\system32\Enomic32.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1844 -
C:\Windows\SysWOW64\Ejennd32.exeC:\Windows\system32\Ejennd32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:2160 -
C:\Windows\SysWOW64\Efolidno.exeC:\Windows\system32\Efolidno.exe47⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\Epgpajdp.exeC:\Windows\system32\Epgpajdp.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2640 -
C:\Windows\SysWOW64\Fcnlng32.exeC:\Windows\system32\Fcnlng32.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3728 -
C:\Windows\SysWOW64\Gablgk32.exeC:\Windows\system32\Gablgk32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5000 -
C:\Windows\SysWOW64\Gmnfglcd.exeC:\Windows\system32\Gmnfglcd.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:3000 -
C:\Windows\SysWOW64\Hnfehm32.exeC:\Windows\system32\Hnfehm32.exe52⤵
- Executes dropped EXE
PID:1204 -
C:\Windows\SysWOW64\Hoibmmpi.exeC:\Windows\system32\Hoibmmpi.exe53⤵
- Executes dropped EXE
- Modifies registry class
PID:4816 -
C:\Windows\SysWOW64\Iajkohmj.exeC:\Windows\system32\Iajkohmj.exe54⤵
- Executes dropped EXE
- Modifies registry class
PID:696 -
C:\Windows\SysWOW64\Ihkila32.exeC:\Windows\system32\Ihkila32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1876 -
C:\Windows\SysWOW64\Jpfnqc32.exeC:\Windows\system32\Jpfnqc32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4104 -
C:\Windows\SysWOW64\Jpmdabfb.exeC:\Windows\system32\Jpmdabfb.exe57⤵
- Executes dropped EXE
PID:3840 -
C:\Windows\SysWOW64\Ongijo32.exeC:\Windows\system32\Ongijo32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2764 -
C:\Windows\SysWOW64\Oagbljcp.exeC:\Windows\system32\Oagbljcp.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4220 -
C:\Windows\SysWOW64\Olmficce.exeC:\Windows\system32\Olmficce.exe60⤵
- Executes dropped EXE
- Modifies registry class
PID:4600 -
C:\Windows\SysWOW64\Pijiif32.exeC:\Windows\system32\Pijiif32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:324 -
C:\Windows\SysWOW64\Qhbcpb32.exeC:\Windows\system32\Qhbcpb32.exe62⤵
- Executes dropped EXE
PID:456 -
C:\Windows\SysWOW64\Qajhigcj.exeC:\Windows\system32\Qajhigcj.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3244 -
C:\Windows\SysWOW64\Alplfpbp.exeC:\Windows\system32\Alplfpbp.exe64⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\Abjdbj32.exeC:\Windows\system32\Abjdbj32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:4804 -
C:\Windows\SysWOW64\Albikp32.exeC:\Windows\system32\Albikp32.exe66⤵
- Modifies registry class
PID:2272 -
C:\Windows\SysWOW64\Aaoadg32.exeC:\Windows\system32\Aaoadg32.exe67⤵PID:3884
-
C:\Windows\SysWOW64\Appaangd.exeC:\Windows\system32\Appaangd.exe68⤵
- Drops file in System32 directory
PID:3852 -
C:\Windows\SysWOW64\Biolkc32.exeC:\Windows\system32\Biolkc32.exe69⤵PID:992
-
C:\Windows\SysWOW64\Boldcj32.exeC:\Windows\system32\Boldcj32.exe70⤵
- Modifies registry class
PID:2032 -
C:\Windows\SysWOW64\Cadcfd32.exeC:\Windows\system32\Cadcfd32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:924 -
C:\Windows\SysWOW64\Chphhn32.exeC:\Windows\system32\Chphhn32.exe72⤵
- Drops file in System32 directory
PID:1972 -
C:\Windows\SysWOW64\Caimachg.exeC:\Windows\system32\Caimachg.exe73⤵
- Drops file in System32 directory
- Modifies registry class
PID:4488 -
C:\Windows\SysWOW64\Clnanlhn.exeC:\Windows\system32\Clnanlhn.exe74⤵
- Drops file in System32 directory
PID:4360 -
C:\Windows\SysWOW64\Cakjfcfe.exeC:\Windows\system32\Cakjfcfe.exe75⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:452 -
C:\Windows\SysWOW64\Dcjfpfnh.exeC:\Windows\system32\Dcjfpfnh.exe76⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2692 -
C:\Windows\SysWOW64\Dlckik32.exeC:\Windows\system32\Dlckik32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:1848 -
C:\Windows\SysWOW64\Dapcab32.exeC:\Windows\system32\Dapcab32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1464 -
C:\Windows\SysWOW64\Dhjknljl.exeC:\Windows\system32\Dhjknljl.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3412 -
C:\Windows\SysWOW64\Denlgq32.exeC:\Windows\system32\Denlgq32.exe80⤵
- Modifies registry class
PID:4452 -
C:\Windows\SysWOW64\Dfphmp32.exeC:\Windows\system32\Dfphmp32.exe81⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:956 -
C:\Windows\SysWOW64\Dllmoj32.exeC:\Windows\system32\Dllmoj32.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4792 -
C:\Windows\SysWOW64\Efnennjc.exeC:\Windows\system32\Efnennjc.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:4392 -
C:\Windows\SysWOW64\Fcbehbim.exeC:\Windows\system32\Fcbehbim.exe84⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3100 -
C:\Windows\SysWOW64\Fjlmdmqj.exeC:\Windows\system32\Fjlmdmqj.exe85⤵
- Drops file in System32 directory
PID:4080 -
C:\Windows\SysWOW64\Fqfeag32.exeC:\Windows\system32\Fqfeag32.exe86⤵
- Modifies registry class
PID:5040 -
C:\Windows\SysWOW64\Gjlfkj32.exeC:\Windows\system32\Gjlfkj32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3300 -
C:\Windows\SysWOW64\Gcggjp32.exeC:\Windows\system32\Gcggjp32.exe88⤵
- Modifies registry class
PID:336 -
C:\Windows\SysWOW64\Gjapfjnb.exeC:\Windows\system32\Gjapfjnb.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3784 -
C:\Windows\SysWOW64\Hcidoo32.exeC:\Windows\system32\Hcidoo32.exe90⤵PID:4972
-
C:\Windows\SysWOW64\Hbanfk32.exeC:\Windows\system32\Hbanfk32.exe91⤵
- Modifies registry class
PID:2052 -
C:\Windows\SysWOW64\Hpenpp32.exeC:\Windows\system32\Hpenpp32.exe92⤵PID:5148
-
C:\Windows\SysWOW64\Hcbgen32.exeC:\Windows\system32\Hcbgen32.exe93⤵
- Modifies registry class
PID:5192 -
C:\Windows\SysWOW64\Imklncch.exeC:\Windows\system32\Imklncch.exe94⤵
- Modifies registry class
PID:5236 -
C:\Windows\SysWOW64\Imbaobmp.exeC:\Windows\system32\Imbaobmp.exe95⤵PID:5276
-
C:\Windows\SysWOW64\Jiphebml.exeC:\Windows\system32\Jiphebml.exe96⤵
- Drops file in System32 directory
- Modifies registry class
PID:5312 -
C:\Windows\SysWOW64\Jdembk32.exeC:\Windows\system32\Jdembk32.exe97⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5356 -
C:\Windows\SysWOW64\Jjoeoedo.exeC:\Windows\system32\Jjoeoedo.exe98⤵
- Modifies registry class
PID:5404 -
C:\Windows\SysWOW64\Kmlmlo32.exeC:\Windows\system32\Kmlmlo32.exe99⤵
- Drops file in System32 directory
PID:5448 -
C:\Windows\SysWOW64\Nneiikqe.exeC:\Windows\system32\Nneiikqe.exe100⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5492 -
C:\Windows\SysWOW64\Nkncno32.exeC:\Windows\system32\Nkncno32.exe101⤵
- Drops file in System32 directory
- Modifies registry class
PID:5528 -
C:\Windows\SysWOW64\Ndfgfd32.exeC:\Windows\system32\Ndfgfd32.exe102⤵
- Modifies registry class
PID:5572 -
C:\Windows\SysWOW64\Nkqpcnig.exeC:\Windows\system32\Nkqpcnig.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5624 -
C:\Windows\SysWOW64\Okcmingd.exeC:\Windows\system32\Okcmingd.exe104⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5668 -
C:\Windows\SysWOW64\Odkaac32.exeC:\Windows\system32\Odkaac32.exe105⤵PID:5712
-
C:\Windows\SysWOW64\Okeinn32.exeC:\Windows\system32\Okeinn32.exe106⤵PID:5752
-
C:\Windows\SysWOW64\Oboakhmo.exeC:\Windows\system32\Oboakhmo.exe107⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5800 -
C:\Windows\SysWOW64\Odbgbb32.exeC:\Windows\system32\Odbgbb32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5844 -
C:\Windows\SysWOW64\Qlmhfj32.exeC:\Windows\system32\Qlmhfj32.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5884 -
C:\Windows\SysWOW64\Ajbegg32.exeC:\Windows\system32\Ajbegg32.exe110⤵PID:5928
-
C:\Windows\SysWOW64\Acjjpllp.exeC:\Windows\system32\Acjjpllp.exe111⤵PID:5972
-
C:\Windows\SysWOW64\Anpnmele.exeC:\Windows\system32\Anpnmele.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6016 -
C:\Windows\SysWOW64\Abngccbl.exeC:\Windows\system32\Abngccbl.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6092 -
C:\Windows\SysWOW64\Blkdgheg.exeC:\Windows\system32\Blkdgheg.exe114⤵
- Modifies registry class
PID:5128 -
C:\Windows\SysWOW64\Boknic32.exeC:\Windows\system32\Boknic32.exe115⤵
- Modifies registry class
PID:5188 -
C:\Windows\SysWOW64\Bhdbaihi.exeC:\Windows\system32\Bhdbaihi.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3272 -
C:\Windows\SysWOW64\Balfko32.exeC:\Windows\system32\Balfko32.exe117⤵
- Drops file in System32 directory
- Modifies registry class
PID:1684 -
C:\Windows\SysWOW64\Cddemi32.exeC:\Windows\system32\Cddemi32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5396 -
C:\Windows\SysWOW64\Ddklnh32.exeC:\Windows\system32\Ddklnh32.exe119⤵
- Drops file in System32 directory
- Modifies registry class
PID:3812 -
C:\Windows\SysWOW64\Daolgl32.exeC:\Windows\system32\Daolgl32.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1520 -
C:\Windows\SysWOW64\Dkgqpaed.exeC:\Windows\system32\Dkgqpaed.exe121⤵PID:5540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-