Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 20:39
Behavioral task
behavioral1
Sample
fdf2a5946a624f7ca114accec788705e.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
fdf2a5946a624f7ca114accec788705e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
fdf2a5946a624f7ca114accec788705e.exe
-
Size
176KB
-
MD5
fdf2a5946a624f7ca114accec788705e
-
SHA1
811a9fc51e63461efd7f78609d74328f0ae21d02
-
SHA256
c0b10cadbdb0b5773dcee574c58e1cbff74f9fe5637a82525401b43f101d2965
-
SHA512
6bf935e0c98e60285e5319063ac7fed67bc2febc852a42727cf96cd9741e41aded51187e7254961c91b5ba4d24f8f2b2dccf9240fbf9035c72b2d66727c1346f
-
SSDEEP
3072:1kmi+jpbS/1Vi8SUjmOiBn3w8BdTj2h33ppaS46HUF2pMXSfN6RnQShl:1Ri+VbyVFXjVu3w8BdTj2V3ppQ60MMCQ
Score
10/10
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkjoqnei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mqpcdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pllieg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akhaipei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ppafpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ldiiio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpfholhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hhbdko32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eckfaj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqbpjmeg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Gahcgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Idonlbff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imknli32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ofalfi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Imeeohoi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejennd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apobakpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jlkfbe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pllieg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lppjnpem.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djmbbk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgdcom32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Koekpi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kifcnjpi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Iajbinaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mmodfqhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onecof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hphfac32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdgckg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oahgnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ddpjjd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pgoigcip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ehklmd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jkhpogij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Npighq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndgpnogo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Djmbbk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lncjgddf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opkfjgmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qfilkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Elnehifk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ofdhlh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppafpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Akdfndpd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmimll32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kknhjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkjoqnei.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnlhme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Akenij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nblfee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ldiiio32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mqpcdn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhopgg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Capkim32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pphlpl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjknakhq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Jkhpogij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mbkmngfn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjakkmpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dhmgfm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kmobii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Imgbdh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhicoi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmokpglb.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/3332-0-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7e4-6.dat family_berbew behavioral2/memory/2004-7-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7e6-14.dat family_berbew behavioral2/memory/4492-20-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7e9-22.dat family_berbew behavioral2/memory/1588-23-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7eb-30.dat family_berbew behavioral2/memory/1876-32-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7ed-38.dat family_berbew behavioral2/memory/3336-40-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000300000001e7ef-46.dat family_berbew behavioral2/memory/368-47-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7f1-54.dat family_berbew behavioral2/memory/3540-55-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7f3-57.dat family_berbew behavioral2/files/0x000200000001e7f3-62.dat family_berbew behavioral2/memory/3748-63-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7f5-70.dat family_berbew behavioral2/memory/4376-71-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7f8-78.dat family_berbew behavioral2/memory/4284-79-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7fa-86.dat family_berbew behavioral2/memory/4288-87-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7fd-90.dat family_berbew behavioral2/memory/3676-95-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7ff-101.dat family_berbew behavioral2/memory/4892-103-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e7ff-104.dat family_berbew behavioral2/files/0x000200000001e802-111.dat family_berbew behavioral2/memory/4852-112-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e807-118.dat family_berbew behavioral2/memory/1936-119-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000200000001e809-126.dat family_berbew behavioral2/memory/4484-128-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000a000000023028-134.dat family_berbew behavioral2/memory/3356-135-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000700000002312c-142.dat family_berbew behavioral2/memory/3492-143-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023135-149.dat family_berbew behavioral2/memory/4432-151-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023137-158.dat family_berbew behavioral2/memory/2504-159-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023139-166.dat family_berbew behavioral2/memory/2092-168-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000600000002313b-174.dat family_berbew behavioral2/memory/1364-175-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000300000001e805-182.dat family_berbew behavioral2/memory/3368-183-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000a000000022480-190.dat family_berbew behavioral2/memory/2592-192-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000600000002313d-198.dat family_berbew behavioral2/memory/4044-200-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x000600000002313f-206.dat family_berbew behavioral2/memory/1580-207-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023141-214.dat family_berbew behavioral2/memory/2280-216-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023143-222.dat family_berbew behavioral2/memory/3628-224-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023145-230.dat family_berbew behavioral2/memory/1632-231-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023147-238.dat family_berbew behavioral2/memory/1448-240-0x0000000000400000-0x000000000043F000-memory.dmp family_berbew behavioral2/files/0x0006000000023149-246.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2004 Fpfholhc.exe 4492 Infqklol.exe 1588 Imknli32.exe 1876 Jjakkmpk.exe 3336 Jnapgjdo.exe 368 Jjknakhq.exe 3540 Kffhakjp.exe 3748 Mdmngm32.exe 4376 Nncoaq32.exe 4284 Nhicoi32.exe 4288 Oolnabal.exe 3676 Pgoigcip.exe 4892 Pdgckg32.exe 4852 Qfilkj32.exe 1936 Akfdcq32.exe 4484 Akhaipei.exe 3356 Bfieagka.exe 3492 Bflagg32.exe 4432 Dhmgfm32.exe 2504 Dpglmjoj.exe 2092 Elgohj32.exe 1364 Eimlgnij.exe 3368 Elnehifk.exe 2592 Gegchl32.exe 4044 Gckcap32.exe 1580 Hphfac32.exe 2280 Hladlc32.exe 3628 Iobmmoed.exe 1632 Ijlkfg32.exe 1448 Ijngkf32.exe 5040 Jqmicpbj.exe 1436 Jginej32.exe 3252 Jjjggede.exe 3240 Kpgoolbl.exe 4344 Kjlcmdbb.exe 3048 Kfeagefd.exe 5016 Lhopgg32.exe 1456 Lplaaiqd.exe 3060 Miipencp.exe 860 Njmejp32.exe 4328 Ndhgie32.exe 1692 Npadcfnl.exe 1760 Odaiodbp.exe 4724 Oahgnh32.exe 4008 Okpkgm32.exe 4876 Ppamjcpj.exe 2312 Paaidf32.exe 2684 Qdihfq32.exe 2824 Akenij32.exe 1260 Ababkdij.exe 2124 Anjpeelk.exe 3532 Bkcjjhgp.exe 3040 Bdphnmjk.exe 380 Cejjdlap.exe 4992 Capkim32.exe 2600 Djmima32.exe 2576 Ehklmd32.exe 4736 Eijigg32.exe 824 Fkehdnee.exe 2344 Gahcgg32.exe 1844 Glbapoqh.exe 3736 Hhlnjpdi.exe 4928 Hohcmjic.exe 1972 Hhbdko32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Ilkohp32.dll Dgieajgj.exe File opened for modification C:\Windows\SysWOW64\Gcgndf32.exe Gmimll32.exe File created C:\Windows\SysWOW64\Mcfqjihp.dll Gmpcmkaa.exe File opened for modification C:\Windows\SysWOW64\Jnapgjdo.exe Jjakkmpk.exe File opened for modification C:\Windows\SysWOW64\Elgohj32.exe Dpglmjoj.exe File created C:\Windows\SysWOW64\Eagnpn32.dll Jlkfbe32.exe File opened for modification C:\Windows\SysWOW64\Mmodfqhf.exe Lbdgmh32.exe File created C:\Windows\SysWOW64\Qmnbej32.exe Qfcjhphd.exe File created C:\Windows\SysWOW64\Geollfdn.dll Koekpi32.exe File created C:\Windows\SysWOW64\Hiaabf32.dll Kpkqbq32.exe File created C:\Windows\SysWOW64\Ababkdij.exe Akenij32.exe File opened for modification C:\Windows\SysWOW64\Nblfee32.exe Nicalpak.exe File created C:\Windows\SysWOW64\Lpdlpnie.dll Dcglfjgf.exe File opened for modification C:\Windows\SysWOW64\Koekpi32.exe Kaajfe32.exe File created C:\Windows\SysWOW64\Olomcacj.dll Lppjnpem.exe File created C:\Windows\SysWOW64\Didhmpdm.dll Infqklol.exe File created C:\Windows\SysWOW64\Pjfioj32.dll Kjlcmdbb.exe File created C:\Windows\SysWOW64\Bldogjib.exe Bgbmdd32.exe File created C:\Windows\SysWOW64\Pabojh32.dll Jkeloa32.exe File created C:\Windows\SysWOW64\Qfcjhphd.exe Pllieg32.exe File created C:\Windows\SysWOW64\Hcjkje32.exe Gmpcmkaa.exe File created C:\Windows\SysWOW64\Likndk32.dll Mdmngm32.exe File opened for modification C:\Windows\SysWOW64\Pgoigcip.exe Oolnabal.exe File opened for modification C:\Windows\SysWOW64\Opiidhoj.exe Ofnhfbjl.exe File created C:\Windows\SysWOW64\Oildaf32.dll Opkfjgmh.exe File opened for modification C:\Windows\SysWOW64\Enlqdc32.exe Dcglfjgf.exe File opened for modification C:\Windows\SysWOW64\Olgnnqpe.exe Ndgpnogo.exe File created C:\Windows\SysWOW64\Hfajlp32.exe Hnpognhd.exe File created C:\Windows\SysWOW64\Kpgoolbl.exe Jjjggede.exe File created C:\Windows\SysWOW64\Bicbje32.dll Lhopgg32.exe File created C:\Windows\SysWOW64\Eciilj32.exe Enlqdc32.exe File opened for modification C:\Windows\SysWOW64\Mdmngm32.exe Kffhakjp.exe File created C:\Windows\SysWOW64\Cklqlb32.dll Pdgckg32.exe File created C:\Windows\SysWOW64\Nblfee32.exe Nicalpak.exe File opened for modification C:\Windows\SysWOW64\Pidjcm32.exe Opkfjgmh.exe File opened for modification C:\Windows\SysWOW64\Pohilc32.exe Pikqcl32.exe File created C:\Windows\SysWOW64\Nhpoieid.dll Ejennd32.exe File created C:\Windows\SysWOW64\Ekdpdkkf.dll Hnpognhd.exe File created C:\Windows\SysWOW64\Akhaipei.exe Akfdcq32.exe File created C:\Windows\SysWOW64\Dpglmjoj.exe Dhmgfm32.exe File created C:\Windows\SysWOW64\Bdphnmjk.exe Bkcjjhgp.exe File created C:\Windows\SysWOW64\Gahcgg32.exe Fkehdnee.exe File created C:\Windows\SysWOW64\Ppblkffp.exe Pidjcm32.exe File created C:\Windows\SysWOW64\Lglopjkg.exe Lncjgddf.exe File created C:\Windows\SysWOW64\Bfdelf32.dll Nhicoi32.exe File created C:\Windows\SysWOW64\Acbhhf32.exe Aneppo32.exe File created C:\Windows\SysWOW64\Bgfpdmho.exe Blqlgdhi.exe File created C:\Windows\SysWOW64\Mjhlnn32.dll Enlqdc32.exe File opened for modification C:\Windows\SysWOW64\Kffhakjp.exe Jjknakhq.exe File opened for modification C:\Windows\SysWOW64\Eimlgnij.exe Elgohj32.exe File created C:\Windows\SysWOW64\Bgicdc32.exe Bldogjib.exe File opened for modification C:\Windows\SysWOW64\Jlkfbe32.exe Idbalhho.exe File created C:\Windows\SysWOW64\Cclflc32.dll Lkhbko32.exe File created C:\Windows\SysWOW64\Npighq32.exe Mmokpglb.exe File opened for modification C:\Windows\SysWOW64\Ccendc32.exe Bgicdc32.exe File created C:\Windows\SysWOW64\Ioclnblj.exe Iajbinaf.exe File opened for modification C:\Windows\SysWOW64\Bpaacblm.exe Bekmei32.exe File created C:\Windows\SysWOW64\Pkdnjmck.dll Kdbchp32.exe File created C:\Windows\SysWOW64\Ppafpm32.exe Omnqhbap.exe File created C:\Windows\SysWOW64\Mikiin32.dll Lkjoqnei.exe File created C:\Windows\SysWOW64\Olgnnqpe.exe Ndgpnogo.exe File created C:\Windows\SysWOW64\Kbfjljhf.exe Kfpjgi32.exe File created C:\Windows\SysWOW64\Ogbifecb.dll Eqpfknbj.exe File created C:\Windows\SysWOW64\Jpgcpo32.dll Imknli32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4740 6396 WerFault.exe 296 -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hchqnhej.dll" Odaiodbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjkpjo32.dll" Okpkgm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiifdfig.dll" Lbdgmh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fccigg32.dll" Peaahmcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gmpcmkaa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jnapgjdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejjjgdba.dll" Jjjggede.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cejjdlap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lmheph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iifmbajf.dll" Lmheph32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bekmei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ipjoee32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnbinagj.dll" Jnapgjdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Jqmicpbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fhchhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kdbchp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Akhaipei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elgohj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 fdf2a5946a624f7ca114accec788705e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Achmpagb.dll" Gegchl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kklkej32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Akhaipei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apmfnbao.dll" Jkhpogij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pcdlghgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epagjcpl.dll" Apobakpn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ikjmcc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpdlpnie.dll" Dcglfjgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhpoieid.dll" Ejennd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Anjpeelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqfkba32.dll" Gahcgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Omfcmm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pefmongg.dll" Cnlhme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elnehifk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dmmdjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Imeeohoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lefngbhd.dll" Acbhhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipomlcnc.dll" Lfnfhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ldiiio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Miipencp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoonpe32.dll" Aphegjhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iajbinaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onecof32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Blchmdff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dqomdppm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aneppo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Glbapoqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fndgfffm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olejcaja.dll" Nnidcg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjhhib32.dll" Idonlbff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Hladlc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bkcjjhgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Npighq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Omnqhbap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Pllieg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bicbje32.dll" Lhopgg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Mmokpglb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Opkfjgmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddhbcl32.dll" Bmlofhca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfpmdman.dll" Jjbjlpga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cofndo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehcfdc32.dll" Eckfaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfcpipdb.dll" Lkcaeige.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ddpjjd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Flmhclod.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 2004 3332 fdf2a5946a624f7ca114accec788705e.exe 95 PID 3332 wrote to memory of 2004 3332 fdf2a5946a624f7ca114accec788705e.exe 95 PID 3332 wrote to memory of 2004 3332 fdf2a5946a624f7ca114accec788705e.exe 95 PID 2004 wrote to memory of 4492 2004 Fpfholhc.exe 96 PID 2004 wrote to memory of 4492 2004 Fpfholhc.exe 96 PID 2004 wrote to memory of 4492 2004 Fpfholhc.exe 96 PID 4492 wrote to memory of 1588 4492 Infqklol.exe 97 PID 4492 wrote to memory of 1588 4492 Infqklol.exe 97 PID 4492 wrote to memory of 1588 4492 Infqklol.exe 97 PID 1588 wrote to memory of 1876 1588 Imknli32.exe 98 PID 1588 wrote to memory of 1876 1588 Imknli32.exe 98 PID 1588 wrote to memory of 1876 1588 Imknli32.exe 98 PID 1876 wrote to memory of 3336 1876 Jjakkmpk.exe 99 PID 1876 wrote to memory of 3336 1876 Jjakkmpk.exe 99 PID 1876 wrote to memory of 3336 1876 Jjakkmpk.exe 99 PID 3336 wrote to memory of 368 3336 Jnapgjdo.exe 100 PID 3336 wrote to memory of 368 3336 Jnapgjdo.exe 100 PID 3336 wrote to memory of 368 3336 Jnapgjdo.exe 100 PID 368 wrote to memory of 3540 368 Jjknakhq.exe 101 PID 368 wrote to memory of 3540 368 Jjknakhq.exe 101 PID 368 wrote to memory of 3540 368 Jjknakhq.exe 101 PID 3540 wrote to memory of 3748 3540 Kffhakjp.exe 102 PID 3540 wrote to memory of 3748 3540 Kffhakjp.exe 102 PID 3540 wrote to memory of 3748 3540 Kffhakjp.exe 102 PID 3748 wrote to memory of 4376 3748 Mdmngm32.exe 103 PID 3748 wrote to memory of 4376 3748 Mdmngm32.exe 103 PID 3748 wrote to memory of 4376 3748 Mdmngm32.exe 103 PID 4376 wrote to memory of 4284 4376 Nncoaq32.exe 104 PID 4376 wrote to memory of 4284 4376 Nncoaq32.exe 104 PID 4376 wrote to memory of 4284 4376 Nncoaq32.exe 104 PID 4284 wrote to memory of 4288 4284 Nhicoi32.exe 105 PID 4284 wrote to memory of 4288 4284 Nhicoi32.exe 105 PID 4284 wrote to memory of 4288 4284 Nhicoi32.exe 105 PID 4288 wrote to memory of 3676 4288 Oolnabal.exe 106 PID 4288 wrote to memory of 3676 4288 Oolnabal.exe 106 PID 4288 wrote to memory of 3676 4288 Oolnabal.exe 106 PID 3676 wrote to memory of 4892 3676 Pgoigcip.exe 107 PID 3676 wrote to memory of 4892 3676 Pgoigcip.exe 107 PID 3676 wrote to memory of 4892 3676 Pgoigcip.exe 107 PID 4892 wrote to memory of 4852 4892 Pdgckg32.exe 108 PID 4892 wrote to memory of 4852 4892 Pdgckg32.exe 108 PID 4892 wrote to memory of 4852 4892 Pdgckg32.exe 108 PID 4852 wrote to memory of 1936 4852 Qfilkj32.exe 109 PID 4852 wrote to memory of 1936 4852 Qfilkj32.exe 109 PID 4852 wrote to memory of 1936 4852 Qfilkj32.exe 109 PID 1936 wrote to memory of 4484 1936 Akfdcq32.exe 110 PID 1936 wrote to memory of 4484 1936 Akfdcq32.exe 110 PID 1936 wrote to memory of 4484 1936 Akfdcq32.exe 110 PID 4484 wrote to memory of 3356 4484 Akhaipei.exe 111 PID 4484 wrote to memory of 3356 4484 Akhaipei.exe 111 PID 4484 wrote to memory of 3356 4484 Akhaipei.exe 111 PID 3356 wrote to memory of 3492 3356 Bfieagka.exe 112 PID 3356 wrote to memory of 3492 3356 Bfieagka.exe 112 PID 3356 wrote to memory of 3492 3356 Bfieagka.exe 112 PID 3492 wrote to memory of 4432 3492 Bflagg32.exe 113 PID 3492 wrote to memory of 4432 3492 Bflagg32.exe 113 PID 3492 wrote to memory of 4432 3492 Bflagg32.exe 113 PID 4432 wrote to memory of 2504 4432 Dhmgfm32.exe 114 PID 4432 wrote to memory of 2504 4432 Dhmgfm32.exe 114 PID 4432 wrote to memory of 2504 4432 Dhmgfm32.exe 114 PID 2504 wrote to memory of 2092 2504 Dpglmjoj.exe 115 PID 2504 wrote to memory of 2092 2504 Dpglmjoj.exe 115 PID 2504 wrote to memory of 2092 2504 Dpglmjoj.exe 115 PID 2092 wrote to memory of 1364 2092 Elgohj32.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdf2a5946a624f7ca114accec788705e.exe"C:\Users\Admin\AppData\Local\Temp\fdf2a5946a624f7ca114accec788705e.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\Fpfholhc.exeC:\Windows\system32\Fpfholhc.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\Infqklol.exeC:\Windows\system32\Infqklol.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Imknli32.exeC:\Windows\system32\Imknli32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\Jjakkmpk.exeC:\Windows\system32\Jjakkmpk.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\Jnapgjdo.exeC:\Windows\system32\Jnapgjdo.exe6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\Jjknakhq.exeC:\Windows\system32\Jjknakhq.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\Kffhakjp.exeC:\Windows\system32\Kffhakjp.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\Mdmngm32.exeC:\Windows\system32\Mdmngm32.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\Nncoaq32.exeC:\Windows\system32\Nncoaq32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\Nhicoi32.exeC:\Windows\system32\Nhicoi32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\Oolnabal.exeC:\Windows\system32\Oolnabal.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\Pgoigcip.exeC:\Windows\system32\Pgoigcip.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\Pdgckg32.exeC:\Windows\system32\Pdgckg32.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\Qfilkj32.exeC:\Windows\system32\Qfilkj32.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\Akfdcq32.exeC:\Windows\system32\Akfdcq32.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\Akhaipei.exeC:\Windows\system32\Akhaipei.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\Bfieagka.exeC:\Windows\system32\Bfieagka.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Bflagg32.exeC:\Windows\system32\Bflagg32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\Dhmgfm32.exeC:\Windows\system32\Dhmgfm32.exe20⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\Dpglmjoj.exeC:\Windows\system32\Dpglmjoj.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\Elgohj32.exeC:\Windows\system32\Elgohj32.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\Eimlgnij.exeC:\Windows\system32\Eimlgnij.exe23⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\SysWOW64\Elnehifk.exeC:\Windows\system32\Elnehifk.exe24⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:3368 -
C:\Windows\SysWOW64\Gegchl32.exeC:\Windows\system32\Gegchl32.exe25⤵
- Executes dropped EXE
- Modifies registry class
PID:2592 -
C:\Windows\SysWOW64\Gckcap32.exeC:\Windows\system32\Gckcap32.exe26⤵
- Executes dropped EXE
PID:4044 -
C:\Windows\SysWOW64\Hphfac32.exeC:\Windows\system32\Hphfac32.exe27⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\Hladlc32.exeC:\Windows\system32\Hladlc32.exe28⤵
- Executes dropped EXE
- Modifies registry class
PID:2280 -
C:\Windows\SysWOW64\Iobmmoed.exeC:\Windows\system32\Iobmmoed.exe29⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\Ijlkfg32.exeC:\Windows\system32\Ijlkfg32.exe30⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\Ijngkf32.exeC:\Windows\system32\Ijngkf32.exe31⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\Jqmicpbj.exeC:\Windows\system32\Jqmicpbj.exe32⤵
- Executes dropped EXE
- Modifies registry class
PID:5040 -
C:\Windows\SysWOW64\Jginej32.exeC:\Windows\system32\Jginej32.exe33⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\Jjjggede.exeC:\Windows\system32\Jjjggede.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3252 -
C:\Windows\SysWOW64\Kpgoolbl.exeC:\Windows\system32\Kpgoolbl.exe35⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\Kjlcmdbb.exeC:\Windows\system32\Kjlcmdbb.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4344 -
C:\Windows\SysWOW64\Kfeagefd.exeC:\Windows\system32\Kfeagefd.exe37⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\Lhopgg32.exeC:\Windows\system32\Lhopgg32.exe38⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5016 -
C:\Windows\SysWOW64\Lplaaiqd.exeC:\Windows\system32\Lplaaiqd.exe39⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\Miipencp.exeC:\Windows\system32\Miipencp.exe40⤵
- Executes dropped EXE
- Modifies registry class
PID:3060 -
C:\Windows\SysWOW64\Njmejp32.exeC:\Windows\system32\Njmejp32.exe41⤵
- Executes dropped EXE
PID:860 -
C:\Windows\SysWOW64\Ndhgie32.exeC:\Windows\system32\Ndhgie32.exe42⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\Npadcfnl.exeC:\Windows\system32\Npadcfnl.exe43⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\Odaiodbp.exeC:\Windows\system32\Odaiodbp.exe44⤵
- Executes dropped EXE
- Modifies registry class
PID:1760 -
C:\Windows\SysWOW64\Oahgnh32.exeC:\Windows\system32\Oahgnh32.exe45⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\Okpkgm32.exeC:\Windows\system32\Okpkgm32.exe46⤵
- Executes dropped EXE
- Modifies registry class
PID:4008 -
C:\Windows\SysWOW64\Ppamjcpj.exeC:\Windows\system32\Ppamjcpj.exe47⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\Paaidf32.exeC:\Windows\system32\Paaidf32.exe48⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\Qdihfq32.exeC:\Windows\system32\Qdihfq32.exe49⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Akenij32.exeC:\Windows\system32\Akenij32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
PID:2824 -
C:\Windows\SysWOW64\Ababkdij.exeC:\Windows\system32\Ababkdij.exe51⤵
- Executes dropped EXE
PID:1260 -
C:\Windows\SysWOW64\Anjpeelk.exeC:\Windows\system32\Anjpeelk.exe52⤵
- Executes dropped EXE
- Modifies registry class
PID:2124 -
C:\Windows\SysWOW64\Bkcjjhgp.exeC:\Windows\system32\Bkcjjhgp.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3532 -
C:\Windows\SysWOW64\Bdphnmjk.exeC:\Windows\system32\Bdphnmjk.exe54⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\Cejjdlap.exeC:\Windows\system32\Cejjdlap.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:380 -
C:\Windows\SysWOW64\Capkim32.exeC:\Windows\system32\Capkim32.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4992 -
C:\Windows\SysWOW64\Djmima32.exeC:\Windows\system32\Djmima32.exe57⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\Ehklmd32.exeC:\Windows\system32\Ehklmd32.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\Eijigg32.exeC:\Windows\system32\Eijigg32.exe59⤵
- Executes dropped EXE
PID:4736 -
C:\Windows\SysWOW64\Fkehdnee.exeC:\Windows\system32\Fkehdnee.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:824 -
C:\Windows\SysWOW64\Gahcgg32.exeC:\Windows\system32\Gahcgg32.exe61⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2344 -
C:\Windows\SysWOW64\Glbapoqh.exeC:\Windows\system32\Glbapoqh.exe62⤵
- Executes dropped EXE
- Modifies registry class
PID:1844 -
C:\Windows\SysWOW64\Hhlnjpdi.exeC:\Windows\system32\Hhlnjpdi.exe63⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\SysWOW64\Hohcmjic.exeC:\Windows\system32\Hohcmjic.exe64⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\SysWOW64\Hhbdko32.exeC:\Windows\system32\Hhbdko32.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\Ikcmmjkb.exeC:\Windows\system32\Ikcmmjkb.exe66⤵PID:640
-
C:\Windows\SysWOW64\Ifphkbep.exeC:\Windows\system32\Ifphkbep.exe67⤵PID:1216
-
C:\Windows\SysWOW64\Jjbjlpga.exeC:\Windows\system32\Jjbjlpga.exe68⤵
- Modifies registry class
PID:2156 -
C:\Windows\SysWOW64\Jkhpogij.exeC:\Windows\system32\Jkhpogij.exe69⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:316 -
C:\Windows\SysWOW64\Kkmijf32.exeC:\Windows\system32\Kkmijf32.exe70⤵PID:3180
-
C:\Windows\SysWOW64\Kmobii32.exeC:\Windows\system32\Kmobii32.exe71⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:348 -
C:\Windows\SysWOW64\Kifcnjpi.exeC:\Windows\system32\Kifcnjpi.exe72⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1464 -
C:\Windows\SysWOW64\Lkiiee32.exeC:\Windows\system32\Lkiiee32.exe73⤵PID:3188
-
C:\Windows\SysWOW64\Lfnmcnjn.exeC:\Windows\system32\Lfnmcnjn.exe74⤵PID:2612
-
C:\Windows\SysWOW64\Lmheph32.exeC:\Windows\system32\Lmheph32.exe75⤵
- Modifies registry class
PID:2160 -
C:\Windows\SysWOW64\Llpofd32.exeC:\Windows\system32\Llpofd32.exe76⤵PID:4732
-
C:\Windows\SysWOW64\Mmokpglb.exeC:\Windows\system32\Mmokpglb.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3272 -
C:\Windows\SysWOW64\Npighq32.exeC:\Windows\system32\Npighq32.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1828 -
C:\Windows\SysWOW64\Niblafgi.exeC:\Windows\system32\Niblafgi.exe79⤵PID:3044
-
C:\Windows\SysWOW64\Ndgpnogo.exeC:\Windows\system32\Ndgpnogo.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:3744 -
C:\Windows\SysWOW64\Olgnnqpe.exeC:\Windows\system32\Olgnnqpe.exe81⤵PID:1948
-
C:\Windows\SysWOW64\Ofmbkipk.exeC:\Windows\system32\Ofmbkipk.exe82⤵PID:1336
-
C:\Windows\SysWOW64\Odqbdnod.exeC:\Windows\system32\Odqbdnod.exe83⤵PID:5160
-
C:\Windows\SysWOW64\Ollgiplp.exeC:\Windows\system32\Ollgiplp.exe84⤵PID:5200
-
C:\Windows\SysWOW64\Ofalfi32.exeC:\Windows\system32\Ofalfi32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5240 -
C:\Windows\SysWOW64\Olndnp32.exeC:\Windows\system32\Olndnp32.exe86⤵PID:5284
-
C:\Windows\SysWOW64\Ofdhlh32.exeC:\Windows\system32\Ofdhlh32.exe87⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5328 -
C:\Windows\SysWOW64\Omnqhbap.exeC:\Windows\system32\Omnqhbap.exe88⤵
- Drops file in System32 directory
- Modifies registry class
PID:5376 -
C:\Windows\SysWOW64\Ppafpm32.exeC:\Windows\system32\Ppafpm32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5424 -
C:\Windows\SysWOW64\Pcdlghgl.exeC:\Windows\system32\Pcdlghgl.exe90⤵
- Modifies registry class
PID:5468 -
C:\Windows\SysWOW64\Pphlpl32.exeC:\Windows\system32\Pphlpl32.exe91⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5524 -
C:\Windows\SysWOW64\Apobakpn.exeC:\Windows\system32\Apobakpn.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5564 -
C:\Windows\SysWOW64\Akdfndpd.exeC:\Windows\system32\Akdfndpd.exe93⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5612 -
C:\Windows\SysWOW64\Acpkbf32.exeC:\Windows\system32\Acpkbf32.exe94⤵PID:5656
-
C:\Windows\SysWOW64\Aneppo32.exeC:\Windows\system32\Aneppo32.exe95⤵
- Drops file in System32 directory
- Modifies registry class
PID:5692 -
C:\Windows\SysWOW64\Acbhhf32.exeC:\Windows\system32\Acbhhf32.exe96⤵
- Modifies registry class
PID:5756 -
C:\Windows\SysWOW64\Aphegjhc.exeC:\Windows\system32\Aphegjhc.exe97⤵
- Modifies registry class
PID:5800 -
C:\Windows\SysWOW64\Bgbmdd32.exeC:\Windows\system32\Bgbmdd32.exe98⤵
- Drops file in System32 directory
PID:5860 -
C:\Windows\SysWOW64\Bldogjib.exeC:\Windows\system32\Bldogjib.exe99⤵
- Drops file in System32 directory
PID:5900 -
C:\Windows\SysWOW64\Bgicdc32.exeC:\Windows\system32\Bgicdc32.exe100⤵
- Drops file in System32 directory
PID:5948 -
C:\Windows\SysWOW64\Ccendc32.exeC:\Windows\system32\Ccendc32.exe101⤵PID:5996
-
C:\Windows\SysWOW64\Ddpjjd32.exeC:\Windows\system32\Ddpjjd32.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6036 -
C:\Windows\SysWOW64\Djmbbk32.exeC:\Windows\system32\Djmbbk32.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6084 -
C:\Windows\SysWOW64\Dgcoaock.exeC:\Windows\system32\Dgcoaock.exe104⤵PID:6128
-
C:\Windows\SysWOW64\Ecoiapdj.exeC:\Windows\system32\Ecoiapdj.exe105⤵PID:5136
-
C:\Windows\SysWOW64\Flmhclod.exeC:\Windows\system32\Flmhclod.exe106⤵
- Modifies registry class
PID:5184 -
C:\Windows\SysWOW64\Fmndkd32.exeC:\Windows\system32\Fmndkd32.exe107⤵PID:3328
-
C:\Windows\SysWOW64\Fhchhm32.exeC:\Windows\system32\Fhchhm32.exe108⤵
- Modifies registry class
PID:5272 -
C:\Windows\SysWOW64\Fndgfffm.exeC:\Windows\system32\Fndgfffm.exe109⤵
- Modifies registry class
PID:5360 -
C:\Windows\SysWOW64\Iajbinaf.exeC:\Windows\system32\Iajbinaf.exe110⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:5436 -
C:\Windows\SysWOW64\Ioclnblj.exeC:\Windows\system32\Ioclnblj.exe111⤵PID:5516
-
C:\Windows\SysWOW64\Idpdfija.exeC:\Windows\system32\Idpdfija.exe112⤵PID:5552
-
C:\Windows\SysWOW64\Ikjmcc32.exeC:\Windows\system32\Ikjmcc32.exe113⤵
- Modifies registry class
PID:5636 -
C:\Windows\SysWOW64\Idbalhho.exeC:\Windows\system32\Idbalhho.exe114⤵
- Drops file in System32 directory
PID:5708 -
C:\Windows\SysWOW64\Jlkfbe32.exeC:\Windows\system32\Jlkfbe32.exe115⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5780 -
C:\Windows\SysWOW64\Jkeloa32.exeC:\Windows\system32\Jkeloa32.exe116⤵
- Drops file in System32 directory
PID:5892 -
C:\Windows\SysWOW64\Klgend32.exeC:\Windows\system32\Klgend32.exe117⤵PID:5944
-
C:\Windows\SysWOW64\Kfpjgi32.exeC:\Windows\system32\Kfpjgi32.exe118⤵
- Drops file in System32 directory
PID:5988 -
C:\Windows\SysWOW64\Kbfjljhf.exeC:\Windows\system32\Kbfjljhf.exe119⤵PID:6072
-
C:\Windows\SysWOW64\Lkhbko32.exeC:\Windows\system32\Lkhbko32.exe120⤵
- Drops file in System32 directory
PID:5124 -
C:\Windows\SysWOW64\Lfnfhg32.exeC:\Windows\system32\Lfnfhg32.exe121⤵
- Modifies registry class
PID:5144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-