Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
79s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 21:31
Behavioral task
behavioral1
Sample
86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe
Resource
win10v2004-20240226-en
General
-
Target
86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe
-
Size
211KB
-
MD5
ef8c645128add1dbd795199c3146b6da
-
SHA1
346b44a6032b798a72b15ae708f6921c48a33426
-
SHA256
86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8
-
SHA512
0449b219883840d2829a7e316605dfbc2c0fc8e05c49401b50ab9e7c534d3c2c8cef07bffaed8d58c12d7a61e15b653e10f71b628c1196c5081143ad9a743ce1
-
SSDEEP
3072:7dEUfKj8BYbDiC1ZTK7sxtLUIGlWzGWhTSAnAoCfP02Fyt8dvi2m9eaJGg3K7mc:7USiZTK408GWhxA/n02RdviveaxK7mc
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/376-0-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x00080000000231f3-6.dat UPX behavioral2/memory/5048-37-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x00090000000231ed-42.dat UPX behavioral2/files/0x00070000000231f8-72.dat UPX behavioral2/files/0x00080000000231f4-108.dat UPX behavioral2/files/0x00070000000231f9-142.dat UPX behavioral2/memory/376-172-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/5048-173-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x00070000000231fa-179.dat UPX behavioral2/files/0x00070000000231fb-214.dat UPX behavioral2/memory/5076-220-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x00070000000231fd-250.dat UPX behavioral2/memory/1620-284-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x00080000000231fe-287.dat UPX behavioral2/files/0x00080000000231fe-286.dat UPX behavioral2/files/0x0007000000023201-321.dat UPX behavioral2/files/0x0008000000023202-356.dat UPX behavioral2/memory/5072-362-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x0008000000023204-392.dat UPX behavioral2/memory/684-394-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000c0000000230fc-428.dat UPX behavioral2/memory/4380-458-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000e000000023101-464.dat UPX behavioral2/memory/4296-466-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000b000000023207-500.dat UPX behavioral2/memory/912-502-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2280-507-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1448-532-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x0007000000023208-538.dat UPX behavioral2/memory/4588-544-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3828-569-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x0007000000023209-575.dat UPX behavioral2/memory/1108-581-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1452-606-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000700000002320a-612.dat UPX behavioral2/memory/684-642-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000700000002320b-648.dat UPX behavioral2/memory/532-654-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4296-679-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/912-712-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4588-745-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2888-778-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4800-784-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3120-812-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1248-845-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1968-878-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1736-884-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4320-912-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3280-918-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4800-950-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4000-979-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/60-1012-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2008-1045-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3280-1078-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/436-1111-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3848-1144-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2880-1185-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/684-1218-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4692-1243-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4476-1276-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4468-1285-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/4244-1342-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2232-1379-0x0000000000400000-0x00000000004A0000-memory.dmp UPX -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemlxvxv.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemkeglt.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemfzgcq.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemrfira.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemghkwq.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemdxkij.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqembmkqf.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemfpqrr.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemtozwb.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemeueod.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemriran.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemgfnif.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemiopgb.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemwqwts.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemdhvhl.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemrtsoa.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemkkets.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemtgpfb.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemminga.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemanmrh.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemutmek.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemotvpl.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemlpspe.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemdaocw.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemaxsyz.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemnhigi.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemzijbz.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemytgpq.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemmtodw.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemyufgl.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemzoizx.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemjdzho.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemjlija.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemjymnf.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemwuqpn.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemisyff.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemlzepv.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemilkaz.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemqusxg.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemjsylu.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemlvcdc.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemqgedb.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemjlont.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemeqgqc.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemtmyyk.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemaozwq.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqempnifa.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqempkyfi.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemppdrx.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemvnurq.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemnptnm.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemucmbd.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemhvuzh.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemxbdqj.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemjghcf.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemljdhe.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemhcknb.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemcmler.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemifqlq.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemtwxor.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemmwcwo.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemtdams.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation Sysqemoyxll.exe -
Executes dropped EXE 64 IoCs
pid Process 5048 Sysqemeisbd.exe 5076 Sysqemujqby.exe 1620 Sysqemzlywo.exe 5072 Sysqemeqfrn.exe 4380 Sysqemptvhm.exe 2280 Sysqemzhxkw.exe 1448 Sysqempxrxo.exe 3828 Sysqemrdyie.exe 1108 Sysqemxbdqj.exe 1452 Sysqemzijbz.exe 684 Sysqemjsylu.exe 532 Sysqemtozwb.exe 4296 Sysqemeueod.exe 912 Sysqemjlija.exe 4588 Sysqemzxjed.exe 2888 Sysqemwnpex.exe 3120 Sysqemtdams.exe 1248 Sysqemrpezi.exe 1968 Sysqemtwkky.exe 1736 Sysqemrbrxi.exe 4320 Sysqemjpjqe.exe 4800 Sysqemuwvnp.exe 4000 Sysqemriran.exe 60 Sysqemjtfgg.exe 2008 Sysqemrczyh.exe 3280 Sysqemrcbet.exe 436 Sysqemgkneu.exe 3848 Sysqemewjrk.exe 2880 Sysqemtxorf.exe 684 Sysqemlpspe.exe 4692 Sysqemwwfsi.exe 4476 Sysqemjymnf.exe 4468 Sysqemeqgqc.exe 4244 Sysqemzdwgp.exe 2232 Sysqemhwvgd.exe 436 Sysqemuykba.exe 4616 Sysqemywibi.exe 4776 Sysqemqotzh.exe 968 Sysqemwuqpn.exe 952 Sysqemoiqzj.exe 3476 Sysqemytgpq.exe 4436 Sysqembdgni.exe 1736 Sysqemgfnif.exe 3280 Sysqemjhrld.exe 3832 Sysqemoyxll.exe 60 Sysqemvnurq.exe 4296 Sysqemoclbn.exe 2032 Sysqemdhvhl.exe 2848 Sysqemdwtzn.exe 4508 Sysqemdaocw.exe 2956 Sysqemlhdic.exe 4924 Sysqemgrilt.exe 2524 Sysqembmnbl.exe 4884 Sysqemtmyyk.exe 5072 Sysqemygsbv.exe 208 Sysqemyztlp.exe 1536 Sysqemweaha.exe 636 Sysqemjghcf.exe 1824 Sysqemdxbfu.exe 4244 Sysqemlxvxv.exe 4336 Sysqemqkqka.exe 912 Sysqemqwclo.exe 4864 Sysqemsguag.exe 3252 Sysqemqomic.exe -
resource yara_rule behavioral2/memory/376-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00080000000231f3-6.dat upx behavioral2/memory/5048-37-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00090000000231ed-42.dat upx behavioral2/files/0x00070000000231f8-72.dat upx behavioral2/files/0x00080000000231f4-108.dat upx behavioral2/files/0x00070000000231f9-142.dat upx behavioral2/memory/376-172-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5048-173-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00070000000231fa-179.dat upx behavioral2/files/0x00070000000231fb-214.dat upx behavioral2/memory/5076-220-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00070000000231fd-250.dat upx behavioral2/memory/1620-284-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x00080000000231fe-287.dat upx behavioral2/files/0x00080000000231fe-286.dat upx behavioral2/files/0x0007000000023201-321.dat upx behavioral2/files/0x0008000000023202-356.dat upx behavioral2/memory/5072-362-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000023204-392.dat upx behavioral2/memory/684-394-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000c0000000230fc-428.dat upx behavioral2/memory/4380-458-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000e000000023101-464.dat upx behavioral2/memory/4296-466-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000b000000023207-500.dat upx behavioral2/memory/912-502-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2280-507-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1448-532-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000023208-538.dat upx behavioral2/memory/4588-544-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3828-569-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000023209-575.dat upx behavioral2/memory/1108-581-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1452-606-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000700000002320a-612.dat upx behavioral2/memory/684-642-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000700000002320b-648.dat upx behavioral2/memory/532-654-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4296-679-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/912-712-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4588-745-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2888-778-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4800-784-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3120-812-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1248-845-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1968-878-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1736-884-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4320-912-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3280-918-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4800-950-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4000-979-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/60-1012-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2008-1045-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3280-1078-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/436-1111-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3848-1144-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2880-1185-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/684-1218-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4692-1243-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4476-1276-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4468-1285-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4244-1342-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2232-1379-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcvvzx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemewjrk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxyddq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaxsyz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkeglt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhnksx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemljdhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlqtgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnptnm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhcknb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeodqm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemmtodw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaommc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemnhigi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtwxor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemokllf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdaocw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaexwd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemcdmen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemgfnif.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvnurq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdxbfu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemisyff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhoulg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzsbrp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqusxg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrczyh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrpezi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjhrld.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemfvuss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemecpqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzhxkw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoyxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemvmtov.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemkiezb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemhvuzh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemotvpl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrcbet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemdwtzn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlxvxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemftrwq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxjepr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemziafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjdzho.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzijbz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjlija.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemoiqzj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemsguag.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqlyae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemrtmsb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemminga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxbdqj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemtxorf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemjymnf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemzdwgp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemilkaz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemxjmsn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemaozwq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqempjnuj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemeueod.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemwwfsi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemqwclo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Sysqemlzepv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 376 wrote to memory of 5048 376 86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe 90 PID 376 wrote to memory of 5048 376 86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe 90 PID 376 wrote to memory of 5048 376 86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe 90 PID 5048 wrote to memory of 5076 5048 Sysqemeisbd.exe 92 PID 5048 wrote to memory of 5076 5048 Sysqemeisbd.exe 92 PID 5048 wrote to memory of 5076 5048 Sysqemeisbd.exe 92 PID 5076 wrote to memory of 1620 5076 Sysqemujqby.exe 93 PID 5076 wrote to memory of 1620 5076 Sysqemujqby.exe 93 PID 5076 wrote to memory of 1620 5076 Sysqemujqby.exe 93 PID 1620 wrote to memory of 5072 1620 Sysqemzlywo.exe 94 PID 1620 wrote to memory of 5072 1620 Sysqemzlywo.exe 94 PID 1620 wrote to memory of 5072 1620 Sysqemzlywo.exe 94 PID 5072 wrote to memory of 4380 5072 Sysqemeqfrn.exe 95 PID 5072 wrote to memory of 4380 5072 Sysqemeqfrn.exe 95 PID 5072 wrote to memory of 4380 5072 Sysqemeqfrn.exe 95 PID 4380 wrote to memory of 2280 4380 Sysqemptvhm.exe 96 PID 4380 wrote to memory of 2280 4380 Sysqemptvhm.exe 96 PID 4380 wrote to memory of 2280 4380 Sysqemptvhm.exe 96 PID 2280 wrote to memory of 1448 2280 Sysqemzhxkw.exe 97 PID 2280 wrote to memory of 1448 2280 Sysqemzhxkw.exe 97 PID 2280 wrote to memory of 1448 2280 Sysqemzhxkw.exe 97 PID 1448 wrote to memory of 3828 1448 Sysqempxrxo.exe 98 PID 1448 wrote to memory of 3828 1448 Sysqempxrxo.exe 98 PID 1448 wrote to memory of 3828 1448 Sysqempxrxo.exe 98 PID 3828 wrote to memory of 1108 3828 Sysqemrdyie.exe 99 PID 3828 wrote to memory of 1108 3828 Sysqemrdyie.exe 99 PID 3828 wrote to memory of 1108 3828 Sysqemrdyie.exe 99 PID 1108 wrote to memory of 1452 1108 Sysqemxbdqj.exe 100 PID 1108 wrote to memory of 1452 1108 Sysqemxbdqj.exe 100 PID 1108 wrote to memory of 1452 1108 Sysqemxbdqj.exe 100 PID 1452 wrote to memory of 684 1452 Sysqemzijbz.exe 101 PID 1452 wrote to memory of 684 1452 Sysqemzijbz.exe 101 PID 1452 wrote to memory of 684 1452 Sysqemzijbz.exe 101 PID 684 wrote to memory of 532 684 Sysqemjsylu.exe 102 PID 684 wrote to memory of 532 684 Sysqemjsylu.exe 102 PID 684 wrote to memory of 532 684 Sysqemjsylu.exe 102 PID 532 wrote to memory of 4296 532 Sysqemtozwb.exe 103 PID 532 wrote to memory of 4296 532 Sysqemtozwb.exe 103 PID 532 wrote to memory of 4296 532 Sysqemtozwb.exe 103 PID 4296 wrote to memory of 912 4296 Sysqemeueod.exe 104 PID 4296 wrote to memory of 912 4296 Sysqemeueod.exe 104 PID 4296 wrote to memory of 912 4296 Sysqemeueod.exe 104 PID 912 wrote to memory of 4588 912 Sysqemjlija.exe 105 PID 912 wrote to memory of 4588 912 Sysqemjlija.exe 105 PID 912 wrote to memory of 4588 912 Sysqemjlija.exe 105 PID 4588 wrote to memory of 2888 4588 Sysqemzxjed.exe 106 PID 4588 wrote to memory of 2888 4588 Sysqemzxjed.exe 106 PID 4588 wrote to memory of 2888 4588 Sysqemzxjed.exe 106 PID 2888 wrote to memory of 3120 2888 Sysqemwnpex.exe 107 PID 2888 wrote to memory of 3120 2888 Sysqemwnpex.exe 107 PID 2888 wrote to memory of 3120 2888 Sysqemwnpex.exe 107 PID 3120 wrote to memory of 1248 3120 Sysqemtdams.exe 108 PID 3120 wrote to memory of 1248 3120 Sysqemtdams.exe 108 PID 3120 wrote to memory of 1248 3120 Sysqemtdams.exe 108 PID 1248 wrote to memory of 1968 1248 Sysqemrpezi.exe 111 PID 1248 wrote to memory of 1968 1248 Sysqemrpezi.exe 111 PID 1248 wrote to memory of 1968 1248 Sysqemrpezi.exe 111 PID 1968 wrote to memory of 1736 1968 Sysqemtwkky.exe 112 PID 1968 wrote to memory of 1736 1968 Sysqemtwkky.exe 112 PID 1968 wrote to memory of 1736 1968 Sysqemtwkky.exe 112 PID 1736 wrote to memory of 4320 1736 Sysqemrbrxi.exe 115 PID 1736 wrote to memory of 4320 1736 Sysqemrbrxi.exe 115 PID 1736 wrote to memory of 4320 1736 Sysqemrbrxi.exe 115 PID 4320 wrote to memory of 4800 4320 Sysqemjpjqe.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe"C:\Users\Admin\AppData\Local\Temp\86e87dfeadae458c3763f21e9069dfac5e2bbf822c99e3896c2fd225edfc3ce8.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeisbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeisbd.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemujqby.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemujqby.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzlywo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzlywo.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeqfrn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeqfrn.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\Sysqemptvhm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemptvhm.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzhxkw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzhxkw.exe"7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\Sysqempxrxo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempxrxo.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrdyie.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrdyie.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxbdqj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxbdqj.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzijbz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzijbz.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjsylu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjsylu.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtozwb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtozwb.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeueod.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeueod.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjlija.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjlija.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzxjed.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzxjed.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwnpex.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwnpex.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtdams.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtdams.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrpezi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrpezi.exe"19⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtwkky.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwkky.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrbrxi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrbrxi.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjpjqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjpjqe.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuwvnp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuwvnp.exe"23⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\Sysqemriran.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemriran.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjtfgg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjtfgg.exe"25⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrczyh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrczyh.exe"26⤵
- Executes dropped EXE
- Modifies registry class
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrcbet.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrcbet.exe"27⤵
- Executes dropped EXE
- Modifies registry class
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgkneu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgkneu.exe"28⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\Sysqemewjrk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemewjrk.exe"29⤵
- Executes dropped EXE
- Modifies registry class
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtxorf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtxorf.exe"30⤵
- Executes dropped EXE
- Modifies registry class
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlpspe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlpspe.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwwfsi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwwfsi.exe"32⤵
- Executes dropped EXE
- Modifies registry class
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjymnf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjymnf.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeqgqc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeqgqc.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzdwgp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzdwgp.exe"35⤵
- Executes dropped EXE
- Modifies registry class
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhwvgd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhwvgd.exe"36⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuykba.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuykba.exe"37⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\Sysqemywibi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemywibi.exe"38⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqotzh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqotzh.exe"39⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwuqpn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwuqpn.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoiqzj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoiqzj.exe"41⤵
- Executes dropped EXE
- Modifies registry class
PID:952 -
C:\Users\Admin\AppData\Local\Temp\Sysqemytgpq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemytgpq.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\Sysqembdgni.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembdgni.exe"43⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgfnif.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgfnif.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjhrld.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjhrld.exe"45⤵
- Executes dropped EXE
- Modifies registry class
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoyxll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoyxll.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvnurq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvnurq.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:60 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoclbn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoclbn.exe"48⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdhvhl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdhvhl.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdwtzn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdwtzn.exe"50⤵
- Executes dropped EXE
- Modifies registry class
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdaocw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdaocw.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlhdic.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlhdic.exe"52⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgrilt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgrilt.exe"53⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\Sysqembmnbl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembmnbl.exe"54⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtmyyk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtmyyk.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\Sysqemygsbv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemygsbv.exe"56⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyztlp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyztlp.exe"57⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\Sysqemweaha.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemweaha.exe"58⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjghcf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjghcf.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdxbfu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdxbfu.exe"60⤵
- Executes dropped EXE
- Modifies registry class
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlxvxv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlxvxv.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqkqka.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqkqka.exe"62⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqwclo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqwclo.exe"63⤵
- Executes dropped EXE
- Modifies registry class
PID:912 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsguag.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsguag.exe"64⤵
- Executes dropped EXE
- Modifies registry class
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqomic.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqomic.exe"65⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiopgb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiopgb.exe"66⤵
- Checks computer location settings
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvmtov.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvmtov.exe"67⤵
- Modifies registry class
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\Sysqemoximo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoximo.exe"68⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\Sysqemljdhe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemljdhe.exe"69⤵
- Checks computer location settings
- Modifies registry class
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaommc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaommc.exe"70⤵
- Modifies registry class
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaszfr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaszfr.exe"71⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\Sysqemisyff.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemisyff.exe"72⤵
- Checks computer location settings
- Modifies registry class
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlzepv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlzepv.exe"73⤵
- Checks computer location settings
- Modifies registry class
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvngsw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvngsw.exe"74⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\Sysqemilkaz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemilkaz.exe"75⤵
- Checks computer location settings
- Modifies registry class
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqejaf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqejaf.exe"76⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxmwbz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxmwbz.exe"77⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlvcdc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlvcdc.exe"78⤵
- Checks computer location settings
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyufgl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyufgl.exe"79⤵
- Checks computer location settings
PID:264 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaexwd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaexwd.exe"80⤵
- Modifies registry class
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiltbb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiltbb.exe"81⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdzcrv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdzcrv.exe"82⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcdmen.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcdmen.exe"83⤵
- Modifies registry class
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkhxxi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkhxxi.exe"84⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxjmsn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxjmsn.exe"85⤵
- Modifies registry class
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqgedb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqgedb.exe"86⤵
- Checks computer location settings
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxyddq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxyddq.exe"87⤵
- Modifies registry class
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfgyvc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfgyvc.exe"88⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\Sysqemaxsyz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaxsyz.exe"89⤵
- Checks computer location settings
- Modifies registry class
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdxkij.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdxkij.exe"90⤵
- Checks computer location settings
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnwwgt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnwwgt.exe"91⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnhigi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnhigi.exe"92⤵
- Checks computer location settings
- Modifies registry class
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlqtgd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlqtgd.exe"93⤵
- Modifies registry class
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaynze.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaynze.exe"94⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcifww.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcifww.exe"95⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\Sysqemanmrh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemanmrh.exe"96⤵
- Checks computer location settings
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnptnm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnptnm.exe"97⤵
- Checks computer location settings
- Modifies registry class
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfthpg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfthpg.exe"98⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqlyae.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqlyae.exe"99⤵
- Modifies registry class
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhoulg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhoulg.exe"100⤵
- Modifies registry class
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxlwye.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxlwye.exe"101⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\Sysqemaozwq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaozwq.exe"102⤵
- Checks computer location settings
- Modifies registry class
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\Sysqemftrwq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemftrwq.exe"103⤵
- Modifies registry class
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemahiul.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemahiul.exe"104⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\Sysqemucmbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemucmbd.exe"105⤵
- Checks computer location settings
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Sysqemppdrx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemppdrx.exe"106⤵
- Checks computer location settings
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcvvzx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcvvzx.exe"107⤵
- Modifies registry class
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxjepr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxjepr.exe"108⤵
- Modifies registry class
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxuqig.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxuqig.exe"109⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhxpxf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhxpxf.exe"110⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\Sysqemifqlq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemifqlq.exe"111⤵
- Checks computer location settings
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrtsoa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtsoa.exe"112⤵
- Checks computer location settings
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkeglt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkeglt.exe"113⤵
- Checks computer location settings
- Modifies registry class
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Sysqempfxze.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempfxze.exe"114⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\Sysqemklgoq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemklgoq.exe"115⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\Sysqempuwjg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempuwjg.exe"116⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\Sysqemclrmp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemclrmp.exe"117⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\Sysqemupimr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemupimr.exe"118⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkiezb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkiezb.exe"119⤵
- Modifies registry class
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\Sysqemzfmhn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzfmhn.exe"120⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\Sysqempjnuj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempjnuj.exe"121⤵
- Modifies registry class
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfzgcq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfzgcq.exe"122⤵
- Checks computer location settings
PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-