Overview
overview
10Static
static
3Setup.exe
windows7-x64
10Setup.exe
windows7-x64
10Setup.exe
windows10-1703-x64
10Setup.exe
windows10-2004-x64
10Setup.exe
windows11-21h2-x64
Chrome.exe
windows10-2004-x64
10Chrome.exe
windows7-x64
10Chrome.exe
windows10-1703-x64
10Chrome.exe
windows10-2004-x64
10Chrome.exe
windows11-21h2-x64
10Setup.exe
windows10-2004-x64
3Setup.exe
windows7-x64
3Setup.exe
windows10-1703-x64
10Setup.exe
windows10-2004-x64
3Setup.exe
windows11-21h2-x64
3Analysis
-
max time kernel
678s -
max time network
1805s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26-04-2024 15:47
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240215-en
windows7-x64
13 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win10-20240404-en
windows10-1703-x64
13 signatures
1800 seconds
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
15 signatures
1800 seconds
Behavioral task
behavioral5
Sample
Setup.exe
Resource
win11-20240419-en
windows11-21h2-x64
13 signatures
1800 seconds
Behavioral task
behavioral6
Sample
Chrome.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral7
Sample
Chrome.exe
Resource
win7-20240419-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral8
Sample
Chrome.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1800 seconds
Behavioral task
behavioral9
Sample
Chrome.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Chrome.exe
Resource
win11-20240419-en
windows11-21h2-x64
10 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Setup.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Setup.exe
Resource
win7-20240215-en
windows7-x64
1 signatures
1800 seconds
Behavioral task
behavioral13
Sample
Setup.exe
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
1800 seconds
Behavioral task
behavioral14
Sample
Setup.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral15
Sample
Setup.exe
Resource
win11-20240412-en
windows11-21h2-x64
1 signatures
1800 seconds
General
-
Target
Setup.exe
-
Size
22.5MB
-
MD5
a4e313952f14d899867d53c80335dce3
-
SHA1
7703d0a9725dea829dd023d9575322ccae81319c
-
SHA256
9e60d8f8d14a520f023015e9b7e1254756a0bbebe294707cd705f5262b2e07b5
-
SHA512
018a2cc0841fd568d2fe3ade35f708dcb06d9ce148a3c085ccdcb70ab51999f7167b57f5c45c665758cfc72371a5bac002425241d3d89639382fc706a325059e
-
SSDEEP
393216:7qwr6Kwzs3OQs5rmJdW96tBbcQR+yu/tKWao+L37GcrKCUcrfuqIC:7qwFwzs+Q6ridk+hcQR+yusk+LLxrKCv
Malware Config
Extracted
Family
nanocore
Version
1.2.2.0
C2
haxorbaba.duckdns.org:1604
Mutex
68d0d384-24c7-4c4a-b00a-25fe172797c1
Attributes
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2016-05-25T14:42:31.650976636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
3994
-
connection_port
1604
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
68d0d384-24c7-4c4a-b00a-25fe172797c1
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
haxorbaba.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 208 Chrome.exe 3848 Chrome.exe 4548 Chrome.exe 164 Chrome.exe 652 Chrome.exe 4400 Chrome.exe 2264 Chrome.exe 4408 Chrome.exe 3360 Chrome.exe 3568 Chrome.exe 1308 Chrome.exe 4236 Chrome.exe 5112 Chrome.exe 2284 Chrome.exe 4220 Chrome.exe 2292 Chrome.exe 2720 Chrome.exe 4164 Chrome.exe 4644 Chrome.exe 2584 Chrome.exe 3316 Chrome.exe 524 Chrome.exe 860 Chrome.exe 4072 Chrome.exe 3160 Chrome.exe 4420 Chrome.exe 4140 Chrome.exe 224 Chrome.exe 356 Chrome.exe 780 Chrome.exe 3700 Chrome.exe 4812 Chrome.exe 2460 Chrome.exe 1988 Chrome.exe 2316 Chrome.exe 2476 Chrome.exe 4376 Chrome.exe 5060 Chrome.exe 1932 Chrome.exe 1832 Chrome.exe 4996 Chrome.exe 2320 Chrome.exe 600 Chrome.exe 748 Chrome.exe 3552 Chrome.exe 3672 Chrome.exe 4648 Chrome.exe 4296 Chrome.exe 708 Chrome.exe 4896 Chrome.exe 4272 Chrome.exe 3320 Chrome.exe 3904 Chrome.exe 200 Chrome.exe 1568 Chrome.exe 1080 Chrome.exe 2108 Chrome.exe 1688 Chrome.exe 2496 Chrome.exe 1404 Chrome.exe 4376 Chrome.exe 4544 Chrome.exe 2056 Chrome.exe 4560 Chrome.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DPI Service = "C:\\Program Files (x86)\\DPI Service\\dpisvc.exe" Chrome.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Chrome.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 208 set thread context of 4548 208 Chrome.exe 79 PID 3848 set thread context of 164 3848 Chrome.exe 78 PID 652 set thread context of 4400 652 Chrome.exe 82 PID 2264 set thread context of 4408 2264 Chrome.exe 86 PID 3360 set thread context of 3568 3360 Chrome.exe 90 PID 1308 set thread context of 4236 1308 Chrome.exe 94 PID 5112 set thread context of 2284 5112 Chrome.exe 101 PID 4220 set thread context of 2292 4220 Chrome.exe 104 PID 2720 set thread context of 4164 2720 Chrome.exe 107 PID 4644 set thread context of 2584 4644 Chrome.exe 110 PID 3316 set thread context of 524 3316 Chrome.exe 113 PID 860 set thread context of 4072 860 Chrome.exe 116 PID 3160 set thread context of 4420 3160 Chrome.exe 120 PID 4140 set thread context of 224 4140 Chrome.exe 123 PID 356 set thread context of 780 356 Chrome.exe 126 PID 3700 set thread context of 4812 3700 Chrome.exe 130 PID 2460 set thread context of 1988 2460 Chrome.exe 133 PID 2316 set thread context of 2476 2316 Chrome.exe 136 PID 4376 set thread context of 5060 4376 Chrome.exe 139 PID 1932 set thread context of 1832 1932 Chrome.exe 143 PID 4996 set thread context of 2320 4996 Chrome.exe 146 PID 600 set thread context of 748 600 Chrome.exe 149 PID 3552 set thread context of 3672 3552 Chrome.exe 152 PID 4648 set thread context of 4296 4648 Chrome.exe 269 PID 708 set thread context of 4896 708 Chrome.exe 159 PID 4272 set thread context of 3320 4272 Chrome.exe 162 PID 3904 set thread context of 200 3904 Chrome.exe 166 PID 1568 set thread context of 1080 1568 Chrome.exe 169 PID 2108 set thread context of 1688 2108 Chrome.exe 173 PID 2496 set thread context of 1404 2496 Chrome.exe 353 PID 4376 set thread context of 4544 4376 Chrome.exe 179 PID 2056 set thread context of 4560 2056 Chrome.exe 183 PID 4912 set thread context of 1360 4912 Chrome.exe 186 PID 424 set thread context of 4488 424 Chrome.exe 189 PID 3316 set thread context of 4644 3316 Chrome.exe 192 PID 344 set thread context of 2996 344 Chrome.exe 196 PID 4112 set thread context of 4824 4112 Chrome.exe 199 PID 4412 set thread context of 2368 4412 Chrome.exe 203 PID 4736 set thread context of 1088 4736 Chrome.exe 206 PID 820 set thread context of 3360 820 Chrome.exe 318 PID 2260 set thread context of 5092 2260 Chrome.exe 213 PID 2256 set thread context of 2668 2256 Chrome.exe 216 PID 3180 set thread context of 440 3180 Chrome.exe 326 PID 2460 set thread context of 536 2460 Chrome.exe 433 PID 4936 set thread context of 2244 4936 Chrome.exe 225 PID 4648 set thread context of 4148 4648 Chrome.exe 452 PID 2248 set thread context of 2800 2248 Chrome.exe 231 PID 1424 set thread context of 4212 1424 Chrome.exe 431 PID 4200 set thread context of 1428 4200 Chrome.exe 237 PID 164 set thread context of 2392 164 Chrome.exe 241 PID 4888 set thread context of 3644 4888 Chrome.exe 244 PID 208 set thread context of 4344 208 Chrome.exe 247 PID 960 set thread context of 2096 960 Chrome.exe 251 PID 2252 set thread context of 3832 2252 Chrome.exe 254 PID 2336 set thread context of 4220 2336 Chrome.exe 257 PID 4032 set thread context of 1716 4032 Chrome.exe 520 PID 2748 set thread context of 3316 2748 Chrome.exe 264 PID 3236 set thread context of 3232 3236 Chrome.exe 267 PID 4296 set thread context of 3848 4296 Chrome.exe 270 PID 5080 set thread context of 1356 5080 Chrome.exe 615 PID 3608 set thread context of 2076 3608 Chrome.exe 453 PID 1720 set thread context of 1108 1720 Chrome.exe 535 PID 3496 set thread context of 4800 3496 Chrome.exe 282 PID 2340 set thread context of 4384 2340 Chrome.exe 543 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DPI Service\dpisvc.exe Chrome.exe File opened for modification C:\Program Files (x86)\DPI Service\dpisvc.exe Chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
pid pid_target Process procid_target 2056 4236 WerFault.exe 94 3548 3568 WerFault.exe 90 5108 4072 WerFault.exe 116 1080 780 WerFault.exe 126 1816 5060 WerFault.exe 139 3368 3672 WerFault.exe 152 4804 3320 WerFault.exe 162 2368 1080 WerFault.exe 169 1308 4544 WerFault.exe 179 3356 4644 WerFault.exe 192 1376 4824 WerFault.exe 199 2136 1088 WerFault.exe 206 4460 1428 WerFault.exe 237 3328 4344 WerFault.exe 247 4224 4220 WerFault.exe 257 4904 2720 WerFault.exe 300 2792 5108 WerFault.exe 304 2104 1988 WerFault.exe 311 2832 524 WerFault.exe 321 208 4408 WerFault.exe 343 4292 2152 WerFault.exe 347 4132 1512 WerFault.exe 363 2104 4628 WerFault.exe 370 2744 4688 WerFault.exe 386 4268 2056 WerFault.exe 399 3120 2832 WerFault.exe 412 1960 3556 WerFault.exe 416 1308 5096 WerFault.exe 420 3476 4272 WerFault.exe 436 1360 1404 WerFault.exe 446 5076 1100 WerFault.exe 468 4388 820 WerFault.exe 481 3140 3972 WerFault.exe 494 600 4216 WerFault.exe 504 2364 2296 WerFault.exe 514 3176 5076 WerFault.exe 527 1308 3684 WerFault.exe 540 1272 3648 WerFault.exe 577 1172 208 WerFault.exe 602 3088 1356 WerFault.exe 615 4520 164 WerFault.exe 622 224 960 WerFault.exe 653 4324 3552 WerFault.exe 660 1936 3424 WerFault.exe 667 4124 4084 WerFault.exe 680 4240 4892 WerFault.exe 684 2248 4708 WerFault.exe 697 516 2096 WerFault.exe 707 2900 4016 WerFault.exe 717 2776 1944 WerFault.exe 727 4532 2884 WerFault.exe 734 2488 1084 WerFault.exe 750 2748 2672 WerFault.exe 754 2564 2392 WerFault.exe 761 4808 4636 WerFault.exe 768 1308 4956 WerFault.exe 781 4684 3476 WerFault.exe 806 2336 3316 WerFault.exe 810 3688 1908 WerFault.exe 814 4912 4616 WerFault.exe 821 704 2312 WerFault.exe 825 1964 1272 WerFault.exe 829 2532 1308 WerFault.exe 833 436 3008 WerFault.exe 852 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3832 schtasks.exe 352 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe 4400 Chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4400 Chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3848 Chrome.exe Token: SeDebugPrivilege 208 Chrome.exe Token: SeDebugPrivilege 652 Chrome.exe Token: SeDebugPrivilege 2264 Chrome.exe Token: SeDebugPrivilege 3360 Chrome.exe Token: SeDebugPrivilege 1308 Chrome.exe Token: SeDebugPrivilege 5112 Chrome.exe Token: SeDebugPrivilege 4400 Chrome.exe Token: SeDebugPrivilege 4220 Chrome.exe Token: SeDebugPrivilege 2720 Chrome.exe Token: SeDebugPrivilege 4644 Chrome.exe Token: SeDebugPrivilege 3316 Chrome.exe Token: SeDebugPrivilege 860 Chrome.exe Token: SeDebugPrivilege 3160 Chrome.exe Token: SeDebugPrivilege 4140 Chrome.exe Token: SeDebugPrivilege 356 Chrome.exe Token: SeDebugPrivilege 3700 Chrome.exe Token: SeDebugPrivilege 2460 Chrome.exe Token: SeDebugPrivilege 2316 Chrome.exe Token: SeDebugPrivilege 4376 Chrome.exe Token: SeDebugPrivilege 1932 Chrome.exe Token: SeDebugPrivilege 4996 Chrome.exe Token: SeDebugPrivilege 600 Chrome.exe Token: SeDebugPrivilege 3552 Chrome.exe Token: SeDebugPrivilege 4648 Chrome.exe Token: SeDebugPrivilege 708 Chrome.exe Token: SeDebugPrivilege 4272 Chrome.exe Token: SeDebugPrivilege 3904 Chrome.exe Token: SeDebugPrivilege 1568 Chrome.exe Token: SeDebugPrivilege 2108 Chrome.exe Token: SeDebugPrivilege 2496 Chrome.exe Token: SeDebugPrivilege 4376 Chrome.exe Token: SeDebugPrivilege 2056 Chrome.exe Token: SeDebugPrivilege 4912 Chrome.exe Token: SeDebugPrivilege 424 Chrome.exe Token: SeDebugPrivilege 3316 Chrome.exe Token: SeDebugPrivilege 344 Chrome.exe Token: SeDebugPrivilege 4112 Chrome.exe Token: SeDebugPrivilege 4412 Chrome.exe Token: SeDebugPrivilege 4736 Chrome.exe Token: SeDebugPrivilege 820 Chrome.exe Token: SeDebugPrivilege 2260 Chrome.exe Token: SeDebugPrivilege 2256 Chrome.exe Token: SeDebugPrivilege 3180 Chrome.exe Token: SeDebugPrivilege 2460 Chrome.exe Token: SeDebugPrivilege 4936 Chrome.exe Token: SeDebugPrivilege 4648 Chrome.exe Token: SeDebugPrivilege 2248 Chrome.exe Token: SeDebugPrivilege 1424 Chrome.exe Token: SeDebugPrivilege 4200 Chrome.exe Token: SeDebugPrivilege 164 Chrome.exe Token: SeDebugPrivilege 4888 Chrome.exe Token: SeDebugPrivilege 208 Chrome.exe Token: SeDebugPrivilege 960 Chrome.exe Token: SeDebugPrivilege 2252 Chrome.exe Token: SeDebugPrivilege 2336 Chrome.exe Token: SeDebugPrivilege 4032 Chrome.exe Token: SeDebugPrivilege 2748 Chrome.exe Token: SeDebugPrivilege 3236 Chrome.exe Token: SeDebugPrivilege 4296 Chrome.exe Token: SeDebugPrivilege 5080 Chrome.exe Token: SeDebugPrivilege 3608 Chrome.exe Token: SeDebugPrivilege 1720 Chrome.exe Token: SeDebugPrivilege 3496 Chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4684 wrote to memory of 3424 4684 Setup.exe 74 PID 4684 wrote to memory of 3424 4684 Setup.exe 74 PID 4684 wrote to memory of 3424 4684 Setup.exe 74 PID 4684 wrote to memory of 208 4684 Setup.exe 75 PID 4684 wrote to memory of 208 4684 Setup.exe 75 PID 4684 wrote to memory of 208 4684 Setup.exe 75 PID 3424 wrote to memory of 1344 3424 Setup.exe 76 PID 3424 wrote to memory of 1344 3424 Setup.exe 76 PID 3424 wrote to memory of 1344 3424 Setup.exe 76 PID 3424 wrote to memory of 3848 3424 Setup.exe 77 PID 3424 wrote to memory of 3848 3424 Setup.exe 77 PID 3424 wrote to memory of 3848 3424 Setup.exe 77 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 3848 wrote to memory of 164 3848 Chrome.exe 78 PID 208 wrote to memory of 4548 208 Chrome.exe 79 PID 1344 wrote to memory of 3644 1344 Setup.exe 80 PID 1344 wrote to memory of 3644 1344 Setup.exe 80 PID 1344 wrote to memory of 3644 1344 Setup.exe 80 PID 1344 wrote to memory of 652 1344 Setup.exe 81 PID 1344 wrote to memory of 652 1344 Setup.exe 81 PID 1344 wrote to memory of 652 1344 Setup.exe 81 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 652 wrote to memory of 4400 652 Chrome.exe 82 PID 3644 wrote to memory of 2260 3644 Setup.exe 83 PID 3644 wrote to memory of 2260 3644 Setup.exe 83 PID 3644 wrote to memory of 2260 3644 Setup.exe 83 PID 3644 wrote to memory of 2264 3644 Setup.exe 84 PID 3644 wrote to memory of 2264 3644 Setup.exe 84 PID 3644 wrote to memory of 2264 3644 Setup.exe 84 PID 4400 wrote to memory of 3832 4400 Chrome.exe 85 PID 4400 wrote to memory of 3832 4400 Chrome.exe 85 PID 4400 wrote to memory of 3832 4400 Chrome.exe 85 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2264 wrote to memory of 4408 2264 Chrome.exe 86 PID 2260 wrote to memory of 684 2260 Setup.exe 88 PID 2260 wrote to memory of 684 2260 Setup.exe 88 PID 2260 wrote to memory of 684 2260 Setup.exe 88 PID 2260 wrote to memory of 3360 2260 Setup.exe 89 PID 2260 wrote to memory of 3360 2260 Setup.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"6⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"7⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"8⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"9⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"10⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"11⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"12⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"13⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"14⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"15⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"16⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"17⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"18⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"19⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"20⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"21⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"22⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"23⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"24⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"25⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"26⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"27⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"28⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"29⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"30⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"31⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"32⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"33⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"34⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"35⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"36⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"37⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"38⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"39⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"40⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"41⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"42⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"43⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"44⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"45⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"46⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"47⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"48⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"49⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"50⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"51⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"52⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"53⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"54⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"55⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"56⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"57⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"58⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"59⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"60⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"61⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"62⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"63⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"64⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"65⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"66⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"67⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"68⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"69⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"70⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"71⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"72⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"73⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"74⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"75⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"76⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"77⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"78⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"79⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"80⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"81⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"82⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"83⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"84⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"85⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"86⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"87⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"88⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"89⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"90⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"91⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"92⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"93⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"94⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"95⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"96⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"97⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"98⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"99⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"100⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"101⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"102⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"103⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"104⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"105⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"106⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"107⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"108⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"109⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"110⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"111⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"112⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"113⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"114⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"115⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"116⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"117⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"118⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"119⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"120⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"121⤵PID:208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-