Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe
Resource
win10v2004-20240508-en
General
-
Target
30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe
-
Size
576KB
-
MD5
17bffffc0c39d64db313f9c33c93fa20
-
SHA1
c9f2ce080c14b50d164b2d69de09bfe2753cc963
-
SHA256
30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385
-
SHA512
85bd9f47fd40ae7354b34e2df1a18ca033d0080edb79e7b30217213a1e3fb5d59fc3236a324802421528e52788004855f8e337a5d70e46e8ad508deb53c8cbe3
-
SSDEEP
12288:gI/+GyXu1jGG1ws5iETdqvZNemWrsiLk6mqgSgRDO:gvGyXsGG1ws5ipX6
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Jofbag32.exeAfiglkle.exeCpkkjc32.exeJjojofgn.exeCdikkg32.exeDikogf32.exeCiohqa32.exeEddeladm.exeLjmlbfhi.exeNhdocl32.exeCakqgeoi.exeDdiibc32.exeOcohkh32.exeKcopdb32.exeOkgnab32.exeGhcoqh32.exeEjjbbkpj.exeIefamlak.exeLckdanld.exeFfhpbacb.exeGaemjbcg.exeJbefcm32.exeIkkjbe32.exeJdhgnf32.exeHpbdmo32.exeGkgkbipp.exeNdbcpd32.exeIigpli32.exeMonhhk32.exeDnnhbjnk.exeIlnomp32.exeGhkllmoi.exeBfcampgf.exeCedpbd32.exeDhbhmb32.exeCgpjlnhh.exeLfolaang.exeFfkoai32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jofbag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Afiglkle.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpkkjc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jjojofgn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdikkg32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dikogf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ciohqa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Eddeladm.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ljmlbfhi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhdocl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cakqgeoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ddiibc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ocohkh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kcopdb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Okgnab32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghcoqh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ejjbbkpj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iefamlak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lckdanld.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ffhpbacb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gaemjbcg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbefcm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ikkjbe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jdhgnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hpbdmo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkgkbipp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ndbcpd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iigpli32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Monhhk32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dnnhbjnk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilnomp32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ghkllmoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bfcampgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cedpbd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dhbhmb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgpjlnhh.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfolaang.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ffkoai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -
Executes dropped EXE 64 IoCs
Processes:
Ocajbekl.exePipopl32.exePmnhfjmg.exePlcdgfbo.exePelipl32.exeQbbfopeg.exeAdeplhib.exeAhchbf32.exeApomfh32.exeAmejeljk.exeAljgfioc.exeBokphdld.exeBommnc32.exeBjijdadm.exeCpeofk32.exeCgpgce32.exeCbkeib32.exeCjbmjplb.exeCopfbfjj.exeClcflkic.exeDbpodagk.exeDdokpmfo.exeDgmglh32.exeDhmcfkme.exeDbehoa32.exeDcfdgiid.exeDgaqgh32.exeDgdmmgpj.exeDjbiicon.exeDgfjbgmh.exeDfijnd32.exeEqonkmdh.exeEjgcdb32.exeEfncicpm.exeEilpeooq.exeEpfhbign.exeEiomkn32.exeEpieghdk.exeEeempocb.exeEalnephf.exeFckjalhj.exeFcmgfkeg.exeFfkcbgek.exeFpdhklkl.exeFdoclk32.exeFjilieka.exeFacdeo32.exeFfpmnf32.exeFioija32.exeFphafl32.exeFeeiob32.exeFmlapp32.exeGonnhhln.exeGhfbqn32.exeGpmjak32.exeGejcjbah.exeGkgkbipp.exeGbnccfpb.exeGhkllmoi.exeGoddhg32.exeGeolea32.exeGogangdc.exeGaemjbcg.exeGhoegl32.exepid process 2968 Ocajbekl.exe 2536 Pipopl32.exe 2668 Pmnhfjmg.exe 2556 Plcdgfbo.exe 2476 Pelipl32.exe 2340 Qbbfopeg.exe 2912 Adeplhib.exe 836 Ahchbf32.exe 1528 Apomfh32.exe 988 Amejeljk.exe 1396 Aljgfioc.exe 2036 Bokphdld.exe 2900 Bommnc32.exe 1972 Bjijdadm.exe 764 Cpeofk32.exe 2740 Cgpgce32.exe 2400 Cbkeib32.exe 1884 Cjbmjplb.exe 2828 Copfbfjj.exe 1408 Clcflkic.exe 1788 Dbpodagk.exe 3068 Ddokpmfo.exe 2988 Dgmglh32.exe 3044 Dhmcfkme.exe 2348 Dbehoa32.exe 348 Dcfdgiid.exe 2172 Dgaqgh32.exe 2768 Dgdmmgpj.exe 2572 Djbiicon.exe 3012 Dgfjbgmh.exe 2460 Dfijnd32.exe 2444 Eqonkmdh.exe 2896 Ejgcdb32.exe 840 Efncicpm.exe 2420 Eilpeooq.exe 2728 Epfhbign.exe 1540 Eiomkn32.exe 1020 Epieghdk.exe 2072 Eeempocb.exe 2860 Ealnephf.exe 2228 Fckjalhj.exe 1944 Fcmgfkeg.exe 1652 Ffkcbgek.exe 692 Fpdhklkl.exe 1712 Fdoclk32.exe 2124 Fjilieka.exe 2264 Facdeo32.exe 848 Ffpmnf32.exe 2932 Fioija32.exe 1924 Fphafl32.exe 880 Feeiob32.exe 1468 Fmlapp32.exe 1596 Gonnhhln.exe 2648 Ghfbqn32.exe 2688 Gpmjak32.exe 2700 Gejcjbah.exe 2448 Gkgkbipp.exe 2888 Gbnccfpb.exe 612 Ghkllmoi.exe 1768 Goddhg32.exe 1508 Geolea32.exe 756 Gogangdc.exe 1680 Gaemjbcg.exe 2216 Ghoegl32.exe -
Loads dropped DLL 64 IoCs
Processes:
30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exeOcajbekl.exePipopl32.exePmnhfjmg.exePlcdgfbo.exePelipl32.exeQbbfopeg.exeAdeplhib.exeAhchbf32.exeApomfh32.exeAmejeljk.exeAljgfioc.exeBokphdld.exeBommnc32.exeBjijdadm.exeCpeofk32.exeCgpgce32.exeCbkeib32.exeCjbmjplb.exeCopfbfjj.exeClcflkic.exeDbpodagk.exeDdokpmfo.exeDgmglh32.exeDhmcfkme.exeDbehoa32.exeDcfdgiid.exeDgaqgh32.exeDgdmmgpj.exeDjbiicon.exeDgfjbgmh.exeDfijnd32.exepid process 1872 30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe 1872 30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe 2968 Ocajbekl.exe 2968 Ocajbekl.exe 2536 Pipopl32.exe 2536 Pipopl32.exe 2668 Pmnhfjmg.exe 2668 Pmnhfjmg.exe 2556 Plcdgfbo.exe 2556 Plcdgfbo.exe 2476 Pelipl32.exe 2476 Pelipl32.exe 2340 Qbbfopeg.exe 2340 Qbbfopeg.exe 2912 Adeplhib.exe 2912 Adeplhib.exe 836 Ahchbf32.exe 836 Ahchbf32.exe 1528 Apomfh32.exe 1528 Apomfh32.exe 988 Amejeljk.exe 988 Amejeljk.exe 1396 Aljgfioc.exe 1396 Aljgfioc.exe 2036 Bokphdld.exe 2036 Bokphdld.exe 2900 Bommnc32.exe 2900 Bommnc32.exe 1972 Bjijdadm.exe 1972 Bjijdadm.exe 764 Cpeofk32.exe 764 Cpeofk32.exe 2740 Cgpgce32.exe 2740 Cgpgce32.exe 2400 Cbkeib32.exe 2400 Cbkeib32.exe 1884 Cjbmjplb.exe 1884 Cjbmjplb.exe 2828 Copfbfjj.exe 2828 Copfbfjj.exe 1408 Clcflkic.exe 1408 Clcflkic.exe 1788 Dbpodagk.exe 1788 Dbpodagk.exe 3068 Ddokpmfo.exe 3068 Ddokpmfo.exe 2988 Dgmglh32.exe 2988 Dgmglh32.exe 3044 Dhmcfkme.exe 3044 Dhmcfkme.exe 2348 Dbehoa32.exe 2348 Dbehoa32.exe 348 Dcfdgiid.exe 348 Dcfdgiid.exe 2172 Dgaqgh32.exe 2172 Dgaqgh32.exe 2768 Dgdmmgpj.exe 2768 Dgdmmgpj.exe 2572 Djbiicon.exe 2572 Djbiicon.exe 3012 Dgfjbgmh.exe 3012 Dgfjbgmh.exe 2460 Dfijnd32.exe 2460 Dfijnd32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bidjnkdg.exeBppoqeja.exeHhcmhdke.exeIoohokoo.exeFdoclk32.exeBlbfjg32.exeBbgnak32.exeOaaifdhb.exeEoompl32.exeFnfcel32.exePlcdgfbo.exeNcbplk32.exeCbgjqo32.exeHedocp32.exeKfkpknkq.exeCbkeib32.exeOkgnab32.exeFqlicclo.exeNlfmbibo.exeJfliim32.exeFphafl32.exeFacdeo32.exeOcohkh32.exeElldgehk.exeLdbofgme.exeGjfdhbld.exeOgqaehak.exeFfnbaojm.exeNenobfak.exeMikhgqbi.exeChqoipkk.exeFncdgcqm.exeCgpjlnhh.exeOionacqo.exeHpjeialg.exeBnihdemo.exeKdmgclfk.exeNblpfepo.exeJbpdeogo.exeFdkklp32.exeAhgnke32.exeDgfjbgmh.exeIcbimi32.exeMgljbm32.exeBlpjegfm.exeNpagjpcd.exeBonoflae.exeIigpli32.exeGhoegl32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Blbfjg32.exe Bidjnkdg.exe File opened for modification C:\Windows\SysWOW64\Baakhm32.exe Bppoqeja.exe File created C:\Windows\SysWOW64\Infaph32.dll Hhcmhdke.exe File opened for modification C:\Windows\SysWOW64\Inojhc32.exe File created C:\Windows\SysWOW64\Ejebfdmb.dll Ioohokoo.exe File opened for modification C:\Windows\SysWOW64\Fjilieka.exe Fdoclk32.exe File created C:\Windows\SysWOW64\Bghjhp32.exe Blbfjg32.exe File created C:\Windows\SysWOW64\Biafnecn.exe Bbgnak32.exe File created C:\Windows\SysWOW64\Olgmcmgh.exe Oaaifdhb.exe File opened for modification C:\Windows\SysWOW64\Eamilh32.exe Eoompl32.exe File created C:\Windows\SysWOW64\Fdpkbf32.exe Fnfcel32.exe File opened for modification C:\Windows\SysWOW64\Pafdjmkq.exe File opened for modification C:\Windows\SysWOW64\Pelipl32.exe Plcdgfbo.exe File created C:\Windows\SysWOW64\Nilhhdga.exe Ncbplk32.exe File opened for modification C:\Windows\SysWOW64\Cmlong32.exe Cbgjqo32.exe File opened for modification C:\Windows\SysWOW64\Hkaglf32.exe Hedocp32.exe File created C:\Windows\SysWOW64\Kgaebl32.dll Kfkpknkq.exe File opened for modification C:\Windows\SysWOW64\Ojglhm32.exe File created C:\Windows\SysWOW64\Cjbmjplb.exe Cbkeib32.exe File created C:\Windows\SysWOW64\Hgggfhdc.dll Okgnab32.exe File created C:\Windows\SysWOW64\Ffibkj32.exe Fqlicclo.exe File opened for modification C:\Windows\SysWOW64\Ndmecgba.exe Nlfmbibo.exe File opened for modification C:\Windows\SysWOW64\Jikeeh32.exe Jfliim32.exe File created C:\Windows\SysWOW64\Gjljfn32.dll File created C:\Windows\SysWOW64\Feeiob32.exe Fphafl32.exe File opened for modification C:\Windows\SysWOW64\Ffpmnf32.exe Facdeo32.exe File opened for modification C:\Windows\SysWOW64\Oaaifdhb.exe Ocohkh32.exe File opened for modification C:\Windows\SysWOW64\Edclib32.exe Elldgehk.exe File created C:\Windows\SysWOW64\Lohccp32.exe Ldbofgme.exe File created C:\Windows\SysWOW64\Ngemkm32.dll Gjfdhbld.exe File created C:\Windows\SysWOW64\Fagigd32.dll Ogqaehak.exe File created C:\Windows\SysWOW64\Kpafapbk.exe File created C:\Windows\SysWOW64\Fknodfcm.dll File created C:\Windows\SysWOW64\Nfocik32.dll Ffnbaojm.exe File opened for modification C:\Windows\SysWOW64\Nhllob32.exe Nenobfak.exe File created C:\Windows\SysWOW64\Mpdqdkie.exe Mikhgqbi.exe File created C:\Windows\SysWOW64\Caidaeak.exe Chqoipkk.exe File created C:\Windows\SysWOW64\Alnalh32.exe File opened for modification C:\Windows\SysWOW64\Dcbnpgkh.exe File opened for modification C:\Windows\SysWOW64\Ffklhqao.exe Fncdgcqm.exe File created C:\Windows\SysWOW64\Cinfhigl.exe Cgpjlnhh.exe File created C:\Windows\SysWOW64\Odebolpe.exe Oionacqo.exe File opened for modification C:\Windows\SysWOW64\Hibjbgbh.exe Hpjeialg.exe File opened for modification C:\Windows\SysWOW64\Becpap32.exe Bnihdemo.exe File created C:\Windows\SysWOW64\Ppjllffc.dll File created C:\Windows\SysWOW64\Mphaobfe.dll File created C:\Windows\SysWOW64\Dhhdho32.dll Kdmgclfk.exe File opened for modification C:\Windows\SysWOW64\Nhiholof.exe Nblpfepo.exe File created C:\Windows\SysWOW64\Medgge32.dll Elldgehk.exe File created C:\Windows\SysWOW64\Nhjpke32.dll Jbpdeogo.exe File created C:\Windows\SysWOW64\Fgigil32.exe Fdkklp32.exe File created C:\Windows\SysWOW64\Incjbkig.dll File opened for modification C:\Windows\SysWOW64\Aaobdjof.exe Ahgnke32.exe File created C:\Windows\SysWOW64\Jnokbe32.dll File opened for modification C:\Windows\SysWOW64\Dfijnd32.exe Dgfjbgmh.exe File created C:\Windows\SysWOW64\Pqiqnfej.dll Icbimi32.exe File created C:\Windows\SysWOW64\Ohkgmi32.dll Mgljbm32.exe File created C:\Windows\SysWOW64\Agjiphda.dll Blpjegfm.exe File created C:\Windows\SysWOW64\Mehjml32.dll Npagjpcd.exe File created C:\Windows\SysWOW64\Balkchpi.exe Bonoflae.exe File created C:\Windows\SysWOW64\Fmqgqj32.dll Iigpli32.exe File opened for modification C:\Windows\SysWOW64\Hiqoeplo.exe File created C:\Windows\SysWOW64\Jalcdhla.dll File opened for modification C:\Windows\SysWOW64\Hmlnoc32.exe Ghoegl32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 6404 2864 -
Modifies registry class 64 IoCs
Processes:
Mhhfdo32.exeMgmahg32.exeOidiekdn.exeQpecfc32.exeOeehln32.exePcnbablo.exeDpkibo32.exeIfampo32.exeEdfbaabj.exeNhiffc32.exeKkolkk32.exeDhmcfkme.exeKemejc32.exeAnccmo32.exeMikhgqbi.exeLkakicam.exeBkmhnjlh.exeBckjhl32.exeGkgkbipp.exeJkbcln32.exeFncpef32.exeKebgia32.exeEfjlgmlf.exeKjnfniii.exeEndhhp32.exeLpekon32.exeJnfomn32.exeEiomkn32.exeAobnniji.exeGinnnooi.exeHnbopmnm.exeGbnccfpb.exeCldooj32.exeCblfdg32.exeJjmpbopd.exeHdqbekcm.exeCgpjlnhh.exeJicgpb32.exeGbdhjm32.exeKfbfkmeh.exeHibjbgbh.exeQogbdl32.exeBepjha32.exeGoplilpf.exeFjjpjgjj.exeHaiccald.exeAajbne32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mhhfdo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mgmahg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oidiekdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmfaflol.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Qpecfc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlbhgd32.dll" Oeehln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djihnh32.dll" Pcnbablo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dpkibo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjghm32.dll" Ifampo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Edfbaabj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nhiffc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kkolkk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dhmcfkme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cqljpedj.dll" Kemejc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oglegn32.dll" Anccmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Mikhgqbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jppgpfpi.dll" Lkakicam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bkmhnjlh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckbjaopk.dll" Bckjhl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gkgkbipp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikbkhq32.dll" Jkbcln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfnnbf32.dll" Fncpef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqalfl32.dll" Kebgia32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Efjlgmlf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bqiibc32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chpmbe32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kjnfniii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Endhhp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djmffb32.dll" Lpekon32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jnfomn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahfalc32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Canhhi32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpdhmlbj.dll" Eiomkn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmlnjo32.dll" Aobnniji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ginnnooi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hnbopmnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gbnccfpb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cldooj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cblfdg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafqii32.dll" Oidiekdn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jjmpbopd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hdqbekcm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cgpjlnhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jicgpb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Gbdhjm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elooehob.dll" Kfbfkmeh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Hibjbgbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qogbdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bepjha32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apoldh32.dll" Goplilpf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fjjpjgjj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Haiccald.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aajbne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elnpioai.dll" -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exeOcajbekl.exePipopl32.exePmnhfjmg.exePlcdgfbo.exePelipl32.exeQbbfopeg.exeAdeplhib.exeAhchbf32.exeApomfh32.exeAmejeljk.exeAljgfioc.exeBokphdld.exeBommnc32.exeBjijdadm.exeCpeofk32.exedescription pid process target process PID 1872 wrote to memory of 2968 1872 30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe Ocajbekl.exe PID 1872 wrote to memory of 2968 1872 30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe Ocajbekl.exe PID 1872 wrote to memory of 2968 1872 30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe Ocajbekl.exe PID 1872 wrote to memory of 2968 1872 30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe Ocajbekl.exe PID 2968 wrote to memory of 2536 2968 Ocajbekl.exe Pipopl32.exe PID 2968 wrote to memory of 2536 2968 Ocajbekl.exe Pipopl32.exe PID 2968 wrote to memory of 2536 2968 Ocajbekl.exe Pipopl32.exe PID 2968 wrote to memory of 2536 2968 Ocajbekl.exe Pipopl32.exe PID 2536 wrote to memory of 2668 2536 Pipopl32.exe Pmnhfjmg.exe PID 2536 wrote to memory of 2668 2536 Pipopl32.exe Pmnhfjmg.exe PID 2536 wrote to memory of 2668 2536 Pipopl32.exe Pmnhfjmg.exe PID 2536 wrote to memory of 2668 2536 Pipopl32.exe Pmnhfjmg.exe PID 2668 wrote to memory of 2556 2668 Pmnhfjmg.exe Plcdgfbo.exe PID 2668 wrote to memory of 2556 2668 Pmnhfjmg.exe Plcdgfbo.exe PID 2668 wrote to memory of 2556 2668 Pmnhfjmg.exe Plcdgfbo.exe PID 2668 wrote to memory of 2556 2668 Pmnhfjmg.exe Plcdgfbo.exe PID 2556 wrote to memory of 2476 2556 Plcdgfbo.exe Pelipl32.exe PID 2556 wrote to memory of 2476 2556 Plcdgfbo.exe Pelipl32.exe PID 2556 wrote to memory of 2476 2556 Plcdgfbo.exe Pelipl32.exe PID 2556 wrote to memory of 2476 2556 Plcdgfbo.exe Pelipl32.exe PID 2476 wrote to memory of 2340 2476 Pelipl32.exe Qbbfopeg.exe PID 2476 wrote to memory of 2340 2476 Pelipl32.exe Qbbfopeg.exe PID 2476 wrote to memory of 2340 2476 Pelipl32.exe Qbbfopeg.exe PID 2476 wrote to memory of 2340 2476 Pelipl32.exe Qbbfopeg.exe PID 2340 wrote to memory of 2912 2340 Qbbfopeg.exe Adeplhib.exe PID 2340 wrote to memory of 2912 2340 Qbbfopeg.exe Adeplhib.exe PID 2340 wrote to memory of 2912 2340 Qbbfopeg.exe Adeplhib.exe PID 2340 wrote to memory of 2912 2340 Qbbfopeg.exe Adeplhib.exe PID 2912 wrote to memory of 836 2912 Adeplhib.exe Ahchbf32.exe PID 2912 wrote to memory of 836 2912 Adeplhib.exe Ahchbf32.exe PID 2912 wrote to memory of 836 2912 Adeplhib.exe Ahchbf32.exe PID 2912 wrote to memory of 836 2912 Adeplhib.exe Ahchbf32.exe PID 836 wrote to memory of 1528 836 Ahchbf32.exe Apomfh32.exe PID 836 wrote to memory of 1528 836 Ahchbf32.exe Apomfh32.exe PID 836 wrote to memory of 1528 836 Ahchbf32.exe Apomfh32.exe PID 836 wrote to memory of 1528 836 Ahchbf32.exe Apomfh32.exe PID 1528 wrote to memory of 988 1528 Apomfh32.exe Amejeljk.exe PID 1528 wrote to memory of 988 1528 Apomfh32.exe Amejeljk.exe PID 1528 wrote to memory of 988 1528 Apomfh32.exe Amejeljk.exe PID 1528 wrote to memory of 988 1528 Apomfh32.exe Amejeljk.exe PID 988 wrote to memory of 1396 988 Amejeljk.exe Aljgfioc.exe PID 988 wrote to memory of 1396 988 Amejeljk.exe Aljgfioc.exe PID 988 wrote to memory of 1396 988 Amejeljk.exe Aljgfioc.exe PID 988 wrote to memory of 1396 988 Amejeljk.exe Aljgfioc.exe PID 1396 wrote to memory of 2036 1396 Aljgfioc.exe Bokphdld.exe PID 1396 wrote to memory of 2036 1396 Aljgfioc.exe Bokphdld.exe PID 1396 wrote to memory of 2036 1396 Aljgfioc.exe Bokphdld.exe PID 1396 wrote to memory of 2036 1396 Aljgfioc.exe Bokphdld.exe PID 2036 wrote to memory of 2900 2036 Bokphdld.exe Bommnc32.exe PID 2036 wrote to memory of 2900 2036 Bokphdld.exe Bommnc32.exe PID 2036 wrote to memory of 2900 2036 Bokphdld.exe Bommnc32.exe PID 2036 wrote to memory of 2900 2036 Bokphdld.exe Bommnc32.exe PID 2900 wrote to memory of 1972 2900 Bommnc32.exe Bjijdadm.exe PID 2900 wrote to memory of 1972 2900 Bommnc32.exe Bjijdadm.exe PID 2900 wrote to memory of 1972 2900 Bommnc32.exe Bjijdadm.exe PID 2900 wrote to memory of 1972 2900 Bommnc32.exe Bjijdadm.exe PID 1972 wrote to memory of 764 1972 Bjijdadm.exe Cpeofk32.exe PID 1972 wrote to memory of 764 1972 Bjijdadm.exe Cpeofk32.exe PID 1972 wrote to memory of 764 1972 Bjijdadm.exe Cpeofk32.exe PID 1972 wrote to memory of 764 1972 Bjijdadm.exe Cpeofk32.exe PID 764 wrote to memory of 2740 764 Cpeofk32.exe Cgpgce32.exe PID 764 wrote to memory of 2740 764 Cpeofk32.exe Cgpgce32.exe PID 764 wrote to memory of 2740 764 Cpeofk32.exe Cgpgce32.exe PID 764 wrote to memory of 2740 764 Cpeofk32.exe Cgpgce32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe"C:\Users\Admin\AppData\Local\Temp\30ad1e16f2eab2ae3732c42f9694bcdc8a10fb6052845b4d605311d5cc2d0385.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\Ocajbekl.exeC:\Windows\system32\Ocajbekl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\Pipopl32.exeC:\Windows\system32\Pipopl32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\Pmnhfjmg.exeC:\Windows\system32\Pmnhfjmg.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Plcdgfbo.exeC:\Windows\system32\Plcdgfbo.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\Pelipl32.exeC:\Windows\system32\Pelipl32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Qbbfopeg.exeC:\Windows\system32\Qbbfopeg.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Adeplhib.exeC:\Windows\system32\Adeplhib.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Ahchbf32.exeC:\Windows\system32\Ahchbf32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\Apomfh32.exeC:\Windows\system32\Apomfh32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\Amejeljk.exeC:\Windows\system32\Amejeljk.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\Aljgfioc.exeC:\Windows\system32\Aljgfioc.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Bokphdld.exeC:\Windows\system32\Bokphdld.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\Bommnc32.exeC:\Windows\system32\Bommnc32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\Cpeofk32.exeC:\Windows\system32\Cpeofk32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\Cgpgce32.exeC:\Windows\system32\Cgpgce32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Windows\SysWOW64\Cbkeib32.exeC:\Windows\system32\Cbkeib32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2400 -
C:\Windows\SysWOW64\Cjbmjplb.exeC:\Windows\system32\Cjbmjplb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Windows\SysWOW64\Clcflkic.exeC:\Windows\system32\Clcflkic.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Windows\SysWOW64\Dbpodagk.exeC:\Windows\system32\Dbpodagk.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Windows\SysWOW64\Dhmcfkme.exeC:\Windows\system32\Dhmcfkme.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3044 -
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Windows\SysWOW64\Dcfdgiid.exeC:\Windows\system32\Dcfdgiid.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Windows\SysWOW64\Dgaqgh32.exeC:\Windows\system32\Dgaqgh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Windows\SysWOW64\Dgdmmgpj.exeC:\Windows\system32\Dgdmmgpj.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Windows\SysWOW64\Djbiicon.exeC:\Windows\system32\Djbiicon.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Windows\SysWOW64\Dgfjbgmh.exeC:\Windows\system32\Dgfjbgmh.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3012 -
C:\Windows\SysWOW64\Dfijnd32.exeC:\Windows\system32\Dfijnd32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Windows\SysWOW64\Eqonkmdh.exeC:\Windows\system32\Eqonkmdh.exe33⤵
- Executes dropped EXE
PID:2444 -
C:\Windows\SysWOW64\Ejgcdb32.exeC:\Windows\system32\Ejgcdb32.exe34⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\Efncicpm.exeC:\Windows\system32\Efncicpm.exe35⤵
- Executes dropped EXE
PID:840 -
C:\Windows\SysWOW64\Eilpeooq.exeC:\Windows\system32\Eilpeooq.exe36⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\Epfhbign.exeC:\Windows\system32\Epfhbign.exe37⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Eiomkn32.exeC:\Windows\system32\Eiomkn32.exe38⤵
- Executes dropped EXE
- Modifies registry class
PID:1540 -
C:\Windows\SysWOW64\Epieghdk.exeC:\Windows\system32\Epieghdk.exe39⤵
- Executes dropped EXE
PID:1020 -
C:\Windows\SysWOW64\Eeempocb.exeC:\Windows\system32\Eeempocb.exe40⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\Ealnephf.exeC:\Windows\system32\Ealnephf.exe41⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\Fckjalhj.exeC:\Windows\system32\Fckjalhj.exe42⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe43⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\Ffkcbgek.exeC:\Windows\system32\Ffkcbgek.exe44⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\Fpdhklkl.exeC:\Windows\system32\Fpdhklkl.exe45⤵
- Executes dropped EXE
PID:692 -
C:\Windows\SysWOW64\Fdoclk32.exeC:\Windows\system32\Fdoclk32.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1712 -
C:\Windows\SysWOW64\Fjilieka.exeC:\Windows\system32\Fjilieka.exe47⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\Facdeo32.exeC:\Windows\system32\Facdeo32.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2264 -
C:\Windows\SysWOW64\Ffpmnf32.exeC:\Windows\system32\Ffpmnf32.exe49⤵
- Executes dropped EXE
PID:848 -
C:\Windows\SysWOW64\Fioija32.exeC:\Windows\system32\Fioija32.exe50⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\SysWOW64\Fphafl32.exeC:\Windows\system32\Fphafl32.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1924 -
C:\Windows\SysWOW64\Feeiob32.exeC:\Windows\system32\Feeiob32.exe52⤵
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\Fmlapp32.exeC:\Windows\system32\Fmlapp32.exe53⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\Gonnhhln.exeC:\Windows\system32\Gonnhhln.exe54⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\SysWOW64\Ghfbqn32.exeC:\Windows\system32\Ghfbqn32.exe55⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\Gpmjak32.exeC:\Windows\system32\Gpmjak32.exe56⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\Gejcjbah.exeC:\Windows\system32\Gejcjbah.exe57⤵
- Executes dropped EXE
PID:2700 -
C:\Windows\SysWOW64\Gkgkbipp.exeC:\Windows\system32\Gkgkbipp.exe58⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2448 -
C:\Windows\SysWOW64\Gbnccfpb.exeC:\Windows\system32\Gbnccfpb.exe59⤵
- Executes dropped EXE
- Modifies registry class
PID:2888 -
C:\Windows\SysWOW64\Ghkllmoi.exeC:\Windows\system32\Ghkllmoi.exe60⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:612 -
C:\Windows\SysWOW64\Goddhg32.exeC:\Windows\system32\Goddhg32.exe61⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\Geolea32.exeC:\Windows\system32\Geolea32.exe62⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\Gogangdc.exeC:\Windows\system32\Gogangdc.exe63⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\Gaemjbcg.exeC:\Windows\system32\Gaemjbcg.exe64⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1680 -
C:\Windows\SysWOW64\Ghoegl32.exeC:\Windows\system32\Ghoegl32.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2216 -
C:\Windows\SysWOW64\Hmlnoc32.exeC:\Windows\system32\Hmlnoc32.exe66⤵PID:484
-
C:\Windows\SysWOW64\Hdfflm32.exeC:\Windows\system32\Hdfflm32.exe67⤵PID:1636
-
C:\Windows\SysWOW64\Hkpnhgge.exeC:\Windows\system32\Hkpnhgge.exe68⤵PID:3056
-
C:\Windows\SysWOW64\Hnojdcfi.exeC:\Windows\system32\Hnojdcfi.exe69⤵PID:1084
-
C:\Windows\SysWOW64\Hdhbam32.exeC:\Windows\system32\Hdhbam32.exe70⤵PID:328
-
C:\Windows\SysWOW64\Hggomh32.exeC:\Windows\system32\Hggomh32.exe71⤵PID:1912
-
C:\Windows\SysWOW64\Hnagjbdf.exeC:\Windows\system32\Hnagjbdf.exe72⤵PID:2868
-
C:\Windows\SysWOW64\Hpocfncj.exeC:\Windows\system32\Hpocfncj.exe73⤵PID:1932
-
C:\Windows\SysWOW64\Hellne32.exeC:\Windows\system32\Hellne32.exe74⤵PID:1956
-
C:\Windows\SysWOW64\Hcplhi32.exeC:\Windows\system32\Hcplhi32.exe75⤵PID:1440
-
C:\Windows\SysWOW64\Henidd32.exeC:\Windows\system32\Henidd32.exe76⤵PID:2440
-
C:\Windows\SysWOW64\Hkkalk32.exeC:\Windows\system32\Hkkalk32.exe77⤵PID:2568
-
C:\Windows\SysWOW64\Icbimi32.exeC:\Windows\system32\Icbimi32.exe78⤵
- Drops file in System32 directory
PID:1628 -
C:\Windows\SysWOW64\Idceea32.exeC:\Windows\system32\Idceea32.exe79⤵PID:2388
-
C:\Windows\SysWOW64\Iknnbklc.exeC:\Windows\system32\Iknnbklc.exe80⤵PID:2112
-
C:\Windows\SysWOW64\Ifcbodli.exeC:\Windows\system32\Ifcbodli.exe81⤵PID:1656
-
C:\Windows\SysWOW64\Ikpjgkjq.exeC:\Windows\system32\Ikpjgkjq.exe82⤵PID:2328
-
C:\Windows\SysWOW64\Inngcfid.exeC:\Windows\system32\Inngcfid.exe83⤵PID:2212
-
C:\Windows\SysWOW64\Ihdkao32.exeC:\Windows\system32\Ihdkao32.exe84⤵PID:2188
-
C:\Windows\SysWOW64\Ijeghgoh.exeC:\Windows\system32\Ijeghgoh.exe85⤵PID:1780
-
C:\Windows\SysWOW64\Iqopea32.exeC:\Windows\system32\Iqopea32.exe86⤵PID:1676
-
C:\Windows\SysWOW64\Idklfpon.exeC:\Windows\system32\Idklfpon.exe87⤵PID:1556
-
C:\Windows\SysWOW64\Ikddbj32.exeC:\Windows\system32\Ikddbj32.exe88⤵PID:2052
-
C:\Windows\SysWOW64\Igkdgk32.exeC:\Windows\system32\Igkdgk32.exe89⤵PID:1964
-
C:\Windows\SysWOW64\Jjjacf32.exeC:\Windows\system32\Jjjacf32.exe90⤵PID:2284
-
C:\Windows\SysWOW64\Jmhmpb32.exeC:\Windows\system32\Jmhmpb32.exe91⤵PID:3032
-
C:\Windows\SysWOW64\Jgnamk32.exeC:\Windows\system32\Jgnamk32.exe92⤵PID:2652
-
C:\Windows\SysWOW64\Jjlnif32.exeC:\Windows\system32\Jjlnif32.exe93⤵PID:2464
-
C:\Windows\SysWOW64\Jmjjea32.exeC:\Windows\system32\Jmjjea32.exe94⤵PID:1240
-
C:\Windows\SysWOW64\Joifam32.exeC:\Windows\system32\Joifam32.exe95⤵PID:1464
-
C:\Windows\SysWOW64\Jjojofgn.exeC:\Windows\system32\Jjojofgn.exe96⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2280 -
C:\Windows\SysWOW64\Jmmfkafa.exeC:\Windows\system32\Jmmfkafa.exe97⤵PID:1548
-
C:\Windows\SysWOW64\Jbjochdi.exeC:\Windows\system32\Jbjochdi.exe98⤵PID:580
-
C:\Windows\SysWOW64\Jicgpb32.exeC:\Windows\system32\Jicgpb32.exe99⤵
- Modifies registry class
PID:2756 -
C:\Windows\SysWOW64\Jkbcln32.exeC:\Windows\system32\Jkbcln32.exe100⤵
- Modifies registry class
PID:864 -
C:\Windows\SysWOW64\Jnqphi32.exeC:\Windows\system32\Jnqphi32.exe101⤵PID:3000
-
C:\Windows\SysWOW64\Jejhecaj.exeC:\Windows\system32\Jejhecaj.exe102⤵PID:1604
-
C:\Windows\SysWOW64\Jnclnihj.exeC:\Windows\system32\Jnclnihj.exe103⤵PID:300
-
C:\Windows\SysWOW64\Kaaijdgn.exeC:\Windows\system32\Kaaijdgn.exe104⤵PID:2808
-
C:\Windows\SysWOW64\Kemejc32.exeC:\Windows\system32\Kemejc32.exe105⤵
- Modifies registry class
PID:2592 -
C:\Windows\SysWOW64\Kneicieh.exeC:\Windows\system32\Kneicieh.exe106⤵PID:2972
-
C:\Windows\SysWOW64\Kaceodek.exeC:\Windows\system32\Kaceodek.exe107⤵PID:1748
-
C:\Windows\SysWOW64\Kcbakpdo.exeC:\Windows\system32\Kcbakpdo.exe108⤵PID:1348
-
C:\Windows\SysWOW64\Kkijmm32.exeC:\Windows\system32\Kkijmm32.exe109⤵PID:1844
-
C:\Windows\SysWOW64\Kafbec32.exeC:\Windows\system32\Kafbec32.exe110⤵PID:1496
-
C:\Windows\SysWOW64\Kcdnao32.exeC:\Windows\system32\Kcdnao32.exe111⤵PID:2392
-
C:\Windows\SysWOW64\Kjnfniii.exeC:\Windows\system32\Kjnfniii.exe112⤵
- Modifies registry class
PID:1040 -
C:\Windows\SysWOW64\Kpkofpgq.exeC:\Windows\system32\Kpkofpgq.exe113⤵PID:2200
-
C:\Windows\SysWOW64\Kgbggnhc.exeC:\Windows\system32\Kgbggnhc.exe114⤵PID:1172
-
C:\Windows\SysWOW64\Kjqccigf.exeC:\Windows\system32\Kjqccigf.exe115⤵PID:876
-
C:\Windows\SysWOW64\Kaklpcoc.exeC:\Windows\system32\Kaklpcoc.exe116⤵PID:2404
-
C:\Windows\SysWOW64\Kcihlong.exeC:\Windows\system32\Kcihlong.exe117⤵PID:2104
-
C:\Windows\SysWOW64\Kifpdelo.exeC:\Windows\system32\Kifpdelo.exe118⤵PID:2468
-
C:\Windows\SysWOW64\Lldlqakb.exeC:\Windows\system32\Lldlqakb.exe119⤵PID:2480
-
C:\Windows\SysWOW64\Lckdanld.exeC:\Windows\system32\Lckdanld.exe120⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2256 -
C:\Windows\SysWOW64\Lihmjejl.exeC:\Windows\system32\Lihmjejl.exe121⤵PID:2160
-
C:\Windows\SysWOW64\Llfifq32.exeC:\Windows\system32\Llfifq32.exe122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-