Analysis
-
max time kernel
134s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:05
Static task
static1
Behavioral task
behavioral1
Sample
44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe
Resource
win10v2004-20240508-en
General
-
Target
44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe
-
Size
128KB
-
MD5
44c2e132d0f72009d07abb59e888ed5f
-
SHA1
f6df019915e5e7ce4bd00e60ce8b2a93cafc9cad
-
SHA256
44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e
-
SHA512
1454ad82cc2b445e064635402ec814e14993e7ffccd448a83bc200fad49172b3485e73fdf711ca2aa606e7a2a93906c33ed48c8377e3078b232d51a1c2509ccf
-
SSDEEP
3072:voPVmkQBW2JEnvzmhESk8QYxQdLrCimBaH8UH30ZIvM6qMH5X3O/:voPVmgMESFtCApaH8m3QIvMWH5H
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Ifgpnmom.exeAijbfo32.exeKpdcfoph.exeKecjmodq.exeNjeccjcd.exeNffccejb.exeIhijhpdo.exeLaeidfdn.exeGkoobhhg.exeBjpdhifk.exeDbbklnpj.exeAldfcpjn.exeLadpagin.exeLcfbdd32.exeQemomb32.exeGhibjjnk.exeOccjjnap.exeMgbaml32.exePfebnmcj.exeCceogcfj.exeDakpiajj.exeQackpado.exeLeegbnan.exeApkihofl.exeHnmcli32.exeDdbolkac.exeFkhbgbkc.exeLkfddc32.exeNagbgl32.exeIdkpganf.exeLbkchj32.exeCbjlhpkb.exeBbikig32.exeNobpmb32.exeNmabjfek.exeQkielpdf.exeGmqkml32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifgpnmom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aijbfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Kpdcfoph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kecjmodq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Njeccjcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nffccejb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ihijhpdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Laeidfdn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkoobhhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bjpdhifk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dbbklnpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Aldfcpjn.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ladpagin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lcfbdd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qemomb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ghibjjnk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Occjjnap.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Mgbaml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Pfebnmcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Cceogcfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Dakpiajj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qackpado.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Leegbnan.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apkihofl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Hnmcli32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Ddbolkac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fkhbgbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Lkfddc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nagbgl32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idkpganf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lbkchj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbjlhpkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Bbikig32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nobpmb32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Nmabjfek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Qkielpdf.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmqkml32.exe -
Executes dropped EXE 64 IoCs
Processes:
Ohidmoaa.exePoeipifl.exePddnnp32.exePqkobqhd.exePqnlhpfb.exePnalad32.exeQfmafg32.exeAkqpom32.exeAeidgbaf.exeAncefgfd.exeBadnhbce.exeBfagpiam.exeBmnlbcfg.exeBjallg32.exeBfhmqhkd.exeBbonei32.exeCadjgf32.exeCbdgqimc.exeCkolek32.exeCdgpnqpo.exeCakqgeoi.exeDanmmd32.exeDpcjnabn.exeDpegcq32.exeDaipqhdg.exeDomqjm32.exeEamilh32.exeEgjbdo32.exeEhjona32.exeFcjeon32.exeFhgnge32.exeFkhgip32.exeFilgbdfd.exeFkjdopeh.exeGqiimfam.exeGjbmelgm.exeGqlebf32.exeGmbfggdo.exeGcmoda32.exeGmgpbf32.exeHfpdkl32.exeHipmmg32.exeHbiaemkk.exeHlafnbal.exeHbknkl32.exeHlccdboi.exeHapklimq.exeHjipenda.exeIpehmebh.exeIjklknbn.exeIaeegh32.exeIipiljgf.exeIdfnicfl.exeIegjqk32.exeIlabmedg.exeIfffkncm.exeIoakoq32.exeIelclkhe.exeJodhdp32.exeJlhhndno.exeJniefm32.exeJgaiobjn.exeJnkakl32.exeJhafhe32.exepid process 2948 Ohidmoaa.exe 2496 Poeipifl.exe 3064 Pddnnp32.exe 2512 Pqkobqhd.exe 2516 Pqnlhpfb.exe 2056 Pnalad32.exe 1480 Qfmafg32.exe 1760 Akqpom32.exe 2656 Aeidgbaf.exe 1856 Ancefgfd.exe 1460 Badnhbce.exe 1068 Bfagpiam.exe 540 Bmnlbcfg.exe 816 Bjallg32.exe 1204 Bfhmqhkd.exe 772 Bbonei32.exe 528 Cadjgf32.exe 436 Cbdgqimc.exe 1144 Ckolek32.exe 2004 Cdgpnqpo.exe 1992 Cakqgeoi.exe 1980 Danmmd32.exe 2304 Dpcjnabn.exe 1052 Dpegcq32.exe 2808 Daipqhdg.exe 2296 Domqjm32.exe 2100 Eamilh32.exe 2688 Egjbdo32.exe 2884 Ehjona32.exe 2608 Fcjeon32.exe 2636 Fhgnge32.exe 2672 Fkhgip32.exe 2472 Filgbdfd.exe 2776 Fkjdopeh.exe 1476 Gqiimfam.exe 1584 Gjbmelgm.exe 2448 Gqlebf32.exe 1348 Gmbfggdo.exe 1080 Gcmoda32.exe 2172 Gmgpbf32.exe 1092 Hfpdkl32.exe 880 Hipmmg32.exe 1732 Hbiaemkk.exe 664 Hlafnbal.exe 372 Hbknkl32.exe 2928 Hlccdboi.exe 1836 Hapklimq.exe 1612 Hjipenda.exe 1872 Ipehmebh.exe 1128 Ijklknbn.exe 2028 Iaeegh32.exe 2816 Iipiljgf.exe 2316 Idfnicfl.exe 1692 Iegjqk32.exe 2108 Ilabmedg.exe 2504 Ifffkncm.exe 2436 Ioakoq32.exe 2412 Ielclkhe.exe 332 Jodhdp32.exe 1100 Jlhhndno.exe 1216 Jniefm32.exe 2684 Jgaiobjn.exe 1196 Jnkakl32.exe 1824 Jhafhe32.exe -
Loads dropped DLL 64 IoCs
Processes:
44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exeOhidmoaa.exePoeipifl.exePddnnp32.exePqkobqhd.exePqnlhpfb.exePnalad32.exeQfmafg32.exeAkqpom32.exeAeidgbaf.exeAncefgfd.exeBadnhbce.exeBfagpiam.exeBmnlbcfg.exeBjallg32.exeBfhmqhkd.exeBbonei32.exeCadjgf32.exeCbdgqimc.exeCkolek32.exeCdgpnqpo.exeCakqgeoi.exeDanmmd32.exeDpcjnabn.exeDpegcq32.exeDaipqhdg.exeDomqjm32.exeEamilh32.exeEgjbdo32.exeEhjona32.exeFcjeon32.exeFhgnge32.exepid process 2212 44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe 2212 44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe 2948 Ohidmoaa.exe 2948 Ohidmoaa.exe 2496 Poeipifl.exe 2496 Poeipifl.exe 3064 Pddnnp32.exe 3064 Pddnnp32.exe 2512 Pqkobqhd.exe 2512 Pqkobqhd.exe 2516 Pqnlhpfb.exe 2516 Pqnlhpfb.exe 2056 Pnalad32.exe 2056 Pnalad32.exe 1480 Qfmafg32.exe 1480 Qfmafg32.exe 1760 Akqpom32.exe 1760 Akqpom32.exe 2656 Aeidgbaf.exe 2656 Aeidgbaf.exe 1856 Ancefgfd.exe 1856 Ancefgfd.exe 1460 Badnhbce.exe 1460 Badnhbce.exe 1068 Bfagpiam.exe 1068 Bfagpiam.exe 540 Bmnlbcfg.exe 540 Bmnlbcfg.exe 816 Bjallg32.exe 816 Bjallg32.exe 1204 Bfhmqhkd.exe 1204 Bfhmqhkd.exe 772 Bbonei32.exe 772 Bbonei32.exe 528 Cadjgf32.exe 528 Cadjgf32.exe 436 Cbdgqimc.exe 436 Cbdgqimc.exe 1144 Ckolek32.exe 1144 Ckolek32.exe 2004 Cdgpnqpo.exe 2004 Cdgpnqpo.exe 1992 Cakqgeoi.exe 1992 Cakqgeoi.exe 1980 Danmmd32.exe 1980 Danmmd32.exe 2304 Dpcjnabn.exe 2304 Dpcjnabn.exe 1052 Dpegcq32.exe 1052 Dpegcq32.exe 2808 Daipqhdg.exe 2808 Daipqhdg.exe 2296 Domqjm32.exe 2296 Domqjm32.exe 2100 Eamilh32.exe 2100 Eamilh32.exe 2688 Egjbdo32.exe 2688 Egjbdo32.exe 2884 Ehjona32.exe 2884 Ehjona32.exe 2608 Fcjeon32.exe 2608 Fcjeon32.exe 2636 Fhgnge32.exe 2636 Fhgnge32.exe -
Drops file in System32 directory 64 IoCs
Processes:
Oaogognm.exeMclgklel.exeIhiabfhk.exeBgffhkoj.exeGqlhkofn.exeCkecpjdh.exeEifobe32.exeNcdpdcfh.exeBadnhbce.exeNnmlcp32.exeJlaeab32.exeDcllbhdn.exeLplbjm32.exeLalhgogb.exeBlgcio32.exeElipgofb.exeNgdjaofc.exeInmmbc32.exeEcadddjh.exeBmnofp32.exeKccian32.exeJfjolf32.exeAkdafn32.exeFqilppic.exeLojjfo32.exeOdgamdef.exeCnklgkap.exeDjoeki32.exeGkhaooec.exePqgilnji.exeDfbbpd32.exeBjbeofpp.exeDqfabdaf.exeFedfgejh.exeAijbfo32.exeNhlgmd32.exeQkielpdf.exePimkbbpi.exeKofaicon.exeIaimipjl.exedescription ioc process File created C:\Windows\SysWOW64\Odmckcmq.exe Oaogognm.exe File opened for modification C:\Windows\SysWOW64\Mnblhddb.exe Mclgklel.exe File created C:\Windows\SysWOW64\Ihlnhffh.exe Ihiabfhk.exe File opened for modification C:\Windows\SysWOW64\Ppbfmdfo.exe File created C:\Windows\SysWOW64\Kncinl32.dll Bgffhkoj.exe File opened for modification C:\Windows\SysWOW64\Gnphdceh.exe Gqlhkofn.exe File opened for modification C:\Windows\SysWOW64\Caokmd32.exe Ckecpjdh.exe File opened for modification C:\Windows\SysWOW64\Epqgopbi.exe Eifobe32.exe File created C:\Windows\SysWOW64\Neblqoel.exe Ncdpdcfh.exe File created C:\Windows\SysWOW64\Bjdnmi32.exe File created C:\Windows\SysWOW64\Ffbnkppp.dll Badnhbce.exe File opened for modification C:\Windows\SysWOW64\Nibqqh32.exe Nnmlcp32.exe File created C:\Windows\SysWOW64\Acfdii32.dll Oaogognm.exe File opened for modification C:\Windows\SysWOW64\Jhhfgcgj.exe Jlaeab32.exe File created C:\Windows\SysWOW64\Jgbpkc32.dll File created C:\Windows\SysWOW64\Oeeeeehe.exe File opened for modification C:\Windows\SysWOW64\Djfdob32.exe Dcllbhdn.exe File opened for modification C:\Windows\SysWOW64\Lhiddoph.exe Lplbjm32.exe File created C:\Windows\SysWOW64\Lkelpd32.exe Lalhgogb.exe File opened for modification C:\Windows\SysWOW64\Oegdcj32.exe File opened for modification C:\Windows\SysWOW64\Bbqkeioh.exe Blgcio32.exe File created C:\Windows\SysWOW64\Gnjhaj32.exe File opened for modification C:\Windows\SysWOW64\Qckalamk.exe File created C:\Windows\SysWOW64\Ohceeg32.dll Elipgofb.exe File created C:\Windows\SysWOW64\Nmabjfek.exe Ngdjaofc.exe File created C:\Windows\SysWOW64\Igebkiof.exe Inmmbc32.exe File opened for modification C:\Windows\SysWOW64\Emjhmipi.exe Ecadddjh.exe File created C:\Windows\SysWOW64\Bnfbaa32.dll Ihiabfhk.exe File created C:\Windows\SysWOW64\Bopknhjd.exe Bmnofp32.exe File created C:\Windows\SysWOW64\Lojjfo32.exe Kccian32.exe File created C:\Windows\SysWOW64\Cdklbpaj.dll File opened for modification C:\Windows\SysWOW64\Japciodd.exe Jfjolf32.exe File created C:\Windows\SysWOW64\Hjojpeec.dll Akdafn32.exe File created C:\Windows\SysWOW64\Pgjkje32.dll Fqilppic.exe File created C:\Windows\SysWOW64\Liboodmk.exe Lojjfo32.exe File created C:\Windows\SysWOW64\Bifmdh32.dll File opened for modification C:\Windows\SysWOW64\Aogpmcmb.exe File opened for modification C:\Windows\SysWOW64\Kceganoe.exe File opened for modification C:\Windows\SysWOW64\Imhanp32.exe File created C:\Windows\SysWOW64\Ddaafojo.dll Odgamdef.exe File created C:\Windows\SysWOW64\Gmcefh32.dll Cnklgkap.exe File created C:\Windows\SysWOW64\Acpchmhl.dll Djoeki32.exe File created C:\Windows\SysWOW64\Hofjem32.exe Gkhaooec.exe File opened for modification C:\Windows\SysWOW64\Pgaahh32.exe Pqgilnji.exe File opened for modification C:\Windows\SysWOW64\Ehaolpke.exe Dfbbpd32.exe File created C:\Windows\SysWOW64\Aofklbnj.exe File opened for modification C:\Windows\SysWOW64\Nhngem32.exe File created C:\Windows\SysWOW64\Dnfkefad.exe File opened for modification C:\Windows\SysWOW64\Bgffhkoj.exe Bjbeofpp.exe File created C:\Windows\SysWOW64\Dgqion32.exe Dqfabdaf.exe File created C:\Windows\SysWOW64\Fjaoplho.exe Fedfgejh.exe File created C:\Windows\SysWOW64\Maljaabb.dll Aijbfo32.exe File created C:\Windows\SysWOW64\Onfoin32.exe Nhlgmd32.exe File created C:\Windows\SysWOW64\Aemgfj32.dll Qkielpdf.exe File created C:\Windows\SysWOW64\Pcbookpp.exe Pimkbbpi.exe File created C:\Windows\SysWOW64\Gcikfhed.exe File opened for modification C:\Windows\SysWOW64\Jepoao32.exe File created C:\Windows\SysWOW64\Qdieaf32.exe File opened for modification C:\Windows\SysWOW64\Khoebi32.exe Kofaicon.exe File created C:\Windows\SysWOW64\Anafme32.dll Iaimipjl.exe File created C:\Windows\SysWOW64\Gfmdfe32.dll File created C:\Windows\SysWOW64\Lkfbmj32.exe File opened for modification C:\Windows\SysWOW64\Coknmp32.exe File created C:\Windows\SysWOW64\Plhfoe32.dll -
Program crash 1 IoCs
Processes:
pid pid_target process target process 2800 1792 -
Modifies registry class 64 IoCs
Processes:
Kccian32.exeMlkjne32.exeKhjgel32.exePqgilnji.exeFejifdab.exeCgnpjkhj.exePegnglnm.exeLcblan32.exeKpfbegei.exePdndggcl.exeNkclkl32.exeAeghng32.exePalepb32.exeDjfdob32.exeCceogcfj.exeQfkelkkd.exeDpegcq32.exeElipgofb.exeIegjqk32.exeNopaoj32.exeCfcmlg32.exeJdidmf32.exeOchenfdn.exeBimoloog.exeEhhdaj32.exeGojhafnb.exeEpqgopbi.exeBpfebmia.exeLblcfnhj.exeDddimn32.exeBojipjcj.exeEfhcej32.exeFkecij32.exeEokgij32.exeFiakkcma.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Kccian32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cndmgj32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klnleckl.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Mlkjne32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Khjgel32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikicmc32.dll" Pqgilnji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fejifdab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Cgnpjkhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pegnglnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkfdpa32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Lcblan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Kpfbegei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Pdndggcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eepjmp32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enadon32.dll" Nkclkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Aeghng32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Palepb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Djfdob32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkhgoifc.dll" Cceogcfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Qfkelkkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Dpegcq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Elipgofb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efkcnl32.dll" Qfkelkkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Iegjqk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Nopaoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aiheodlg.dll" Cfcmlg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nijjfj32.dll" Jdidmf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Ochenfdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eecapl32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bimoloog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Ehhdaj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Gojhafnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cinelbbc.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnfoepmg.dll" Epqgopbi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Bpfebmia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papifjfj.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Lblcfnhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Dddimn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Bojipjcj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Efhcej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiopiqpb.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjfikeqd.dll" Fkecij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Eokgij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lclgbcdk.dll" Fiakkcma.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exeOhidmoaa.exePoeipifl.exePddnnp32.exePqkobqhd.exePqnlhpfb.exePnalad32.exeQfmafg32.exeAkqpom32.exeAeidgbaf.exeAncefgfd.exeBadnhbce.exeBfagpiam.exeBmnlbcfg.exeBjallg32.exeBfhmqhkd.exedescription pid process target process PID 2212 wrote to memory of 2948 2212 44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe Ohidmoaa.exe PID 2212 wrote to memory of 2948 2212 44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe Ohidmoaa.exe PID 2212 wrote to memory of 2948 2212 44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe Ohidmoaa.exe PID 2212 wrote to memory of 2948 2212 44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe Ohidmoaa.exe PID 2948 wrote to memory of 2496 2948 Ohidmoaa.exe Poeipifl.exe PID 2948 wrote to memory of 2496 2948 Ohidmoaa.exe Poeipifl.exe PID 2948 wrote to memory of 2496 2948 Ohidmoaa.exe Poeipifl.exe PID 2948 wrote to memory of 2496 2948 Ohidmoaa.exe Poeipifl.exe PID 2496 wrote to memory of 3064 2496 Poeipifl.exe Pddnnp32.exe PID 2496 wrote to memory of 3064 2496 Poeipifl.exe Pddnnp32.exe PID 2496 wrote to memory of 3064 2496 Poeipifl.exe Pddnnp32.exe PID 2496 wrote to memory of 3064 2496 Poeipifl.exe Pddnnp32.exe PID 3064 wrote to memory of 2512 3064 Pddnnp32.exe Pqkobqhd.exe PID 3064 wrote to memory of 2512 3064 Pddnnp32.exe Pqkobqhd.exe PID 3064 wrote to memory of 2512 3064 Pddnnp32.exe Pqkobqhd.exe PID 3064 wrote to memory of 2512 3064 Pddnnp32.exe Pqkobqhd.exe PID 2512 wrote to memory of 2516 2512 Pqkobqhd.exe Pqnlhpfb.exe PID 2512 wrote to memory of 2516 2512 Pqkobqhd.exe Pqnlhpfb.exe PID 2512 wrote to memory of 2516 2512 Pqkobqhd.exe Pqnlhpfb.exe PID 2512 wrote to memory of 2516 2512 Pqkobqhd.exe Pqnlhpfb.exe PID 2516 wrote to memory of 2056 2516 Pqnlhpfb.exe Pnalad32.exe PID 2516 wrote to memory of 2056 2516 Pqnlhpfb.exe Pnalad32.exe PID 2516 wrote to memory of 2056 2516 Pqnlhpfb.exe Pnalad32.exe PID 2516 wrote to memory of 2056 2516 Pqnlhpfb.exe Pnalad32.exe PID 2056 wrote to memory of 1480 2056 Pnalad32.exe Qfmafg32.exe PID 2056 wrote to memory of 1480 2056 Pnalad32.exe Qfmafg32.exe PID 2056 wrote to memory of 1480 2056 Pnalad32.exe Qfmafg32.exe PID 2056 wrote to memory of 1480 2056 Pnalad32.exe Qfmafg32.exe PID 1480 wrote to memory of 1760 1480 Qfmafg32.exe Akqpom32.exe PID 1480 wrote to memory of 1760 1480 Qfmafg32.exe Akqpom32.exe PID 1480 wrote to memory of 1760 1480 Qfmafg32.exe Akqpom32.exe PID 1480 wrote to memory of 1760 1480 Qfmafg32.exe Akqpom32.exe PID 1760 wrote to memory of 2656 1760 Akqpom32.exe Aeidgbaf.exe PID 1760 wrote to memory of 2656 1760 Akqpom32.exe Aeidgbaf.exe PID 1760 wrote to memory of 2656 1760 Akqpom32.exe Aeidgbaf.exe PID 1760 wrote to memory of 2656 1760 Akqpom32.exe Aeidgbaf.exe PID 2656 wrote to memory of 1856 2656 Aeidgbaf.exe Ancefgfd.exe PID 2656 wrote to memory of 1856 2656 Aeidgbaf.exe Ancefgfd.exe PID 2656 wrote to memory of 1856 2656 Aeidgbaf.exe Ancefgfd.exe PID 2656 wrote to memory of 1856 2656 Aeidgbaf.exe Ancefgfd.exe PID 1856 wrote to memory of 1460 1856 Ancefgfd.exe Badnhbce.exe PID 1856 wrote to memory of 1460 1856 Ancefgfd.exe Badnhbce.exe PID 1856 wrote to memory of 1460 1856 Ancefgfd.exe Badnhbce.exe PID 1856 wrote to memory of 1460 1856 Ancefgfd.exe Badnhbce.exe PID 1460 wrote to memory of 1068 1460 Badnhbce.exe Bfagpiam.exe PID 1460 wrote to memory of 1068 1460 Badnhbce.exe Bfagpiam.exe PID 1460 wrote to memory of 1068 1460 Badnhbce.exe Bfagpiam.exe PID 1460 wrote to memory of 1068 1460 Badnhbce.exe Bfagpiam.exe PID 1068 wrote to memory of 540 1068 Bfagpiam.exe Bmnlbcfg.exe PID 1068 wrote to memory of 540 1068 Bfagpiam.exe Bmnlbcfg.exe PID 1068 wrote to memory of 540 1068 Bfagpiam.exe Bmnlbcfg.exe PID 1068 wrote to memory of 540 1068 Bfagpiam.exe Bmnlbcfg.exe PID 540 wrote to memory of 816 540 Bmnlbcfg.exe Bjallg32.exe PID 540 wrote to memory of 816 540 Bmnlbcfg.exe Bjallg32.exe PID 540 wrote to memory of 816 540 Bmnlbcfg.exe Bjallg32.exe PID 540 wrote to memory of 816 540 Bmnlbcfg.exe Bjallg32.exe PID 816 wrote to memory of 1204 816 Bjallg32.exe Bfhmqhkd.exe PID 816 wrote to memory of 1204 816 Bjallg32.exe Bfhmqhkd.exe PID 816 wrote to memory of 1204 816 Bjallg32.exe Bfhmqhkd.exe PID 816 wrote to memory of 1204 816 Bjallg32.exe Bfhmqhkd.exe PID 1204 wrote to memory of 772 1204 Bfhmqhkd.exe Bbonei32.exe PID 1204 wrote to memory of 772 1204 Bfhmqhkd.exe Bbonei32.exe PID 1204 wrote to memory of 772 1204 Bfhmqhkd.exe Bbonei32.exe PID 1204 wrote to memory of 772 1204 Bfhmqhkd.exe Bbonei32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe"C:\Users\Admin\AppData\Local\Temp\44d776d30309a5a9abd3d57081da3867d8ec0680f1a7c18a9f38c317cc3b4d4e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Ohidmoaa.exeC:\Windows\system32\Ohidmoaa.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Poeipifl.exeC:\Windows\system32\Poeipifl.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\Pddnnp32.exeC:\Windows\system32\Pddnnp32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\Pqkobqhd.exeC:\Windows\system32\Pqkobqhd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\Pqnlhpfb.exeC:\Windows\system32\Pqnlhpfb.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\Pnalad32.exeC:\Windows\system32\Pnalad32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\Qfmafg32.exeC:\Windows\system32\Qfmafg32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\Akqpom32.exeC:\Windows\system32\Akqpom32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\Aeidgbaf.exeC:\Windows\system32\Aeidgbaf.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Ancefgfd.exeC:\Windows\system32\Ancefgfd.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\Badnhbce.exeC:\Windows\system32\Badnhbce.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\Bfagpiam.exeC:\Windows\system32\Bfagpiam.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\Bmnlbcfg.exeC:\Windows\system32\Bmnlbcfg.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\Bjallg32.exeC:\Windows\system32\Bjallg32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\Bfhmqhkd.exeC:\Windows\system32\Bfhmqhkd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\Bbonei32.exeC:\Windows\system32\Bbonei32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Windows\SysWOW64\Cadjgf32.exeC:\Windows\system32\Cadjgf32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Windows\SysWOW64\Cbdgqimc.exeC:\Windows\system32\Cbdgqimc.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Windows\SysWOW64\Ckolek32.exeC:\Windows\system32\Ckolek32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Windows\SysWOW64\Cdgpnqpo.exeC:\Windows\system32\Cdgpnqpo.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Windows\SysWOW64\Cakqgeoi.exeC:\Windows\system32\Cakqgeoi.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Windows\SysWOW64\Danmmd32.exeC:\Windows\system32\Danmmd32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Windows\SysWOW64\Dpcjnabn.exeC:\Windows\system32\Dpcjnabn.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Windows\SysWOW64\Dpegcq32.exeC:\Windows\system32\Dpegcq32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1052 -
C:\Windows\SysWOW64\Daipqhdg.exeC:\Windows\system32\Daipqhdg.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Windows\SysWOW64\Domqjm32.exeC:\Windows\system32\Domqjm32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Windows\SysWOW64\Eamilh32.exeC:\Windows\system32\Eamilh32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Windows\SysWOW64\Egjbdo32.exeC:\Windows\system32\Egjbdo32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Windows\SysWOW64\Ehjona32.exeC:\Windows\system32\Ehjona32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Windows\SysWOW64\Fcjeon32.exeC:\Windows\system32\Fcjeon32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Windows\SysWOW64\Fhgnge32.exeC:\Windows\system32\Fhgnge32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Windows\SysWOW64\Fkhgip32.exeC:\Windows\system32\Fkhgip32.exe33⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\Filgbdfd.exeC:\Windows\system32\Filgbdfd.exe34⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\SysWOW64\Fkjdopeh.exeC:\Windows\system32\Fkjdopeh.exe35⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\Gqiimfam.exeC:\Windows\system32\Gqiimfam.exe36⤵
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\Gjbmelgm.exeC:\Windows\system32\Gjbmelgm.exe37⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\Gqlebf32.exeC:\Windows\system32\Gqlebf32.exe38⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\Gmbfggdo.exeC:\Windows\system32\Gmbfggdo.exe39⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\Gcmoda32.exeC:\Windows\system32\Gcmoda32.exe40⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\Gmgpbf32.exeC:\Windows\system32\Gmgpbf32.exe41⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\Hfpdkl32.exeC:\Windows\system32\Hfpdkl32.exe42⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\Hipmmg32.exeC:\Windows\system32\Hipmmg32.exe43⤵
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\Hbiaemkk.exeC:\Windows\system32\Hbiaemkk.exe44⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\Hlafnbal.exeC:\Windows\system32\Hlafnbal.exe45⤵
- Executes dropped EXE
PID:664 -
C:\Windows\SysWOW64\Hbknkl32.exeC:\Windows\system32\Hbknkl32.exe46⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\Hlccdboi.exeC:\Windows\system32\Hlccdboi.exe47⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\SysWOW64\Hapklimq.exeC:\Windows\system32\Hapklimq.exe48⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\SysWOW64\Hjipenda.exeC:\Windows\system32\Hjipenda.exe49⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\Ipehmebh.exeC:\Windows\system32\Ipehmebh.exe50⤵
- Executes dropped EXE
PID:1872 -
C:\Windows\SysWOW64\Ijklknbn.exeC:\Windows\system32\Ijklknbn.exe51⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\SysWOW64\Iaeegh32.exeC:\Windows\system32\Iaeegh32.exe52⤵
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\Iipiljgf.exeC:\Windows\system32\Iipiljgf.exe53⤵
- Executes dropped EXE
PID:2816 -
C:\Windows\SysWOW64\Idfnicfl.exeC:\Windows\system32\Idfnicfl.exe54⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\Iegjqk32.exeC:\Windows\system32\Iegjqk32.exe55⤵
- Executes dropped EXE
- Modifies registry class
PID:1692 -
C:\Windows\SysWOW64\Ilabmedg.exeC:\Windows\system32\Ilabmedg.exe56⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\Ifffkncm.exeC:\Windows\system32\Ifffkncm.exe57⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\Ioakoq32.exeC:\Windows\system32\Ioakoq32.exe58⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\Ielclkhe.exeC:\Windows\system32\Ielclkhe.exe59⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\Jodhdp32.exeC:\Windows\system32\Jodhdp32.exe60⤵
- Executes dropped EXE
PID:332 -
C:\Windows\SysWOW64\Jlhhndno.exeC:\Windows\system32\Jlhhndno.exe61⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\Jniefm32.exeC:\Windows\system32\Jniefm32.exe62⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\SysWOW64\Jgaiobjn.exeC:\Windows\system32\Jgaiobjn.exe63⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\Jnkakl32.exeC:\Windows\system32\Jnkakl32.exe64⤵
- Executes dropped EXE
PID:1196 -
C:\Windows\SysWOW64\Jhafhe32.exeC:\Windows\system32\Jhafhe32.exe65⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\Jaijak32.exeC:\Windows\system32\Jaijak32.exe66⤵PID:620
-
C:\Windows\SysWOW64\Jgfcja32.exeC:\Windows\system32\Jgfcja32.exe67⤵PID:2264
-
C:\Windows\SysWOW64\Jlckbh32.exeC:\Windows\system32\Jlckbh32.exe68⤵PID:2736
-
C:\Windows\SysWOW64\Kghpoa32.exeC:\Windows\system32\Kghpoa32.exe69⤵PID:2248
-
C:\Windows\SysWOW64\Knbhlkkc.exeC:\Windows\system32\Knbhlkkc.exe70⤵PID:696
-
C:\Windows\SysWOW64\Kcopdb32.exeC:\Windows\system32\Kcopdb32.exe71⤵PID:2640
-
C:\Windows\SysWOW64\Khlili32.exeC:\Windows\system32\Khlili32.exe72⤵PID:888
-
C:\Windows\SysWOW64\Kofaicon.exeC:\Windows\system32\Kofaicon.exe73⤵
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\Khoebi32.exeC:\Windows\system32\Khoebi32.exe74⤵PID:2592
-
C:\Windows\SysWOW64\Kcdjoaee.exeC:\Windows\system32\Kcdjoaee.exe75⤵PID:2432
-
C:\Windows\SysWOW64\Kdefgj32.exeC:\Windows\system32\Kdefgj32.exe76⤵PID:2552
-
C:\Windows\SysWOW64\Kokjdb32.exeC:\Windows\system32\Kokjdb32.exe77⤵PID:2456
-
C:\Windows\SysWOW64\Kdhcli32.exeC:\Windows\system32\Kdhcli32.exe78⤵PID:2376
-
C:\Windows\SysWOW64\Lblcfnhj.exeC:\Windows\system32\Lblcfnhj.exe79⤵
- Modifies registry class
PID:2800 -
C:\Windows\SysWOW64\Ldjpbign.exeC:\Windows\system32\Ldjpbign.exe80⤵PID:568
-
C:\Windows\SysWOW64\Ljghjpfe.exeC:\Windows\system32\Ljghjpfe.exe81⤵PID:1608
-
C:\Windows\SysWOW64\Lqqpgj32.exeC:\Windows\system32\Lqqpgj32.exe82⤵PID:1960
-
C:\Windows\SysWOW64\Lkfddc32.exeC:\Windows\system32\Lkfddc32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3020 -
C:\Windows\SysWOW64\Lcaiiejc.exeC:\Windows\system32\Lcaiiejc.exe84⤵PID:1252
-
C:\Windows\SysWOW64\Lngnfnji.exeC:\Windows\system32\Lngnfnji.exe85⤵PID:1088
-
C:\Windows\SysWOW64\Lqejbiim.exeC:\Windows\system32\Lqejbiim.exe86⤵PID:1484
-
C:\Windows\SysWOW64\Lgoboc32.exeC:\Windows\system32\Lgoboc32.exe87⤵PID:2892
-
C:\Windows\SysWOW64\Liqoflfh.exeC:\Windows\system32\Liqoflfh.exe88⤵PID:2860
-
C:\Windows\SysWOW64\Lcfbdd32.exeC:\Windows\system32\Lcfbdd32.exe89⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1560 -
C:\Windows\SysWOW64\Mjpkqonj.exeC:\Windows\system32\Mjpkqonj.exe90⤵PID:1784
-
C:\Windows\SysWOW64\Mmogmjmn.exeC:\Windows\system32\Mmogmjmn.exe91⤵PID:1792
-
C:\Windows\SysWOW64\Mejlalji.exeC:\Windows\system32\Mejlalji.exe92⤵PID:1520
-
C:\Windows\SysWOW64\Mkddnf32.exeC:\Windows\system32\Mkddnf32.exe93⤵PID:2716
-
C:\Windows\SysWOW64\Mbnljqic.exeC:\Windows\system32\Mbnljqic.exe94⤵PID:2924
-
C:\Windows\SysWOW64\Mlfacfpc.exeC:\Windows\system32\Mlfacfpc.exe95⤵PID:2440
-
C:\Windows\SysWOW64\Mbpipp32.exeC:\Windows\system32\Mbpipp32.exe96⤵PID:2356
-
C:\Windows\SysWOW64\Mijamjnm.exeC:\Windows\system32\Mijamjnm.exe97⤵PID:2952
-
C:\Windows\SysWOW64\Mngjeamd.exeC:\Windows\system32\Mngjeamd.exe98⤵PID:2204
-
C:\Windows\SysWOW64\Mccbmh32.exeC:\Windows\system32\Mccbmh32.exe99⤵PID:1796
-
C:\Windows\SysWOW64\Mlkjne32.exeC:\Windows\system32\Mlkjne32.exe100⤵
- Modifies registry class
PID:2792 -
C:\Windows\SysWOW64\Nagbgl32.exeC:\Windows\system32\Nagbgl32.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1304 -
C:\Windows\SysWOW64\Nfdkoc32.exeC:\Windows\system32\Nfdkoc32.exe102⤵PID:1620
-
C:\Windows\SysWOW64\Najpll32.exeC:\Windows\system32\Najpll32.exe103⤵PID:936
-
C:\Windows\SysWOW64\Nfghdcfj.exeC:\Windows\system32\Nfghdcfj.exe104⤵PID:324
-
C:\Windows\SysWOW64\Nallalep.exeC:\Windows\system32\Nallalep.exe105⤵PID:1308
-
C:\Windows\SysWOW64\Nbniid32.exeC:\Windows\system32\Nbniid32.exe106⤵PID:340
-
C:\Windows\SysWOW64\Njdqka32.exeC:\Windows\system32\Njdqka32.exe107⤵PID:2760
-
C:\Windows\SysWOW64\Nlfmbibo.exeC:\Windows\system32\Nlfmbibo.exe108⤵PID:1500
-
C:\Windows\SysWOW64\Ndmecgba.exeC:\Windows\system32\Ndmecgba.exe109⤵PID:1352
-
C:\Windows\SysWOW64\Nijnln32.exeC:\Windows\system32\Nijnln32.exe110⤵PID:2712
-
C:\Windows\SysWOW64\Npdfhhhe.exeC:\Windows\system32\Npdfhhhe.exe111⤵PID:2660
-
C:\Windows\SysWOW64\Oonldcih.exeC:\Windows\system32\Oonldcih.exe112⤵PID:2400
-
C:\Windows\SysWOW64\Ohfqmi32.exeC:\Windows\system32\Ohfqmi32.exe113⤵PID:1648
-
C:\Windows\SysWOW64\Oanefo32.exeC:\Windows\system32\Oanefo32.exe114⤵PID:1996
-
C:\Windows\SysWOW64\Oijjka32.exeC:\Windows\system32\Oijjka32.exe115⤵PID:1452
-
C:\Windows\SysWOW64\Oaqbln32.exeC:\Windows\system32\Oaqbln32.exe116⤵PID:2076
-
C:\Windows\SysWOW64\Pgnjde32.exeC:\Windows\system32\Pgnjde32.exe117⤵PID:2932
-
C:\Windows\SysWOW64\Pilfpqaa.exeC:\Windows\system32\Pilfpqaa.exe118⤵PID:1284
-
C:\Windows\SysWOW64\Pdakniag.exeC:\Windows\system32\Pdakniag.exe119⤵PID:1324
-
C:\Windows\SysWOW64\Pecgea32.exeC:\Windows\system32\Pecgea32.exe120⤵PID:2940
-
C:\Windows\SysWOW64\Plmpblnb.exeC:\Windows\system32\Plmpblnb.exe121⤵PID:1004
-
C:\Windows\SysWOW64\Pcghof32.exeC:\Windows\system32\Pcghof32.exe122⤵PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-