Analysis
-
max time kernel
146s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:30
Static task
static1
Behavioral task
behavioral1
Sample
7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe
-
Size
1.3MB
-
MD5
7868d805ce1d3fdcc539238cadff80f0
-
SHA1
32be0cadd3d7662a12f8458aa50f557c1408466c
-
SHA256
f207e8be863a68075bb01a862fa73a865afee43851ddf3741297a82b3689f084
-
SHA512
95db88bf804e17923e3aff20c8c376853e9185071b7cdb366ab8d55cba4a254e1e361a0d61bba93efe8a7e821d378199e1236edfd0584e83ec6ac357d7a47cd8
-
SSDEEP
6144:Iy/A+HGhxjVJyE5ZC2npb+oB+Zz2HG8t0DoEWufVuvw0HBHY8rQ+6bPD3wPSk8ym:ZHOVsAbaz22cWfVaw0HBHY8r8ABjMn
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Hipkdnmf.exeNhiholof.exeOifdbb32.exeAffdle32.exeAababceh.exeLpbefoai.exeIlqpdm32.exeFbdlkj32.exeNpdfhhhe.exeQqfkln32.exeQbelgood.exeCgpjlnhh.exeGmoqnhla.exeLqcmmjko.exeMfdopp32.exeNkbhgojk.exePogclp32.exeHicodd32.exeHejoiedd.exeAbmbhn32.exeFhikme32.exeHpocfncj.exeGcglec32.exeIecdhm32.exeNocemcbj.exeGhmkjedk.exePkjmoj32.exeFpicodoj.exeFheabelm.exePnalad32.exeDmoipopd.exeGphmeo32.exeJbjochdi.exeDlkepi32.exeLgmcqkkh.exeAfohaa32.exeFnfamcoj.exeDiibag32.exePegqpacp.exeEfqbglen.exePohfehdi.exeGmecmg32.exeNlfmbibo.exeKincipnk.exePokieo32.exeEpoqde32.exeFiokbjgn.exeIibfajdc.exeFaokjpfd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hipkdnmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nhiholof.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oifdbb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Affdle32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aababceh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpbefoai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ilqpdm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fbdlkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Npdfhhhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Qqfkln32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qbelgood.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Cgpjlnhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gmoqnhla.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lqcmmjko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mfdopp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Nkbhgojk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pogclp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hicodd32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hejoiedd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Abmbhn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fhikme32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpocfncj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gcglec32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iecdhm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nocemcbj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ghmkjedk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pkjmoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpicodoj.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fheabelm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pnalad32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dmoipopd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gphmeo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jbjochdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dlkepi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lgmcqkkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Afohaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fnfamcoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Diibag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Pegqpacp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Efqbglen.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pohfehdi.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gmecmg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nlfmbibo.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kincipnk.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pokieo32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epoqde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fiokbjgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Iibfajdc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Faokjpfd.exe -
Executes dropped EXE 64 IoCs
Processes:
Mohbip32.exeMdejaf32.exeMhqfbebj.exeNpnhlg32.exeNcmdhb32.exeNleiqhcg.exeNocemcbj.exeOnphoo32.exeOdjpkihg.exeOkchhc32.exeOgjimd32.exeOkfencna.exeOmgaek32.exePaejki32.exePiblek32.exePlahag32.exePchpbded.exePmqdkj32.exeQdccfh32.exeQljkhe32.exeQnigda32.exeQagcpljo.exeAnkdiqih.exeAplpai32.exeAjbdna32.exeAmpqjm32.exeAdmemg32.exeAenbdoii.exeAepojo32.exeAljgfioc.exeBingpmnl.exeBkodhe32.exeBaildokg.exeBhcdaibd.exeBloqah32.exeBegeknan.exeBdlblj32.exeBgknheej.exeBkfjhd32.exeBjijdadm.exeBaqbenep.exeBpcbqk32.exeBdooajdc.exeBcaomf32.exeCngcjo32.exeCljcelan.exeCdakgibq.exeCcdlbf32.exeCjndop32.exeCllpkl32.exeCphlljge.exeCoklgg32.exeCgbdhd32.exeComimg32.exeCciemedf.exeCciemedf.exeCbkeib32.exeCjbmjplb.exeClaifkkf.exeCkdjbh32.exeCopfbfjj.exeCfinoq32.exeCdlnkmha.exeCobbhfhg.exepid process 320 Mohbip32.exe 1440 Mdejaf32.exe 2596 Mhqfbebj.exe 2236 Npnhlg32.exe 2612 Ncmdhb32.exe 2752 Nleiqhcg.exe 2496 Nocemcbj.exe 2892 Onphoo32.exe 2800 Odjpkihg.exe 704 Okchhc32.exe 3040 Ogjimd32.exe 1640 Okfencna.exe 1284 Omgaek32.exe 1332 Paejki32.exe 1968 Piblek32.exe 584 Plahag32.exe 1008 Pchpbded.exe 2424 Pmqdkj32.exe 2492 Qdccfh32.exe 380 Qljkhe32.exe 1368 Qnigda32.exe 796 Qagcpljo.exe 916 Ankdiqih.exe 2208 Aplpai32.exe 2932 Ajbdna32.exe 900 Ampqjm32.exe 1712 Admemg32.exe 2220 Aenbdoii.exe 2268 Aepojo32.exe 2680 Aljgfioc.exe 2588 Bingpmnl.exe 2744 Bkodhe32.exe 1836 Baildokg.exe 3052 Bhcdaibd.exe 2972 Bloqah32.exe 3032 Begeknan.exe 2556 Bdlblj32.exe 2764 Bgknheej.exe 1536 Bkfjhd32.exe 924 Bjijdadm.exe 852 Baqbenep.exe 2848 Bpcbqk32.exe 2244 Bdooajdc.exe 964 Bcaomf32.exe 1676 Cngcjo32.exe 2376 Cljcelan.exe 1588 Cdakgibq.exe 540 Ccdlbf32.exe 1800 Cjndop32.exe 2388 Cllpkl32.exe 2252 Cphlljge.exe 1496 Coklgg32.exe 2452 Cgbdhd32.exe 2660 Comimg32.exe 1516 Cciemedf.exe 2476 Cciemedf.exe 2996 Cbkeib32.exe 2464 Cjbmjplb.exe 2332 Claifkkf.exe 2004 Ckdjbh32.exe 772 Copfbfjj.exe 2144 Cfinoq32.exe 1708 Cdlnkmha.exe 1012 Cobbhfhg.exe -
Loads dropped DLL 64 IoCs
Processes:
7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exeMohbip32.exeMdejaf32.exeMhqfbebj.exeNpnhlg32.exeNcmdhb32.exeNleiqhcg.exeNocemcbj.exeOnphoo32.exeOdjpkihg.exeOkchhc32.exeOgjimd32.exeOkfencna.exeOmgaek32.exePaejki32.exePiblek32.exePlahag32.exePchpbded.exePmqdkj32.exeQdccfh32.exeQljkhe32.exeQnigda32.exeQagcpljo.exeAnkdiqih.exeAplpai32.exeAjbdna32.exeAmpqjm32.exeAdmemg32.exeAenbdoii.exeAepojo32.exeAljgfioc.exeBingpmnl.exepid process 2212 7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe 2212 7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe 320 Mohbip32.exe 320 Mohbip32.exe 1440 Mdejaf32.exe 1440 Mdejaf32.exe 2596 Mhqfbebj.exe 2596 Mhqfbebj.exe 2236 Npnhlg32.exe 2236 Npnhlg32.exe 2612 Ncmdhb32.exe 2612 Ncmdhb32.exe 2752 Nleiqhcg.exe 2752 Nleiqhcg.exe 2496 Nocemcbj.exe 2496 Nocemcbj.exe 2892 Onphoo32.exe 2892 Onphoo32.exe 2800 Odjpkihg.exe 2800 Odjpkihg.exe 704 Okchhc32.exe 704 Okchhc32.exe 3040 Ogjimd32.exe 3040 Ogjimd32.exe 1640 Okfencna.exe 1640 Okfencna.exe 1284 Omgaek32.exe 1284 Omgaek32.exe 1332 Paejki32.exe 1332 Paejki32.exe 1968 Piblek32.exe 1968 Piblek32.exe 584 Plahag32.exe 584 Plahag32.exe 1008 Pchpbded.exe 1008 Pchpbded.exe 2424 Pmqdkj32.exe 2424 Pmqdkj32.exe 2492 Qdccfh32.exe 2492 Qdccfh32.exe 380 Qljkhe32.exe 380 Qljkhe32.exe 1368 Qnigda32.exe 1368 Qnigda32.exe 796 Qagcpljo.exe 796 Qagcpljo.exe 916 Ankdiqih.exe 916 Ankdiqih.exe 2208 Aplpai32.exe 2208 Aplpai32.exe 2932 Ajbdna32.exe 2932 Ajbdna32.exe 900 Ampqjm32.exe 900 Ampqjm32.exe 1712 Admemg32.exe 1712 Admemg32.exe 2220 Aenbdoii.exe 2220 Aenbdoii.exe 2268 Aepojo32.exe 2268 Aepojo32.exe 2680 Aljgfioc.exe 2680 Aljgfioc.exe 2588 Bingpmnl.exe 2588 Bingpmnl.exe -
Drops file in System32 directory 64 IoCs
Processes:
Kjqccigf.exeGmdadnkh.exeLbogfcjc.exeFbgmbg32.exeKgbipf32.exeAbmbhn32.exeHajinjff.exeNpijoj32.exeBdeeqehb.exeMkddnf32.exeOlkfmi32.exeOghhfg32.exeLmgalkcf.exeFlgeqgog.exePikkiijf.exeIabhah32.exeKifpdelo.exeEqbddk32.exeGjdhbc32.exeJchhkjhn.exeFiokbjgn.exeGffoldhp.exeKjifhc32.exeHelgmg32.exeGpabcbdb.exeLjkaeo32.exeLjnnko32.exeEijcpoac.exeJmmfkafa.exeFcefji32.exeGebbnpfp.exeAmnocpdk.exePpcbgkka.exePbhmnkjf.exeMkmhaj32.exeKnmamp32.exeNkhdkgnj.exeBekkcljk.exeOopnlacm.exeQeaedd32.exeGhiaof32.exeMpbdnk32.exeCmpdgf32.exeDnlidb32.exeIlncom32.exeKgcpjmcb.exeNocnbmoo.exeGhcoqh32.exeIiecgjba.exeHkpnhgge.exeNlfmbibo.exedescription ioc process File created C:\Windows\SysWOW64\Kjcpii32.exe Kjqccigf.exe File created C:\Windows\SysWOW64\Oagcgibo.dll Gmdadnkh.exe File opened for modification C:\Windows\SysWOW64\Eeaepd32.exe File created C:\Windows\SysWOW64\Okhdnm32.dll File created C:\Windows\SysWOW64\Jkgajhcc.dll Lbogfcjc.exe File created C:\Windows\SysWOW64\Eifppipg.dll File created C:\Windows\SysWOW64\Kifjcn32.dll Fbgmbg32.exe File created C:\Windows\SysWOW64\Kfeikcfa.exe Kgbipf32.exe File created C:\Windows\SysWOW64\Ieajkfmd.exe File created C:\Windows\SysWOW64\Pgddfe32.dll File opened for modification C:\Windows\SysWOW64\Aemkjiem.exe Abmbhn32.exe File created C:\Windows\SysWOW64\Kldhfkql.dll Hajinjff.exe File created C:\Windows\SysWOW64\Okppejbk.dll Npijoj32.exe File created C:\Windows\SysWOW64\Bkommo32.exe Bdeeqehb.exe File created C:\Windows\SysWOW64\Iiegdegb.dll Mkddnf32.exe File created C:\Windows\SysWOW64\Opfbngfb.exe Olkfmi32.exe File opened for modification C:\Windows\SysWOW64\Oifdbb32.exe Oghhfg32.exe File created C:\Windows\SysWOW64\Lqcmmjko.exe Lmgalkcf.exe File created C:\Windows\SysWOW64\Hcenjk32.dll File created C:\Windows\SysWOW64\Fnfamcoj.exe Flgeqgog.exe File created C:\Windows\SysWOW64\Dmmmfc32.exe File created C:\Windows\SysWOW64\Qmfgjh32.exe Pikkiijf.exe File created C:\Windows\SysWOW64\Bfomkg32.dll Iabhah32.exe File created C:\Windows\SysWOW64\Fgpomb32.dll File opened for modification C:\Windows\SysWOW64\Lpbefoai.exe Kifpdelo.exe File created C:\Windows\SysWOW64\Ecqqpgli.exe Eqbddk32.exe File created C:\Windows\SysWOW64\Mmjhjhkh.dll Gjdhbc32.exe File opened for modification C:\Windows\SysWOW64\Jkoplhip.exe Jchhkjhn.exe File created C:\Windows\SysWOW64\Fpicodoj.exe Fiokbjgn.exe File created C:\Windows\SysWOW64\Gjakmc32.exe Gffoldhp.exe File created C:\Windows\SysWOW64\Kmcipd32.dll Kjifhc32.exe File opened for modification C:\Windows\SysWOW64\Hfmddp32.exe Helgmg32.exe File opened for modification C:\Windows\SysWOW64\Nhgnaehm.exe File created C:\Windows\SysWOW64\Cnmfdb32.exe File opened for modification C:\Windows\SysWOW64\Gghkdp32.exe Gpabcbdb.exe File opened for modification C:\Windows\SysWOW64\Lmjnak32.exe Ljkaeo32.exe File created C:\Windows\SysWOW64\Lmljgj32.exe Ljnnko32.exe File created C:\Windows\SysWOW64\Kcfdakpf.dll Eijcpoac.exe File created C:\Windows\SysWOW64\Jkpgfn32.exe Jmmfkafa.exe File opened for modification C:\Windows\SysWOW64\Fhqbkhch.exe Fcefji32.exe File created C:\Windows\SysWOW64\Ghfnkn32.dll Gebbnpfp.exe File created C:\Windows\SysWOW64\Jchgdg32.dll Amnocpdk.exe File created C:\Windows\SysWOW64\Aedcngmm.dll Ppcbgkka.exe File created C:\Windows\SysWOW64\Pmanoifd.exe Pbhmnkjf.exe File created C:\Windows\SysWOW64\Noomnjpj.dll Mkmhaj32.exe File opened for modification C:\Windows\SysWOW64\Kgefefnd.exe Knmamp32.exe File created C:\Windows\SysWOW64\Mjhocpkj.dll Nkhdkgnj.exe File created C:\Windows\SysWOW64\Haloha32.dll Bekkcljk.exe File opened for modification C:\Windows\SysWOW64\Jolghndm.exe File created C:\Windows\SysWOW64\Necfoajd.dll Oopnlacm.exe File created C:\Windows\SysWOW64\Hjojco32.dll Qeaedd32.exe File opened for modification C:\Windows\SysWOW64\Gihniioc.exe Ghiaof32.exe File created C:\Windows\SysWOW64\Dpccjn32.dll Mpbdnk32.exe File created C:\Windows\SysWOW64\Cpnaca32.exe Cmpdgf32.exe File created C:\Windows\SysWOW64\Naeqjnho.dll Dnlidb32.exe File created C:\Windows\SysWOW64\Ijbdha32.exe Ilncom32.exe File opened for modification C:\Windows\SysWOW64\Knmhgf32.exe Kgcpjmcb.exe File opened for modification C:\Windows\SysWOW64\Kdnild32.exe File created C:\Windows\SysWOW64\Nnennj32.exe Nocnbmoo.exe File created C:\Windows\SysWOW64\Aobmncbj.dll Ghcoqh32.exe File created C:\Windows\SysWOW64\Ibmgpoia.exe Iiecgjba.exe File created C:\Windows\SysWOW64\Hkkmeglp.dll Hkpnhgge.exe File created C:\Windows\SysWOW64\Nbpeoc32.exe Nlfmbibo.exe File created C:\Windows\SysWOW64\Lecpilip.dll -
Program crash 1 IoCs
Processes:
pid pid_target process target process 7328 6196 -
Modifies registry class 64 IoCs
Processes:
Plahag32.exeLgmcqkkh.exeHobcak32.exeOopfakpa.exeDepbfhpe.exeKdbpnk32.exeCfhiplmp.exeQeaedd32.exeNbjcqe32.exe7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exeDjpmccqq.exeAlpmfdcb.exeIefamlak.exeCllkin32.exeBgknheej.exeOkikfagn.exeOkfencna.exeKahojc32.exeNfcbldmm.exeFgcejm32.exeIaeiieeb.exeNhfipcid.exeNdhipoob.exeLjabkeaf.exeQgmfchei.exeFlgeqgog.exeGjakmc32.exeJplkmgol.exeHicodd32.exeDojald32.exeGmpgio32.exeEpoqde32.exeGildahhp.exeKcbakpdo.exeBjdplm32.exeJdejhfig.exeKoddccaa.exeOdlojanh.exeNcjqhmkm.exeNmhmlbkk.exeAgjmim32.exeDbbkja32.exeLcncpfaf.exeMdejaf32.exeAnafhopc.exeBoqbfb32.exeAijpnfif.exeIppbnjni.exeEchfaf32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Plahag32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnecbc32.dll" Lgmcqkkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hobcak32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oopfakpa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjmglpp.dll" Depbfhpe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Kdbpnk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cfhiplmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpomb32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlionk32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjojco32.dll" Qeaedd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dodnpp32.dll" Nbjcqe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhdnm32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" 7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Djpmccqq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmfmjjgm.dll" Alpmfdcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pimkgkgm.dll" Iefamlak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cllkin32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Bgknheej.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Okikfagn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enemcbio.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikeelnol.dll" Okfencna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kahojc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Nfcbldmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkbeabf.dll" Fgcejm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iaeiieeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljdpbcc.dll" Nhfipcid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcpnnfqg.dll" Ndhipoob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edmkdcdl.dll" Ljabkeaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qgmfchei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgphd32.dll" Flgeqgog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gjakmc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfcaiilc.dll" Jplkmgol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnbnfb32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejemnf.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgpdcgoc.dll" Hicodd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Dojald32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihicd32.dll" Gmpgio32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Epoqde32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Gildahhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Kcbakpdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjnolikh.dll" Bjdplm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jdejhfig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Koddccaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gphfihaj.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Odlojanh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ncjqhmkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Iefamlak.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Nmhmlbkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Agjmim32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkcmiimi.dll" Dbbkja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lcncpfaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Mdejaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccnnibig.dll" Anafhopc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qpmnhglp.dll" Boqbfb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aijpnfif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhmone32.dll" Ippbnjni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmkmmi32.dll" Echfaf32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exeMohbip32.exeMdejaf32.exeMhqfbebj.exeNpnhlg32.exeNcmdhb32.exeNleiqhcg.exeNocemcbj.exeOnphoo32.exeOdjpkihg.exeOkchhc32.exeOgjimd32.exeOkfencna.exeOmgaek32.exePaejki32.exePiblek32.exedescription pid process target process PID 2212 wrote to memory of 320 2212 7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe Amkbnp32.exe PID 2212 wrote to memory of 320 2212 7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe Amkbnp32.exe PID 2212 wrote to memory of 320 2212 7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe Amkbnp32.exe PID 2212 wrote to memory of 320 2212 7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe Amkbnp32.exe PID 320 wrote to memory of 1440 320 Mohbip32.exe Mdejaf32.exe PID 320 wrote to memory of 1440 320 Mohbip32.exe Mdejaf32.exe PID 320 wrote to memory of 1440 320 Mohbip32.exe Mdejaf32.exe PID 320 wrote to memory of 1440 320 Mohbip32.exe Mdejaf32.exe PID 1440 wrote to memory of 2596 1440 Mdejaf32.exe Bpjkiogm.exe PID 1440 wrote to memory of 2596 1440 Mdejaf32.exe Bpjkiogm.exe PID 1440 wrote to memory of 2596 1440 Mdejaf32.exe Bpjkiogm.exe PID 1440 wrote to memory of 2596 1440 Mdejaf32.exe Bpjkiogm.exe PID 2596 wrote to memory of 2236 2596 Mhqfbebj.exe Npnhlg32.exe PID 2596 wrote to memory of 2236 2596 Mhqfbebj.exe Npnhlg32.exe PID 2596 wrote to memory of 2236 2596 Mhqfbebj.exe Npnhlg32.exe PID 2596 wrote to memory of 2236 2596 Mhqfbebj.exe Npnhlg32.exe PID 2236 wrote to memory of 2612 2236 Npnhlg32.exe Ncmdhb32.exe PID 2236 wrote to memory of 2612 2236 Npnhlg32.exe Ncmdhb32.exe PID 2236 wrote to memory of 2612 2236 Npnhlg32.exe Ncmdhb32.exe PID 2236 wrote to memory of 2612 2236 Npnhlg32.exe Ncmdhb32.exe PID 2612 wrote to memory of 2752 2612 Ncmdhb32.exe Nleiqhcg.exe PID 2612 wrote to memory of 2752 2612 Ncmdhb32.exe Nleiqhcg.exe PID 2612 wrote to memory of 2752 2612 Ncmdhb32.exe Nleiqhcg.exe PID 2612 wrote to memory of 2752 2612 Ncmdhb32.exe Nleiqhcg.exe PID 2752 wrote to memory of 2496 2752 Nleiqhcg.exe Nocemcbj.exe PID 2752 wrote to memory of 2496 2752 Nleiqhcg.exe Nocemcbj.exe PID 2752 wrote to memory of 2496 2752 Nleiqhcg.exe Nocemcbj.exe PID 2752 wrote to memory of 2496 2752 Nleiqhcg.exe Nocemcbj.exe PID 2496 wrote to memory of 2892 2496 Nocemcbj.exe Onphoo32.exe PID 2496 wrote to memory of 2892 2496 Nocemcbj.exe Onphoo32.exe PID 2496 wrote to memory of 2892 2496 Nocemcbj.exe Onphoo32.exe PID 2496 wrote to memory of 2892 2496 Nocemcbj.exe Onphoo32.exe PID 2892 wrote to memory of 2800 2892 Onphoo32.exe Odjpkihg.exe PID 2892 wrote to memory of 2800 2892 Onphoo32.exe Odjpkihg.exe PID 2892 wrote to memory of 2800 2892 Onphoo32.exe Odjpkihg.exe PID 2892 wrote to memory of 2800 2892 Onphoo32.exe Odjpkihg.exe PID 2800 wrote to memory of 704 2800 Odjpkihg.exe Fgohna32.exe PID 2800 wrote to memory of 704 2800 Odjpkihg.exe Fgohna32.exe PID 2800 wrote to memory of 704 2800 Odjpkihg.exe Fgohna32.exe PID 2800 wrote to memory of 704 2800 Odjpkihg.exe Fgohna32.exe PID 704 wrote to memory of 3040 704 Okchhc32.exe Ogjimd32.exe PID 704 wrote to memory of 3040 704 Okchhc32.exe Ogjimd32.exe PID 704 wrote to memory of 3040 704 Okchhc32.exe Ogjimd32.exe PID 704 wrote to memory of 3040 704 Okchhc32.exe Ogjimd32.exe PID 3040 wrote to memory of 1640 3040 Ogjimd32.exe Okfencna.exe PID 3040 wrote to memory of 1640 3040 Ogjimd32.exe Okfencna.exe PID 3040 wrote to memory of 1640 3040 Ogjimd32.exe Okfencna.exe PID 3040 wrote to memory of 1640 3040 Ogjimd32.exe Okfencna.exe PID 1640 wrote to memory of 1284 1640 Okfencna.exe Omgaek32.exe PID 1640 wrote to memory of 1284 1640 Okfencna.exe Omgaek32.exe PID 1640 wrote to memory of 1284 1640 Okfencna.exe Omgaek32.exe PID 1640 wrote to memory of 1284 1640 Okfencna.exe Omgaek32.exe PID 1284 wrote to memory of 1332 1284 Omgaek32.exe Paejki32.exe PID 1284 wrote to memory of 1332 1284 Omgaek32.exe Paejki32.exe PID 1284 wrote to memory of 1332 1284 Omgaek32.exe Paejki32.exe PID 1284 wrote to memory of 1332 1284 Omgaek32.exe Paejki32.exe PID 1332 wrote to memory of 1968 1332 Paejki32.exe Piblek32.exe PID 1332 wrote to memory of 1968 1332 Paejki32.exe Piblek32.exe PID 1332 wrote to memory of 1968 1332 Paejki32.exe Piblek32.exe PID 1332 wrote to memory of 1968 1332 Paejki32.exe Piblek32.exe PID 1968 wrote to memory of 584 1968 Piblek32.exe Plahag32.exe PID 1968 wrote to memory of 584 1968 Piblek32.exe Plahag32.exe PID 1968 wrote to memory of 584 1968 Piblek32.exe Plahag32.exe PID 1968 wrote to memory of 584 1968 Piblek32.exe Plahag32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7868d805ce1d3fdcc539238cadff80f0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Mohbip32.exeC:\Windows\system32\Mohbip32.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\Mdejaf32.exeC:\Windows\system32\Mdejaf32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\Mhqfbebj.exeC:\Windows\system32\Mhqfbebj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Npnhlg32.exeC:\Windows\system32\Npnhlg32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\Ncmdhb32.exeC:\Windows\system32\Ncmdhb32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Nleiqhcg.exeC:\Windows\system32\Nleiqhcg.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Nocemcbj.exeC:\Windows\system32\Nocemcbj.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\Onphoo32.exeC:\Windows\system32\Onphoo32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\Odjpkihg.exeC:\Windows\system32\Odjpkihg.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\Okchhc32.exeC:\Windows\system32\Okchhc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\Ogjimd32.exeC:\Windows\system32\Ogjimd32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Okfencna.exeC:\Windows\system32\Okfencna.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\Omgaek32.exeC:\Windows\system32\Omgaek32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\Paejki32.exeC:\Windows\system32\Paejki32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\Piblek32.exeC:\Windows\system32\Piblek32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\Plahag32.exeC:\Windows\system32\Plahag32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:584 -
C:\Windows\SysWOW64\Pchpbded.exeC:\Windows\system32\Pchpbded.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Windows\SysWOW64\Pmqdkj32.exeC:\Windows\system32\Pmqdkj32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Windows\SysWOW64\Qdccfh32.exeC:\Windows\system32\Qdccfh32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Windows\SysWOW64\Qljkhe32.exeC:\Windows\system32\Qljkhe32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Windows\SysWOW64\Qnigda32.exeC:\Windows\system32\Qnigda32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Windows\SysWOW64\Qagcpljo.exeC:\Windows\system32\Qagcpljo.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Windows\SysWOW64\Ankdiqih.exeC:\Windows\system32\Ankdiqih.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Windows\SysWOW64\Aplpai32.exeC:\Windows\system32\Aplpai32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Windows\SysWOW64\Ajbdna32.exeC:\Windows\system32\Ajbdna32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Windows\SysWOW64\Ampqjm32.exeC:\Windows\system32\Ampqjm32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Windows\SysWOW64\Admemg32.exeC:\Windows\system32\Admemg32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Windows\SysWOW64\Aenbdoii.exeC:\Windows\system32\Aenbdoii.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Windows\SysWOW64\Aepojo32.exeC:\Windows\system32\Aepojo32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Windows\SysWOW64\Aljgfioc.exeC:\Windows\system32\Aljgfioc.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Windows\SysWOW64\Bingpmnl.exeC:\Windows\system32\Bingpmnl.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Windows\SysWOW64\Bkodhe32.exeC:\Windows\system32\Bkodhe32.exe33⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\Baildokg.exeC:\Windows\system32\Baildokg.exe34⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\SysWOW64\Bhcdaibd.exeC:\Windows\system32\Bhcdaibd.exe35⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\Bloqah32.exeC:\Windows\system32\Bloqah32.exe36⤵
- Executes dropped EXE
PID:2972 -
C:\Windows\SysWOW64\Begeknan.exeC:\Windows\system32\Begeknan.exe37⤵
- Executes dropped EXE
PID:3032 -
C:\Windows\SysWOW64\Bdlblj32.exeC:\Windows\system32\Bdlblj32.exe38⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\SysWOW64\Bgknheej.exeC:\Windows\system32\Bgknheej.exe39⤵
- Executes dropped EXE
- Modifies registry class
PID:2764 -
C:\Windows\SysWOW64\Bkfjhd32.exeC:\Windows\system32\Bkfjhd32.exe40⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\Bjijdadm.exeC:\Windows\system32\Bjijdadm.exe41⤵
- Executes dropped EXE
PID:924 -
C:\Windows\SysWOW64\Baqbenep.exeC:\Windows\system32\Baqbenep.exe42⤵
- Executes dropped EXE
PID:852 -
C:\Windows\SysWOW64\Bpcbqk32.exeC:\Windows\system32\Bpcbqk32.exe43⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\Bdooajdc.exeC:\Windows\system32\Bdooajdc.exe44⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\Bcaomf32.exeC:\Windows\system32\Bcaomf32.exe45⤵
- Executes dropped EXE
PID:964 -
C:\Windows\SysWOW64\Cngcjo32.exeC:\Windows\system32\Cngcjo32.exe46⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\SysWOW64\Cljcelan.exeC:\Windows\system32\Cljcelan.exe47⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\Cdakgibq.exeC:\Windows\system32\Cdakgibq.exe48⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\SysWOW64\Ccdlbf32.exeC:\Windows\system32\Ccdlbf32.exe49⤵
- Executes dropped EXE
PID:540 -
C:\Windows\SysWOW64\Cjndop32.exeC:\Windows\system32\Cjndop32.exe50⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\Cllpkl32.exeC:\Windows\system32\Cllpkl32.exe51⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Cphlljge.exeC:\Windows\system32\Cphlljge.exe52⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\SysWOW64\Coklgg32.exeC:\Windows\system32\Coklgg32.exe53⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\Cgbdhd32.exeC:\Windows\system32\Cgbdhd32.exe54⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\Comimg32.exeC:\Windows\system32\Comimg32.exe55⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\Cciemedf.exeC:\Windows\system32\Cciemedf.exe56⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\SysWOW64\Cciemedf.exeC:\Windows\system32\Cciemedf.exe57⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\Cbkeib32.exeC:\Windows\system32\Cbkeib32.exe58⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\SysWOW64\Cjbmjplb.exeC:\Windows\system32\Cjbmjplb.exe59⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\Claifkkf.exeC:\Windows\system32\Claifkkf.exe60⤵
- Executes dropped EXE
PID:2332 -
C:\Windows\SysWOW64\Ckdjbh32.exeC:\Windows\system32\Ckdjbh32.exe61⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\Copfbfjj.exeC:\Windows\system32\Copfbfjj.exe62⤵
- Executes dropped EXE
PID:772 -
C:\Windows\SysWOW64\Cfinoq32.exeC:\Windows\system32\Cfinoq32.exe63⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\Cdlnkmha.exeC:\Windows\system32\Cdlnkmha.exe64⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\Cobbhfhg.exeC:\Windows\system32\Cobbhfhg.exe65⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\SysWOW64\Dbpodagk.exeC:\Windows\system32\Dbpodagk.exe66⤵PID:812
-
C:\Windows\SysWOW64\Dflkdp32.exeC:\Windows\system32\Dflkdp32.exe67⤵PID:1136
-
C:\Windows\SysWOW64\Ddokpmfo.exeC:\Windows\system32\Ddokpmfo.exe68⤵PID:1748
-
C:\Windows\SysWOW64\Dgmglh32.exeC:\Windows\system32\Dgmglh32.exe69⤵PID:2536
-
C:\Windows\SysWOW64\Dkhcmgnl.exeC:\Windows\system32\Dkhcmgnl.exe70⤵PID:2480
-
C:\Windows\SysWOW64\Dbbkja32.exeC:\Windows\system32\Dbbkja32.exe71⤵
- Modifies registry class
PID:2760 -
C:\Windows\SysWOW64\Dbehoa32.exeC:\Windows\system32\Dbehoa32.exe72⤵PID:2356
-
C:\Windows\SysWOW64\Dqhhknjp.exeC:\Windows\system32\Dqhhknjp.exe73⤵PID:1804
-
C:\Windows\SysWOW64\Ddcdkl32.exeC:\Windows\system32\Ddcdkl32.exe74⤵PID:1444
-
C:\Windows\SysWOW64\Dgaqgh32.exeC:\Windows\system32\Dgaqgh32.exe75⤵PID:1764
-
C:\Windows\SysWOW64\Djpmccqq.exeC:\Windows\system32\Djpmccqq.exe76⤵
- Modifies registry class
PID:1432 -
C:\Windows\SysWOW64\Dnlidb32.exeC:\Windows\system32\Dnlidb32.exe77⤵
- Drops file in System32 directory
PID:1812 -
C:\Windows\SysWOW64\Dmoipopd.exeC:\Windows\system32\Dmoipopd.exe78⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1788 -
C:\Windows\SysWOW64\Ddeaalpg.exeC:\Windows\system32\Ddeaalpg.exe79⤵PID:1664
-
C:\Windows\SysWOW64\Dchali32.exeC:\Windows\system32\Dchali32.exe80⤵PID:2296
-
C:\Windows\SysWOW64\Dfgmhd32.exeC:\Windows\system32\Dfgmhd32.exe81⤵PID:1256
-
C:\Windows\SysWOW64\Djbiicon.exeC:\Windows\system32\Djbiicon.exe82⤵PID:2656
-
C:\Windows\SysWOW64\Dmafennb.exeC:\Windows\system32\Dmafennb.exe83⤵PID:2264
-
C:\Windows\SysWOW64\Dcknbh32.exeC:\Windows\system32\Dcknbh32.exe84⤵PID:944
-
C:\Windows\SysWOW64\Dfijnd32.exeC:\Windows\system32\Dfijnd32.exe85⤵PID:2928
-
C:\Windows\SysWOW64\Djefobmk.exeC:\Windows\system32\Djefobmk.exe86⤵PID:3028
-
C:\Windows\SysWOW64\Emcbkn32.exeC:\Windows\system32\Emcbkn32.exe87⤵PID:1308
-
C:\Windows\SysWOW64\Ebpkce32.exeC:\Windows\system32\Ebpkce32.exe88⤵PID:384
-
C:\Windows\SysWOW64\Eijcpoac.exeC:\Windows\system32\Eijcpoac.exe89⤵
- Drops file in System32 directory
PID:2872 -
C:\Windows\SysWOW64\Ekholjqg.exeC:\Windows\system32\Ekholjqg.exe90⤵PID:2072
-
C:\Windows\SysWOW64\Eilpeooq.exeC:\Windows\system32\Eilpeooq.exe91⤵PID:1520
-
C:\Windows\SysWOW64\Eecqjpee.exeC:\Windows\system32\Eecqjpee.exe92⤵PID:1864
-
C:\Windows\SysWOW64\Elmigj32.exeC:\Windows\system32\Elmigj32.exe93⤵PID:860
-
C:\Windows\SysWOW64\Ebgacddo.exeC:\Windows\system32\Ebgacddo.exe94⤵PID:2368
-
C:\Windows\SysWOW64\Eeempocb.exeC:\Windows\system32\Eeempocb.exe95⤵PID:2280
-
C:\Windows\SysWOW64\Eloemi32.exeC:\Windows\system32\Eloemi32.exe96⤵PID:2484
-
C:\Windows\SysWOW64\Ennaieib.exeC:\Windows\system32\Ennaieib.exe97⤵PID:2688
-
C:\Windows\SysWOW64\Ebinic32.exeC:\Windows\system32\Ebinic32.exe98⤵PID:2852
-
C:\Windows\SysWOW64\Fehjeo32.exeC:\Windows\system32\Fehjeo32.exe99⤵PID:2984
-
C:\Windows\SysWOW64\Fhffaj32.exeC:\Windows\system32\Fhffaj32.exe100⤵PID:1592
-
C:\Windows\SysWOW64\Flabbihl.exeC:\Windows\system32\Flabbihl.exe101⤵PID:1696
-
C:\Windows\SysWOW64\Fmcoja32.exeC:\Windows\system32\Fmcoja32.exe102⤵PID:644
-
C:\Windows\SysWOW64\Faokjpfd.exeC:\Windows\system32\Faokjpfd.exe103⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1964 -
C:\Windows\SysWOW64\Fcmgfkeg.exeC:\Windows\system32\Fcmgfkeg.exe104⤵PID:2604
-
C:\Windows\SysWOW64\Ffkcbgek.exeC:\Windows\system32\Ffkcbgek.exe105⤵PID:292
-
C:\Windows\SysWOW64\Faagpp32.exeC:\Windows\system32\Faagpp32.exe106⤵PID:1700
-
C:\Windows\SysWOW64\Fhkpmjln.exeC:\Windows\system32\Fhkpmjln.exe107⤵PID:2748
-
C:\Windows\SysWOW64\Ffnphf32.exeC:\Windows\system32\Ffnphf32.exe108⤵PID:3024
-
C:\Windows\SysWOW64\Filldb32.exeC:\Windows\system32\Filldb32.exe109⤵PID:3000
-
C:\Windows\SysWOW64\Fmhheqje.exeC:\Windows\system32\Fmhheqje.exe110⤵PID:1152
-
C:\Windows\SysWOW64\Fjlhneio.exeC:\Windows\system32\Fjlhneio.exe111⤵PID:2940
-
C:\Windows\SysWOW64\Fddmgjpo.exeC:\Windows\system32\Fddmgjpo.exe112⤵PID:2708
-
C:\Windows\SysWOW64\Fbgmbg32.exeC:\Windows\system32\Fbgmbg32.exe113⤵
- Drops file in System32 directory
PID:1684 -
C:\Windows\SysWOW64\Feeiob32.exeC:\Windows\system32\Feeiob32.exe114⤵PID:2136
-
C:\Windows\SysWOW64\Globlmmj.exeC:\Windows\system32\Globlmmj.exe115⤵PID:324
-
C:\Windows\SysWOW64\Gpknlk32.exeC:\Windows\system32\Gpknlk32.exe116⤵PID:1648
-
C:\Windows\SysWOW64\Gfefiemq.exeC:\Windows\system32\Gfefiemq.exe117⤵PID:2944
-
C:\Windows\SysWOW64\Gegfdb32.exeC:\Windows\system32\Gegfdb32.exe118⤵PID:2636
-
C:\Windows\SysWOW64\Glaoalkh.exeC:\Windows\system32\Glaoalkh.exe119⤵PID:1824
-
C:\Windows\SysWOW64\Gopkmhjk.exeC:\Windows\system32\Gopkmhjk.exe120⤵PID:2592
-
C:\Windows\SysWOW64\Ghmiam32.exeC:\Windows\system32\Ghmiam32.exe121⤵PID:1164
-
C:\Windows\SysWOW64\Gkkemh32.exeC:\Windows\system32\Gkkemh32.exe122⤵PID:700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-