Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 04:22
Behavioral task
behavioral1
Sample
2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe
-
Size
226KB
-
MD5
2cb9c11cb08aefa5418ed0d9c2618e80
-
SHA1
4d7eddda5c542a88daad62cbe8c16e0175ee1155
-
SHA256
1906918ba199b39ff36985f810c4b5d169320ca0ff86f883c0a3b7e5d49f16b7
-
SHA512
cdbf095d1bba9c9d0863791915344d7fd0f5d1f62d16c06033ccf51dbf108e4af59a30e419e7fe6d904e623e25df6aac512c1dce63191ec4b78295bc2927bc5f
-
SSDEEP
6144:ptbK2+nUivD1exXfxqySSKpRmSKeTk7eT5ABrnL8MdYg:pJLp5IKrEAlnLAg
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
Mmpijp32.exeCdfkolkf.exeIghhln32.exeGkhkjd32.exeLiddbc32.exeFkbkdkpp.exeNajceeoo.exeBopocbcq.exeLpekef32.exeKlkcdj32.exeDgejpd32.exeLieccf32.exeNnjlpo32.exeAmaqjp32.exeEpagkd32.exeHkjjlhle.exeEppqqn32.exeMaggnali.exeFkqeib32.exeIdgojc32.exeIfihif32.exeBcelmhen.exeKpepcedo.exeCpbbch32.exeLggldm32.exeMhbmphjm.exeHghoeqmp.exeLldfjh32.exeKiaqcnpb.exeCaienjfd.exeJnfcia32.exeGdhmnlcj.exeHmabdibj.exeLbngllob.exeGpcfmkff.exeQceiaa32.exeNnlhfn32.exeHpcodihc.exeAkhcfe32.exeNgmpcn32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mmpijp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cdfkolkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ighhln32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkhkjd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Liddbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkbkdkpp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Najceeoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Bopocbcq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lpekef32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klkcdj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgejpd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lieccf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnjlpo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Amaqjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Epagkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hkjjlhle.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eppqqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Maggnali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Fkqeib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Idgojc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ifihif32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcelmhen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Kpepcedo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cpbbch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lggldm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Mhbmphjm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hghoeqmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lldfjh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kiaqcnpb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Caienjfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Jnfcia32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdhmnlcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hmabdibj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Lbngllob.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Gpcfmkff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qceiaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnlhfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Hpcodihc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Akhcfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}" Ngmpcn32.exe -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\Windows\SysWOW64\Kgmlkp32.exe family_berbew C:\Windows\SysWOW64\Kacphh32.exe family_berbew C:\Windows\SysWOW64\Kpepcedo.exe family_berbew C:\Windows\SysWOW64\Kaemnhla.exe family_berbew C:\Windows\SysWOW64\Kbfiep32.exe family_berbew C:\Windows\SysWOW64\Kipabjil.exe family_berbew C:\Windows\SysWOW64\Kcifkp32.exe family_berbew C:\Windows\SysWOW64\Kmnjhioc.exe family_berbew C:\Windows\SysWOW64\Kdhbec32.exe family_berbew C:\Windows\SysWOW64\Liekmj32.exe family_berbew C:\Windows\SysWOW64\Lpocjdld.exe family_berbew C:\Windows\SysWOW64\Lkdggmlj.exe family_berbew C:\Windows\SysWOW64\Laopdgcg.exe family_berbew C:\Windows\SysWOW64\Lgkhlnbn.exe family_berbew C:\Windows\SysWOW64\Lnepih32.exe family_berbew C:\Windows\SysWOW64\Lcbiao32.exe family_berbew C:\Windows\SysWOW64\Lnhmng32.exe family_berbew C:\Windows\SysWOW64\Ldaeka32.exe family_berbew C:\Windows\SysWOW64\Ljnnch32.exe family_berbew C:\Windows\SysWOW64\Lphfpbdi.exe family_berbew C:\Windows\SysWOW64\Lknjmkdo.exe family_berbew C:\Windows\SysWOW64\Mpkbebbf.exe family_berbew C:\Windows\SysWOW64\Mdfofakp.exe family_berbew C:\Windows\SysWOW64\Majopeii.exe family_berbew C:\Windows\SysWOW64\Mnapdf32.exe family_berbew C:\Windows\SysWOW64\Mpolqa32.exe family_berbew C:\Windows\SysWOW64\Mjhqjg32.exe family_berbew C:\Windows\SysWOW64\Mjjmog32.exe family_berbew C:\Windows\SysWOW64\Mcbahlip.exe family_berbew C:\Windows\SysWOW64\Nacbfdao.exe family_berbew C:\Windows\SysWOW64\Nklfoi32.exe family_berbew C:\Windows\SysWOW64\Nddkgonp.exe family_berbew C:\Windows\SysWOW64\Njfmke32.exe family_berbew C:\Windows\SysWOW64\Ondeac32.exe family_berbew C:\Windows\SysWOW64\Occkojkm.exe family_berbew C:\Windows\SysWOW64\Onmhgb32.exe family_berbew C:\Windows\SysWOW64\Pkaiqf32.exe family_berbew C:\Windows\SysWOW64\Pcagphom.exe family_berbew C:\Windows\SysWOW64\Pjmlbbdg.exe family_berbew C:\Windows\SysWOW64\Qecppkdm.exe family_berbew C:\Windows\SysWOW64\Qnnanphk.exe family_berbew C:\Windows\SysWOW64\Bhkhibmc.exe family_berbew C:\Windows\SysWOW64\Clkndpag.exe family_berbew C:\Windows\SysWOW64\Ceaehfjj.exe family_berbew C:\Windows\SysWOW64\Clnjjpod.exe family_berbew C:\Windows\SysWOW64\Ekacmjgl.exe family_berbew C:\Windows\SysWOW64\Eefhjc32.exe family_berbew C:\Windows\SysWOW64\Ecmeig32.exe family_berbew C:\Windows\SysWOW64\Elgfgl32.exe family_berbew C:\Windows\SysWOW64\Fcckif32.exe family_berbew C:\Windows\SysWOW64\Fkopnh32.exe family_berbew C:\Windows\SysWOW64\Fkalchij.exe family_berbew C:\Windows\SysWOW64\Glebhjlg.exe family_berbew C:\Windows\SysWOW64\Glhonj32.exe family_berbew C:\Windows\SysWOW64\Gmjlcj32.exe family_berbew C:\Windows\SysWOW64\Gomakdcp.exe family_berbew C:\Windows\SysWOW64\Hbpgbo32.exe family_berbew C:\Windows\SysWOW64\Hodgkc32.exe family_berbew C:\Windows\SysWOW64\Hkmefd32.exe family_berbew C:\Windows\SysWOW64\Hcdmga32.exe family_berbew C:\Windows\SysWOW64\Ipknlb32.exe family_berbew C:\Windows\SysWOW64\Imoneg32.exe family_berbew C:\Windows\SysWOW64\Imakkfdg.exe family_berbew C:\Windows\SysWOW64\Ifllil32.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
Kgmlkp32.exeKacphh32.exeKpepcedo.exeKaemnhla.exeKbfiep32.exeKipabjil.exeKcifkp32.exeKmnjhioc.exeKdhbec32.exeLiekmj32.exeLpocjdld.exeLkdggmlj.exeLaopdgcg.exeLgkhlnbn.exeLnepih32.exeLcbiao32.exeLnhmng32.exeLdaeka32.exeLjnnch32.exeLphfpbdi.exeLknjmkdo.exeMpkbebbf.exeMdfofakp.exeMajopeii.exeMnapdf32.exeMpolqa32.exeMjhqjg32.exeMjjmog32.exeMcbahlip.exeNacbfdao.exeNklfoi32.exeNddkgonp.exeNqklmpdd.exeNnolfdcn.exeNqmhbpba.exeNcldnkae.exeNjfmke32.exeNcnadk32.exeOndeac32.exeOnfbfc32.exeOcckojkm.exeOnholckc.exeOdbgim32.exeOgaceh32.exeOnklabip.exeOcgdji32.exeOkolkg32.exeOnmhgb32.exePcjapi32.exePkaiqf32.exePbkamqmd.exePeimil32.exePjffbc32.exePbmncp32.exePgjfkg32.exePndohaqe.exePcagphom.exePnfkma32.exePeqcjkfp.exePjmlbbdg.exeQecppkdm.exeQjpiha32.exeQajadlja.exeQchmagie.exepid process 2472 Kgmlkp32.exe 2304 Kacphh32.exe 3400 Kpepcedo.exe 1216 Kaemnhla.exe 748 Kbfiep32.exe 316 Kipabjil.exe 2464 Kcifkp32.exe 628 Kmnjhioc.exe 1260 Kdhbec32.exe 1876 Liekmj32.exe 2068 Lpocjdld.exe 3048 Lkdggmlj.exe 2476 Laopdgcg.exe 4168 Lgkhlnbn.exe 3532 Lnepih32.exe 4884 Lcbiao32.exe 3088 Lnhmng32.exe 5112 Ldaeka32.exe 3836 Ljnnch32.exe 3920 Lphfpbdi.exe 1256 Lknjmkdo.exe 2296 Mpkbebbf.exe 4380 Mdfofakp.exe 4956 Majopeii.exe 4584 Mnapdf32.exe 3728 Mpolqa32.exe 4692 Mjhqjg32.exe 4084 Mjjmog32.exe 4644 Mcbahlip.exe 4444 Nacbfdao.exe 5024 Nklfoi32.exe 384 Nddkgonp.exe 4172 Nqklmpdd.exe 220 Nnolfdcn.exe 4292 Nqmhbpba.exe 428 Ncldnkae.exe 1116 Njfmke32.exe 4420 Ncnadk32.exe 3628 Ondeac32.exe 1956 Onfbfc32.exe 2772 Occkojkm.exe 1320 Onholckc.exe 4040 Odbgim32.exe 736 Ogaceh32.exe 1244 Onklabip.exe 1864 Ocgdji32.exe 4672 Okolkg32.exe 3672 Onmhgb32.exe 1112 Pcjapi32.exe 1844 Pkaiqf32.exe 3612 Pbkamqmd.exe 3484 Peimil32.exe 2728 Pjffbc32.exe 764 Pbmncp32.exe 4728 Pgjfkg32.exe 4180 Pndohaqe.exe 2228 Pcagphom.exe 2076 Pnfkma32.exe 1564 Peqcjkfp.exe 3688 Pjmlbbdg.exe 4724 Qecppkdm.exe 3596 Qjpiha32.exe 4012 Qajadlja.exe 1392 Qchmagie.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bjddphlq.exeEkacmjgl.exeKnalji32.exeOjllan32.exeLfhnaa32.exeAeniabfd.exeHkbdki32.exeBombmcec.exeFbfcmhpg.exeMgehfkop.exeMcpnhfhf.exeBfkedibe.exeGgeboaob.exeMbjnbqhp.exeLalnmiia.exeBjaqpbkh.exeMelnob32.exePlpqil32.exeKelalp32.exeMjkblhfo.exeBjghpn32.exeEdpnfo32.exeGglpibgm.exeBogcgj32.exeIbmeoq32.exeDemecd32.exeCdfkolkf.exeGiqkkf32.exeLqpamb32.exeCmhigf32.exeKgipcogp.exeCimcan32.exeCidjbmcp.exeKqnbkl32.exeOiknlagg.exeEdfdej32.exeNcfmno32.exePcpikkge.exeHgmgqc32.exeQmkadgpo.exeHghoeqmp.exeNlqomd32.exeQjlnnemp.exeKaemnhla.exeAjeadd32.exedescription ioc process File created C:\Windows\SysWOW64\Bmbplc32.exe Bjddphlq.exe File created C:\Windows\SysWOW64\Echknh32.exe Ekacmjgl.exe File created C:\Windows\SysWOW64\Iekkfckg.dll Knalji32.exe File created C:\Windows\SysWOW64\Neclenfo.exe File created C:\Windows\SysWOW64\Ojhpimhp.exe File opened for modification C:\Windows\SysWOW64\Olkhmi32.exe Ojllan32.exe File opened for modification C:\Windows\SysWOW64\Lifjnm32.exe Lfhnaa32.exe File created C:\Windows\SysWOW64\Dahmfpap.exe File opened for modification C:\Windows\SysWOW64\Obnehj32.exe File opened for modification C:\Windows\SysWOW64\Afoeiklb.exe Aeniabfd.exe File opened for modification C:\Windows\SysWOW64\Hnaqgd32.exe Hkbdki32.exe File created C:\Windows\SysWOW64\Jjqkamhk.dll Bombmcec.exe File created C:\Windows\SysWOW64\Hkajlm32.dll File created C:\Windows\SysWOW64\Lckiihok.exe File created C:\Windows\SysWOW64\Fjmkoeqi.exe Fbfcmhpg.exe File opened for modification C:\Windows\SysWOW64\Mkadfj32.exe Mgehfkop.exe File opened for modification C:\Windows\SysWOW64\Menjdbgj.exe Mcpnhfhf.exe File created C:\Windows\SysWOW64\Bnbmefbg.exe Bfkedibe.exe File opened for modification C:\Windows\SysWOW64\Goljqnpd.exe Ggeboaob.exe File created C:\Windows\SysWOW64\Midfokpm.exe Mbjnbqhp.exe File created C:\Windows\SysWOW64\Mlnigobn.dll Lalnmiia.exe File opened for modification C:\Windows\SysWOW64\Bqkill32.exe Bjaqpbkh.exe File created C:\Windows\SysWOW64\Ggmmlamj.exe File created C:\Windows\SysWOW64\Cgpfqchb.dll File created C:\Windows\SysWOW64\Migjoaaf.exe Melnob32.exe File created C:\Windows\SysWOW64\Plkcijka.dll Plpqil32.exe File created C:\Windows\SysWOW64\Iebngial.exe File created C:\Windows\SysWOW64\Mpolbbim.dll File opened for modification C:\Windows\SysWOW64\Haodle32.exe File created C:\Windows\SysWOW64\Nnbebofc.dll Kelalp32.exe File opened for modification C:\Windows\SysWOW64\Madjhb32.exe Mjkblhfo.exe File created C:\Windows\SysWOW64\Qjfmkk32.exe File created C:\Windows\SysWOW64\Iohejo32.exe File opened for modification C:\Windows\SysWOW64\Ilkoim32.exe File opened for modification C:\Windows\SysWOW64\Bhkhibmc.exe Bjghpn32.exe File created C:\Windows\SysWOW64\Elgfgl32.exe Edpnfo32.exe File opened for modification C:\Windows\SysWOW64\Gochjpho.exe Gglpibgm.exe File opened for modification C:\Windows\SysWOW64\Bfqkddfd.exe Bogcgj32.exe File created C:\Windows\SysWOW64\Ihgnkkbd.exe Ibmeoq32.exe File created C:\Windows\SysWOW64\Eocqqdjh.dll Demecd32.exe File created C:\Windows\SysWOW64\Pjngmo32.dll Cdfkolkf.exe File opened for modification C:\Windows\SysWOW64\Gnlgleef.exe Giqkkf32.exe File opened for modification C:\Windows\SysWOW64\Lgjijmin.exe Lqpamb32.exe File created C:\Windows\SysWOW64\Ghfedh32.dll File created C:\Windows\SysWOW64\Efeichoo.dll Cmhigf32.exe File created C:\Windows\SysWOW64\Knchpiom.exe Kgipcogp.exe File opened for modification C:\Windows\SysWOW64\Dhgonidg.exe File created C:\Windows\SysWOW64\Nnmoekkn.dll Cimcan32.exe File created C:\Windows\SysWOW64\Hlmjfa32.dll Cidjbmcp.exe File created C:\Windows\SysWOW64\Agnjelkm.dll Kqnbkl32.exe File created C:\Windows\SysWOW64\Gdidcm32.dll Oiknlagg.exe File created C:\Windows\SysWOW64\Fligqhga.exe File opened for modification C:\Windows\SysWOW64\Egdqae32.exe Edfdej32.exe File created C:\Windows\SysWOW64\Menbeg32.dll Ncfmno32.exe File created C:\Windows\SysWOW64\Pfnegggi.exe Pcpikkge.exe File created C:\Windows\SysWOW64\Hildmn32.exe Hgmgqc32.exe File created C:\Windows\SysWOW64\Qqfmde32.exe Qmkadgpo.exe File created C:\Windows\SysWOW64\Dogkme32.dll Hghoeqmp.exe File created C:\Windows\SysWOW64\Hlhmjl32.dll File created C:\Windows\SysWOW64\Nookip32.exe Nlqomd32.exe File created C:\Windows\SysWOW64\Flippejg.dll Qjlnnemp.exe File created C:\Windows\SysWOW64\Gejqna32.dll File opened for modification C:\Windows\SysWOW64\Kbfiep32.exe Kaemnhla.exe File created C:\Windows\SysWOW64\Lbcnlf32.dll Ajeadd32.exe -
Program crash 1 IoCs
Processes:
pid pid_target process target process 16648 16568 -
Modifies registry class 64 IoCs
Processes:
Embkoi32.exeEpikpo32.exeIkbfgppo.exeJpmlnjco.exeHmlpaoaj.exeIkdcmpnl.exeGmjlcj32.exeBfchidda.exeFibojhim.exeIkejgf32.exeOafcqcea.exeOfnckp32.exeCceddf32.exeCidjbmcp.exeHfningai.exeEjbbmnnb.exeQnnanphk.exeIbjjhn32.exeEhkclgmb.exeCajcbgml.exePlndcl32.exeIgchfiof.exeJpijnqkp.exePjmehkqk.exeFnobem32.exeLhfmdj32.exeJgadgf32.exeFlngfn32.exePdkcde32.exeCnkplejl.exeCjbpaf32.exeLnepih32.exeJbgoof32.exePpopjp32.exeBclang32.exeJdbhkk32.exeAkhcfe32.exeFdfmlhna.exeLemkcnaa.exeLnpofnhk.exeAqoiqn32.exeJmhale32.exeAeniabfd.exeLbnngbbn.exeIlghlc32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Embkoi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Epikpo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egacbb32.dll" Ikbfgppo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jpmlnjco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqpdko32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hmlpaoaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ikdcmpnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnkfcl32.dll" Gmjlcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mholheco.dll" Bfchidda.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Fibojhim.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ikejgf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Oafcqcea.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlpihhpj.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ofnckp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cceddf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Cidjbmcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Hfningai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ejbbmnnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Famkjfqd.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Qnnanphk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnmacdaj.dll" Ibjjhn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Ehkclgmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcgdgamg.dll" Cajcbgml.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Plndcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jomnmjjb.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Igchfiof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqplhmkl.dll" Jpijnqkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpabk32.dll" Pjmehkqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Fnobem32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lhfmdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enqjamin.dll" Jgadgf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Flngfn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehaaclak.dll" Pdkcde32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Cnkplejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll" Cjbpaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Lnepih32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jbgoof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifomef32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbjnhape.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lddkje32.dll" Ppopjp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Bclang32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qikoka32.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Jdbhkk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Akhcfe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hclkag32.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjbeio32.dll" Fdfmlhna.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lemkcnaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cffpglpg.dll" Lnpofnhk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Aqoiqn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Jmhale32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Aeniabfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32 Lbnngbbn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment" Ilghlc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exeKgmlkp32.exeKacphh32.exeKpepcedo.exeKaemnhla.exeKbfiep32.exeKipabjil.exeKcifkp32.exeKmnjhioc.exeKdhbec32.exeLiekmj32.exeLpocjdld.exeLkdggmlj.exeLaopdgcg.exeLgkhlnbn.exeLnepih32.exeLcbiao32.exeLnhmng32.exeLdaeka32.exeLjnnch32.exeLphfpbdi.exeLknjmkdo.exedescription pid process target process PID 3500 wrote to memory of 2472 3500 2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe Kgmlkp32.exe PID 3500 wrote to memory of 2472 3500 2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe Kgmlkp32.exe PID 3500 wrote to memory of 2472 3500 2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe Kgmlkp32.exe PID 2472 wrote to memory of 2304 2472 Kgmlkp32.exe Kacphh32.exe PID 2472 wrote to memory of 2304 2472 Kgmlkp32.exe Kacphh32.exe PID 2472 wrote to memory of 2304 2472 Kgmlkp32.exe Kacphh32.exe PID 2304 wrote to memory of 3400 2304 Kacphh32.exe Kpepcedo.exe PID 2304 wrote to memory of 3400 2304 Kacphh32.exe Kpepcedo.exe PID 2304 wrote to memory of 3400 2304 Kacphh32.exe Kpepcedo.exe PID 3400 wrote to memory of 1216 3400 Kpepcedo.exe Kaemnhla.exe PID 3400 wrote to memory of 1216 3400 Kpepcedo.exe Kaemnhla.exe PID 3400 wrote to memory of 1216 3400 Kpepcedo.exe Kaemnhla.exe PID 1216 wrote to memory of 748 1216 Kaemnhla.exe Kbfiep32.exe PID 1216 wrote to memory of 748 1216 Kaemnhla.exe Kbfiep32.exe PID 1216 wrote to memory of 748 1216 Kaemnhla.exe Kbfiep32.exe PID 748 wrote to memory of 316 748 Kbfiep32.exe Kipabjil.exe PID 748 wrote to memory of 316 748 Kbfiep32.exe Kipabjil.exe PID 748 wrote to memory of 316 748 Kbfiep32.exe Kipabjil.exe PID 316 wrote to memory of 2464 316 Kipabjil.exe Kcifkp32.exe PID 316 wrote to memory of 2464 316 Kipabjil.exe Kcifkp32.exe PID 316 wrote to memory of 2464 316 Kipabjil.exe Kcifkp32.exe PID 2464 wrote to memory of 628 2464 Kcifkp32.exe Kmnjhioc.exe PID 2464 wrote to memory of 628 2464 Kcifkp32.exe Kmnjhioc.exe PID 2464 wrote to memory of 628 2464 Kcifkp32.exe Kmnjhioc.exe PID 628 wrote to memory of 1260 628 Kmnjhioc.exe Kdhbec32.exe PID 628 wrote to memory of 1260 628 Kmnjhioc.exe Kdhbec32.exe PID 628 wrote to memory of 1260 628 Kmnjhioc.exe Kdhbec32.exe PID 1260 wrote to memory of 1876 1260 Kdhbec32.exe Liekmj32.exe PID 1260 wrote to memory of 1876 1260 Kdhbec32.exe Liekmj32.exe PID 1260 wrote to memory of 1876 1260 Kdhbec32.exe Liekmj32.exe PID 1876 wrote to memory of 2068 1876 Liekmj32.exe Lpocjdld.exe PID 1876 wrote to memory of 2068 1876 Liekmj32.exe Lpocjdld.exe PID 1876 wrote to memory of 2068 1876 Liekmj32.exe Lpocjdld.exe PID 2068 wrote to memory of 3048 2068 Lpocjdld.exe Lkdggmlj.exe PID 2068 wrote to memory of 3048 2068 Lpocjdld.exe Lkdggmlj.exe PID 2068 wrote to memory of 3048 2068 Lpocjdld.exe Lkdggmlj.exe PID 3048 wrote to memory of 2476 3048 Lkdggmlj.exe Laopdgcg.exe PID 3048 wrote to memory of 2476 3048 Lkdggmlj.exe Laopdgcg.exe PID 3048 wrote to memory of 2476 3048 Lkdggmlj.exe Laopdgcg.exe PID 2476 wrote to memory of 4168 2476 Laopdgcg.exe Lgkhlnbn.exe PID 2476 wrote to memory of 4168 2476 Laopdgcg.exe Lgkhlnbn.exe PID 2476 wrote to memory of 4168 2476 Laopdgcg.exe Lgkhlnbn.exe PID 4168 wrote to memory of 3532 4168 Lgkhlnbn.exe Lnepih32.exe PID 4168 wrote to memory of 3532 4168 Lgkhlnbn.exe Lnepih32.exe PID 4168 wrote to memory of 3532 4168 Lgkhlnbn.exe Lnepih32.exe PID 3532 wrote to memory of 4884 3532 Lnepih32.exe Lcbiao32.exe PID 3532 wrote to memory of 4884 3532 Lnepih32.exe Lcbiao32.exe PID 3532 wrote to memory of 4884 3532 Lnepih32.exe Lcbiao32.exe PID 4884 wrote to memory of 3088 4884 Lcbiao32.exe Lnhmng32.exe PID 4884 wrote to memory of 3088 4884 Lcbiao32.exe Lnhmng32.exe PID 4884 wrote to memory of 3088 4884 Lcbiao32.exe Lnhmng32.exe PID 3088 wrote to memory of 5112 3088 Lnhmng32.exe Ldaeka32.exe PID 3088 wrote to memory of 5112 3088 Lnhmng32.exe Ldaeka32.exe PID 3088 wrote to memory of 5112 3088 Lnhmng32.exe Ldaeka32.exe PID 5112 wrote to memory of 3836 5112 Ldaeka32.exe Ljnnch32.exe PID 5112 wrote to memory of 3836 5112 Ldaeka32.exe Ljnnch32.exe PID 5112 wrote to memory of 3836 5112 Ldaeka32.exe Ljnnch32.exe PID 3836 wrote to memory of 3920 3836 Ljnnch32.exe Lphfpbdi.exe PID 3836 wrote to memory of 3920 3836 Ljnnch32.exe Lphfpbdi.exe PID 3836 wrote to memory of 3920 3836 Ljnnch32.exe Lphfpbdi.exe PID 3920 wrote to memory of 1256 3920 Lphfpbdi.exe Lknjmkdo.exe PID 3920 wrote to memory of 1256 3920 Lphfpbdi.exe Lknjmkdo.exe PID 3920 wrote to memory of 1256 3920 Lphfpbdi.exe Lknjmkdo.exe PID 1256 wrote to memory of 2296 1256 Lknjmkdo.exe Mpkbebbf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2cb9c11cb08aefa5418ed0d9c2618e80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\Kgmlkp32.exeC:\Windows\system32\Kgmlkp32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\Kacphh32.exeC:\Windows\system32\Kacphh32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Kpepcedo.exeC:\Windows\system32\Kpepcedo.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\Kaemnhla.exeC:\Windows\system32\Kaemnhla.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\Kbfiep32.exeC:\Windows\system32\Kbfiep32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\Kipabjil.exeC:\Windows\system32\Kipabjil.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\Kcifkp32.exeC:\Windows\system32\Kcifkp32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\Kmnjhioc.exeC:\Windows\system32\Kmnjhioc.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\Kdhbec32.exeC:\Windows\system32\Kdhbec32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\Liekmj32.exeC:\Windows\system32\Liekmj32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\Lpocjdld.exeC:\Windows\system32\Lpocjdld.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\Lkdggmlj.exeC:\Windows\system32\Lkdggmlj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\Laopdgcg.exeC:\Windows\system32\Laopdgcg.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\Lgkhlnbn.exeC:\Windows\system32\Lgkhlnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\Lnepih32.exeC:\Windows\system32\Lnepih32.exe16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\Lcbiao32.exeC:\Windows\system32\Lcbiao32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\Lnhmng32.exeC:\Windows\system32\Lnhmng32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\Ldaeka32.exeC:\Windows\system32\Ldaeka32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\Ljnnch32.exeC:\Windows\system32\Ljnnch32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\Lphfpbdi.exeC:\Windows\system32\Lphfpbdi.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\Lknjmkdo.exeC:\Windows\system32\Lknjmkdo.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\Mpkbebbf.exeC:\Windows\system32\Mpkbebbf.exe23⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\Mdfofakp.exeC:\Windows\system32\Mdfofakp.exe24⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\Majopeii.exeC:\Windows\system32\Majopeii.exe25⤵
- Executes dropped EXE
PID:4956 -
C:\Windows\SysWOW64\Mnapdf32.exeC:\Windows\system32\Mnapdf32.exe26⤵
- Executes dropped EXE
PID:4584 -
C:\Windows\SysWOW64\Mpolqa32.exeC:\Windows\system32\Mpolqa32.exe27⤵
- Executes dropped EXE
PID:3728 -
C:\Windows\SysWOW64\Mjhqjg32.exeC:\Windows\system32\Mjhqjg32.exe28⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\Mjjmog32.exeC:\Windows\system32\Mjjmog32.exe29⤵
- Executes dropped EXE
PID:4084 -
C:\Windows\SysWOW64\Mcbahlip.exeC:\Windows\system32\Mcbahlip.exe30⤵
- Executes dropped EXE
PID:4644 -
C:\Windows\SysWOW64\Nacbfdao.exeC:\Windows\system32\Nacbfdao.exe31⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\Nklfoi32.exeC:\Windows\system32\Nklfoi32.exe32⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\Nddkgonp.exeC:\Windows\system32\Nddkgonp.exe33⤵
- Executes dropped EXE
PID:384 -
C:\Windows\SysWOW64\Nqklmpdd.exeC:\Windows\system32\Nqklmpdd.exe34⤵
- Executes dropped EXE
PID:4172 -
C:\Windows\SysWOW64\Nnolfdcn.exeC:\Windows\system32\Nnolfdcn.exe35⤵
- Executes dropped EXE
PID:220 -
C:\Windows\SysWOW64\Nqmhbpba.exeC:\Windows\system32\Nqmhbpba.exe36⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\Ncldnkae.exeC:\Windows\system32\Ncldnkae.exe37⤵
- Executes dropped EXE
PID:428 -
C:\Windows\SysWOW64\Njfmke32.exeC:\Windows\system32\Njfmke32.exe38⤵
- Executes dropped EXE
PID:1116 -
C:\Windows\SysWOW64\Ncnadk32.exeC:\Windows\system32\Ncnadk32.exe39⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\Ondeac32.exeC:\Windows\system32\Ondeac32.exe40⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\Onfbfc32.exeC:\Windows\system32\Onfbfc32.exe41⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\Occkojkm.exeC:\Windows\system32\Occkojkm.exe42⤵
- Executes dropped EXE
PID:2772 -
C:\Windows\SysWOW64\Onholckc.exeC:\Windows\system32\Onholckc.exe43⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\Odbgim32.exeC:\Windows\system32\Odbgim32.exe44⤵
- Executes dropped EXE
PID:4040 -
C:\Windows\SysWOW64\Ogaceh32.exeC:\Windows\system32\Ogaceh32.exe45⤵
- Executes dropped EXE
PID:736 -
C:\Windows\SysWOW64\Onklabip.exeC:\Windows\system32\Onklabip.exe46⤵
- Executes dropped EXE
PID:1244 -
C:\Windows\SysWOW64\Ocgdji32.exeC:\Windows\system32\Ocgdji32.exe47⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\SysWOW64\Okolkg32.exeC:\Windows\system32\Okolkg32.exe48⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\Onmhgb32.exeC:\Windows\system32\Onmhgb32.exe49⤵
- Executes dropped EXE
PID:3672 -
C:\Windows\SysWOW64\Pcjapi32.exeC:\Windows\system32\Pcjapi32.exe50⤵
- Executes dropped EXE
PID:1112 -
C:\Windows\SysWOW64\Pkaiqf32.exeC:\Windows\system32\Pkaiqf32.exe51⤵
- Executes dropped EXE
PID:1844 -
C:\Windows\SysWOW64\Pbkamqmd.exeC:\Windows\system32\Pbkamqmd.exe52⤵
- Executes dropped EXE
PID:3612 -
C:\Windows\SysWOW64\Peimil32.exeC:\Windows\system32\Peimil32.exe53⤵
- Executes dropped EXE
PID:3484 -
C:\Windows\SysWOW64\Pjffbc32.exeC:\Windows\system32\Pjffbc32.exe54⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\Pbmncp32.exeC:\Windows\system32\Pbmncp32.exe55⤵
- Executes dropped EXE
PID:764 -
C:\Windows\SysWOW64\Pgjfkg32.exeC:\Windows\system32\Pgjfkg32.exe56⤵
- Executes dropped EXE
PID:4728 -
C:\Windows\SysWOW64\Pndohaqe.exeC:\Windows\system32\Pndohaqe.exe57⤵
- Executes dropped EXE
PID:4180 -
C:\Windows\SysWOW64\Pcagphom.exeC:\Windows\system32\Pcagphom.exe58⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\Pnfkma32.exeC:\Windows\system32\Pnfkma32.exe59⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\Peqcjkfp.exeC:\Windows\system32\Peqcjkfp.exe60⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\Pjmlbbdg.exeC:\Windows\system32\Pjmlbbdg.exe61⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\Qecppkdm.exeC:\Windows\system32\Qecppkdm.exe62⤵
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\Qjpiha32.exeC:\Windows\system32\Qjpiha32.exe63⤵
- Executes dropped EXE
PID:3596 -
C:\Windows\SysWOW64\Qajadlja.exeC:\Windows\system32\Qajadlja.exe64⤵
- Executes dropped EXE
PID:4012 -
C:\Windows\SysWOW64\Qchmagie.exeC:\Windows\system32\Qchmagie.exe65⤵
- Executes dropped EXE
PID:1392 -
C:\Windows\SysWOW64\Qnnanphk.exeC:\Windows\system32\Qnnanphk.exe66⤵
- Modifies registry class
PID:4924 -
C:\Windows\SysWOW64\Aegikj32.exeC:\Windows\system32\Aegikj32.exe67⤵PID:3960
-
C:\Windows\SysWOW64\Alabgd32.exeC:\Windows\system32\Alabgd32.exe68⤵PID:4312
-
C:\Windows\SysWOW64\Aejfpjne.exeC:\Windows\system32\Aejfpjne.exe69⤵PID:3556
-
C:\Windows\SysWOW64\Aldomc32.exeC:\Windows\system32\Aldomc32.exe70⤵PID:2852
-
C:\Windows\SysWOW64\Abngjnmo.exeC:\Windows\system32\Abngjnmo.exe71⤵PID:3200
-
C:\Windows\SysWOW64\Aelcfilb.exeC:\Windows\system32\Aelcfilb.exe72⤵PID:1404
-
C:\Windows\SysWOW64\Ajiknpjj.exeC:\Windows\system32\Ajiknpjj.exe73⤵PID:2892
-
C:\Windows\SysWOW64\Andgoobc.exeC:\Windows\system32\Andgoobc.exe74⤵PID:1884
-
C:\Windows\SysWOW64\Aacckjaf.exeC:\Windows\system32\Aacckjaf.exe75⤵PID:624
-
C:\Windows\SysWOW64\Adapgfqj.exeC:\Windows\system32\Adapgfqj.exe76⤵PID:3008
-
C:\Windows\SysWOW64\Ajkhdp32.exeC:\Windows\system32\Ajkhdp32.exe77⤵PID:1524
-
C:\Windows\SysWOW64\Aealah32.exeC:\Windows\system32\Aealah32.exe78⤵PID:2856
-
C:\Windows\SysWOW64\Ahoimd32.exeC:\Windows\system32\Ahoimd32.exe79⤵PID:2104
-
C:\Windows\SysWOW64\Alkdnboj.exeC:\Windows\system32\Alkdnboj.exe80⤵PID:1132
-
C:\Windows\SysWOW64\Bahmfj32.exeC:\Windows\system32\Bahmfj32.exe81⤵PID:1068
-
C:\Windows\SysWOW64\Becifhfj.exeC:\Windows\system32\Becifhfj.exe82⤵PID:2572
-
C:\Windows\SysWOW64\Blmacb32.exeC:\Windows\system32\Blmacb32.exe83⤵PID:1012
-
C:\Windows\SysWOW64\Bnlnon32.exeC:\Windows\system32\Bnlnon32.exe84⤵PID:4888
-
C:\Windows\SysWOW64\Beeflhdh.exeC:\Windows\system32\Beeflhdh.exe85⤵PID:3956
-
C:\Windows\SysWOW64\Bhdbhcck.exeC:\Windows\system32\Bhdbhcck.exe86⤵PID:3888
-
C:\Windows\SysWOW64\Bnnjen32.exeC:\Windows\system32\Bnnjen32.exe87⤵PID:1416
-
C:\Windows\SysWOW64\Bdkcmdhp.exeC:\Windows\system32\Bdkcmdhp.exe88⤵PID:3564
-
C:\Windows\SysWOW64\Bjdkjo32.exeC:\Windows\system32\Bjdkjo32.exe89⤵PID:1620
-
C:\Windows\SysWOW64\Bdmpcdfm.exeC:\Windows\system32\Bdmpcdfm.exe90⤵PID:1692
-
C:\Windows\SysWOW64\Bjghpn32.exeC:\Windows\system32\Bjghpn32.exe91⤵
- Drops file in System32 directory
PID:4464 -
C:\Windows\SysWOW64\Bhkhibmc.exeC:\Windows\system32\Bhkhibmc.exe92⤵PID:3064
-
C:\Windows\SysWOW64\Bkidenlg.exeC:\Windows\system32\Bkidenlg.exe93⤵PID:3940
-
C:\Windows\SysWOW64\Cdainc32.exeC:\Windows\system32\Cdainc32.exe94⤵PID:1992
-
C:\Windows\SysWOW64\Cliaoq32.exeC:\Windows\system32\Cliaoq32.exe95⤵PID:1812
-
C:\Windows\SysWOW64\Ceaehfjj.exeC:\Windows\system32\Ceaehfjj.exe96⤵PID:5044
-
C:\Windows\SysWOW64\Chpada32.exeC:\Windows\system32\Chpada32.exe97⤵PID:1580
-
C:\Windows\SysWOW64\Clkndpag.exeC:\Windows\system32\Clkndpag.exe98⤵PID:4136
-
C:\Windows\SysWOW64\Cknnpm32.exeC:\Windows\system32\Cknnpm32.exe99⤵PID:3412
-
C:\Windows\SysWOW64\Cahfmgoo.exeC:\Windows\system32\Cahfmgoo.exe100⤵PID:3856
-
C:\Windows\SysWOW64\Clnjjpod.exeC:\Windows\system32\Clnjjpod.exe101⤵PID:4964
-
C:\Windows\SysWOW64\Cajcbgml.exeC:\Windows\system32\Cajcbgml.exe102⤵
- Modifies registry class
PID:3024 -
C:\Windows\SysWOW64\Chdkoa32.exeC:\Windows\system32\Chdkoa32.exe103⤵PID:5160
-
C:\Windows\SysWOW64\Conclk32.exeC:\Windows\system32\Conclk32.exe104⤵PID:5204
-
C:\Windows\SysWOW64\Ckedalaj.exeC:\Windows\system32\Ckedalaj.exe105⤵PID:5248
-
C:\Windows\SysWOW64\Daolnf32.exeC:\Windows\system32\Daolnf32.exe106⤵PID:5292
-
C:\Windows\SysWOW64\Dhidjpqc.exeC:\Windows\system32\Dhidjpqc.exe107⤵PID:5336
-
C:\Windows\SysWOW64\Demecd32.exeC:\Windows\system32\Demecd32.exe108⤵
- Drops file in System32 directory
PID:5380 -
C:\Windows\SysWOW64\Ddpeoafg.exeC:\Windows\system32\Ddpeoafg.exe109⤵PID:5424
-
C:\Windows\SysWOW64\Dkjmlk32.exeC:\Windows\system32\Dkjmlk32.exe110⤵PID:5472
-
C:\Windows\SysWOW64\Deoaid32.exeC:\Windows\system32\Deoaid32.exe111⤵PID:5516
-
C:\Windows\SysWOW64\Dhnnep32.exeC:\Windows\system32\Dhnnep32.exe112⤵PID:5560
-
C:\Windows\SysWOW64\Dkljak32.exeC:\Windows\system32\Dkljak32.exe113⤵PID:5604
-
C:\Windows\SysWOW64\Dafbne32.exeC:\Windows\system32\Dafbne32.exe114⤵PID:5644
-
C:\Windows\SysWOW64\Dddojq32.exeC:\Windows\system32\Dddojq32.exe115⤵PID:5688
-
C:\Windows\SysWOW64\Dllfkn32.exeC:\Windows\system32\Dllfkn32.exe116⤵PID:5744
-
C:\Windows\SysWOW64\Dceohhja.exeC:\Windows\system32\Dceohhja.exe117⤵PID:5784
-
C:\Windows\SysWOW64\Dedkdcie.exeC:\Windows\system32\Dedkdcie.exe118⤵PID:5828
-
C:\Windows\SysWOW64\Ekacmjgl.exeC:\Windows\system32\Ekacmjgl.exe119⤵
- Drops file in System32 directory
PID:5872 -
C:\Windows\SysWOW64\Echknh32.exeC:\Windows\system32\Echknh32.exe120⤵PID:5916
-
C:\Windows\SysWOW64\Eefhjc32.exeC:\Windows\system32\Eefhjc32.exe121⤵PID:5960
-
C:\Windows\SysWOW64\Ekcpbj32.exeC:\Windows\system32\Ekcpbj32.exe122⤵PID:6004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-