Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe
Resource
win10v2004-20240802-en
General
-
Target
3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe
-
Size
211KB
-
MD5
dd82fd67de555c611e2513dcaa80a4b0
-
SHA1
91a2024a0c6b8d6ac2ca383458d19a556ccd2879
-
SHA256
3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541
-
SHA512
bd856cf8b4656c14d37cb901f3f78a862ff92ccf412c694850c2025b591616890114f5dd8036fb747c89b8fcd643eec9b6144e79e5e5c5a72cc210e588507af7
-
SSDEEP
6144:k9NbYFEgTM8zbtr141Tt725mkHDs6ues+bcQX:k7+nzbtJWT45mkHSmcQX
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found -
Renames multiple (87) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation nEYEYAwQ.exe -
Executes dropped EXE 2 IoCs
pid Process 4772 nEYEYAwQ.exe 1328 DGcYEcgA.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEYEYAwQ.exe = "C:\\Users\\Admin\\bWYcMsAc\\nEYEYAwQ.exe" 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DGcYEcgA.exe = "C:\\ProgramData\\qmQYIEYw\\DGcYEcgA.exe" 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nEYEYAwQ.exe = "C:\\Users\\Admin\\bWYcMsAc\\nEYEYAwQ.exe" nEYEYAwQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DGcYEcgA.exe = "C:\\ProgramData\\qmQYIEYw\\DGcYEcgA.exe" DGcYEcgA.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe nEYEYAwQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2332 reg.exe 1380 reg.exe 4092 reg.exe 3900 reg.exe 1956 reg.exe 2340 Process not Found 3940 reg.exe 1168 reg.exe 4960 reg.exe 2352 reg.exe 4824 reg.exe 2064 reg.exe 536 reg.exe 3516 Process not Found 4744 reg.exe 1216 Process not Found 3500 Process not Found 2800 reg.exe 4744 Process not Found 4956 Process not Found 4004 reg.exe 5036 reg.exe 232 reg.exe 3452 reg.exe 4580 reg.exe 2932 reg.exe 4736 reg.exe 4440 Process not Found 2192 reg.exe 2808 reg.exe 4028 reg.exe 1824 reg.exe 2800 reg.exe 528 reg.exe 2952 reg.exe 1756 reg.exe 4676 reg.exe 4392 reg.exe 516 reg.exe 320 Process not Found 1096 reg.exe 536 reg.exe 4860 reg.exe 4436 reg.exe 516 reg.exe 2448 reg.exe 1256 reg.exe 2984 Process not Found 2792 reg.exe 4556 reg.exe 2880 Process not Found 1252 reg.exe 1540 reg.exe 1140 reg.exe 2284 reg.exe 4356 reg.exe 3492 reg.exe 4512 reg.exe 4308 reg.exe 4568 reg.exe 1200 reg.exe 856 Process not Found 3536 reg.exe 1028 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4580 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4580 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4580 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4580 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4332 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4332 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4332 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4332 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 5092 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 5092 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 5092 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 5092 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4660 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4660 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4660 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4660 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 2996 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 2996 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 2996 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 2996 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3308 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3308 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3308 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3308 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3672 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3672 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3672 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3672 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4492 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4492 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4492 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4492 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1204 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1204 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1204 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1204 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1748 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1748 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1748 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 1748 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4688 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4688 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4688 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4688 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3796 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3796 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3796 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 3796 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4820 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4820 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4820 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 4820 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4772 nEYEYAwQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe 4772 nEYEYAwQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 4772 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 82 PID 4440 wrote to memory of 4772 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 82 PID 4440 wrote to memory of 4772 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 82 PID 4440 wrote to memory of 1328 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 83 PID 4440 wrote to memory of 1328 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 83 PID 4440 wrote to memory of 1328 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 83 PID 4440 wrote to memory of 4876 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 84 PID 4440 wrote to memory of 4876 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 84 PID 4440 wrote to memory of 4876 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 84 PID 4440 wrote to memory of 3536 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 86 PID 4440 wrote to memory of 3536 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 86 PID 4440 wrote to memory of 3536 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 86 PID 4440 wrote to memory of 4568 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 87 PID 4440 wrote to memory of 4568 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 87 PID 4440 wrote to memory of 4568 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 87 PID 4440 wrote to memory of 2680 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 88 PID 4440 wrote to memory of 2680 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 88 PID 4440 wrote to memory of 2680 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 88 PID 4440 wrote to memory of 4992 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 89 PID 4440 wrote to memory of 4992 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 89 PID 4440 wrote to memory of 4992 4440 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 89 PID 4876 wrote to memory of 3424 4876 cmd.exe 94 PID 4876 wrote to memory of 3424 4876 cmd.exe 94 PID 4876 wrote to memory of 3424 4876 cmd.exe 94 PID 4992 wrote to memory of 2336 4992 cmd.exe 95 PID 4992 wrote to memory of 2336 4992 cmd.exe 95 PID 4992 wrote to memory of 2336 4992 cmd.exe 95 PID 3424 wrote to memory of 4240 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 96 PID 3424 wrote to memory of 4240 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 96 PID 3424 wrote to memory of 4240 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 96 PID 4240 wrote to memory of 4576 4240 cmd.exe 98 PID 4240 wrote to memory of 4576 4240 cmd.exe 98 PID 4240 wrote to memory of 4576 4240 cmd.exe 98 PID 3424 wrote to memory of 3628 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 99 PID 3424 wrote to memory of 3628 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 99 PID 3424 wrote to memory of 3628 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 99 PID 3424 wrote to memory of 4748 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 100 PID 3424 wrote to memory of 4748 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 100 PID 3424 wrote to memory of 4748 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 100 PID 3424 wrote to memory of 5048 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 101 PID 3424 wrote to memory of 5048 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 101 PID 3424 wrote to memory of 5048 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 101 PID 3424 wrote to memory of 2216 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 102 PID 3424 wrote to memory of 2216 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 102 PID 3424 wrote to memory of 2216 3424 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 102 PID 2216 wrote to memory of 224 2216 cmd.exe 107 PID 2216 wrote to memory of 224 2216 cmd.exe 107 PID 2216 wrote to memory of 224 2216 cmd.exe 107 PID 4576 wrote to memory of 2264 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 108 PID 4576 wrote to memory of 2264 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 108 PID 4576 wrote to memory of 2264 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 108 PID 2264 wrote to memory of 4580 2264 cmd.exe 110 PID 2264 wrote to memory of 4580 2264 cmd.exe 110 PID 2264 wrote to memory of 4580 2264 cmd.exe 110 PID 4576 wrote to memory of 320 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 111 PID 4576 wrote to memory of 320 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 111 PID 4576 wrote to memory of 320 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 111 PID 4576 wrote to memory of 4820 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 112 PID 4576 wrote to memory of 4820 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 112 PID 4576 wrote to memory of 4820 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 112 PID 4576 wrote to memory of 4356 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 113 PID 4576 wrote to memory of 4356 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 113 PID 4576 wrote to memory of 4356 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 113 PID 4576 wrote to memory of 4032 4576 3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe"C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\bWYcMsAc\nEYEYAwQ.exe"C:\Users\Admin\bWYcMsAc\nEYEYAwQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4772
-
-
C:\ProgramData\qmQYIEYw\DGcYEcgA.exe"C:\ProgramData\qmQYIEYw\DGcYEcgA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1328
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"2⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"4⤵
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"6⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"8⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N9⤵
- Suspicious behavior: EnumeratesProcesses
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"10⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N11⤵
- Suspicious behavior: EnumeratesProcesses
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"12⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N13⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"14⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"16⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N17⤵
- Suspicious behavior: EnumeratesProcesses
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"18⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N19⤵
- Suspicious behavior: EnumeratesProcesses
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"20⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N21⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"22⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"24⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N25⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"26⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N27⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"28⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N29⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"30⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N31⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"32⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N33⤵PID:4032
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"34⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N35⤵PID:1700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"36⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N37⤵PID:4016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"38⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N39⤵PID:5016
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"40⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N41⤵PID:4748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"42⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N43⤵PID:956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"44⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N45⤵PID:8
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"46⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N47⤵PID:5060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"48⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N49⤵PID:1676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"50⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N51⤵PID:1316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"52⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N53⤵PID:4024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"54⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N55⤵PID:4004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"56⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N57⤵PID:4000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"58⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N59⤵PID:2916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"60⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N61⤵PID:4888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"62⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N63⤵PID:4996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"64⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N65⤵PID:1252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"66⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N67⤵PID:2900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"68⤵PID:2416
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N69⤵PID:4392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"70⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N71⤵PID:1688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"72⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N73⤵PID:4364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"74⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N75⤵PID:4916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"76⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N77⤵PID:4940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"78⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N79⤵PID:1456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"80⤵PID:3576
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:3408
-
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N81⤵PID:4308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"82⤵PID:4320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:4564
-
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N83⤵PID:3596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"84⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N85⤵PID:1344
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"86⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N87⤵PID:1868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"88⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N89⤵PID:1596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"90⤵
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N91⤵PID:4448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"92⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N93⤵
- System Location Discovery: System Language Discovery
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"94⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N95⤵PID:1072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"96⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N97⤵PID:2796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"98⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N99⤵PID:4240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"100⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N101⤵PID:3724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"102⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N103⤵PID:984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"104⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N105⤵PID:4336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"106⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N107⤵PID:1976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"108⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N109⤵PID:544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"110⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N111⤵PID:3900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"112⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N113⤵PID:1128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"114⤵
- System Location Discovery: System Language Discovery
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N115⤵PID:4788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"116⤵PID:2956
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1117⤵PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N117⤵PID:4988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"118⤵PID:4688
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1119⤵PID:4344
-
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N119⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"120⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N.exeC:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N121⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3c01792ee255068f02a0fa3164e4c72f30b0e36c790699a7b93ccbc220b8b541N"122⤵PID:1444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-