Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe
Resource
win10v2004-20241007-en
General
-
Target
95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe
-
Size
194KB
-
MD5
8467fa7e163a2b69bbcfb023641aa440
-
SHA1
020d3100037b97b9e7d82416b57f644d5f116ca7
-
SHA256
95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290c
-
SHA512
2636a919a32079380f04e47a9988903c2cc3184ba925c266d2e64ff60378579707fce353c9a69057b17399c0a4640aae8739c29cb7e6a9042c25ec7d20a1ebe2
-
SSDEEP
3072:BU9xsZhI7T4Mdew/MCgXFjT2A0SBsHS4J8h1F9yMwh5oHefi+pZIG:BU8h0T4MdeGMBX98WFnh1W3bfLp+
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (83) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 5 IoCs
flow pid Process 38 4996 Process not Found 42 4996 Process not Found 44 4996 Process not Found 46 4996 Process not Found 48 4996 Process not Found -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation KaMIMEQs.exe -
Executes dropped EXE 2 IoCs
pid Process 2280 TgwUAAkA.exe 1564 KaMIMEQs.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KaMIMEQs.exe = "C:\\ProgramData\\UAcQYIgk\\KaMIMEQs.exe" KaMIMEQs.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TgwUAAkA.exe = "C:\\Users\\Admin\\nYYQgMcY\\TgwUAAkA.exe" TgwUAAkA.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TgwUAAkA.exe = "C:\\Users\\Admin\\nYYQgMcY\\TgwUAAkA.exe" 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KaMIMEQs.exe = "C:\\ProgramData\\UAcQYIgk\\KaMIMEQs.exe" 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\shell32.dll.exe KaMIMEQs.exe File created C:\Windows\SysWOW64\shell32.dll.exe KaMIMEQs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2412 reg.exe 2196 reg.exe 3844 reg.exe 2472 reg.exe 3756 reg.exe 4584 reg.exe 4632 reg.exe 1908 reg.exe 1040 reg.exe 1908 reg.exe 756 reg.exe 232 reg.exe 3488 reg.exe 1496 reg.exe 1904 reg.exe 740 reg.exe 2204 reg.exe 4500 reg.exe 2684 Process not Found 4936 reg.exe 3988 reg.exe 1760 reg.exe 3856 Process not Found 3248 reg.exe 4952 reg.exe 4940 reg.exe 3604 reg.exe 1836 Process not Found 4348 Process not Found 3800 reg.exe 468 reg.exe 3444 reg.exe 5064 reg.exe 4448 reg.exe 3680 Process not Found 3996 reg.exe 2480 reg.exe 4312 reg.exe 2316 reg.exe 636 reg.exe 4080 reg.exe 2240 Process not Found 4708 reg.exe 2944 reg.exe 3276 reg.exe 3264 reg.exe 3244 Process not Found 3608 Process not Found 3868 reg.exe 4604 reg.exe 4280 reg.exe 3844 reg.exe 212 reg.exe 4180 reg.exe 876 Process not Found 2656 reg.exe 4220 reg.exe 2412 reg.exe 3024 reg.exe 1256 reg.exe 2688 Process not Found 4976 Process not Found 2500 reg.exe 2324 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1660 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1660 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1660 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1660 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2128 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2128 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2128 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2128 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3004 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3004 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3004 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3004 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1508 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1508 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1508 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1508 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4084 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4084 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4084 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4084 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1936 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1936 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1936 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1936 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 368 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 368 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 368 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 368 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4208 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4208 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4208 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 4208 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3440 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3440 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3440 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3440 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3144 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3144 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3144 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 3144 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 2484 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1400 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1400 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1400 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 1400 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1564 KaMIMEQs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe 1564 KaMIMEQs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2280 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 86 PID 2500 wrote to memory of 2280 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 86 PID 2500 wrote to memory of 2280 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 86 PID 2500 wrote to memory of 1564 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 87 PID 2500 wrote to memory of 1564 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 87 PID 2500 wrote to memory of 1564 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 87 PID 2500 wrote to memory of 1760 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 88 PID 2500 wrote to memory of 1760 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 88 PID 2500 wrote to memory of 1760 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 88 PID 2500 wrote to memory of 4448 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 90 PID 2500 wrote to memory of 4448 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 90 PID 2500 wrote to memory of 4448 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 90 PID 2500 wrote to memory of 3144 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 91 PID 2500 wrote to memory of 3144 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 91 PID 2500 wrote to memory of 3144 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 91 PID 2500 wrote to memory of 4684 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 92 PID 2500 wrote to memory of 4684 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 92 PID 2500 wrote to memory of 4684 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 92 PID 2500 wrote to memory of 1856 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 93 PID 2500 wrote to memory of 1856 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 93 PID 2500 wrote to memory of 1856 2500 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 93 PID 1760 wrote to memory of 1872 1760 cmd.exe 99 PID 1760 wrote to memory of 1872 1760 cmd.exe 99 PID 1760 wrote to memory of 1872 1760 cmd.exe 99 PID 1856 wrote to memory of 2084 1856 cmd.exe 98 PID 1856 wrote to memory of 2084 1856 cmd.exe 98 PID 1856 wrote to memory of 2084 1856 cmd.exe 98 PID 1872 wrote to memory of 3460 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 101 PID 1872 wrote to memory of 3460 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 101 PID 1872 wrote to memory of 3460 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 101 PID 3460 wrote to memory of 3176 3460 cmd.exe 103 PID 3460 wrote to memory of 3176 3460 cmd.exe 103 PID 3460 wrote to memory of 3176 3460 cmd.exe 103 PID 1872 wrote to memory of 3684 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 104 PID 1872 wrote to memory of 3684 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 104 PID 1872 wrote to memory of 3684 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 104 PID 1872 wrote to memory of 2720 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 105 PID 1872 wrote to memory of 2720 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 105 PID 1872 wrote to memory of 2720 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 105 PID 1872 wrote to memory of 3432 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 106 PID 1872 wrote to memory of 3432 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 106 PID 1872 wrote to memory of 3432 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 106 PID 1872 wrote to memory of 4368 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 107 PID 1872 wrote to memory of 4368 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 107 PID 1872 wrote to memory of 4368 1872 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 107 PID 4368 wrote to memory of 1640 4368 cmd.exe 112 PID 4368 wrote to memory of 1640 4368 cmd.exe 112 PID 4368 wrote to memory of 1640 4368 cmd.exe 112 PID 3176 wrote to memory of 1260 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 113 PID 3176 wrote to memory of 1260 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 113 PID 3176 wrote to memory of 1260 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 113 PID 3176 wrote to memory of 664 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 115 PID 3176 wrote to memory of 664 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 115 PID 3176 wrote to memory of 664 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 115 PID 3176 wrote to memory of 1508 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 116 PID 3176 wrote to memory of 1508 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 116 PID 3176 wrote to memory of 1508 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 116 PID 3176 wrote to memory of 2144 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 117 PID 3176 wrote to memory of 2144 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 117 PID 3176 wrote to memory of 2144 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 117 PID 3176 wrote to memory of 5000 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 118 PID 3176 wrote to memory of 5000 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 118 PID 3176 wrote to memory of 5000 3176 95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe 118 PID 1260 wrote to memory of 3484 1260 cmd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe"C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\nYYQgMcY\TgwUAAkA.exe"C:\Users\Admin\nYYQgMcY\TgwUAAkA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2280
-
-
C:\ProgramData\UAcQYIgk\KaMIMEQs.exe"C:\ProgramData\UAcQYIgk\KaMIMEQs.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"2⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"4⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"6⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN7⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"8⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"10⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN11⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"12⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"14⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"16⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN17⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"18⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN19⤵
- Suspicious behavior: EnumeratesProcesses
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"20⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN21⤵
- Suspicious behavior: EnumeratesProcesses
PID:368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"22⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"24⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN25⤵
- Suspicious behavior: EnumeratesProcesses
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"26⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN27⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"28⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN29⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"30⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN31⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"32⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN33⤵PID:4152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"34⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN35⤵PID:3872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"36⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN37⤵PID:3456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"38⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN39⤵PID:2604
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"40⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN41⤵PID:1640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"42⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN43⤵PID:4160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"44⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN45⤵PID:1788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"46⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN47⤵
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"48⤵PID:2748
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV149⤵PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN49⤵PID:4896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"50⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN51⤵PID:2880
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"52⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN53⤵PID:5004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"54⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN55⤵PID:2404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"56⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN57⤵PID:3528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"58⤵PID:3484
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV159⤵PID:4896
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN59⤵PID:2624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"60⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN61⤵PID:2976
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"62⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN63⤵PID:1388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"64⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN65⤵PID:2500
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"66⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN67⤵PID:3724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"68⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN69⤵PID:1336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN71⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"72⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN73⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"74⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN75⤵PID:756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"76⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN77⤵PID:3932
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"78⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN79⤵PID:456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"80⤵PID:920
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN81⤵PID:2780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"82⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN83⤵PID:3080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"84⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN85⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"86⤵PID:4116
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:4596
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN87⤵PID:1788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"88⤵PID:2240
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:4996
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN89⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"90⤵PID:3344
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN91⤵PID:232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"92⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN93⤵PID:4560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"94⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN95⤵PID:464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"96⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN97⤵PID:2212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"98⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN99⤵PID:2920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"100⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN101⤵PID:3800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"102⤵PID:4700
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:5044
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN103⤵
- System Location Discovery: System Language Discovery
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"104⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN105⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"106⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN107⤵PID:4192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"108⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN109⤵PID:1040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"110⤵PID:112
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:4436
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN111⤵PID:3488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"112⤵PID:4952
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN113⤵PID:2780
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"114⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN115⤵
- System Location Discovery: System Language Discovery
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"116⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN117⤵
- System Location Discovery: System Language Discovery
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"118⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN119⤵PID:640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"120⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN.exeC:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN121⤵PID:2188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\95732cd02e4cb60c30d720c624d5dddf0e289eb67ba6972a35731e863d65290cN"122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-