Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 19:48
Static task
static1
Behavioral task
behavioral1
Sample
1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe
Resource
win10v2004-20241007-en
General
-
Target
1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe
-
Size
187KB
-
MD5
165ff7a540b2338d7b848c17c9e9e9ca
-
SHA1
2b4ccc7579cd41e57cd6e19108ea7df964b6b0b9
-
SHA256
1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5
-
SHA512
225e7909b4587c2a090681de0ac870c5ad00f245f6467e51f1b99489d149fffd8e57907fceb435b31b30c4adaadb89b0e718a73cdace715369b269584bec41be
-
SSDEEP
3072:kxqO4KrRMCg2fMLAEO8NGzswbpA3fiani/dckNHqTl9EsRVKQoY:koOMCDMLANEf9iFckNK59EPY
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (81) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation pwAAgUcQ.exe -
Executes dropped EXE 2 IoCs
pid Process 3864 cwkokwAo.exe 964 pwAAgUcQ.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cwkokwAo.exe = "C:\\Users\\Admin\\USMQAEkw\\cwkokwAo.exe" 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pwAAgUcQ.exe = "C:\\ProgramData\\fGkMcgYc\\pwAAgUcQ.exe" 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pwAAgUcQ.exe = "C:\\ProgramData\\fGkMcgYc\\pwAAgUcQ.exe" pwAAgUcQ.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cwkokwAo.exe = "C:\\Users\\Admin\\USMQAEkw\\cwkokwAo.exe" cwkokwAo.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\shell32.dll.exe pwAAgUcQ.exe File opened for modification C:\Windows\SysWOW64\shell32.dll.exe pwAAgUcQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 3392 Process not Found 1972 reg.exe 4160 reg.exe 3552 reg.exe 428 reg.exe 2180 Process not Found 2524 reg.exe 3084 Process not Found 3496 reg.exe 4488 reg.exe 4220 Process not Found 908 reg.exe 4432 reg.exe 4048 reg.exe 1400 reg.exe 2612 reg.exe 4084 reg.exe 4176 reg.exe 464 reg.exe 4544 Process not Found 3404 reg.exe 4084 reg.exe 4572 reg.exe 2636 reg.exe 4884 reg.exe 1572 reg.exe 2232 reg.exe 3432 reg.exe 1452 reg.exe 1944 reg.exe 1884 reg.exe 2600 reg.exe 2240 reg.exe 980 reg.exe 3456 reg.exe 1688 Process not Found 4024 reg.exe 2256 reg.exe 4680 reg.exe 1476 reg.exe 4800 reg.exe 1768 Process not Found 4728 reg.exe 428 reg.exe 1824 Process not Found 3448 Process not Found 3012 reg.exe 1900 reg.exe 2416 reg.exe 2612 reg.exe 4220 Process not Found 4816 reg.exe 3644 reg.exe 3268 reg.exe 1880 reg.exe 4772 Process not Found 1536 reg.exe 1364 reg.exe 3108 reg.exe 1128 reg.exe 1544 reg.exe 1340 reg.exe 1284 reg.exe 2956 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4780 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4780 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4780 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4780 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2024 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2024 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2024 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2024 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2188 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2188 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2188 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2188 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3448 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3448 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3448 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3448 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2432 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2432 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2432 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2432 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3552 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3552 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3552 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3552 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4772 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4772 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4772 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4772 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2424 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2424 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2424 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2424 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 516 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 516 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 516 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 516 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 548 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 548 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 548 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 548 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3636 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3636 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3636 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 3636 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2100 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2100 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2100 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 2100 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4148 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4148 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4148 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 4148 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 964 pwAAgUcQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe 964 pwAAgUcQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 3864 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 82 PID 4792 wrote to memory of 3864 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 82 PID 4792 wrote to memory of 3864 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 82 PID 4792 wrote to memory of 964 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 83 PID 4792 wrote to memory of 964 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 83 PID 4792 wrote to memory of 964 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 83 PID 4792 wrote to memory of 1572 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 84 PID 4792 wrote to memory of 1572 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 84 PID 4792 wrote to memory of 1572 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 84 PID 1572 wrote to memory of 4016 1572 cmd.exe 86 PID 1572 wrote to memory of 4016 1572 cmd.exe 86 PID 1572 wrote to memory of 4016 1572 cmd.exe 86 PID 4792 wrote to memory of 2740 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 87 PID 4792 wrote to memory of 2740 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 87 PID 4792 wrote to memory of 2740 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 87 PID 4792 wrote to memory of 3124 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 88 PID 4792 wrote to memory of 3124 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 88 PID 4792 wrote to memory of 3124 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 88 PID 4792 wrote to memory of 3996 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 89 PID 4792 wrote to memory of 3996 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 89 PID 4792 wrote to memory of 3996 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 89 PID 4792 wrote to memory of 3584 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 90 PID 4792 wrote to memory of 3584 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 90 PID 4792 wrote to memory of 3584 4792 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 90 PID 3584 wrote to memory of 2004 3584 cmd.exe 95 PID 3584 wrote to memory of 2004 3584 cmd.exe 95 PID 3584 wrote to memory of 2004 3584 cmd.exe 95 PID 4016 wrote to memory of 2864 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 96 PID 4016 wrote to memory of 2864 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 96 PID 4016 wrote to memory of 2864 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 96 PID 4016 wrote to memory of 1260 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 98 PID 4016 wrote to memory of 1260 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 98 PID 4016 wrote to memory of 1260 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 98 PID 4016 wrote to memory of 2928 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 99 PID 4016 wrote to memory of 2928 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 99 PID 4016 wrote to memory of 2928 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 99 PID 4016 wrote to memory of 2900 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 100 PID 4016 wrote to memory of 2900 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 100 PID 4016 wrote to memory of 2900 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 100 PID 4016 wrote to memory of 776 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 101 PID 4016 wrote to memory of 776 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 101 PID 4016 wrote to memory of 776 4016 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 101 PID 2864 wrote to memory of 2748 2864 cmd.exe 106 PID 2864 wrote to memory of 2748 2864 cmd.exe 106 PID 2864 wrote to memory of 2748 2864 cmd.exe 106 PID 776 wrote to memory of 1576 776 cmd.exe 107 PID 776 wrote to memory of 1576 776 cmd.exe 107 PID 776 wrote to memory of 1576 776 cmd.exe 107 PID 2748 wrote to memory of 5024 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 108 PID 2748 wrote to memory of 5024 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 108 PID 2748 wrote to memory of 5024 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 108 PID 2748 wrote to memory of 4404 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 110 PID 2748 wrote to memory of 4404 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 110 PID 2748 wrote to memory of 4404 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 110 PID 2748 wrote to memory of 2540 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 112 PID 2748 wrote to memory of 2540 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 112 PID 2748 wrote to memory of 2540 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 112 PID 5024 wrote to memory of 4780 5024 cmd.exe 111 PID 5024 wrote to memory of 4780 5024 cmd.exe 111 PID 5024 wrote to memory of 4780 5024 cmd.exe 111 PID 2748 wrote to memory of 4672 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 113 PID 2748 wrote to memory of 4672 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 113 PID 2748 wrote to memory of 4672 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 113 PID 2748 wrote to memory of 4736 2748 1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe"C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\USMQAEkw\cwkokwAo.exe"C:\Users\Admin\USMQAEkw\cwkokwAo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3864
-
-
C:\ProgramData\fGkMcgYc\pwAAgUcQ.exe"C:\ProgramData\fGkMcgYc\pwAAgUcQ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba53⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"4⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba55⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"6⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba57⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"8⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba59⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"10⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba511⤵
- Suspicious behavior: EnumeratesProcesses
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"12⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba513⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"14⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba515⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"16⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba517⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"18⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba519⤵
- Suspicious behavior: EnumeratesProcesses
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"20⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba521⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"22⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba523⤵
- Suspicious behavior: EnumeratesProcesses
PID:516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"24⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba525⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"26⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba527⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"28⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba529⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"30⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba531⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"32⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba533⤵PID:4676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"34⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba535⤵PID:4820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"36⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba537⤵PID:3852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"38⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba539⤵PID:4144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"40⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba541⤵PID:776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"42⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba543⤵PID:5088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"44⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba545⤵PID:2056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"46⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba547⤵PID:1536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"48⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba549⤵PID:3108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"50⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba551⤵PID:2524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"52⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba553⤵PID:2396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"54⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba555⤵PID:2828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"56⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba557⤵PID:876
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"58⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba559⤵PID:1800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"60⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba561⤵PID:4396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"62⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba563⤵PID:4076
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"64⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba565⤵PID:1596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"66⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba567⤵PID:1892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"68⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba569⤵PID:464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"70⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba571⤵PID:4764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"72⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba573⤵PID:2492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"74⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba575⤵PID:4248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"76⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba577⤵PID:3820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"78⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba579⤵PID:464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"80⤵
- System Location Discovery: System Language Discovery
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba581⤵PID:4764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"82⤵
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba583⤵PID:1724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"84⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba585⤵PID:1356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"86⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba587⤵PID:2540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"88⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba589⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"90⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba591⤵PID:4820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"92⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba593⤵PID:4400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"94⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba595⤵
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"96⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba597⤵PID:2012
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"98⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba599⤵PID:1924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"100⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5101⤵PID:776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"102⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5103⤵PID:3632
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"104⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5105⤵PID:2472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"106⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5107⤵PID:4280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"108⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5109⤵PID:3432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"110⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5111⤵PID:4832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"112⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5113⤵PID:2232
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"114⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5115⤵PID:1824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"116⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5117⤵PID:640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"118⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5119⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"120⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5.exeC:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5121⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1693c70edbe17a0347d769d47eb88715bc22dc50c2e1b1af187a39fa22c07ba5"122⤵PID:3580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-