Analysis
-
max time kernel
58s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 13:06
Behavioral task
behavioral1
Sample
6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe
-
Size
404KB
-
MD5
7669095339ef3ba8ecc243fb764db290
-
SHA1
4e91ef6578b193835750804d62100ccddf6629e9
-
SHA256
6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6
-
SHA512
56bb7fccdedcd7a42a8630d9cee0f26577e547f60933578db1a53a7daaef72990c26a6c63fff53b29626f513c83fa5d471a126144e9fef6c26b2840258850937
-
SSDEEP
6144:k9pYXf9sWreD5D+Ox1hwDXPtBSp5GL9p:uYX45D+QSTtoTG
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000f00000001866e-9.dat family_neshta behavioral1/files/0x0006000000018687-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x000100000001070c-18.dat family_neshta behavioral1/files/0x00010000000107e5-17.dat family_neshta behavioral1/memory/2844-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2920-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2568-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2572-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/408-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/528-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/804-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2068-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2204-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2988-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2932-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-113.dat family_neshta behavioral1/memory/2376-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f776-116.dat family_neshta behavioral1/files/0x000100000000f82d-141.dat family_neshta behavioral1/files/0x000100000000f703-139.dat family_neshta behavioral1/files/0x000100000000f7e6-137.dat family_neshta behavioral1/files/0x000100000000f7ca-136.dat family_neshta behavioral1/memory/636-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2324-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/564-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3020-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/832-184-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1512-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2416-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1520-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1856-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1156-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1952-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2428-216-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1616-231-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1784-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1908-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2444-251-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2776-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2720-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2540-283-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2708-282-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2080-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1128-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2980-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2644-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/940-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2872-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1300-337-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1348-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1436-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1972-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2108-347-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1120-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2164-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1080-369-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2248-368-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2844 svchost.com 2920 6B0A02~1.EXE 2568 svchost.com 2572 6B0A02~1.EXE 528 svchost.com 408 6B0A02~1.EXE 2068 svchost.com 804 6B0A02~1.EXE 2988 svchost.com 2204 6B0A02~1.EXE 2788 svchost.com 2932 6B0A02~1.EXE 2376 svchost.com 636 6B0A02~1.EXE 2324 svchost.com 564 6B0A02~1.EXE 2232 svchost.com 3020 6B0A02~1.EXE 1512 svchost.com 832 6B0A02~1.EXE 2416 svchost.com 1520 6B0A02~1.EXE 1856 svchost.com 1156 6B0A02~1.EXE 1952 svchost.com 2428 6B0A02~1.EXE 1616 svchost.com 1784 6B0A02~1.EXE 1908 svchost.com 2444 6B0A02~1.EXE 2776 svchost.com 2720 6B0A02~1.EXE 2540 svchost.com 2708 6B0A02~1.EXE 2080 svchost.com 1128 6B0A02~1.EXE 2084 svchost.com 2640 6B0A02~1.EXE 2644 svchost.com 2980 6B0A02~1.EXE 940 svchost.com 2872 6B0A02~1.EXE 2816 svchost.com 1300 6B0A02~1.EXE 1436 svchost.com 1348 6B0A02~1.EXE 1972 svchost.com 2108 6B0A02~1.EXE 2164 svchost.com 1120 6B0A02~1.EXE 2248 svchost.com 1080 6B0A02~1.EXE 1844 svchost.com 676 6B0A02~1.EXE 1416 svchost.com 3020 6B0A02~1.EXE 1716 svchost.com 1508 6B0A02~1.EXE 1512 svchost.com 832 6B0A02~1.EXE 268 svchost.com 2476 6B0A02~1.EXE 1652 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2180 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2180 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2844 svchost.com 2844 svchost.com 2568 svchost.com 2568 svchost.com 528 svchost.com 528 svchost.com 2068 svchost.com 2068 svchost.com 2988 svchost.com 2988 svchost.com 2788 svchost.com 2788 svchost.com 2376 svchost.com 2376 svchost.com 2180 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2324 svchost.com 2324 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2232 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2232 svchost.com 1512 svchost.com 1512 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2416 svchost.com 2416 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 1856 svchost.com 1856 svchost.com 1952 svchost.com 1952 svchost.com 1616 svchost.com 1616 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 1908 svchost.com 1908 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2776 svchost.com 2776 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 2540 svchost.com 2540 svchost.com 2080 svchost.com 2080 svchost.com 2084 svchost.com 2084 svchost.com 2644 svchost.com 2644 svchost.com 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 940 svchost.com 940 svchost.com 2816 svchost.com 2816 svchost.com 1436 svchost.com 1436 svchost.com 1972 svchost.com 1972 svchost.com 2164 svchost.com 2164 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE File opened for modification C:\Windows\svchost.com 6B0A02~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B0A02~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2688 2180 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 30 PID 2180 wrote to memory of 2688 2180 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 30 PID 2180 wrote to memory of 2688 2180 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 30 PID 2180 wrote to memory of 2688 2180 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 30 PID 2688 wrote to memory of 2844 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 31 PID 2688 wrote to memory of 2844 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 31 PID 2688 wrote to memory of 2844 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 31 PID 2688 wrote to memory of 2844 2688 6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe 31 PID 2844 wrote to memory of 2920 2844 svchost.com 32 PID 2844 wrote to memory of 2920 2844 svchost.com 32 PID 2844 wrote to memory of 2920 2844 svchost.com 32 PID 2844 wrote to memory of 2920 2844 svchost.com 32 PID 2920 wrote to memory of 2568 2920 6B0A02~1.EXE 33 PID 2920 wrote to memory of 2568 2920 6B0A02~1.EXE 33 PID 2920 wrote to memory of 2568 2920 6B0A02~1.EXE 33 PID 2920 wrote to memory of 2568 2920 6B0A02~1.EXE 33 PID 2568 wrote to memory of 2572 2568 svchost.com 34 PID 2568 wrote to memory of 2572 2568 svchost.com 34 PID 2568 wrote to memory of 2572 2568 svchost.com 34 PID 2568 wrote to memory of 2572 2568 svchost.com 34 PID 2572 wrote to memory of 528 2572 6B0A02~1.EXE 35 PID 2572 wrote to memory of 528 2572 6B0A02~1.EXE 35 PID 2572 wrote to memory of 528 2572 6B0A02~1.EXE 35 PID 2572 wrote to memory of 528 2572 6B0A02~1.EXE 35 PID 528 wrote to memory of 408 528 svchost.com 36 PID 528 wrote to memory of 408 528 svchost.com 36 PID 528 wrote to memory of 408 528 svchost.com 36 PID 528 wrote to memory of 408 528 svchost.com 36 PID 408 wrote to memory of 2068 408 6B0A02~1.EXE 37 PID 408 wrote to memory of 2068 408 6B0A02~1.EXE 37 PID 408 wrote to memory of 2068 408 6B0A02~1.EXE 37 PID 408 wrote to memory of 2068 408 6B0A02~1.EXE 37 PID 2068 wrote to memory of 804 2068 svchost.com 38 PID 2068 wrote to memory of 804 2068 svchost.com 38 PID 2068 wrote to memory of 804 2068 svchost.com 38 PID 2068 wrote to memory of 804 2068 svchost.com 38 PID 804 wrote to memory of 2988 804 6B0A02~1.EXE 39 PID 804 wrote to memory of 2988 804 6B0A02~1.EXE 39 PID 804 wrote to memory of 2988 804 6B0A02~1.EXE 39 PID 804 wrote to memory of 2988 804 6B0A02~1.EXE 39 PID 2988 wrote to memory of 2204 2988 svchost.com 40 PID 2988 wrote to memory of 2204 2988 svchost.com 40 PID 2988 wrote to memory of 2204 2988 svchost.com 40 PID 2988 wrote to memory of 2204 2988 svchost.com 40 PID 2204 wrote to memory of 2788 2204 6B0A02~1.EXE 41 PID 2204 wrote to memory of 2788 2204 6B0A02~1.EXE 41 PID 2204 wrote to memory of 2788 2204 6B0A02~1.EXE 41 PID 2204 wrote to memory of 2788 2204 6B0A02~1.EXE 41 PID 2788 wrote to memory of 2932 2788 svchost.com 42 PID 2788 wrote to memory of 2932 2788 svchost.com 42 PID 2788 wrote to memory of 2932 2788 svchost.com 42 PID 2788 wrote to memory of 2932 2788 svchost.com 42 PID 2932 wrote to memory of 2376 2932 6B0A02~1.EXE 43 PID 2932 wrote to memory of 2376 2932 6B0A02~1.EXE 43 PID 2932 wrote to memory of 2376 2932 6B0A02~1.EXE 43 PID 2932 wrote to memory of 2376 2932 6B0A02~1.EXE 43 PID 2376 wrote to memory of 636 2376 svchost.com 44 PID 2376 wrote to memory of 636 2376 svchost.com 44 PID 2376 wrote to memory of 636 2376 svchost.com 44 PID 2376 wrote to memory of 636 2376 svchost.com 44 PID 636 wrote to memory of 2324 636 6B0A02~1.EXE 127 PID 636 wrote to memory of 2324 636 6B0A02~1.EXE 127 PID 636 wrote to memory of 2324 636 6B0A02~1.EXE 127 PID 636 wrote to memory of 2324 636 6B0A02~1.EXE 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe"C:\Users\Admin\AppData\Local\Temp\6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\6b0a02dac907e95a899f5aa6e540d4a5c76dcd9f136da44eff496040ddfabbf6N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE22⤵
- Executes dropped EXE
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE24⤵
- Executes dropped EXE
PID:1520 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE26⤵
- Executes dropped EXE
PID:1156 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE28⤵
- Executes dropped EXE
PID:2428 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE30⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE34⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE36⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE38⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2980 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE44⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE46⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1348 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE50⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE54⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"55⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE56⤵
- Executes dropped EXE
PID:676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"57⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE58⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE60⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"61⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"63⤵
- Executes dropped EXE
PID:268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE64⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"65⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE66⤵PID:1856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"67⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE68⤵PID:2268
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"69⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE70⤵PID:2960
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"71⤵
- Drops file in Windows directory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE72⤵PID:2752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"73⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE74⤵
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"75⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE76⤵PID:2672
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"77⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE78⤵PID:2804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"79⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE80⤵PID:2224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"81⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE82⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"83⤵
- Drops file in Windows directory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE84⤵PID:1044
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"85⤵
- Drops file in Windows directory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE86⤵PID:2344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"87⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE88⤵PID:2116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"89⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE90⤵PID:3040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE92⤵PID:2304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"93⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE94⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"95⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"97⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE98⤵PID:1232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"99⤵
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE100⤵PID:2248
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"101⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE102⤵
- Drops file in Windows directory
PID:828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"103⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE104⤵PID:2876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"105⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE106⤵PID:2472
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"107⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE108⤵PID:2416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE110⤵PID:2028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"111⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE112⤵PID:764
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"113⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE114⤵PID:1284
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"115⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"117⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE118⤵PID:2752
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"119⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE120⤵PID:2736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\6B0A02~1.EXE"121⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-