Analysis
-
max time kernel
38s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 19:29
Behavioral task
behavioral1
Sample
2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe
-
Size
3.7MB
-
MD5
e7743360d7504c003717a724c7078da0
-
SHA1
50ddbc01198721da12d3f6940a422c2b6752d29a
-
SHA256
2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503
-
SHA512
b6a83d6db2f18ba56f48e4abbf5f4e24e73d91a01a29d385947cbe72c02a44de891ed8fe37efaa23a08505b4c38a8edc6896126a748bea646e8ece5b245d5968
-
SSDEEP
24576:ruWNAd6RMEAiQRDz7kxPYTVLM46SgezoLZqtVJW8PNwdnk9zUQABRVBJZOWHjD3e:r06XAB4x8LM46A8Np8PaNlRVBJZo
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016df5-4.dat family_neshta behavioral1/files/0x0008000000016edc-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0013000000010321-18.dat family_neshta behavioral1/files/0x000f00000001033a-17.dat family_neshta behavioral1/memory/2132-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2952-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d8-56.dat family_neshta behavioral1/files/0x000100000000f7ca-61.dat family_neshta behavioral1/files/0x000100000000f7e6-65.dat family_neshta behavioral1/memory/2176-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1916-70-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2240-104-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010361-110.dat family_neshta behavioral1/memory/1912-103-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1412-124-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-141-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/376-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/696-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2532-176-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1324-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3008-213-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/396-229-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1548-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2980-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2900-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2312-253-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1760-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1372-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2788-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2640-275-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2668-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1584-236-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/764-228-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1988-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/296-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/644-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2164-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1884-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1504-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1500-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/112-177-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2508-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2476-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2292-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1596-150-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/580-140-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010f30-131.dat family_neshta behavioral1/files/0x00010000000117fc-130.dat family_neshta behavioral1/files/0x0001000000010c12-129.dat family_neshta behavioral1/memory/1724-125-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f872-89.dat family_neshta behavioral1/files/0x000100000000f82e-87.dat family_neshta behavioral1/files/0x000100000000f82d-86.dat family_neshta behavioral1/files/0x000100000000f703-85.dat family_neshta behavioral1/memory/2240-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2132 svchost.com 2952 2EB93C~1.EXE 2756 svchost.com 2648 2EB93C~1.EXE 2176 svchost.com 1916 2EB93C~1.EXE 2240 svchost.com 1912 2EB93C~1.EXE 1724 svchost.com 1412 2EB93C~1.EXE 1640 svchost.com 580 2EB93C~1.EXE 1596 svchost.com 2292 2EB93C~1.EXE 376 svchost.com 2476 2EB93C~1.EXE 2508 svchost.com 696 2EB93C~1.EXE 2532 svchost.com 112 2EB93C~1.EXE 1500 svchost.com 1504 2EB93C~1.EXE 1884 svchost.com 2164 2EB93C~1.EXE 644 svchost.com 1324 2EB93C~1.EXE 2504 svchost.com 3008 2EB93C~1.EXE 296 svchost.com 1988 2EB93C~1.EXE 396 svchost.com 764 2EB93C~1.EXE 1584 svchost.com 1548 2EB93C~1.EXE 2980 svchost.com 2868 2EB93C~1.EXE 2900 svchost.com 2312 2EB93C~1.EXE 2616 svchost.com 2668 2EB93C~1.EXE 2756 svchost.com 2640 2EB93C~1.EXE 2936 svchost.com 2788 2EB93C~1.EXE 1760 svchost.com 1372 2EB93C~1.EXE 2240 svchost.com 1288 2EB93C~1.EXE 2332 svchost.com 1412 2EB93C~1.EXE 332 svchost.com 2456 2EB93C~1.EXE 2424 svchost.com 276 2EB93C~1.EXE 1380 svchost.com 988 2EB93C~1.EXE 1756 svchost.com 1696 2EB93C~1.EXE 2924 svchost.com 2216 2EB93C~1.EXE 2500 svchost.com 2280 2EB93C~1.EXE 2964 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 1580 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 1580 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2132 svchost.com 2132 svchost.com 2756 svchost.com 2756 svchost.com 2176 svchost.com 2176 svchost.com 1580 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2240 svchost.com 2240 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 1724 svchost.com 1724 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 1640 svchost.com 1640 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 1596 svchost.com 1596 svchost.com 376 svchost.com 376 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2508 svchost.com 2508 svchost.com 2532 svchost.com 2532 svchost.com 1500 svchost.com 1500 svchost.com 1884 svchost.com 1884 svchost.com 644 svchost.com 644 svchost.com 2504 svchost.com 2504 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 296 svchost.com 296 svchost.com 396 svchost.com 396 svchost.com 1584 svchost.com 1584 svchost.com 2980 svchost.com 2980 svchost.com 2900 svchost.com 2900 svchost.com 2616 svchost.com 2616 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2756 svchost.com 2756 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2936 svchost.com 2936 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 1760 svchost.com 1760 svchost.com 2240 svchost.com 2240 svchost.com 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 2332 svchost.com 2332 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys 2EB93C~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 2EB93C~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB93C~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2740 1580 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 30 PID 1580 wrote to memory of 2740 1580 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 30 PID 1580 wrote to memory of 2740 1580 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 30 PID 1580 wrote to memory of 2740 1580 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 30 PID 2740 wrote to memory of 2132 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 31 PID 2740 wrote to memory of 2132 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 31 PID 2740 wrote to memory of 2132 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 31 PID 2740 wrote to memory of 2132 2740 2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe 31 PID 2132 wrote to memory of 2952 2132 svchost.com 32 PID 2132 wrote to memory of 2952 2132 svchost.com 32 PID 2132 wrote to memory of 2952 2132 svchost.com 32 PID 2132 wrote to memory of 2952 2132 svchost.com 32 PID 2952 wrote to memory of 2756 2952 2EB93C~1.EXE 71 PID 2952 wrote to memory of 2756 2952 2EB93C~1.EXE 71 PID 2952 wrote to memory of 2756 2952 2EB93C~1.EXE 71 PID 2952 wrote to memory of 2756 2952 2EB93C~1.EXE 71 PID 2756 wrote to memory of 2648 2756 svchost.com 34 PID 2756 wrote to memory of 2648 2756 svchost.com 34 PID 2756 wrote to memory of 2648 2756 svchost.com 34 PID 2756 wrote to memory of 2648 2756 svchost.com 34 PID 2648 wrote to memory of 2176 2648 2EB93C~1.EXE 115 PID 2648 wrote to memory of 2176 2648 2EB93C~1.EXE 115 PID 2648 wrote to memory of 2176 2648 2EB93C~1.EXE 115 PID 2648 wrote to memory of 2176 2648 2EB93C~1.EXE 115 PID 2176 wrote to memory of 1916 2176 svchost.com 36 PID 2176 wrote to memory of 1916 2176 svchost.com 36 PID 2176 wrote to memory of 1916 2176 svchost.com 36 PID 2176 wrote to memory of 1916 2176 svchost.com 36 PID 1916 wrote to memory of 2240 1916 2EB93C~1.EXE 77 PID 1916 wrote to memory of 2240 1916 2EB93C~1.EXE 77 PID 1916 wrote to memory of 2240 1916 2EB93C~1.EXE 77 PID 1916 wrote to memory of 2240 1916 2EB93C~1.EXE 77 PID 2240 wrote to memory of 1912 2240 svchost.com 38 PID 2240 wrote to memory of 1912 2240 svchost.com 38 PID 2240 wrote to memory of 1912 2240 svchost.com 38 PID 2240 wrote to memory of 1912 2240 svchost.com 38 PID 1912 wrote to memory of 1724 1912 2EB93C~1.EXE 39 PID 1912 wrote to memory of 1724 1912 2EB93C~1.EXE 39 PID 1912 wrote to memory of 1724 1912 2EB93C~1.EXE 39 PID 1912 wrote to memory of 1724 1912 2EB93C~1.EXE 39 PID 1724 wrote to memory of 1412 1724 svchost.com 120 PID 1724 wrote to memory of 1412 1724 svchost.com 120 PID 1724 wrote to memory of 1412 1724 svchost.com 120 PID 1724 wrote to memory of 1412 1724 svchost.com 120 PID 1412 wrote to memory of 1640 1412 2EB93C~1.EXE 41 PID 1412 wrote to memory of 1640 1412 2EB93C~1.EXE 41 PID 1412 wrote to memory of 1640 1412 2EB93C~1.EXE 41 PID 1412 wrote to memory of 1640 1412 2EB93C~1.EXE 41 PID 1640 wrote to memory of 580 1640 svchost.com 42 PID 1640 wrote to memory of 580 1640 svchost.com 42 PID 1640 wrote to memory of 580 1640 svchost.com 42 PID 1640 wrote to memory of 580 1640 svchost.com 42 PID 580 wrote to memory of 1596 580 2EB93C~1.EXE 43 PID 580 wrote to memory of 1596 580 2EB93C~1.EXE 43 PID 580 wrote to memory of 1596 580 2EB93C~1.EXE 43 PID 580 wrote to memory of 1596 580 2EB93C~1.EXE 43 PID 1596 wrote to memory of 2292 1596 svchost.com 44 PID 1596 wrote to memory of 2292 1596 svchost.com 44 PID 1596 wrote to memory of 2292 1596 svchost.com 44 PID 1596 wrote to memory of 2292 1596 svchost.com 44 PID 2292 wrote to memory of 376 2292 2EB93C~1.EXE 45 PID 2292 wrote to memory of 376 2292 2EB93C~1.EXE 45 PID 2292 wrote to memory of 376 2292 2EB93C~1.EXE 45 PID 2292 wrote to memory of 376 2292 2EB93C~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe"C:\Users\Admin\AppData\Local\Temp\2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2eb93c4fc2bcf8ed9de92ddae4a565853d61c7d08c206d9e8a3551768a1f4503N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE18⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE20⤵
- Executes dropped EXE
PID:696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE24⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE28⤵
- Executes dropped EXE
PID:1324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE30⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE32⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE34⤵
- Executes dropped EXE
PID:764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE40⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE42⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE46⤵
- Executes dropped EXE
PID:2788 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE48⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1288 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE52⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"53⤵
- Executes dropped EXE
PID:332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE54⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"55⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE56⤵
- Executes dropped EXE
PID:276 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE58⤵
- Executes dropped EXE
PID:988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"59⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE60⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"61⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE62⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"63⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE64⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE66⤵PID:2016
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"67⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE68⤵PID:2476
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"69⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE70⤵PID:2864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"71⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE72⤵PID:2896
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"73⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE74⤵PID:2728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"75⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE76⤵PID:1144
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE78⤵
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"79⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE80⤵PID:2352
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"81⤵
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE82⤵PID:2656
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"83⤵
- Drops file in Windows directory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE84⤵PID:2788
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"85⤵
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE86⤵PID:2160
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"87⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE88⤵PID:992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"89⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE90⤵
- Drops file in Windows directory
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"91⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE92⤵PID:1412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"93⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"95⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE96⤵PID:1256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"97⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE98⤵PID:2660
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"99⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE100⤵PID:1124
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"101⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE102⤵PID:1964
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE104⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"105⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE106⤵PID:1224
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"107⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE108⤵PID:1976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"109⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE110⤵PID:3068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"111⤵
- Drops file in Windows directory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE112⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"113⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE114⤵
- Drops file in Windows directory
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE116⤵
- Drops file in Windows directory
PID:2540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"117⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE118⤵PID:2600
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"119⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE120⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2EB93C~1.EXE"121⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-