Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-01-2025 15:36
Behavioral task
behavioral1
Sample
927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe
-
Size
3.5MB
-
MD5
e67f1d45faeeaf090828146717416f10
-
SHA1
fc3373d369f1a771f249ed32133318c4396f5391
-
SHA256
927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9
-
SHA512
d20c82fa7a0e7993fca0ec23cfda08b1f44e01a6f5edc39056618ab4c020bb9630b5b5794de0f1bf7ba17a9c64ba715ab0e77a35145b386fafc77731c0b35cf7
-
SSDEEP
24576:6eaedDJh+YAu35naNirXqlG2qSOuaRc3uS2ORNGaqWXcPEfkk8qsuqfNxfnPaXa:62JdqmS2ORJdc8fqVuiNF
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016dd0-2.dat family_neshta behavioral1/files/0x0008000000016de4-15.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x000700000001033a-17.dat family_neshta behavioral1/files/0x0022000000010678-16.dat family_neshta behavioral1/memory/2628-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2684-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2888-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-66-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2540-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f776-72.dat family_neshta behavioral1/memory/2996-77-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7e6-82.dat family_neshta behavioral1/memory/2612-78-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f703-95.dat family_neshta behavioral1/memory/1380-103-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1164-102-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82e-114.dat family_neshta behavioral1/files/0x000100000000f872-117.dat family_neshta behavioral1/memory/2776-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2596-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82d-98.dat family_neshta behavioral1/memory/468-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2960-159-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010b94-136.dat family_neshta behavioral1/memory/856-170-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2904-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1636-183-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-184-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2248-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1312-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1000-221-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1548-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1760-234-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2172-233-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/900-241-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1052-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2296-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/304-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1596-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2748-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1920-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2696-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3068-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1316-287-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2556-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2088-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2992-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1128-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1368-312-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1756-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1440-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2760-320-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1948-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/496-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1924-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2188-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2472-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 2628 svchost.com 2684 927E4F~1.EXE 2820 svchost.com 2888 927E4F~1.EXE 2864 svchost.com 2540 927E4F~1.EXE 2612 svchost.com 2996 927E4F~1.EXE 1380 svchost.com 1164 927E4F~1.EXE 2596 svchost.com 2776 927E4F~1.EXE 468 svchost.com 2960 927E4F~1.EXE 856 svchost.com 2904 927E4F~1.EXE 3016 svchost.com 1636 927E4F~1.EXE 1312 svchost.com 2248 927E4F~1.EXE 1000 svchost.com 1548 927E4F~1.EXE 1760 svchost.com 2172 927E4F~1.EXE 1052 svchost.com 900 927E4F~1.EXE 2296 svchost.com 304 927E4F~1.EXE 1596 svchost.com 2616 927E4F~1.EXE 2748 svchost.com 2732 927E4F~1.EXE 1920 svchost.com 2696 927E4F~1.EXE 3068 svchost.com 1316 927E4F~1.EXE 2556 svchost.com 2088 927E4F~1.EXE 2992 svchost.com 1128 927E4F~1.EXE 1368 svchost.com 1756 927E4F~1.EXE 2760 svchost.com 1440 927E4F~1.EXE 2360 svchost.com 1948 927E4F~1.EXE 496 svchost.com 1924 927E4F~1.EXE 2972 svchost.com 2188 927E4F~1.EXE 2472 svchost.com 1836 927E4F~1.EXE 1764 svchost.com 2148 927E4F~1.EXE 1140 svchost.com 2912 927E4F~1.EXE 3024 svchost.com 1820 927E4F~1.EXE 1068 svchost.com 1636 927E4F~1.EXE 860 svchost.com 1956 927E4F~1.EXE 1984 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2488 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 2488 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 2628 svchost.com 2628 svchost.com 2820 svchost.com 2820 svchost.com 2864 svchost.com 2864 svchost.com 2612 svchost.com 2612 svchost.com 2488 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 1380 svchost.com 1380 svchost.com 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 2596 svchost.com 2596 svchost.com 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 468 svchost.com 468 svchost.com 856 svchost.com 856 svchost.com 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 3016 svchost.com 3016 svchost.com 1312 svchost.com 1312 svchost.com 1000 svchost.com 1000 svchost.com 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 1760 svchost.com 1760 svchost.com 1052 svchost.com 1052 svchost.com 2296 svchost.com 2296 svchost.com 1596 svchost.com 1596 svchost.com 2748 svchost.com 2748 svchost.com 1920 svchost.com 1920 svchost.com 3068 svchost.com 3068 svchost.com 2556 svchost.com 2556 svchost.com 2992 svchost.com 2992 svchost.com 1368 svchost.com 1368 svchost.com 2760 svchost.com 2760 svchost.com 2360 svchost.com 2360 svchost.com 496 svchost.com 496 svchost.com 2972 svchost.com 2972 svchost.com 2472 svchost.com 2472 svchost.com 1764 svchost.com 1764 svchost.com 1140 svchost.com 1140 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\svchost.com 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 927E4F~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 927E4F~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927E4F~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 824 2488 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 31 PID 2488 wrote to memory of 824 2488 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 31 PID 2488 wrote to memory of 824 2488 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 31 PID 2488 wrote to memory of 824 2488 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 31 PID 824 wrote to memory of 2628 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 32 PID 824 wrote to memory of 2628 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 32 PID 824 wrote to memory of 2628 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 32 PID 824 wrote to memory of 2628 824 927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe 32 PID 2628 wrote to memory of 2684 2628 svchost.com 33 PID 2628 wrote to memory of 2684 2628 svchost.com 33 PID 2628 wrote to memory of 2684 2628 svchost.com 33 PID 2628 wrote to memory of 2684 2628 svchost.com 33 PID 2684 wrote to memory of 2820 2684 927E4F~1.EXE 34 PID 2684 wrote to memory of 2820 2684 927E4F~1.EXE 34 PID 2684 wrote to memory of 2820 2684 927E4F~1.EXE 34 PID 2684 wrote to memory of 2820 2684 927E4F~1.EXE 34 PID 2820 wrote to memory of 2888 2820 svchost.com 35 PID 2820 wrote to memory of 2888 2820 svchost.com 35 PID 2820 wrote to memory of 2888 2820 svchost.com 35 PID 2820 wrote to memory of 2888 2820 svchost.com 35 PID 2888 wrote to memory of 2864 2888 927E4F~1.EXE 36 PID 2888 wrote to memory of 2864 2888 927E4F~1.EXE 36 PID 2888 wrote to memory of 2864 2888 927E4F~1.EXE 36 PID 2888 wrote to memory of 2864 2888 927E4F~1.EXE 36 PID 2864 wrote to memory of 2540 2864 svchost.com 37 PID 2864 wrote to memory of 2540 2864 svchost.com 37 PID 2864 wrote to memory of 2540 2864 svchost.com 37 PID 2864 wrote to memory of 2540 2864 svchost.com 37 PID 2540 wrote to memory of 2612 2540 927E4F~1.EXE 38 PID 2540 wrote to memory of 2612 2540 927E4F~1.EXE 38 PID 2540 wrote to memory of 2612 2540 927E4F~1.EXE 38 PID 2540 wrote to memory of 2612 2540 927E4F~1.EXE 38 PID 2612 wrote to memory of 2996 2612 svchost.com 39 PID 2612 wrote to memory of 2996 2612 svchost.com 39 PID 2612 wrote to memory of 2996 2612 svchost.com 39 PID 2612 wrote to memory of 2996 2612 svchost.com 39 PID 2996 wrote to memory of 1380 2996 927E4F~1.EXE 40 PID 2996 wrote to memory of 1380 2996 927E4F~1.EXE 40 PID 2996 wrote to memory of 1380 2996 927E4F~1.EXE 40 PID 2996 wrote to memory of 1380 2996 927E4F~1.EXE 40 PID 1380 wrote to memory of 1164 1380 svchost.com 41 PID 1380 wrote to memory of 1164 1380 svchost.com 41 PID 1380 wrote to memory of 1164 1380 svchost.com 41 PID 1380 wrote to memory of 1164 1380 svchost.com 41 PID 1164 wrote to memory of 2596 1164 927E4F~1.EXE 122 PID 1164 wrote to memory of 2596 1164 927E4F~1.EXE 122 PID 1164 wrote to memory of 2596 1164 927E4F~1.EXE 122 PID 1164 wrote to memory of 2596 1164 927E4F~1.EXE 122 PID 2596 wrote to memory of 2776 2596 svchost.com 43 PID 2596 wrote to memory of 2776 2596 svchost.com 43 PID 2596 wrote to memory of 2776 2596 svchost.com 43 PID 2596 wrote to memory of 2776 2596 svchost.com 43 PID 2776 wrote to memory of 468 2776 927E4F~1.EXE 44 PID 2776 wrote to memory of 468 2776 927E4F~1.EXE 44 PID 2776 wrote to memory of 468 2776 927E4F~1.EXE 44 PID 2776 wrote to memory of 468 2776 927E4F~1.EXE 44 PID 468 wrote to memory of 2960 468 svchost.com 45 PID 468 wrote to memory of 2960 468 svchost.com 45 PID 468 wrote to memory of 2960 468 svchost.com 45 PID 468 wrote to memory of 2960 468 svchost.com 45 PID 2960 wrote to memory of 856 2960 927E4F~1.EXE 46 PID 2960 wrote to memory of 856 2960 927E4F~1.EXE 46 PID 2960 wrote to memory of 856 2960 927E4F~1.EXE 46 PID 2960 wrote to memory of 856 2960 927E4F~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe"C:\Users\Admin\AppData\Local\Temp\927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\927e4fd8addaa8f4e3cfb9b68f9f2184f1832a5f458feeb95ee388e5b7c65ae9N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE18⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE20⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE22⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE24⤵
- Executes dropped EXE
PID:1548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE30⤵
- Executes dropped EXE
PID:304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE32⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE34⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE36⤵
- Executes dropped EXE
PID:2696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE40⤵
- Executes dropped EXE
PID:2088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE44⤵
- Executes dropped EXE
PID:1756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1440 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE48⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE50⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE56⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE58⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"59⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE60⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"61⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"63⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE64⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"65⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE66⤵PID:2168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"67⤵
- Drops file in Windows directory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE68⤵PID:1680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"69⤵
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE70⤵
- System Location Discovery: System Language Discovery
PID:1012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"71⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE72⤵PID:1048
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"73⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE74⤵PID:2312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"75⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE76⤵
- Drops file in Windows directory
PID:2644 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"77⤵
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE78⤵PID:2792
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"79⤵
- Drops file in Windows directory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE80⤵PID:2736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"81⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE82⤵
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"83⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE84⤵
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"85⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE86⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE88⤵PID:2856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"89⤵
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE90⤵PID:664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"91⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"93⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE94⤵PID:3012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"95⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE96⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"97⤵
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE98⤵PID:276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"99⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE100⤵PID:396
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE102⤵PID:1720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"103⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE104⤵PID:1580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"105⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE106⤵
- Drops file in Windows directory
PID:916 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"107⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE108⤵
- Drops file in Windows directory
PID:688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"109⤵
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE110⤵
- Drops file in Windows directory
PID:1540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"111⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE112⤵PID:2144
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"113⤵
- Drops file in Windows directory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE114⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"115⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE116⤵PID:1256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"117⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE118⤵PID:820
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"119⤵
- Drops file in Windows directory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE120⤵
- Drops file in Windows directory
PID:1600 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\927E4F~1.EXE"121⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-