Analysis
-
max time kernel
31s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
04-01-2025 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe
-
Size
257KB
-
MD5
a21a10aa6027254a8d1e38e060215ac3
-
SHA1
58af229abb8ec4fbed29c012f07d4b56e7409433
-
SHA256
258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b
-
SHA512
65d08842968272d2c0c1f01fbd1d6dcb05b6213fc597439a76831b02c2dae2e41a5bc23cf46a0fb918cf5c279a9f4bec0ad0f036f6e9bce3ac5f256bb0907f07
-
SSDEEP
6144:jyH7xOc6H5c6HcT66vlmrEbAMpgY3gTH8DRBUeRUqptyH7xOc6H5c6HcT66vlmrM:ja6+Me7ale0
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016ce0-17.dat family_neshta behavioral1/files/0x0008000000016ce9-33.dat family_neshta behavioral1/files/0x0007000000016d0c-49.dat family_neshta behavioral1/files/0x0001000000010314-57.dat family_neshta behavioral1/files/0x0001000000010312-56.dat family_neshta behavioral1/files/0x0005000000010351-54.dat family_neshta behavioral1/memory/2824-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2780-65-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2204-79-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/736-78-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1788-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1612-93-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1044-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2540-107-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2880-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1432-135-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1760-134-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2192-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2132-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2376-161-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2396-160-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/924-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1588-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1972-192-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1048-191-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1592-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1580-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2136-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1516-243-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/868-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1084-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2148-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1644-274-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3060-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2996-284-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/816-283-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2808-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2616-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2836-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/968-312-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-311-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/616-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/736-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/584-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1676-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1724-377-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1432-376-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/572-388-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-387-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2416-397-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1956-396-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1128-405-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1864-404-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2664-413-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2144-412-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2504-420-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1496-421-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2312 svchost.exe 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 3016 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2904 svchost.exe 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2172 svchost.exe 2780 svchost.com 2824 258DF3~1.EXE 2204 svchost.com 736 258DF3~1.EXE 1788 svchost.com 1612 258DF3~1.EXE 1044 svchost.com 2540 258DF3~1.EXE 1820 svchost.com 2880 258DF3~1.EXE 1432 svchost.com 1760 258DF3~1.EXE 2192 svchost.com 2132 258DF3~1.EXE 2376 svchost.com 2396 258DF3~1.EXE 1588 svchost.com 924 258DF3~1.EXE 1048 svchost.com 1972 258DF3~1.EXE 2460 svchost.com 2232 258DF3~1.EXE 1580 svchost.com 1592 258DF3~1.EXE 2136 svchost.com 1516 258DF3~1.EXE 868 svchost.com 1084 258DF3~1.EXE 2716 svchost.com 2148 258DF3~1.EXE 1644 svchost.com 3060 258DF3~1.EXE 2996 svchost.com 816 258DF3~1.EXE 2712 svchost.com 2808 258DF3~1.EXE 2616 svchost.com 2836 258DF3~1.EXE 968 svchost.com 2412 258DF3~1.EXE 736 svchost.com 616 258DF3~1.EXE 584 svchost.com 2252 258DF3~1.EXE 1820 svchost.com 1676 258DF3~1.EXE 1724 svchost.com 1432 258DF3~1.EXE 572 svchost.com 2432 258DF3~1.EXE 2416 svchost.com 1956 258DF3~1.EXE 1128 svchost.com 1864 258DF3~1.EXE 2664 svchost.com 2144 258DF3~1.EXE 1496 svchost.com 2504 258DF3~1.EXE -
Loads dropped DLL 64 IoCs
pid Process 2312 svchost.exe 2312 svchost.exe 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2904 svchost.exe 2904 svchost.exe 2780 svchost.com 2780 svchost.com 2204 svchost.com 2204 svchost.com 1788 svchost.com 1788 svchost.com 1044 svchost.com 1044 svchost.com 1820 svchost.com 1820 svchost.com 1432 svchost.com 1432 svchost.com 2192 svchost.com 2192 svchost.com 2376 svchost.com 2376 svchost.com 1588 svchost.com 1588 svchost.com 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 1048 svchost.com 1048 svchost.com 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2460 svchost.com 2460 svchost.com 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 1580 svchost.com 1580 svchost.com 2136 svchost.com 2136 svchost.com 868 svchost.com 868 svchost.com 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2716 svchost.com 2716 svchost.com 1644 svchost.com 1644 svchost.com 2996 svchost.com 2996 svchost.com 2712 svchost.com 2712 svchost.com 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 2616 svchost.com 2616 svchost.com 968 svchost.com 968 svchost.com 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 736 svchost.com 736 svchost.com 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 584 svchost.com 584 svchost.com 1820 svchost.com 1820 svchost.com 1724 svchost.com 1724 svchost.com 572 svchost.com 572 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File created C:\Windows\svchost.exe 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 258DF3~1.EXE File opened for modification C:\Windows\directx.sys 258DF3~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 258DF3~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1084 wrote to memory of 2312 1084 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 30 PID 1084 wrote to memory of 2312 1084 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 30 PID 1084 wrote to memory of 2312 1084 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 30 PID 1084 wrote to memory of 2312 1084 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 30 PID 2312 wrote to memory of 2464 2312 svchost.exe 31 PID 2312 wrote to memory of 2464 2312 svchost.exe 31 PID 2312 wrote to memory of 2464 2312 svchost.exe 31 PID 2312 wrote to memory of 2464 2312 svchost.exe 31 PID 2464 wrote to memory of 3016 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 32 PID 2464 wrote to memory of 3016 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 32 PID 2464 wrote to memory of 3016 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 32 PID 2464 wrote to memory of 3016 2464 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 32 PID 3016 wrote to memory of 2904 3016 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 3016 wrote to memory of 2904 3016 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 3016 wrote to memory of 2904 3016 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 3016 wrote to memory of 2904 3016 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 33 PID 2904 wrote to memory of 2912 2904 svchost.exe 34 PID 2904 wrote to memory of 2912 2904 svchost.exe 34 PID 2904 wrote to memory of 2912 2904 svchost.exe 34 PID 2904 wrote to memory of 2912 2904 svchost.exe 34 PID 2912 wrote to memory of 2780 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 36 PID 2912 wrote to memory of 2780 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 36 PID 2912 wrote to memory of 2780 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 36 PID 2912 wrote to memory of 2780 2912 258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe 36 PID 2780 wrote to memory of 2824 2780 svchost.com 37 PID 2780 wrote to memory of 2824 2780 svchost.com 37 PID 2780 wrote to memory of 2824 2780 svchost.com 37 PID 2780 wrote to memory of 2824 2780 svchost.com 37 PID 2824 wrote to memory of 2204 2824 258DF3~1.EXE 38 PID 2824 wrote to memory of 2204 2824 258DF3~1.EXE 38 PID 2824 wrote to memory of 2204 2824 258DF3~1.EXE 38 PID 2824 wrote to memory of 2204 2824 258DF3~1.EXE 38 PID 2204 wrote to memory of 736 2204 svchost.com 39 PID 2204 wrote to memory of 736 2204 svchost.com 39 PID 2204 wrote to memory of 736 2204 svchost.com 39 PID 2204 wrote to memory of 736 2204 svchost.com 39 PID 736 wrote to memory of 1788 736 258DF3~1.EXE 40 PID 736 wrote to memory of 1788 736 258DF3~1.EXE 40 PID 736 wrote to memory of 1788 736 258DF3~1.EXE 40 PID 736 wrote to memory of 1788 736 258DF3~1.EXE 40 PID 1788 wrote to memory of 1612 1788 svchost.com 41 PID 1788 wrote to memory of 1612 1788 svchost.com 41 PID 1788 wrote to memory of 1612 1788 svchost.com 41 PID 1788 wrote to memory of 1612 1788 svchost.com 41 PID 1612 wrote to memory of 1044 1612 258DF3~1.EXE 42 PID 1612 wrote to memory of 1044 1612 258DF3~1.EXE 42 PID 1612 wrote to memory of 1044 1612 258DF3~1.EXE 42 PID 1612 wrote to memory of 1044 1612 258DF3~1.EXE 42 PID 1044 wrote to memory of 2540 1044 svchost.com 43 PID 1044 wrote to memory of 2540 1044 svchost.com 43 PID 1044 wrote to memory of 2540 1044 svchost.com 43 PID 1044 wrote to memory of 2540 1044 svchost.com 43 PID 2540 wrote to memory of 1820 2540 258DF3~1.EXE 80 PID 2540 wrote to memory of 1820 2540 258DF3~1.EXE 80 PID 2540 wrote to memory of 1820 2540 258DF3~1.EXE 80 PID 2540 wrote to memory of 1820 2540 258DF3~1.EXE 80 PID 1820 wrote to memory of 2880 1820 svchost.com 45 PID 1820 wrote to memory of 2880 1820 svchost.com 45 PID 1820 wrote to memory of 2880 1820 svchost.com 45 PID 1820 wrote to memory of 2880 1820 svchost.com 45 PID 2880 wrote to memory of 1432 2880 258DF3~1.EXE 132 PID 2880 wrote to memory of 1432 2880 258DF3~1.EXE 132 PID 2880 wrote to memory of 1432 2880 258DF3~1.EXE 132 PID 2880 wrote to memory of 1432 2880 258DF3~1.EXE 132
Processes
-
C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\258df3371764b8ecb73ff5d97ed381afd47e58cf6fc4db48641062a29feed65b.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE22⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE28⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE30⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE32⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE34⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE38⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE40⤵
- Executes dropped EXE
PID:816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE46⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE48⤵
- Executes dropped EXE
PID:616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE50⤵
- Executes dropped EXE
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE52⤵
- Executes dropped EXE
PID:1676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE56⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"57⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE58⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"59⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"61⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"63⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE64⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"65⤵
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE66⤵
- Drops file in Windows directory
PID:2336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"67⤵
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE68⤵PID:1004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"69⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE70⤵
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"71⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE72⤵
- Drops file in Windows directory
PID:2036 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"73⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE74⤵PID:564
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"75⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE76⤵PID:740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"77⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE78⤵PID:2872
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"79⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE80⤵PID:1560
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"81⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE82⤵
- Drops file in Windows directory
PID:1892 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"83⤵
- Drops file in Windows directory
PID:424 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE84⤵PID:816
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"85⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE86⤵PID:2808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"87⤵
- Drops file in Windows directory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE88⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"89⤵
- System Location Discovery: System Language Discovery
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE90⤵PID:1572
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"91⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE92⤵PID:1744
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"93⤵
- Drops file in Windows directory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"95⤵
- Drops file in Windows directory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE96⤵PID:2316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"97⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE98⤵
- System Location Discovery: System Language Discovery
PID:660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"99⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE100⤵PID:1168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"101⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE102⤵
- Drops file in Windows directory
PID:2400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE104⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"105⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE106⤵PID:2424
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"107⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE108⤵
- Drops file in Windows directory
PID:532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"109⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE110⤵PID:2676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"111⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE114⤵PID:1052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"115⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE116⤵
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"117⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE118⤵PID:1276
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE120⤵PID:1712
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\258DF3~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-