Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-01-2025 23:23
Behavioral task
behavioral1
Sample
9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe
-
Size
1.0MB
-
MD5
f4c66a81b575670408bf550ebe6f0e30
-
SHA1
49c93276942187c71f0e425abad49a72cc7ea539
-
SHA256
9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7
-
SHA512
acd2c719e2a6871e2fe988b03f16217c56fe32b223f83e0a83d8f93f302a0744ca4e85746c1efe47121513f74d4e0d38de6761085f98552850bb0a6f5e192f42
-
SSDEEP
6144:k9wF9N9N9N9N9N9N9N9N9N9N9N9N9N9N9N9N9N9N9N9N9:
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016dc6-9.dat family_neshta behavioral1/files/0x0008000000016dc9-15.dat family_neshta behavioral1/files/0x0001000000010319-20.dat family_neshta behavioral1/files/0x0001000000010317-19.dat family_neshta behavioral1/files/0x000100000001064f-18.dat family_neshta behavioral1/files/0x000b000000010326-17.dat family_neshta behavioral1/memory/2672-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2944-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2864-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2580-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7d9-84.dat family_neshta behavioral1/memory/2432-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2920-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f77c-89.dat family_neshta behavioral1/files/0x000100000000f7de-88.dat family_neshta behavioral1/files/0x000100000000f7d0-91.dat family_neshta behavioral1/files/0x000100000000f87a-108.dat family_neshta behavioral1/files/0x000100000000f834-107.dat family_neshta behavioral1/files/0x000100000000f833-106.dat family_neshta behavioral1/files/0x000100000000f709-105.dat family_neshta behavioral1/memory/1816-104-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-103-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x0001000000010374-115.dat family_neshta behavioral1/memory/1996-137-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2972-147-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/832-162-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-163-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/676-175-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1072-174-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-155-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1152-154-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2252-146-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/296-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7ec-97.dat family_neshta behavioral1/memory/940-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2488-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1544-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1988-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/860-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/568-213-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/876-228-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/988-227-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2456-240-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2680-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2596-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-279-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3028-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1308-295-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2360-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2868-303-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2432-313-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2072-312-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2016-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1468-329-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1624-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/868-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/480-337-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2768-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2304-345-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2672 svchost.com 2944 9D3C83~1.EXE 2864 svchost.com 2828 9D3C83~1.EXE 2580 svchost.com 2360 9D3C83~1.EXE 2432 svchost.com 2920 9D3C83~1.EXE 1816 svchost.com 2052 9D3C83~1.EXE 296 svchost.com 1996 9D3C83~1.EXE 2972 svchost.com 2252 9D3C83~1.EXE 1648 svchost.com 1152 9D3C83~1.EXE 2092 svchost.com 832 9D3C83~1.EXE 676 svchost.com 1072 9D3C83~1.EXE 940 svchost.com 2488 9D3C83~1.EXE 1544 svchost.com 1988 9D3C83~1.EXE 568 svchost.com 860 9D3C83~1.EXE 988 svchost.com 876 9D3C83~1.EXE 2456 svchost.com 1712 9D3C83~1.EXE 2752 svchost.com 2680 9D3C83~1.EXE 2596 svchost.com 2564 9D3C83~1.EXE 3028 svchost.com 1308 9D3C83~1.EXE 2360 svchost.com 2868 9D3C83~1.EXE 2432 svchost.com 2072 9D3C83~1.EXE 2016 svchost.com 2608 9D3C83~1.EXE 1624 svchost.com 1468 9D3C83~1.EXE 868 svchost.com 480 9D3C83~1.EXE 2304 svchost.com 2768 9D3C83~1.EXE 2056 svchost.com 3044 9D3C83~1.EXE 1992 svchost.com 1376 9D3C83~1.EXE 1312 svchost.com 2968 9D3C83~1.EXE 1044 svchost.com 556 9D3C83~1.EXE 1980 svchost.com 1464 9D3C83~1.EXE 1528 svchost.com 1724 9D3C83~1.EXE 1688 svchost.com 2396 9D3C83~1.EXE 2484 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2096 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2096 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2672 svchost.com 2672 svchost.com 2864 svchost.com 2864 svchost.com 2580 svchost.com 2580 svchost.com 2432 svchost.com 2432 svchost.com 1816 svchost.com 1816 svchost.com 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2096 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 296 svchost.com 296 svchost.com 2972 svchost.com 2972 svchost.com 1648 svchost.com 1648 svchost.com 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2092 svchost.com 2092 svchost.com 676 svchost.com 676 svchost.com 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 940 svchost.com 940 svchost.com 1544 svchost.com 1544 svchost.com 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 568 svchost.com 568 svchost.com 988 svchost.com 988 svchost.com 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2456 svchost.com 2456 svchost.com 2752 svchost.com 2752 svchost.com 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 2596 svchost.com 2596 svchost.com 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 3028 svchost.com 3028 svchost.com 2360 svchost.com 2360 svchost.com 2432 svchost.com 2432 svchost.com 2016 svchost.com 2016 svchost.com 1624 svchost.com 1624 svchost.com 868 svchost.com 868 svchost.com 2304 svchost.com 2304 svchost.com 2056 svchost.com 2056 svchost.com 1992 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE File opened for modification C:\Windows\svchost.com 9D3C83~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3C83~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2272 2096 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 31 PID 2096 wrote to memory of 2272 2096 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 31 PID 2096 wrote to memory of 2272 2096 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 31 PID 2096 wrote to memory of 2272 2096 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 31 PID 2272 wrote to memory of 2672 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 32 PID 2272 wrote to memory of 2672 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 32 PID 2272 wrote to memory of 2672 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 32 PID 2272 wrote to memory of 2672 2272 9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe 32 PID 2672 wrote to memory of 2944 2672 svchost.com 33 PID 2672 wrote to memory of 2944 2672 svchost.com 33 PID 2672 wrote to memory of 2944 2672 svchost.com 33 PID 2672 wrote to memory of 2944 2672 svchost.com 33 PID 2944 wrote to memory of 2864 2944 9D3C83~1.EXE 34 PID 2944 wrote to memory of 2864 2944 9D3C83~1.EXE 34 PID 2944 wrote to memory of 2864 2944 9D3C83~1.EXE 34 PID 2944 wrote to memory of 2864 2944 9D3C83~1.EXE 34 PID 2864 wrote to memory of 2828 2864 svchost.com 35 PID 2864 wrote to memory of 2828 2864 svchost.com 35 PID 2864 wrote to memory of 2828 2864 svchost.com 35 PID 2864 wrote to memory of 2828 2864 svchost.com 35 PID 2828 wrote to memory of 2580 2828 9D3C83~1.EXE 36 PID 2828 wrote to memory of 2580 2828 9D3C83~1.EXE 36 PID 2828 wrote to memory of 2580 2828 9D3C83~1.EXE 36 PID 2828 wrote to memory of 2580 2828 9D3C83~1.EXE 36 PID 2580 wrote to memory of 2360 2580 svchost.com 68 PID 2580 wrote to memory of 2360 2580 svchost.com 68 PID 2580 wrote to memory of 2360 2580 svchost.com 68 PID 2580 wrote to memory of 2360 2580 svchost.com 68 PID 2360 wrote to memory of 2432 2360 9D3C83~1.EXE 70 PID 2360 wrote to memory of 2432 2360 9D3C83~1.EXE 70 PID 2360 wrote to memory of 2432 2360 9D3C83~1.EXE 70 PID 2360 wrote to memory of 2432 2360 9D3C83~1.EXE 70 PID 2432 wrote to memory of 2920 2432 svchost.com 39 PID 2432 wrote to memory of 2920 2432 svchost.com 39 PID 2432 wrote to memory of 2920 2432 svchost.com 39 PID 2432 wrote to memory of 2920 2432 svchost.com 39 PID 2920 wrote to memory of 1816 2920 9D3C83~1.EXE 40 PID 2920 wrote to memory of 1816 2920 9D3C83~1.EXE 40 PID 2920 wrote to memory of 1816 2920 9D3C83~1.EXE 40 PID 2920 wrote to memory of 1816 2920 9D3C83~1.EXE 40 PID 1816 wrote to memory of 2052 1816 svchost.com 41 PID 1816 wrote to memory of 2052 1816 svchost.com 41 PID 1816 wrote to memory of 2052 1816 svchost.com 41 PID 1816 wrote to memory of 2052 1816 svchost.com 41 PID 2052 wrote to memory of 296 2052 9D3C83~1.EXE 122 PID 2052 wrote to memory of 296 2052 9D3C83~1.EXE 122 PID 2052 wrote to memory of 296 2052 9D3C83~1.EXE 122 PID 2052 wrote to memory of 296 2052 9D3C83~1.EXE 122 PID 296 wrote to memory of 1996 296 svchost.com 129 PID 296 wrote to memory of 1996 296 svchost.com 129 PID 296 wrote to memory of 1996 296 svchost.com 129 PID 296 wrote to memory of 1996 296 svchost.com 129 PID 1996 wrote to memory of 2972 1996 9D3C83~1.EXE 44 PID 1996 wrote to memory of 2972 1996 9D3C83~1.EXE 44 PID 1996 wrote to memory of 2972 1996 9D3C83~1.EXE 44 PID 1996 wrote to memory of 2972 1996 9D3C83~1.EXE 44 PID 2972 wrote to memory of 2252 2972 svchost.com 45 PID 2972 wrote to memory of 2252 2972 svchost.com 45 PID 2972 wrote to memory of 2252 2972 svchost.com 45 PID 2972 wrote to memory of 2252 2972 svchost.com 45 PID 2252 wrote to memory of 1648 2252 9D3C83~1.EXE 46 PID 2252 wrote to memory of 1648 2252 9D3C83~1.EXE 46 PID 2252 wrote to memory of 1648 2252 9D3C83~1.EXE 46 PID 2252 wrote to memory of 1648 2252 9D3C83~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe"C:\Users\Admin\AppData\Local\Temp\9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\9d3c832f54f4d3e2bbc1d067cbd246b836a4de2002ed44ec70e859f50fe5efa7N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE18⤵
- Executes dropped EXE
PID:1152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE20⤵
- Executes dropped EXE
PID:832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE22⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE24⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE28⤵
- Executes dropped EXE
PID:860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE30⤵
- Executes dropped EXE
PID:876 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE34⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE36⤵
- Executes dropped EXE
PID:2564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE38⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE40⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE42⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE44⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE46⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE50⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2768 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE52⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE54⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"55⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE56⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"57⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"59⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE60⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"61⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE62⤵
- Executes dropped EXE
PID:1724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"63⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE64⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE66⤵PID:2984
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"67⤵
- Drops file in Windows directory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"69⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE70⤵PID:1760
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"71⤵
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE72⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"73⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE74⤵PID:2556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"75⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE76⤵PID:2584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"77⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE78⤵PID:2864
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"79⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE80⤵
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"81⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE82⤵PID:2912
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"83⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE84⤵PID:2908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"85⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE86⤵PID:2856
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"87⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE88⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"89⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE90⤵PID:2648
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE92⤵PID:264
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"93⤵
- Drops file in Windows directory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE94⤵PID:2976
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"95⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"97⤵
- Drops file in Windows directory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE98⤵PID:2368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"99⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE100⤵
- Drops file in Windows directory
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"101⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE102⤵PID:372
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"103⤵
- Drops file in Windows directory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE104⤵PID:836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"105⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE106⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"107⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE108⤵PID:2992
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"109⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE110⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"111⤵
- System Location Discovery: System Language Discovery
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE112⤵PID:2452
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE114⤵PID:1740
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"115⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE116⤵PID:1596
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"117⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE118⤵PID:2420
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"119⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE120⤵PID:2556
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\9D3C83~1.EXE"121⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-