Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10192f0f1221...a0.exe
windows7-x64
10192f0f1221...a0.exe
windows10-2004-x64
10193e069cb0...e1.exe
windows7-x64
10193e069cb0...e1.exe
windows10-2004-x64
10196a171e0e...b9.exe
windows7-x64
10196a171e0e...b9.exe
windows10-2004-x64
10197a511efa...32.exe
windows7-x64
8197a511efa...32.exe
windows10-2004-x64
819ec0ef7b7...c4.exe
windows7-x64
1019ec0ef7b7...c4.exe
windows10-2004-x64
101a4ae15ef3...a3.exe
windows7-x64
101a4ae15ef3...a3.exe
windows10-2004-x64
101a76abc85d...f9.exe
windows7-x64
61a76abc85d...f9.exe
windows10-2004-x64
61a9cd1714a...bf.exe
windows7-x64
101a9cd1714a...bf.exe
windows10-2004-x64
101b06c73e9c...af.exe
windows7-x64
101b06c73e9c...af.exe
windows10-2004-x64
101b0acebe24...06.exe
windows7-x64
101b0acebe24...06.exe
windows10-2004-x64
101b64ed84e0...ca.exe
windows7-x64
101b64ed84e0...ca.exe
windows10-2004-x64
101b7c2cbdf7...fc.exe
windows7-x64
101b7c2cbdf7...fc.exe
windows10-2004-x64
101bb302f6b2...b3.exe
windows7-x64
101bb302f6b2...b3.exe
windows10-2004-x64
101bbf7d818b...fd.exe
windows7-x64
101bbf7d818b...fd.exe
windows10-2004-x64
101be2b92cea...ae.exe
windows7-x64
101be2b92cea...ae.exe
windows10-2004-x64
101c2345047a...a0.exe
windows7-x64
101c2345047a...a0.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:17
Behavioral task
behavioral1
Sample
192f0f1221e376146e725a4d23ee69a0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
192f0f1221e376146e725a4d23ee69a0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
196a171e0e93d86ea0a2e62e57df3214202969dfdc4a3d635f228fe0a53565b9.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
196a171e0e93d86ea0a2e62e57df3214202969dfdc4a3d635f228fe0a53565b9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
197a511efac9c171f1a50077e9ae4a32.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
197a511efac9c171f1a50077e9ae4a32.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
19ec0ef7b7ce9c5d9d5a2c9ee955a5c4.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
19ec0ef7b7ce9c5d9d5a2c9ee955a5c4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
1a4ae15ef300f51f70607edc1e8e62a3.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
1a4ae15ef300f51f70607edc1e8e62a3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
1a76abc85db21c92e847aa3562aab0b09c56bdce383b54b6957b78314d4429f9.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
1a76abc85db21c92e847aa3562aab0b09c56bdce383b54b6957b78314d4429f9.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral15
Sample
1a9cd1714a3e518cfd51f84f1be819bf.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
1a9cd1714a3e518cfd51f84f1be819bf.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral17
Sample
1b06c73e9c03f55f8fe3c26f374a889e7095d080c3448d4d040db1ebf46f6aaf.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
1b06c73e9c03f55f8fe3c26f374a889e7095d080c3448d4d040db1ebf46f6aaf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
1b7c2cbdf74b50ca0c081bd3404b8054bd85c6e0ab7b65f5863d2dd3d2fc9cfc.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
1b7c2cbdf74b50ca0c081bd3404b8054bd85c6e0ab7b65f5863d2dd3d2fc9cfc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
1bb302f6b26022b9f405c4a06c165b236837688e94ea312a231c8f780e63d2b3.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
1bb302f6b26022b9f405c4a06c165b236837688e94ea312a231c8f780e63d2b3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
1bbf7d818b40f8fa0da224e39f27829bb7d8a8bdbec66fa62cfba39cd0d6d3fd.exe
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
1bbf7d818b40f8fa0da224e39f27829bb7d8a8bdbec66fa62cfba39cd0d6d3fd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
1be2b92ceabc55905ef2d5a4d28e28f80931887ca1b7aa2557775e09402d36ae.exe
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
1be2b92ceabc55905ef2d5a4d28e28f80931887ca1b7aa2557775e09402d36ae.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
1c2345047abfb5daed017769f13254053b7c8cfe14027982065835c6a4bc9aa0.exe
Resource
win7-20250207-en
General
-
Target
1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe
-
Size
316KB
-
MD5
3712cf0750a5fd9bec05a0b62be6397d
-
SHA1
1024df56ce919a3695a7a881de4742b9ea06a221
-
SHA256
1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306
-
SHA512
416c2c3e16049ff492f48de8d0d6b8b009d9468d90fd2e07250b8c2a9b7dcd746098f834ebe30adfea1f5457271ba9480bd4db3d7882deb235c0579d140e6ee8
-
SSDEEP
6144:4xURWkZv8/643Toyn6jIvril1nKMn9oW6AL/RN2ozqd9K:4qYkZODoy6je2nKM9oKD2oem
Malware Config
Extracted
xworm
127.0.0.1:7000
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral20/files/0x00130000000234ea-11.dat family_xworm behavioral20/memory/4140-21-0x00000000006B0000-0x00000000006C2000-memory.dmp family_xworm -
Xworm family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation 1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation Output.exe -
Executes dropped EXE 64 IoCs
pid Process 4140 XClient.exe 5432 Output.exe 4560 XClient.exe 4556 Output.exe 4708 XClient.exe 6012 Output.exe 4732 XClient.exe 4672 Output.exe 4260 XClient.exe 5456 Output.exe 5052 XClient.exe 5776 Output.exe 508 XClient.exe 3548 Output.exe 6040 XClient.exe 4088 Output.exe 5704 XClient.exe 3132 Output.exe 944 XClient.exe 1380 Output.exe 1336 XClient.exe 3108 Output.exe 5064 XClient.exe 5772 Output.exe 2720 XClient.exe 5864 Output.exe 2384 XClient.exe 3680 Output.exe 5700 XClient.exe 3536 Output.exe 3156 XClient.exe 5304 Output.exe 5572 XClient.exe 932 Output.exe 1844 XClient.exe 876 Output.exe 344 XClient.exe 5636 Output.exe 5308 XClient.exe 5532 Output.exe 3076 XClient.exe 3584 Output.exe 2508 XClient.exe 1104 Output.exe 3980 XClient.exe 3396 Output.exe 3560 XClient.exe 6100 Output.exe 8 XClient.exe 1992 Output.exe 2412 XClient.exe 5528 Output.exe 4308 XClient.exe 4296 Output.exe 2520 XClient.exe 5768 Output.exe 3088 XClient.exe 5608 Output.exe 4600 XClient.exe 4616 Output.exe 4788 XClient.exe 4524 Output.exe 4728 XClient.exe 4924 Output.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4140 XClient.exe Token: SeDebugPrivilege 4560 XClient.exe Token: SeDebugPrivilege 4708 XClient.exe Token: SeDebugPrivilege 4732 XClient.exe Token: SeDebugPrivilege 4260 XClient.exe Token: SeDebugPrivilege 5052 XClient.exe Token: SeDebugPrivilege 508 XClient.exe Token: SeDebugPrivilege 6040 XClient.exe Token: SeDebugPrivilege 5704 XClient.exe Token: SeDebugPrivilege 944 XClient.exe Token: SeDebugPrivilege 1336 XClient.exe Token: SeDebugPrivilege 5064 XClient.exe Token: SeDebugPrivilege 2720 XClient.exe Token: SeDebugPrivilege 2384 XClient.exe Token: SeDebugPrivilege 5700 XClient.exe Token: SeDebugPrivilege 3156 XClient.exe Token: SeDebugPrivilege 5572 XClient.exe Token: SeDebugPrivilege 1844 XClient.exe Token: SeDebugPrivilege 344 XClient.exe Token: SeDebugPrivilege 5308 XClient.exe Token: SeDebugPrivilege 3076 XClient.exe Token: SeDebugPrivilege 2508 XClient.exe Token: SeDebugPrivilege 3980 XClient.exe Token: SeDebugPrivilege 3560 XClient.exe Token: SeDebugPrivilege 8 XClient.exe Token: SeDebugPrivilege 2412 XClient.exe Token: SeDebugPrivilege 4308 XClient.exe Token: SeDebugPrivilege 2520 XClient.exe Token: SeDebugPrivilege 3088 XClient.exe Token: SeDebugPrivilege 4600 XClient.exe Token: SeDebugPrivilege 4788 XClient.exe Token: SeDebugPrivilege 4728 XClient.exe Token: SeDebugPrivilege 1364 XClient.exe Token: SeDebugPrivilege 5776 XClient.exe Token: SeDebugPrivilege 4020 XClient.exe Token: SeDebugPrivilege 5468 XClient.exe Token: SeDebugPrivilege 3108 XClient.exe Token: SeDebugPrivilege 2560 XClient.exe Token: SeDebugPrivilege 5644 XClient.exe Token: SeDebugPrivilege 3536 XClient.exe Token: SeDebugPrivilege 628 XClient.exe Token: SeDebugPrivilege 112 XClient.exe Token: SeDebugPrivilege 976 XClient.exe Token: SeDebugPrivilege 2092 XClient.exe Token: SeDebugPrivilege 2916 XClient.exe Token: SeDebugPrivilege 2752 XClient.exe Token: SeDebugPrivilege 4528 XClient.exe Token: SeDebugPrivilege 2408 XClient.exe Token: SeDebugPrivilege 5136 XClient.exe Token: SeDebugPrivilege 4652 XClient.exe Token: SeDebugPrivilege 5504 XClient.exe Token: SeDebugPrivilege 1428 XClient.exe Token: SeDebugPrivilege 6088 XClient.exe Token: SeDebugPrivilege 3680 XClient.exe Token: SeDebugPrivilege 2632 XClient.exe Token: SeDebugPrivilege 4440 XClient.exe Token: SeDebugPrivilege 1120 XClient.exe Token: SeDebugPrivilege 6128 XClient.exe Token: SeDebugPrivilege 1296 XClient.exe Token: SeDebugPrivilege 2008 XClient.exe Token: SeDebugPrivilege 6044 XClient.exe Token: SeDebugPrivilege 5212 XClient.exe Token: SeDebugPrivilege 1992 XClient.exe Token: SeDebugPrivilege 3780 XClient.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6060 wrote to memory of 4140 6060 1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe 87 PID 6060 wrote to memory of 4140 6060 1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe 87 PID 6060 wrote to memory of 5432 6060 1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe 89 PID 6060 wrote to memory of 5432 6060 1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe 89 PID 5432 wrote to memory of 4560 5432 Output.exe 337 PID 5432 wrote to memory of 4560 5432 Output.exe 337 PID 5432 wrote to memory of 4556 5432 Output.exe 382 PID 5432 wrote to memory of 4556 5432 Output.exe 382 PID 4556 wrote to memory of 4708 4556 Output.exe 647 PID 4556 wrote to memory of 4708 4556 Output.exe 647 PID 4556 wrote to memory of 6012 4556 Output.exe 259 PID 4556 wrote to memory of 6012 4556 Output.exe 259 PID 6012 wrote to memory of 4732 6012 Output.exe 94 PID 6012 wrote to memory of 4732 6012 Output.exe 94 PID 6012 wrote to memory of 4672 6012 Output.exe 95 PID 6012 wrote to memory of 4672 6012 Output.exe 95 PID 4672 wrote to memory of 4260 4672 Output.exe 458 PID 4672 wrote to memory of 4260 4672 Output.exe 458 PID 4672 wrote to memory of 5456 4672 Output.exe 97 PID 4672 wrote to memory of 5456 4672 Output.exe 97 PID 5456 wrote to memory of 5052 5456 Output.exe 403 PID 5456 wrote to memory of 5052 5456 Output.exe 403 PID 5456 wrote to memory of 5776 5456 Output.exe 99 PID 5456 wrote to memory of 5776 5456 Output.exe 99 PID 5776 wrote to memory of 508 5776 Output.exe 832 PID 5776 wrote to memory of 508 5776 Output.exe 832 PID 5776 wrote to memory of 3548 5776 Output.exe 227 PID 5776 wrote to memory of 3548 5776 Output.exe 227 PID 3548 wrote to memory of 6040 3548 Output.exe 102 PID 3548 wrote to memory of 6040 3548 Output.exe 102 PID 3548 wrote to memory of 4088 3548 Output.exe 103 PID 3548 wrote to memory of 4088 3548 Output.exe 103 PID 4088 wrote to memory of 5704 4088 Output.exe 1642 PID 4088 wrote to memory of 5704 4088 Output.exe 1642 PID 4088 wrote to memory of 3132 4088 Output.exe 968 PID 4088 wrote to memory of 3132 4088 Output.exe 968 PID 3132 wrote to memory of 944 3132 Output.exe 346 PID 3132 wrote to memory of 944 3132 Output.exe 346 PID 3132 wrote to memory of 1380 3132 Output.exe 1197 PID 3132 wrote to memory of 1380 3132 Output.exe 1197 PID 1380 wrote to memory of 1336 1380 Output.exe 108 PID 1380 wrote to memory of 1336 1380 Output.exe 108 PID 1380 wrote to memory of 3108 1380 Output.exe 1677 PID 1380 wrote to memory of 3108 1380 Output.exe 1677 PID 3108 wrote to memory of 5064 3108 Output.exe 1685 PID 3108 wrote to memory of 5064 3108 Output.exe 1685 PID 3108 wrote to memory of 5772 3108 Output.exe 1114 PID 3108 wrote to memory of 5772 3108 Output.exe 1114 PID 5772 wrote to memory of 2720 5772 Output.exe 669 PID 5772 wrote to memory of 2720 5772 Output.exe 669 PID 5772 wrote to memory of 5864 5772 Output.exe 1069 PID 5772 wrote to memory of 5864 5772 Output.exe 1069 PID 5864 wrote to memory of 2384 5864 Output.exe 114 PID 5864 wrote to memory of 2384 5864 Output.exe 114 PID 5864 wrote to memory of 3680 5864 Output.exe 201 PID 5864 wrote to memory of 3680 5864 Output.exe 201 PID 3680 wrote to memory of 5700 3680 Output.exe 1792 PID 3680 wrote to memory of 5700 3680 Output.exe 1792 PID 3680 wrote to memory of 3536 3680 Output.exe 572 PID 3680 wrote to memory of 3536 3680 Output.exe 572 PID 3536 wrote to memory of 3156 3536 Output.exe 118 PID 3536 wrote to memory of 3156 3536 Output.exe 118 PID 3536 wrote to memory of 5304 3536 Output.exe 119 PID 3536 wrote to memory of 5304 3536 Output.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe"C:\Users\Admin\AppData\Local\Temp\1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:508
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6040
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5704
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
PID:5304 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5572
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"18⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"19⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:344
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
PID:5636 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5308
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"21⤵
- Executes dropped EXE
PID:5532 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
PID:6100 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:8
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"26⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"27⤵
- Executes dropped EXE
PID:5528 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"29⤵
- Executes dropped EXE
PID:5768 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
PID:5608 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"33⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"34⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"34⤵PID:384
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
PID:5776
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"35⤵
- Checks computer location settings
PID:4808 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"36⤵
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"36⤵PID:3220
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"37⤵
- Suspicious use of AdjustPrivilegeToken
PID:5468
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"37⤵PID:5288
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"38⤵
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"38⤵
- Checks computer location settings
PID:4080 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"39⤵
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"39⤵PID:3280
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"40⤵
- Suspicious use of AdjustPrivilegeToken
PID:5644
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"40⤵PID:1720
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"41⤵
- Checks computer location settings
PID:2012 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"42⤵
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"42⤵PID:932
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"43⤵
- Suspicious use of AdjustPrivilegeToken
PID:112
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"43⤵PID:5660
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"44⤵
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"44⤵PID:3856
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"45⤵
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"45⤵
- Checks computer location settings
PID:3476 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"46⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"46⤵
- Checks computer location settings
PID:5676 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"47⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"47⤵PID:1936
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"48⤵PID:3112
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"48⤵PID:3912
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"49⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"49⤵PID:5608
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"50⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"50⤵PID:4592
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"51⤵
- Suspicious use of AdjustPrivilegeToken
PID:5136
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"51⤵PID:4552
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"52⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"52⤵
- Checks computer location settings
PID:3104 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"53⤵
- Suspicious use of AdjustPrivilegeToken
PID:5504
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"53⤵
- Checks computer location settings
PID:3668 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"54⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"54⤵
- Checks computer location settings
PID:5180 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"55⤵
- Suspicious use of AdjustPrivilegeToken
PID:6088
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"55⤵PID:2572
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"56⤵
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"56⤵
- Checks computer location settings
PID:6008 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"57⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"57⤵PID:1720
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"58⤵
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"58⤵
- Checks computer location settings
PID:2272 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"59⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"59⤵PID:876
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"60⤵
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"60⤵
- Checks computer location settings
PID:920 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"61⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"61⤵
- Checks computer location settings
PID:4196 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"62⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"62⤵
- Checks computer location settings
PID:3204 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"63⤵
- Suspicious use of AdjustPrivilegeToken
PID:6044
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"63⤵PID:2900
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"64⤵
- Suspicious use of AdjustPrivilegeToken
PID:5212
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"64⤵
- Checks computer location settings
PID:3268 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"65⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"65⤵PID:5648
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"66⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"66⤵PID:6060
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"67⤵PID:4580
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"67⤵PID:4556
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"68⤵PID:4924
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"68⤵
- Checks computer location settings
PID:1204 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"69⤵PID:3548
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"69⤵
- Checks computer location settings
PID:5720 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"70⤵PID:5296
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"70⤵PID:1612
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"71⤵PID:5440
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"71⤵
- Checks computer location settings
PID:1196 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"72⤵PID:840
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"72⤵
- Checks computer location settings
PID:844 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"73⤵PID:5368
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"73⤵
- Checks computer location settings
PID:3628 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"74⤵PID:1444
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"74⤵PID:2476
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"75⤵PID:2088
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"75⤵
- Checks computer location settings
PID:3752 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"76⤵PID:3596
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"76⤵
- Checks computer location settings
PID:5396 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"77⤵PID:3092
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"77⤵PID:4852
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"78⤵PID:2412
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"78⤵PID:3656
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"79⤵PID:2152
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"79⤵PID:5144
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"80⤵PID:4644
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"80⤵PID:5500
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"81⤵PID:4676
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"81⤵PID:2856
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"82⤵PID:2464
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"82⤵
- Checks computer location settings
PID:3192 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"83⤵PID:1048
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"83⤵
- Checks computer location settings
PID:4688 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"84⤵PID:4352
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"84⤵PID:5392
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"85⤵PID:6012
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"85⤵PID:2208
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"86⤵PID:1952
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"86⤵
- Checks computer location settings
PID:4696 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"87⤵PID:344
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"87⤵
- Checks computer location settings
PID:5720 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"88⤵PID:3392
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"88⤵
- Checks computer location settings
PID:3220 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"89⤵PID:5076
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"89⤵
- Checks computer location settings
PID:3252 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"90⤵PID:6008
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"90⤵
- Checks computer location settings
PID:6040 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"91⤵PID:444
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"91⤵
- Checks computer location settings
PID:1644 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"92⤵PID:4276
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"92⤵
- Checks computer location settings
PID:4892 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"93⤵PID:3732
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"93⤵PID:2736
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"94⤵PID:1232
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"94⤵
- Checks computer location settings
PID:2544 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"95⤵PID:1372
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"95⤵
- Checks computer location settings
PID:1416 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"96⤵PID:1392
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"96⤵PID:5124
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"97⤵PID:1112
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"97⤵PID:3428
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"98⤵PID:4600
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"98⤵
- Checks computer location settings
PID:3452 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"99⤵PID:4688
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"99⤵
- Checks computer location settings
PID:4368 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"100⤵PID:5184
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"100⤵PID:5600
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"101⤵PID:856
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"101⤵PID:4264
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"102⤵PID:1676
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"102⤵PID:5528
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"103⤵PID:2316
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"103⤵
- Checks computer location settings
PID:2532 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"104⤵PID:4904
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"104⤵
- Checks computer location settings
PID:5388 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"105⤵PID:3792
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"105⤵PID:5988
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"106⤵PID:2320
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"106⤵PID:3108
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"107⤵PID:5304
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"107⤵PID:3944
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"108⤵PID:4152
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"108⤵
- Checks computer location settings
PID:5504 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"109⤵PID:3656
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"109⤵PID:2756
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"110⤵PID:1716
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"110⤵PID:4588
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"111⤵PID:5676
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"111⤵
- Checks computer location settings
PID:4968 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"112⤵PID:4292
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"112⤵
- Checks computer location settings
PID:4472 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"113⤵PID:620
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"113⤵PID:3912
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"114⤵PID:4940
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"114⤵
- Checks computer location settings
PID:3224 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"115⤵PID:1188
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"115⤵PID:2208
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"116⤵PID:5268
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"116⤵
- Checks computer location settings
PID:5776 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"117⤵PID:2136
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"117⤵PID:5720
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"118⤵PID:4072
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"118⤵PID:3220
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"119⤵PID:5216
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"119⤵PID:5836
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"120⤵PID:4212
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"120⤵PID:3440
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"121⤵PID:5332
-
-
C:\Users\Admin\AppData\Roaming\Output.exe"C:\Users\Admin\AppData\Roaming\Output.exe"121⤵
- Checks computer location settings
PID:5812 -
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"122⤵PID:3480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-