Analysis
-
max time kernel
154s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2023 15:49
Behavioral task
behavioral1
Sample
NEAS.252812a584840421c504c6b70d224460.exe
Resource
win7-20231025-en
General
-
Target
NEAS.252812a584840421c504c6b70d224460.exe
-
Size
225KB
-
MD5
252812a584840421c504c6b70d224460
-
SHA1
1f6439095e4b7a354993ffb9cc9a592aa8d80c2e
-
SHA256
c7541559d0094babdd6a8908a2879e0a6d0e291e671aaced913597d027521e8d
-
SHA512
21f4d19aa002df6f737fcc2d7113ae74c79cd8696c06f28e697ea5b5c8589572bff40a1975ff3b8e994d269163b688597f1024036c99c635d17d0b4a757cd1e9
-
SSDEEP
6144:jcm4FmowdHoSbuCHfYWNhraHcpOaKHpOCt:J4wFHoSbxYSeFaKHpOCt
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1460-5-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2340-9-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4664-18-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2096-16-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4272-29-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2072-27-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4588-35-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/116-47-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4880-53-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1684-68-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5096-77-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3104-91-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3704-99-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4948-104-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5076-107-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1372-118-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2004-114-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3604-132-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3100-134-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4128-146-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5100-152-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2760-166-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1368-171-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5000-177-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3616-174-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2556-181-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1912-183-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1576-197-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2316-200-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4604-206-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1412-212-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4576-233-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1756-236-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3828-239-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4312-241-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2548-246-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3104-249-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3992-258-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1748-271-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2996-278-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3732-285-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4920-290-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1460-309-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2736-342-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1384-353-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/772-375-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4868-392-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3228-402-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5000-413-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2316-432-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2764-470-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2576-506-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4408-522-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1412-541-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3112-552-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1384-568-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4352-595-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1812-620-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1380-645-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4972-732-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4812-790-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3880-812-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3780-1171-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3296-2311-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/1460-0-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0008000000022e29-3.dat family_berbew behavioral2/memory/1460-5-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0008000000022e29-4.dat family_berbew behavioral2/files/0x0007000000022e2e-8.dat family_berbew behavioral2/memory/2096-11-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e2e-10.dat family_berbew behavioral2/memory/2340-9-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e2f-14.dat family_berbew behavioral2/files/0x0007000000022e2f-12.dat family_berbew behavioral2/memory/4664-18-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2096-16-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e2f-15.dat family_berbew behavioral2/files/0x0008000000022e2a-20.dat family_berbew behavioral2/files/0x0008000000022e2a-22.dat family_berbew behavioral2/files/0x0007000000022e31-25.dat family_berbew behavioral2/files/0x0007000000022e31-26.dat family_berbew behavioral2/memory/4272-29-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2072-27-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e32-31.dat family_berbew behavioral2/memory/4588-35-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e32-33.dat family_berbew behavioral2/files/0x0007000000022e33-37.dat family_berbew behavioral2/files/0x0007000000022e33-39.dat family_berbew behavioral2/files/0x0007000000022e34-42.dat family_berbew behavioral2/memory/116-47-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e35-48.dat family_berbew behavioral2/files/0x0007000000022e34-43.dat family_berbew behavioral2/files/0x0007000000022e35-49.dat family_berbew behavioral2/files/0x0007000000022e36-52.dat family_berbew behavioral2/memory/4880-53-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e36-54.dat family_berbew behavioral2/files/0x0007000000022e37-57.dat family_berbew behavioral2/files/0x0007000000022e37-59.dat family_berbew behavioral2/files/0x0007000000022e38-62.dat family_berbew behavioral2/files/0x0007000000022e38-64.dat family_berbew behavioral2/files/0x0007000000022e39-67.dat family_berbew behavioral2/memory/1684-68-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e39-69.dat family_berbew behavioral2/files/0x0007000000022e3a-72.dat family_berbew behavioral2/memory/5096-77-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e3a-74.dat family_berbew behavioral2/files/0x0007000000022e3b-78.dat family_berbew behavioral2/files/0x0007000000022e3b-79.dat family_berbew behavioral2/files/0x0007000000022e3d-82.dat family_berbew behavioral2/files/0x0007000000022e3d-84.dat family_berbew behavioral2/files/0x0007000000022e3e-87.dat family_berbew behavioral2/files/0x0007000000022e3e-89.dat family_berbew behavioral2/memory/3104-91-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e3f-95.dat family_berbew behavioral2/files/0x0007000000022e3f-94.dat family_berbew behavioral2/memory/3704-99-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e40-100.dat family_berbew behavioral2/files/0x0007000000022e41-105.dat family_berbew behavioral2/memory/4948-104-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e41-103.dat family_berbew behavioral2/files/0x0007000000022e40-98.dat family_berbew behavioral2/memory/5076-107-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e42-109.dat family_berbew behavioral2/files/0x0007000000022e42-111.dat family_berbew behavioral2/files/0x0007000000022e43-116.dat family_berbew behavioral2/files/0x0007000000022e43-115.dat family_berbew behavioral2/memory/1372-118-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000022e44-121.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2340 ttx6anc.exe 2096 j4ss9r3.exe 4664 ra1s7k.exe 2072 9xwiok.exe 4272 jw7mls.exe 4588 s33934v.exe 3624 u73e1w3.exe 116 hmu4xm8.exe 4880 mj0i2us.exe 3572 h2v47.exe 2192 3635uo.exe 1684 298uei.exe 3696 o6a6w.exe 5096 5x7l5.exe 996 3n43r40.exe 2148 apvka47.exe 3104 3ap44.exe 3704 4o08w.exe 4948 h9q509.exe 5076 x5cu3l.exe 2004 ef21o10.exe 1372 11d7e7.exe 4580 peok19.exe 3604 co8tt56.exe 3100 ktj82n.exe 2400 t9o2bdl.exe 4128 do4s6.exe 5100 218g3.exe 3672 t41q9.exe 4804 15uwo.exe 2760 96txf.exe 1368 ad1ap9h.exe 3616 0683pb.exe 5000 cq3cggc.exe 2556 g6dh065.exe 1912 i2m7s16.exe 1644 l14a1.exe 1632 n6n861t.exe 1568 76i52k.exe 1576 ls43k.exe 2316 5772s59.exe 4896 542t8.exe 4604 b8bcxbr.exe 2664 v5e1gp.exe 1412 iw3msga.exe 3880 09j529m.exe 1508 903jw.exe 3624 cc57ux.exe 3628 758gh.exe 4852 3c10m.exe 1504 4b58p1.exe 4576 h4a7s.exe 1756 2sr8sv5.exe 3828 4909r5e.exe 4312 n5o15l.exe 2548 p1ss3.exe 3104 72br8.exe 2232 et0sim.exe 4524 4ciukc6.exe 3992 1hdwt.exe 4928 6p0wi.exe 2928 p9d0wv.exe 4196 fhw13.exe 1748 cj0o76.exe -
resource yara_rule behavioral2/memory/1460-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0008000000022e29-3.dat upx behavioral2/memory/1460-5-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0008000000022e29-4.dat upx behavioral2/files/0x0007000000022e2e-8.dat upx behavioral2/memory/2096-11-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e2e-10.dat upx behavioral2/memory/2340-9-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e2f-14.dat upx behavioral2/files/0x0007000000022e2f-12.dat upx behavioral2/memory/4664-18-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2096-16-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e2f-15.dat upx behavioral2/files/0x0008000000022e2a-20.dat upx behavioral2/files/0x0008000000022e2a-22.dat upx behavioral2/files/0x0007000000022e31-25.dat upx behavioral2/files/0x0007000000022e31-26.dat upx behavioral2/memory/4272-29-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2072-27-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e32-31.dat upx behavioral2/memory/4588-35-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e32-33.dat upx behavioral2/files/0x0007000000022e33-37.dat upx behavioral2/files/0x0007000000022e33-39.dat upx behavioral2/files/0x0007000000022e34-42.dat upx behavioral2/memory/116-47-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e35-48.dat upx behavioral2/files/0x0007000000022e34-43.dat upx behavioral2/files/0x0007000000022e35-49.dat upx behavioral2/files/0x0007000000022e36-52.dat upx behavioral2/memory/4880-53-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e36-54.dat upx behavioral2/files/0x0007000000022e37-57.dat upx behavioral2/files/0x0007000000022e37-59.dat upx behavioral2/files/0x0007000000022e38-62.dat upx behavioral2/files/0x0007000000022e38-64.dat upx behavioral2/files/0x0007000000022e39-67.dat upx behavioral2/memory/1684-68-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e39-69.dat upx behavioral2/files/0x0007000000022e3a-72.dat upx behavioral2/memory/5096-77-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e3a-74.dat upx behavioral2/files/0x0007000000022e3b-78.dat upx behavioral2/files/0x0007000000022e3b-79.dat upx behavioral2/files/0x0007000000022e3d-82.dat upx behavioral2/files/0x0007000000022e3d-84.dat upx behavioral2/files/0x0007000000022e3e-87.dat upx behavioral2/files/0x0007000000022e3e-89.dat upx behavioral2/memory/3104-91-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e3f-95.dat upx behavioral2/files/0x0007000000022e3f-94.dat upx behavioral2/memory/3704-99-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e40-100.dat upx behavioral2/files/0x0007000000022e41-105.dat upx behavioral2/memory/4948-104-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e41-103.dat upx behavioral2/files/0x0007000000022e40-98.dat upx behavioral2/memory/5076-107-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e42-109.dat upx behavioral2/files/0x0007000000022e42-111.dat upx behavioral2/files/0x0007000000022e43-116.dat upx behavioral2/files/0x0007000000022e43-115.dat upx behavioral2/memory/1372-118-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000022e44-121.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2340 1460 NEAS.252812a584840421c504c6b70d224460.exe 88 PID 1460 wrote to memory of 2340 1460 NEAS.252812a584840421c504c6b70d224460.exe 88 PID 1460 wrote to memory of 2340 1460 NEAS.252812a584840421c504c6b70d224460.exe 88 PID 2340 wrote to memory of 2096 2340 ttx6anc.exe 89 PID 2340 wrote to memory of 2096 2340 ttx6anc.exe 89 PID 2340 wrote to memory of 2096 2340 ttx6anc.exe 89 PID 2096 wrote to memory of 4664 2096 j4ss9r3.exe 90 PID 2096 wrote to memory of 4664 2096 j4ss9r3.exe 90 PID 2096 wrote to memory of 4664 2096 j4ss9r3.exe 90 PID 4664 wrote to memory of 2072 4664 ra1s7k.exe 91 PID 4664 wrote to memory of 2072 4664 ra1s7k.exe 91 PID 4664 wrote to memory of 2072 4664 ra1s7k.exe 91 PID 2072 wrote to memory of 4272 2072 9xwiok.exe 92 PID 2072 wrote to memory of 4272 2072 9xwiok.exe 92 PID 2072 wrote to memory of 4272 2072 9xwiok.exe 92 PID 4272 wrote to memory of 4588 4272 jw7mls.exe 94 PID 4272 wrote to memory of 4588 4272 jw7mls.exe 94 PID 4272 wrote to memory of 4588 4272 jw7mls.exe 94 PID 4588 wrote to memory of 3624 4588 s33934v.exe 95 PID 4588 wrote to memory of 3624 4588 s33934v.exe 95 PID 4588 wrote to memory of 3624 4588 s33934v.exe 95 PID 3624 wrote to memory of 116 3624 u73e1w3.exe 96 PID 3624 wrote to memory of 116 3624 u73e1w3.exe 96 PID 3624 wrote to memory of 116 3624 u73e1w3.exe 96 PID 116 wrote to memory of 4880 116 hmu4xm8.exe 97 PID 116 wrote to memory of 4880 116 hmu4xm8.exe 97 PID 116 wrote to memory of 4880 116 hmu4xm8.exe 97 PID 4880 wrote to memory of 3572 4880 mj0i2us.exe 98 PID 4880 wrote to memory of 3572 4880 mj0i2us.exe 98 PID 4880 wrote to memory of 3572 4880 mj0i2us.exe 98 PID 3572 wrote to memory of 2192 3572 h2v47.exe 99 PID 3572 wrote to memory of 2192 3572 h2v47.exe 99 PID 3572 wrote to memory of 2192 3572 h2v47.exe 99 PID 2192 wrote to memory of 1684 2192 3635uo.exe 100 PID 2192 wrote to memory of 1684 2192 3635uo.exe 100 PID 2192 wrote to memory of 1684 2192 3635uo.exe 100 PID 1684 wrote to memory of 3696 1684 298uei.exe 101 PID 1684 wrote to memory of 3696 1684 298uei.exe 101 PID 1684 wrote to memory of 3696 1684 298uei.exe 101 PID 3696 wrote to memory of 5096 3696 o6a6w.exe 102 PID 3696 wrote to memory of 5096 3696 o6a6w.exe 102 PID 3696 wrote to memory of 5096 3696 o6a6w.exe 102 PID 5096 wrote to memory of 996 5096 5x7l5.exe 103 PID 5096 wrote to memory of 996 5096 5x7l5.exe 103 PID 5096 wrote to memory of 996 5096 5x7l5.exe 103 PID 996 wrote to memory of 2148 996 3n43r40.exe 104 PID 996 wrote to memory of 2148 996 3n43r40.exe 104 PID 996 wrote to memory of 2148 996 3n43r40.exe 104 PID 2148 wrote to memory of 3104 2148 apvka47.exe 105 PID 2148 wrote to memory of 3104 2148 apvka47.exe 105 PID 2148 wrote to memory of 3104 2148 apvka47.exe 105 PID 3104 wrote to memory of 3704 3104 3ap44.exe 106 PID 3104 wrote to memory of 3704 3104 3ap44.exe 106 PID 3104 wrote to memory of 3704 3104 3ap44.exe 106 PID 3704 wrote to memory of 4948 3704 4o08w.exe 107 PID 3704 wrote to memory of 4948 3704 4o08w.exe 107 PID 3704 wrote to memory of 4948 3704 4o08w.exe 107 PID 4948 wrote to memory of 5076 4948 h9q509.exe 109 PID 4948 wrote to memory of 5076 4948 h9q509.exe 109 PID 4948 wrote to memory of 5076 4948 h9q509.exe 109 PID 5076 wrote to memory of 2004 5076 x5cu3l.exe 108 PID 5076 wrote to memory of 2004 5076 x5cu3l.exe 108 PID 5076 wrote to memory of 2004 5076 x5cu3l.exe 108 PID 2004 wrote to memory of 1372 2004 ef21o10.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.252812a584840421c504c6b70d224460.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.252812a584840421c504c6b70d224460.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\ttx6anc.exec:\ttx6anc.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\j4ss9r3.exec:\j4ss9r3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\ra1s7k.exec:\ra1s7k.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\9xwiok.exec:\9xwiok.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jw7mls.exec:\jw7mls.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\s33934v.exec:\s33934v.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\u73e1w3.exec:\u73e1w3.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\hmu4xm8.exec:\hmu4xm8.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\mj0i2us.exec:\mj0i2us.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\h2v47.exec:\h2v47.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\3635uo.exec:\3635uo.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\298uei.exec:\298uei.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\o6a6w.exec:\o6a6w.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\5x7l5.exec:\5x7l5.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3n43r40.exec:\3n43r40.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\apvka47.exec:\apvka47.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3ap44.exec:\3ap44.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\4o08w.exec:\4o08w.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\h9q509.exec:\h9q509.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\x5cu3l.exec:\x5cu3l.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\32omw1.exec:\32omw1.exe10⤵PID:460
-
\??\c:\g8e1d17.exec:\g8e1d17.exe11⤵PID:4312
-
\??\c:\8wn427.exec:\8wn427.exe12⤵PID:3764
-
\??\c:\49nug2t.exec:\49nug2t.exe13⤵PID:3188
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\ef21o10.exec:\ef21o10.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\11d7e7.exec:\11d7e7.exe2⤵
- Executes dropped EXE
PID:1372 -
\??\c:\peok19.exec:\peok19.exe3⤵
- Executes dropped EXE
PID:4580 -
\??\c:\co8tt56.exec:\co8tt56.exe4⤵
- Executes dropped EXE
PID:3604 -
\??\c:\ktj82n.exec:\ktj82n.exe5⤵
- Executes dropped EXE
PID:3100 -
\??\c:\t9o2bdl.exec:\t9o2bdl.exe6⤵
- Executes dropped EXE
PID:2400 -
\??\c:\do4s6.exec:\do4s6.exe7⤵
- Executes dropped EXE
PID:4128 -
\??\c:\218g3.exec:\218g3.exe8⤵
- Executes dropped EXE
PID:5100 -
\??\c:\t41q9.exec:\t41q9.exe9⤵
- Executes dropped EXE
PID:3672 -
\??\c:\15uwo.exec:\15uwo.exe10⤵
- Executes dropped EXE
PID:4804 -
\??\c:\96txf.exec:\96txf.exe11⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ad1ap9h.exec:\ad1ap9h.exe12⤵
- Executes dropped EXE
PID:1368 -
\??\c:\0683pb.exec:\0683pb.exe13⤵
- Executes dropped EXE
PID:3616 -
\??\c:\cq3cggc.exec:\cq3cggc.exe14⤵
- Executes dropped EXE
PID:5000 -
\??\c:\g6dh065.exec:\g6dh065.exe15⤵
- Executes dropped EXE
PID:2556 -
\??\c:\i2m7s16.exec:\i2m7s16.exe16⤵
- Executes dropped EXE
PID:1912 -
\??\c:\l14a1.exec:\l14a1.exe17⤵
- Executes dropped EXE
PID:1644 -
\??\c:\n6n861t.exec:\n6n861t.exe18⤵
- Executes dropped EXE
PID:1632 -
\??\c:\76i52k.exec:\76i52k.exe19⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ls43k.exec:\ls43k.exe20⤵
- Executes dropped EXE
PID:1576 -
\??\c:\5772s59.exec:\5772s59.exe21⤵
- Executes dropped EXE
PID:2316 -
\??\c:\542t8.exec:\542t8.exe22⤵
- Executes dropped EXE
PID:4896 -
\??\c:\b8bcxbr.exec:\b8bcxbr.exe23⤵
- Executes dropped EXE
PID:4604 -
\??\c:\v5e1gp.exec:\v5e1gp.exe24⤵
- Executes dropped EXE
PID:2664 -
\??\c:\iw3msga.exec:\iw3msga.exe25⤵
- Executes dropped EXE
PID:1412 -
\??\c:\09j529m.exec:\09j529m.exe26⤵
- Executes dropped EXE
PID:3880 -
\??\c:\903jw.exec:\903jw.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\cc57ux.exec:\cc57ux.exe28⤵
- Executes dropped EXE
PID:3624 -
\??\c:\758gh.exec:\758gh.exe29⤵
- Executes dropped EXE
PID:3628 -
\??\c:\3c10m.exec:\3c10m.exe30⤵
- Executes dropped EXE
PID:4852 -
\??\c:\4b58p1.exec:\4b58p1.exe31⤵
- Executes dropped EXE
PID:1504 -
\??\c:\h4a7s.exec:\h4a7s.exe32⤵
- Executes dropped EXE
PID:4576 -
\??\c:\2sr8sv5.exec:\2sr8sv5.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\4909r5e.exec:\4909r5e.exe34⤵
- Executes dropped EXE
PID:3828 -
\??\c:\n5o15l.exec:\n5o15l.exe35⤵
- Executes dropped EXE
PID:4312 -
\??\c:\p1ss3.exec:\p1ss3.exe36⤵
- Executes dropped EXE
PID:2548 -
\??\c:\72br8.exec:\72br8.exe37⤵
- Executes dropped EXE
PID:3104 -
\??\c:\et0sim.exec:\et0sim.exe38⤵
- Executes dropped EXE
PID:2232 -
\??\c:\4ciukc6.exec:\4ciukc6.exe39⤵
- Executes dropped EXE
PID:4524 -
\??\c:\1hdwt.exec:\1hdwt.exe40⤵
- Executes dropped EXE
PID:3992 -
\??\c:\6p0wi.exec:\6p0wi.exe41⤵
- Executes dropped EXE
PID:4928 -
\??\c:\p9d0wv.exec:\p9d0wv.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fhw13.exec:\fhw13.exe43⤵
- Executes dropped EXE
PID:4196 -
\??\c:\cj0o76.exec:\cj0o76.exe44⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jp5mx.exec:\jp5mx.exe45⤵PID:1536
-
\??\c:\iiqmw.exec:\iiqmw.exe46⤵PID:2996
-
\??\c:\dmip6.exec:\dmip6.exe47⤵PID:4764
-
\??\c:\1n311.exec:\1n311.exe48⤵PID:3732
-
\??\c:\7v84r7.exec:\7v84r7.exe49⤵PID:3032
-
\??\c:\l50ae.exec:\l50ae.exe50⤵PID:4920
-
\??\c:\170b9.exec:\170b9.exe51⤵PID:4368
-
\??\c:\2d821.exec:\2d821.exe52⤵PID:4792
-
\??\c:\r1g31.exec:\r1g31.exe53⤵PID:5000
-
\??\c:\v176dg.exec:\v176dg.exe54⤵PID:2216
-
\??\c:\n1553w.exec:\n1553w.exe55⤵PID:1380
-
\??\c:\6a50mtp.exec:\6a50mtp.exe56⤵PID:1460
-
\??\c:\c7ub1w1.exec:\c7ub1w1.exe57⤵PID:2340
-
\??\c:\8eikuki.exec:\8eikuki.exe58⤵PID:1700
-
\??\c:\t3abc83.exec:\t3abc83.exe59⤵PID:2096
-
\??\c:\cha7r.exec:\cha7r.exe60⤵PID:4664
-
\??\c:\097999.exec:\097999.exe61⤵PID:3472
-
\??\c:\oaick.exec:\oaick.exe62⤵PID:3112
-
\??\c:\l98e758.exec:\l98e758.exe63⤵PID:320
-
\??\c:\es91q.exec:\es91q.exe64⤵PID:3880
-
\??\c:\0d7agau.exec:\0d7agau.exe65⤵PID:2736
-
\??\c:\3a3ul.exec:\3a3ul.exe66⤵PID:744
-
\??\c:\33f92c.exec:\33f92c.exe67⤵PID:3628
-
\??\c:\t5931.exec:\t5931.exe68⤵PID:1280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\o90pau.exec:\o90pau.exe1⤵PID:1192
-
\??\c:\8uske.exec:\8uske.exe2⤵PID:1384
-
\??\c:\vsn7j5k.exec:\vsn7j5k.exe3⤵PID:3156
-
\??\c:\86sauw.exec:\86sauw.exe4⤵PID:996
-
\??\c:\2ssekes.exec:\2ssekes.exe5⤵PID:3540
-
\??\c:\nm843r.exec:\nm843r.exe6⤵PID:2764
-
\??\c:\3n5g74u.exec:\3n5g74u.exe7⤵PID:3104
-
\??\c:\15mm74.exec:\15mm74.exe8⤵PID:772
-
\??\c:\s0pr4.exec:\s0pr4.exe9⤵PID:4876
-
\??\c:\2rwm04.exec:\2rwm04.exe10⤵PID:4228
-
\??\c:\1eswk.exec:\1eswk.exe11⤵PID:2332
-
\??\c:\cu5a917.exec:\cu5a917.exe12⤵PID:1044
-
\??\c:\337ogkw.exec:\337ogkw.exe13⤵PID:2576
-
\??\c:\psiaom.exec:\psiaom.exe14⤵PID:4868
-
\??\c:\4ox98sp.exec:\4ox98sp.exe15⤵PID:3912
-
\??\c:\dov2kx.exec:\dov2kx.exe16⤵PID:3616
-
\??\c:\x52ur9.exec:\x52ur9.exe17⤵PID:3228
-
\??\c:\7p70c.exec:\7p70c.exe18⤵PID:1816
-
\??\c:\vl773w.exec:\vl773w.exe19⤵PID:5000
-
\??\c:\8lj3e.exec:\8lj3e.exe20⤵PID:2216
-
\??\c:\n2qwp90.exec:\n2qwp90.exe21⤵PID:1644
-
\??\c:\e601q7.exec:\e601q7.exe22⤵PID:3632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\8bvw01.exec:\8bvw01.exe4⤵PID:3400
-
\??\c:\373845.exec:\373845.exe5⤵PID:3908
-
\??\c:\82ed72q.exec:\82ed72q.exe6⤵PID:116
-
-
-
-
-
-
\??\c:\0n9933.exec:\0n9933.exe1⤵PID:4092
-
\??\c:\n9aseaq.exec:\n9aseaq.exe2⤵PID:1904
-
\??\c:\j3ob4.exec:\j3ob4.exe3⤵PID:2316
-
\??\c:\4aj1gh.exec:\4aj1gh.exe4⤵PID:4080
-
\??\c:\v5710.exec:\v5710.exe5⤵PID:3780
-
\??\c:\og58p0.exec:\og58p0.exe6⤵PID:3112
-
\??\c:\3c36mi5.exec:\3c36mi5.exe7⤵PID:4880
-
\??\c:\38c33.exec:\38c33.exe8⤵PID:3908
-
\??\c:\6w50n7.exec:\6w50n7.exe9⤵PID:3624
-
\??\c:\h5571r0.exec:\h5571r0.exe10⤵PID:336
-
\??\c:\536c3.exec:\536c3.exe11⤵PID:3808
-
\??\c:\90g99e.exec:\90g99e.exe12⤵PID:760
-
\??\c:\247wq.exec:\247wq.exe13⤵PID:2364
-
\??\c:\d71915.exec:\d71915.exe14⤵PID:4936
-
\??\c:\m0i35.exec:\m0i35.exe15⤵PID:3608
-
\??\c:\agccu9.exec:\agccu9.exe16⤵PID:2444
-
\??\c:\2q916t9.exec:\2q916t9.exe17⤵PID:2764
-
\??\c:\s2kr19.exec:\s2kr19.exe18⤵PID:844
-
\??\c:\mmegok.exec:\mmegok.exe19⤵PID:3940
-
\??\c:\5380q4.exec:\5380q4.exe20⤵PID:3832
-
\??\c:\85keis.exec:\85keis.exe21⤵PID:5076
-
\??\c:\6h1q7c.exec:\6h1q7c.exe22⤵PID:3536
-
\??\c:\x9smo.exec:\x9smo.exe23⤵PID:1704
-
\??\c:\3n4coq.exec:\3n4coq.exe24⤵PID:1812
-
\??\c:\j53e38m.exec:\j53e38m.exe25⤵PID:1616
-
\??\c:\08n3mhs.exec:\08n3mhs.exe26⤵PID:1724
-
\??\c:\69gqo.exec:\69gqo.exe27⤵PID:4128
-
\??\c:\j4iwwg.exec:\j4iwwg.exe28⤵PID:2576
-
\??\c:\9up7c.exec:\9up7c.exe29⤵PID:2692
-
\??\c:\24giw3.exec:\24giw3.exe30⤵PID:4484
-
\??\c:\77154.exec:\77154.exe31⤵PID:2556
-
\??\c:\8ws1q.exec:\8ws1q.exe32⤵PID:4408
-
\??\c:\rnj3m6r.exec:\rnj3m6r.exe33⤵PID:1816
-
\??\c:\553511.exec:\553511.exe34⤵PID:1620
-
\??\c:\357td.exec:\357td.exe35⤵PID:1576
-
\??\c:\4v515.exec:\4v515.exe36⤵PID:1644
-
\??\c:\33kn9.exec:\33kn9.exe37⤵PID:1964
-
\??\c:\v9359ow.exec:\v9359ow.exe38⤵PID:2072
-
\??\c:\4okwue8.exec:\4okwue8.exe39⤵PID:1412
-
\??\c:\j99315.exec:\j99315.exe40⤵PID:2316
-
\??\c:\iq92wj3.exec:\iq92wj3.exe41⤵PID:4984
-
\??\c:\6go3ur.exec:\6go3ur.exe42⤵PID:3112
-
\??\c:\0g3599.exec:\0g3599.exe43⤵PID:4048
-
\??\c:\vvm0gu2.exec:\vvm0gu2.exe44⤵PID:2736
-
\??\c:\5f934n.exec:\5f934n.exe45⤵PID:4772
-
\??\c:\6x56a73.exec:\6x56a73.exe46⤵PID:4564
-
\??\c:\em2pxs1.exec:\em2pxs1.exe47⤵PID:1384
-
\??\c:\2gc5i.exec:\2gc5i.exe48⤵PID:4392
-
\??\c:\9cr59.exec:\9cr59.exe49⤵PID:1932
-
\??\c:\53pdus2.exec:\53pdus2.exe50⤵PID:4960
-
\??\c:\4v335k.exec:\4v335k.exe51⤵PID:4312
-
\??\c:\7tcg8d.exec:\7tcg8d.exe52⤵PID:3356
-
\??\c:\n3v46p.exec:\n3v46p.exe53⤵PID:1308
-
\??\c:\bcu30nq.exec:\bcu30nq.exe54⤵PID:4460
-
\??\c:\35aowu2.exec:\35aowu2.exe55⤵PID:3704
-
\??\c:\t59179.exec:\t59179.exe56⤵PID:4352
-
\??\c:\8i3q59.exec:\8i3q59.exe57⤵PID:4208
-
\??\c:\pgpdj.exec:\pgpdj.exe58⤵PID:3104
-
\??\c:\ii331.exec:\ii331.exe59⤵PID:3992
-
\??\c:\f535w35.exec:\f535w35.exe60⤵PID:1748
-
\??\c:\2x171mr.exec:\2x171mr.exe61⤵PID:4892
-
\??\c:\u4k9kwk.exec:\u4k9kwk.exe62⤵PID:2276
-
\??\c:\4e9sems.exec:\4e9sems.exe63⤵PID:1812
-
\??\c:\g0q119.exec:\g0q119.exe64⤵PID:5048
-
\??\c:\91351wd.exec:\91351wd.exe65⤵PID:3588
-
\??\c:\iv6n31.exec:\iv6n31.exe66⤵PID:936
-
\??\c:\98h76s.exec:\98h76s.exe67⤵PID:4728
-
\??\c:\vdvc82.exec:\vdvc82.exe68⤵PID:3228
-
\??\c:\imwo3.exec:\imwo3.exe69⤵PID:4484
-
\??\c:\d13373.exec:\d13373.exe70⤵PID:4792
-
\??\c:\v52w5.exec:\v52w5.exe71⤵PID:1632
-
\??\c:\e8x5713.exec:\e8x5713.exe72⤵PID:1380
-
\??\c:\170ax5c.exec:\170ax5c.exe73⤵PID:1952
-
\??\c:\e9u34k4.exec:\e9u34k4.exe74⤵PID:4084
-
\??\c:\2biixj.exec:\2biixj.exe75⤵PID:2272
-
\??\c:\se5e12.exec:\se5e12.exe76⤵PID:1576
-
\??\c:\ja11311.exec:\ja11311.exe77⤵PID:4244
-
\??\c:\n7awc38.exec:\n7awc38.exe78⤵PID:1904
-
\??\c:\kq7kr12.exec:\kq7kr12.exe79⤵PID:3428
-
\??\c:\19g35.exec:\19g35.exe80⤵PID:232
-
\??\c:\87a1s4n.exec:\87a1s4n.exe81⤵PID:4220
-
\??\c:\l4f6q13.exec:\l4f6q13.exe82⤵PID:2192
-
\??\c:\se211x.exec:\se211x.exe83⤵PID:2860
-
\??\c:\fp35mm.exec:\fp35mm.exe84⤵PID:3112
-
\??\c:\k4vce.exec:\k4vce.exe85⤵PID:4048
-
\??\c:\p797a.exec:\p797a.exe86⤵PID:4576
-
\??\c:\36kok.exec:\36kok.exe87⤵PID:5096
-
\??\c:\731s9.exec:\731s9.exe88⤵PID:1836
-
\??\c:\914p131.exec:\914p131.exe89⤵PID:1384
-
\??\c:\38t7g.exec:\38t7g.exe90⤵PID:760
-
\??\c:\v5i1wd.exec:\v5i1wd.exe91⤵PID:2964
-
\??\c:\gmj9c.exec:\gmj9c.exe92⤵PID:4328
-
\??\c:\t93mt8s.exec:\t93mt8s.exe93⤵PID:4312
-
\??\c:\6wu3s.exec:\6wu3s.exe94⤵PID:5016
-
\??\c:\a1o2n1.exec:\a1o2n1.exe95⤵PID:4360
-
\??\c:\j9egmko.exec:\j9egmko.exe96⤵PID:3704
-
\??\c:\8csgs.exec:\8csgs.exe97⤵PID:2764
-
\??\c:\ns4s7u9.exec:\ns4s7u9.exe98⤵PID:4836
-
\??\c:\3um1t.exec:\3um1t.exe99⤵PID:1432
-
\??\c:\mnhg21i.exec:\mnhg21i.exe100⤵PID:4972
-
\??\c:\933523b.exec:\933523b.exe101⤵PID:3104
-
\??\c:\ol5595.exec:\ol5595.exe102⤵PID:3212
-
\??\c:\667t2wn.exec:\667t2wn.exe103⤵PID:3760
-
\??\c:\116o5.exec:\116o5.exe104⤵PID:2332
-
\??\c:\1r9wa.exec:\1r9wa.exe105⤵PID:4056
-
\??\c:\93mn5.exec:\93mn5.exe106⤵PID:3732
-
\??\c:\tu37k0t.exec:\tu37k0t.exe107⤵PID:5048
-
-
-
-
-
-
-
\??\c:\d4x0s.exec:\d4x0s.exe102⤵PID:4356
-
\??\c:\1c51jje.exec:\1c51jje.exe103⤵PID:1812
-
\??\c:\r441t93.exec:\r441t93.exe104⤵PID:1948
-
\??\c:\6l1wu.exec:\6l1wu.exe105⤵PID:1044
-
\??\c:\l2rd26.exec:\l2rd26.exe106⤵PID:4484
-
\??\c:\ex9cwk.exec:\ex9cwk.exe107⤵PID:1912
-
\??\c:\ax74s72.exec:\ax74s72.exe108⤵PID:2676
-
\??\c:\0ip98w.exec:\0ip98w.exe109⤵PID:4916
-
\??\c:\k4gkc7.exec:\k4gkc7.exe110⤵PID:868
-
\??\c:\85il4gn.exec:\85il4gn.exe111⤵PID:1472
-
\??\c:\ka51k.exec:\ka51k.exe112⤵PID:1820
-
\??\c:\w17ve07.exec:\w17ve07.exe113⤵PID:1432
-
\??\c:\d8umg9.exec:\d8umg9.exe114⤵PID:2576
-
\??\c:\0mt5it3.exec:\0mt5it3.exe115⤵PID:4664
-
\??\c:\4esq34q.exec:\4esq34q.exe116⤵PID:2508
-
\??\c:\9gwck7.exec:\9gwck7.exe117⤵PID:3100
-
\??\c:\09w13.exec:\09w13.exe118⤵PID:2704
-
\??\c:\2xkt4ir.exec:\2xkt4ir.exe119⤵PID:1508
-
\??\c:\lx257d.exec:\lx257d.exe120⤵PID:4516
-
\??\c:\b90mg70.exec:\b90mg70.exe121⤵PID:1840
-
\??\c:\l9wote5.exec:\l9wote5.exe122⤵PID:3632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-