Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 22:47
Behavioral task
behavioral1
Sample
613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe
Resource
win10v2004-20240419-en
General
-
Target
613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe
-
Size
621KB
-
MD5
9297853bc93ab1a8f62762c6affdff9e
-
SHA1
41e40d15ea550c86daf39ce41faa08df3bb80324
-
SHA256
613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2
-
SHA512
ebefcfa23d5055cbd155b6441603d7099b4c745035cb97db9434f88c2790db7ea72ec712023afa56b8e195a8b840c793351bbba770faf848e2a7372eefa0d503
-
SSDEEP
3072:uCaoAs101Pol0xPTM7mRCAdJSSxPUkl3Vn2ZMQTCk/dN92sdNhavtrVdewnAx3wr:uqDAwl0xPTMiR9JSSxPUKl0dodHBwSV
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 53 IoCs
resource yara_rule behavioral1/memory/1640-0-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0007000000016cf5-6.dat UPX behavioral1/memory/2872-22-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0034000000016cab-21.dat UPX behavioral1/files/0x0007000000016cfe-30.dat UPX behavioral1/memory/2648-37-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0007000000016d06-49.dat UPX behavioral1/memory/2536-52-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0007000000016d0e-54.dat UPX behavioral1/memory/2432-67-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x000a000000016d1f-75.dat UPX behavioral1/memory/1000-82-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0008000000017465-84.dat UPX behavioral1/memory/1644-97-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1220-113-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0034000000016cc9-108.dat UPX behavioral1/files/0x0006000000017474-115.dat UPX behavioral1/memory/564-129-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1068-145-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0009000000018648-142.dat UPX behavioral1/memory/1640-154-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1456-161-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0031000000018649-158.dat UPX behavioral1/files/0x000500000001865b-169.dat UPX behavioral1/memory/880-176-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2872-170-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/files/0x0005000000018664-182.dat UPX behavioral1/files/0x00050000000186c4-202.dat UPX behavioral1/memory/2232-208-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1000-207-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1744-193-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2964-216-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2536-187-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2056-229-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2888-244-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1068-243-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2360-258-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1456-252-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1468-267-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2140-277-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2812-288-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1204-301-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1724-310-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1604-320-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2964-316-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2056-330-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/576-337-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2360-351-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2992-346-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1468-362-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/1656-359-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2140-379-0x0000000000400000-0x0000000000493000-memory.dmp UPX behavioral1/memory/2580-373-0x0000000000400000-0x0000000000493000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 2872 Sysqemvmcty.exe 2648 Sysqemhgijj.exe 2536 Sysqempzpoh.exe 2432 Sysqemeslbi.exe 1000 Sysqemuaxjp.exe 1644 Sysqemjuuez.exe 1220 Sysqemwwalk.exe 564 Sysqemognes.exe 1068 Sysqemdskzb.exe 1456 Sysqemtlhll.exe 880 Sysqemgkbou.exe 1744 Sysqemsptri.exe 2232 Sysqemfgouq.exe 2964 Sysqemaisrw.exe 2056 Sysqemngmmf.exe 2888 Sysqemfvlri.exe 2360 Sysqemuslzu.exe 1468 Sysqempxbbd.exe 2140 Sysqemcskzj.exe 2812 Sysqemrtdey.exe 1204 Sysqemmrwwt.exe 1724 Sysqembshji.exe 1604 Sysqemtcvcq.exe 576 Sysqemofzzo.exe 2992 Sysqembkquc.exe 1656 Sysqemojlwl.exe 2580 Sysqemvulpu.exe 2616 Sysqemkcecj.exe 2144 Sysqemkjcza.exe 1584 Sysqemcuhzi.exe 2136 Sysqememhpa.exe 1728 Sysqemwejhn.exe 1628 Sysqembnrce.exe 2312 Sysqemtbqhg.exe 2952 Sysqembgamy.exe 1708 Sysqemtursa.exe 2232 Sysqemveipt.exe 804 Sysqemneszg.exe 2640 Sysqemsimhz.exe 3068 Sysqemnkifx.exe 1468 Sysqemxgjxn.exe 1568 Sysqempchcq.exe 2812 Sysqemttepm.exe 1800 Sysqemjebkv.exe 1756 Sysqemdwsan.exe 1308 Sysqemvkrfy.exe 2308 Sysqemddqff.exe 2192 Sysqemvdsxs.exe 2872 Sysqemxqvan.exe 2488 Sysqemsazyl.exe 1536 Sysqemuocag.exe 708 Sysqemmcafr.exe 296 Sysqemrljah.exe 1840 Sysqemmonyf.exe 1616 Sysqemwcnvd.exe 1740 Sysqemrejtb.exe 2460 Sysqemtrmvw.exe 1876 Sysqemlcane.exe 2224 Sysqemphcgr.exe 1864 Sysqemhshgz.exe 2052 Sysqemhlqqt.exe 880 Sysqemwenld.exe 2116 Sysqembrhto.exe 2720 Sysqemucmlw.exe -
Loads dropped DLL 64 IoCs
pid Process 1640 613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe 1640 613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe 2872 Sysqemvmcty.exe 2872 Sysqemvmcty.exe 2648 Sysqemhgijj.exe 2648 Sysqemhgijj.exe 2536 Sysqempzpoh.exe 2536 Sysqempzpoh.exe 2432 Sysqemeslbi.exe 2432 Sysqemeslbi.exe 1000 Sysqemuaxjp.exe 1000 Sysqemuaxjp.exe 1644 Sysqemjuuez.exe 1644 Sysqemjuuez.exe 1220 Sysqemwwalk.exe 1220 Sysqemwwalk.exe 564 Sysqemognes.exe 564 Sysqemognes.exe 1068 Sysqemdskzb.exe 1068 Sysqemdskzb.exe 1456 Sysqemtlhll.exe 1456 Sysqemtlhll.exe 880 Sysqemgkbou.exe 880 Sysqemgkbou.exe 1744 Sysqemsptri.exe 1744 Sysqemsptri.exe 2232 Sysqemfgouq.exe 2232 Sysqemfgouq.exe 2964 Sysqemaisrw.exe 2964 Sysqemaisrw.exe 2056 Sysqemngmmf.exe 2056 Sysqemngmmf.exe 2888 Sysqemfvlri.exe 2888 Sysqemfvlri.exe 2360 Sysqemuslzu.exe 2360 Sysqemuslzu.exe 1468 Sysqempxbbd.exe 1468 Sysqempxbbd.exe 2140 Sysqemcskzj.exe 2140 Sysqemcskzj.exe 2812 Sysqemrtdey.exe 2812 Sysqemrtdey.exe 1204 Sysqemmrwwt.exe 1204 Sysqemmrwwt.exe 1724 Sysqembshji.exe 1724 Sysqembshji.exe 1604 Sysqemtcvcq.exe 1604 Sysqemtcvcq.exe 576 Sysqemofzzo.exe 576 Sysqemofzzo.exe 2992 Sysqembkquc.exe 2992 Sysqembkquc.exe 1656 Sysqemojlwl.exe 1656 Sysqemojlwl.exe 2580 Sysqemvulpu.exe 2580 Sysqemvulpu.exe 2616 Sysqemkcecj.exe 2616 Sysqemkcecj.exe 2144 Sysqemkjcza.exe 2144 Sysqemkjcza.exe 1584 Sysqemcuhzi.exe 1584 Sysqemcuhzi.exe 2136 Sysqememhpa.exe 2136 Sysqememhpa.exe -
resource yara_rule behavioral1/memory/1640-0-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0007000000016cf5-6.dat upx behavioral1/memory/2872-22-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0034000000016cab-21.dat upx behavioral1/files/0x0007000000016cfe-30.dat upx behavioral1/memory/2648-37-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0007000000016d06-49.dat upx behavioral1/memory/2536-52-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0007000000016d0e-54.dat upx behavioral1/memory/2432-67-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x000a000000016d1f-75.dat upx behavioral1/memory/1000-82-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0008000000017465-84.dat upx behavioral1/memory/1644-97-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1220-113-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0034000000016cc9-108.dat upx behavioral1/files/0x0006000000017474-115.dat upx behavioral1/memory/564-129-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1068-145-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0009000000018648-142.dat upx behavioral1/memory/1640-154-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1456-161-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0031000000018649-158.dat upx behavioral1/files/0x000500000001865b-169.dat upx behavioral1/memory/880-176-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2872-170-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/files/0x0005000000018664-182.dat upx behavioral1/files/0x00050000000186c4-202.dat upx behavioral1/memory/2232-208-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1000-207-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1744-193-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2964-216-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2536-187-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2056-229-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2888-244-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1068-243-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2360-258-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1456-252-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1468-267-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2140-277-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2812-288-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1204-301-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1724-310-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1604-320-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2964-316-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2056-330-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/576-337-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2360-351-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2992-346-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1468-362-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/1656-359-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2140-379-0x0000000000400000-0x0000000000493000-memory.dmp upx behavioral1/memory/2580-373-0x0000000000400000-0x0000000000493000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2872 1640 613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe 28 PID 1640 wrote to memory of 2872 1640 613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe 28 PID 1640 wrote to memory of 2872 1640 613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe 28 PID 1640 wrote to memory of 2872 1640 613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe 28 PID 2872 wrote to memory of 2648 2872 Sysqemvmcty.exe 29 PID 2872 wrote to memory of 2648 2872 Sysqemvmcty.exe 29 PID 2872 wrote to memory of 2648 2872 Sysqemvmcty.exe 29 PID 2872 wrote to memory of 2648 2872 Sysqemvmcty.exe 29 PID 2648 wrote to memory of 2536 2648 Sysqemhgijj.exe 30 PID 2648 wrote to memory of 2536 2648 Sysqemhgijj.exe 30 PID 2648 wrote to memory of 2536 2648 Sysqemhgijj.exe 30 PID 2648 wrote to memory of 2536 2648 Sysqemhgijj.exe 30 PID 2536 wrote to memory of 2432 2536 Sysqempzpoh.exe 31 PID 2536 wrote to memory of 2432 2536 Sysqempzpoh.exe 31 PID 2536 wrote to memory of 2432 2536 Sysqempzpoh.exe 31 PID 2536 wrote to memory of 2432 2536 Sysqempzpoh.exe 31 PID 2432 wrote to memory of 1000 2432 Sysqemeslbi.exe 32 PID 2432 wrote to memory of 1000 2432 Sysqemeslbi.exe 32 PID 2432 wrote to memory of 1000 2432 Sysqemeslbi.exe 32 PID 2432 wrote to memory of 1000 2432 Sysqemeslbi.exe 32 PID 1000 wrote to memory of 1644 1000 Sysqemuaxjp.exe 33 PID 1000 wrote to memory of 1644 1000 Sysqemuaxjp.exe 33 PID 1000 wrote to memory of 1644 1000 Sysqemuaxjp.exe 33 PID 1000 wrote to memory of 1644 1000 Sysqemuaxjp.exe 33 PID 1644 wrote to memory of 1220 1644 Sysqemjuuez.exe 34 PID 1644 wrote to memory of 1220 1644 Sysqemjuuez.exe 34 PID 1644 wrote to memory of 1220 1644 Sysqemjuuez.exe 34 PID 1644 wrote to memory of 1220 1644 Sysqemjuuez.exe 34 PID 1220 wrote to memory of 564 1220 Sysqemwwalk.exe 35 PID 1220 wrote to memory of 564 1220 Sysqemwwalk.exe 35 PID 1220 wrote to memory of 564 1220 Sysqemwwalk.exe 35 PID 1220 wrote to memory of 564 1220 Sysqemwwalk.exe 35 PID 564 wrote to memory of 1068 564 Sysqemognes.exe 36 PID 564 wrote to memory of 1068 564 Sysqemognes.exe 36 PID 564 wrote to memory of 1068 564 Sysqemognes.exe 36 PID 564 wrote to memory of 1068 564 Sysqemognes.exe 36 PID 1068 wrote to memory of 1456 1068 Sysqemdskzb.exe 37 PID 1068 wrote to memory of 1456 1068 Sysqemdskzb.exe 37 PID 1068 wrote to memory of 1456 1068 Sysqemdskzb.exe 37 PID 1068 wrote to memory of 1456 1068 Sysqemdskzb.exe 37 PID 1456 wrote to memory of 880 1456 Sysqemtlhll.exe 38 PID 1456 wrote to memory of 880 1456 Sysqemtlhll.exe 38 PID 1456 wrote to memory of 880 1456 Sysqemtlhll.exe 38 PID 1456 wrote to memory of 880 1456 Sysqemtlhll.exe 38 PID 880 wrote to memory of 1744 880 Sysqemgkbou.exe 39 PID 880 wrote to memory of 1744 880 Sysqemgkbou.exe 39 PID 880 wrote to memory of 1744 880 Sysqemgkbou.exe 39 PID 880 wrote to memory of 1744 880 Sysqemgkbou.exe 39 PID 1744 wrote to memory of 2232 1744 Sysqemsptri.exe 64 PID 1744 wrote to memory of 2232 1744 Sysqemsptri.exe 64 PID 1744 wrote to memory of 2232 1744 Sysqemsptri.exe 64 PID 1744 wrote to memory of 2232 1744 Sysqemsptri.exe 64 PID 2232 wrote to memory of 2964 2232 Sysqemfgouq.exe 41 PID 2232 wrote to memory of 2964 2232 Sysqemfgouq.exe 41 PID 2232 wrote to memory of 2964 2232 Sysqemfgouq.exe 41 PID 2232 wrote to memory of 2964 2232 Sysqemfgouq.exe 41 PID 2964 wrote to memory of 2056 2964 Sysqemaisrw.exe 42 PID 2964 wrote to memory of 2056 2964 Sysqemaisrw.exe 42 PID 2964 wrote to memory of 2056 2964 Sysqemaisrw.exe 42 PID 2964 wrote to memory of 2056 2964 Sysqemaisrw.exe 42 PID 2056 wrote to memory of 2888 2056 Sysqemngmmf.exe 43 PID 2056 wrote to memory of 2888 2056 Sysqemngmmf.exe 43 PID 2056 wrote to memory of 2888 2056 Sysqemngmmf.exe 43 PID 2056 wrote to memory of 2888 2056 Sysqemngmmf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe"C:\Users\Admin\AppData\Local\Temp\613263a54db271e2775c3bf7ff97b4b4ed33cbdefd73d407411e52573412b9f2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvmcty.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvmcty.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhgijj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhgijj.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\Sysqempzpoh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempzpoh.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeslbi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeslbi.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuaxjp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuaxjp.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjuuez.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjuuez.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwwalk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwwalk.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\Sysqemognes.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemognes.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdskzb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdskzb.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtlhll.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtlhll.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgkbou.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgkbou.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsptri.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsptri.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfgouq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfgouq.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaisrw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaisrw.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\Sysqemngmmf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemngmmf.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfvlri.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfvlri.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuslzu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuslzu.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\Sysqempxbbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempxbbd.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcskzj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcskzj.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrtdey.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtdey.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmrwwt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmrwwt.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\Sysqembshji.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembshji.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtcvcq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtcvcq.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\Sysqemofzzo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemofzzo.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\Sysqembkquc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembkquc.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Sysqemojlwl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemojlwl.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvulpu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvulpu.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkcecj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkcecj.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkjcza.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkjcza.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcuhzi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcuhzi.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\Sysqememhpa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqememhpa.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwejhn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwejhn.exe"33⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\Sysqembnrce.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembnrce.exe"34⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtbqhg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtbqhg.exe"35⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\Sysqembgamy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembgamy.exe"36⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtursa.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtursa.exe"37⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemveipt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemveipt.exe"38⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\Sysqemneszg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemneszg.exe"39⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsimhz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsimhz.exe"40⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnkifx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnkifx.exe"41⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxgjxn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxgjxn.exe"42⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Sysqempchcq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempchcq.exe"43⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemttepm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemttepm.exe"44⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjebkv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjebkv.exe"45⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdwsan.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdwsan.exe"46⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvkrfy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvkrfy.exe"47⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\Sysqemddqff.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemddqff.exe"48⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvdsxs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvdsxs.exe"49⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxqvan.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxqvan.exe"50⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsazyl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsazyl.exe"51⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuocag.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuocag.exe"52⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmcafr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmcafr.exe"53⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrljah.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrljah.exe"54⤵
- Executes dropped EXE
PID:296 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmonyf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmonyf.exe"55⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwcnvd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwcnvd.exe"56⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrejtb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrejtb.exe"57⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtrmvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtrmvw.exe"58⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\Sysqemlcane.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlcane.exe"59⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\Sysqemphcgr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemphcgr.exe"60⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhshgz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhshgz.exe"61⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhlqqt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhlqqt.exe"62⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwenld.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwenld.exe"63⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\Sysqembrhto.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembrhto.exe"64⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\Sysqemucmlw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemucmlw.exe"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdejwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdejwj.exe"66⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvsabt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvsabt.exe"67⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvljln.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvljln.exe"68⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnwodv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnwodv.exe"69⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsffgm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsffgm.exe"70⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhfqlb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhfqlb.exe"71⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsbrej.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsbrej.exe"72⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkmewq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkmewq.exe"73⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\Sysqemocbrm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemocbrm.exe"74⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgqawp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgqawp.exe"75⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrmsgf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrmsgf.exe"76⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgjagj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgjagj.exe"77⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgyymi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgyymi.exe"78⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyjmei.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyjmei.exe"79⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqmapk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqmapk.exe"80⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfulbz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfulbz.exe"81⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\Sysqempqmup.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempqmup.exe"82⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfyxun.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfyxun.exe"83⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\Sysqemukdzr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemukdzr.exe"84⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmyuec.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmyuec.exe"85⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsolpk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsolpk.exe"86⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhzicm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhzicm.exe"87⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\Sysqemhhhsf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhhhsf.exe"88⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzsmsn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzsmsn.exe"89⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\Sysqembfyfc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembfyfc.exe"90⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqcgno.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqcgno.exe"91⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdiyno.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdiyno.exe"92⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsbniy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsbniy.exe"93⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\Sysqemuxqkt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuxqkt.exe"94⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmhddb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmhddb.exe"95⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmamvv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmamvv.exe"96⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\Sysqemeodaf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeodaf.exe"97⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\Sysqemedagw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemedagw.exe"98⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\Sysqemtpxsg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtpxsg.exe"99⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxqfsf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxqfsf.exe"100⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqbttf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqbttf.exe"101⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnnogd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnnogd.exe"102⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfcnlf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfcnlf.exe"103⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzlgtl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzlgtl.exe"104⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrwult.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrwult.exe"105⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\Sysqemoxmyp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemoxmyp.exe"106⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\Sysqemglddz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemglddz.exe"107⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlywlt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlywlt.exe"108⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdgyqq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdgyqq.exe"109⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgpyoi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgpyoi.exe"110⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxhayv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxhayv.exe"111⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\Sysqemcritm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcritm.exe"112⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsnqby.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsnqby.exe"113⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrcggp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrcggp.exe"114⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjrfda.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjrfda.exe"115⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlehov.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlehov.exe"116⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdagtx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdagtx.exe"117⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjcooo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjcooo.exe"118⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\Sysqembncgw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembncgw.exe"119⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfdybk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfdybk.exe"120⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\Sysqemyomus.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyomus.exe"121⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsydjk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsydjk.exe"122⤵PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-