Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/05/2024, 01:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe
-
Size
443KB
-
MD5
69df7d79a028540c6cd2cf50a4df02a0
-
SHA1
88d5a8b720e753f894d7846164dbaa3eab41685b
-
SHA256
702f26768c41187d5bde38958d92ef80da18847e1e453c405a8e57290e89fbe0
-
SHA512
7768c0859d8d611e434798b55b0c9f107ec91c5001c8feea3b3fe10ee73686b4c6d73d9b0034377afd2c0775ca199e4debc556949b280a067e5b8740ca042bbf
-
SSDEEP
6144:n3C9BRo7tvnJ9Fywhk/T4i37K3BoKg0p5WI09Jl:n3C9ytvn8whkb4i3e3GFO6Jl
Malware Config
Signatures
-
Detect Blackmoon payload 18 IoCs
resource yara_rule behavioral1/memory/3008-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2588-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2388 82288.exe 2036 42628.exe 2532 llxxllx.exe 2720 c824662.exe 2432 lfxlrxr.exe 2736 42462.exe 2588 6020220.exe 2440 64846.exe 2468 646288.exe 1644 46288.exe 2512 5vddp.exe 2956 xrllrxr.exe 2944 k48808.exe 2152 3jjvd.exe 1568 608400.exe 1320 624260.exe 2668 u080224.exe 2520 8802402.exe 572 7hnhtn.exe 2868 llflflx.exe 2252 842868.exe 2240 k06002.exe 2380 8280686.exe 2372 tttnbh.exe 1956 ttnthh.exe 1540 82686.exe 1864 4806880.exe 764 6406840.exe 620 flfrllf.exe 1688 26406.exe 2052 xrlxfff.exe 1752 42406.exe 1976 8206840.exe 1680 ffflxxx.exe 2200 nbtthh.exe 1072 k04628.exe 2176 04684.exe 2644 6400884.exe 2532 nhthnn.exe 2836 hbtbnt.exe 2260 5vpvd.exe 2548 g6068.exe 2596 fxlxflx.exe 2728 s0868.exe 1152 824640.exe 2716 vvpvp.exe 2772 5rffflf.exe 2980 7rllflx.exe 2964 5frrxfr.exe 1776 1dvvj.exe 1868 262288.exe 1984 jjjjj.exe 2696 86206.exe 1608 rlffrrx.exe 2100 88004.exe 2976 2646880.exe 1952 48284.exe 2864 thbhnn.exe 2868 9lflxxr.exe 1852 o824682.exe 1856 hhntbh.exe 1132 3htbnn.exe 1660 5tnhbb.exe 2068 vjvpd.exe -
resource yara_rule behavioral1/memory/3008-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2512-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2668-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2588-71-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2388 3008 69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe 28 PID 3008 wrote to memory of 2388 3008 69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe 28 PID 3008 wrote to memory of 2388 3008 69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe 28 PID 3008 wrote to memory of 2388 3008 69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe 28 PID 2388 wrote to memory of 2036 2388 82288.exe 29 PID 2388 wrote to memory of 2036 2388 82288.exe 29 PID 2388 wrote to memory of 2036 2388 82288.exe 29 PID 2388 wrote to memory of 2036 2388 82288.exe 29 PID 2036 wrote to memory of 2532 2036 42628.exe 66 PID 2036 wrote to memory of 2532 2036 42628.exe 66 PID 2036 wrote to memory of 2532 2036 42628.exe 66 PID 2036 wrote to memory of 2532 2036 42628.exe 66 PID 2532 wrote to memory of 2720 2532 llxxllx.exe 31 PID 2532 wrote to memory of 2720 2532 llxxllx.exe 31 PID 2532 wrote to memory of 2720 2532 llxxllx.exe 31 PID 2532 wrote to memory of 2720 2532 llxxllx.exe 31 PID 2720 wrote to memory of 2432 2720 c824662.exe 32 PID 2720 wrote to memory of 2432 2720 c824662.exe 32 PID 2720 wrote to memory of 2432 2720 c824662.exe 32 PID 2720 wrote to memory of 2432 2720 c824662.exe 32 PID 2432 wrote to memory of 2736 2432 lfxlrxr.exe 33 PID 2432 wrote to memory of 2736 2432 lfxlrxr.exe 33 PID 2432 wrote to memory of 2736 2432 lfxlrxr.exe 33 PID 2432 wrote to memory of 2736 2432 lfxlrxr.exe 33 PID 2736 wrote to memory of 2588 2736 42462.exe 34 PID 2736 wrote to memory of 2588 2736 42462.exe 34 PID 2736 wrote to memory of 2588 2736 42462.exe 34 PID 2736 wrote to memory of 2588 2736 42462.exe 34 PID 2588 wrote to memory of 2440 2588 6020220.exe 35 PID 2588 wrote to memory of 2440 2588 6020220.exe 35 PID 2588 wrote to memory of 2440 2588 6020220.exe 35 PID 2588 wrote to memory of 2440 2588 6020220.exe 35 PID 2440 wrote to memory of 2468 2440 64846.exe 36 PID 2440 wrote to memory of 2468 2440 64846.exe 36 PID 2440 wrote to memory of 2468 2440 64846.exe 36 PID 2440 wrote to memory of 2468 2440 64846.exe 36 PID 2468 wrote to memory of 1644 2468 646288.exe 37 PID 2468 wrote to memory of 1644 2468 646288.exe 37 PID 2468 wrote to memory of 1644 2468 646288.exe 37 PID 2468 wrote to memory of 1644 2468 646288.exe 37 PID 1644 wrote to memory of 2512 1644 46288.exe 38 PID 1644 wrote to memory of 2512 1644 46288.exe 38 PID 1644 wrote to memory of 2512 1644 46288.exe 38 PID 1644 wrote to memory of 2512 1644 46288.exe 38 PID 2512 wrote to memory of 2956 2512 5vddp.exe 39 PID 2512 wrote to memory of 2956 2512 5vddp.exe 39 PID 2512 wrote to memory of 2956 2512 5vddp.exe 39 PID 2512 wrote to memory of 2956 2512 5vddp.exe 39 PID 2956 wrote to memory of 2944 2956 xrllrxr.exe 40 PID 2956 wrote to memory of 2944 2956 xrllrxr.exe 40 PID 2956 wrote to memory of 2944 2956 xrllrxr.exe 40 PID 2956 wrote to memory of 2944 2956 xrllrxr.exe 40 PID 2944 wrote to memory of 2152 2944 k48808.exe 41 PID 2944 wrote to memory of 2152 2944 k48808.exe 41 PID 2944 wrote to memory of 2152 2944 k48808.exe 41 PID 2944 wrote to memory of 2152 2944 k48808.exe 41 PID 2152 wrote to memory of 1568 2152 3jjvd.exe 42 PID 2152 wrote to memory of 1568 2152 3jjvd.exe 42 PID 2152 wrote to memory of 1568 2152 3jjvd.exe 42 PID 2152 wrote to memory of 1568 2152 3jjvd.exe 42 PID 1568 wrote to memory of 1320 1568 608400.exe 43 PID 1568 wrote to memory of 1320 1568 608400.exe 43 PID 1568 wrote to memory of 1320 1568 608400.exe 43 PID 1568 wrote to memory of 1320 1568 608400.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69df7d79a028540c6cd2cf50a4df02a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\82288.exec:\82288.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\42628.exec:\42628.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\llxxllx.exec:\llxxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\c824662.exec:\c824662.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lfxlrxr.exec:\lfxlrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\42462.exec:\42462.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\6020220.exec:\6020220.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\64846.exec:\64846.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\646288.exec:\646288.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\46288.exec:\46288.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\5vddp.exec:\5vddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xrllrxr.exec:\xrllrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\k48808.exec:\k48808.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\3jjvd.exec:\3jjvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\608400.exec:\608400.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\624260.exec:\624260.exe17⤵
- Executes dropped EXE
PID:1320 -
\??\c:\u080224.exec:\u080224.exe18⤵
- Executes dropped EXE
PID:2668 -
\??\c:\8802402.exec:\8802402.exe19⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7hnhtn.exec:\7hnhtn.exe20⤵
- Executes dropped EXE
PID:572 -
\??\c:\llflflx.exec:\llflflx.exe21⤵
- Executes dropped EXE
PID:2868 -
\??\c:\842868.exec:\842868.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\k06002.exec:\k06002.exe23⤵
- Executes dropped EXE
PID:2240 -
\??\c:\8280686.exec:\8280686.exe24⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tttnbh.exec:\tttnbh.exe25⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ttnthh.exec:\ttnthh.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\82686.exec:\82686.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\4806880.exec:\4806880.exe28⤵
- Executes dropped EXE
PID:1864 -
\??\c:\6406840.exec:\6406840.exe29⤵
- Executes dropped EXE
PID:764 -
\??\c:\flfrllf.exec:\flfrllf.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\26406.exec:\26406.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xrlxfff.exec:\xrlxfff.exe32⤵
- Executes dropped EXE
PID:2052 -
\??\c:\42406.exec:\42406.exe33⤵
- Executes dropped EXE
PID:1752 -
\??\c:\8206840.exec:\8206840.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ffflxxx.exec:\ffflxxx.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nbtthh.exec:\nbtthh.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\k04628.exec:\k04628.exe37⤵
- Executes dropped EXE
PID:1072 -
\??\c:\04684.exec:\04684.exe38⤵
- Executes dropped EXE
PID:2176 -
\??\c:\6400884.exec:\6400884.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nhthnn.exec:\nhthnn.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbtbnt.exec:\hbtbnt.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5vpvd.exec:\5vpvd.exe42⤵
- Executes dropped EXE
PID:2260 -
\??\c:\g6068.exec:\g6068.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fxlxflx.exec:\fxlxflx.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\s0868.exec:\s0868.exe45⤵
- Executes dropped EXE
PID:2728 -
\??\c:\824640.exec:\824640.exe46⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vvpvp.exec:\vvpvp.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5rffflf.exec:\5rffflf.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7rllflx.exec:\7rllflx.exe49⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5frrxfr.exec:\5frrxfr.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\1dvvj.exec:\1dvvj.exe51⤵
- Executes dropped EXE
PID:1776 -
\??\c:\262288.exec:\262288.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jjjjj.exec:\jjjjj.exe53⤵
- Executes dropped EXE
PID:1984 -
\??\c:\86206.exec:\86206.exe54⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlffrrx.exec:\rlffrrx.exe55⤵
- Executes dropped EXE
PID:1608 -
\??\c:\88004.exec:\88004.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\2646880.exec:\2646880.exe57⤵
- Executes dropped EXE
PID:2976 -
\??\c:\48284.exec:\48284.exe58⤵
- Executes dropped EXE
PID:1952 -
\??\c:\thbhnn.exec:\thbhnn.exe59⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9lflxxr.exec:\9lflxxr.exe60⤵
- Executes dropped EXE
PID:2868 -
\??\c:\o824682.exec:\o824682.exe61⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hhntbh.exec:\hhntbh.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3htbnn.exec:\3htbnn.exe63⤵
- Executes dropped EXE
PID:1132 -
\??\c:\5tnhbb.exec:\5tnhbb.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vjvpd.exec:\vjvpd.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lxxffll.exec:\lxxffll.exe66⤵PID:376
-
\??\c:\pjddd.exec:\pjddd.exe67⤵PID:1940
-
\??\c:\48006.exec:\48006.exe68⤵PID:880
-
\??\c:\g0802.exec:\g0802.exe69⤵PID:808
-
\??\c:\5jvvd.exec:\5jvvd.exe70⤵PID:1064
-
\??\c:\vpddj.exec:\vpddj.exe71⤵PID:1804
-
\??\c:\c686228.exec:\c686228.exe72⤵PID:2132
-
\??\c:\9lrllff.exec:\9lrllff.exe73⤵PID:1924
-
\??\c:\7vjjj.exec:\7vjjj.exe74⤵PID:1560
-
\??\c:\7lxfffr.exec:\7lxfffr.exe75⤵PID:1976
-
\??\c:\42006.exec:\42006.exe76⤵PID:304
-
\??\c:\a6084.exec:\a6084.exe77⤵PID:3012
-
\??\c:\s8040.exec:\s8040.exe78⤵PID:2564
-
\??\c:\422426.exec:\422426.exe79⤵PID:3044
-
\??\c:\64606.exec:\64606.exe80⤵PID:2176
-
\??\c:\648400.exec:\648400.exe81⤵PID:2644
-
\??\c:\nbnhbh.exec:\nbnhbh.exe82⤵PID:2580
-
\??\c:\48044.exec:\48044.exe83⤵PID:2648
-
\??\c:\2684806.exec:\2684806.exe84⤵PID:2472
-
\??\c:\ppdjd.exec:\ppdjd.exe85⤵PID:2480
-
\??\c:\826240.exec:\826240.exe86⤵PID:660
-
\??\c:\pdjjv.exec:\pdjjv.exe87⤵PID:1624
-
\??\c:\pvdpp.exec:\pvdpp.exe88⤵PID:2700
-
\??\c:\dpdpv.exec:\dpdpv.exe89⤵PID:556
-
\??\c:\5djdd.exec:\5djdd.exe90⤵PID:2780
-
\??\c:\42068.exec:\42068.exe91⤵PID:2484
-
\??\c:\pjdpv.exec:\pjdpv.exe92⤵PID:1700
-
\??\c:\0220644.exec:\0220644.exe93⤵PID:2428
-
\??\c:\5htnbh.exec:\5htnbh.exe94⤵PID:1512
-
\??\c:\hbnnbh.exec:\hbnnbh.exe95⤵PID:1868
-
\??\c:\lllrxfx.exec:\lllrxfx.exe96⤵PID:2600
-
\??\c:\8206846.exec:\8206846.exe97⤵PID:2924
-
\??\c:\xlxxlxr.exec:\xlxxlxr.exe98⤵PID:1808
-
\??\c:\022862.exec:\022862.exe99⤵PID:2100
-
\??\c:\dppdd.exec:\dppdd.exe100⤵PID:2976
-
\??\c:\602800.exec:\602800.exe101⤵PID:1952
-
\??\c:\1lxlrrx.exec:\1lxlrrx.exe102⤵PID:2404
-
\??\c:\e20400.exec:\e20400.exe103⤵PID:2248
-
\??\c:\46206.exec:\46206.exe104⤵PID:1264
-
\??\c:\pjjjd.exec:\pjjjd.exe105⤵PID:288
-
\??\c:\282862.exec:\282862.exe106⤵PID:1084
-
\??\c:\4828402.exec:\4828402.exe107⤵PID:1768
-
\??\c:\604406.exec:\604406.exe108⤵PID:1364
-
\??\c:\ppdpj.exec:\ppdpj.exe109⤵PID:1392
-
\??\c:\8462642.exec:\8462642.exe110⤵PID:1960
-
\??\c:\0000840.exec:\0000840.exe111⤵PID:908
-
\??\c:\400404.exec:\400404.exe112⤵PID:764
-
\??\c:\s0842.exec:\s0842.exe113⤵PID:1684
-
\??\c:\llxlrxl.exec:\llxlrxl.exe114⤵PID:1480
-
\??\c:\6684008.exec:\6684008.exe115⤵PID:1784
-
\??\c:\24000.exec:\24000.exe116⤵PID:2024
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe117⤵PID:1432
-
\??\c:\btnthn.exec:\btnthn.exe118⤵PID:2352
-
\??\c:\rfxfllr.exec:\rfxfllr.exe119⤵PID:1664
-
\??\c:\vjvvj.exec:\vjvvj.exe120⤵PID:3012
-
\??\c:\6008244.exec:\6008244.exe121⤵PID:2564
-
\??\c:\bntbnb.exec:\bntbnb.exe122⤵PID:3044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-