Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 19:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7becbe337c816356dff0054739def600_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
7becbe337c816356dff0054739def600_NeikiAnalytics.exe
-
Size
179KB
-
MD5
7becbe337c816356dff0054739def600
-
SHA1
689107fa7f553698fb053099d9f6a021b71476f2
-
SHA256
93754a01d17d765e88671d1cc895c2143c1734c405adb63968f7b872825a9110
-
SHA512
878bb076e0bcb84cd2f4b82005d0ee79e88eb42e72d3349dcfb68fd1968faaf9666d64a7f1d90124bf991ba2743e309a3523c8519dd4c51298efc741b23b0d71
-
SSDEEP
3072:AhOmTsF93UYfwC6GIoutQ6M/Fpi8rY9AABa1YRMxgRP5ZXux+:Acm4FmowdHoSCddWhR/Z+Y
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2196-12-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2204-9-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1720-21-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2528-39-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2728-30-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/3016-63-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2460-72-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2672-79-0x00000000005D0000-0x0000000000601000-memory.dmp family_blackmoon behavioral1/memory/2672-82-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2436-84-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2972-94-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2044-102-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2044-105-0x0000000000220000-0x0000000000251000-memory.dmp family_blackmoon behavioral1/memory/2760-127-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2316-147-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1648-170-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2852-196-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2768-204-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1020-225-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1504-223-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2128-240-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2780-282-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2116-291-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/552-316-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2224-323-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/3060-336-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2568-343-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2444-387-0x0000000000220000-0x0000000000251000-memory.dmp family_blackmoon behavioral1/memory/2748-408-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/2760-421-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1820-467-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1480-642-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1808-675-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/844-725-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon behavioral1/memory/1316-1056-0x00000000002C0000-0x00000000002F1000-memory.dmp family_blackmoon behavioral1/memory/1388-1111-0x0000000000400000-0x0000000000431000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2196 vpdjv.exe 1720 g8806.exe 2728 48060.exe 2528 jdpvp.exe 2624 c680006.exe 3016 w86206.exe 2460 4862440.exe 2672 5nbntt.exe 2436 60462.exe 2972 btnttb.exe 2044 646688.exe 2704 446840.exe 2760 dvppd.exe 2892 8200068.exe 1400 8204224.exe 2316 22066.exe 1796 04426.exe 1648 0428024.exe 1292 7tnnbh.exe 764 u288402.exe 2852 02680.exe 2768 7dppv.exe 940 u204062.exe 1504 frflrlr.exe 1020 864006.exe 2128 424400.exe 2140 082228.exe 1140 hbtbbb.exe 2800 9nbbtb.exe 956 606248.exe 2780 s4628.exe 2116 e46240.exe 1144 82028.exe 2020 xlxxrrx.exe 1584 pdjjv.exe 552 420622.exe 2224 2282620.exe 2096 dpjjd.exe 3060 o040228.exe 2568 rffflrr.exe 2040 08444.exe 2664 7hbbbt.exe 2576 w08840.exe 2752 82068.exe 2588 nnhnbt.exe 2740 nhntnn.exe 2444 804680.exe 2972 e62884.exe 2912 82084.exe 2592 6406202.exe 2748 1nthtt.exe 2492 lflxrff.exe 2760 6404040.exe 2028 7jddv.exe 2700 rlflllr.exe 1324 e86060.exe 2316 bbtbhn.exe 1600 0844488.exe 2880 1rffffl.exe 1820 9tttnt.exe 1316 080022.exe 2936 4282484.exe 336 c202884.exe 2296 5djdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2196 2204 7becbe337c816356dff0054739def600_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 2196 2204 7becbe337c816356dff0054739def600_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 2196 2204 7becbe337c816356dff0054739def600_NeikiAnalytics.exe 28 PID 2204 wrote to memory of 2196 2204 7becbe337c816356dff0054739def600_NeikiAnalytics.exe 28 PID 2196 wrote to memory of 1720 2196 vpdjv.exe 29 PID 2196 wrote to memory of 1720 2196 vpdjv.exe 29 PID 2196 wrote to memory of 1720 2196 vpdjv.exe 29 PID 2196 wrote to memory of 1720 2196 vpdjv.exe 29 PID 1720 wrote to memory of 2728 1720 g8806.exe 30 PID 1720 wrote to memory of 2728 1720 g8806.exe 30 PID 1720 wrote to memory of 2728 1720 g8806.exe 30 PID 1720 wrote to memory of 2728 1720 g8806.exe 30 PID 2728 wrote to memory of 2528 2728 48060.exe 31 PID 2728 wrote to memory of 2528 2728 48060.exe 31 PID 2728 wrote to memory of 2528 2728 48060.exe 31 PID 2728 wrote to memory of 2528 2728 48060.exe 31 PID 2528 wrote to memory of 2624 2528 jdpvp.exe 32 PID 2528 wrote to memory of 2624 2528 jdpvp.exe 32 PID 2528 wrote to memory of 2624 2528 jdpvp.exe 32 PID 2528 wrote to memory of 2624 2528 jdpvp.exe 32 PID 2624 wrote to memory of 3016 2624 c680006.exe 33 PID 2624 wrote to memory of 3016 2624 c680006.exe 33 PID 2624 wrote to memory of 3016 2624 c680006.exe 33 PID 2624 wrote to memory of 3016 2624 c680006.exe 33 PID 3016 wrote to memory of 2460 3016 w86206.exe 34 PID 3016 wrote to memory of 2460 3016 w86206.exe 34 PID 3016 wrote to memory of 2460 3016 w86206.exe 34 PID 3016 wrote to memory of 2460 3016 w86206.exe 34 PID 2460 wrote to memory of 2672 2460 4862440.exe 35 PID 2460 wrote to memory of 2672 2460 4862440.exe 35 PID 2460 wrote to memory of 2672 2460 4862440.exe 35 PID 2460 wrote to memory of 2672 2460 4862440.exe 35 PID 2672 wrote to memory of 2436 2672 5nbntt.exe 36 PID 2672 wrote to memory of 2436 2672 5nbntt.exe 36 PID 2672 wrote to memory of 2436 2672 5nbntt.exe 36 PID 2672 wrote to memory of 2436 2672 5nbntt.exe 36 PID 2436 wrote to memory of 2972 2436 60462.exe 37 PID 2436 wrote to memory of 2972 2436 60462.exe 37 PID 2436 wrote to memory of 2972 2436 60462.exe 37 PID 2436 wrote to memory of 2972 2436 60462.exe 37 PID 2972 wrote to memory of 2044 2972 btnttb.exe 38 PID 2972 wrote to memory of 2044 2972 btnttb.exe 38 PID 2972 wrote to memory of 2044 2972 btnttb.exe 38 PID 2972 wrote to memory of 2044 2972 btnttb.exe 38 PID 2044 wrote to memory of 2704 2044 646688.exe 39 PID 2044 wrote to memory of 2704 2044 646688.exe 39 PID 2044 wrote to memory of 2704 2044 646688.exe 39 PID 2044 wrote to memory of 2704 2044 646688.exe 39 PID 2704 wrote to memory of 2760 2704 446840.exe 40 PID 2704 wrote to memory of 2760 2704 446840.exe 40 PID 2704 wrote to memory of 2760 2704 446840.exe 40 PID 2704 wrote to memory of 2760 2704 446840.exe 40 PID 2760 wrote to memory of 2892 2760 dvppd.exe 41 PID 2760 wrote to memory of 2892 2760 dvppd.exe 41 PID 2760 wrote to memory of 2892 2760 dvppd.exe 41 PID 2760 wrote to memory of 2892 2760 dvppd.exe 41 PID 2892 wrote to memory of 1400 2892 8200068.exe 42 PID 2892 wrote to memory of 1400 2892 8200068.exe 42 PID 2892 wrote to memory of 1400 2892 8200068.exe 42 PID 2892 wrote to memory of 1400 2892 8200068.exe 42 PID 1400 wrote to memory of 2316 1400 8204224.exe 43 PID 1400 wrote to memory of 2316 1400 8204224.exe 43 PID 1400 wrote to memory of 2316 1400 8204224.exe 43 PID 1400 wrote to memory of 2316 1400 8204224.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\7becbe337c816356dff0054739def600_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7becbe337c816356dff0054739def600_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vpdjv.exec:\vpdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\g8806.exec:\g8806.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\48060.exec:\48060.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jdpvp.exec:\jdpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\c680006.exec:\c680006.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\w86206.exec:\w86206.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\4862440.exec:\4862440.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\5nbntt.exec:\5nbntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\60462.exec:\60462.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\btnttb.exec:\btnttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\646688.exec:\646688.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\446840.exec:\446840.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\dvppd.exec:\dvppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\8200068.exec:\8200068.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\8204224.exec:\8204224.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\22066.exec:\22066.exe17⤵
- Executes dropped EXE
PID:2316 -
\??\c:\04426.exec:\04426.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\0428024.exec:\0428024.exe19⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7tnnbh.exec:\7tnnbh.exe20⤵
- Executes dropped EXE
PID:1292 -
\??\c:\u288402.exec:\u288402.exe21⤵
- Executes dropped EXE
PID:764 -
\??\c:\02680.exec:\02680.exe22⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7dppv.exec:\7dppv.exe23⤵
- Executes dropped EXE
PID:2768 -
\??\c:\u204062.exec:\u204062.exe24⤵
- Executes dropped EXE
PID:940 -
\??\c:\frflrlr.exec:\frflrlr.exe25⤵
- Executes dropped EXE
PID:1504 -
\??\c:\864006.exec:\864006.exe26⤵
- Executes dropped EXE
PID:1020 -
\??\c:\424400.exec:\424400.exe27⤵
- Executes dropped EXE
PID:2128 -
\??\c:\082228.exec:\082228.exe28⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbtbbb.exec:\hbtbbb.exe29⤵
- Executes dropped EXE
PID:1140 -
\??\c:\9nbbtb.exec:\9nbbtb.exe30⤵
- Executes dropped EXE
PID:2800 -
\??\c:\606248.exec:\606248.exe31⤵
- Executes dropped EXE
PID:956 -
\??\c:\s4628.exec:\s4628.exe32⤵
- Executes dropped EXE
PID:2780 -
\??\c:\e46240.exec:\e46240.exe33⤵
- Executes dropped EXE
PID:2116 -
\??\c:\82028.exec:\82028.exe34⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xlxxrrx.exec:\xlxxrrx.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pdjjv.exec:\pdjjv.exe36⤵
- Executes dropped EXE
PID:1584 -
\??\c:\420622.exec:\420622.exe37⤵
- Executes dropped EXE
PID:552 -
\??\c:\2282620.exec:\2282620.exe38⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dpjjd.exec:\dpjjd.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\o040228.exec:\o040228.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rffflrr.exec:\rffflrr.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\08444.exec:\08444.exe42⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7hbbbt.exec:\7hbbbt.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\w08840.exec:\w08840.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\82068.exec:\82068.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nnhnbt.exec:\nnhnbt.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhntnn.exec:\nhntnn.exe47⤵
- Executes dropped EXE
PID:2740 -
\??\c:\804680.exec:\804680.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\e62884.exec:\e62884.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\82084.exec:\82084.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\6406202.exec:\6406202.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1nthtt.exec:\1nthtt.exe52⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lflxrff.exec:\lflxrff.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\6404040.exec:\6404040.exe54⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7jddv.exec:\7jddv.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlflllr.exec:\rlflllr.exe56⤵
- Executes dropped EXE
PID:2700 -
\??\c:\e86060.exec:\e86060.exe57⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bbtbhn.exec:\bbtbhn.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\0844488.exec:\0844488.exe59⤵
- Executes dropped EXE
PID:1600 -
\??\c:\1rffffl.exec:\1rffffl.exe60⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9tttnt.exec:\9tttnt.exe61⤵
- Executes dropped EXE
PID:1820 -
\??\c:\080022.exec:\080022.exe62⤵
- Executes dropped EXE
PID:1316 -
\??\c:\4282484.exec:\4282484.exe63⤵
- Executes dropped EXE
PID:2936 -
\??\c:\c202884.exec:\c202884.exe64⤵
- Executes dropped EXE
PID:336 -
\??\c:\5djdp.exec:\5djdp.exe65⤵
- Executes dropped EXE
PID:2296 -
\??\c:\264022.exec:\264022.exe66⤵PID:1908
-
\??\c:\pjvpj.exec:\pjvpj.exe67⤵PID:2772
-
\??\c:\dvdpp.exec:\dvdpp.exe68⤵PID:1936
-
\??\c:\thnnbb.exec:\thnnbb.exe69⤵PID:1504
-
\??\c:\k64028.exec:\k64028.exe70⤵PID:348
-
\??\c:\ppddj.exec:\ppddj.exe71⤵PID:1340
-
\??\c:\86444.exec:\86444.exe72⤵PID:960
-
\??\c:\06222.exec:\06222.exe73⤵PID:1200
-
\??\c:\20628.exec:\20628.exe74⤵PID:1364
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe75⤵PID:1568
-
\??\c:\btbttt.exec:\btbttt.exe76⤵PID:2956
-
\??\c:\pdvvd.exec:\pdvvd.exe77⤵PID:2368
-
\??\c:\xrflrrl.exec:\xrflrrl.exe78⤵PID:616
-
\??\c:\280662.exec:\280662.exe79⤵PID:2116
-
\??\c:\3bntbt.exec:\3bntbt.exe80⤵PID:3000
-
\??\c:\20220.exec:\20220.exe81⤵PID:1564
-
\??\c:\3nhhhn.exec:\3nhhhn.exe82⤵PID:1584
-
\??\c:\64062.exec:\64062.exe83⤵PID:2200
-
\??\c:\3rfflfr.exec:\3rfflfr.exe84⤵PID:2224
-
\??\c:\1fxfrxr.exec:\1fxfrxr.exe85⤵PID:2944
-
\??\c:\60284.exec:\60284.exe86⤵PID:3060
-
\??\c:\1hbbhn.exec:\1hbbhn.exe87⤵PID:2528
-
\??\c:\w64800.exec:\w64800.exe88⤵PID:1480
-
\??\c:\o862840.exec:\o862840.exe89⤵PID:2584
-
\??\c:\hbnbtt.exec:\hbnbtt.exe90⤵PID:2684
-
\??\c:\bnttbb.exec:\bnttbb.exe91⤵PID:2328
-
\??\c:\24222.exec:\24222.exe92⤵PID:2208
-
\??\c:\86600.exec:\86600.exe93⤵PID:2560
-
\??\c:\c642846.exec:\c642846.exe94⤵PID:1808
-
\??\c:\0484284.exec:\0484284.exe95⤵PID:1040
-
\??\c:\nnttbb.exec:\nnttbb.exe96⤵PID:2696
-
\??\c:\vpvdd.exec:\vpvdd.exe97⤵PID:2184
-
\??\c:\o600220.exec:\o600220.exe98⤵PID:1932
-
\??\c:\thnntt.exec:\thnntt.exe99⤵PID:2032
-
\??\c:\86844.exec:\86844.exe100⤵PID:920
-
\??\c:\860626.exec:\860626.exe101⤵PID:844
-
\??\c:\1ttttt.exec:\1ttttt.exe102⤵PID:1940
-
\??\c:\5xrrffl.exec:\5xrrffl.exe103⤵PID:1640
-
\??\c:\e42806.exec:\e42806.exe104⤵PID:2156
-
\??\c:\pvjdv.exec:\pvjdv.exe105⤵PID:1652
-
\??\c:\64662.exec:\64662.exe106⤵PID:324
-
\??\c:\264684.exec:\264684.exe107⤵PID:1760
-
\??\c:\5pddj.exec:\5pddj.exe108⤵PID:1044
-
\??\c:\3nhhhn.exec:\3nhhhn.exe109⤵PID:2940
-
\??\c:\1xfllll.exec:\1xfllll.exe110⤵PID:2288
-
\??\c:\a8242.exec:\a8242.exe111⤵PID:592
-
\??\c:\46846.exec:\46846.exe112⤵PID:584
-
\??\c:\e60660.exec:\e60660.exe113⤵PID:940
-
\??\c:\20228.exec:\20228.exe114⤵PID:640
-
\??\c:\a0288.exec:\a0288.exe115⤵PID:1756
-
\??\c:\rrflxlr.exec:\rrflxlr.exe116⤵PID:2276
-
\??\c:\480066.exec:\480066.exe117⤵PID:2128
-
\??\c:\i622446.exec:\i622446.exe118⤵PID:1340
-
\??\c:\nhtthh.exec:\nhtthh.exe119⤵PID:960
-
\??\c:\9lllrrf.exec:\9lllrrf.exe120⤵PID:1200
-
\??\c:\u400008.exec:\u400008.exe121⤵PID:2160
-
\??\c:\82606.exec:\82606.exe122⤵PID:1568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-