Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 14:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe
-
Size
395KB
-
MD5
76fe96754c1143f0a2a220039ea45580
-
SHA1
303792313ed244eedd160fd5d8077532880e2186
-
SHA256
00478da94fbb88bd1f6adb9e43374d5b5cdf50f5b103a275913722c57f4b8e28
-
SHA512
c5228d07fe06ad8ae110dfbbe9c3a811f1fa90aecaad9157246c9f7fb451fa0520a8a160869a30c60b76c043431b64cb0f1e5dd1f236c8c0a017cbbcfbf5f363
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkobjcSbcY+CaQdaFOY4iGFYtRdu/M:n3C9ytvngQjZbz+xt4vFBk
Malware Config
Signatures
-
Detect Blackmoon payload 17 IoCs
resource yara_rule behavioral1/memory/2212-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3060-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/300-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2988 btnbhh.exe 3060 68440.exe 2672 080028.exe 2724 dvdjv.exe 2600 xrlfrlx.exe 2576 602806.exe 2452 6484886.exe 2676 g8882.exe 840 248202.exe 2480 fxxfrxx.exe 1544 0248088.exe 300 4066682.exe 1624 vddjv.exe 1568 6080840.exe 296 5llxlrx.exe 1268 42468.exe 2320 c640808.exe 2536 lxrffff.exe 2252 xrllrrx.exe 2312 6808828.exe 332 00664.exe 1484 60424.exe 588 u640224.exe 2856 lllrffr.exe 1368 nnnbnt.exe 1400 28280.exe 1792 i262626.exe 1036 5rlrlrl.exe 776 882024.exe 2192 048628.exe 1872 g6880.exe 2040 2640286.exe 3064 vvpdv.exe 1584 82624.exe 2004 64662.exe 2804 444628.exe 2580 8804000.exe 2652 vpvjv.exe 2544 hbtbnn.exe 2448 rfrfrrl.exe 2712 jdvjv.exe 2484 btnnbh.exe 2464 bthhnt.exe 2472 6008408.exe 2452 g8662.exe 2896 4806282.exe 2764 fxfrrff.exe 2068 260244.exe 2000 248668.exe 2520 20280.exe 2256 1jppv.exe 2184 2482864.exe 2760 400888.exe 2744 4868624.exe 884 jjdjj.exe 1312 jdvpj.exe 1724 8848202.exe 2320 04886.exe 1812 jjvdp.exe 2084 1dvpd.exe 784 4844284.exe 1316 080462.exe 2168 3vpjj.exe 1684 4602080.exe -
resource yara_rule behavioral1/memory/2212-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2988-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3060-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2600-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/300-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-267-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2988 2212 76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 2988 2212 76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 2988 2212 76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe 28 PID 2212 wrote to memory of 2988 2212 76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe 28 PID 2988 wrote to memory of 3060 2988 btnbhh.exe 29 PID 2988 wrote to memory of 3060 2988 btnbhh.exe 29 PID 2988 wrote to memory of 3060 2988 btnbhh.exe 29 PID 2988 wrote to memory of 3060 2988 btnbhh.exe 29 PID 3060 wrote to memory of 2672 3060 68440.exe 30 PID 3060 wrote to memory of 2672 3060 68440.exe 30 PID 3060 wrote to memory of 2672 3060 68440.exe 30 PID 3060 wrote to memory of 2672 3060 68440.exe 30 PID 2672 wrote to memory of 2724 2672 080028.exe 31 PID 2672 wrote to memory of 2724 2672 080028.exe 31 PID 2672 wrote to memory of 2724 2672 080028.exe 31 PID 2672 wrote to memory of 2724 2672 080028.exe 31 PID 2724 wrote to memory of 2600 2724 dvdjv.exe 32 PID 2724 wrote to memory of 2600 2724 dvdjv.exe 32 PID 2724 wrote to memory of 2600 2724 dvdjv.exe 32 PID 2724 wrote to memory of 2600 2724 dvdjv.exe 32 PID 2600 wrote to memory of 2576 2600 xrlfrlx.exe 33 PID 2600 wrote to memory of 2576 2600 xrlfrlx.exe 33 PID 2600 wrote to memory of 2576 2600 xrlfrlx.exe 33 PID 2600 wrote to memory of 2576 2600 xrlfrlx.exe 33 PID 2576 wrote to memory of 2452 2576 602806.exe 34 PID 2576 wrote to memory of 2452 2576 602806.exe 34 PID 2576 wrote to memory of 2452 2576 602806.exe 34 PID 2576 wrote to memory of 2452 2576 602806.exe 34 PID 2452 wrote to memory of 2676 2452 6484886.exe 35 PID 2452 wrote to memory of 2676 2452 6484886.exe 35 PID 2452 wrote to memory of 2676 2452 6484886.exe 35 PID 2452 wrote to memory of 2676 2452 6484886.exe 35 PID 2676 wrote to memory of 840 2676 g8882.exe 36 PID 2676 wrote to memory of 840 2676 g8882.exe 36 PID 2676 wrote to memory of 840 2676 g8882.exe 36 PID 2676 wrote to memory of 840 2676 g8882.exe 36 PID 840 wrote to memory of 2480 840 248202.exe 37 PID 840 wrote to memory of 2480 840 248202.exe 37 PID 840 wrote to memory of 2480 840 248202.exe 37 PID 840 wrote to memory of 2480 840 248202.exe 37 PID 2480 wrote to memory of 1544 2480 fxxfrxx.exe 38 PID 2480 wrote to memory of 1544 2480 fxxfrxx.exe 38 PID 2480 wrote to memory of 1544 2480 fxxfrxx.exe 38 PID 2480 wrote to memory of 1544 2480 fxxfrxx.exe 38 PID 1544 wrote to memory of 300 1544 0248088.exe 39 PID 1544 wrote to memory of 300 1544 0248088.exe 39 PID 1544 wrote to memory of 300 1544 0248088.exe 39 PID 1544 wrote to memory of 300 1544 0248088.exe 39 PID 300 wrote to memory of 1624 300 4066682.exe 40 PID 300 wrote to memory of 1624 300 4066682.exe 40 PID 300 wrote to memory of 1624 300 4066682.exe 40 PID 300 wrote to memory of 1624 300 4066682.exe 40 PID 1624 wrote to memory of 1568 1624 vddjv.exe 41 PID 1624 wrote to memory of 1568 1624 vddjv.exe 41 PID 1624 wrote to memory of 1568 1624 vddjv.exe 41 PID 1624 wrote to memory of 1568 1624 vddjv.exe 41 PID 1568 wrote to memory of 296 1568 6080840.exe 42 PID 1568 wrote to memory of 296 1568 6080840.exe 42 PID 1568 wrote to memory of 296 1568 6080840.exe 42 PID 1568 wrote to memory of 296 1568 6080840.exe 42 PID 296 wrote to memory of 1268 296 5llxlrx.exe 43 PID 296 wrote to memory of 1268 296 5llxlrx.exe 43 PID 296 wrote to memory of 1268 296 5llxlrx.exe 43 PID 296 wrote to memory of 1268 296 5llxlrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\76fe96754c1143f0a2a220039ea45580_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\btnbhh.exec:\btnbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\68440.exec:\68440.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\080028.exec:\080028.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\dvdjv.exec:\dvdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\602806.exec:\602806.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\6484886.exec:\6484886.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\g8882.exec:\g8882.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\248202.exec:\248202.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\fxxfrxx.exec:\fxxfrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\0248088.exec:\0248088.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\4066682.exec:\4066682.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\vddjv.exec:\vddjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\6080840.exec:\6080840.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\5llxlrx.exec:\5llxlrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\42468.exec:\42468.exe17⤵
- Executes dropped EXE
PID:1268 -
\??\c:\c640808.exec:\c640808.exe18⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lxrffff.exec:\lxrffff.exe19⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xrllrrx.exec:\xrllrrx.exe20⤵
- Executes dropped EXE
PID:2252 -
\??\c:\6808828.exec:\6808828.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\00664.exec:\00664.exe22⤵
- Executes dropped EXE
PID:332 -
\??\c:\60424.exec:\60424.exe23⤵
- Executes dropped EXE
PID:1484 -
\??\c:\u640224.exec:\u640224.exe24⤵
- Executes dropped EXE
PID:588 -
\??\c:\lllrffr.exec:\lllrffr.exe25⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nnnbnt.exec:\nnnbnt.exe26⤵
- Executes dropped EXE
PID:1368 -
\??\c:\28280.exec:\28280.exe27⤵
- Executes dropped EXE
PID:1400 -
\??\c:\i262626.exec:\i262626.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5rlrlrl.exec:\5rlrlrl.exe29⤵
- Executes dropped EXE
PID:1036 -
\??\c:\882024.exec:\882024.exe30⤵
- Executes dropped EXE
PID:776 -
\??\c:\048628.exec:\048628.exe31⤵
- Executes dropped EXE
PID:2192 -
\??\c:\g6880.exec:\g6880.exe32⤵
- Executes dropped EXE
PID:1872 -
\??\c:\2640286.exec:\2640286.exe33⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvpdv.exec:\vvpdv.exe34⤵
- Executes dropped EXE
PID:3064 -
\??\c:\82624.exec:\82624.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\64662.exec:\64662.exe36⤵
- Executes dropped EXE
PID:2004 -
\??\c:\444628.exec:\444628.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\8804000.exec:\8804000.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vpvjv.exec:\vpvjv.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbtbnn.exec:\hbtbnn.exe40⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rfrfrrl.exec:\rfrfrrl.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jdvjv.exec:\jdvjv.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\btnnbh.exec:\btnnbh.exe43⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bthhnt.exec:\bthhnt.exe44⤵
- Executes dropped EXE
PID:2464 -
\??\c:\6008408.exec:\6008408.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\g8662.exec:\g8662.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\4806282.exec:\4806282.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fxfrrff.exec:\fxfrrff.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\260244.exec:\260244.exe49⤵
- Executes dropped EXE
PID:2068 -
\??\c:\248668.exec:\248668.exe50⤵
- Executes dropped EXE
PID:2000 -
\??\c:\20280.exec:\20280.exe51⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1jppv.exec:\1jppv.exe52⤵
- Executes dropped EXE
PID:2256 -
\??\c:\2482864.exec:\2482864.exe53⤵
- Executes dropped EXE
PID:2184 -
\??\c:\400888.exec:\400888.exe54⤵
- Executes dropped EXE
PID:2760 -
\??\c:\4868624.exec:\4868624.exe55⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjdjj.exec:\jjdjj.exe56⤵
- Executes dropped EXE
PID:884 -
\??\c:\jdvpj.exec:\jdvpj.exe57⤵
- Executes dropped EXE
PID:1312 -
\??\c:\8848202.exec:\8848202.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\04886.exec:\04886.exe59⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jjvdp.exec:\jjvdp.exe60⤵
- Executes dropped EXE
PID:1812 -
\??\c:\1dvpd.exec:\1dvpd.exe61⤵
- Executes dropped EXE
PID:2084 -
\??\c:\4844284.exec:\4844284.exe62⤵
- Executes dropped EXE
PID:784 -
\??\c:\080462.exec:\080462.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3vpjj.exec:\3vpjj.exe64⤵
- Executes dropped EXE
PID:2168 -
\??\c:\4602080.exec:\4602080.exe65⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jvpvp.exec:\jvpvp.exe66⤵PID:1008
-
\??\c:\60846.exec:\60846.exe67⤵PID:2400
-
\??\c:\608400.exec:\608400.exe68⤵PID:2188
-
\??\c:\424062.exec:\424062.exe69⤵PID:1540
-
\??\c:\26068.exec:\26068.exe70⤵PID:1400
-
\??\c:\08882.exec:\08882.exe71⤵PID:2268
-
\??\c:\e48628.exec:\e48628.exe72⤵PID:320
-
\??\c:\llfllxr.exec:\llfllxr.exe73⤵PID:1144
-
\??\c:\404680.exec:\404680.exe74⤵PID:3044
-
\??\c:\i040628.exec:\i040628.exe75⤵PID:2192
-
\??\c:\1rlxflr.exec:\1rlxflr.exe76⤵PID:2860
-
\??\c:\04202.exec:\04202.exe77⤵PID:1032
-
\??\c:\028286.exec:\028286.exe78⤵PID:2196
-
\??\c:\flflrfr.exec:\flflrfr.exe79⤵PID:1560
-
\??\c:\pjvdp.exec:\pjvdp.exe80⤵PID:1500
-
\??\c:\5jvvv.exec:\5jvvv.exe81⤵PID:3020
-
\??\c:\bhbtnb.exec:\bhbtnb.exe82⤵PID:3068
-
\??\c:\jdvjj.exec:\jdvjj.exe83⤵PID:3060
-
\??\c:\6648686.exec:\6648686.exe84⤵PID:2688
-
\??\c:\hhbnth.exec:\hhbnth.exe85⤵PID:2528
-
\??\c:\46404.exec:\46404.exe86⤵PID:2612
-
\??\c:\jpdvd.exec:\jpdvd.exe87⤵PID:2468
-
\??\c:\826246.exec:\826246.exe88⤵PID:2504
-
\??\c:\602244.exec:\602244.exe89⤵PID:2904
-
\??\c:\8688888.exec:\8688888.exe90⤵PID:2488
-
\??\c:\k84424.exec:\k84424.exe91⤵PID:2796
-
\??\c:\fxrxlfx.exec:\fxrxlfx.exe92⤵PID:1056
-
\??\c:\lrxxlff.exec:\lrxxlff.exe93⤵PID:2064
-
\??\c:\a6880.exec:\a6880.exe94⤵PID:2176
-
\??\c:\u862068.exec:\u862068.exe95⤵PID:1880
-
\??\c:\i806408.exec:\i806408.exe96⤵PID:1516
-
\??\c:\486266.exec:\486266.exe97⤵PID:2428
-
\??\c:\8206060.exec:\8206060.exe98⤵PID:2684
-
\??\c:\9vpvd.exec:\9vpvd.exe99⤵PID:1992
-
\??\c:\000460.exec:\000460.exe100⤵PID:1324
-
\??\c:\btnbtb.exec:\btnbtb.exe101⤵PID:2280
-
\??\c:\3llrlxr.exec:\3llrlxr.exe102⤵PID:1976
-
\??\c:\4402626.exec:\4402626.exe103⤵PID:2536
-
\??\c:\4886826.exec:\4886826.exe104⤵PID:1812
-
\??\c:\264000.exec:\264000.exe105⤵PID:800
-
\??\c:\284268.exec:\284268.exe106⤵PID:2128
-
\??\c:\rxrxllx.exec:\rxrxllx.exe107⤵PID:552
-
\??\c:\llrrffx.exec:\llrrffx.exe108⤵PID:1868
-
\??\c:\4806402.exec:\4806402.exe109⤵PID:420
-
\??\c:\rxffxll.exec:\rxffxll.exe110⤵PID:1816
-
\??\c:\m8006.exec:\m8006.exe111⤵PID:1620
-
\??\c:\048640.exec:\048640.exe112⤵PID:920
-
\??\c:\jdpvv.exec:\jdpvv.exe113⤵PID:1100
-
\??\c:\28442.exec:\28442.exe114⤵PID:756
-
\??\c:\08224.exec:\08224.exe115⤵PID:1020
-
\??\c:\s0884.exec:\s0884.exe116⤵PID:2112
-
\??\c:\i220804.exec:\i220804.exe117⤵PID:1680
-
\??\c:\882460.exec:\882460.exe118⤵PID:2824
-
\??\c:\6224442.exec:\6224442.exe119⤵PID:1744
-
\??\c:\2820460.exec:\2820460.exe120⤵PID:2124
-
\??\c:\404848.exec:\404848.exe121⤵PID:2336
-
\??\c:\nhtbbh.exec:\nhtbbh.exe122⤵PID:1848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-