Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
9eedeb2eeb6302112cd796c8052a61c0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
9eedeb2eeb6302112cd796c8052a61c0N.exe
Resource
win10v2004-20240802-en
General
-
Target
9eedeb2eeb6302112cd796c8052a61c0N.exe
-
Size
728KB
-
MD5
9eedeb2eeb6302112cd796c8052a61c0
-
SHA1
b6d1cfac8b50eeefa46614184c68cca6d88826c6
-
SHA256
e28e4915de12b4c024d3aad5e30cd83b118484c44a46d86874f92d484b5be05a
-
SHA512
c31f9969dbbd463872ef2835572888536c0325dbd0fae14dfe8add643c3814d3ae955486a81a8118e223b61890a5a07d85317610ae3ddb941a41fe033211b4d5
-
SSDEEP
6144:dqDAwl0xPTMiR9JSSxPUKYGdodH/baqE7Al8jk2jcbaqE7Al8jk2jA:d+67XR9JSSxvYGdodH/1CVc1CVA
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2780 Sysqemihzdi.exe 2636 Sysqemnihyq.exe 2516 Sysqemnaiis.exe 2060 Sysqemsnbqe.exe 2100 Sysqemmigge.exe 1704 Sysqemwwhvu.exe 1868 Sysqemozvgw.exe 2128 Sysqembmnvb.exe 2140 Sysqemstmtg.exe 1608 Sysqemabila.exe 2404 Sysqemaqxqr.exe 1092 Sysqemkpkoc.exe 1048 Sysqemrbhtn.exe 308 Sysqemblxeb.exe 1928 Sysqembaujs.exe 2628 Sysqemngmmg.exe 2804 Sysqemnjyed.exe 2524 Sysqemcdnre.exe 1064 Sysqemxbdmh.exe 2728 Sysqemmuahr.exe 1340 Sysqemtghei.exe 2720 Sysqemirerr.exe 2576 Sysqemglaeh.exe 2920 Sysqemqleka.exe 2796 Sysqemhrdzw.exe 1380 Sysqemuxvct.exe 2180 Sysqemmxgzk.exe 1668 Sysqembugzw.exe 2304 Sysqemyobmu.exe 1932 Sysqemnovzk.exe 884 Sysqemfoyxj.exe 2140 Sysqemstpax.exe 1452 Sysqemezhax.exe 1796 Sysqemwngfh.exe 976 Sysqemqxann.exe 3012 Sysqemgnlvm.exe 2816 Sysqemfjxsr.exe 2744 Sysqembhqlm.exe 2792 Sysqemitxqj.exe 2156 Sysqemxiiyq.exe 1140 Sysqemrkkfn.exe 2908 Sysqemhegsx.exe 2868 Sysqemeycfv.exe 1340 Sysqemjdlij.exe 2884 Sysqemiwusd.exe 1708 Sysqemaklyo.exe 1616 Sysqemvbnbd.exe 876 Sysqemkynap.exe 1508 Sysqempzddg.exe 1400 Sysqemcbjlr.exe 2036 Sysqemmtobe.exe 1792 Sysqembqwbq.exe 328 Sysqemyndbj.exe 2244 Sysqemnhawt.exe 2568 Sysqemycbga.exe 2152 Sysqemnwpbk.exe 2324 Sysqemkattr.exe 2724 Sysqemziebp.exe 1000 Sysqemtsyjv.exe 2720 Sysqemjirrc.exe 2764 Sysqembprhh.exe 1568 Sysqemqmrgt.exe 3028 Sysqemaegmy.exe 2596 Sysqemkgwwt.exe -
Loads dropped DLL 64 IoCs
pid Process 2708 9eedeb2eeb6302112cd796c8052a61c0N.exe 2708 9eedeb2eeb6302112cd796c8052a61c0N.exe 2780 Sysqemihzdi.exe 2780 Sysqemihzdi.exe 2636 Sysqemnihyq.exe 2636 Sysqemnihyq.exe 2516 Sysqemnaiis.exe 2516 Sysqemnaiis.exe 2060 Sysqemsnbqe.exe 2060 Sysqemsnbqe.exe 2100 Sysqemmigge.exe 2100 Sysqemmigge.exe 1704 Sysqemwwhvu.exe 1704 Sysqemwwhvu.exe 1868 Sysqemozvgw.exe 1868 Sysqemozvgw.exe 2128 Sysqembmnvb.exe 2128 Sysqembmnvb.exe 2140 Sysqemstmtg.exe 2140 Sysqemstmtg.exe 1608 Sysqemabila.exe 1608 Sysqemabila.exe 2404 Sysqemaqxqr.exe 2404 Sysqemaqxqr.exe 1092 Sysqemkpkoc.exe 1092 Sysqemkpkoc.exe 1048 Sysqemrbhtn.exe 1048 Sysqemrbhtn.exe 308 Sysqemblxeb.exe 308 Sysqemblxeb.exe 1928 Sysqembaujs.exe 1928 Sysqembaujs.exe 2628 Sysqemngmmg.exe 2628 Sysqemngmmg.exe 2804 Sysqemnjyed.exe 2804 Sysqemnjyed.exe 2524 Sysqemcdnre.exe 2524 Sysqemcdnre.exe 1064 Sysqemxbdmh.exe 1064 Sysqemxbdmh.exe 2728 Sysqemmuahr.exe 2728 Sysqemmuahr.exe 1340 Sysqemtghei.exe 1340 Sysqemtghei.exe 2720 Sysqemirerr.exe 2720 Sysqemirerr.exe 2576 Sysqemglaeh.exe 2576 Sysqemglaeh.exe 2920 Sysqemqleka.exe 2920 Sysqemqleka.exe 2796 Sysqemhrdzw.exe 2796 Sysqemhrdzw.exe 1380 Sysqemuxvct.exe 1380 Sysqemuxvct.exe 2180 Sysqemmxgzk.exe 2180 Sysqemmxgzk.exe 1668 Sysqembugzw.exe 1668 Sysqembugzw.exe 2304 Sysqemyobmu.exe 2304 Sysqemyobmu.exe 1932 Sysqemnovzk.exe 1932 Sysqemnovzk.exe 884 Sysqemfoyxj.exe 884 Sysqemfoyxj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnvafc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhvcrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemblaaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemdcqnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmplyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkgwwt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemonpfc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcbjlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemjvypi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemhpxgl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwngfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemblxeb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemitxqj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsnbqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemducwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnplqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembqwbq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemlazqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmxgzk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtsoce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembhqlm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqempbrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsnvnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemecagy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemzpaek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxwwed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemaklyo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqtuit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnkmrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembcacn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqvbbk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemcyohh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmrwef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfiktc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgawcw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxmrvw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemsrcwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxodii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemwnnyg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemerxlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemgzkzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrhbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemrtsep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemkynap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemqmrgt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfimay.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemxuydd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemnttzx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqembbuab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemachvs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfvxpy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemotxmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtcksb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemylmbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemglaeh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmlliu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemtlzsi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemloflc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmtewj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemmjilm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemofwjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemfvmyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysqemvbnlu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2780 2708 9eedeb2eeb6302112cd796c8052a61c0N.exe 30 PID 2708 wrote to memory of 2780 2708 9eedeb2eeb6302112cd796c8052a61c0N.exe 30 PID 2708 wrote to memory of 2780 2708 9eedeb2eeb6302112cd796c8052a61c0N.exe 30 PID 2708 wrote to memory of 2780 2708 9eedeb2eeb6302112cd796c8052a61c0N.exe 30 PID 2780 wrote to memory of 2636 2780 Sysqemihzdi.exe 31 PID 2780 wrote to memory of 2636 2780 Sysqemihzdi.exe 31 PID 2780 wrote to memory of 2636 2780 Sysqemihzdi.exe 31 PID 2780 wrote to memory of 2636 2780 Sysqemihzdi.exe 31 PID 2636 wrote to memory of 2516 2636 Sysqemnihyq.exe 32 PID 2636 wrote to memory of 2516 2636 Sysqemnihyq.exe 32 PID 2636 wrote to memory of 2516 2636 Sysqemnihyq.exe 32 PID 2636 wrote to memory of 2516 2636 Sysqemnihyq.exe 32 PID 2516 wrote to memory of 2060 2516 Sysqemnaiis.exe 33 PID 2516 wrote to memory of 2060 2516 Sysqemnaiis.exe 33 PID 2516 wrote to memory of 2060 2516 Sysqemnaiis.exe 33 PID 2516 wrote to memory of 2060 2516 Sysqemnaiis.exe 33 PID 2060 wrote to memory of 2100 2060 Sysqemsnbqe.exe 34 PID 2060 wrote to memory of 2100 2060 Sysqemsnbqe.exe 34 PID 2060 wrote to memory of 2100 2060 Sysqemsnbqe.exe 34 PID 2060 wrote to memory of 2100 2060 Sysqemsnbqe.exe 34 PID 2100 wrote to memory of 1704 2100 Sysqemmigge.exe 35 PID 2100 wrote to memory of 1704 2100 Sysqemmigge.exe 35 PID 2100 wrote to memory of 1704 2100 Sysqemmigge.exe 35 PID 2100 wrote to memory of 1704 2100 Sysqemmigge.exe 35 PID 1704 wrote to memory of 1868 1704 Sysqemwwhvu.exe 36 PID 1704 wrote to memory of 1868 1704 Sysqemwwhvu.exe 36 PID 1704 wrote to memory of 1868 1704 Sysqemwwhvu.exe 36 PID 1704 wrote to memory of 1868 1704 Sysqemwwhvu.exe 36 PID 1868 wrote to memory of 2128 1868 Sysqemozvgw.exe 37 PID 1868 wrote to memory of 2128 1868 Sysqemozvgw.exe 37 PID 1868 wrote to memory of 2128 1868 Sysqemozvgw.exe 37 PID 1868 wrote to memory of 2128 1868 Sysqemozvgw.exe 37 PID 2128 wrote to memory of 2140 2128 Sysqembmnvb.exe 38 PID 2128 wrote to memory of 2140 2128 Sysqembmnvb.exe 38 PID 2128 wrote to memory of 2140 2128 Sysqembmnvb.exe 38 PID 2128 wrote to memory of 2140 2128 Sysqembmnvb.exe 38 PID 2140 wrote to memory of 1608 2140 Sysqemstmtg.exe 39 PID 2140 wrote to memory of 1608 2140 Sysqemstmtg.exe 39 PID 2140 wrote to memory of 1608 2140 Sysqemstmtg.exe 39 PID 2140 wrote to memory of 1608 2140 Sysqemstmtg.exe 39 PID 1608 wrote to memory of 2404 1608 Sysqemabila.exe 40 PID 1608 wrote to memory of 2404 1608 Sysqemabila.exe 40 PID 1608 wrote to memory of 2404 1608 Sysqemabila.exe 40 PID 1608 wrote to memory of 2404 1608 Sysqemabila.exe 40 PID 2404 wrote to memory of 1092 2404 Sysqemaqxqr.exe 41 PID 2404 wrote to memory of 1092 2404 Sysqemaqxqr.exe 41 PID 2404 wrote to memory of 1092 2404 Sysqemaqxqr.exe 41 PID 2404 wrote to memory of 1092 2404 Sysqemaqxqr.exe 41 PID 1092 wrote to memory of 1048 1092 Sysqemkpkoc.exe 42 PID 1092 wrote to memory of 1048 1092 Sysqemkpkoc.exe 42 PID 1092 wrote to memory of 1048 1092 Sysqemkpkoc.exe 42 PID 1092 wrote to memory of 1048 1092 Sysqemkpkoc.exe 42 PID 1048 wrote to memory of 308 1048 Sysqemrbhtn.exe 43 PID 1048 wrote to memory of 308 1048 Sysqemrbhtn.exe 43 PID 1048 wrote to memory of 308 1048 Sysqemrbhtn.exe 43 PID 1048 wrote to memory of 308 1048 Sysqemrbhtn.exe 43 PID 308 wrote to memory of 1928 308 Sysqemblxeb.exe 44 PID 308 wrote to memory of 1928 308 Sysqemblxeb.exe 44 PID 308 wrote to memory of 1928 308 Sysqemblxeb.exe 44 PID 308 wrote to memory of 1928 308 Sysqemblxeb.exe 44 PID 1928 wrote to memory of 2628 1928 Sysqembaujs.exe 45 PID 1928 wrote to memory of 2628 1928 Sysqembaujs.exe 45 PID 1928 wrote to memory of 2628 1928 Sysqembaujs.exe 45 PID 1928 wrote to memory of 2628 1928 Sysqembaujs.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eedeb2eeb6302112cd796c8052a61c0N.exe"C:\Users\Admin\AppData\Local\Temp\9eedeb2eeb6302112cd796c8052a61c0N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemihzdi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemihzdi.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnihyq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnihyq.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnaiis.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnaiis.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\Sysqemsnbqe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsnbqe.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmigge.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmigge.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwwhvu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwwhvu.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Sysqemozvgw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemozvgw.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\Sysqembmnvb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembmnvb.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\Sysqemstmtg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemstmtg.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\Sysqemabila.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemabila.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaqxqr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaqxqr.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkpkoc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkpkoc.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrbhtn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrbhtn.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\Sysqemblxeb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemblxeb.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Users\Admin\AppData\Local\Temp\Sysqembaujs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembaujs.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\Sysqemngmmg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemngmmg.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnjyed.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnjyed.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcdnre.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcdnre.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxbdmh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxbdmh.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmuahr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmuahr.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtghei.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtghei.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\Sysqemirerr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemirerr.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\Sysqemglaeh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemglaeh.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqleka.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqleka.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhrdzw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhrdzw.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuxvct.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuxvct.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmxgzk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmxgzk.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\Sysqembugzw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembugzw.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyobmu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyobmu.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnovzk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnovzk.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfoyxj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfoyxj.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\Sysqemstpax.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemstpax.exe"33⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\Sysqemezhax.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemezhax.exe"34⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwngfh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwngfh.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqxann.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqxann.exe"36⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\Sysqemgnlvm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgnlvm.exe"37⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfjxsr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfjxsr.exe"38⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\Sysqembhqlm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembhqlm.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\Sysqemitxqj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemitxqj.exe"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemxiiyq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxiiyq.exe"41⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrkkfn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrkkfn.exe"42⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhegsx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhegsx.exe"43⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeycfv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeycfv.exe"44⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjdlij.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjdlij.exe"45⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\Sysqemiwusd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiwusd.exe"46⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaklyo.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaklyo.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvbnbd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvbnbd.exe"48⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkynap.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkynap.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:876 -
C:\Users\Admin\AppData\Local\Temp\Sysqempzddg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempzddg.exe"50⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcbjlr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcbjlr.exe"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\Sysqemmtobe.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmtobe.exe"52⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\Sysqembqwbq.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembqwbq.exe"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyndbj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyndbj.exe"54⤵
- Executes dropped EXE
PID:328 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnhawt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnhawt.exe"55⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Sysqemycbga.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemycbga.exe"56⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnwpbk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnwpbk.exe"57⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkattr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkattr.exe"58⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\Sysqemziebp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemziebp.exe"59⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtsyjv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtsyjv.exe"60⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjirrc.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjirrc.exe"61⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\Sysqembprhh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembprhh.exe"62⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqmrgt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqmrgt.exe"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\Sysqemaegmy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemaegmy.exe"64⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\Sysqemkgwwt.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkgwwt.exe"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\Sysqemujura.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemujura.exe"66⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmrwef.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmrwef.exe"67⤵
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\Sysqemrhbrb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrhbrb.exe"68⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\Sysqemjgdey.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjgdey.exe"69⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\Sysqemotxmr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemotxmr.exe"70⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdqfme.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdqfme.exe"71⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgawcw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgawcw.exe"72⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\Sysqemvxwki.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvxwki.exe"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\Sysqemagnfz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemagnfz.exe"74⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\Sysqemsraxz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemsraxz.exe"75⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\Sysqemwlixy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwlixy.exe"76⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\Sysqempskkd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempskkd.exe"77⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\Sysqemgzkzh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemgzkzh.exe"78⤵
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\Sysqemwwszu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemwwszu.exe"79⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\Sysqemqqxpm.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqqxpm.exe"80⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfvxpy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfvxpy.exe"81⤵
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\Sysqemseysv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemseysv.exe"82⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\Sysqemfkqnj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfkqnj.exe"83⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\Sysqemblaaf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemblaaf.exe"84⤵
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\Sysqemuscnk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemuscnk.exe"85⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\Sysqemlknqs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemlknqs.exe"86⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\Sysqemekpdx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemekpdx.exe"87⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\Sysqemdcqnr.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdcqnr.exe"88⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\Sysqemtwnia.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemtwnia.exe"89⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\Sysqemxmrvw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemxmrvw.exe"90⤵
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\Sysqemqtuit.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemqtuit.exe"91⤵
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\Sysqempbrtb.exe"C:\Users\Admin\AppData\Local\Temp\Sysqempbrtb.exe"92⤵
- System Location Discovery: System Language Discovery
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\Sysqemhatyy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemhatyy.exe"93⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\Sysqemzptvd.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemzptvd.exe"94⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrdran.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrdran.exe"95⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\Sysqemigglp.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemigglp.exe"96⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvxbgy.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvxbgy.exe"97⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvbnlu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvbnlu.exe"98⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\Sysqemnplqf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnplqf.exe"99⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\Sysqemcbjwj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemcbjwj.exe"100⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrugjs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrugjs.exe"101⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Sysqemmplyk.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemmplyk.exe"102⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\Sysqemeayrs.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemeayrs.exe"103⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\Sysqemvdmbu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemvdmbu.exe"104⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkegoj.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkegoj.exe"105⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnkmrz.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnkmrz.exe"106⤵
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfvzrg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfvzrg.exe"107⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\Sysqemecxbg.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemecxbg.exe"108⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\Sysqemrtsep.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemrtsep.exe"109⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Sysqemofwjh.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemofwjh.exe"110⤵
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\Sysqemdghww.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemdghww.exe"111⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\Sysqemiizch.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemiizch.exe"112⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\Sysqemasmug.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemasmug.exe"113⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjzmrl.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjzmrl.exe"114⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\Sysqembncxw.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembncxw.exe"115⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\Sysqemjvypi.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemjvypi.exe"116⤵
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\Sysqembcacn.exe"C:\Users\Admin\AppData\Local\Temp\Sysqembcacn.exe"117⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\Sysqemyhvut.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemyhvut.exe"118⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnaspv.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnaspv.exe"119⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\Sysqemnttzx.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemnttzx.exe"120⤵
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\Sysqemfavnu.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemfavnu.exe"121⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\Sysqemkumaf.exe"C:\Users\Admin\AppData\Local\Temp\Sysqemkumaf.exe"122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-