Overview
overview
10Static
static
10Malware.2024.12.25.7z
windows7-x64
1Malware.2024.12.25.7z
windows10-2004-x64
12024-12-25...19.exe
windows7-x64
2024-12-25...19.exe
windows10-2004-x64
2024-12-25...8a.pdf
windows7-x64
32024-12-25...8a.pdf
windows10-2004-x64
32024-12-25...0d.pdf
windows7-x64
32024-12-25...0d.pdf
windows10-2004-x64
32024-12-25...96.exe
windows7-x64
72024-12-25...96.exe
windows10-2004-x64
72024-12-25...61.exe
windows7-x64
12024-12-25...61.exe
windows10-2004-x64
12024-12-25...03.pdf
windows7-x64
32024-12-25...03.pdf
windows10-2004-x64
32024-12-25...62.exe
windows7-x64
102024-12-25...62.exe
windows10-2004-x64
102024-12-25...25.exe
windows7-x64
12024-12-25...25.exe
windows10-2004-x64
12024-12-25...6b.exe
windows7-x64
102024-12-25...6b.exe
windows10-2004-x64
102024-12-25...ec.exe
windows7-x64
12024-12-25...ec.exe
windows10-2004-x64
32024-12-25...cc.exe
windows7-x64
12024-12-25...cc.exe
windows10-2004-x64
32024-12-25...3a.exe
windows7-x64
102024-12-25...3a.exe
windows10-2004-x64
102024-12-25...66.exe
windows7-x64
32024-12-25...66.exe
windows10-2004-x64
32024-12-25...97.exe
windows7-x64
102024-12-25...97.exe
windows10-2004-x64
102024-12-25...1d.pdf
windows7-x64
32024-12-25...1d.pdf
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-01-2025 17:40
Static task
static1
Behavioral task
behavioral1
Sample
Malware.2024.12.25.7z
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Malware.2024.12.25.7z
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
2024-12-25/unknown-df6ecbdc8f043bbe3a4018a4fd3734c474761e1c7505fb0917df4fb808087e19.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
2024-12-25/unknown-df6ecbdc8f043bbe3a4018a4fd3734c474761e1c7505fb0917df4fb808087e19.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
2024-12-25/unknown-e0b170a4440b174bb3d6bd6c5abb8833cd7eae6eadc74d4176c8bb8a4b38ca8a.pdf
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
2024-12-25/unknown-e0b170a4440b174bb3d6bd6c5abb8833cd7eae6eadc74d4176c8bb8a4b38ca8a.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
2024-12-25/unknown-e1e08ee8a9d8d42268b3537c74ec3f099dc05a1cf1fd91d3c1e54084957c570d.pdf
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
2024-12-25/unknown-e1e08ee8a9d8d42268b3537c74ec3f099dc05a1cf1fd91d3c1e54084957c570d.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
2024-12-25/unknown-e1ffabc651f471b8d4141420d8e171310bc91a400462062ca96f6ac202a0a896.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
2024-12-25/unknown-e1ffabc651f471b8d4141420d8e171310bc91a400462062ca96f6ac202a0a896.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
2024-12-25/unknown-e2c57dce7eb054b47a8f96e8be747b91ad1fce0bc0de597c9d41fce2623d9361.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
2024-12-25/unknown-e2c57dce7eb054b47a8f96e8be747b91ad1fce0bc0de597c9d41fce2623d9361.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
2024-12-25/unknown-e3dcabde5987c263aef8243cba944e442658bfcf1ad19ebbd7c78b89be0ab203.pdf
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
2024-12-25/unknown-e3dcabde5987c263aef8243cba944e442658bfcf1ad19ebbd7c78b89be0ab203.pdf
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
2024-12-25/unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
2024-12-25/unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
2024-12-25/unknown-e4c4e59c66b650e0d696b6ec194d61637a688293cd5e23be9c630f7748c74125.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
2024-12-25/unknown-e4c4e59c66b650e0d696b6ec194d61637a688293cd5e23be9c630f7748c74125.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral19
Sample
2024-12-25/unknown-e668037208d053a72e197f6b156805776bf8bd8823c0b850d7c6302e22eb726b.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
2024-12-25/unknown-e668037208d053a72e197f6b156805776bf8bd8823c0b850d7c6302e22eb726b.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
2024-12-25/unknown-e8c053991c3618b30dde741da46435044fd5ae153f78c53f526f0de329fd43ec.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
2024-12-25/unknown-e8c053991c3618b30dde741da46435044fd5ae153f78c53f526f0de329fd43ec.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral23
Sample
2024-12-25/unknown-ea34039dbd854222e03748c548a5210e552bbfaa600ae0f24dfb55397a3136cc.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
2024-12-25/unknown-ea34039dbd854222e03748c548a5210e552bbfaa600ae0f24dfb55397a3136cc.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral25
Sample
2024-12-25/unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
2024-12-25/unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
2024-12-25/unknown-ec6a36915e9f9d331e80881a2336503416fc441a599fec36e2601e6f27229b66.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
2024-12-25/unknown-ec6a36915e9f9d331e80881a2336503416fc441a599fec36e2601e6f27229b66.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral29
Sample
2024-12-25/unknown-ed34607d35c3e5e97ce126000df93ecdcc854d9e7bde1ee42e08b243df314697.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
2024-12-25/unknown-ed34607d35c3e5e97ce126000df93ecdcc854d9e7bde1ee42e08b243df314697.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral31
Sample
2024-12-25/unknown-ed52a60eea60738501367935811e2f8a9ffe366ff9656cca8d4d9c78555d581d.pdf
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
2024-12-25/unknown-ed52a60eea60738501367935811e2f8a9ffe366ff9656cca8d4d9c78555d581d.pdf
Resource
win10v2004-20250129-en
General
-
Target
2024-12-25/unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe
-
Size
455KB
-
MD5
fde5e265ba6cdbb0270cbaddc3993a10
-
SHA1
f4d328bb4f667389b248f6e2509c04e153e2e87e
-
SHA256
ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a
-
SHA512
055f22c437be2c63ae28d3bd567ca4801d2e537e9c827627d0f5003c3b21c8546abcd6e0e4b065914e5b5acc869e91e5006f2e7a70c948b40fc97221f52bd814
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral25/memory/2820-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2852-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2964-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2724-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2720-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2640-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2440-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/536-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1040-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2028-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2428-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2788-117-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/1444-134-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral25/memory/2972-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2220-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1584-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1384-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2920-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1424-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/932-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1716-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/916-271-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral25/memory/2372-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2372-281-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/1552-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2696-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2776-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2724-336-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral25/memory/484-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2028-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2292-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2868-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2508-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/2228-442-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/3024-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2480-462-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/1836-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1092-492-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral25/memory/2108-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2692-519-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/2692-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2380-526-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral25/memory/2688-532-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral25/memory/2696-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/2216-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1596-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/2000-883-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/2788-921-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral25/memory/1716-1043-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral25/memory/908-1054-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2852 jvpvd.exe 2724 xxllxxf.exe 2964 xxlrffx.exe 2720 9rlrflx.exe 2640 vpjvd.exe 2440 1xxrffr.exe 536 nnntnt.exe 1040 vdjvj.exe 2028 lfxfxff.exe 2224 3hbhnt.exe 2428 xrlrxxf.exe 2788 nhbbhb.exe 2516 rxlrxfr.exe 1444 rrlrfrr.exe 2972 3hbhbh.exe 2220 rllxlrl.exe 1584 1nbhnt.exe 1932 3pjpv.exe 1384 fxlrxfl.exe 2312 ntnhhh.exe 2920 pjvdj.exe 2276 xrflxfx.exe 1424 9tnthn.exe 1096 bbnnnn.exe 2244 jdvdp.exe 932 lxxlfrl.exe 2376 bhbhnb.exe 1716 1dvdd.exe 1724 btntbb.exe 916 ppppv.exe 2372 rfxrxxr.exe 1552 7nbntt.exe 3012 jpppv.exe 1988 rffrflr.exe 2724 nbbnnn.exe 2696 pjjvd.exe 2776 fxrxflx.exe 2624 3nbnnb.exe 1656 jdvvd.exe 2180 rrlrxxl.exe 536 bnbnth.exe 484 nbtbhb.exe 1040 7dpvj.exe 2028 xrllllx.exe 2292 9ffrxfl.exe 2868 hbhntb.exe 1980 5thnbb.exe 2508 1dppp.exe 2864 fffxrrx.exe 1624 bthhtt.exe 2228 3vjpv.exe 2976 pdvdp.exe 1960 xrllrrf.exe 1700 nhbbnt.exe 1940 dvjpd.exe 3024 jvjpv.exe 2480 ffxlxxl.exe 2472 frfllxl.exe 1836 btbbhh.exe 284 vddpd.exe 1092 fxlrxxl.exe 296 fxrrffl.exe 2260 hbnnbb.exe 2108 9bhbbb.exe -
resource yara_rule behavioral25/memory/2820-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2852-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2964-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2724-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2720-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2640-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2640-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2440-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/536-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1040-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2028-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2428-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2788-117-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral25/memory/2972-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2220-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1584-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1384-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2920-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1424-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/932-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/932-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1716-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2372-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1552-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/3012-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2696-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2776-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/484-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2028-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2292-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2868-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1980-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2508-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1700-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/3024-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2472-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1836-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1836-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1092-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2108-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2692-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2688-532-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral25/memory/2216-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/812-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2292-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2040-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2432-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1940-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1596-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/576-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2584-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2012-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1308-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2788-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2444-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2472-986-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1596-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/2760-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral25/memory/1988-1092-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2852 2820 unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe 30 PID 2820 wrote to memory of 2852 2820 unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe 30 PID 2820 wrote to memory of 2852 2820 unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe 30 PID 2820 wrote to memory of 2852 2820 unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe 30 PID 2852 wrote to memory of 2724 2852 jvpvd.exe 31 PID 2852 wrote to memory of 2724 2852 jvpvd.exe 31 PID 2852 wrote to memory of 2724 2852 jvpvd.exe 31 PID 2852 wrote to memory of 2724 2852 jvpvd.exe 31 PID 2724 wrote to memory of 2964 2724 xxllxxf.exe 32 PID 2724 wrote to memory of 2964 2724 xxllxxf.exe 32 PID 2724 wrote to memory of 2964 2724 xxllxxf.exe 32 PID 2724 wrote to memory of 2964 2724 xxllxxf.exe 32 PID 2964 wrote to memory of 2720 2964 xxlrffx.exe 33 PID 2964 wrote to memory of 2720 2964 xxlrffx.exe 33 PID 2964 wrote to memory of 2720 2964 xxlrffx.exe 33 PID 2964 wrote to memory of 2720 2964 xxlrffx.exe 33 PID 2720 wrote to memory of 2640 2720 9rlrflx.exe 34 PID 2720 wrote to memory of 2640 2720 9rlrflx.exe 34 PID 2720 wrote to memory of 2640 2720 9rlrflx.exe 34 PID 2720 wrote to memory of 2640 2720 9rlrflx.exe 34 PID 2640 wrote to memory of 2440 2640 vpjvd.exe 35 PID 2640 wrote to memory of 2440 2640 vpjvd.exe 35 PID 2640 wrote to memory of 2440 2640 vpjvd.exe 35 PID 2640 wrote to memory of 2440 2640 vpjvd.exe 35 PID 2440 wrote to memory of 536 2440 1xxrffr.exe 36 PID 2440 wrote to memory of 536 2440 1xxrffr.exe 36 PID 2440 wrote to memory of 536 2440 1xxrffr.exe 36 PID 2440 wrote to memory of 536 2440 1xxrffr.exe 36 PID 536 wrote to memory of 1040 536 nnntnt.exe 37 PID 536 wrote to memory of 1040 536 nnntnt.exe 37 PID 536 wrote to memory of 1040 536 nnntnt.exe 37 PID 536 wrote to memory of 1040 536 nnntnt.exe 37 PID 1040 wrote to memory of 2028 1040 vdjvj.exe 38 PID 1040 wrote to memory of 2028 1040 vdjvj.exe 38 PID 1040 wrote to memory of 2028 1040 vdjvj.exe 38 PID 1040 wrote to memory of 2028 1040 vdjvj.exe 38 PID 2028 wrote to memory of 2224 2028 lfxfxff.exe 39 PID 2028 wrote to memory of 2224 2028 lfxfxff.exe 39 PID 2028 wrote to memory of 2224 2028 lfxfxff.exe 39 PID 2028 wrote to memory of 2224 2028 lfxfxff.exe 39 PID 2224 wrote to memory of 2428 2224 3hbhnt.exe 40 PID 2224 wrote to memory of 2428 2224 3hbhnt.exe 40 PID 2224 wrote to memory of 2428 2224 3hbhnt.exe 40 PID 2224 wrote to memory of 2428 2224 3hbhnt.exe 40 PID 2428 wrote to memory of 2788 2428 xrlrxxf.exe 41 PID 2428 wrote to memory of 2788 2428 xrlrxxf.exe 41 PID 2428 wrote to memory of 2788 2428 xrlrxxf.exe 41 PID 2428 wrote to memory of 2788 2428 xrlrxxf.exe 41 PID 2788 wrote to memory of 2516 2788 nhbbhb.exe 42 PID 2788 wrote to memory of 2516 2788 nhbbhb.exe 42 PID 2788 wrote to memory of 2516 2788 nhbbhb.exe 42 PID 2788 wrote to memory of 2516 2788 nhbbhb.exe 42 PID 2516 wrote to memory of 1444 2516 rxlrxfr.exe 43 PID 2516 wrote to memory of 1444 2516 rxlrxfr.exe 43 PID 2516 wrote to memory of 1444 2516 rxlrxfr.exe 43 PID 2516 wrote to memory of 1444 2516 rxlrxfr.exe 43 PID 1444 wrote to memory of 2972 1444 rrlrfrr.exe 44 PID 1444 wrote to memory of 2972 1444 rrlrfrr.exe 44 PID 1444 wrote to memory of 2972 1444 rrlrfrr.exe 44 PID 1444 wrote to memory of 2972 1444 rrlrfrr.exe 44 PID 2972 wrote to memory of 2220 2972 3hbhbh.exe 45 PID 2972 wrote to memory of 2220 2972 3hbhbh.exe 45 PID 2972 wrote to memory of 2220 2972 3hbhbh.exe 45 PID 2972 wrote to memory of 2220 2972 3hbhbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jvpvd.exec:\jvpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xxllxxf.exec:\xxllxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xxlrffx.exec:\xxlrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\9rlrflx.exec:\9rlrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vpjvd.exec:\vpjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1xxrffr.exec:\1xxrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nnntnt.exec:\nnntnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\vdjvj.exec:\vdjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\lfxfxff.exec:\lfxfxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\3hbhnt.exec:\3hbhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\nhbbhb.exec:\nhbbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rxlrxfr.exec:\rxlrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rrlrfrr.exec:\rrlrfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\3hbhbh.exec:\3hbhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rllxlrl.exec:\rllxlrl.exe17⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1nbhnt.exec:\1nbhnt.exe18⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3pjpv.exec:\3pjpv.exe19⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe20⤵
- Executes dropped EXE
PID:1384 -
\??\c:\ntnhhh.exec:\ntnhhh.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pjvdj.exec:\pjvdj.exe22⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrflxfx.exec:\xrflxfx.exe23⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9tnthn.exec:\9tnthn.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bbnnnn.exec:\bbnnnn.exe25⤵
- Executes dropped EXE
PID:1096 -
\??\c:\jdvdp.exec:\jdvdp.exe26⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lxxlfrl.exec:\lxxlfrl.exe27⤵
- Executes dropped EXE
PID:932 -
\??\c:\bhbhnb.exec:\bhbhnb.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1dvdd.exec:\1dvdd.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\btntbb.exec:\btntbb.exe30⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppppv.exec:\ppppv.exe31⤵
- Executes dropped EXE
PID:916 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\7nbntt.exec:\7nbntt.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jpppv.exec:\jpppv.exe34⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rffrflr.exec:\rffrflr.exe35⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nbbnnn.exec:\nbbnnn.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pjjvd.exec:\pjjvd.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxrxflx.exec:\fxrxflx.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3nbnnb.exec:\3nbnnb.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jdvvd.exec:\jdvvd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe41⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bnbnth.exec:\bnbnth.exe42⤵
- Executes dropped EXE
PID:536 -
\??\c:\nbtbhb.exec:\nbtbhb.exe43⤵
- Executes dropped EXE
PID:484 -
\??\c:\7dpvj.exec:\7dpvj.exe44⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xrllllx.exec:\xrllllx.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9ffrxfl.exec:\9ffrxfl.exe46⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hbhntb.exec:\hbhntb.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5thnbb.exec:\5thnbb.exe48⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1dppp.exec:\1dppp.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fffxrrx.exec:\fffxrrx.exe50⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bthhtt.exec:\bthhtt.exe51⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3vjpv.exec:\3vjpv.exe52⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pdvdp.exec:\pdvdp.exe53⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xrllrrf.exec:\xrllrrf.exe54⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhbbnt.exec:\nhbbnt.exe55⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvjpd.exec:\dvjpd.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jvjpv.exec:\jvjpv.exe57⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe58⤵
- Executes dropped EXE
PID:2480 -
\??\c:\frfllxl.exec:\frfllxl.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\btbbhh.exec:\btbbhh.exe60⤵
- Executes dropped EXE
PID:1836 -
\??\c:\vddpd.exec:\vddpd.exe61⤵
- Executes dropped EXE
PID:284 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe62⤵
- Executes dropped EXE
PID:1092 -
\??\c:\fxrrffl.exec:\fxrrffl.exe63⤵
- Executes dropped EXE
PID:296 -
\??\c:\hbnnbb.exec:\hbnnbb.exe64⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9bhbbb.exec:\9bhbbb.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jpdjp.exec:\jpdjp.exe66⤵PID:2692
-
\??\c:\3xxxrlx.exec:\3xxxrlx.exe67⤵PID:2380
-
\??\c:\nhnntt.exec:\nhnntt.exe68⤵PID:2688
-
\??\c:\bnbbhb.exec:\bnbbhb.exe69⤵PID:1448
-
\??\c:\7dvjv.exec:\7dvjv.exe70⤵PID:1636
-
\??\c:\3djdp.exec:\3djdp.exe71⤵PID:1664
-
\??\c:\7rrxflx.exec:\7rrxflx.exe72⤵PID:2820
-
\??\c:\bnhhnn.exec:\bnhhnn.exe73⤵PID:2760
-
\??\c:\nnbbnn.exec:\nnbbnn.exe74⤵PID:2804
-
\??\c:\7pddv.exec:\7pddv.exe75⤵PID:1224
-
\??\c:\dpvvd.exec:\dpvvd.exe76⤵PID:2964
-
\??\c:\1xrxfrx.exec:\1xrxfrx.exe77⤵PID:2696
-
\??\c:\tntnbn.exec:\tntnbn.exe78⤵PID:2776
-
\??\c:\tnnnhb.exec:\tnnnhb.exe79⤵PID:2216
-
\??\c:\dvjvj.exec:\dvjvj.exe80⤵PID:1656
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe81⤵PID:2440
-
\??\c:\fxllxxl.exec:\fxllxxl.exe82⤵PID:1004
-
\??\c:\3hbhnn.exec:\3hbhnn.exe83⤵PID:812
-
\??\c:\7bttbt.exec:\7bttbt.exe84⤵PID:600
-
\??\c:\ppjpd.exec:\ppjpd.exe85⤵PID:880
-
\??\c:\llxfrxf.exec:\llxfrxf.exe86⤵PID:2292
-
\??\c:\hnhbbt.exec:\hnhbbt.exe87⤵PID:2040
-
\??\c:\hbttbb.exec:\hbttbb.exe88⤵PID:2136
-
\??\c:\jdpvj.exec:\jdpvj.exe89⤵PID:1884
-
\??\c:\jvddj.exec:\jvddj.exe90⤵PID:2876
-
\??\c:\lxllrrx.exec:\lxllrrx.exe91⤵PID:2860
-
\??\c:\hbtbbb.exec:\hbtbbb.exe92⤵PID:2152
-
\??\c:\1nnnhh.exec:\1nnnhh.exe93⤵PID:1820
-
\??\c:\dpddp.exec:\dpddp.exe94⤵PID:2588
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe95⤵PID:1616
-
\??\c:\rrrlxfl.exec:\rrrlxfl.exe96⤵PID:2432
-
\??\c:\nttbnn.exec:\nttbnn.exe97⤵PID:1940
-
\??\c:\jdpvd.exec:\jdpvd.exe98⤵PID:2500
-
\??\c:\vpdvd.exec:\vpdvd.exe99⤵PID:2268
-
\??\c:\xrflxlx.exec:\xrflxlx.exe100⤵PID:1072
-
\??\c:\hbthnn.exec:\hbthnn.exe101⤵PID:1596
-
\??\c:\hbttbh.exec:\hbttbh.exe102⤵PID:1532
-
\??\c:\dpvvj.exec:\dpvvj.exe103⤵PID:972
-
\??\c:\pjppp.exec:\pjppp.exe104⤵PID:1456
-
\??\c:\rxlxffr.exec:\rxlxffr.exe105⤵PID:576
-
\??\c:\hbnhnt.exec:\hbnhnt.exe106⤵PID:2584
-
\??\c:\tnttbb.exec:\tnttbb.exe107⤵PID:2544
-
\??\c:\pdppd.exec:\pdppd.exe108⤵PID:1628
-
\??\c:\dvvdj.exec:\dvvdj.exe109⤵PID:2012
-
\??\c:\lfrxflx.exec:\lfrxflx.exe110⤵PID:2560
-
\??\c:\hbhthh.exec:\hbhthh.exe111⤵PID:1668
-
\??\c:\hbttnn.exec:\hbttnn.exe112⤵PID:2840
-
\??\c:\dvpdp.exec:\dvpdp.exe113⤵PID:1664
-
\??\c:\rlflrxl.exec:\rlflrxl.exe114⤵PID:2748
-
\??\c:\tbtbtt.exec:\tbtbtt.exe115⤵PID:2732
-
\??\c:\hbhbnn.exec:\hbhbnn.exe116⤵PID:2932
-
\??\c:\djjjp.exec:\djjjp.exe117⤵PID:2664
-
\??\c:\lfrffxx.exec:\lfrffxx.exe118⤵PID:2744
-
\??\c:\5hbnbb.exec:\5hbnbb.exe119⤵PID:2720
-
\??\c:\1hntbh.exec:\1hntbh.exe120⤵PID:2640
-
\??\c:\dvdvd.exec:\dvdvd.exe121⤵PID:1524
-
\??\c:\xlxxllx.exec:\xlxxllx.exe122⤵PID:332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-