41f21cc601ed52586434e04d1c7d11dd5457eeb41492f248450c4b24e70c5b64

Sharing

Copy URL Twitter E-mail

General

Target
exodus.zip
Size 64.1MB
Sample260801-ampwhatxbz
SHA256 41f21cc601ed52586434e04d1c7d11dd5457eeb41492f248450c4b24e70c5b64
MD5 87fb18528c17767c0cf0d65b8005ffee
SHA1 6bfda594989cc4d7d64ba3a15b1ae5cc45be345a
SHA512 034046992fbe7f1f7531cc90ec216b0326f927d88a574395855fe2d1b5b45796b63ebe2ca79112e62fd0d47f8125d3dd13e989c87cfaac35941cf0a286a0ee63
SSDEEP 1572864:Ylan+/hgwa/uEwR5ZVK16//gpnGjI3tSCA9GLiiUnwtIV9hvjlbE2:cz/htR/VKuIRGMdsGLQnKInhdE2
TLSH
T1B6E733B8F6043807F91FF2BEC30F95665FE490C95D1A8D0DC881FA56309F6D6AB2464A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/linux-x64/native/libHarfBuzzSharp.so
- Size 2.0MB
- SHA256 95fad4b704332ff1a9d7e137ab5d1849b8711099be61fd5d264afe0562b306a2
- MD5 ded676d3023bb7f08d7de7e7edaee68e
- SHA1 e4ef87b4faaafb0176b856a0524ecfd564feb340
- SHA512 0199620e34330107a4660063eba07f72a76127b51ee43a1131819d9a8e54d0f6a1e92f4f840291ef8a62fc6113d89e571b76e9f62f744ae65cbb5412b70fdf69
- SSDEEP 24576:XouxmpcDanVDn8kUA2VLElER5w2iraWAf1p3F86gn+FF7nxBhI2X:7xmpcDIDnnJumA1p16iBnxBy4
- TLSH
  T1F1A56D82F1B724BDCE1ACC34921E9433E57A74061112AD7BB6C4EB306F15E619F9EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/linux-x64/native/libSkiaSharp.so
- Size 8.8MB
- SHA256 a009dee86e037173654eb19b91365e7d545814b7f632240049596c04342fcf02
- MD5 2182bb47766d57adb5706c9c1f140339
- SHA1 0697b403c89c00bc27977dbcc2080aacb13ea7b1
- SHA512 72a1ef05e691f6e82e42917629c671ba71215bce0c0c188b7f87e6cad0cf2956108c95a659c2d7f138d29601c4e3d611d64108dce1c2a7421314e53091046b1c
- SSDEEP 98304:y9u0A7d0d5gh8pQKQzvVqA0PjVctyj5kdJF98IYdJr:y95iYgMCDor
- TLSH
  T1AD965B42F5B324BDC96ACC34875EA437F634344582256E3736C8EA312F66A209F5FB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/osx/native/libAvaloniaNative.dylib
- Size 1.3MB
- SHA256 cc39dfea7b7360479f82ded049d87173b5a64e72193e4fd5847def419417b0bd
- MD5 4d6d1f55ef25c4a1b0aff1fd6133da82
- SHA1 505790fb8ef61b85aa10c56e3e28199a424591cc
- SHA512 6dccc26a4274dd145b9b5c250226e6740a8bf77fc8eb2811567a992533371527fe8ab6c9382c9d09693a50e246464d196f514bd9b034153476ff879e30960184
- SSDEEP 12288:5CfMRSgED+IL/V15pqUKypD16q7J1TWtOlnwbN1uO:sERS5DN/V15pqUKNqlRJnwR1uO
- TLSH
  T114552B22E7486853CE9962B84F6E0329F336FD419B34D3EB2990B1796FF21954F11B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/osx/native/libHarfBuzzSharp.dylib
- Size 2.6MB
- SHA256 ca20dd85d0204a7bdaa2b6eb4f6bd17486d8c6e860437052de29a08538de085e
- MD5 4c390260c3d123d2e6a06962d5205309
- SHA1 65ab0d43b255f54c3ebe0733697b8a65c45f0979
- SHA512 4584f554cd4ee2e23a596245a56b12b599ba82a00f01c519b1418651a43a30d03bcef5ce7a156bf23da4366361c7050af0edc571df5ad51cf18718b93d643d5b
- SSDEEP 49152:ENZfLMHDxO/N0a0/1fsRcUnV5qMGgiUqBIIdhY4/HXHLgxx4cl1D7sibXP+IgMyG:iCxO/Cas05qMtirBIIzY4/HXHLgxx4cT
- TLSH
  T172C5BF07A56D4412E5C1F13D4B868B723216F4A26724F5AD3362B26CEF54DF2A62E333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/osx/native/libSkiaSharp.dylib
- Size 14.4MB
- SHA256 2eeb547217bd3f44d30867cf2a6f65455d429c94951cb8faca41c894092aa198
- MD5 7c25f4b710cbaae431d61053663f3211
- SHA1 858a74c4fb9286ccfc648cd58261b32bc5abc5c1
- SHA512 4b2f634b1b984f3d188257cf8f6c4ef0ac9015d010b93d87dbdbe33c3258274836317a960537959296e3d4ef4b75f2df7304955e0f38a26810567c9d49b2095b
- SSDEEP 98304:faHWCseZBgVuEZy5WWAZNv2fzTeHfSA6bG/IRxLju7zjAyAp20NyAUoLAkwwhBYk:SfCFoTIfHIG7zjAyN0NyACkONhuRCK
- TLSH
  T153E6CF05A13DA42CE0C6E07C4B5B4AB27525FCA44234E99B35A6F378EEA1DE0563D733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-arm64/native/av_libglesv2.dll
- Size 4.0MB
- SHA256 da25c83dc53e69838e8ca21a1526beabe086cb3fcb348fd441e21ed8f917898b
- MD5 470a5ccdce0da2b142f8332e4d431507
- SHA1 296e0b8e93c5374080304e353797f321e1abb6e5
- SHA512 54a8d58ce331a970e84689db582ed20abb702216659fe21eda917d81b1b8852d1879f4d61ec6433257ef6cc47c35ccec0785f0b6fb097aa206586a2d2f86d5e4
- SSDEEP 49152:b6r5zk6oode++IUMZc/rH51CrOtTG2tSLfjN3:b6ri6ooduIU
- TLSH
  T1A5164B04AB4CAC92E5C2F63CDD674F98212BED709021869FB55F414CEEA5BC2E2E7171
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6 behavioral7
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-arm64/native/libHarfBuzzSharp.dll
- Size 1.7MB
- SHA256 12ade447cbc51cf31735a609c78906614eb68141a97a3b1745c32db537ace15f
- MD5 7f2fab055aa2b32d8993c43e9adf3482
- SHA1 0eb3df4a6c1a8b0d2118ac177cdfbf9854f4d1ce
- SHA512 e5751762c02cc6bb37b198ce59c25e97e4dd515b37fea8ba79bb38c85895b5d869e87be507813d3d3f41d38d870adcbc464e9696fd4da4df07c4ee7728366929
- SSDEEP 24576:hKn2zaVVdDstuR6xriVjl87Kc80WfKdUt4t5Q33M00ke0Xm4S361g:FKVdguRTl8380WfKdUt4t57em4E61g
- TLSH
  T114858E40DA0DE882DBC2EB3DEC958F603137A9B0C5645CDEA146451CFCD1FD6C5E8AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8 behavioral9
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-arm64/native/libSkiaSharp.dll
- Size 7.6MB
- SHA256 58d6071685942c646f4bb110508ebe72c80fc360ed8d8e9afcf1035d99f36bdc
- MD5 4415da0cdca32b651f1422df19ae26eb
- SHA1 c84ae767fcce5ed09f935be0108d367978c5f272
- SHA512 3bf9b3bfad8ffebc0c1046cda8247d1475205c5aff9dc1a9ac9edaaedfc65340b548eeeba36e15d9c6e5aeda701c35e2116ecbdc6b6fe0e9ac9f1accea97619a
- SSDEEP 49152:GVkH9NFrcZtJoNRovXDNzpOxvADks8ihRkgAR7x+JeHXWVY/aOqdNZH5zuTdQh8y:GVkH9HrcZt2zovGxs3W9N3KdPH5z2dxy
- TLSH
  T1CC867D80196DE869E6C2E8FC6E674BD5361AA880CD35868F7036421DDC72BD1DDF72B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral11
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-x64/native/av_libglesv2.dll
- Size 4.2MB
- SHA256 85b3aee47c0e0eaf3a5ea5c75ba8131387a12639b6a0ef280c28531fb77695ae
- MD5 73d2fb4c35d323813a86e3bf5c85c345
- SHA1 81f751a34e0c25bdea93902a19a94a49ce1495df
- SHA512 e81677cc9b99ff3d54f67000a60489603e01a896f90c4ef0c883b82e2fdb7b90d2899c078958b3f060a20373b99cb6c4deb7f64cc4c7e0ba2a708209f4684ca4
- SSDEEP 49152:I1qISHMa72SRXc0kFg760EvAy4U5hDempTKkslMx0YEQtHhcEIy/rcgcrq8T/2tj:vbMNgMdth1t
- TLSH
  T175167D1AA7B400BAC8BBD139C9175A0BE3F1FC4641B0D70F21B9679A5FA7770626B314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-x64/native/libHarfBuzzSharp.dll
- Size 1.5MB
- SHA256 f13d0dae00a598620a436fd991219a2e0fe6157eac90faa025d4d76845cd996c
- MD5 f121a2afb03f1b8ca1784e544464a346
- SHA1 9346297a66989dbe88bc459ee8bf936e7acb3d24
- SHA512 ebbb8c2d7d97521286af0f6b02195890b193e660a28e6b1e5112ed9f1fcc081c66587a7a82c8a9468d1a55d477880487d1b3edf1deb2ea285e17d70fbd56c6f1
- SSDEEP 49152:PBy4VCDmxqVx/1hlcsHI7woyGYdwENWa6m4ys:aQkPNWMs
- TLSH
  T1A575AD4AE26A11E9D9ABD074C656840BD3B274420F14DFFF26E08695EF23EF5167E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14 behavioral15
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-x64/native/libSkiaSharp.dll
- Size 9.0MB
- SHA256 3268b1b2de384d00ed77431fe8a1f053d2c69eee25d07dcfc352491570d63b52
- MD5 6b5e769126b4d38601df662bd08e7163
- SHA1 c799c7c3b8209468bb4047b4783f691537d717e9
- SHA512 168c4a5981aa6513bacaa459bac26a3033315a677547eaa01d901b75e46baef91c6fd63185629a3a218a643fcacfa86ae36b8a5313e11f3bcd311bf4b0c61c6f
- SSDEEP 98304:cjRZLtqNj1xK+Re5fNMVlgpANGuRsUCn+ovoZOXe:oZL8NabV0fGkNee
- TLSH
  T10C964A13B66B64ACC04AC474834B99665E2038CB0B35BCEF52C5A1393FB9BF42F79615
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-x86/native/av_libglesv2.dll
- Size 3.2MB
- SHA256 b5f682067664bf44f92418d57097876b9ffb656c4e1e496d7f056eb3f910e5d8
- MD5 c2b853790468c88c21ec7b6e21959313
- SHA1 54bca8b373eba2196cf47b497734ebe3aaa0d37a
- SHA512 cb885aaaba3a6bb4770d86d0ff6cc6bf499fae945fbf45680bf3682a20bcb4af4b9ecd4e31172cfa090b630d8e749a120d31fd0436e2ffd50efe55146f6744ab
- SSDEEP 49152:9nm84lPJ9YOUCXg4/OuBuitPB5W4pifrmvzrjBTSBYWxXzfjhCAZmfYM:9nhEJSOfQ4/LB9b5WxB
- TLSH
  T18CE59E1278E14436DA5E0270498ABF49E7FCA9112171DB9726BC981EBFF1AC36333356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18 behavioral19
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-x86/native/libHarfBuzzSharp.dll
- Size 1.3MB
- SHA256 797b2472ac9cb2457a1cf3db0970fb88f4531c8217fff4b7705decf9a85a19a5
- MD5 1426c6d3cecd7e504db7121caf7be3c5
- SHA1 dfa43f1682b5f988d0f26c38dab3ef38d2cb94bc
- SHA512 b90aa23f9c6ef9d942469f2fd36bab1f700dfd3d867132f0a7c43d42a3cd84957e3564e27db1f93745518b53f9046144a61eecf912c5b272f56ad9374ba2bba9
- SSDEEP 24576:3psAU7vw8DMj0Cl5szcGX5sE0qtSTxleVbXXzskEXbRhrOa:xeI8DEHAcGXCxsBXX/ubvrOa
- TLSH
  T130558D10E413C4A5ED8500F1EABDFA9E25ACDB35032C5CE3A9C0A969FE615F32E35647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20 behavioral21
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/runtimes/win-x86/native/libSkiaSharp.dll
- Size 7.6MB
- SHA256 29feaf6f6aa8eb88f0225c14dc1d9b0a9f45ab9fb6bef3ca2ab54ea8df658fd7
- MD5 584a3fe755baaf8b09ca8d13a706478d
- SHA1 e60d2a6e5db17d32f7eb06a0b75d8e89f792d887
- SHA512 57a2c38d8128c7a7d7f3012eebeb63b52bf763f168b3b5aa5c057af382bd25ab7d29b92a3df2e03e6191fb60c1ae0bd13de80527d855880f82096804bb14d286
- SSDEEP 98304:DT2Y+JxUTlQBS7WJRQ4cl5eyMsgg6l7kzwp0VKvQl+:7+JxQa9J+4clRsg4wzwp0IQ8
- TLSH
  T13F868D03B293F0FAC44B11F4211EB23F9A350A4857158DEBD7CCADB85AF26D118B756A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/tr/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 c095fba9868d939e169934cb2eaf155246d10f631ef3ed04bc33febbdb9bfe62
- MD5 40f8973ca3a178b0fbbc669627057380
- SHA1 8e7d0526c8e2f2fa70c5bda9e33c84a925b1af2c
- SHA512 87bb7de944d2d8911bf7148721e94eccc112a9552762d298157ec103a6773a903fcdf6f5af67d5a377090d8733031be1cfa3d7f304d5358dccb8c089a8845baf
- SSDEEP 384:tM1F+kKuWkBfQWPRdHRN7CwuAzXulGswDuEgi:S1I4R33zr
- TLSH
  T1F7723B819BB88503FEBB297152A0E443BE3DB7C76911621E341EE6191F537C2DB24A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/tr/Microsoft.CodeAnalysis.CSharp.resources.dll
- Size 341KB
- SHA256 8b13ff042e8daff213af548c0e5161d34cb4c26bbb34b338e3bd8e6cd8b8fb59
- MD5 b44fec42b602cc8ac173a2e4e8f0088b
- SHA1 c3d89dbd115178da153edf97af73eec5e0164b22
- SHA512 b2ba0c9cbf3e8dcdfb372c131e3ba6979ba382a018723aa8ad6a879e78abe29a05a05e6e05ba5de87be81161e926c27f8ec45b826019e0f56077bcee1a5ac127
- SSDEEP 6144:IK1aCVBpoR9WjY6CAKQ8ObI/VH37u/OwHG941sEzzNSHTBdR:I9FOza
- TLSH
  T14E74A401B6FD241CF3F71BD9BFF6851ADD6B7DA22B20C24D20094B1F17A4A8646A1736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/tr/Microsoft.CodeAnalysis.Scripting.resources.dll
- Size 16KB
- SHA256 ede2ca2ac9fc46b7e8fe52e614dbc5d2b3e815b7447ad01e49985ded9bc9fae1
- MD5 a11097ced18582d7d7695f4879f4be64
- SHA1 357f8d71944ea79354d063121747d99987e35a47
- SHA512 25528675719d25656bda092037cd7b75cc4ee616c44f44df05690cd96afa31a8145fa400095f8fa6f5b55b8fb6e4c615b633b805f889f94af7b95bc2261592c3
- SSDEEP 384:0hxGeFULa4jR+NB4RnGoyWPiweWgYdHRN7B9oiFWSlGsQiv:0LG5aOFg2UHP
- TLSH
  T1E3722991D7F84503F9B72E71AA74D9437C3EA7C22920D11F1009E6191FA37C19B64B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/tr/Microsoft.CodeAnalysis.resources.dll
- Size 38KB
- SHA256 fd867a536d6042ff76e8ae8e9df27d590677d519606b5c804c912b332fcd107a
- MD5 7a43cd5a0044140b3214a84c0cd36f33
- SHA1 c5d62bb2bdc57ea351c09c076582f6f06123ae03
- SHA512 fc4ad0845b6fcdf7823698793742aab6742f9c8d216778bcb19d07d84337e96899626c964f92847c7cc884e992632dc82758e55914d895706664c325dfd2c2d3
- SSDEEP 768:lZSMXZmHiFZv/hLInxC6LeRCtETTUgBJy27n+PMkNwJZ:lgPcZv5voETUgBln+PMkNwJZ
- TLSH
  T10903A541ABFD2409F6F71F75AAB8D65A9C3FBE923D31D01D0005864E1A72B81CAA1737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  exodus/custom exodus/Exodus/Exodus/bin/Debug/net8.0-windows/zh-Hans/Microsoft.CodeAnalysis.CSharp.Scripting.resources.dll
- Size 15KB
- SHA256 605f9f9db2027e525acebd31fdc18ef0555331aaa6edefb9788b3f63665c8370
- MD5 39e6aa156a26026fa991cb427c26df46
- SHA1 94742c33e0c02e6dd23a8381cae415bfbe26f896
- SHA512 ad20102698c997d2b45fc6c6905497e8cd290d32c17dd2e1440aaae27b2b646927604a09f33da75e8e1cc3d46338c2c4ea9bd58a7d433938f44b63e5ade4c863
- SSDEEP 192:88M1DpU9LNx8TJWkGOqIJ+WG0FW4GD5dHnhWgN7aQWdAoIVFWSqnajKsQiAy:XM1DndWkBfQWPQdHRN7GAoiFWSlGsQi
- TLSH
  T1B86228929B784507E9BB29B14275D5437E3C63D36920921E318EF1681F93BC2DF24A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32