Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll
- Size 11.8MB
- Sample260804-bxwbpsttex
- SHA256 05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48
- MD5 a5ffe7fd71b84cad50c49cc7ac9c1e24
- SHA1 e7dbcbd33347ccc8a1ef2a5b90ce394c35cf4387
- SHA512 fd7f30e8cf629f0d703d4e6fdfe427b894406b6fdd707d27d59c9b7f1c2d055b05bee10c8b88cea00091f338d953d708330a09e2f1301e5bd7fc6fc42b1eb7b9
- SSDEEP 196608:ruNr39OeYxwceDJ2wBYoQ+SetHig4hPkbFTlpGoi5d7ue5Dcv/xrMHDAfhQpIMUw:ruNzZYxwhBYoQ+ScHiguQFTlHir7l5D/
- TLSH T1CFC6BF306612D226E46E45F1AA3DDAAF90487E7507B444D7F3C84F6A29B48C32B36F17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 900 wrote to memory of 2788 900 rundll32.exe 86 PID 2788 wrote to memory of 2452 2788 rundll32.exe 87 PID 2452 wrote to memory of 1804 2452 rundll32.exe 88 PID 1804 wrote to memory of 3984 1804 rundll32.exe 89 PID 3984 wrote to memory of 2260 3984 rundll32.exe 90 PID 2260 wrote to memory of 1876 2260 rundll32.exe 91 PID 1876 wrote to memory of 2328 1876 rundll32.exe 92 PID 2328 wrote to memory of 3996 2328 rundll32.exe 93 PID 3996 wrote to memory of 2296 3996 rundll32.exe 94 PID 2296 wrote to memory of 2484 2296 rundll32.exe 95 PID 2484 wrote to memory of 3472 2484 rundll32.exe 96 PID 3472 wrote to memory of 2880 3472 rundll32.exe 97 PID 2880 wrote to memory of 536 2880 rundll32.exe 98 PID 536 wrote to memory of 4616 536 rundll32.exe 99 PID 4616 wrote to memory of 4300 4616 rundll32.exe 100 PID 4300 wrote to memory of 1500 4300 rundll32.exe 101 PID 1500 wrote to memory of 4884 1500 rundll32.exe 102 PID 4884 wrote to memory of 3732 4884 rundll32.exe 103 PID 3732 wrote to memory of 1884 3732 rundll32.exe 104 PID 1884 wrote to memory of 1324 1884 rundll32.exe 105 PID 1324 wrote to memory of 1792 1324 rundll32.exe 106 PID 1792 wrote to memory of 1192 1792 rundll32.exe 107 PID 1192 wrote to memory of 1288 1192 rundll32.exe 108 PID 1288 wrote to memory of 2980 1288 rundll32.exe 109 PID 2980 wrote to memory of 4620 2980 rundll32.exe 110 PID 4620 wrote to memory of 4004 4620 rundll32.exe 111 PID 4004 wrote to memory of 4480 4004 rundll32.exe 112 PID 4480 wrote to memory of 3636 4480 rundll32.exe 113 PID 3636 wrote to memory of 3960 3636 rundll32.exe 114 PID 3960 wrote to memory of 1468 3960 rundll32.exe 115 PID 1468 wrote to memory of 4964 1468 rundll32.exe 116 PID 4964 wrote to memory of 1340 4964 rundll32.exe 117 PID 1340 wrote to memory of 2092 1340 rundll32.exe 118 PID 2092 wrote to memory of 3684 2092 rundll32.exe 119 PID 3684 wrote to memory of 452 3684 rundll32.exe 120 PID 452 wrote to memory of 1620 452 rundll32.exe 121 PID 1620 wrote to memory of 2612 1620 rundll32.exe 122 PID 2612 wrote to memory of 4912 2612 rundll32.exe 123 PID 4912 wrote to memory of 4272 4912 rundll32.exe 124 PID 4272 wrote to memory of 744 4272 rundll32.exe 125 PID 744 wrote to memory of 2204 744 rundll32.exe 126 PID 2204 wrote to memory of 4872 2204 rundll32.exe 127 PID 4872 wrote to memory of 4948 4872 rundll32.exe 128 PID 4948 wrote to memory of 2180 4948 rundll32.exe 129 PID 2180 wrote to memory of 1968 2180 rundll32.exe 130 PID 1968 wrote to memory of 2348 1968 rundll32.exe 131 PID 2348 wrote to memory of 2840 2348 rundll32.exe 132 PID 2840 wrote to memory of 888 2840 rundll32.exe 133 PID 888 wrote to memory of 4156 888 rundll32.exe 134 PID 4156 wrote to memory of 4776 4156 rundll32.exe 135 PID 4776 wrote to memory of 4448 4776 rundll32.exe 136 PID 4448 wrote to memory of 2992 4448 rundll32.exe 137 PID 2992 wrote to memory of 3428 2992 rundll32.exe 138 PID 3428 wrote to memory of 4460 3428 rundll32.exe 139 PID 4460 wrote to memory of 2480 4460 rundll32.exe 140 PID 2480 wrote to memory of 1168 2480 rundll32.exe 141 PID 1168 wrote to memory of 1800 1168 rundll32.exe 142 PID 1800 wrote to memory of 5016 1800 rundll32.exe 143 PID 5016 wrote to memory of 116 5016 rundll32.exe 144 PID 116 wrote to memory of 4264 116 rundll32.exe 145 PID 4264 wrote to memory of 3380 4264 rundll32.exe 146 PID 3380 wrote to memory of 4296 3380 rundll32.exe 147 PID 4296 wrote to memory of 672 4296 rundll32.exe 148 PID 672 wrote to memory of 2692 672 rundll32.exe 149
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#17⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#123⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#124⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#125⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#126⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#127⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#128⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#129⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#130⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#131⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#132⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#133⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#134⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#135⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#136⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#137⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#138⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#139⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#140⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#141⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#142⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#143⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#144⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#145⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#146⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#147⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#148⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#149⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#150⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#151⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#152⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#153⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#154⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#155⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#156⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#157⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#158⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#159⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#160⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#161⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#162⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#163⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#164⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#165⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#166⤵PID:392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#167⤵PID:3356
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#168⤵PID:2196
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#169⤵PID:3364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#170⤵PID:332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#171⤵PID:3884
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#172⤵
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#173⤵PID:4132
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#174⤵PID:3748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#175⤵PID:644
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#176⤵PID:1948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#177⤵PID:2524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#178⤵PID:956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#179⤵PID:4684
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#180⤵PID:2752
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#181⤵PID:408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#182⤵PID:2912
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#183⤵PID:1892
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#184⤵PID:1872
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#185⤵PID:4008
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#186⤵PID:3392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#187⤵PID:1668
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#188⤵PID:2152
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#189⤵PID:4244
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#190⤵PID:5096
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#191⤵PID:2056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#192⤵PID:2908
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#193⤵PID:4056
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#194⤵PID:1304
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#195⤵PID:5004
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#196⤵PID:2364
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#197⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#198⤵PID:836
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#199⤵PID:4860
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1100⤵PID:4848
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1101⤵PID:2408
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1102⤵PID:708
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1103⤵PID:4456
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1104⤵PID:4932
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1105⤵PID:4720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1106⤵PID:4648
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1107⤵PID:4392
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1108⤵PID:2564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1109⤵
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1110⤵PID:4748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1111⤵PID:2220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1112⤵PID:3720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1113⤵PID:4276
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1114⤵PID:464
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1115⤵PID:4416
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1116⤵PID:3616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1117⤵PID:2120
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1118⤵PID:1524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1119⤵PID:5124
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1120⤵PID:5140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1121⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05e831ed6fe2d71aeab7637b1226bec66d6aa54c3146e9a0952385835a7aac48.dll,#1122⤵PID:5188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-