Analysis
- max time kernel
39s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe
- Size 70.0MB
- Sample260804-hevqsahn2s
- SHA256 8491d14586324c70b2cbf07b9b9d91f1a5ed596b31b88a0011556b4dff572b4d
- MD5 7dc1bd64b8a4ca8ba45dac279549543e
- SHA1 d852710f4591123d635e09f537474290a1b0bd0c
- SHA512 95a67a4d763c418a8461e69e4a401262b7775f787563fd6047494615b733ac047fa1626e744ea4f59031985da960077b943bc4f8718bbfbd3a8460fd95fae264
- SSDEEP 24576:n/5Fbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb+:6
- TLSH T1D8F7E1EA9525F0873CE285DF96CC6AC04A2F39FCB664D70D9D2CC535366C2112839E7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6112 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4316 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4964 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5572 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5456 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2372 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2776 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3936 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5740 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6016 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5212 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1040 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2060 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6056 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3744 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4216 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3876 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3732 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2756 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3416 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5180 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1864 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2388 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1052 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4928 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5100 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1512 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1344 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 980 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2404 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5660 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4420 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2728 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2928 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4560 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5692 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5304 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1912 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5960 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3032 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 788 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3768 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5772 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2564 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4004 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5636 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3928 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1936 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2892 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1608 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5176 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2236 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1408 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4344 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2752 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4588 cqurs Vurftbwrst Anty TSydf Prwo wppdmh - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 6112 3000 2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe 89 PID 6112 wrote to memory of 4316 6112 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 90 PID 4316 wrote to memory of 4964 4316 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 91 PID 4964 wrote to memory of 5572 4964 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 92 PID 5572 wrote to memory of 5456 5572 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 93 PID 5456 wrote to memory of 6036 5456 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 94 PID 6036 wrote to memory of 4548 6036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 95 PID 4548 wrote to memory of 2372 4548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 96 PID 2372 wrote to memory of 2776 2372 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 97 PID 2776 wrote to memory of 3936 2776 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 98 PID 3936 wrote to memory of 5740 3936 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 99 PID 5740 wrote to memory of 6016 5740 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 100 PID 6016 wrote to memory of 5212 6016 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 101 PID 5212 wrote to memory of 1040 5212 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 102 PID 1040 wrote to memory of 3276 1040 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 103 PID 3276 wrote to memory of 2060 3276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 104 PID 2060 wrote to memory of 6056 2060 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 105 PID 6056 wrote to memory of 5036 6056 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 106 PID 5036 wrote to memory of 3744 5036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 107 PID 3744 wrote to memory of 4216 3744 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 108 PID 4216 wrote to memory of 3876 4216 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 109 PID 3876 wrote to memory of 3732 3876 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 110 PID 3732 wrote to memory of 2756 3732 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 111 PID 2756 wrote to memory of 3416 2756 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 112 PID 3416 wrote to memory of 5180 3416 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 113 PID 5180 wrote to memory of 1864 5180 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 114 PID 1864 wrote to memory of 2388 1864 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 115 PID 2388 wrote to memory of 1052 2388 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 116 PID 1052 wrote to memory of 4928 1052 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 117 PID 4928 wrote to memory of 5100 4928 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 118 PID 5100 wrote to memory of 1512 5100 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 119 PID 1512 wrote to memory of 1344 1512 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 120 PID 1344 wrote to memory of 4124 1344 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 121 PID 4124 wrote to memory of 980 4124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 122 PID 980 wrote to memory of 2404 980 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 123 PID 2404 wrote to memory of 5660 2404 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 124 PID 5660 wrote to memory of 5276 5660 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 125 PID 5276 wrote to memory of 4420 5276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 126 PID 4420 wrote to memory of 2728 4420 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 127 PID 2728 wrote to memory of 2928 2728 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 128 PID 2928 wrote to memory of 4560 2928 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 129 PID 4560 wrote to memory of 5692 4560 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 130 PID 5692 wrote to memory of 5304 5692 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 131 PID 5304 wrote to memory of 1912 5304 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 132 PID 1912 wrote to memory of 5960 1912 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 133 PID 5960 wrote to memory of 3032 5960 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 134 PID 3032 wrote to memory of 788 3032 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 135 PID 788 wrote to memory of 3768 788 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 136 PID 3768 wrote to memory of 5772 3768 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 137 PID 5772 wrote to memory of 2564 5772 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 138 PID 2564 wrote to memory of 4004 2564 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 139 PID 4004 wrote to memory of 5636 4004 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 140 PID 5636 wrote to memory of 3928 5636 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 141 PID 3928 wrote to memory of 1936 3928 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 142 PID 1936 wrote to memory of 3036 1936 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 143 PID 3036 wrote to memory of 2892 3036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 144 PID 2892 wrote to memory of 1608 2892 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 145 PID 1608 wrote to memory of 5176 1608 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 146 PID 5176 wrote to memory of 2236 5176 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 147 PID 2236 wrote to memory of 1124 2236 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 148 PID 1124 wrote to memory of 1408 1124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 149 PID 1408 wrote to memory of 4344 1408 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 150 PID 4344 wrote to memory of 2752 4344 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 151 PID 2752 wrote to memory of 4588 2752 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI65⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI66⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI67⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI68⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI69⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI70⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI71⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI72⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI73⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI74⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI75⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI76⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI77⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI78⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI79⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI80⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI81⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI82⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI83⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI84⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI85⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI86⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI87⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI88⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI89⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI90⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI91⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI92⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI93⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI94⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI95⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI96⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI97⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI98⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI99⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI100⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI101⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI102⤵
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI103⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI104⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI105⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI106⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI107⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI108⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI109⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI110⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI111⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI112⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI113⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI114⤵
- System Location Discovery: System Language Discovery
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI115⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI116⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI117⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI118⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI119⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI120⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI121⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI122⤵PID:5328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-