Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
wsl.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
wsl.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target wsl.exe
- Size 263KB
- Sample260806-thqf1seq9x
- SHA256 806c534a528d66864fd123d23752c5caa8d385ae492cfbecfe0714a38c33dde6
- MD5 7de69a44faef889165d60b1fc81f4284
- SHA1 6283ff166e88402868d2e7be6b2bd405be2a654d
- SHA512 a3a35c1004ad86b32ebcaf90e9956642d44db3d4b5d53a44414729730177e430d2ba4d7bdd1118575368540f51ec59239a9380ecf662272a89e27a41154aace8
- SSDEEP 3072:Tim5Hdsikwx8MN5ZmhaUuNav9WAj65oLx6mwDcFWDr3r/ibficJgHWAJ4r15piKQ:lRkaXaFWwC/mbsT+9Atj
- TLSH T15B446C89FB85ACEBC61546358DAF436D3734F6C01B879B275D38B2341D236D0AE8B606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 13264 cmd.exe 14920 cmd.exe 16100 cmd.exe 11576 Process not Found 9540 cmd.exe 10128 cmd.exe 11192 cmd.exe 11272 cmd.exe 15656 cmd.exe 18396 Process not Found 1900 Process not Found 22280 Process not Found 5984 Process not Found 11336 Process not Found 5216 cmd.exe 20656 Process not Found 7576 cmd.exe 12472 cmd.exe 14384 cmd.exe 11468 cmd.exe 20052 Process not Found 20212 Process not Found 3264 cmd.exe 11972 cmd.exe 20468 Process not Found 17776 Process not Found 15016 cmd.exe 3284 Process not Found 15396 Process not Found 7716 Process not Found 16496 cmd.exe 8360 Process not Found 10916 Process not Found 20084 Process not Found 440 cmd.exe 16728 cmd.exe 7760 Process not Found 7768 cmd.exe 11696 cmd.exe 17644 cmd.exe 6532 Process not Found 17636 Process not Found 6304 cmd.exe 14488 cmd.exe 14688 cmd.exe 14948 Process not Found 12864 cmd.exe 10136 Process not Found 21776 Process not Found 15184 cmd.exe 17948 cmd.exe 13344 Process not Found 17700 Process not Found 16068 cmd.exe 12332 Process not Found 20276 Process not Found 21452 Process not Found 8136 Process not Found 21028 Process not Found 9648 cmd.exe 14584 cmd.exe 8724 Process not Found 17908 Process not Found 2040 cmd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 412 3148 wsl.exe 87 PID 412 wrote to memory of 3288 412 cmd.exe 88 PID 3288 wrote to memory of 3952 3288 wsl.exe 89 PID 3952 wrote to memory of 1540 3952 cmd.exe 90 PID 1540 wrote to memory of 1868 1540 wsl.exe 91 PID 1868 wrote to memory of 4784 1868 cmd.exe 92 PID 4784 wrote to memory of 4280 4784 wsl.exe 93 PID 4280 wrote to memory of 2996 4280 cmd.exe 94 PID 2996 wrote to memory of 4400 2996 wsl.exe 95 PID 4400 wrote to memory of 1244 4400 cmd.exe 96 PID 1244 wrote to memory of 2992 1244 wsl.exe 97 PID 2992 wrote to memory of 1728 2992 cmd.exe 98 PID 1728 wrote to memory of 2088 1728 wsl.exe 99 PID 2088 wrote to memory of 2916 2088 cmd.exe 100 PID 2916 wrote to memory of 3200 2916 wsl.exe 101 PID 3200 wrote to memory of 2188 3200 cmd.exe 102 PID 2188 wrote to memory of 5108 2188 wsl.exe 103 PID 5108 wrote to memory of 852 5108 cmd.exe 104 PID 852 wrote to memory of 2520 852 wsl.exe 105 PID 2520 wrote to memory of 1468 2520 cmd.exe 106 PID 1468 wrote to memory of 4004 1468 wsl.exe 107 PID 4004 wrote to memory of 640 4004 cmd.exe 108 PID 640 wrote to memory of 1568 640 wsl.exe 109 PID 1568 wrote to memory of 1636 1568 cmd.exe 110 PID 1636 wrote to memory of 2932 1636 wsl.exe 111 PID 2932 wrote to memory of 2416 2932 cmd.exe 112 PID 2416 wrote to memory of 2284 2416 wsl.exe 113 PID 2284 wrote to memory of 2452 2284 cmd.exe 114 PID 2452 wrote to memory of 4232 2452 wsl.exe 115 PID 4232 wrote to memory of 5116 4232 cmd.exe 116 PID 5116 wrote to memory of 4556 5116 wsl.exe 117 PID 4556 wrote to memory of 828 4556 cmd.exe 118 PID 828 wrote to memory of 2848 828 wsl.exe 119 PID 2848 wrote to memory of 4024 2848 cmd.exe 120 PID 4024 wrote to memory of 556 4024 wsl.exe 121 PID 556 wrote to memory of 4544 556 cmd.exe 122 PID 4544 wrote to memory of 5088 4544 wsl.exe 123 PID 5088 wrote to memory of 4844 5088 cmd.exe 124 PID 4844 wrote to memory of 4808 4844 wsl.exe 125 PID 4808 wrote to memory of 1804 4808 cmd.exe 126 PID 1804 wrote to memory of 3296 1804 wsl.exe 127 PID 3296 wrote to memory of 396 3296 cmd.exe 128 PID 396 wrote to memory of 212 396 wsl.exe 129 PID 212 wrote to memory of 1932 212 cmd.exe 130 PID 1932 wrote to memory of 1264 1932 wsl.exe 131 PID 1264 wrote to memory of 4696 1264 cmd.exe 132 PID 4696 wrote to memory of 680 4696 wsl.exe 133 PID 680 wrote to memory of 4464 680 cmd.exe 134 PID 4464 wrote to memory of 2624 4464 wsl.exe 135 PID 2624 wrote to memory of 636 2624 cmd.exe 136 PID 636 wrote to memory of 744 636 wsl.exe 137 PID 744 wrote to memory of 988 744 cmd.exe 138 PID 988 wrote to memory of 4964 988 wsl.exe 139 PID 4964 wrote to memory of 888 4964 cmd.exe 140 PID 888 wrote to memory of 3812 888 wsl.exe 141 PID 3812 wrote to memory of 2068 3812 cmd.exe 142 PID 2068 wrote to memory of 4236 2068 wsl.exe 143 PID 4236 wrote to memory of 4196 4236 cmd.exe 144 PID 4196 wrote to memory of 2240 4196 wsl.exe 145 PID 2240 wrote to memory of 2448 2240 cmd.exe 146 PID 2448 wrote to memory of 3264 2448 wsl.exe 147 PID 3264 wrote to memory of 4124 3264 cmd.exe 148 PID 4124 wrote to memory of 3756 4124 wsl.exe 149 PID 3756 wrote to memory of 1904 3756 cmd.exe 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\wsl.exe"C:\Users\Admin\AppData\Local\Temp\wsl.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install2⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install3⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install4⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install5⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install6⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install7⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install8⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install9⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install10⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install11⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install12⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install13⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install14⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install15⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install16⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install17⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install18⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install19⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install20⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install21⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install22⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install23⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install24⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install25⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install26⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install27⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install28⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install29⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install30⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install31⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install32⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install33⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install34⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install35⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install36⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install37⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install38⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install39⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install40⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install41⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install42⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install43⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install44⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install45⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install46⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install47⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install48⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install49⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install50⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install51⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install52⤵
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install53⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install54⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install55⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install56⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install57⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install58⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install59⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install60⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install61⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install63⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install64⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install65⤵PID:1904
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install66⤵
- Executes a command shell one-liner
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install67⤵PID:4336
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install68⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install69⤵PID:4136
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install70⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install71⤵PID:4712
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install72⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install73⤵PID:3320
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install74⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install75⤵PID:3392
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install76⤵
- Executes a command shell one-liner
PID:440 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install77⤵PID:3312
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install78⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install79⤵PID:4256
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install80⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install81⤵PID:1940
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install82⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install83⤵PID:4564
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install84⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install85⤵PID:2780
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install86⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install87⤵PID:1972
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install88⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install89⤵PID:1140
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install90⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install91⤵PID:2044
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install92⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install93⤵PID:4700
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install94⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install95⤵PID:3316
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install96⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install97⤵PID:688
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install98⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install99⤵PID:4996
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install100⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install101⤵PID:4748
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install102⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install103⤵PID:5132
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install104⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install105⤵PID:5160
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install106⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install107⤵PID:5196
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install108⤵
- Executes a command shell one-liner
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install109⤵PID:5236
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install110⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install111⤵PID:5268
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install112⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install113⤵PID:5300
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install114⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install115⤵PID:5328
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install116⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install117⤵PID:5360
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install118⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install119⤵PID:5392
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install120⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install121⤵PID:5424
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install122⤵PID:5440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-