Analysis
- max time kernel
71s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
wsl.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
wsl.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target wsl.exe
- Size 263KB
- Sample260806-thqf1seq9x
- SHA256 806c534a528d66864fd123d23752c5caa8d385ae492cfbecfe0714a38c33dde6
- MD5 7de69a44faef889165d60b1fc81f4284
- SHA1 6283ff166e88402868d2e7be6b2bd405be2a654d
- SHA512 a3a35c1004ad86b32ebcaf90e9956642d44db3d4b5d53a44414729730177e430d2ba4d7bdd1118575368540f51ec59239a9380ecf662272a89e27a41154aace8
- SSDEEP 3072:Tim5Hdsikwx8MN5ZmhaUuNav9WAj65oLx6mwDcFWDr3r/ibficJgHWAJ4r15piKQ:lRkaXaFWwC/mbsT+9Atj
- TLSH T15B446C89FB85ACEBC61546358DAF436D3734F6C01B879B275D38B2341D236D0AE8B606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 17000 Process not Found 26628 Process not Found 11416 Process not Found 6908 Process not Found 28404 Process not Found 43232 Process not Found 48044 Process not Found 50244 Process not Found 51460 Process not Found 7468 cmd.exe 25440 Process not Found 18900 Process not Found 39532 Process not Found 47252 Process not Found 59980 Process not Found 10080 cmd.exe 39644 Process not Found 40304 Process not Found 15400 Process not Found 18044 Process not Found 46616 Process not Found 49560 Process not Found 53344 Process not Found 27276 Process not Found 31432 Process not Found 21664 Process not Found 40476 Process not Found 29008 Process not Found 24792 Process not Found 7748 cmd.exe 14340 cmd.exe 40716 Process not Found 8228 Process not Found 41420 Process not Found 57292 Process not Found 12536 Process not Found 36876 Process not Found 38812 Process not Found 35116 Process not Found 53864 Process not Found 58624 Process not Found 59248 Process not Found 49124 Process not Found 13020 cmd.exe 16328 cmd.exe 18036 cmd.exe 18820 Process not Found 21312 Process not Found 8616 Process not Found 32444 Process not Found 37520 Process not Found 8428 cmd.exe 14648 cmd.exe 19072 Process not Found 35992 Process not Found 49700 Process not Found 32312 Process not Found 32868 Process not Found 54444 Process not Found 5648 Process not Found 43652 Process not Found 44280 Process not Found 42524 Process not Found 48664 Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 3436 2560 wsl.exe 90 PID 3436 wrote to memory of 5000 3436 cmd.exe 91 PID 5000 wrote to memory of 2536 5000 wsl.exe 92 PID 2536 wrote to memory of 1236 2536 cmd.exe 93 PID 1236 wrote to memory of 4180 1236 wsl.exe 94 PID 4180 wrote to memory of 5652 4180 cmd.exe 95 PID 5652 wrote to memory of 5368 5652 wsl.exe 96 PID 5368 wrote to memory of 424 5368 cmd.exe 97 PID 424 wrote to memory of 2064 424 wsl.exe 98 PID 2064 wrote to memory of 4264 2064 cmd.exe 99 PID 4264 wrote to memory of 5984 4264 wsl.exe 100 PID 5984 wrote to memory of 5780 5984 cmd.exe 101 PID 5780 wrote to memory of 1004 5780 wsl.exe 102 PID 1004 wrote to memory of 2276 1004 cmd.exe 103 PID 2276 wrote to memory of 3796 2276 wsl.exe 104 PID 3796 wrote to memory of 2448 3796 cmd.exe 105 PID 2448 wrote to memory of 5408 2448 wsl.exe 106 PID 5408 wrote to memory of 3980 5408 cmd.exe 107 PID 3980 wrote to memory of 568 3980 wsl.exe 108 PID 568 wrote to memory of 2572 568 cmd.exe 109 PID 2572 wrote to memory of 1220 2572 wsl.exe 110 PID 1220 wrote to memory of 4740 1220 cmd.exe 111 PID 4740 wrote to memory of 1488 4740 wsl.exe 112 PID 1488 wrote to memory of 5980 1488 cmd.exe 113 PID 5980 wrote to memory of 5452 5980 wsl.exe 114 PID 5452 wrote to memory of 720 5452 cmd.exe 115 PID 720 wrote to memory of 4936 720 wsl.exe 116 PID 4936 wrote to memory of 4300 4936 cmd.exe 117 PID 4300 wrote to memory of 4416 4300 wsl.exe 118 PID 4416 wrote to memory of 352 4416 cmd.exe 119 PID 352 wrote to memory of 260 352 wsl.exe 120 PID 260 wrote to memory of 248 260 cmd.exe 121 PID 248 wrote to memory of 1044 248 wsl.exe 122 PID 1044 wrote to memory of 5108 1044 cmd.exe 123 PID 5108 wrote to memory of 5296 5108 wsl.exe 124 PID 5296 wrote to memory of 4608 5296 cmd.exe 125 PID 4608 wrote to memory of 512 4608 wsl.exe 126 PID 512 wrote to memory of 1928 512 cmd.exe 127 PID 1928 wrote to memory of 2648 1928 wsl.exe 128 PID 2648 wrote to memory of 552 2648 cmd.exe 129 PID 552 wrote to memory of 2640 552 wsl.exe 130 PID 2640 wrote to memory of 1576 2640 cmd.exe 131 PID 1576 wrote to memory of 5760 1576 wsl.exe 132 PID 5760 wrote to memory of 1832 5760 cmd.exe 133 PID 1832 wrote to memory of 5720 1832 wsl.exe 134 PID 5720 wrote to memory of 5800 5720 cmd.exe 135 PID 5800 wrote to memory of 3136 5800 wsl.exe 136 PID 3136 wrote to memory of 5988 3136 cmd.exe 137 PID 5988 wrote to memory of 6064 5988 wsl.exe 138 PID 6064 wrote to memory of 4296 6064 cmd.exe 139 PID 4296 wrote to memory of 4644 4296 wsl.exe 140 PID 4644 wrote to memory of 5356 4644 cmd.exe 141 PID 5356 wrote to memory of 4672 5356 wsl.exe 142 PID 4672 wrote to memory of 556 4672 cmd.exe 143 PID 556 wrote to memory of 2716 556 wsl.exe 144 PID 2716 wrote to memory of 2656 2716 cmd.exe 145 PID 2656 wrote to memory of 2960 2656 wsl.exe 146 PID 2960 wrote to memory of 1312 2960 cmd.exe 147 PID 1312 wrote to memory of 1364 1312 wsl.exe 148 PID 1364 wrote to memory of 2728 1364 cmd.exe 149 PID 2728 wrote to memory of 1136 2728 wsl.exe 150 PID 1136 wrote to memory of 5292 1136 cmd.exe 151 PID 5292 wrote to memory of 4184 5292 wsl.exe 152 PID 4184 wrote to memory of 3940 4184 cmd.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\wsl.exe"C:\Users\Admin\AppData\Local\Temp\wsl.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install2⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install3⤵
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install4⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install5⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install6⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install7⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install8⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install9⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install10⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install11⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install12⤵
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install13⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install14⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install15⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install16⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install17⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install18⤵
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install19⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install20⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install21⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install22⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install23⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install24⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install25⤵
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install26⤵
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install27⤵
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install28⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install29⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install30⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install31⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install32⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install33⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install34⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install35⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install36⤵
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install37⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install38⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install39⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install40⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install41⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install42⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install43⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install44⤵
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install45⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install46⤵
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install47⤵
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install48⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install49⤵
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install50⤵
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install51⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install52⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install53⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install54⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install55⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install56⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install57⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install58⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install59⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install60⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install61⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install62⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install63⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install64⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install65⤵PID:3940
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install66⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install67⤵PID:4600
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install68⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install69⤵PID:5420
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install70⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install71⤵PID:5896
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install72⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install73⤵PID:2104
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install74⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install75⤵PID:4604
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install76⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install77⤵PID:3688
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install78⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install79⤵PID:1748
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install80⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install81⤵PID:4140
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install82⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install83⤵PID:3872
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install84⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install85⤵PID:2868
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install86⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install87⤵PID:5436
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install88⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install89⤵PID:5484
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install90⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install91⤵PID:5740
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install92⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install93⤵PID:4232
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install94⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install95⤵PID:4168
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install96⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install97⤵PID:1828
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install98⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install99⤵PID:3480
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install100⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install101⤵PID:5044
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install102⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install103⤵PID:3536
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install104⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install105⤵PID:4492
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install106⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install107⤵PID:1924
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install108⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install109⤵PID:2336
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install110⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install111⤵PID:2980
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install112⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install113⤵PID:5372
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install114⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install115⤵PID:4404
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install116⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install117⤵PID:1808
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install118⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install119⤵PID:3328
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install120⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\wsl.exewsl --install121⤵PID:2652
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wsl --install122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-