47004f57042e1bf98cec1747c046ffc968964c42f3daab8aa1bd674a79f07994

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_8572a9b64135bd7f605669ef7f147d5a_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Size 41.2MB
Sample260905-21d5psbj8x
SHA256 47004f57042e1bf98cec1747c046ffc968964c42f3daab8aa1bd674a79f07994
MD5 8572a9b64135bd7f605669ef7f147d5a
SHA1 a492696000d1c778d64a0e176cadb7daf258ac95
SHA512 0f4a73c4cb87837a5eeb8229f58d74212ad3807b95e6a92d1f424c42c84c2058571f78b48101884357f64328a471d21b662a6ba46338b130f5d1be720e0943e1
SSDEEP 393216:AzBd4IcVUnN7qg+21j++sHV1KX6RSF32YhQSI8w5SvDazn1d5VR/6Lgc/icMOQMb:AaW1JhQlR7TtKeagPV1jmL
TLSH
T157978C0773E501A9E177D1388AAB9103EBB2B8161734D7DB329C03652F67AE09D7BB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
824	powershell.exe
824	powershell.exe
824	powershell.exe
824	powershell.exe
824	powershell.exe
5412	powershell.exe
5412	powershell.exe
5412	powershell.exe
1580	powershell.exe
1580	powershell.exe
1580	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	5412	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 824	3140	2026-09-03_8572a9b64135bd7f605669ef7f147d5a_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	90
PID 824 wrote to memory of 2804	824	powershell.exe	91
PID 2804 wrote to memory of 5804	2804	csc.exe	92
PID 3140 wrote to memory of 5412	3140	2026-09-03_8572a9b64135bd7f605669ef7f147d5a_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	93
PID 5412 wrote to memory of 3420	5412	powershell.exe	94
PID 3420 wrote to memory of 2468	3420	csc.exe	95
PID 3140 wrote to memory of 1580	3140	2026-09-03_8572a9b64135bd7f605669ef7f147d5a_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	96
PID 1580 wrote to memory of 3036	1580	powershell.exe	97
PID 3036 wrote to memory of 2316	3036	csc.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-09-03_8572a9b64135bd7f605669ef7f147d5a_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_8572a9b64135bd7f605669ef7f147d5a_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYwBsAGEAcwBzACAAVABlAHIAbQBoAHUAYgBOAGEAdABpAHYAZQAgAHsACgAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKAAoAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEkAcwBJAGMAbwBuAGkAYwAoAEkAbgB0AFAAdAByACAAaABXAG4AZAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABXAGkAbgBkAG8AdwBUAGgAcgBlAGEAZABQAHIAbwBjAGUAcwBzAEkAZAAoAEkAbgB0AFAAdAByACAAaABXAG4AZAAsACAAbwB1AHQAIAB1AGkAbgB0ACAAcAByAG8AYwBlAHMAcwBJAGQAKQA7AAoAfQAKACIAQAAKAAoACgAKAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAKABbAG8AYgBqAGUAYwB0AF0AJAB2AGEAbAB1AGUAKQAgAHsACgAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAdgBhAGwAdQBlACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAJAB0AGUAeAB0ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAHYAYQBsAHUAZQAKACAAIABpAGYAIAAoAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAFcAaABpAHQAZQBTAHAAYQBjAGUAKAAkAHQAZQB4AHQAKQApACAAewAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAJAB0AGUAeAB0AC4AVAByAGkAbQAoACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIARgBvAHIAZQBnAHIAbwB1AG4AZABIAGEAbgBkAGwAZQAoACkAIAB7AAoAIAAgAHIAZQB0AHUAcgBuACAAWwBpAG4AdAA2ADQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAUAByAG8AYwBlAHMAcwBJAGQARgByAG8AbQBIAGEAbgBkAGwAZQAoAFsAaQBuAHQANgA0AF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACAAewAKACAAIABpAGYAIAAoACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAMAAKACAAIAB9AAoACgAgACAAWwB1AGkAbgB0ADMAMgBdACQAcAByAG8AYwBlAHMAcwBJAGQAIAA9ACAAMAAKACAAIABbAHYAbwBpAGQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKABbAEkAbgB0AFAAdAByAF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAsACAAWwByAGUAZgBdACQAcAByAG8AYwBlAHMAcwBJAGQAKQAKACAAIAByAGUAdAB1AHIAbgAgAFsAaQBuAHQAXQAkAHAAcgBvAGMAZQBzAHMASQBkAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAHQALQBUAGUAcgBtAGgAdQBiAEYAbwByAGUAZwByAG8AdQBuAGQAKABbAGkAbgB0ADYANABdACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAKQAgAHsACgAgACAAaQBmACAAKAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlAAoAIAAgAH0ACgAKACAAIABpAGYAIAAoAFsAVABlAHIAbQBoAHUAYgBOAGEAdABpAHYAZQBdADoAOgBJAHMASQBjAG8AbgBpAGMAKABbAEkAbgB0AFAAdAByAF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACkAIAB7AAoAIAAgACAAIABbAHYAbwBpAGQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoAUwBoAG8AdwBXAGkAbgBkAG8AdwAoAFsASQBuAHQAUAB0AHIAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACwAIAA5ACkACgAgACAAfQAKAAoAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA0ADAACgAgACAAJAByAGUAcwB1AGwAdAAgAD0AIABbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoAUwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoAFsASQBuAHQAUAB0AHIAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkACgAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADgAMAAKACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAdQBsAHQACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABGAGkAbgBkAC0AVABlAHIAbQBoAHUAYgBXAGkAbgBkAG8AdwBFAGwAZQBtAGUAbgB0AEIAeQBIAGEAbgBkAGwAZQAoAFsAaQBuAHQANgA0AF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACAAewAKACAAIAAkAGMAaABpAGwAZAByAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAHUAdABvAG0AYQB0AGkAbwBuAEUAbABlAG0AZQBuAHQAXQA6ADoAUgBvAG8AdABFAGwAZQBtAGUAbgB0AC4ARgBpAG4AZABBAGwAbAAoAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAZQBlAFMAYwBvAHAAZQBdADoAOgBDAGgAaQBsAGQAcgBlAG4ALAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQwBvAG4AZABpAHQAaQBvAG4AXQA6ADoAVAByAHUAZQBDAG8AbgBkAGkAdABpAG8AbgAKACAAIAApAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBsAGQAIABpAG4AIAAkAGMAaABpAGwAZAByAGUAbgApACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAaQBmACAAKABbAGkAbgB0ADYANABdACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAE4AYQB0AGkAdgBlAFcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABjAGgAaQBsAGQACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBUAGUAcgBtAGgAdQBiAFQAbwBwAEwAZQB2AGUAbABXAGkAbgBkAG8AdwBzACgAKQAgAHsACgAgACAAJABjAGgAaQBsAGQAcgBlAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQB1AHQAbwBtAGEAdABpAG8AbgBFAGwAZQBtAGUAbgB0AF0AOgA6AFIAbwBvAHQARQBsAGUAbQBlAG4AdAAuAEYAaQBuAGQAQQBsAGwAKAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGUAZQBTAGMAbwBwAGUAXQA6ADoAQwBoAGkAbABkAHIAZQBuACwACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBuAGQAaQB0AGkAbwBuAF0AOgA6AFQAcgB1AGUAQwBvAG4AZABpAHQAaQBvAG4ACgAgACAAKQAKAAoAIAAgACQAdwBpAG4AZABvAHcAcwAgAD0AIABAACgAKQAKAAoAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYwBoAGkAbABkACAAaQBuACAAJABjAGgAaQBsAGQAcgBlAG4AKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAA9ACAAWwBpAG4AdAA2ADQAXQAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBOAGEAdABpAHYAZQBXAGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIABjAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAdwBpAG4AZABvAHcAcwAgACsAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAA9ACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIAAgACAAIAAgAHAAcgBvAGMAZQBzAHMASQBkACAAPQAgAFsAaQBuAHQAXQAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBQAHIAbwBjAGUAcwBzAEkAZAAKACAAIAAgACAAIAAgAHQAaQB0AGwAZQAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAE4AYQBtAGUACgAgACAAIAAgACAAIABjAGwAYQBzAHMATgBhAG0AZQAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAEMAbABhAHMAcwBOAGEAbQBlAAoAIAAgACAAIAAgACAAYQB1AHQAbwBtAGEAdABpAG8AbgBJAGQAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAEkAZAAKACAAIAAgACAAfQAKACAAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIABAACgAJAB3AGkAbgBkAG8AdwBzACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIARQBsAGUAbQBlAG4AdABzACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACQAdwBpAG4AZABvAHcAIAA9ACAARgBpAG4AZAAtAFQAZQByAG0AaAB1AGIAVwBpAG4AZABvAHcARQBsAGUAbQBlAG4AdABCAHkASABhAG4AZABsAGUAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlAAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHcAaQBuAGQAbwB3ACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAEAAKAApAAoAIAAgAH0ACgAKACAAIAAkAGMAbwBuAGQAaQB0AGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUAByAG8AcABlAHIAdAB5AEMAbwBuAGQAaQB0AGkAbwBuACgACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ARQBsAGUAbQBlAG4AdABdADoAOgBDAG8AbgB0AHIAbwBsAFQAeQBwAGUAUAByAG8AcABlAHIAdAB5ACwACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBuAHQAcgBvAGwAVAB5AHAAZQBdADoAOgBUAGEAYgBJAHQAZQBtAAoAIAAgACkACgAKACAAIAAkAG0AYQB0AGMAaABlAHMAIAA9ACAAJAB3AGkAbgBkAG8AdwAuAEYAaQBuAGQAQQBsAGwAKAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGUAZQBTAGMAbwBwAGUAXQA6ADoARABlAHMAYwBlAG4AZABhAG4AdABzACwACgAgACAAIAAgACQAYwBvAG4AZABpAHQAaQBvAG4ACgAgACAAKQAKAAoAIAAgACQAaQB0AGUAbQBzACAAPQAgAEAAKAApAAoAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAaQB0AGUAbQAgAGkAbgAgACQAbQBhAHQAYwBoAGUAcwApACAAewAKACAAIAAgACAAJABpAHQAZQBtAHMAIAArAD0AIAAkAGkAdABlAG0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAQAAoACQAaQB0AGUAbQBzACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIASQBuAGYAbwBzACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACQAaQB0AGUAbQBzACAAPQAgAEAAKABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIARQBsAGUAbQBlAG4AdABzACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApAAoAIAAgACQAdABhAGIAcwAgAD0AIABAACgAKQAKACAAIAAkAGkAbgBkAGUAeAAgAD0AIAAwAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABpAHQAZQBtACAAaQBuACAAJABpAHQAZQBtAHMAKQAgAHsACgAgACAAIAAgACQAaQBuAGQAZQB4ACAAKwA9ACAAMQAKACAAIAAgACAAJABpAHMAUwBlAGwAZQBjAHQAZQBkACAAPQAgACQAZgBhAGwAcwBlAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAgAD0AIAAkAGkAdABlAG0ALgBHAGUAdABDAHUAcgByAGUAbgB0AFAAYQB0AHQAZQByAG4AKABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBTAGUAbABlAGMAdABpAG8AbgBJAHQAZQBtAFAAYQB0AHQAZQByAG4AXQA6ADoAUABhAHQAdABlAHIAbgApAAoAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACAAIAAkAGkAcwBTAGUAbABlAGMAdABlAGQAIAA9ACAAJABwAGEAdAB0AGUAcgBuAC4AQwB1AHIAcgBlAG4AdAAuAEkAcwBTAGUAbABlAGMAdABlAGQACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAKACAAIAAgACAAJAB0AGkAdABsAGUAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGkAdABlAG0ALgBDAHUAcgByAGUAbgB0AC4ATgBhAG0AZQAKACAAIAAgACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJAB0AGkAdABsAGUAKQApACAAewAKACAAIAAgACAAIAAgACQAdABpAHQAbABlACAAPQAgACIAVABhAGIAIAAkAGkAbgBkAGUAeAAiAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAdABhAGIAcwAgACsAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAdABhAGIASQBuAGQAZQB4ACAAPQAgACQAaQBuAGQAZQB4AAoAIAAgACAAIAAgACAAdABpAHQAbABlACAAPQAgACQAdABpAHQAbABlAAoAIAAgACAAIAAgACAAaQBzAEMAdQByAHIAZQBuAHQAIAA9ACAAJABpAHMAUwBlAGwAZQBjAHQAZQBkAAoAIAAgACAAIAAgACAAYQB1AHQAbwBtAGEAdABpAG8AbgBJAGQAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGkAdABlAG0ALgBDAHUAcgByAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgBJAGQACgAgACAAIAAgAH0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAQAAoACQAdABhAGIAcwApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAGwAZQBjAHQALQBUAGUAcgBtAGgAdQBiAFQAYQBiACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACwAIABbAGkAbgB0AF0AJAB0AGEAYgBJAG4AZABlAHgAKQAgAHsACgAgACAAJABpAHQAZQBtAHMAIAA9ACAAQAAoAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGEAYgBFAGwAZQBtAGUAbgB0AHMAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkACgAKACAAIABpAGYAIAAoACQAaQB0AGUAbQBzAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAdABhAGIASQBuAGQAZQB4ACAALQBlAHEAIAAxACkAIAB7AAoAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABTAGUAdAAtAFQAZQByAG0AaAB1AGIARgBvAHIAZQBnAHIAbwB1AG4AZAAgACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUACgAgACAAIAAgAH0ACgAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBTAGUAcwBzAGkAbwBuACAAbgBvAHQAIABmAG8AdQBuAGQAIgAKACAAIAB9AAoACgAgACAAaQBmACAAKAAkAHQAYQBiAEkAbgBkAGUAeAAgAC0AbAB0ACAAMQAgAC0AbwByACAAJAB0AGEAYgBJAG4AZABlAHgAIAAtAGcAdAAgACQAaQB0AGUAbQBzAC4AQwBvAHUAbgB0ACkAIAB7AAoAIAAgACAAIAB0AGgAcgBvAHcAIAAiAFMAZQBzAHMAaQBvAG4AIABuAG8AdAAgAGYAbwB1AG4AZAAiAAoAIAAgAH0ACgAKACAAIABbAHYAbwBpAGQAXQAoAFMAZQB0AC0AVABlAHIAbQBoAHUAYgBGAG8AcgBlAGcAcgBvAHUAbgBkACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApAAoAIAAgACQAdABhAHIAZwBlAHQAIAA9ACAAJABpAHQAZQBtAHMAWwAkAHQAYQBiAEkAbgBkAGUAeAAgAC0AIAAxAF0ACgAKACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAHQAdABlAHIAbgAgAD0AIAAkAHQAYQByAGcAZQB0AC4ARwBlAHQAQwB1AHIAcgBlAG4AdABQAGEAdAB0AGUAcgBuACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBlAGwAZQBjAHQAaQBvAG4ASQB0AGUAbQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAuAFMAZQBsAGUAYwB0ACgAKQAKACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAdABhAHIAZwBlAHQALgBHAGUAdABDAHUAcgByAGUAbgB0AFAAYQB0AHQAZQByAG4AKABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBJAG4AdgBvAGsAZQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAuAEkAbgB2AG8AawBlACgAKQAKACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAuAFMAZQB0AEYAbwBjAHUAcwAoACkACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAHQAcgB1AGUACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBsAGwAZQBjAHQAaQBvAG4AcwAuAEcAZQBuAGUAcgBpAGMALgBMAGkAcwB0AFsAcwB0AHIAaQBuAGcAXQBdACQAYwBhAG4AZABpAGQAYQB0AGUAcwAsACAAWwBzAHQAcgBpAG4AZwBdACQAdgBhAGwAdQBlACkAIAB7AAoAIAAgACQAdABlAHgAdAAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAdgBhAGwAdQBlAAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHQAZQB4AHQAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgAH0ACgAKACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMALgBDAG8AbgB0AGEAaQBuAHMAKAAkAHQAZQB4AHQAKQApACAAewAKACAAIAAgACAAJABjAGEAbgBkAGkAZABhAHQAZQBzAC4AQQBkAGQAKAAkAHQAZQB4AHQAKQAKACAAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQARgByAG8AbQBFAGwAZQBtAGUAbgB0ACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQB1AHQAbwBtAGEAdABpAG8AbgBFAGwAZQBtAGUAbgB0AF0AJABlAGwAZQBtAGUAbgB0ACkAIAB7AAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAGUAbABlAG0AZQBuAHQAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgACcAUwB5AHMAdABlAG0ALgBDAG8AbABsAGUAYwB0AGkAbwBuAHMALgBHAGUAbgBlAHIAaQBjAC4ATABpAHMAdABbAHMAdAByAGkAbgBnAF0AJwAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAZQBsAGUAbQBlAG4AdAAuAEcAZQB0AEMAdQByAHIAZQBuAHQAUABhAHQAdABlAHIAbgAoAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFQAZQB4AHQAUABhAHQAdABlAHIAbgBdADoAOgBQAGEAdAB0AGUAcgBuACkACgAgACAAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBuAGUAIAAkAHAAYQB0AHQAZQByAG4AKQAgAHsACgAgACAAIAAgACAAIABBAGQAZAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABDAGEAbgBkAGkAZABhAHQAZQAgACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgACgAJABwAGEAdAB0AGUAcgBuAC4ARABvAGMAdQBtAGUAbgB0AFIAYQBuAGcAZQAuAEcAZQB0AFQAZQB4AHQAKAAtADEAKQApAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAZQBsAGUAbQBlAG4AdAAuAEcAZQB0AEMAdQByAHIAZQBuAHQAUABhAHQAdABlAHIAbgAoAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFYAYQBsAHUAZQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAKAAkAHAAYQB0AHQAZQByAG4ALgBDAHUAcgByAGUAbgB0AC4AVgBhAGwAdQBlACkACgAgACAAIAAgAH0ACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoACgAgACAAdAByAHkAIAB7AAoAIAAgACAAIABBAGQAZAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABDAGEAbgBkAGkAZABhAHQAZQAgACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgACQAZQBsAGUAbQBlAG4AdAAuAEMAdQByAHIAZQBuAHQALgBOAGEAbQBlAAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAGkAZgAgACgAJABjAGEAbgBkAGkAZABhAHQAZQBzAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIAAoACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATABlAG4AZwB0AGgAIAB9ACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEYAcgBvAG0ASABhAG4AZABsAGUAKABbAGkAbgB0ADYANABdACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAKQAgAHsACgAgACAAJAByAG8AbwB0ACAAPQAgAEYAaQBuAGQALQBUAGUAcgBtAGgAdQBiAFcAaQBuAGQAbwB3AEUAbABlAG0AZQBuAHQAQgB5AEgAYQBuAGQAbABlACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AZQBxACAAJAByAG8AbwB0ACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAnAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwAuAEwAaQBzAHQAWwBzAHQAcgBpAG4AZwBdACcACgAgACAAQQBkAGQALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAQwBhAG4AZABpAGQAYQB0AGUAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMAIAAoAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEYAcgBvAG0ARQBsAGUAbQBlAG4AdAAgACQAcgBvAG8AdAApAAoACgAgACAAJABlAGwAZQBtAGUAbgB0AHMAIAA9ACAAJAByAG8AbwB0AC4ARgBpAG4AZABBAGwAbAAoAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAZQBlAFMAYwBvAHAAZQBdADoAOgBEAGUAcwBjAGUAbgBkAGEAbgB0AHMALAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQwBvAG4AZABpAHQAaQBvAG4AXQA6ADoAVAByAHUAZQBDAG8AbgBkAGkAdABpAG8AbgAKACAAIAApAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABlAGwAZQBtAGUAbgB0ACAAaQBuACAAJABlAGwAZQBtAGUAbgB0AHMAKQAgAHsACgAgACAAIAAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAKABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABGAHIAbwBtAEUAbABlAG0AZQBuAHQAIAAkAGUAbABlAG0AZQBuAHQAKQAKACAAIAB9AAoACgAgACAAaQBmACAAKAAkAGMAYQBuAGQAaQBkAGEAdABlAHMALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIAByAGUAdAB1AHIAbgAgACgAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBMAGUAbgBnAHQAaAAgAH0AIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAAoAfQAKAAoACgAKAHQAcgB5ACAAewAKAAoAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAgAD0AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIARgBvAHIAZQBnAHIAbwB1AG4AZABIAGEAbgBkAGwAZQAKAGkAZgAgACgAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAgAC0AZQBxACAAMAApACAAewAKACAAIAAkAHAAYQB5AGwAbwBhAGQAIAA9ACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsACgAgACAAIAAgAHAAcgBvAGMAZQBzAHMATgBhAG0AZQAgAD0AIAAkAG4AdQBsAGwACgAgACAAfQAKAH0AIABlAGwAcwBlACAAewAKACAAIAAkAHAAcgBvAGMAZQBzAHMASQBkACAAPQAgAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBQAHIAbwBjAGUAcwBzAEkAZABGAHIAbwBtAEgAYQBuAGQAbABlACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIAAkAHAAcgBvAGMAZQBzAHMAIAA9ACAAaQBmACAAKAAkAHAAcgBvAGMAZQBzAHMASQBkACAALQBlAHEAIAAwACkAIAB7ACAAJABuAHUAbABsACAAfQAgAGUAbABzAGUAIAB7ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBJAGQAIAAkAHAAcgBvAGMAZQBzAHMASQBkACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfQAKACAAIAAkAHAAYQB5AGwAbwBhAGQAIAA9ACAAWwBwAHMAYwB1AHMAdABvAG0AbwBiAGoAZQBjAHQAXQBAAHsACgAgACAAIAAgAHAAcgBvAGMAZQBzAHMATgBhAG0AZQAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAcAByAG8AYwBlAHMAcwAuAFAAcgBvAGMAZQBzAHMATgBhAG0AZQAKACAAIAB9AAoAfQAKAAoAJABwAGEAeQBsAG8AYQBkACAAfAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARABlAHAAdABoACAANgAgAC0AQwBvAG0AcAByAGUAcwBzAAoAIAAgACAAIAAgACAACgB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAkAG0AZQBzAHMAYQBnAGUAIAA9ACAAaQBmACAAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAgAC0AYQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQAgAHsACgAgACAAIAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACgAJABfACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAKQAuAFQAcgBpAG0AKAApAAoAIAAgAH0ACgAKACAAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAG0AZQBzAHMAYQBnAGUACgAgACAAZQB4AGkAdAAgADEACgB9AAoA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\larf2ter\larf2ter.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES576D.tmp" "c:\Users\Admin\AppData\Local\Temp\larf2ter\CSC17B5E50898394E58BA51D07563D1A2AC.TMP"
      4⤵
      PID:5804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYwBsAGEAcwBzACAAVABlAHIAbQBoAHUAYgBOAGEAdABpAHYAZQAgAHsACgAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKAAoAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEkAcwBJAGMAbwBuAGkAYwAoAEkAbgB0AFAAdAByACAAaABXAG4AZAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABXAGkAbgBkAG8AdwBUAGgAcgBlAGEAZABQAHIAbwBjAGUAcwBzAEkAZAAoAEkAbgB0AFAAdAByACAAaABXAG4AZAAsACAAbwB1AHQAIAB1AGkAbgB0ACAAcAByAG8AYwBlAHMAcwBJAGQAKQA7AAoAfQAKACIAQAAKAAoACgAKAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAKABbAG8AYgBqAGUAYwB0AF0AJAB2AGEAbAB1AGUAKQAgAHsACgAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAdgBhAGwAdQBlACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAJAB0AGUAeAB0ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAHYAYQBsAHUAZQAKACAAIABpAGYAIAAoAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAFcAaABpAHQAZQBTAHAAYQBjAGUAKAAkAHQAZQB4AHQAKQApACAAewAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAJAB0AGUAeAB0AC4AVAByAGkAbQAoACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIARgBvAHIAZQBnAHIAbwB1AG4AZABIAGEAbgBkAGwAZQAoACkAIAB7AAoAIAAgAHIAZQB0AHUAcgBuACAAWwBpAG4AdAA2ADQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAUAByAG8AYwBlAHMAcwBJAGQARgByAG8AbQBIAGEAbgBkAGwAZQAoAFsAaQBuAHQANgA0AF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACAAewAKACAAIABpAGYAIAAoACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAMAAKACAAIAB9AAoACgAgACAAWwB1AGkAbgB0ADMAMgBdACQAcAByAG8AYwBlAHMAcwBJAGQAIAA9ACAAMAAKACAAIABbAHYAbwBpAGQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKABbAEkAbgB0AFAAdAByAF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAsACAAWwByAGUAZgBdACQAcAByAG8AYwBlAHMAcwBJAGQAKQAKACAAIAByAGUAdAB1AHIAbgAgAFsAaQBuAHQAXQAkAHAAcgBvAGMAZQBzAHMASQBkAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAHQALQBUAGUAcgBtAGgAdQBiAEYAbwByAGUAZwByAG8AdQBuAGQAKABbAGkAbgB0ADYANABdACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAKQAgAHsACgAgACAAaQBmACAAKAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlAAoAIAAgAH0ACgAKACAAIABpAGYAIAAoAFsAVABlAHIAbQBoAHUAYgBOAGEAdABpAHYAZQBdADoAOgBJAHMASQBjAG8AbgBpAGMAKABbAEkAbgB0AFAAdAByAF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACkAIAB7AAoAIAAgACAAIABbAHYAbwBpAGQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoAUwBoAG8AdwBXAGkAbgBkAG8AdwAoAFsASQBuAHQAUAB0AHIAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACwAIAA5ACkACgAgACAAfQAKAAoAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA0ADAACgAgACAAJAByAGUAcwB1AGwAdAAgAD0AIABbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoAUwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoAFsASQBuAHQAUAB0AHIAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkACgAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADgAMAAKACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAdQBsAHQACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABGAGkAbgBkAC0AVABlAHIAbQBoAHUAYgBXAGkAbgBkAG8AdwBFAGwAZQBtAGUAbgB0AEIAeQBIAGEAbgBkAGwAZQAoAFsAaQBuAHQANgA0AF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACAAewAKACAAIAAkAGMAaABpAGwAZAByAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAHUAdABvAG0AYQB0AGkAbwBuAEUAbABlAG0AZQBuAHQAXQA6ADoAUgBvAG8AdABFAGwAZQBtAGUAbgB0AC4ARgBpAG4AZABBAGwAbAAoAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAZQBlAFMAYwBvAHAAZQBdADoAOgBDAGgAaQBsAGQAcgBlAG4ALAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQwBvAG4AZABpAHQAaQBvAG4AXQA6ADoAVAByAHUAZQBDAG8AbgBkAGkAdABpAG8AbgAKACAAIAApAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBsAGQAIABpAG4AIAAkAGMAaABpAGwAZAByAGUAbgApACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAaQBmACAAKABbAGkAbgB0ADYANABdACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAE4AYQB0AGkAdgBlAFcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABjAGgAaQBsAGQACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBUAGUAcgBtAGgAdQBiAFQAbwBwAEwAZQB2AGUAbABXAGkAbgBkAG8AdwBzACgAKQAgAHsACgAgACAAJABjAGgAaQBsAGQAcgBlAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQB1AHQAbwBtAGEAdABpAG8AbgBFAGwAZQBtAGUAbgB0AF0AOgA6AFIAbwBvAHQARQBsAGUAbQBlAG4AdAAuAEYAaQBuAGQAQQBsAGwAKAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGUAZQBTAGMAbwBwAGUAXQA6ADoAQwBoAGkAbABkAHIAZQBuACwACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBuAGQAaQB0AGkAbwBuAF0AOgA6AFQAcgB1AGUAQwBvAG4AZABpAHQAaQBvAG4ACgAgACAAKQAKAAoAIAAgACQAdwBpAG4AZABvAHcAcwAgAD0AIABAACgAKQAKAAoAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYwBoAGkAbABkACAAaQBuACAAJABjAGgAaQBsAGQAcgBlAG4AKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAA9ACAAWwBpAG4AdAA2ADQAXQAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBOAGEAdABpAHYAZQBXAGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIABjAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAdwBpAG4AZABvAHcAcwAgACsAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAA9ACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIAAgACAAIAAgAHAAcgBvAGMAZQBzAHMASQBkACAAPQAgAFsAaQBuAHQAXQAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBQAHIAbwBjAGUAcwBzAEkAZAAKACAAIAAgACAAIAAgAHQAaQB0AGwAZQAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAE4AYQBtAGUACgAgACAAIAAgACAAIABjAGwAYQBzAHMATgBhAG0AZQAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAEMAbABhAHMAcwBOAGEAbQBlAAoAIAAgACAAIAAgACAAYQB1AHQAbwBtAGEAdABpAG8AbgBJAGQAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAEkAZAAKACAAIAAgACAAfQAKACAAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIABAACgAJAB3AGkAbgBkAG8AdwBzACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIARQBsAGUAbQBlAG4AdABzACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACQAdwBpAG4AZABvAHcAIAA9ACAARgBpAG4AZAAtAFQAZQByAG0AaAB1AGIAVwBpAG4AZABvAHcARQBsAGUAbQBlAG4AdABCAHkASABhAG4AZABsAGUAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlAAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHcAaQBuAGQAbwB3ACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAEAAKAApAAoAIAAgAH0ACgAKACAAIAAkAGMAbwBuAGQAaQB0AGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUAByAG8AcABlAHIAdAB5AEMAbwBuAGQAaQB0AGkAbwBuACgACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ARQBsAGUAbQBlAG4AdABdADoAOgBDAG8AbgB0AHIAbwBsAFQAeQBwAGUAUAByAG8AcABlAHIAdAB5ACwACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBuAHQAcgBvAGwAVAB5AHAAZQBdADoAOgBUAGEAYgBJAHQAZQBtAAoAIAAgACkACgAKACAAIAAkAG0AYQB0AGMAaABlAHMAIAA9ACAAJAB3AGkAbgBkAG8AdwAuAEYAaQBuAGQAQQBsAGwAKAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGUAZQBTAGMAbwBwAGUAXQA6ADoARABlAHMAYwBlAG4AZABhAG4AdABzACwACgAgACAAIAAgACQAYwBvAG4AZABpAHQAaQBvAG4ACgAgACAAKQAKAAoAIAAgACQAaQB0AGUAbQBzACAAPQAgAEAAKAApAAoAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAaQB0AGUAbQAgAGkAbgAgACQAbQBhAHQAYwBoAGUAcwApACAAewAKACAAIAAgACAAJABpAHQAZQBtAHMAIAArAD0AIAAkAGkAdABlAG0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAQAAoACQAaQB0AGUAbQBzACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIASQBuAGYAbwBzACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACQAaQB0AGUAbQBzACAAPQAgAEAAKABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIARQBsAGUAbQBlAG4AdABzACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApAAoAIAAgACQAdABhAGIAcwAgAD0AIABAACgAKQAKACAAIAAkAGkAbgBkAGUAeAAgAD0AIAAwAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABpAHQAZQBtACAAaQBuACAAJABpAHQAZQBtAHMAKQAgAHsACgAgACAAIAAgACQAaQBuAGQAZQB4ACAAKwA9ACAAMQAKACAAIAAgACAAJABpAHMAUwBlAGwAZQBjAHQAZQBkACAAPQAgACQAZgBhAGwAcwBlAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAgAD0AIAAkAGkAdABlAG0ALgBHAGUAdABDAHUAcgByAGUAbgB0AFAAYQB0AHQAZQByAG4AKABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBTAGUAbABlAGMAdABpAG8AbgBJAHQAZQBtAFAAYQB0AHQAZQByAG4AXQA6ADoAUABhAHQAdABlAHIAbgApAAoAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACAAIAAkAGkAcwBTAGUAbABlAGMAdABlAGQAIAA9ACAAJABwAGEAdAB0AGUAcgBuAC4AQwB1AHIAcgBlAG4AdAAuAEkAcwBTAGUAbABlAGMAdABlAGQACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAKACAAIAAgACAAJAB0AGkAdABsAGUAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGkAdABlAG0ALgBDAHUAcgByAGUAbgB0AC4ATgBhAG0AZQAKACAAIAAgACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJAB0AGkAdABsAGUAKQApACAAewAKACAAIAAgACAAIAAgACQAdABpAHQAbABlACAAPQAgACIAVABhAGIAIAAkAGkAbgBkAGUAeAAiAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAdABhAGIAcwAgACsAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAdABhAGIASQBuAGQAZQB4ACAAPQAgACQAaQBuAGQAZQB4AAoAIAAgACAAIAAgACAAdABpAHQAbABlACAAPQAgACQAdABpAHQAbABlAAoAIAAgACAAIAAgACAAaQBzAEMAdQByAHIAZQBuAHQAIAA9ACAAJABpAHMAUwBlAGwAZQBjAHQAZQBkAAoAIAAgACAAIAAgACAAYQB1AHQAbwBtAGEAdABpAG8AbgBJAGQAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGkAdABlAG0ALgBDAHUAcgByAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgBJAGQACgAgACAAIAAgAH0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAQAAoACQAdABhAGIAcwApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAGwAZQBjAHQALQBUAGUAcgBtAGgAdQBiAFQAYQBiACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACwAIABbAGkAbgB0AF0AJAB0AGEAYgBJAG4AZABlAHgAKQAgAHsACgAgACAAJABpAHQAZQBtAHMAIAA9ACAAQAAoAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGEAYgBFAGwAZQBtAGUAbgB0AHMAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkACgAKACAAIABpAGYAIAAoACQAaQB0AGUAbQBzAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAdABhAGIASQBuAGQAZQB4ACAALQBlAHEAIAAxACkAIAB7AAoAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABTAGUAdAAtAFQAZQByAG0AaAB1AGIARgBvAHIAZQBnAHIAbwB1AG4AZAAgACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUACgAgACAAIAAgAH0ACgAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBTAGUAcwBzAGkAbwBuACAAbgBvAHQAIABmAG8AdQBuAGQAIgAKACAAIAB9AAoACgAgACAAaQBmACAAKAAkAHQAYQBiAEkAbgBkAGUAeAAgAC0AbAB0ACAAMQAgAC0AbwByACAAJAB0AGEAYgBJAG4AZABlAHgAIAAtAGcAdAAgACQAaQB0AGUAbQBzAC4AQwBvAHUAbgB0ACkAIAB7AAoAIAAgACAAIAB0AGgAcgBvAHcAIAAiAFMAZQBzAHMAaQBvAG4AIABuAG8AdAAgAGYAbwB1AG4AZAAiAAoAIAAgAH0ACgAKACAAIABbAHYAbwBpAGQAXQAoAFMAZQB0AC0AVABlAHIAbQBoAHUAYgBGAG8AcgBlAGcAcgBvAHUAbgBkACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApAAoAIAAgACQAdABhAHIAZwBlAHQAIAA9ACAAJABpAHQAZQBtAHMAWwAkAHQAYQBiAEkAbgBkAGUAeAAgAC0AIAAxAF0ACgAKACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAHQAdABlAHIAbgAgAD0AIAAkAHQAYQByAGcAZQB0AC4ARwBlAHQAQwB1AHIAcgBlAG4AdABQAGEAdAB0AGUAcgBuACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBlAGwAZQBjAHQAaQBvAG4ASQB0AGUAbQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAuAFMAZQBsAGUAYwB0ACgAKQAKACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAdABhAHIAZwBlAHQALgBHAGUAdABDAHUAcgByAGUAbgB0AFAAYQB0AHQAZQByAG4AKABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBJAG4AdgBvAGsAZQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAuAEkAbgB2AG8AawBlACgAKQAKACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAuAFMAZQB0AEYAbwBjAHUAcwAoACkACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAHQAcgB1AGUACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBsAGwAZQBjAHQAaQBvAG4AcwAuAEcAZQBuAGUAcgBpAGMALgBMAGkAcwB0AFsAcwB0AHIAaQBuAGcAXQBdACQAYwBhAG4AZABpAGQAYQB0AGUAcwAsACAAWwBzAHQAcgBpAG4AZwBdACQAdgBhAGwAdQBlACkAIAB7AAoAIAAgACQAdABlAHgAdAAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAdgBhAGwAdQBlAAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHQAZQB4AHQAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgAH0ACgAKACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMALgBDAG8AbgB0AGEAaQBuAHMAKAAkAHQAZQB4AHQAKQApACAAewAKACAAIAAgACAAJABjAGEAbgBkAGkAZABhAHQAZQBzAC4AQQBkAGQAKAAkAHQAZQB4AHQAKQAKACAAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQARgByAG8AbQBFAGwAZQBtAGUAbgB0ACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQB1AHQAbwBtAGEAdABpAG8AbgBFAGwAZQBtAGUAbgB0AF0AJABlAGwAZQBtAGUAbgB0ACkAIAB7AAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAGUAbABlAG0AZQBuAHQAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgACcAUwB5AHMAdABlAG0ALgBDAG8AbABsAGUAYwB0AGkAbwBuAHMALgBHAGUAbgBlAHIAaQBjAC4ATABpAHMAdABbAHMAdAByAGkAbgBnAF0AJwAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAZQBsAGUAbQBlAG4AdAAuAEcAZQB0AEMAdQByAHIAZQBuAHQAUABhAHQAdABlAHIAbgAoAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFQAZQB4AHQAUABhAHQAdABlAHIAbgBdADoAOgBQAGEAdAB0AGUAcgBuACkACgAgACAAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBuAGUAIAAkAHAAYQB0AHQAZQByAG4AKQAgAHsACgAgACAAIAAgACAAIABBAGQAZAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABDAGEAbgBkAGkAZABhAHQAZQAgACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgACgAJABwAGEAdAB0AGUAcgBuAC4ARABvAGMAdQBtAGUAbgB0AFIAYQBuAGcAZQAuAEcAZQB0AFQAZQB4AHQAKAAtADEAKQApAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAZQBsAGUAbQBlAG4AdAAuAEcAZQB0AEMAdQByAHIAZQBuAHQAUABhAHQAdABlAHIAbgAoAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFYAYQBsAHUAZQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAKAAkAHAAYQB0AHQAZQByAG4ALgBDAHUAcgByAGUAbgB0AC4AVgBhAGwAdQBlACkACgAgACAAIAAgAH0ACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoACgAgACAAdAByAHkAIAB7AAoAIAAgACAAIABBAGQAZAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABDAGEAbgBkAGkAZABhAHQAZQAgACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgACQAZQBsAGUAbQBlAG4AdAAuAEMAdQByAHIAZQBuAHQALgBOAGEAbQBlAAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAGkAZgAgACgAJABjAGEAbgBkAGkAZABhAHQAZQBzAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIAAoACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATABlAG4AZwB0AGgAIAB9ACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEYAcgBvAG0ASABhAG4AZABsAGUAKABbAGkAbgB0ADYANABdACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAKQAgAHsACgAgACAAJAByAG8AbwB0ACAAPQAgAEYAaQBuAGQALQBUAGUAcgBtAGgAdQBiAFcAaQBuAGQAbwB3AEUAbABlAG0AZQBuAHQAQgB5AEgAYQBuAGQAbABlACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AZQBxACAAJAByAG8AbwB0ACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAnAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwAuAEwAaQBzAHQAWwBzAHQAcgBpAG4AZwBdACcACgAgACAAQQBkAGQALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAQwBhAG4AZABpAGQAYQB0AGUAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMAIAAoAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEYAcgBvAG0ARQBsAGUAbQBlAG4AdAAgACQAcgBvAG8AdAApAAoACgAgACAAJABlAGwAZQBtAGUAbgB0AHMAIAA9ACAAJAByAG8AbwB0AC4ARgBpAG4AZABBAGwAbAAoAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAZQBlAFMAYwBvAHAAZQBdADoAOgBEAGUAcwBjAGUAbgBkAGEAbgB0AHMALAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQwBvAG4AZABpAHQAaQBvAG4AXQA6ADoAVAByAHUAZQBDAG8AbgBkAGkAdABpAG8AbgAKACAAIAApAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABlAGwAZQBtAGUAbgB0ACAAaQBuACAAJABlAGwAZQBtAGUAbgB0AHMAKQAgAHsACgAgACAAIAAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAKABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABGAHIAbwBtAEUAbABlAG0AZQBuAHQAIAAkAGUAbABlAG0AZQBuAHQAKQAKACAAIAB9AAoACgAgACAAaQBmACAAKAAkAGMAYQBuAGQAaQBkAGEAdABlAHMALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIAByAGUAdAB1AHIAbgAgACgAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBMAGUAbgBnAHQAaAAgAH0AIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAAoAfQAKAAoACgAKAHQAcgB5ACAAewAKAAoAJABwAGEAeQBsAG8AYQBkACAAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgAHIAdQBuAG4AaQBuAGcAIAA9ACAAKABAACgARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAQAAoACcAVwBpAG4AZABvAHcAcwBUAGUAcgBtAGkAbgBhAGwAJwAsACAAJwBXAGkAbgBkAG8AdwBzAFQAZQByAG0AaQBuAGEAbABQAHIAZQB2AGkAZQB3ACcAKQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApACkALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAACgB9AAoACgAkAHAAYQB5AGwAbwBhAGQAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBEAGUAcAB0AGgAIAA2ACAALQBDAG8AbQBwAHIAZQBzAHMACgAgACAAIAAgAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAJABtAGUAcwBzAGEAZwBlACAAPQAgAGkAZgAgACgAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4AIAAtAGEAbgBkACAAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACkAIAB7AAoAIAAgACAAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUACgAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAoACQAXwAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACkALgBUAHIAaQBtACgAKQAKACAAIAB9AAoACgAgACAAVwByAGkAdABlAC0ARQByAHIAbwByACAAJABtAGUAcwBzAGEAZwBlAAoAIAAgAGUAeABpAHQAIAAxAAoAfQAKAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xwkeeq4w\xwkeeq4w.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EEF.tmp" "c:\Users\Admin\AppData\Local\Temp\xwkeeq4w\CSCFA920D78A7784ECABB1C37D54337E0C3.TMP"
      4⤵
      PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAYwBsAGEAcwBzACAAVABlAHIAbQBoAHUAYgBOAGEAdABpAHYAZQAgAHsACgAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKAAoAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEkAcwBJAGMAbwBuAGkAYwAoAEkAbgB0AFAAdAByACAAaABXAG4AZAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABXAGkAbgBkAG8AdwBUAGgAcgBlAGEAZABQAHIAbwBjAGUAcwBzAEkAZAAoAEkAbgB0AFAAdAByACAAaABXAG4AZAAsACAAbwB1AHQAIAB1AGkAbgB0ACAAcAByAG8AYwBlAHMAcwBJAGQAKQA7AAoAfQAKACIAQAAKAAoACgAKAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAKABbAG8AYgBqAGUAYwB0AF0AJAB2AGEAbAB1AGUAKQAgAHsACgAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAdgBhAGwAdQBlACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAJAB0AGUAeAB0ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAkAHYAYQBsAHUAZQAKACAAIABpAGYAIAAoAFsAcwB0AHIAaQBuAGcAXQA6ADoASQBzAE4AdQBsAGwATwByAFcAaABpAHQAZQBTAHAAYQBjAGUAKAAkAHQAZQB4AHQAKQApACAAewAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAJAB0AGUAeAB0AC4AVAByAGkAbQAoACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIARgBvAHIAZQBnAHIAbwB1AG4AZABIAGEAbgBkAGwAZQAoACkAIAB7AAoAIAAgAHIAZQB0AHUAcgBuACAAWwBpAG4AdAA2ADQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoARwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAUAByAG8AYwBlAHMAcwBJAGQARgByAG8AbQBIAGEAbgBkAGwAZQAoAFsAaQBuAHQANgA0AF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACAAewAKACAAIABpAGYAIAAoACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAMAAKACAAIAB9AAoACgAgACAAWwB1AGkAbgB0ADMAMgBdACQAcAByAG8AYwBlAHMAcwBJAGQAIAA9ACAAMAAKACAAIABbAHYAbwBpAGQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKABbAEkAbgB0AFAAdAByAF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAsACAAWwByAGUAZgBdACQAcAByAG8AYwBlAHMAcwBJAGQAKQAKACAAIAByAGUAdAB1AHIAbgAgAFsAaQBuAHQAXQAkAHAAcgBvAGMAZQBzAHMASQBkAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAHQALQBUAGUAcgBtAGgAdQBiAEYAbwByAGUAZwByAG8AdQBuAGQAKABbAGkAbgB0ADYANABdACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAKQAgAHsACgAgACAAaQBmACAAKAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlAAoAIAAgAH0ACgAKACAAIABpAGYAIAAoAFsAVABlAHIAbQBoAHUAYgBOAGEAdABpAHYAZQBdADoAOgBJAHMASQBjAG8AbgBpAGMAKABbAEkAbgB0AFAAdAByAF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACkAIAB7AAoAIAAgACAAIABbAHYAbwBpAGQAXQBbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoAUwBoAG8AdwBXAGkAbgBkAG8AdwAoAFsASQBuAHQAUAB0AHIAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACwAIAA5ACkACgAgACAAfQAKAAoAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA0ADAACgAgACAAJAByAGUAcwB1AGwAdAAgAD0AIABbAFQAZQByAG0AaAB1AGIATgBhAHQAaQB2AGUAXQA6ADoAUwBlAHQARgBvAHIAZQBnAHIAbwB1AG4AZABXAGkAbgBkAG8AdwAoAFsASQBuAHQAUAB0AHIAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkACgAgACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADgAMAAKACAAIAByAGUAdAB1AHIAbgAgACQAcgBlAHMAdQBsAHQACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABGAGkAbgBkAC0AVABlAHIAbQBoAHUAYgBXAGkAbgBkAG8AdwBFAGwAZQBtAGUAbgB0AEIAeQBIAGEAbgBkAGwAZQAoAFsAaQBuAHQANgA0AF0AJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApACAAewAKACAAIAAkAGMAaABpAGwAZAByAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAHUAdABvAG0AYQB0AGkAbwBuAEUAbABlAG0AZQBuAHQAXQA6ADoAUgBvAG8AdABFAGwAZQBtAGUAbgB0AC4ARgBpAG4AZABBAGwAbAAoAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAZQBlAFMAYwBvAHAAZQBdADoAOgBDAGgAaQBsAGQAcgBlAG4ALAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQwBvAG4AZABpAHQAaQBvAG4AXQA6ADoAVAByAHUAZQBDAG8AbgBkAGkAdABpAG8AbgAKACAAIAApAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBsAGQAIABpAG4AIAAkAGMAaABpAGwAZAByAGUAbgApACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAaQBmACAAKABbAGkAbgB0ADYANABdACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAE4AYQB0AGkAdgBlAFcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABjAGgAaQBsAGQACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBUAGUAcgBtAGgAdQBiAFQAbwBwAEwAZQB2AGUAbABXAGkAbgBkAG8AdwBzACgAKQAgAHsACgAgACAAJABjAGgAaQBsAGQAcgBlAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQB1AHQAbwBtAGEAdABpAG8AbgBFAGwAZQBtAGUAbgB0AF0AOgA6AFIAbwBvAHQARQBsAGUAbQBlAG4AdAAuAEYAaQBuAGQAQQBsAGwAKAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGUAZQBTAGMAbwBwAGUAXQA6ADoAQwBoAGkAbABkAHIAZQBuACwACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBuAGQAaQB0AGkAbwBuAF0AOgA6AFQAcgB1AGUAQwBvAG4AZABpAHQAaQBvAG4ACgAgACAAKQAKAAoAIAAgACQAdwBpAG4AZABvAHcAcwAgAD0AIABAACgAKQAKAAoAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAYwBoAGkAbABkACAAaQBuACAAJABjAGgAaQBsAGQAcgBlAG4AKQAgAHsACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAA9ACAAWwBpAG4AdAA2ADQAXQAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBOAGEAdABpAHYAZQBXAGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIABjAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAAgACAAYwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAdwBpAG4AZABvAHcAcwAgACsAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAdwBpAG4AZABvAHcASABhAG4AZABsAGUAIAA9ACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIAAgACAAIAAgAHAAcgBvAGMAZQBzAHMASQBkACAAPQAgAFsAaQBuAHQAXQAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBQAHIAbwBjAGUAcwBzAEkAZAAKACAAIAAgACAAIAAgAHQAaQB0AGwAZQAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAE4AYQBtAGUACgAgACAAIAAgACAAIABjAGwAYQBzAHMATgBhAG0AZQAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAYwBoAGkAbABkAC4AQwB1AHIAcgBlAG4AdAAuAEMAbABhAHMAcwBOAGEAbQBlAAoAIAAgACAAIAAgACAAYQB1AHQAbwBtAGEAdABpAG8AbgBJAGQAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGMAaABpAGwAZAAuAEMAdQByAHIAZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAEkAZAAKACAAIAAgACAAfQAKACAAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIABAACgAJAB3AGkAbgBkAG8AdwBzACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIARQBsAGUAbQBlAG4AdABzACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACQAdwBpAG4AZABvAHcAIAA9ACAARgBpAG4AZAAtAFQAZQByAG0AaAB1AGIAVwBpAG4AZABvAHcARQBsAGUAbQBlAG4AdABCAHkASABhAG4AZABsAGUAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlAAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHcAaQBuAGQAbwB3ACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAEAAKAApAAoAIAAgAH0ACgAKACAAIAAkAGMAbwBuAGQAaQB0AGkAbwBuACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUAByAG8AcABlAHIAdAB5AEMAbwBuAGQAaQB0AGkAbwBuACgACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ARQBsAGUAbQBlAG4AdABdADoAOgBDAG8AbgB0AHIAbwBsAFQAeQBwAGUAUAByAG8AcABlAHIAdAB5ACwACgAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEMAbwBuAHQAcgBvAGwAVAB5AHAAZQBdADoAOgBUAGEAYgBJAHQAZQBtAAoAIAAgACkACgAKACAAIAAkAG0AYQB0AGMAaABlAHMAIAA9ACAAJAB3AGkAbgBkAG8AdwAuAEYAaQBuAGQAQQBsAGwAKAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGUAZQBTAGMAbwBwAGUAXQA6ADoARABlAHMAYwBlAG4AZABhAG4AdABzACwACgAgACAAIAAgACQAYwBvAG4AZABpAHQAaQBvAG4ACgAgACAAKQAKAAoAIAAgACQAaQB0AGUAbQBzACAAPQAgAEAAKAApAAoAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAaQB0AGUAbQAgAGkAbgAgACQAbQBhAHQAYwBoAGUAcwApACAAewAKACAAIAAgACAAJABpAHQAZQBtAHMAIAArAD0AIAAkAGkAdABlAG0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAQAAoACQAaQB0AGUAbQBzACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIASQBuAGYAbwBzACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkAIAB7AAoAIAAgACQAaQB0AGUAbQBzACAAPQAgAEAAKABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABhAGIARQBsAGUAbQBlAG4AdABzACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApAAoAIAAgACQAdABhAGIAcwAgAD0AIABAACgAKQAKACAAIAAkAGkAbgBkAGUAeAAgAD0AIAAwAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABpAHQAZQBtACAAaQBuACAAJABpAHQAZQBtAHMAKQAgAHsACgAgACAAIAAgACQAaQBuAGQAZQB4ACAAKwA9ACAAMQAKACAAIAAgACAAJABpAHMAUwBlAGwAZQBjAHQAZQBkACAAPQAgACQAZgBhAGwAcwBlAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAgAD0AIAAkAGkAdABlAG0ALgBHAGUAdABDAHUAcgByAGUAbgB0AFAAYQB0AHQAZQByAG4AKABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBTAGUAbABlAGMAdABpAG8AbgBJAHQAZQBtAFAAYQB0AHQAZQByAG4AXQA6ADoAUABhAHQAdABlAHIAbgApAAoAIAAgACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACAAIAAkAGkAcwBTAGUAbABlAGMAdABlAGQAIAA9ACAAJABwAGEAdAB0AGUAcgBuAC4AQwB1AHIAcgBlAG4AdAAuAEkAcwBTAGUAbABlAGMAdABlAGQACgAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAKACAAIAAgACAAJAB0AGkAdABsAGUAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGkAdABlAG0ALgBDAHUAcgByAGUAbgB0AC4ATgBhAG0AZQAKACAAIAAgACAAaQBmACAAKABbAHMAdAByAGkAbgBnAF0AOgA6AEkAcwBOAHUAbABsAE8AcgBXAGgAaQB0AGUAUwBwAGEAYwBlACgAJAB0AGkAdABsAGUAKQApACAAewAKACAAIAAgACAAIAAgACQAdABpAHQAbABlACAAPQAgACIAVABhAGIAIAAkAGkAbgBkAGUAeAAiAAoAIAAgACAAIAB9AAoACgAgACAAIAAgACQAdABhAGIAcwAgACsAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgACAAIAAgACAAdABhAGIASQBuAGQAZQB4ACAAPQAgACQAaQBuAGQAZQB4AAoAIAAgACAAIAAgACAAdABpAHQAbABlACAAPQAgACQAdABpAHQAbABlAAoAIAAgACAAIAAgACAAaQBzAEMAdQByAHIAZQBuAHQAIAA9ACAAJABpAHMAUwBlAGwAZQBjAHQAZQBkAAoAIAAgACAAIAAgACAAYQB1AHQAbwBtAGEAdABpAG8AbgBJAGQAIAA9ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAIAAkAGkAdABlAG0ALgBDAHUAcgByAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgBJAGQACgAgACAAIAAgAH0ACgAgACAAfQAKAAoAIAAgAHIAZQB0AHUAcgBuACAAQAAoACQAdABhAGIAcwApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAUwBlAGwAZQBjAHQALQBUAGUAcgBtAGgAdQBiAFQAYQBiACgAWwBpAG4AdAA2ADQAXQAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACwAIABbAGkAbgB0AF0AJAB0AGEAYgBJAG4AZABlAHgAKQAgAHsACgAgACAAJABpAHQAZQBtAHMAIAA9ACAAQAAoAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGEAYgBFAGwAZQBtAGUAbgB0AHMAIAAkAHcAaQBuAGQAbwB3AEgAYQBuAGQAbABlACkACgAKACAAIABpAGYAIAAoACQAaQB0AGUAbQBzAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAdABhAGIASQBuAGQAZQB4ACAALQBlAHEAIAAxACkAIAB7AAoAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIABTAGUAdAAtAFQAZQByAG0AaAB1AGIARgBvAHIAZQBnAHIAbwB1AG4AZAAgACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUACgAgACAAIAAgAH0ACgAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBTAGUAcwBzAGkAbwBuACAAbgBvAHQAIABmAG8AdQBuAGQAIgAKACAAIAB9AAoACgAgACAAaQBmACAAKAAkAHQAYQBiAEkAbgBkAGUAeAAgAC0AbAB0ACAAMQAgAC0AbwByACAAJAB0AGEAYgBJAG4AZABlAHgAIAAtAGcAdAAgACQAaQB0AGUAbQBzAC4AQwBvAHUAbgB0ACkAIAB7AAoAIAAgACAAIAB0AGgAcgBvAHcAIAAiAFMAZQBzAHMAaQBvAG4AIABuAG8AdAAgAGYAbwB1AG4AZAAiAAoAIAAgAH0ACgAKACAAIABbAHYAbwBpAGQAXQAoAFMAZQB0AC0AVABlAHIAbQBoAHUAYgBGAG8AcgBlAGcAcgBvAHUAbgBkACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQApAAoAIAAgACQAdABhAHIAZwBlAHQAIAA9ACAAJABpAHQAZQBtAHMAWwAkAHQAYQBiAEkAbgBkAGUAeAAgAC0AIAAxAF0ACgAKACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACQAcABhAHQAdABlAHIAbgAgAD0AIAAkAHQAYQByAGcAZQB0AC4ARwBlAHQAQwB1AHIAcgBlAG4AdABQAGEAdAB0AGUAcgBuACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBlAGwAZQBjAHQAaQBvAG4ASQB0AGUAbQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAuAFMAZQBsAGUAYwB0ACgAKQAKACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAdABhAHIAZwBlAHQALgBHAGUAdABDAHUAcgByAGUAbgB0AFAAYQB0AHQAZQByAG4AKABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBJAG4AdgBvAGsAZQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgACQAcABhAHQAdABlAHIAbgAuAEkAbgB2AG8AawBlACgAKQAKACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAuAFMAZQB0AEYAbwBjAHUAcwAoACkACgAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADIAMAAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAHQAcgB1AGUACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBsAGwAZQBjAHQAaQBvAG4AcwAuAEcAZQBuAGUAcgBpAGMALgBMAGkAcwB0AFsAcwB0AHIAaQBuAGcAXQBdACQAYwBhAG4AZABpAGQAYQB0AGUAcwAsACAAWwBzAHQAcgBpAG4AZwBdACQAdgBhAGwAdQBlACkAIAB7AAoAIAAgACQAdABlAHgAdAAgAD0AIABDAG8AbgB2AGUAcgB0AFQAbwAtAFQAZQByAG0AaAB1AGIAVABlAHgAdAAgACQAdgBhAGwAdQBlAAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHQAZQB4AHQAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgAH0ACgAKACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMALgBDAG8AbgB0AGEAaQBuAHMAKAAkAHQAZQB4AHQAKQApACAAewAKACAAIAAgACAAJABjAGEAbgBkAGkAZABhAHQAZQBzAC4AQQBkAGQAKAAkAHQAZQB4AHQAKQAKACAAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQARgByAG8AbQBFAGwAZQBtAGUAbgB0ACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQB1AHQAbwBtAGEAdABpAG8AbgBFAGwAZQBtAGUAbgB0AF0AJABlAGwAZQBtAGUAbgB0ACkAIAB7AAoAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAGUAbABlAG0AZQBuAHQAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgACcAUwB5AHMAdABlAG0ALgBDAG8AbABsAGUAYwB0AGkAbwBuAHMALgBHAGUAbgBlAHIAaQBjAC4ATABpAHMAdABbAHMAdAByAGkAbgBnAF0AJwAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAZQBsAGUAbQBlAG4AdAAuAEcAZQB0AEMAdQByAHIAZQBuAHQAUABhAHQAdABlAHIAbgAoAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFQAZQB4AHQAUABhAHQAdABlAHIAbgBdADoAOgBQAGEAdAB0AGUAcgBuACkACgAgACAAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBuAGUAIAAkAHAAYQB0AHQAZQByAG4AKQAgAHsACgAgACAAIAAgACAAIABBAGQAZAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABDAGEAbgBkAGkAZABhAHQAZQAgACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgACgAJABwAGEAdAB0AGUAcgBuAC4ARABvAGMAdQBtAGUAbgB0AFIAYQBuAGcAZQAuAEcAZQB0AFQAZQB4AHQAKAAtADEAKQApAAoAIAAgACAAIAB9AAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAJABwAGEAdAB0AGUAcgBuACAAPQAgACQAZQBsAGUAbQBlAG4AdAAuAEcAZQB0AEMAdQByAHIAZQBuAHQAUABhAHQAdABlAHIAbgAoAFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAFYAYQBsAHUAZQBQAGEAdAB0AGUAcgBuAF0AOgA6AFAAYQB0AHQAZQByAG4AKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAcABhAHQAdABlAHIAbgApACAAewAKACAAIAAgACAAIAAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAKAAkAHAAYQB0AHQAZQByAG4ALgBDAHUAcgByAGUAbgB0AC4AVgBhAGwAdQBlACkACgAgACAAIAAgAH0ACgAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoACgAgACAAdAByAHkAIAB7AAoAIAAgACAAIABBAGQAZAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABDAGEAbgBkAGkAZABhAHQAZQAgACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgACQAZQBsAGUAbQBlAG4AdAAuAEMAdQByAHIAZQBuAHQALgBOAGEAbQBlAAoAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKAAoAIAAgAGkAZgAgACgAJABjAGEAbgBkAGkAZABhAHQAZQBzAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAcgBlAHQAdQByAG4AIAAoACQAYwBhAG4AZABpAGQAYQB0AGUAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ATABlAG4AZwB0AGgAIAB9ACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAKQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEYAcgBvAG0ASABhAG4AZABsAGUAKABbAGkAbgB0ADYANABdACQAdwBpAG4AZABvAHcASABhAG4AZABsAGUAKQAgAHsACgAgACAAJAByAG8AbwB0ACAAPQAgAEYAaQBuAGQALQBUAGUAcgBtAGgAdQBiAFcAaQBuAGQAbwB3AEUAbABlAG0AZQBuAHQAQgB5AEgAYQBuAGQAbABlACAAJAB3AGkAbgBkAG8AdwBIAGEAbgBkAGwAZQAKACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AZQBxACAAJAByAG8AbwB0ACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAnAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwAuAEwAaQBzAHQAWwBzAHQAcgBpAG4AZwBdACcACgAgACAAQQBkAGQALQBUAGUAcgBtAGgAdQBiAFQAZQB4AHQAQwBhAG4AZABpAGQAYQB0AGUAIAAkAGMAYQBuAGQAaQBkAGEAdABlAHMAIAAoAEcAZQB0AC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEYAcgBvAG0ARQBsAGUAbQBlAG4AdAAgACQAcgBvAG8AdAApAAoACgAgACAAJABlAGwAZQBtAGUAbgB0AHMAIAA9ACAAJAByAG8AbwB0AC4ARgBpAG4AZABBAGwAbAAoAAoAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBUAHIAZQBlAFMAYwBvAHAAZQBdADoAOgBEAGUAcwBjAGUAbgBkAGEAbgB0AHMALAAKACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQwBvAG4AZABpAHQAaQBvAG4AXQA6ADoAVAByAHUAZQBDAG8AbgBkAGkAdABpAG8AbgAKACAAIAApAAoACgAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABlAGwAZQBtAGUAbgB0ACAAaQBuACAAJABlAGwAZQBtAGUAbgB0AHMAKQAgAHsACgAgACAAIAAgAEEAZABkAC0AVABlAHIAbQBoAHUAYgBUAGUAeAB0AEMAYQBuAGQAaQBkAGEAdABlACAAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAKABHAGUAdAAtAFQAZQByAG0AaAB1AGIAVABlAHgAdABGAHIAbwBtAEUAbABlAG0AZQBuAHQAIAAkAGUAbABlAG0AZQBuAHQAKQAKACAAIAB9AAoACgAgACAAaQBmACAAKAAkAGMAYQBuAGQAaQBkAGEAdABlAHMALgBDAG8AdQBuAHQAIAAtAGUAcQAgADAAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIAByAGUAdAB1AHIAbgAgACgAJABjAGEAbgBkAGkAZABhAHQAZQBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBMAGUAbgBnAHQAaAAgAH0AIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQApAAoAfQAKAAoACgAKAHQAcgB5ACAAewAKAAoAJABwAGEAeQBsAG8AYQBkACAAPQAgAFsAcABzAGMAdQBzAHQAbwBtAG8AYgBqAGUAYwB0AF0AQAB7AAoAIAAgAHIAdQBuAG4AaQBuAGcAIAA9ACAAKABAACgARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJwBjAG0AZAAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAKQAuAEMAbwB1AG4AdAAgAC0AZwB0ACAAMAAKAH0ACgAKACQAcABhAHkAbABvAGEAZAAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEQAZQBwAHQAaAAgADYAIAAtAEMAbwBtAHAAcgBlAHMAcwAKACAAIAAgACAACgB9ACAAYwBhAHQAYwBoACAAewAKACAAIAAkAG0AZQBzAHMAYQBnAGUAIAA9ACAAaQBmACAAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAgAC0AYQBuAGQAIAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQAgAHsACgAgACAAIAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAKACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACgAJABfACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAKQAuAFQAcgBpAG0AKAApAAoAIAAgAH0ACgAKACAAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAkAG0AZQBzAHMAYQBnAGUACgAgACAAZQB4AGkAdAAgADEACgB9AAoA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vufmjyds\vufmjyds.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7248.tmp" "c:\Users\Admin\AppData\Local\Temp\vufmjyds\CSC91191F3C902A49558EEB4D5E4944DE61.TMP"
      4⤵
      PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 280ada7d9baed43256342ef30e7976b918ae1ecb276f65a5e93fa57ce03ebab0
MD5 8f6e2842e1d2938845f44f759dbef53e
SHA1 6890e0cd0fea514ba0c95a52687443adca1b7a7e
SHA512 0b4e064b99359fd18071e6face2ececc86df438de5b1f5cd24258ef1a2568a6d36d062452b7751e5b2e9638d3a6b563a46a82a60eccde36dba7d94c6ccd14522
TLSH
T18131C83BB3CC46D5C86E443A00CA980432F686DBC0EEDE9BB780C554686F6C4DE68A50
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3fd4c66af5315bae6c19936a9ee14aba7f2e8d32c9a359f2832f0ab394a1d771
MD5 49fd4ff84a2e31c4cc8f84f2fc060dca
SHA1 2b961e6b5332e939da39c1f383e57adfdedb3649
SHA512 294853b170dd119a9b4ad640e1ff7bb9c44b616cbfa85aeb5a3440e330419f2008da20d82fc18ef7eb5e0f2353cc75040da6c72bbb391eadcf219ec01e5bea79
TLSH
T18F31ED3BB3CD86A5C899483A50CDAC1032B5C7DB87DEDF9BB780C458B96FA84DA64050
MD5 SHA1 SHA512 TLSH

Submit Download

RES576D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES576D.tmp
Size 1KB
SHA256 9c3e577ab3b3f6542079c7dd9b6fd288738b6dfdb17dfd9a03dd5cbdbe51a54b
MD5 717ed8d0b7f998092ce6cdf0954cddc2
SHA1 0702a588b55f7d7c1ded81db5125d50584ea982d
SHA512 338632f31dd90eb7955ef8484559bbaee42c321c6988336496bf051b0f42e47872b27b8f48ae2fca0ae3dab71995fed8815022cb05d3dbd56d341d531793fcf7
TLSH
T110218C0993E9471FF0B35731A9FA072FA275FD68EFA6935A9584026C2C51104EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES5EEF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5EEF.tmp
Size 1KB
SHA256 00a6b1c4fffd5b2e5fcd5a1177455e03dd6f70c393cd96d629854aa34a9a6ed9
MD5 3555fb99950d7abaf6e484ec37758126
SHA1 fdbed750a118f0675d6c8ba127902cdc900d0bda
SHA512 8d795dc4e338dca8f40127c287cf301116a42e3073be7d0700ed231af197b0306914765e0ee4732efcfe5e3ba9a7e066d8dc9fc6990f2b4f2be125b854b49b02
TLSH
T15E21890597EA471FF0774732B9FA272F9674FD64EFA2A79F4540422C2842144EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES7248.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7248.tmp
Size 1KB
SHA256 bf7d2c0b2e35286fc7b64a42cccc8f155569ce46d9db3c38cdc146fd7ad8f836
MD5 1cd482e449acd8e226c44ca4d518c8b3
SHA1 78ad6d6857ece022f5ef9fcc78a2a7bc7050f4f3
SHA512 3fba61e75349c94e6b0918a5cc551030a12fc9df35fc0b89331c1b595eae17fcb209f1d78884f981b331c2138989cdb0ca8fd5e42056055f3ea178d3d844f8e5
TLSH
T183216A0593E84B5EF0731B32BDF6072F9234FDA4AFA2A75A454442282C51118EEF0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3fn15hi2.ma2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3fn15hi2.ma2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

larf2ter.dll

Path C:\Users\Admin\AppData\Local\Temp\larf2ter\larf2ter.dll
Size 3KB
SHA256 0b25413a658ee30e0d666fa129101bc6066ccdd26fc09f5a218f51a5565bbcf9
MD5 6cba4440c54465b2cb57deb5cad31bb5
SHA1 b574e76caa32650463b316eb891ffed459a1be70
SHA512 2e977a77cf734df3c8ead2afddcd0bd2d95de8b25d30b395c2d7b8d08cd2f7fdcad12fccb7d802e0a36010569f5c7c4eace11b60a573d46bc23d3ae26e93b803
TLSH
T1CD71BB1AD7E84566E0BB0734AEF3172A63B4FC509B7347AF199042296DA12244A31FF1
MD5 SHA1 SHA512 TLSH

Submit Download

vufmjyds.dll

Path C:\Users\Admin\AppData\Local\Temp\vufmjyds\vufmjyds.dll
Size 3KB
SHA256 11c13700ce3bea220fa6cbf6d846742c8323a9d293fea2d5435d0565d829ae30
MD5 8126ec56c1150aec5f9d8fa86dc0c4e6
SHA1 b7d451c92b689661a3f1f73e26f3e193e09146f3
SHA512 c19122ce6e57b867fd064590aff0f4f21009a208b0bec620e800b359e51173ccccf7ebd3690edf7868d0a53972a0b3d9202e35d4382ae941df2114603bc7588a
TLSH
T1BB71ED2AD7E84567E4BB0734ADF3172663B4F8509BB347BE199082286CA52204E31FF1
MD5 SHA1 SHA512 TLSH

Submit Download

xwkeeq4w.dll

Path C:\Users\Admin\AppData\Local\Temp\xwkeeq4w\xwkeeq4w.dll
Size 3KB
SHA256 0b44c456399293884cadeda3f468bfe7dbbc0ace24a268618d4c0079395cfdbc
MD5 39e51fb64c1db7a0970d34c8337dc411
SHA1 cc9748e6a76d39244802b280a94be13c44db206f
SHA512 43d3473b4a9d896fd05367ab103d304baa771df6c123daa2a43a0d9084e5f33027f8e71d004b66b00faa1f3b3b6b949db229900cef77c86ba4d6d0f5e804df88
TLSH
T19871CD1BDBE84667E4BB4734ADF3172A67B4F8509BB357AF199042286C912204A31FF1
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 1f8e4a3feae1d016210ad8c605eef1277e6029ab199fe34f575b44a1ea02a42d
MD5 ff79a7330b904bbc0f2e8efb0a59003d
SHA1 29c2081665f87dae18357d50eda9d5a7a8173e72
SHA512 c679ee81e6748b10ae68a4bbea0ab9a87d16437752e9a0b02eb7b8f61a30fd4145fd92bd03b11c38bf7679df58e394b00f9a0e73651cd9fae046022ae2300c7f
SSDEEP 96:DwEpCttTFukvhkvCCtx2eDeNFE0BQHj2taFE0BQHj2tu:UEYNcx2cMFE0Ba2taFE0Ba2tu
TLSH
T162D1CD1063F6421AF5B68E7A6CB57321A636FC02EF07DBDE0240551DAD70615F83876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 2ebc95adb997def565cdbcc6a47485f8c4a4d48576752ba137dc1672eb2304da
MD5 f658077bd7c983a03653237274787b3c
SHA1 6d507c3e96a10181f6b4ce34083bad549a082f73
SHA512 e9dfe44b7ff8ee27c80273cb9bcf28b004c7f2d80cb6ebfa2316351dfe26bf22087c5a4df8351cbb636b8076b993b306ec20f2b9806c9c75b9da4b05b76f12ed
SSDEEP 96:DXkMg0tChImFukvhkvCCtx2eDeNFE01QHj2taFE0BQHj2tu:bkMg0w/cx2cMFE01a2taFE0Ba2tu
TLSH
T108D1DF1023F6421AF5B68E7A6CB57321A236FC01EF17DBDE0240951DAC70625F83872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 064a7f041e34e6e2d4f9ba8be90dce717bdf7c0339e43c3eb115b9c1408734fa
MD5 aba4a539b3eb4190465118a7a9183d80
SHA1 5ba180820a219be8f32442d2381a95acbd965988
SHA512 133a59766f0d03bdbf5cc6e8a2e318054e095fb1fd26d9edac7c53f18ebb781579b1eba641b24213f62b9f7f14836c8c0cce6276714eb84854d2503b42d2edd8
SSDEEP 96:DDEpCttTFukvhkvCCtx2eDeNFE0BQHj2taFE0BQHj2tu:HEYNcx2cMFE0Ba2taFE0Ba2tu
TLSH
T1D7D1CD1063F6421AE5B68E7A6CB57321A636FC02EF07DBDE0240951DAD70615F83876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC17B5E50898394E58BA51D07563D1A2AC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\larf2ter\CSC17B5E50898394E58BA51D07563D1A2AC.TMP
Size 652B
SHA256 914b120305c4b4b2b8de5d3f451b5106cae3d6d2020423c6f8d763380aeae90e
MD5 d6af95c32d7abd89bc9b56e2bfe28e1c
SHA1 03a98bc5a66815f1179e32713a6435e7e66bc19e
SHA512 c6813b2152e8981f35bcf837ae2d96a6064fc9c6466ff35be2773d9ca3d4f4b4f1febff05fc4dd08b2a77701da1484fedbb5cfb9c9f080a268e640fd16989c0d
TLSH
T13EF03A0963F8020AF0F34B70BDF6436791A8BC64DE3693ED1980035D2C745109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

larf2ter.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\larf2ter\larf2ter.0.cs
Size 557B
SHA256 e657ad425988002fa8f670f51ac726004d2a206bbd018551a5ec3ae75b19b6ab
MD5 79bac02aeba563bd0ac01d8465e569c6
SHA1 71e027d914e2f6e306bb92f7e43eb235fe20d9fe
SHA512 8d8f601652ffd18e022a9ac4bc1fca36a63e5267af8665b76cbdcc1614070acd10b07f24ca53913d0adfb480f9433c877bd43fd532fa7f20421c766f3bc46085
TLSH
T1D3F0BB14A231EE642453840E9C93AAFEF50F103437BB1E5545B617219F5F06F41B569D
MD5 SHA1 SHA512 TLSH

Submit Download

larf2ter.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\larf2ter\larf2ter.cmdline
Size 369B
SHA256 5e6dadf9b199f94fc8deadee242fa7ef8dc849293e0dbb0671f6332328955254
MD5 caf7b689bf8f725e9f65c8947c8f1d5d
SHA1 8ad6648e2e0e2feb6f3569bbee3885c11a9c2127
SHA512 4ae8d83aca2a548b18cb7e0dcd04c17b01283e5bc7db1117bb7517781b5113bcd8f67d53c59d1a76a3c7056e06b4426d00ee85b5a7904319f46ad1b695eba4fa
TLSH
T1D6E0C02B4246C2BF11DF10072169C4BCC2724F4329803F8471484D0DE2270492BF2759
MD5 SHA1 SHA512 TLSH

Submit Download

CSC91191F3C902A49558EEB4D5E4944DE61.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vufmjyds\CSC91191F3C902A49558EEB4D5E4944DE61.TMP
Size 652B
SHA256 c71fca54839450372e1ef9f7cd9d3586a3a540e784f136b52a9f65ad6fcfa3d1
MD5 4ce4e7f73d6f248e81a0c2e5fdcbd022
SHA1 b9b0534dbcdc9bf346ad159fefb163b5dfcf0620
SHA512 45a5890e92dac2332454c24c5794da8459c2c42acd21d6985eae10400ba158d165970d85773f42f9cdca55e97d7f0c3fec5613a54d45d6c220d26720991b6f51
TLSH
T1E6F05E1963F8420EF4F35B30BEF643A391A9BC65DE7293ED144443192C646108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vufmjyds.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vufmjyds\vufmjyds.cmdline
Size 369B
SHA256 9fab26d3d7f4687efc179f39dc9ad371ac989f3aecfb591c8e917d279a57d62e
MD5 e34905645cc4247c05d0473d58b5c78b
SHA1 4209fbc67cea9f5cf596b1b0f86be1410aa0b3c8
SHA512 f878cc6098c72a607fb325b39a6b5560104de9c081d147a17587f75ffe675555be6f3b1482482ac08974adb9010608eacac1e959fc554b84c59c4f539af93684
TLSH
T1E1E0D83A9256C6BE1AE9100735A9E9BCE2720A4B2A517FA86154C49DE03B00C77D17E6
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFA920D78A7784ECABB1C37D54337E0C3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xwkeeq4w\CSCFA920D78A7784ECABB1C37D54337E0C3.TMP
Size 652B
SHA256 af55c49fc80f12dc781c6a0c9212f5b28d3361043999464cb0b5e49310285560
MD5 6cb1ec93bf423f7923fa46e5e745eeb9
SHA1 0e1871c9c398351e7e603ad3c9db3652b5bec35b
SHA512 4dd7227ccd62cbe8150065aea37a2d6dde249a65329c0d2a67ecdc7e2aad213158687ad9513b25a4fcd01c3f3eacc58d40e967d65af889af2dba021a2710d987
TLSH
T1EFF05E0967F8420EF0F34B31BDF6536391A8BC64DE72A3ED1454032928645108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xwkeeq4w.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xwkeeq4w\xwkeeq4w.cmdline
Size 369B
SHA256 773952ddbb85cce4e53a79c7a52b58ed73b9c12c2f9c8e98fb820426fc5d003f
MD5 ec19012da66f72a4867f82bec6ebaea9
SHA1 73b39162c821f74580d3ade1fd8827479e09cd7d
SHA512 b0bc872f73cca71908c29dd44646dd0bd1ed4ba41f10a40c0c67d4d9312d0cc94f20f5d6263e2d404435735e0806b2844f029ba8c97c63c420b1e7718aa23e0b
TLSH
T152E0C02E4F46C27D11DE1A072169CCACCEF22F8339403F8491C0880DD22700037D3B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/824-25-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-9-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-29-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-28-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-27-0x000002EFF8C70000-0x000002EFF9198000-memory.dmp

Download

memory/824-7-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-26-0x000002EFF8570000-0x000002EFF8732000-memory.dmp

Download

memory/824-30-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-33-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-24-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-32-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-23-0x000002EFF7AE0000-0x000002EFF7AE8000-memory.dmp

Download

memory/824-15-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-3-0x00007FFD38C4F000-0x00007FFD38C50000-memory.dmp

Download

memory/824-8-0x00007FFD38AC0000-0x00007FFD39464000-memory.dmp

Download

memory/824-6-0x000002EFF8350000-0x000002EFF8372000-memory.dmp

Download

memory/1580-78-0x00000242F2CD0000-0x00000242F2CD8000-memory.dmp

Download

memory/5412-55-0x00000294A35D0000-0x00000294A35D8000-memory.dmp

Download