Edit tour
Windows
Analysis Report
setup_it_security (1).msi
Overview
General Information
| Sample name: | setup_it_security (1).msi |
| Analysis ID: | 1488350 |
| MD5: | 4c2ccd8e957c65e8c7ef53c5147066c3 |
| SHA1: | 6cd11864dfe9f061c2a4e599304934d94f8c36e8 |
| SHA256: | 3809affad6dc10de4613edb2c172f47b641b0393270a129b24683ccd30fb39d7 |
| Tags: | msi |
| Infos: |   |
 | |
Detection
AteraAgent
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected AteraAgent
AI detected suspicious sample
Bypasses PowerShell execution policy
Creates files in the system32 config directory
Found suspicious powershell code related to unpacking or dynamic code loading
Installs Task Scheduler Managed Wrapper
Loading BitLocker PowerShell Module
Queries disk data (e.g. SMART data)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive service information (via WMI, MSSMBios_RawSMBiosTables, often done to detect sandboxes)
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Reads the Security eventlog
Reads the System eventlog
Very long command line found
Writes many files with high entropy
Yara detected Generic Downloader
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for available system drives (often done to infect USB drives)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses net.exe to stop services
Uses taskkill to terminate processes
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
msiexec.exe (PID: 6636 cmdline: "C:\Window s\System32 \msiexec.e xe" /i "C: \Users\use r\Desktop\ setup_it_s ecurity (1 ).msi" MD5: E5DA170027542E25EDE42FC54C929077)
- msiexec.exe (PID: 5324 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077) - msiexec.exe (PID: 4888 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng 876136A FC6C35375E 8E539CFFE1 FB058 MD5: 9D09DC1EDA745A5F87553048E57620CF) 
rundll32.exe (PID: 6452 cmdline: rundll32.e xe "C:\Win dows\Insta ller\MSI38 0B.tmp",zz zzInvokeMa nagedCusto mActionOut OfProc Sfx CA_5781625 2 AlphaCo ntrolAgent Installati on!AlphaCo ntrolAgent Installati on.CustomA ctions.Gen erateAgent Id MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7196 cmdline:
rundll32.e xe "C:\Win dows\Insta ller\MSI3C 81.tmp",zz zzInvokeMa nagedCusto mActionOut OfProc Sfx CA_5782703 6 AlphaCo ntrolAgent Installati on!AlphaCo ntrolAgent Installati on.CustomA ctions.Rep ortMsiStar t MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7280 cmdline:
rundll32.e xe "C:\Win dows\Insta ller\MSI4B 86.tmp",zz zzInvokeMa nagedCusto mActionOut OfProc Sfx CA_5786531 10 AlphaC ontrolAgen tInstallat ion!AlphaC ontrolAgen tInstallat ion.Custom Actions.Sh ouldContin ueInstalla tion MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 7908 cmdline:
rundll32.e xe "C:\Win dows\Insta ller\MSI62 10.tmp",zz zzInvokeMa nagedCusto mActionOut OfProc Sfx CA_5792296 32 AlphaC ontrolAgen tInstallat ion!AlphaC ontrolAgen tInstallat ion.Custom Actions.Re portMsiEnd MD5: 889B99C52A60DD49227C5E485A016679) - msiexec.exe (PID: 7332 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng F3FE6E8 483124E644 50C53B6CA0 F2865 E Gl obal\MSI00 00 MD5: 9D09DC1EDA745A5F87553048E57620CF) 
net.exe (PID: 7368 cmdline: "NET" STOP AteraAgen t MD5: 31890A7DE89936F922D44D677F681A7F) 
conhost.exe (PID: 7376 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - net1.exe (PID: 7408 cmdline:
C:\Windows \system32\ net1 STOP AteraAgent MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1) - taskkill.exe (PID: 7432 cmdline:
"TaskKill. exe" /f /i m AteraAge nt.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 7440 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AteraAgent.exe (PID: 7520 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ AteraAgent .exe" /i / Integrator Login="it@ netnut.io" /CompanyI d="1" /Int egratorLog inUI="" /C ompanyIdUI ="" /Folde rId="" /Ac countId="0 01Q300000C DtpOIAT" / AgentId="2 19cfac1-8d 31-4145-a0 6a-203fddd 623c4" MD5: 477293F80461713D51A98A24023D45E8) - msiexec.exe (PID: 3368 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng 3463CFE 313C5F6D68 DABEECB95B 6FC58 E Gl obal\MSI00 00 MD5: 9D09DC1EDA745A5F87553048E57620CF) - rundll32.exe (PID: 8076 cmdline:
rundll32.e xe "C:\Win dows\Insta ller\MSI30 EA.tmp",zz zzInvokeMa nagedCusto mActionOut OfProc Sfx CA_5845281 37 AlphaC ontrolAgen tInstallat ion!AlphaC ontrolAgen tInstallat ion.Custom Actions.Ge nerateAgen tId MD5: 889B99C52A60DD49227C5E485A016679) - rundll32.exe (PID: 404 cmdline:
rundll32.e xe "C:\Win dows\Insta ller\MSI33 D9.tmp",zz zzInvokeMa nagedCusto mActionOut OfProc Sfx CA_5845984 41 AlphaC ontrolAgen tInstallat ion!AlphaC ontrolAgen tInstallat ion.Custom Actions.Re portMsiSta rt MD5: 889B99C52A60DD49227C5E485A016679)
- AteraAgent.exe (PID: 7696 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ AteraAgent .exe" MD5: 477293F80461713D51A98A24023D45E8) - sc.exe (PID: 7812 cmdline:
"C:\Window s\System32 \sc.exe" f ailure Ate raAgent re set= 600 a ctions= re start/2500 0 MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - conhost.exe (PID: 7824 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AgentPackageAgentInformation.exe (PID: 6600 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eAgentInfo rmation\Ag entPackage AgentInfor mation.exe " 219cfac1 -8d31-4145 -a06a-203f ddd623c4 " 80051a9b-3 773-4781-a 860-0a1fa9 902094" ag ent-api.at era.com/Pr oduction 4 43 or8ixLi 90Mf "mini malIdentif ication" 0 01Q300000C DtpOIAT MD5: ACCE8B17DE63299AA4D5CB7D709BEEDC) - conhost.exe (PID: 7028 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AgentPackageAgentInformation.exe (PID: 6532 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eAgentInfo rmation\Ag entPackage AgentInfor mation.exe " 219cfac1 -8d31-4145 -a06a-203f ddd623c4 " d9931af6-1 b9d-44c1-9 ed5-93aefc f99ae5" ag ent-api.at era.com/Pr oduction 4 43 or8ixLi 90Mf "mini malIdentif ication" 0 01Q300000C DtpOIAT MD5: ACCE8B17DE63299AA4D5CB7D709BEEDC) - conhost.exe (PID: 6528 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AgentPackageAgentInformation.exe (PID: 7476 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eAgentInfo rmation\Ag entPackage AgentInfor mation.exe " 219cfac1 -8d31-4145 -a06a-203f ddd623c4 " 54c44644-c 1a6-46f7-9 967-66ad9b d7a25c" ag ent-api.at era.com/Pr oduction 4 43 or8ixLi 90Mf "iden tified" 00 1Q300000CD tpOIAT MD5: ACCE8B17DE63299AA4D5CB7D709BEEDC) - conhost.exe (PID: 7484 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AgentPackageAgentInformation.exe (PID: 7824 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eAgentInfo rmation\Ag entPackage AgentInfor mation.exe " 219cfac1 -8d31-4145 -a06a-203f ddd623c4 " d85c307e-1 608-4140-9 ac8-c846e7 08cdc6" ag ent-api.at era.com/Pr oduction 4 43 or8ixLi 90Mf "gene ralinfo fr omGui" 001 Q300000CDt pOIAT MD5: ACCE8B17DE63299AA4D5CB7D709BEEDC) - conhost.exe (PID: 7524 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 3912 cmdline:
"C:\Window s\System32 \cmd.exe" /c cscript "C:\Progr am Files ( x86)\Micro soft Offic e\Office16 \ospp.vbs" /dstatus MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8024 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
cscript.exe (PID: 8072 cmdline: cscript "C :\Program Files (x86 )\Microsof t Office\O ffice16\os pp.vbs" /d status MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD) 
powershell.exe (PID: 1028 cmdline: "powershel l.exe" Set -Execution Policy Byp ass -Scope CurrentUs er MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7376 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 1448 cmdline:
"cmd.exe" /c powersh ell.exe -F ile "C:\Pr ogram File s (x86)\Mi crosoft Of fice\Offic e16\vNextD iag.ps1" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2148 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 412 cmdline:
powershell .exe -File "C:\Progr am Files ( x86)\Micro soft Offic e\Office16 \vNextDiag .ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) - AgentPackageMonitoring.exe (PID: 7356 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eMonitorin g\AgentPac kageMonito ring.exe" 219cfac1-8 d31-4145-a 06a-203fdd d623c4 "8e 4f2c67-221 1-44b9-9c5 e-9e2f7f6d 852f" agen t-api.ater a.com/Prod uction 443 or8ixLi90 Mf "syncpr ofile" 001 Q300000CDt pOIAT MD5: B50005A1A62AFA85240D1F65165856EB) - conhost.exe (PID: 7332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- AteraAgent.exe (PID: 1528 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ AteraAgent .exe" MD5: 477293F80461713D51A98A24023D45E8) - sc.exe (PID: 7672 cmdline:
"C:\Window s\System32 \sc.exe" f ailure Ate raAgent re set= 600 a ctions= re start/2500 0 MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - conhost.exe (PID: 7792 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AgentPackageUpgradeAgent.exe (PID: 7224 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eUpgradeAg ent\AgentP ackageUpgr adeAgent.e xe" 219cfa c1-8d31-41 45-a06a-20 3fddd623c4 "dfef552b -734e-4f27 -813c-95ef 61915f0e" agent-api. atera.com/ Production 443 or8ix Li90Mf "ch eckforupda tes" 001Q3 00000CDtpO IAT MD5: 6095B43FA565DA44E7A818CFB4BACBA2) - conhost.exe (PID: 7240 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - msiexec.exe (PID: 6328 cmdline:
"msiexec.e xe" /i C:\ Windows\TE MP\ateraAg entSetup64 _1_8_7_2.m si /lv* At eraSetupLo g.txt /qn /norestart MD5: E5DA170027542E25EDE42FC54C929077) - AgentPackageSTRemote.exe (PID: 7324 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eSTRemote\ AgentPacka geSTRemote .exe" 219c fac1-8d31- 4145-a06a- 203fddd623 c4 "1a1cdc 7d-4148-4f 2b-a60e-77 0bbe4296d3 " agent-ap i.atera.co m/Producti on 443 or8 ixLi90Mf " downloadif needed" 00 1Q300000CD tpOIAT MD5: A86B9D7A0085275F89BBD0878DBDEE3B) - conhost.exe (PID: 7028 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AgentPackageTicketing.exe (PID: 7428 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eTicketing \AgentPack ageTicketi ng.exe" 21 9cfac1-8d3 1-4145-a06 a-203fddd6 23c4 "fd22 9431-cfd0- 4a48-9506- 52dcbd66ec e5" agent- api.atera. com/Produc tion 443 o r8ixLi90Mf "maintain " 001Q3000 00CDtpOIAT MD5: B0E08EBA67B6AAB9E4CD11E3CC0D9988) - conhost.exe (PID: 7464 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - AgentPackageRuntimeInstaller.exe (PID: 2720 cmdline:
"C:\Progra m Files (x 86)\ATERA Networks\A teraAgent\ Packages\A gentPackag eRuntimeIn staller\Ag entPackage RuntimeIns taller.exe " 219cfac1 -8d31-4145 -a06a-203f ddd623c4 " 8f7a044c-9 35b-42c2-8 dbd-e9da15 a52a0d" ag ent-api.at era.com/Pr oduction 4 43 or8ixLi 90Mf "eyJD b21tYW5kTm FtZSI6Imlu c3RhbGxkb3 RuZXQiLCJE b3ROZXRWZX JzaW9uIjoi Ni4wLjMyIi wiTWFjQVJN RG93bmxvYW RVcmwiOiJo dHRwczovL2 Rvd25sb2Fk LnZpc3VhbH N0dWRpby5t aWNyb3NvZn QuY29tL2Rv d25sb2FkL3 ByLzNiMTFi ZDM4LTU4Zm QtNDc4My05 ZDdmLWUxOG UwNDA5ZmU2 YS9hM2RmNG M3ZWJmZjhm YzJjNjdkN2 M5ZjU1MThm YjdmZC9kb3 RuZXQtcnVu dGltZS02Lj AuMzItb3N4 LWFybTY0Ln BrZyIsIk1h Y1g2NERvd2 5sb2FkVXJs IjoiaHR0cH M6Ly9kb3du bG9hZC52aX N1YWxzdHVk aW8ubWljcm 9zb2Z0LmNv bS9kb3dubG 9hZC9wci9h YTBiMWY3MS 04ZGZjLTRi MWItOTUyNS 0yMjQ5Y2Q0 N2NkN2QvZW RkNDJjM2Yy YmYxMTEwNj czNTVhZTFk NDU5OGZhNT EvZG90bmV0 LXJ1bnRpbW UtNi4wLjMy LW9zeC14Nj QucGtnIiwi V2luQVJNRG 93bmxvYWRV cmwiOiJodH RwczovL2Rv d25sb2FkLn Zpc3VhbHN0 dWRpby5taW Nyb3NvZnQu Y29tL2Rvd2 5sb2FkL3By L2I2ZGIyMj YxLTQyODgt NDc0Zi04Nz YyLTRlZTA2 YmNiMTIyNy 9lOGIxNDU4 ZWE5ZjgyYj kwZTYzYmU4 ZmU4YjlmMj c3NS9kb3Ru ZXQtcnVudG ltZS02LjAu MzItd2luLW FybTY0LmV4 ZSIsIldpbl g2NERvd25s b2FkVXJsIj oiaHR0cHM6 Ly9kb3dubG 9hZC52aXN1 YWxzdHVkaW 8ubWljcm9z b2Z0LmNvbS 9kb3dubG9h ZC9wci80NT E1YWFhYS1j N2Q1LTQwYm YtYjdmZC1m NDc2ZDZlYT NiMWEvYzU0 NWVhOTJkYm Q1Mzc3NTNh ZWZiOTM3ND c4ZmQ1MzIv ZG90bmV0LX J1bnRpbWUt Ni4wLjMyLX dpbi14NjQu ZXhlIiwiV2 luWDg2RG93 bmxvYWRVcm wiOiJodHRw czovL2Rvd2 5sb2FkLnZp c3VhbHN0dW Rpby5taWNy b3NvZnQuY2 9tL2Rvd25s b2FkL3ByLz Q4ZWRkZTFl LTFlOGYtNG RiNi1iNGRj LWM4ODI1NT ZkZGE0Yi8w ODRhZjllNT Q2ODZmNzBh OGRhZWNlYT JkMmZiZTJj Yi9kb3RuZX QtcnVudGlt ZS02LjAuMz Itd2luLXg4 Ni5leGUiLC JNYWNBUk1D aGVja3N1bS I6ImszRlZu UDdFQ25zUW dITm92ZTBv ZmFVNXgzVF VHVDZkOFk3 TmFwbTZPZW puNXBpVXNo Zlcwczc1Qk JhVUR6T3hr NmxXL01BOF JnM2pqTVFI ai9Eb3lRPT 0iLCJNYWNY NjRDaGVja3 N1bSI6IjZ2 bUxDeVFPSn BrUkFtSDMx UnRYZE9tSn FuQkZEXHUw MDJCZ1VGeW xzN3hjSldv WmZcdTAwMk Juc25WWWtR c2JIYWV0TX VUcm8xaWRM cDhSVnl6Rj E4NmFLQUNo SkZnUT09Ii wiV2luQVJN Q2hlY2tzdW 0iOiJ3eG02 bWxhZkdzWX pPTmh4WVBL SW85a3RBVk N0WC94MGVu a0s0RjAwUH JQMm9FSTI3 aXFPNTh2ak FEOHpITUMw enRYNnBBWW ZNb0hEMXoy czYzcm5SQT 09IiwiV2lu WDY0Q2hlY2 tzdW0iOiI1 Ry9MOVhSM2 J0R0ZrcGFo aHpTdkVDcV NIb3J1d0Fh ZTZVdkk4az FNYWFvb3Ni RmR5Nk4xU3 NHdFB2NEpu SUs4UmxPVU tUSHU2NFZM THRCb1RWTH FoUT09Iiwi V2luWDg2Q2 hlY2tzdW0i OiJTZU51SV x1MDAyQkhM aTM0L0JQL1 ZKcHFqb2Fa eVZDY1ZLVn NhQUdtalc5 dWJyeUFrZ3 pkZ2wwS2xj NENuT2ljZ0 1Mb2R4dVNV cU9SeVRJbU dZWmVGSzlM bW1RPT0iLC JXb3Jrc3Bh Y2VJZCI6Im JmMGNlNDlk LTc3Y2YtND cyMS1iZjcw LTU3Njg2Mz gzYzlhYiIs IkxvZ05hbW UiOiJEb3RO ZXRSdW50aW 1lSW5zdGFs bGF0aW9uUm Vwb3J0Iiwi U2hhcmVkS2 V5IjoialVJ Uy9UOUNSVk RlS3hZZzRV cjNhQ2hoV1